Re: [PATCH 3/6] xen/arm: ffa: Tighten notification parameter validation

[Bertrand Marquis <Bertrand.Marquis@xxxxxxx>]

Hi Jens,

> On 22 Apr 2026, at 13:36, Jens Wiklander <jens.wiklander@xxxxxxxxxx> wrote:
> 
> Hi Bertand,
> 
> On Fri, Apr 17, 2026 at 3:41 PM Bertrand Marquis
> <bertrand.marquis@xxxxxxx> wrote:
>> 
>> The notification handlers still validate overlapping subsets of their
>> inputs. BIND, UNBIND, and SET each decode caller and destination IDs
>> locally, GET still accepts a non-zero receiver vCPU ID and reserved flag
>> bits, and SET still accepts non-zero NS-virtual flags. BIND also treats
>> unsupported non-zero flag encodings as a supported-feature failure
>> instead of as malformed input.
>> 
>> Add ffa_notif_parse_params() and use it to centralize the common
>> caller/destination and non-zero bitmap checks for BIND, UNBIND, and SET.
>> Also reject malformed GET and SET requests locally before touching
>> cached state or forwarding anything to the SPMC. Keep BIND limited to
>> global notifications and reject unsupported non-zero flag encodings with
>> INVALID_PARAMETERS.
>> 
>> - add a shared parameter parser for notification caller/destination
>>  validation
>> - wire BIND and UNBIND through the shared parser and reject unsupported
>>  bind flag encodings with INVALID_PARAMETERS
>> - reject non-zero receiver vCPU and reserved flag bits in
>>  FFA_NOTIFICATION_GET
>> - reject non-zero flags in the NS-virtual FFA_NOTIFICATION_SET path
>> 
>> Functional impact: malformed notification requests are rejected
>> consistently earlier in the mediator.
>> 
>> Signed-off-by: Bertrand Marquis <bertrand.marquis@xxxxxxx>
>> ---
>> xen/arch/arm/tee/ffa_notif.c | 61 +++++++++++++++++++++++++++++-------
>> 1 file changed, 50 insertions(+), 11 deletions(-)
>> 
>> diff --git a/xen/arch/arm/tee/ffa_notif.c b/xen/arch/arm/tee/ffa_notif.c
>> index d15119409a25..491db3b04df5 100644
>> --- a/xen/arch/arm/tee/ffa_notif.c
>> +++ b/xen/arch/arm/tee/ffa_notif.c
>> @@ -42,21 +42,40 @@ static void inject_notif_pending(struct domain *d)
>>                d);
>> }
>> 
>> +static int32_t ffa_notif_parse_params(uint16_t dom_id, uint16_t caller_id,
>> +                                      uint16_t dest_id, uint32_t bitmap_lo,
>> +                                      uint32_t bitmap_hi)
> 
> Nit: I would have picked ffa_notif_validate_params() or
> ffa_notif_check_params(), but that might be more a matter of taste.

Agree, I will rename it to validate_params.


> Anyway, looks good:
> Reviewed-by: Jens Wiklander <jens.wiklander@xxxxxxxxxx>

Thanks
Bertrand