Re: [PATCH v5 7/7] KVM: arm64: Support FFA_NOTIFICATION_INFO_GET in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Overly strict validation of the W1 parameter in `do_ffa_notif_info_get` incorrectly treats it as a Should-Be-Zero (SBZ) field, rejecting valid `FFA_NOTIFICATION_INFO_GET` requests.
--

commit 8b1c1179ab464455664a3ac244072d9355b5e039
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_INFO_GET in host handler

This commit allows the host to query the FF-A notification status by proxying
the info get message to Trustzone, whilst ensuring that the SBZ fields are
enforced.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index 053efd99bf110..5539fb0d246ee 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
[ ... ]
> @@ -1028,6 +1026,20 @@ static void do_ffa_notif_get(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }
>  
> +static void do_ffa_notif_info_get(struct arm_smccc_1_2_regs *res,
> +				  struct kvm_cpu_context *ctxt)
> +{
> +	struct arm_smccc_1_2_regs *args;
> +
> +	if (ffa_check_unused_args_sbz(ctxt, 1)) {

[Severity: Medium]
Does this overly strict validation reject valid requests?

For FFA_NOTIFICATION_INFO_GET, W1 is used to specify the ID type (e.g., 1 for
Partition/vCPU IDs). By starting the unused arguments check at index 1, this
incorrectly treats the ID type parameter as a Should-Be-Zero field.

If the host attempts to query notification info for specific partitions or
vCPUs by setting W1 to a non-zero valid ID list type, this will return
FFA_RET_INVALID_PARAMETERS.

Should the SBZ check start from a later index instead?

> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	args = (void *)&ctxt->regs.regs[0];
> +	hyp_smccc_1_2_smc(args, res);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623115354.632361-1-sebastianene@google.com?part=7