Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "arm64:

   - Fix an accounting buglet when reclaiming pages from a protected
     guest

   - Fix a bunch of architectural compliance issues when injecting a
     synthesised exception, most of which were missing the PSTATE.IL bit
     indicating a 32bit-wide instruction

   - Another set of fixes addressing issues with translation of
     VNCR_EL2, including corner cases where the guest point that
     register at a RO page...

   - Don't warn when trapping accesses to ZCR_EL2 from an L2 guest, as
     that's not unexpected at all

   - Address a bunch of races with LPI migration vs LPIs being disabled

   - Fix a total howler of a bug combining FEAT_MOPS and NV, resulting
     in exception returning in the wrong place...

   - Move locking for kvm_io_bus_get_dev() into the caller, ensuring
     race-free checks that the returned object is of the correct type

   - Fix initialisation of the page-table walk level when relaxing
     permissions

   - Correctly update the XN attribute when relaxing permissions

   - Fix the sign extension of loads from emulated MMIO regions

   - Assorted collection of fixes for pKVM's FFA proxy, together with a
     couple of FFA driver adjustments

   - Coerce Fuad Tabba into a reviewer role, and may his Inbox catch
     fire!

  s390:

   - more gmap KVM memory management fixes

   - PCI passthru fixes

  x86:

   - Fix a bug where KVM will trigger a UAF if updating IOMMU IRTEs
     fails when registering an IRQ-bypass producer

   - Ignore pending PV EOI instead of BUG()ing the host if the feature
     was disabled by the guest

   - Fix nVMX bugs where KVM would run L1 with an L1-controlled CR3
     after a failed "late" consistency check when KVM is NOT using EPT

   - Disallow intra-host migration/mirroring of SNP VMs as KVM doesn't
     yet support moving/mirroring SNP state

   - Fix a TOCTOU bug in KVM's handling of the "trusted" CPUID for TDX
     guests

   - Fix a NULL pointer deref in trace_kvm_inj_exception() where a
     change to the core infrastructure missed KVM's unique (ab)use of
     __print_symbolic()

   - Put vmcs12 pages if nested VM-Enter fails due to invalid guest
     state

   - Fix TLB conflicts between two VMs if one of them VM is run on a CPU
     before and after it is hotplugged"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (48 commits)
  KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
  KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
  KVM: x86: Fix null pointer deref due to dummy array in trace_kvm_inj_exception()
  KVM: TDX: Reject concurrent change to CPUID entry count
  KVM: selftests: Verify SNP VMs are rejected from migration and mirroring
  KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
  KVM: s390: pci: Fix handling of AIF enable without AISB
  KVM: s390: Improve kvm_s390_vm_stop_migration()
  KVM: s390: Fix dat_crste_walk_range() early return
  KVM: s390: vsie: Avoid potential deadlock with real spaces
  KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
  KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabled
  KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks
  KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
  KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
  KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
  firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
  firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
  KVM: arm64: Zero out the stack initialized data in the FFA handler
  KVM: arm64: Ensure FFA ranges are page aligned
  ...

1 files changed, 8 insertions, 1 deletions

diff --git a/include/linux/arm_ffa.h b/include/linux/arm_ffa.h
index 17eca3dfc59e..e71d83ee0aef 100644
--- a/include/linux/arm_ffa.h
+++ b/include/linux/arm_ffa.h
@@ -421,6 +421,13 @@ struct ffa_mem_region {
 #define FFA_EMAD_HAS_IMPDEF_FIELD(version)	((version) >= FFA_VERSION_1_2)
 #define FFA_MEM_REGION_HAS_EP_MEM_OFFSET(version) ((version) > FFA_VERSION_1_0)
 
+/* The layout changed from FFA_VERSION_1_0 and the region includes an
+ * ep_mem_offset.
+ */
+#define FFA_MEM_REGION_SZ(version)		(!FFA_MEM_REGION_HAS_EP_MEM_OFFSET((version)) ?\
+						 offsetof(struct ffa_mem_region, ep_mem_offset) :\
+						 sizeof(struct ffa_mem_region))
+
 static inline u32 ffa_emad_size_get(u32 ffa_version)
 {
 	u32 sz;
@@ -445,7 +452,7 @@ ffa_mem_desc_offset(struct ffa_mem_region *buf, int count, u32 ffa_version)
 	if (!FFA_MEM_REGION_HAS_EP_MEM_OFFSET(ffa_version))
 		offset += offsetof(struct ffa_mem_region, ep_mem_offset);
 	else
-		offset += sizeof(struct ffa_mem_region);
+		offset += buf->ep_mem_offset;
 
 	return offset;
 }