Add support for indirect messages between VMs.
This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
---
Changes in v2:
- Switch ifdef to IS_ENABLED
---
xen/arch/arm/tee/ffa_msg.c | 96 +++++++++++++++++++++++++++++++---
xen/arch/arm/tee/ffa_private.h | 4 ++
2 files changed, 92 insertions(+), 8 deletions(-)
diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
index ee594e737fc7..336d5bbf64f6 100644
--- a/xen/arch/arm/tee/ffa_msg.c
+++ b/xen/arch/arm/tee/ffa_msg.c
@@ -96,9 +96,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
uint16_t dst_id, src_id;
int32_t ret;
- if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
- return FFA_RET_NOT_SUPPORTED;
-
if ( !spin_trylock(&src_ctx->tx_lock) )
return FFA_RET_BUSY;
@@ -106,10 +103,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
src_id = src_msg->send_recv_id >> 16;
dst_id = src_msg->send_recv_id & GENMASK(15,0);
- if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
+ if ( src_id != ffa_get_vm_id(src_d) )
{
ret = FFA_RET_INVALID_PARAMETERS;
- goto out_unlock_tx;
+ goto out;
}
/* check source message fits in buffer */
@@ -118,13 +115,96 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
{
ret = FFA_RET_INVALID_PARAMETERS;
- goto out_unlock_tx;
+ goto out;
}
- ret = ffa_simple_call(FFA_MSG_SEND2,
+ if ( FFA_ID_IS_SECURE(dst_id) )
+ {
+ /* Message for a secure partition */
+ if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
+ {
+ ret = FFA_RET_NOT_SUPPORTED;
+ goto out;
+ }
+
+ ret = ffa_simple_call(FFA_MSG_SEND2,
((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
+ goto out;
+ }
-out_unlock_tx:
+ /* Message for a VM */
+ if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
+ {
+ struct domain *dst_d;
+ struct ffa_ctx *dst_ctx;
+ struct ffa_part_msg_rxtx *dst_msg;
+ int err;
+
+ if ( dst_id == 0 )
+ {
+ /* FF-A ID 0 is the hypervisor, this is not valid */
+ ret = FFA_RET_INVALID_PARAMETERS;
+ goto out;
+ }
+
+ /* This is also checking that dest is not src */
+ err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
+ if ( err )
+ {
+ ret = FFA_RET_INVALID_PARAMETERS;
+ goto out;
+ }
+
+ if ( dst_d->arch.tee == NULL )
+ {
+ ret = FFA_RET_INVALID_PARAMETERS;
+ goto out_unlock;
+ }
+
+ dst_ctx = dst_d->arch.tee;
+ if ( !dst_ctx->guest_vers )
+ {
+ ret = FFA_RET_INVALID_PARAMETERS;
+ goto out_unlock;
+ }
+
+ /* This also checks that destination has set a Rx buffer */
+ ret = ffa_rx_acquire(dst_d);
+ if ( ret )
+ goto out_unlock;
+
+ /* we need to have enough space in the destination buffer */
+ if ( dst_ctx->page_count * FFA_PAGE_SIZE <
+ (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
+ {
+ ret = FFA_RET_NO_MEMORY;
+ ffa_rx_release(dst_d);
+ goto out_unlock;
+ }
+
+ dst_msg = dst_ctx->rx;
+
+ /* prepare destination header */
+ dst_msg->flags = 0;
+ dst_msg->reserved = 0;
+ dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
+ dst_msg->send_recv_id = src_msg->send_recv_id;
+ dst_msg->msg_size = src_msg->msg_size;
+
+ memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
+ src_ctx->tx + src_msg->msg_offset, src_msg->msg_size);
+
+ /* receiver rx buffer will be released by the receiver*/
+
+out_unlock:
+ rcu_unlock_domain(dst_d);
+ if ( !ret )
+ ffa_raise_rx_buffer_full(dst_d);
+ }
+ else
+ ret = FFA_RET_INVALID_PARAMETERS;
+
+out:
spin_unlock(&src_ctx->tx_lock);
return ret;
}
diff --git a/xen/arch/arm/tee/ffa_private.h b/xen/arch/arm/tee/ffa_private.h
index 1f5067d5d0c9..340db229453c 100644
--- a/xen/arch/arm/tee/ffa_private.h
+++ b/xen/arch/arm/tee/ffa_private.h
@@ -380,6 +380,10 @@ int ffa_handle_notification_set(struct cpu_user_regs *regs);
#ifdef CONFIG_FFA_VM_TO_VM
void ffa_raise_rx_buffer_full(struct domain *d);
+#else
+static inline void ffa_raise_rx_buffer_full(struct domain *d)
+{
+}
#endif
void ffa_handle_msg_send_direct_req(struct cpu_user_regs *regs, uint32_t fid);
--
2.47.1Hi Bertrand,
On Mon, Mar 10, 2025 at 3:51 PM Bertrand Marquis
<bertrand.marquis@arm.com> wrote:
>
> Add support for indirect messages between VMs.
