[PATCH 0/2] firmware: arm_ffa: Fix RXTX_MAP buffer size regressions

[Seth Forshee]

On Tue, Jun 02, 2026 at 05:51:10PM +0100, Sudeep Holla wrote:
> On Mon, Jun 01, 2026 at 03:45:10PM -0500, Seth Forshee wrote:
> > Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size
> > during RXTX_MAP") caused a regression for some FF-A implementations. It
> > has the effect of passing the size of the page-aligned buffers to
> > FFA_RXTX_MAP, which may be larger than the maximum size supported by the
> > SPMC. When this happens FFA_RXTX_MAP will fail with INVALID_PARAMETERS.
> > 
> > The following patches deal with two distinct scenarios which lead to
> > this issue. With FF-A v1.2+, FFA_FEATURES can specify a maximum supported
> > RX/TX buffer size, so patch 1 decodes this field and honors the maximum if
> > specified. For FF-A v1.1 and earlier the maximum is unknown, so patch 2
> > deals with this by first attempting FFA_RXTX_MAP with the page-aligned
> > buffer size (preserving the behavior introduced by commit 83210251fd70).
> > If this fails due to invalid parameters it retries with the minimum buffer
> > size from FFA_FEATURES.
> > 
> > Testing was done with FF-A v1.1 and v1.2 implementations, both of which
> > reject buffer sizes larger than 4K. Both implementations were tested with
> > 4K, 16K, and 64K pages. Without these patches, probe fails for page sizes
> > larger than 4K with the message "failed to register FFA RxTx buffers."
> > With the patches probe succeeds for all page sizes.
> > 
> > The patches are based on for-next/ffa/fixes.
> 
> for-next/ffa/updates has patches queued for v7.2.
> 
> > 
> > Signed-off-by: Seth Forshee <sforshee at nvidia.com>
> > ---
> > Seth Forshee (2):
> >       firmware: arm_ffa: Honor maximum RX/TX buffer size
> >       firmware: arm_ffa: Fall back to minimum buffer size if RXTX_MAP fails
> > 
> >  drivers/firmware/arm_ffa/driver.c | 51 ++++++++++++++++++++++++++++++++++-----
> >  1 file changed, 45 insertions(+), 6 deletions(-)
> 
> Wondering if these 2 fixes can be merged into one and simplified something
> like(untested) patch below(rebased on linux-next or for-next/ffa/updates)

>From a quick review, yes, I think that looks like it should work. I'll
give it a closer look and some testing.

Seth

> 
> Regards,
> Sudeep
> 
> -->8
> diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
> index 0f468362c288..5ffe21c568b7 100644
> --- a/drivers/firmware/arm_ffa/driver.c
> +++ b/drivers/firmware/arm_ffa/driver.c
> @@ -32,6 +32,7 @@
>  #include <linux/interrupt.h>
>  #include <linux/io.h>
>  #include <linux/kernel.h>
> +#include <linux/minmax.h>
>  #include <linux/module.h>
>  #include <linux/mm.h>
>  #include <linux/mutex.h>
> @@ -59,7 +60,9 @@
>         (FIELD_PREP(SENDER_ID_MASK, (s)) | FIELD_PREP(RECEIVER_ID_MASK, (r)))
> 
>  #define RXTX_MAP_MIN_BUFSZ_MASK        GENMASK(1, 0)
> -#define RXTX_MAP_MIN_BUFSZ(x)  ((x) & RXTX_MAP_MIN_BUFSZ_MASK)
> +#define RXTX_MAP_MAX_BUFSZ_MASK        GENMASK(31, 16)
> +#define RXTX_MAP_MIN_BUFSZ(x)  (FIELD_GET(RXTX_MAP_MIN_BUFSZ_MASK, (x)))
> +#define RXTX_MAP_MAX_BUFSZ(x)  (FIELD_GET(RXTX_MAP_MAX_BUFSZ_MASK, (x)))
> 
>  #define FFA_MAX_NOTIFICATIONS          64
> 
> @@ -2101,7 +2104,7 @@ static int ffa_probe(struct platform_device *pdev)
>  {
>         int ret;
>         u32 buf_sz;
> -       size_t rxtx_bufsz = SZ_4K;
> +       size_t rxtx_min_bufsz = SZ_4K, rxtx_bufsz, rxtx_max_bufsz = 0;
> 
>         if (IS_BUILTIN(CONFIG_ARM_FFA_TRANSPORT) &&
>             is_protected_kvm_enabled() && !is_pkvm_initialized())
> @@ -2132,15 +2135,18 @@ static int ffa_probe(struct platform_device *pdev)
>         ret = ffa_features(FFA_FN_NATIVE(RXTX_MAP), 0, &buf_sz, NULL);
>         if (!ret) {
>                 if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 1)
> -                       rxtx_bufsz = SZ_64K;
> +                       rxtx_min_bufsz = SZ_64K;
>                 else if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 2)
> -                       rxtx_bufsz = SZ_16K;
> +                       rxtx_min_bufsz = SZ_16K;
>                 else
> -                       rxtx_bufsz = SZ_4K;
> +                       rxtx_min_bufsz = SZ_4K;
> +
> +               rxtx_max_bufsz = RXTX_MAP_MAX_BUFSZ(buf_sz) * SZ_4K;
> +               if (rxtx_max_bufsz != 0 && rxtx_max_bufsz < rxtx_min_bufsz)
> +                       rxtx_max_bufsz = rxtx_min_bufsz;
>         }
> 
> -       rxtx_bufsz = PAGE_ALIGN(rxtx_bufsz);
> -       drv_info->rxtx_bufsz = rxtx_bufsz;
> +       rxtx_bufsz = min_not_zero(PAGE_ALIGN(rxtx_min_bufsz), rxtx_max_bufsz);
>         drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL);
>         if (!drv_info->rx_buffer) {
>                 ret = -ENOMEM;
> @@ -2156,10 +2162,17 @@ static int ffa_probe(struct platform_device *pdev)
>         ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
>                            virt_to_phys(drv_info->rx_buffer),
>                            rxtx_bufsz / FFA_PAGE_SIZE);
> +       if (ret == -EINVAL && !rxtx_max_bufsz && rxtx_min_bufsz < rxtx_bufsz) {
> +               rxtx_bufsz = rxtx_min_bufsz;
> +               ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
> +                                  virt_to_phys(drv_info->rx_buffer),
> +                                  rxtx_bufsz / FFA_PAGE_SIZE);
> +       }
>         if (ret) {
>                 pr_err("failed to register FFA RxTx buffers\n");
>                 goto free_pages;
>         }
> +       drv_info->rxtx_bufsz = rxtx_bufsz;
> 
>         mutex_init(&drv_info->rx_lock);
>         mutex_init(&drv_info->tx_lock);
> 
>