diff mbox series

[v3,4/5] xen/arm: ffa: Add indirect message between VM

Message ID 4a9867855093453eaad4f548df8e92162176eed9.1742570590.git.bertrand.marquis@arm.com (mailing list archive)
State Superseded
Headers show
Series FF-A VM to VM support | expand

Commit Message

Bertrand Marquis March 24, 2025, 9:14 a.m. UTC 
Add support for indirect messages between VMs.
This is only enabled if CONFIG_FFA_VM_TO_VM is selected.

Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
---
Changes in v3:
- Move vm to vm indirect message handling in a sub function to simplify
  lock handling and make implementation easier to read
Changes in v2:
- Switch ifdef to IS_ENABLED
---
 xen/arch/arm/tee/ffa_msg.c | 96 ++++++++++++++++++++++++++++++++++----
 1 file changed, 88 insertions(+), 8 deletions(-)

Comments

Jens Wiklander March 24, 2025, 10:41 a.m. UTC | #1 
Hi Bertrand,

On Mon, Mar 24, 2025 at 10:15 AM Bertrand Marquis
<bertrand.marquis@arm.com> wrote:
>
> Add support for indirect messages between VMs.
> This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
>
> Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
> ---
> Changes in v3:
> - Move vm to vm indirect message handling in a sub function to simplify
>   lock handling and make implementation easier to read
> Changes in v2:
> - Switch ifdef to IS_ENABLED
> ---
>  xen/arch/arm/tee/ffa_msg.c | 96 ++++++++++++++++++++++++++++++++++----
>  1 file changed, 88 insertions(+), 8 deletions(-)
>
> diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
> index ee594e737fc7..c21083b5e68f 100644
> --- a/xen/arch/arm/tee/ffa_msg.c
> +++ b/xen/arch/arm/tee/ffa_msg.c
> @@ -88,6 +88,72 @@ out:
>                   resp.a7 & mask);
>  }
>
> +static int32_t ffa_msg_send2_vm(uint16_t dst_id,
> +                                const struct ffa_part_msg_rxtx *src_msg)
> +{
> +    struct domain *dst_d;
> +    struct ffa_ctx *dst_ctx;
> +    struct ffa_part_msg_rxtx *dst_msg;
> +    int err;
> +    int32_t ret;
> +
> +    if ( dst_id == 0 )
> +        /* FF-A ID 0 is the hypervisor, this is not valid */
> +        return FFA_RET_INVALID_PARAMETERS;
> +
> +    /* This is also checking that dest is not src */
> +    err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
> +    if ( err )
> +        return FFA_RET_INVALID_PARAMETERS;
> +
> +    if ( dst_d->arch.tee == NULL )
> +    {
> +        ret = FFA_RET_INVALID_PARAMETERS;
> +        goto out_unlock;
> +    }
> +
> +    dst_ctx = dst_d->arch.tee;
> +    if ( !dst_ctx->guest_vers )
> +    {
> +        ret = FFA_RET_INVALID_PARAMETERS;
> +        goto out_unlock;
> +    }
> +
> +    /* we need to have enough space in the destination buffer */
> +    if ( dst_ctx->page_count * FFA_PAGE_SIZE <
> +            (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
> +    {
> +        ret = FFA_RET_NO_MEMORY;
> +        goto out_unlock;
> +    }
> +
> +    /* This also checks that destination has set a Rx buffer */
> +    ret = ffa_rx_acquire(dst_d);
> +    if ( ret )
> +        goto out_unlock;
> +
> +    dst_msg = dst_ctx->rx;
> +
> +    /* prepare destination header */
> +    dst_msg->flags = 0;
> +    dst_msg->reserved = 0;
> +    dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
> +    dst_msg->send_recv_id = src_msg->send_recv_id;
> +    dst_msg->msg_size = src_msg->msg_size;
> +
> +    memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
> +           ((void *)src_msg) + src_msg->msg_offset, src_msg->msg_size);

Is it possible for another core in the VM to modify
src_msg->msg_offset or src_msg->msg_size after we check them but
before we use them here (TOC/TOU)?