> This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
>
> Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
> ---
> Changes in v2:
> - Switch ifdef to IS_ENABLED
> ---
> xen/arch/arm/tee/ffa_msg.c | 96 +++++++++++++++++++++++++++++++---
> xen/arch/arm/tee/ffa_private.h | 4 ++
> 2 files changed, 92 insertions(+), 8 deletions(-)
>
> diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
> index ee594e737fc7..336d5bbf64f6 100644
> --- a/xen/arch/arm/tee/ffa_msg.c
> +++ b/xen/arch/arm/tee/ffa_msg.c
> @@ -96,9 +96,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
> uint16_t dst_id, src_id;
> int32_t ret;
>
> - if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
> - return FFA_RET_NOT_SUPPORTED;
> -
> if ( !spin_trylock(&src_ctx->tx_lock) )
> return FFA_RET_BUSY;
>
> @@ -106,10 +103,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
> src_id = src_msg->send_recv_id >> 16;
> dst_id = src_msg->send_recv_id & GENMASK(15,0);
>
> - if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
> + if ( src_id != ffa_get_vm_id(src_d) )
> {
> ret = FFA_RET_INVALID_PARAMETERS;
> - goto out_unlock_tx;
> + goto out;
> }
>
> /* check source message fits in buffer */
> @@ -118,13 +115,96 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
> src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
> {
> ret = FFA_RET_INVALID_PARAMETERS;
> - goto out_unlock_tx;
> + goto out;
> }
>
> - ret = ffa_simple_call(FFA_MSG_SEND2,
> + if ( FFA_ID_IS_SECURE(dst_id) )
> + {
> + /* Message for a secure partition */
> + if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
> + {
> + ret = FFA_RET_NOT_SUPPORTED;
> + goto out;
> + }
> +
> + ret = ffa_simple_call(FFA_MSG_SEND2,
> ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
> + goto out;
> + }
>
> -out_unlock_tx:
> + /* Message for a VM */
> + if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
> + {
I would move this block into a helper function to isolate the needed
cleanup etc, but that might be more a matter of taste so do as you
prefer.
