Re: [PATCH] KVM: arm64: Allow smaller FF-A RX/TX buffers

[Sebastian Ene <sebastianene@google.com>]

On Thu, Aug 20, 2026 at 02:42:31PM +0900, Kim Mankyum wrote:

Hello Kim,

> pKVM currently requires the host to map PAGE_SIZE worth of RX/TX
> buffers, as do_ffa_rxtx_map() requires the FF-A page count to match
> the capacity of the hypervisor RX/TX buffers.
> 
> This is unnecessarily restrictive when the kernel page size is larger
> than the minimum RX/TX buffer size advertised by the SPMC. For
> example, with a 16K kernel and an SPMC advertising a minimum RX/TX
> buffer size of 4K, a host request with a page count of one is rejected
> by pKVM.
> 

That is because we should trap and report the minimum number of pages
from pKVM and not from SPMC. The host doesn't end up mapping directly in
the SPMC.

Something like this should do the trick:

```
diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
index 48cf502ce1e7..95156d409f79 100644
--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -1355,7 +1355,7 @@ static bool do_ffa_features(struct arm_smccc_1_2_regs *res,
                            struct kvm_cpu_context *ctxt)
 {
        DECLARE_REG(u32, id, ctxt, 1);
-       u64 prop = 0;
+       u64 prop = 0, buff_sz;
        int ret = 0;
 
        if (!ffa_call_supported(id)) {
@@ -1364,6 +1364,18 @@ static bool do_ffa_features(struct arm_smccc_1_2_regs *res,
        }
 
        switch (id) {
+       case FFA_RXTX_MAP:
+       case FFA_FN64_RXTX_MAP:
+               buff_sz = KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE;
+               if (buff_sz == SZ_4K)
+                       prop = FFA_FEAT_RXTX_MIN_SZ_4K;
+               else if (buff_sz == SZ_64K)
+                       prop = FFA_FEAT_RXTX_MIN_SZ_64K;
+               else if (buff_sz == SZ_16K)
+                       prop = FFA_FEAT_RXTX_MIN_SZ_16K;
+               else
+                       ret = FFA_RET_NOT_SUPPORTED;
+               goto out_handled;
        case FFA_MEM_SHARE:
        case FFA_FN64_MEM_SHARE:
        case FFA_MEM_LEND:
```

> hyp_ffa_post_init() already allows an SPMC whose minimum RX/TX buffer
> size is smaller than PAGE_SIZE, and the page count supplied by the host
> is forwarded unchanged when mapping the hypervisor buffers into the
> SPMC.
> 
> Allow RX/TX buffers smaller than the capacity of the hypervisor buffers
> while continuing to reject requests which exceed it.
> 

I don't think you should change that, it will probably brake things because the hyp knows that
it is using KVM_FFA_MBOX_NR_PAGES but you only mapped npages in SPMC. 

I have some android patch where I am also trying to remove the limitation that the hypervisor has
only one page per mailbox buffer (set in stone that KVM_FFA_MBOX_NR_PAGES is 1) :
https://android-review.googlesource.com/c/kernel/common/+/4238522

This should probably put you in a better position for a patch ?


> Fixes: 9d0c6a9af9e3 ("KVM: arm64: Handle FFA_RXTX_MAP and FFA_RXTX_UNMAP calls from the host")
> Signed-off-by: Kim Mankyum <mankyum.kim@samsung.com>
> ---
>  arch/arm64/kvm/hyp/nvhe/ffa.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index a327c2bbb6b6..594d1112b5f9 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -239,7 +239,8 @@ static void do_ffa_rxtx_map(struct arm_smccc_1_2_regs *res,
>  	int ret = 0;
>  	void *rx_virt, *tx_virt;
>  
> -	if (npages != (KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) / FFA_PAGE_SIZE) {
> +	if (!npages ||
> +	    npages > (KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) / FFA_PAGE_SIZE) {
>  		ret = FFA_RET_INVALID_PARAMETERS;
>  		goto out;
>  	}
> 
> ---
> base-commit: cb8a75eec0877810b50aa1c5a833f929525cd2ee
> change-id: 20260820-master-572418a358ab
> 
> Best regards,
> --  
> Kim Mankyum <mankyum.kim@samsung.com>
>

Thanks,
Sebastian