drivers/firmware/arm_ffa/driver.c | 51 ++++++++++++++++++++++++++++++++++----- 1 file changed, 45 insertions(+), 6 deletions(-)
Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size
during RXTX_MAP") caused a regression for some FF-A implementations. It
has the effect of passing the size of the page-aligned buffers to
FFA_RXTX_MAP, which may be larger than the maximum size supported by the
SPMC. When this happens FFA_RXTX_MAP will fail with INVALID_PARAMETERS.
The following patches deal with two distinct scenarios which lead to
this issue. With FF-A v1.2+, FFA_FEATURES can specify a maximum supported
RX/TX buffer size, so patch 1 decodes this field and honors the maximum if
specified. For FF-A v1.1 and earlier the maximum is unknown, so patch 2
deals with this by first attempting FFA_RXTX_MAP with the page-aligned
buffer size (preserving the behavior introduced by commit 83210251fd70).
If this fails due to invalid parameters it retries with the minimum buffer
size from FFA_FEATURES.
Testing was done with FF-A v1.1 and v1.2 implementations, both of which
reject buffer sizes larger than 4K. Both implementations were tested with
4K, 16K, and 64K pages. Without these patches, probe fails for page sizes
larger than 4K with the message "failed to register FFA RxTx buffers."
With the patches probe succeeds for all page sizes.
The patches are based on for-next/ffa/fixes.
Signed-off-by: Seth Forshee <sforshee@nvidia.com>
---
Seth Forshee (2):
firmware: arm_ffa: Honor maximum RX/TX buffer size
firmware: arm_ffa: Fall back to minimum buffer size if RXTX_MAP fails
drivers/firmware/arm_ffa/driver.c | 51 ++++++++++++++++++++++++++++++++++-----
1 file changed, 45 insertions(+), 6 deletions(-)
---
base-commit: a6848a50404eefb6f0b131c21881a2d8d21b31a9
change-id: 20260531-b4-ffa-rxtx-map-fixes-244ede71a935
Best regards,
--
Seth Forshee <sforshee@nvidia.com>
On Mon, Jun 01, 2026 at 03:45:10PM -0500, Seth Forshee wrote:
> Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size
> during RXTX_MAP") caused a regression for some FF-A implementations. It
> has the effect of passing the size of the page-aligned buffers to
> FFA_RXTX_MAP, which may be larger than the maximum size supported by the
> SPMC. When this happens FFA_RXTX_MAP will fail with INVALID_PARAMETERS.
>
> The following patches deal with two distinct scenarios which lead to
> this issue. With FF-A v1.2+, FFA_FEATURES can specify a maximum supported
> RX/TX buffer size, so patch 1 decodes this field and honors the maximum if
> specified. For FF-A v1.1 and earlier the maximum is unknown, so patch 2
> deals with this by first attempting FFA_RXTX_MAP with the page-aligned
> buffer size (preserving the behavior introduced by commit 83210251fd70).
> If this fails due to invalid parameters it retries with the minimum buffer
> size from FFA_FEATURES.
>
> Testing was done with FF-A v1.1 and v1.2 implementations, both of which
> reject buffer sizes larger than 4K. Both implementations were tested with
> 4K, 16K, and 64K pages. Without these patches, probe fails for page sizes
> larger than 4K with the message "failed to register FFA RxTx buffers."
> With the patches probe succeeds for all page sizes.
>
> The patches are based on for-next/ffa/fixes.
for-next/ffa/updates has patches queued for v7.2.