> + struct domain *dst_d;
> + struct ffa_ctx *dst_ctx;
> + struct ffa_part_msg_rxtx *dst_msg;
> + int err;
> +
> + if ( dst_id == 0 )
> + {
> + /* FF-A ID 0 is the hypervisor, this is not valid */
> + ret = FFA_RET_INVALID_PARAMETERS;
> + goto out;
> + }
> +
> + /* This is also checking that dest is not src */
> + err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
> + if ( err )
> + {
> + ret = FFA_RET_INVALID_PARAMETERS;
> + goto out;
> + }
> +
> + if ( dst_d->arch.tee == NULL )
> + {
> + ret = FFA_RET_INVALID_PARAMETERS;
> + goto out_unlock;
> + }
> +
> + dst_ctx = dst_d->arch.tee;
> + if ( !dst_ctx->guest_vers )
> + {
> + ret = FFA_RET_INVALID_PARAMETERS;
> + goto out_unlock;
> + }
> +
> + /* This also checks that destination has set a Rx buffer */
> + ret = ffa_rx_acquire(dst_d);
> + if ( ret )
> + goto out_unlock;
> +
> + /* we need to have enough space in the destination buffer */
> + if ( dst_ctx->page_count * FFA_PAGE_SIZE <
> + (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
> + {
> + ret = FFA_RET_NO_MEMORY;
> + ffa_rx_release(dst_d);
> + goto out_unlock;
> + }
> +
> + dst_msg = dst_ctx->rx;
> +
> + /* prepare destination header */
> + dst_msg->flags = 0;
> + dst_msg->reserved = 0;
> + dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
> + dst_msg->send_recv_id = src_msg->send_recv_id;
> + dst_msg->msg_size = src_msg->msg_size;
> +
> + memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
> + src_ctx->tx + src_msg->msg_offset, src_msg->msg_size);
> +
> + /* receiver rx buffer will be released by the receiver*/
> +
> +out_unlock:
> + rcu_unlock_domain(dst_d);
> + if ( !ret )
> + ffa_raise_rx_buffer_full(dst_d);
> + }
> + else
> + ret = FFA_RET_INVALID_PARAMETERS;
> +
> +out:
> spin_unlock(&src_ctx->tx_lock);
> return ret;
> }
> diff --git a/xen/arch/arm/tee/ffa_private.h b/xen/arch/arm/tee/ffa_private.h
> index 1f5067d5d0c9..340db229453c 100644
> --- a/xen/arch/arm/tee/ffa_private.h
> +++ b/xen/arch/arm/tee/ffa_private.h
> @@ -380,6 +380,10 @@ int ffa_handle_notification_set(struct cpu_user_regs *regs);
>
> #ifdef CONFIG_FFA_VM_TO_VM
> void ffa_raise_rx_buffer_full(struct domain *d);
> +#else
> +static inline void ffa_raise_rx_buffer_full(struct domain *d)
> +{
> +}
Shouldn't this go in the previous patch "xen/arm: ffa: Add buffer full
notification support"?
Cheers,
Jens
> #endif
>
> void ffa_handle_msg_send_direct_req(struct cpu_user_regs *regs, uint32_t fid);
> --
> 2.47.1
>
Hi Jens,
> On 20 Mar 2025, at 16:53, Jens Wiklander <jens.wiklander@linaro.org> wrote:
>
> Hi Bertrand,
>
> On Mon, Mar 10, 2025 at 3:51 PM Bertrand Marquis
> <bertrand.marquis@arm.com> wrote:
>>
>> Add support for indirect messages between VMs.
>> This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
>>
>> Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
>> ---
>> Changes in v2:
>> - Switch ifdef to IS_ENABLED
>> ---
>> xen/arch/arm/tee/ffa_msg.c | 96 +++++++++++++++++++++++++++++++---
>> xen/arch/arm/tee/ffa_private.h | 4 ++
>> 2 files changed, 92 insertions(+), 8 deletions(-)
>>
>> diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
>> index ee594e737fc7..336d5bbf64f6 100644
>> --- a/xen/arch/arm/tee/ffa_msg.c
>> +++ b/xen/arch/arm/tee/ffa_msg.c
>> @@ -96,9 +96,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>> uint16_t dst_id, src_id;
>> int32_t ret;
>>
>> - if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
>> - return FFA_RET_NOT_SUPPORTED;
>> -
>> if ( !spin_trylock(&src_ctx->tx_lock) )
>> return FFA_RET_BUSY;
>>
>> @@ -106,10 +103,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>> src_id = src_msg->send_recv_id >> 16;
>> dst_id = src_msg->send_recv_id & GENMASK(15,0);
>>
>> - if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
>> + if ( src_id != ffa_get_vm_id(src_d) )
>> {
>> ret = FFA_RET_INVALID_PARAMETERS;
>> - goto out_unlock_tx;
>> + goto out;
>> }
>>
>> /* check source message fits in buffer */
>> @@ -118,13 +115,96 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>> src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
>> {
>> ret = FFA_RET_INVALID_PARAMETERS;
>> - goto out_unlock_tx;
>> + goto out;
>> }
>>
>> - ret = ffa_simple_call(FFA_MSG_SEND2,
>> + if ( FFA_ID_IS_SECURE(dst_id) )
>> + {
>> + /* Message for a secure partition */
>> + if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
>> + {
>> + ret = FFA_RET_NOT_SUPPORTED;
>> + goto out;
>> + }
>> +
>> + ret = ffa_simple_call(FFA_MSG_SEND2,
>> ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
>> + goto out;
>> + }
>>
>> -out_unlock_tx:
>> + /* Message for a VM */
>> + if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
>> + {
>
> I would move this block into a helper function to isolate the needed
> cleanup etc, but that might be more a matter of taste so do as you
> prefer.
