Re: [PATCH v7 3/7] KVM: arm64: Support FFA_NOTIFICATION_UNBIND in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The FFA_NOTIFICATION_UNBIND handler incorrectly treats the W2 parameter as a reserved field and forces it to be zero, which violates the FF-A specification and breaks valid unbind operations.
--

commit 607a657720d57d669adb319d0385db08fa611fcc
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_UNBIND in host handler

This commit adds support for the FFA_NOTIFICATION_UNBIND host handler by
verifying the arguments and forwarding the message to TrustZone. It extracts
the endpoint ID and verifies that the correct host FF-A ID is used before
allowing the unbind operation to proceed.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
[ ... ]
> @@ -897,6 +896,27 @@ static void do_ffa_notif_bind(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }
>  
> +static void do_ffa_notif_unbind(struct arm_smccc_1_2_regs *res,
> +				struct kvm_cpu_context *ctxt)
> +{
> +	DECLARE_REG(u32, endp_id, ctxt, 1);
> +	DECLARE_REG(u32, reserved, ctxt, 2);
> +	struct arm_smccc_1_2_regs *args;
> +
> +	if (reserved) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}

[Severity: High]
Does this incorrectly reject valid unbind operations? The FF-A specification
defines W2 as the Notification ID(s) Low bitmap for unbind requests. 

By declaring W2 as reserved and forcing it to zero, it looks like this handler
prevents the host from unbinding any notifications that use the lower 32 bits
of the Notification ID bitmap.

Additionally, should there be an ffa_check_unused_args_sbz() call here to
verify the remaining unused registers are zeroed out, similar to the other
handlers?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629093558.2425257-1-sebastianene@google.com?part=3