>
> Signed-off-by: Seth Forshee <sforshee@nvidia.com>
> ---
> Seth Forshee (2):
> firmware: arm_ffa: Honor maximum RX/TX buffer size
> firmware: arm_ffa: Fall back to minimum buffer size if RXTX_MAP fails
>
> drivers/firmware/arm_ffa/driver.c | 51 ++++++++++++++++++++++++++++++++++-----
> 1 file changed, 45 insertions(+), 6 deletions(-)
Wondering if these 2 fixes can be merged into one and simplified something
like(untested) patch below(rebased on linux-next or for-next/ffa/updates)
Regards,
Sudeep
-->8
diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
index 0f468362c288..5ffe21c568b7 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
@@ -32,6 +32,7 @@
#include <linux/interrupt.h>
#include <linux/io.h>
#include <linux/kernel.h>
+#include <linux/minmax.h>
#include <linux/module.h>
#include <linux/mm.h>
#include <linux/mutex.h>
@@ -59,7 +60,9 @@
(FIELD_PREP(SENDER_ID_MASK, (s)) | FIELD_PREP(RECEIVER_ID_MASK, (r)))
#define RXTX_MAP_MIN_BUFSZ_MASK GENMASK(1, 0)
-#define RXTX_MAP_MIN_BUFSZ(x) ((x) & RXTX_MAP_MIN_BUFSZ_MASK)
+#define RXTX_MAP_MAX_BUFSZ_MASK GENMASK(31, 16)
+#define RXTX_MAP_MIN_BUFSZ(x) (FIELD_GET(RXTX_MAP_MIN_BUFSZ_MASK, (x)))
+#define RXTX_MAP_MAX_BUFSZ(x) (FIELD_GET(RXTX_MAP_MAX_BUFSZ_MASK, (x)))
#define FFA_MAX_NOTIFICATIONS 64
@@ -2101,7 +2104,7 @@ static int ffa_probe(struct platform_device *pdev)
{
int ret;
u32 buf_sz;
- size_t rxtx_bufsz = SZ_4K;
+ size_t rxtx_min_bufsz = SZ_4K, rxtx_bufsz, rxtx_max_bufsz = 0;
if (IS_BUILTIN(CONFIG_ARM_FFA_TRANSPORT) &&
is_protected_kvm_enabled() && !is_pkvm_initialized())
@@ -2132,15 +2135,18 @@ static int ffa_probe(struct platform_device *pdev)
ret = ffa_features(FFA_FN_NATIVE(RXTX_MAP), 0, &buf_sz, NULL);
if (!ret) {
if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 1)
- rxtx_bufsz = SZ_64K;
+ rxtx_min_bufsz = SZ_64K;
else if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 2)
- rxtx_bufsz = SZ_16K;
+ rxtx_min_bufsz = SZ_16K;
else
- rxtx_bufsz = SZ_4K;
+ rxtx_min_bufsz = SZ_4K;
+
+ rxtx_max_bufsz = RXTX_MAP_MAX_BUFSZ(buf_sz) * SZ_4K;
+ if (rxtx_max_bufsz != 0 && rxtx_max_bufsz < rxtx_min_bufsz)
+ rxtx_max_bufsz = rxtx_min_bufsz;
}
- rxtx_bufsz = PAGE_ALIGN(rxtx_bufsz);
- drv_info->rxtx_bufsz = rxtx_bufsz;
+ rxtx_bufsz = min_not_zero(PAGE_ALIGN(rxtx_min_bufsz), rxtx_max_bufsz);
drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL);
if (!drv_info->rx_buffer) {
ret = -ENOMEM;
@@ -2156,10 +2162,17 @@ static int ffa_probe(struct platform_device *pdev)
ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
virt_to_phys(drv_info->rx_buffer),
rxtx_bufsz / FFA_PAGE_SIZE);
+ if (ret == -EINVAL && !rxtx_max_bufsz && rxtx_min_bufsz < rxtx_bufsz) {
+ rxtx_bufsz = rxtx_min_bufsz;
+ ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
+ virt_to_phys(drv_info->rx_buffer),
+ rxtx_bufsz / FFA_PAGE_SIZE);
+ }
if (ret) {
pr_err("failed to register FFA RxTx buffers\n");
goto free_pages;
}
+ drv_info->rxtx_bufsz = rxtx_bufsz;
mutex_init(&drv_info->rx_lock);
mutex_init(&drv_info->tx_lock);
On Tue, Jun 02, 2026 at 05:51:10PM +0100, Sudeep Holla wrote:
> On Mon, Jun 01, 2026 at 03:45:10PM -0500, Seth Forshee wrote:
> > Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size
> > during RXTX_MAP") caused a regression for some FF-A implementations. It
> > has the effect of passing the size of the page-aligned buffers to
> > FFA_RXTX_MAP, which may be larger than the maximum size supported by the
> > SPMC. When this happens FFA_RXTX_MAP will fail with INVALID_PARAMETERS.
> >
> > The following patches deal with two distinct scenarios which lead to
> > this issue. With FF-A v1.2+, FFA_FEATURES can specify a maximum supported
> > RX/TX buffer size, so patch 1 decodes this field and honors the maximum if
> > specified. For FF-A v1.1 and earlier the maximum is unknown, so patch 2
> > deals with this by first attempting FFA_RXTX_MAP with the page-aligned
> > buffer size (preserving the behavior introduced by commit 83210251fd70).
> > If this fails due to invalid parameters it retries with the minimum buffer
> > size from FFA_FEATURES.
> >
> > Testing was done with FF-A v1.1 and v1.2 implementations, both of which
> > reject buffer sizes larger than 4K. Both implementations were tested with
> > 4K, 16K, and 64K pages. Without these patches, probe fails for page sizes
> > larger than 4K with the message "failed to register FFA RxTx buffers."
> > With the patches probe succeeds for all page sizes.
> >
> > The patches are based on for-next/ffa/fixes.
>
> for-next/ffa/updates has patches queued for v7.2.
