[PATCH v6 7/7] KVM: arm64: Enforce strict SBZ checks in the FF-A proxy

[Sebastian Ene]

On Fri, Jun 26, 2026 at 10:11:14AM +0100, Will Deacon wrote:
> On Fri, Jun 26, 2026 at 07:45:45AM +0000, Sebastian Ene wrote:
> > Introduce a helper method ffa_check_unused_args_sbz to enforce strict
> > arguments checking when the hypervisor acts as a relayer between the
> > host and Trustzone.
> > 
> > Signed-off-by: Sebastian Ene <sebastianene at google.com>
> > Reviewed-by: Vincent Donnefort <vdonnefort at google.com>
> > ---
> >  arch/arm64/kvm/hyp/nvhe/ffa.c | 96 ++++++++++++++++++++++++++++++++++-
> >  1 file changed, 95 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> > index 712811e89435..bd50ddc5b61c 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> > @@ -74,6 +74,21 @@ static u32 hyp_ffa_version;
> >  static bool has_version_negotiated;
> >  static hyp_spinlock_t version_lock;
> >  
> > +static bool ffa_check_unused_args_sbz(struct kvm_cpu_context *ctxt, int first_reg)
> > +{
> > +	DECLARE_REG(u32, func_id, ctxt, 0);
> > +	int reg, end_reg = 7;
> > +
> > +	if (FFA_MINOR_VERSION(hyp_ffa_version) >= 2)
> > +		end_reg = ARM_SMCCC_IS_64(func_id) ? 17 : 7;
> 
> This looks like an accident waiting to happen if we don't check the major
> number as well.
> 
> I think you should just check:
> 
> 	if (hyp_ffa_version >= FFA_VERSION_1_2)
> 
> instead.
> 
> You should also add a comment.

We restrict hyp_ffa_version major to 1.0 here
https://elixir.bootlin.com/linux/v7.1.1/source/arch/arm64/kvm/hyp/nvhe/ffa.c#L962
but since this is an easy fix I will include it.

> 
> Will

Sebastian