Re: [PATCH v9 4/6] KVM: arm64: Validate the offset to the mem access descriptor

[Vincent Donnefort via OP-TEE <op-tee@lists.trustedfirmware.org>]

On Thu, Jul 02, 2026 at 10:38:41AM +0000, Sebastian Ene wrote:
> Prevent the pKVM hypervisor from making assumptions that the
> endpoint memory access descriptor (EMAD) comes right after the
> FF-A memory region header.
> Prior to FF-A version 1.1 the header of the memory region
> didn't contain an offset to the endpoint memory access descriptor.
> The layout of a memory transaction looks like this from 1.1 onward:
> Type | Field name | Offset
> [ Header | ffa_mem_region  | 0
>   EMAD 1 | ffa_mem_region_attributes) | ffa_mem_region.ep_mem_offset
> ]
> Verify that the offset to the first endpoint memory access descriptor
> is within the mailbox buffer bounds.
> 
> Also, fix one hardcoded sizeof(struct ffa_mem_region_attributes) that
> should be replaced ffa_emad_size_get() for compatibility with FFA v1.0.
> 
> Fixes: 42fb33dde42b ("KVM: arm64: Use FF-A 1.1 with pKVM")
> Signed-off-by: Mostafa Saleh <smostafa@google.com>
> Signed-off-by: Sebastian Ene <sebastianene@google.com>

Reviewed-by: Vincent Donnefort <vdonnefort@google.com>

> ---
>  arch/arm64/kvm/hyp/nvhe/ffa.c | 27 +++++++++++++++++++--------
>  include/linux/arm_ffa.h       |  7 +++++++
>  2 files changed, 26 insertions(+), 8 deletions(-)
> 
[...]

> diff --git a/include/linux/arm_ffa.h b/include/linux/arm_ffa.h
> index 033c630b271b..e71d83ee0aef 100644
> --- a/include/linux/arm_ffa.h
> +++ b/include/linux/arm_ffa.h
> @@ -421,6 +421,13 @@ struct ffa_mem_region {
>  #define FFA_EMAD_HAS_IMPDEF_FIELD(version)	((version) >= FFA_VERSION_1_2)
>  #define FFA_MEM_REGION_HAS_EP_MEM_OFFSET(version) ((version) > FFA_VERSION_1_0)
>  
> +/* The layout changed from FFA_VERSION_1_0 and the region includes an
> + * ep_mem_offset.
> + */

nit: Coding-style.

> +#define FFA_MEM_REGION_SZ(version)		(!FFA_MEM_REGION_HAS_EP_MEM_OFFSET((version)) ?\
> +						 offsetof(struct ffa_mem_region, ep_mem_offset) :\
> +						 sizeof(struct ffa_mem_region))

nit: Could avoid the ! by just swapping the two expressions.

> +
>  static inline u32 ffa_emad_size_get(u32 ffa_version)
>  {
>  	u32 sz;
> -- 
> 2.55.0.rc0.799.gd6f94ed593-goog
>