Re: [PATCH v8 5/7] KVM: arm64: Support FFA_NOTIFICATION_GET in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing validation of unused MBZ (Must Be Zero) arguments in `do_ffa_notif_get` before forwarding to EL3.
--

--- Patch [5]: [PATCH v8 5/7] KVM: arm64: Support FFA_NOTIFICATION_GET in host handler ---
commit cd049d1e9c7b39f84753d7230fd609869137d4ae
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_GET in host handler

This patch adds support for proxying FF-A notification GET messages from
the pKVM hypervisor to TrustZone, validating the endpoint and flag
arguments sent from the host driver.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c

[ ... ]

> @@ -938,6 +937,27 @@ static void do_ffa_notif_set(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }
>  
> +static void do_ffa_notif_get(struct arm_smccc_1_2_regs *res,
> +			     struct kvm_cpu_context *ctxt)
> +{
> +	DECLARE_REG(u32, endp_id, ctxt, 1);
> +	DECLARE_REG(u32, flags, ctxt, 2);
> +	struct arm_smccc_1_2_regs *args;
> +

[Severity: Medium]
Should this function verify that the unused registers are zero before
forwarding the raw context to EL3?

Looking at do_ffa_notif_bind() and do_ffa_notif_unbind(), they use
ffa_check_unused_args_sbz() to ensure unused registers are cleared. Without
a similar check here, could an untrusted host pass unvalidated data in the
remaining registers (x3-x17) directly to the SPMD?

> +	if (FIELD_GET(FFA_NOTIF_RECEIVER_ENDP_MASK, endp_id) != HOST_FFA_ID) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	if (flags & GENMASK(31, 4)) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	args = (void *)&ctxt->regs.regs[0];
> +	hyp_smccc_1_2_smc(args, res);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729121306.1519473-2-sebastianene@google.com?part=5