core: ffa: fix spmc_retrieve_req() buffer

Prior to this patch when retrieving a shared memory block the memory
transaction descriptor (struct ffa_mem_transaction_1_1 or struct
ffa_mem_transaction_1_0) was read from the TX buffer instead of the RX
buffer where the actual memory transaction is supplied. Fix this by
changing to read the memory transaction descriptor from the RX buffer.

This used to work somewhat by chance since OP-TEE before the call to
FFA_MEM_RETRIEVE_REQ_32 filled in a memory transaction descriptor
of what we expect to retrieve in the TX buffer.

Fixes: f49f23f ("core: ffa: rename nw_rxtx to my_rxtx")
Fixes: a1c5302 ("core: spmc: support FF-A 1.1")
Suggested-by: Olivier Deprez <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
Acked-by: Jerome Forissier <[email protected]>
Reviewed-by: Balint Dobszay <[email protected]>

core/arch/arm/kernel/thread_spmc.c

@@ -1832,7 +1832,7 @@ static void *spmc_retrieve_req(uint64_t cookie,
 			     cookie, args.a0);
 		return NULL;
 	}
-	rc = spmc_read_mem_transaction(my_rxtx.ffa_vers, my_rxtx.tx,
+	rc = spmc_read_mem_transaction(my_rxtx.ffa_vers, my_rxtx.rx,
 				       my_rxtx.size, trans);
 	if (rc) {
 		EMSG("Memory transaction failure for cookie %#"PRIx64" rc %d",