[PATCH] KVM: arm64: Allow smaller FF-A RX/TX buffers

[PATCH] KVM: arm64: Allow smaller FF-A RX/TX buffers

[Kim Mankyum via B4 Relay]

From: Kim Mankyum <mankyum.kim@samsung.com>

pKVM currently requires the host to map PAGE_SIZE worth of RX/TX
buffers, as do_ffa_rxtx_map() requires the FF-A page count to match
the capacity of the hypervisor RX/TX buffers.

This is unnecessarily restrictive when the kernel page size is larger
than the minimum RX/TX buffer size advertised by the SPMC. For
example, with a 16K kernel and an SPMC advertising a minimum RX/TX
buffer size of 4K, a host request with a page count of one is rejected
by pKVM.

hyp_ffa_post_init() already allows an SPMC whose minimum RX/TX buffer
size is smaller than PAGE_SIZE, and the page count supplied by the host
is forwarded unchanged when mapping the hypervisor buffers into the
SPMC.

Allow RX/TX buffers smaller than the capacity of the hypervisor buffers
while continuing to reject requests which exceed it.

Fixes: 9d0c6a9af9e3 ("KVM: arm64: Handle FFA_RXTX_MAP and FFA_RXTX_UNMAP calls from the host")
Signed-off-by: Kim Mankyum <mankyum.kim@samsung.com>
---
 arch/arm64/kvm/hyp/nvhe/ffa.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
index a327c2bbb6b6..594d1112b5f9 100644
--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -239,7 +239,8 @@ static void do_ffa_rxtx_map(struct arm_smccc_1_2_regs *res,
 	int ret = 0;
 	void *rx_virt, *tx_virt;
 
-	if (npages != (KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) / FFA_PAGE_SIZE) {
+	if (!npages ||
+	    npages > (KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) / FFA_PAGE_SIZE) {
 		ret = FFA_RET_INVALID_PARAMETERS;
 		goto out;
 	}

---
base-commit: cb8a75eec0877810b50aa1c5a833f929525cd2ee
change-id: 20260820-master-572418a358ab

Best regards,
--  
Kim Mankyum <mankyum.kim@samsung.com>

Re: [PATCH] KVM: arm64: Allow smaller FF-A RX/TX buffers

[Marc Zyngier]

On Thu, 20 Aug 2026 06:42:31 +0100,
Kim Mankyum via B4 Relay <devnull+mankyum.kim.samsung.com@kernel.org> wrote:
> 
> From: Kim Mankyum <mankyum.kim@samsung.com>
> 
> pKVM currently requires the host to map PAGE_SIZE worth of RX/TX
> buffers, as do_ffa_rxtx_map() requires the FF-A page count to match
> the capacity of the hypervisor RX/TX buffers.
> 
> This is unnecessarily restrictive when the kernel page size is larger
> than the minimum RX/TX buffer size advertised by the SPMC. For
> example, with a 16K kernel and an SPMC advertising a minimum RX/TX
> buffer size of 4K, a host request with a page count of one is rejected
> by pKVM.
> 
> hyp_ffa_post_init() already allows an SPMC whose minimum RX/TX buffer
> size is smaller than PAGE_SIZE, and the page count supplied by the host
> is forwarded unchanged when mapping the hypervisor buffers into the
> SPMC.
> 
> Allow RX/TX buffers smaller than the capacity of the hypervisor buffers
> while continuing to reject requests which exceed it.

You don't explain why this is safe.

Are you guaranteed that the physical page stays accessible to the
host?

What happens if another range in the same physical page gets shared
again? Best case, this will fail, but why is that an acceptable
behaviour?

You need to provide answers to these questions before we can consider
this change.

Thanks,

	M.

-- 
Jazz isn't dead. It just smells funny.

