Re: [PATCH v8 1/7] KVM: arm64: Forward FFA_NOTIFICATION_BITMAP calls to Trustzone

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing validation of reserved (MBZ) arguments before forwarding FFA_NOTIFICATION_BITMAP_CREATE and FFA_NOTIFICATION_BITMAP_DESTROY to EL3.
--

--- Patch [1]: [PATCH v8 1/7] KVM: arm64: Forward FFA_NOTIFICATION_BITMAP calls to Trustzone ---
commit 7c773174b9942d3484859ba47f60655d48005460
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Forward FFA_NOTIFICATION_BITMAP calls to Trustzone

This commit allows FF-A notification bitmap messages to be forwarded to
Trustzone from the host kernel driver. It implements a new handler that
enforces the host VMID check before forwarding the call.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index 1af722771178a..ecc13b795f2c3 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c

[ ... ]

> @@ -862,6 +860,21 @@ static void do_ffa_part_get(struct arm_smccc_1_2_regs *res,
>  	hyp_spin_unlock(&host_buffers.lock);
>  }
>  
> +static void do_ffa_notif_bitmap(struct arm_smccc_1_2_regs *res,
> +				struct kvm_cpu_context *ctxt)
> +{
> +	DECLARE_REG(u32, vmid, ctxt, 1);
> +	struct arm_smccc_1_2_regs *args;
> +
> +	if (vmid != HOST_FFA_ID) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +

[Severity: Medium]
Does this missing SBZ check allow the host to pass arbitrary data in reserved
registers to EL3?

The FF-A specification requires unused arguments in these hypercalls to be
zero (MBZ). By not checking them here, EL2 forwards the raw host register
context (such as w3-w17) directly to EL3.

Other FF-A handlers in this file enforce this using
ffa_check_unused_args_sbz().

Could we add a call to ffa_check_unused_args_sbz() before forwarding the
call, to ensure we don't unnecessarily expand the attack surface of the
SPMD/SPMC in TrustZone?

> +	args = (void *)&ctxt->regs.regs[0];
> +	hyp_smccc_1_2_smc(args, res);
> +}
> +
>  bool kvm_host_ffa_handler(struct kvm_cpu_context *host_ctxt, u32 func_id)

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729121306.1519473-2-sebastianene@google.com?part=1