Re: [PATCH v2 4/5] xen/arm: ffa: Add indirect message between VM

[Jens Wiklander <jens.wiklander@xxxxxxxxxx>]

Hi Bertrand,

On Mon, Mar 10, 2025 at 3:51 PM Bertrand Marquis
<bertrand.marquis@xxxxxxx> wrote:
>
> Add support for indirect messages between VMs.
> This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
>
> Signed-off-by: Bertrand Marquis <bertrand.marquis@xxxxxxx>
> ---
> Changes in v2:
> - Switch ifdef to IS_ENABLED
> ---
>  xen/arch/arm/tee/ffa_msg.c     | 96 +++++++++++++++++++++++++++++++---
>  xen/arch/arm/tee/ffa_private.h |  4 ++
>  2 files changed, 92 insertions(+), 8 deletions(-)
>
> diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
> index ee594e737fc7..336d5bbf64f6 100644
> --- a/xen/arch/arm/tee/ffa_msg.c
> +++ b/xen/arch/arm/tee/ffa_msg.c
> @@ -96,9 +96,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>      uint16_t dst_id, src_id;
>      int32_t ret;
>
> -    if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
> -        return FFA_RET_NOT_SUPPORTED;
> -
>      if ( !spin_trylock(&src_ctx->tx_lock) )
>          return FFA_RET_BUSY;
>
> @@ -106,10 +103,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>      src_id = src_msg->send_recv_id >> 16;
>      dst_id = src_msg->send_recv_id & GENMASK(15,0);
>
> -    if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
> +    if ( src_id != ffa_get_vm_id(src_d) )
>      {
>          ret = FFA_RET_INVALID_PARAMETERS;
> -        goto out_unlock_tx;
> +        goto out;
>      }
>
>      /* check source message fits in buffer */
> @@ -118,13 +115,96 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>           src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
>      {
>          ret = FFA_RET_INVALID_PARAMETERS;
> -        goto out_unlock_tx;
> +        goto out;
>      }
>
> -    ret = ffa_simple_call(FFA_MSG_SEND2,
> +    if ( FFA_ID_IS_SECURE(dst_id) )
> +    {
> +        /* Message for a secure partition */
> +        if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
> +        {
> +            ret = FFA_RET_NOT_SUPPORTED;
> +            goto out;
> +        }
> +
> +        ret = ffa_simple_call(FFA_MSG_SEND2,
>                            ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
> +        goto out;
> +    }
>
> -out_unlock_tx:
> +    /* Message for a VM */
> +    if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
> +    {

I would move this block into a helper function to isolate the needed
cleanup etc, but that might be more a matter of taste so do as you
prefer.

> +        struct domain *dst_d;
> +        struct ffa_ctx *dst_ctx;
> +        struct ffa_part_msg_rxtx *dst_msg;
> +        int err;
> +
> +        if ( dst_id == 0 )
> +        {
> +            /* FF-A ID 0 is the hypervisor, this is not valid */
> +            ret = FFA_RET_INVALID_PARAMETERS;
> +            goto out;
> +        }
> +
> +        /* This is also checking that dest is not src */
> +        err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
> +        if ( err )
> +        {
> +            ret = FFA_RET_INVALID_PARAMETERS;
> +            goto out;
> +        }
> +
> +        if ( dst_d->arch.tee == NULL )
> +        {
> +            ret = FFA_RET_INVALID_PARAMETERS;
> +            goto out_unlock;
> +        }
> +
> +        dst_ctx = dst_d->arch.tee;
> +        if ( !dst_ctx->guest_vers )
> +        {
> +            ret = FFA_RET_INVALID_PARAMETERS;
> +            goto out_unlock;
> +        }
> +
> +        /* This also checks that destination has set a Rx buffer */
> +        ret = ffa_rx_acquire(dst_d);
> +        if ( ret )
> +            goto out_unlock;
> +
> +        /* we need to have enough space in the destination buffer */
> +        if ( dst_ctx->page_count * FFA_PAGE_SIZE <
> +                (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
> +        {
> +            ret = FFA_RET_NO_MEMORY;
> +            ffa_rx_release(dst_d);
> +            goto out_unlock;
> +        }
> +
> +        dst_msg = dst_ctx->rx;
> +
> +        /* prepare destination header */
> +        dst_msg->flags = 0;
> +        dst_msg->reserved = 0;
> +        dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
> +        dst_msg->send_recv_id = src_msg->send_recv_id;
> +        dst_msg->msg_size = src_msg->msg_size;
> +
> +        memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
> +               src_ctx->tx + src_msg->msg_offset, src_msg->msg_size);
> +
> +        /* receiver rx buffer will be released by the receiver*/
> +
> +out_unlock:
> +        rcu_unlock_domain(dst_d);
> +        if ( !ret )
> +            ffa_raise_rx_buffer_full(dst_d);
> +    }
> +    else
> +        ret = FFA_RET_INVALID_PARAMETERS;
> +
> +out:
>      spin_unlock(&src_ctx->tx_lock);
>      return ret;
>  }
> diff --git a/xen/arch/arm/tee/ffa_private.h b/xen/arch/arm/tee/ffa_private.h
> index 1f5067d5d0c9..340db229453c 100644
> --- a/xen/arch/arm/tee/ffa_private.h
> +++ b/xen/arch/arm/tee/ffa_private.h
> @@ -380,6 +380,10 @@ int ffa_handle_notification_set(struct cpu_user_regs 
> *regs);
>
>  #ifdef CONFIG_FFA_VM_TO_VM
>  void ffa_raise_rx_buffer_full(struct domain *d);
> +#else
> +static inline void ffa_raise_rx_buffer_full(struct domain *d)
> +{
> +}

Shouldn't this go in the previous patch "xen/arm: ffa: Add buffer full
notification support"?

Cheers,
Jens

>  #endif
>
>  void ffa_handle_msg_send_direct_req(struct cpu_user_regs *regs, uint32_t 
> fid);
> --
> 2.47.1
>