Re: [PATCH v8 6/7] KVM: arm64: Support FFA_NOTIFICATION_INFO_GET in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] FFA_NOTIFICATION_INFO_GET is passed through directly to EL3 without proxying the RX buffer, causing the host to read stale data when there are more than 5 endpoints.
--

--- Patch [6]: [PATCH v8 6/7] KVM: arm64: Support FFA_NOTIFICATION_INFO_GET in host handler ---
commit 027209aeedfc445dc1a85dadbbed6fe91255d566
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_INFO_GET in host handler

This commit allows the host to send FF-A notification queries to Trustzone and
proxies these messages from pKVM by removing FFA_NOTIFICATION_INFO_GET from
the unsupported calls list.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index c22fe45147414..712811e894352 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -678,8 +678,6 @@ static bool ffa_call_supported(u64 func_id)
>  	case FFA_RXTX_MAP:
>  	case FFA_MEM_DONATE:
>  	case FFA_MEM_RETRIEVE_REQ:
> -       /* Optional notification interfaces added in FF-A 1.1 */
> -	case FFA_NOTIFICATION_INFO_GET:

[Severity: High]
Does this code successfully proxy the RX buffer when there are more than 5
endpoints with pending notifications?

According to the FF-A specification (v1.1, section 17.5.2), when more than 5
endpoints have pending notifications, EL3 returns the notification array in
the caller's RX buffer.

Because EL2 passes the call through natively without a dedicated proxy
handler in kvm_host_ffa_handler(), EL3 will write the data into EL2's
hyp_buffers.rx.

Without a proxy handler to copy this data to host_buffers.rx (like is done
for FFA_PARTITION_INFO_GET), won't the host read stale or garbage data from
its own buffer?

Furthermore, does this direct pass-through modify EL3's RX buffer state to
Full without EL2 synchronizing via host_buffers.lock?

>  	/* Optional interfaces added in FF-A 1.2 */
>  	case FFA_MSG_SEND_DIRECT_REQ2:		/* Optional per 7.5.1 */
>  	case FFA_MSG_SEND_DIRECT_RESP2:		/* Optional per 7.5.1 */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729121306.1519473-2-sebastianene@google.com?part=6