Re: [PATCH v6 5/7] KVM: arm64: Support FFA_NOTIFICATION_GET in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] `do_ffa_notif_set` fails to validate the upper 16 bits of the flags parameter, violating the MBZ requirement before proxying the call to TrustZone.
--

commit dc6778bf3607c00222a50fb85f58ca74257482ea
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_GET in host handler

Allow FF-A notification GET messages to be proxied from the pKVM
hypervisor to Trustzone and verify the arguments sent from the host
driver.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index 2bb16aa414f9f..c22fe45147414 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
[ ... ]
> @@ -938,6 +937,27 @@ static void do_ffa_notif_set(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }

[Severity: Medium]
This is a pre-existing issue, but looking at do_ffa_notif_set() just above
this diff, it uses GENMASK(15, 2) to validate the flags parameter:

arch/arm64/kvm/hyp/nvhe/ffa.c:do_ffa_notif_set() {
    ...
	if (flags & GENMASK(15, 2)) {
		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
		return;
	}
    ...
}

Does this fail to validate the upper 16 bits of the flags parameter?

The FF-A 1.1 specification defines bits [31:2] of the flags parameter (W2)
in FFA_NOTIFICATION_SET as Reserved (Must Be Zero).

By using GENMASK(15, 2), the validation logic only checks if bits 2 through 15
are zero, ignoring bits 16 through 31. This allows unvalidated, non-zero
reserved bits to bypass the strict MBZ checks and be forwarded to EL3.

>  
> +static void do_ffa_notif_get(struct arm_smccc_1_2_regs *res,
> +			     struct kvm_cpu_context *ctxt)
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626074545.433234-1-sebastianene@google.com?part=5