[v8] FF-A VM to VM support

[PATCH v8 0/6] FF-A VM to VM support

Posted by Bertrand Marquis 2 months, 2 weeks ago

This patch serie adds support to use FF-A between VM for communications
using indirect messages.

It adds a Kconfig parameter to enable this feature and marks it as
experimental as for now there is no system to restrict communication
rights between VM using this system.

It also adds support to use VM to VM communications using FF-A even if
there is no firmware support for FF-A. As this feature enables FF-A
support in all cases, we also introduce a new command line parameter to
allow the user to force which tee is to be used between FF-A and Optee
to have a solution to enable optee support if FF-A VM to VM is enabled.

Changes since v7:
- typo fixes
- use LIST_HEAD and DEFINE_RWLOCK
- add Jens R-b and Julien A-b

Changes since v6:
- use a rwlock to protect access to the chain list of context
- rebase on top of staging
- add some R-b/A-b from Jens and Julien

Changes since v5:
- coding style fixes
- rework version negociation to use the context lock
- split probe into fw and vm to vm probe to make code clearer
- add some R-b from Jens

Changes since v4:
- fix typos and optimize command line parameter
- split VM to VM support in 2 patches to ease review
- organize ffa contexts in a chain list to be able to build the partinfo
  result without taking the global domain lock
- introduce a maximum number of SPs to prevent holding the CPU for too
  long during partinfo call
- use an atomic to store the number of FF-A VMs
- prevent potential overflows in indirect message handling
- fix copy bug in indirect message introduced in v4

Changes since v3:
- reintroduce firmare v1.0 support in partinfo
- fix a possible TOC/TOU issue in indirect message handling
- typos and small fixes

Changes since v2:
- Rework partition_info_get implementation
- Taint Xen and display a message when VM to VM is enabled
- Various fixes explained in each patch

Changes since v1 (rfc):
- add a tee command line parameter
- use IS_ENABLED instead of ifdef when possible
- rebase on latest staging


Bertrand Marquis (6):
  xen/arm: Create tee command line parameter
  xen/arm: ffa: Rework partinfo_get implementation
  xen/arm: ffa: Introduce VM to VM support
  xen/arm: ffa: Add buffer full notification support
  xen/arm: ffa: Add indirect message between VM
  xen/arm: ffa: Enable VM to VM without firmware

 docs/misc/xen-command-line.pandoc  |  14 ++
 xen/arch/arm/include/asm/tee/tee.h |   4 +
 xen/arch/arm/tee/Kconfig           |  11 ++
 xen/arch/arm/tee/ffa.c             | 112 ++++++++---
 xen/arch/arm/tee/ffa_msg.c         | 117 ++++++++++--
 xen/arch/arm/tee/ffa_notif.c       | 140 ++++++++------
 xen/arch/arm/tee/ffa_partinfo.c    | 292 ++++++++++++++++++++---------
 xen/arch/arm/tee/ffa_private.h     | 158 +++++++++++++---
 xen/arch/arm/tee/tee.c             |  32 ++++
 9 files changed, 665 insertions(+), 215 deletions(-)

-- 
2.47.1

Re: [PATCH v8 0/6] FF-A VM to VM support

Posted by Julien Grall 2 months, 2 weeks ago

Hi Bertrand,

On 11/08/2025 14:34, Bertrand Marquis wrote:
> This patch serie adds support to use FF-A between VM for communications
> using indirect messages.
> 
> It adds a Kconfig parameter to enable this feature and marks it as
> experimental as for now there is no system to restrict communication
> rights between VM using this system.
> 
> It also adds support to use VM to VM communications using FF-A even if
> there is no firmware support for FF-A. As this feature enables FF-A
> support in all cases, we also introduce a new command line parameter to
> allow the user to force which tee is to be used between FF-A and Optee
> to have a solution to enable optee support if FF-A VM to VM is enabled.
> 
> Changes since v7:
> - typo fixes
> - use LIST_HEAD and DEFINE_RWLOCK
> - add Jens R-b and Julien A-b
> 
> Changes since v6:
> - use a rwlock to protect access to the chain list of context
> - rebase on top of staging
> - add some R-b/A-b from Jens and Julien
> 
> Changes since v5:
> - coding style fixes
> - rework version negociation to use the context lock
> - split probe into fw and vm to vm probe to make code clearer
> - add some R-b from Jens
> 
> Changes since v4:
> - fix typos and optimize command line parameter
> - split VM to VM support in 2 patches to ease review
> - organize ffa contexts in a chain list to be able to build the partinfo
>    result without taking the global domain lock
> - introduce a maximum number of SPs to prevent holding the CPU for too
>    long during partinfo call
> - use an atomic to store the number of FF-A VMs
> - prevent potential overflows in indirect message handling
> - fix copy bug in indirect message introduced in v4
> 
> Changes since v3:
> - reintroduce firmare v1.0 support in partinfo
> - fix a possible TOC/TOU issue in indirect message handling
> - typos and small fixes
> 
> Changes since v2:
> - Rework partition_info_get implementation
> - Taint Xen and display a message when VM to VM is enabled
> - Various fixes explained in each patch
> 
> Changes since v1 (rfc):
> - add a tee command line parameter
> - use IS_ENABLED instead of ifdef when possible
> - rebase on latest staging
> 
> 
> Bertrand Marquis (6):
>    xen/arm: Create tee command line parameter
>    xen/arm: ffa: Rework partinfo_get implementation
>    xen/arm: ffa: Introduce VM to VM support
>    xen/arm: ffa: Add buffer full notification support
>    xen/arm: ffa: Add indirect message between VM
>    xen/arm: ffa: Enable VM to VM without firmware

I merged the series.

Cheers,

-- 
Julien Grall