Re: [PATCH] KVM: arm64: Allow smaller FF-A RX/TX buffers

[Sebastian Ene]

On Thu, Aug 20, 2026 at 02:42:31PM +0900, Kim Mankyum wrote:

Hello Kim,

> pKVM currently requires the host to map PAGE_SIZE worth of RX/TX
> buffers, as do_ffa_rxtx_map() requires the FF-A page count to match
> the capacity of the hypervisor RX/TX buffers.
> 
> This is unnecessarily restrictive when the kernel page size is larger
> than the minimum RX/TX buffer size advertised by the SPMC. For
> example, with a 16K kernel and an SPMC advertising a minimum RX/TX
> buffer size of 4K, a host request with a page count of one is rejected
> by pKVM.
> 

That is because we should trap and report the minimum number of pages
from pKVM and not from SPMC. The host doesn't end up mapping directly in
the SPMC.

Something like this should do the trick:

```
diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
index 48cf502ce1e7..95156d409f79 100644
--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -1355,7 +1355,7 @@ static bool do_ffa_features(struct arm_smccc_1_2_regs *res,
                            struct kvm_cpu_context *ctxt)
 {
        DECLARE_REG(u32, id, ctxt, 1);
-       u64 prop = 0;
+       u64 prop = 0, buff_sz;
        int ret = 0;
 
        if (!ffa_call_supported(id)) {
@@ -1364,6 +1364,18 @@ static bool do_ffa_features(struct arm_smccc_1_2_regs *res,
        }
 
        switch (id) {
+       case FFA_RXTX_MAP:
+       case FFA_FN64_RXTX_MAP:
+               buff_sz = KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE;
+               if (buff_sz == SZ_4K)
+                       prop = FFA_FEAT_RXTX_MIN_SZ_4K;
+               else if (buff_sz == SZ_64K)
+                       prop = FFA_FEAT_RXTX_MIN_SZ_64K;
+               else if (buff_sz == SZ_16K)
+                       prop = FFA_FEAT_RXTX_MIN_SZ_16K;
+               else
+                       ret = FFA_RET_NOT_SUPPORTED;
+               goto out_handled;
        case FFA_MEM_SHARE:
        case FFA_FN64_MEM_SHARE:
        case FFA_MEM_LEND:
```

> hyp_ffa_post_init() already allows an SPMC whose minimum RX/TX buffer
> size is smaller than PAGE_SIZE, and the page count supplied by the host
> is forwarded unchanged when mapping the hypervisor buffers into the
> SPMC.
> 
> Allow RX/TX buffers smaller than the capacity of the hypervisor buffers
> while continuing to reject requests which exceed it.
> 

I don't think you should change that, it will probably brake things because the hyp knows that
it is using KVM_FFA_MBOX_NR_PAGES but you only mapped npages in SPMC. 

I have some android patch where I am also trying to remove the limitation that the hypervisor has
only one page per mailbox buffer (set in stone that KVM_FFA_MBOX_NR_PAGES is 1) :
https://android-review.googlesource.com/c/kernel/common/+/4238522

This should probably put you in a better position for a patch ?


> Fixes: 9d0c6a9af9e3 ("KVM: arm64: Handle FFA_RXTX_MAP and FFA_RXTX_UNMAP calls from the host")
> Signed-off-by: Kim Mankyum <mankyum.kim@samsung.com>
> ---
>  arch/arm64/kvm/hyp/nvhe/ffa.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index a327c2bbb6b6..594d1112b5f9 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -239,7 +239,8 @@ static void do_ffa_rxtx_map(struct arm_smccc_1_2_regs *res,
>  	int ret = 0;
>  	void *rx_virt, *tx_virt;
>  
> -	if (npages != (KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) / FFA_PAGE_SIZE) {
> +	if (!npages ||
> +	    npages > (KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) / FFA_PAGE_SIZE) {
>  		ret = FFA_RET_INVALID_PARAMETERS;
>  		goto out;
>  	}
> 
> ---
> base-commit: cb8a75eec0877810b50aa1c5a833f929525cd2ee
> change-id: 20260820-master-572418a358ab
> 
> Best regards,
> --  
> Kim Mankyum <mankyum.kim@samsung.com>
>

Thanks,
Sebastian