Re: [PATCH v7 7/7] KVM: arm64: Enforce strict SBZ checks in the FF-A proxy

[Will Deacon]

On Mon, Jun 29, 2026 at 09:35:58AM +0000, Sebastian Ene wrote:
> Introduce a helper method ffa_check_unused_args_sbz to enforce strict
> arguments checking when the hypervisor acts as a relayer between the
> host and Trustzone.
> 
> Signed-off-by: Sebastian Ene <sebastianene@xxxxxxxxxx>
> Reviewed-by: Vincent Donnefort <vdonnefort@xxxxxxxxxx>
> Acked-by: Will Deacon <will@xxxxxxxxxx>
> ---
>  arch/arm64/kvm/hyp/nvhe/ffa.c | 96 ++++++++++++++++++++++++++++++++++-
>  1 file changed, 95 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index 712811e89435..334f8a28d942 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -74,6 +74,21 @@ static u32 hyp_ffa_version;
>  static bool has_version_negotiated;
>  static hyp_spinlock_t version_lock;
>  
> +static bool ffa_check_unused_args_sbz(struct kvm_cpu_context *ctxt, int first_reg)
> +{
> +	DECLARE_REG(u32, func_id, ctxt, 0);
> +	int reg, end_reg = 7;
> +
> +	if (hyp_ffa_version >= FFA_VERSION_1_2 && ARM_SMCCC_IS_64(func_id))
> +		end_reg = 17;

Sashiko gets angry about this check, but I don't think we need to change
anything. Yes, there is a data race on hyp_ffa_version if you issue
FFA_VERSION concurrently with itself, but FFA_VERSION is a 32-bit call
so it's all moot.

In fact, a 64-bit FFA_VERSION would be problematic for other reasons,
because a single (non-racy) CPU trying to attempt a version downgrade
could end up passing non-zero values in registers that SBZ in the running
version (of which it knows nothing about).

So my Ack stands.

Will