Yes that would be better. Will do.
>
>> + struct domain *dst_d;
>> + struct ffa_ctx *dst_ctx;
>> + struct ffa_part_msg_rxtx *dst_msg;
>> + int err;
>> +
>> + if ( dst_id == 0 )
>> + {
>> + /* FF-A ID 0 is the hypervisor, this is not valid */
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> + goto out;
>> + }
>> +
>> + /* This is also checking that dest is not src */
>> + err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
>> + if ( err )
>> + {
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> + goto out;
>> + }
>> +
>> + if ( dst_d->arch.tee == NULL )
>> + {
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> + goto out_unlock;
>> + }
>> +
>> + dst_ctx = dst_d->arch.tee;
>> + if ( !dst_ctx->guest_vers )
>> + {
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> + goto out_unlock;
>> + }
>> +
>> + /* This also checks that destination has set a Rx buffer */
>> + ret = ffa_rx_acquire(dst_d);
>> + if ( ret )
>> + goto out_unlock;
>> +
>> + /* we need to have enough space in the destination buffer */
>> + if ( dst_ctx->page_count * FFA_PAGE_SIZE <
>> + (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
>> + {
>> + ret = FFA_RET_NO_MEMORY;
>> + ffa_rx_release(dst_d);
>> + goto out_unlock;
>> + }
>> +
>> + dst_msg = dst_ctx->rx;
>> +
>> + /* prepare destination header */
>> + dst_msg->flags = 0;
>> + dst_msg->reserved = 0;
>> + dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
>> + dst_msg->send_recv_id = src_msg->send_recv_id;
>> + dst_msg->msg_size = src_msg->msg_size;
>> +
>> + memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
>> + src_ctx->tx + src_msg->msg_offset, src_msg->msg_size);
>> +
>> + /* receiver rx buffer will be released by the receiver*/
>> +
>> +out_unlock:
>> + rcu_unlock_domain(dst_d);
>> + if ( !ret )
>> + ffa_raise_rx_buffer_full(dst_d);
>> + }
>> + else
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> +
>> +out:
>> spin_unlock(&src_ctx->tx_lock);
>> return ret;
>> }
>> diff --git a/xen/arch/arm/tee/ffa_private.h b/xen/arch/arm/tee/ffa_private.h
>> index 1f5067d5d0c9..340db229453c 100644
>> --- a/xen/arch/arm/tee/ffa_private.h
>> +++ b/xen/arch/arm/tee/ffa_private.h
>> @@ -380,6 +380,10 @@ int ffa_handle_notification_set(struct cpu_user_regs *regs);
>>
>> #ifdef CONFIG_FFA_VM_TO_VM
>> void ffa_raise_rx_buffer_full(struct domain *d);
>> +#else
>> +static inline void ffa_raise_rx_buffer_full(struct domain *d)
>> +{
>> +}
>
> Shouldn't this go in the previous patch "xen/arm: ffa: Add buffer full
> notification support"?
>
Definitely yes. I will move it back.
Cheers
Bertrand
> Cheers,
> Jens
>
>> #endif
>>
>> void ffa_handle_msg_send_direct_req(struct cpu_user_regs *regs, uint32_t fid);
>> --
>> 2.47.1
© 2016 - 2025 Red Hat, Inc.