>
> >
> > Signed-off-by: Seth Forshee <sforshee@nvidia.com>
> > ---
> > Seth Forshee (2):
> > firmware: arm_ffa: Honor maximum RX/TX buffer size
> > firmware: arm_ffa: Fall back to minimum buffer size if RXTX_MAP fails
> >
> > drivers/firmware/arm_ffa/driver.c | 51 ++++++++++++++++++++++++++++++++++-----
> > 1 file changed, 45 insertions(+), 6 deletions(-)
>
> Wondering if these 2 fixes can be merged into one and simplified something
> like(untested) patch below(rebased on linux-next or for-next/ffa/updates)
From a quick review, yes, I think that looks like it should work. I'll
give it a closer look and some testing.
Seth
>
> Regards,
> Sudeep
>
> -->8
> diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
> index 0f468362c288..5ffe21c568b7 100644
> --- a/drivers/firmware/arm_ffa/driver.c
> +++ b/drivers/firmware/arm_ffa/driver.c
> @@ -32,6 +32,7 @@
> #include <linux/interrupt.h>
> #include <linux/io.h>
> #include <linux/kernel.h>
> +#include <linux/minmax.h>
> #include <linux/module.h>
> #include <linux/mm.h>
> #include <linux/mutex.h>
> @@ -59,7 +60,9 @@
> (FIELD_PREP(SENDER_ID_MASK, (s)) | FIELD_PREP(RECEIVER_ID_MASK, (r)))
>
> #define RXTX_MAP_MIN_BUFSZ_MASK GENMASK(1, 0)
> -#define RXTX_MAP_MIN_BUFSZ(x) ((x) & RXTX_MAP_MIN_BUFSZ_MASK)
> +#define RXTX_MAP_MAX_BUFSZ_MASK GENMASK(31, 16)
> +#define RXTX_MAP_MIN_BUFSZ(x) (FIELD_GET(RXTX_MAP_MIN_BUFSZ_MASK, (x)))
> +#define RXTX_MAP_MAX_BUFSZ(x) (FIELD_GET(RXTX_MAP_MAX_BUFSZ_MASK, (x)))
>
> #define FFA_MAX_NOTIFICATIONS 64
>
> @@ -2101,7 +2104,7 @@ static int ffa_probe(struct platform_device *pdev)
> {
> int ret;
> u32 buf_sz;
> - size_t rxtx_bufsz = SZ_4K;
> + size_t rxtx_min_bufsz = SZ_4K, rxtx_bufsz, rxtx_max_bufsz = 0;
>
> if (IS_BUILTIN(CONFIG_ARM_FFA_TRANSPORT) &&
> is_protected_kvm_enabled() && !is_pkvm_initialized())
> @@ -2132,15 +2135,18 @@ static int ffa_probe(struct platform_device *pdev)
> ret = ffa_features(FFA_FN_NATIVE(RXTX_MAP), 0, &buf_sz, NULL);
> if (!ret) {
> if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 1)
> - rxtx_bufsz = SZ_64K;
> + rxtx_min_bufsz = SZ_64K;
> else if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 2)
> - rxtx_bufsz = SZ_16K;
> + rxtx_min_bufsz = SZ_16K;
> else
> - rxtx_bufsz = SZ_4K;
> + rxtx_min_bufsz = SZ_4K;
> +
> + rxtx_max_bufsz = RXTX_MAP_MAX_BUFSZ(buf_sz) * SZ_4K;
> + if (rxtx_max_bufsz != 0 && rxtx_max_bufsz < rxtx_min_bufsz)
> + rxtx_max_bufsz = rxtx_min_bufsz;
> }
>
> - rxtx_bufsz = PAGE_ALIGN(rxtx_bufsz);
> - drv_info->rxtx_bufsz = rxtx_bufsz;
> + rxtx_bufsz = min_not_zero(PAGE_ALIGN(rxtx_min_bufsz), rxtx_max_bufsz);
> drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL);
> if (!drv_info->rx_buffer) {
> ret = -ENOMEM;
> @@ -2156,10 +2162,17 @@ static int ffa_probe(struct platform_device *pdev)
> ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
> virt_to_phys(drv_info->rx_buffer),
> rxtx_bufsz / FFA_PAGE_SIZE);
> + if (ret == -EINVAL && !rxtx_max_bufsz && rxtx_min_bufsz < rxtx_bufsz) {
> + rxtx_bufsz = rxtx_min_bufsz;
> + ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
> + virt_to_phys(drv_info->rx_buffer),
> + rxtx_bufsz / FFA_PAGE_SIZE);
> + }
> if (ret) {
> pr_err("failed to register FFA RxTx buffers\n");
> goto free_pages;
> }
> + drv_info->rxtx_bufsz = rxtx_bufsz;
>
> mutex_init(&drv_info->rx_lock);
> mutex_init(&drv_info->tx_lock);
>
>
© 2016 - 2026 Red Hat, Inc.