Re: [PATCH v6 4/7] KVM: arm64: Support FFA_NOTIFICATION_SET in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Incomplete validation of host-supplied `flags` (MBZ bits) before proxying FFA_NOTIFICATION_SET to EL3.
--

commit 390edd982e712bdb39d83c8b5c1be4b16e311bcb
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_SET in host handler

Allow FF-A notification SET messages to be proxied from the pKVM
hypervisor to Trustzone and verify the arguments.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index d52d7c4d5e7f5..2bb16aa414f9f 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c

[ ... ]

> @@ -917,6 +917,27 @@ static void do_ffa_notif_unbind(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }
>  
> +static void do_ffa_notif_set(struct arm_smccc_1_2_regs *res,
> +			     struct kvm_cpu_context *ctxt)
> +{
> +	DECLARE_REG(u32, endp_id, ctxt, 1);
> +	DECLARE_REG(u32, flags, ctxt, 2);
> +	struct arm_smccc_1_2_regs *args;
> +
> +	if (FIELD_GET(FFA_NOTIF_SENDER_ENDP_MASK, endp_id) != HOST_FFA_ID) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	if (flags & GENMASK(15, 2)) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}

[Severity: Medium]
Does this validation check miss the upper 16 bits of the flags register?

According to the FF-A specification for FFA_NOTIFICATION_SET, when bit 0 of 
the flags is 0 (global notification), bits [31:16] must be zero (MBZ). Since
this check only covers GENMASK(15, 2), it appears the host could pass
unvalidated data in the upper 16 bits of the flags argument to Trustzone.

Should this check be expanded to enforce the MBZ requirement on bits [31:16]
before proxying the hypercall to EL3?

> +
> +	args = (void *)&ctxt->regs.regs[0];
> +	hyp_smccc_1_2_smc(args, res);
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626074545.433234-1-sebastianene@google.com?part=4