Cheers,
Jens

> +
> +    /* receiver rx buffer will be released by the receiver*/
> +
> +out_unlock:
> +    rcu_unlock_domain(dst_d);
> +    if ( !ret )
> +        ffa_raise_rx_buffer_full(dst_d);
> +
> +    return ret;
> +}
> +
>  int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>  {
>      struct domain *src_d = current->domain;
> @@ -96,9 +162,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>      uint16_t dst_id, src_id;
>      int32_t ret;
>
> -    if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
> -        return FFA_RET_NOT_SUPPORTED;
> -
>      if ( !spin_trylock(&src_ctx->tx_lock) )
>          return FFA_RET_BUSY;
>
> @@ -106,10 +169,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>      src_id = src_msg->send_recv_id >> 16;
>      dst_id = src_msg->send_recv_id & GENMASK(15,0);
>
> -    if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
> +    if ( src_id != ffa_get_vm_id(src_d) )
>      {
>          ret = FFA_RET_INVALID_PARAMETERS;
> -        goto out_unlock_tx;
> +        goto out;
>      }
>
>      /* check source message fits in buffer */
> @@ -118,13 +181,30 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>           src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
>      {
>          ret = FFA_RET_INVALID_PARAMETERS;
> -        goto out_unlock_tx;
> +        goto out;
>      }
>
> -    ret = ffa_simple_call(FFA_MSG_SEND2,
> +    if ( FFA_ID_IS_SECURE(dst_id) )
> +    {
> +        /* Message for a secure partition */
> +        if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
> +        {
> +            ret = FFA_RET_NOT_SUPPORTED;
> +            goto out;
> +        }
> +
> +        ret = ffa_simple_call(FFA_MSG_SEND2,
>                            ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
> +    }
> +    else if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
> +    {
> +        /* Message for a VM */
> +        ret = ffa_msg_send2_vm(dst_id, src_msg);
> +    }
> +    else
> +        ret = FFA_RET_INVALID_PARAMETERS;
>
> -out_unlock_tx:
> +out:
>      spin_unlock(&src_ctx->tx_lock);
>      return ret;
>  }
> --
> 2.47.1
>
Bertrand Marquis March 24, 2025, 1:06 p.m. UTC | #2 
Hi Jens,

> On 24 Mar 2025, at 11:41, Jens Wiklander <jens.wiklander@linaro.org> wrote:
> 
> Hi Bertrand,
> 
> On Mon, Mar 24, 2025 at 10:15 AM Bertrand Marquis
> <bertrand.marquis@arm.com> wrote:
>> 
>> Add support for indirect messages between VMs.
>> This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
>> 
>> Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
>> ---
>> Changes in v3:
>> - Move vm to vm indirect message handling in a sub function to simplify
>>  lock handling and make implementation easier to read
>> Changes in v2:
>> - Switch ifdef to IS_ENABLED
>> ---
>> xen/arch/arm/tee/ffa_msg.c | 96 ++++++++++++++++++++++++++++++++++----
>> 1 file changed, 88 insertions(+), 8 deletions(-)
>> 
>> diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
>> index ee594e737fc7..c21083b5e68f 100644
>> --- a/xen/arch/arm/tee/ffa_msg.c
>> +++ b/xen/arch/arm/tee/ffa_msg.c
>> @@ -88,6 +88,72 @@ out:
>>                  resp.a7 & mask);
>> }
>> 
>> +static int32_t ffa_msg_send2_vm(uint16_t dst_id,
>> +                                const struct ffa_part_msg_rxtx *src_msg)
>> +{
>> +    struct domain *dst_d;
>> +    struct ffa_ctx *dst_ctx;
>> +    struct ffa_part_msg_rxtx *dst_msg;
>> +    int err;
>> +    int32_t ret;
>> +
>> +    if ( dst_id == 0 )
>> +        /* FF-A ID 0 is the hypervisor, this is not valid */
>> +        return FFA_RET_INVALID_PARAMETERS;
>> +
>> +    /* This is also checking that dest is not src */
>> +    err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
>> +    if ( err )
>> +        return FFA_RET_INVALID_PARAMETERS;
>> +
>> +    if ( dst_d->arch.tee == NULL )
>> +    {
>> +        ret = FFA_RET_INVALID_PARAMETERS;
>> +        goto out_unlock;
>> +    }
>> +
>> +    dst_ctx = dst_d->arch.tee;
>> +    if ( !dst_ctx->guest_vers )
>> +    {
>> +        ret = FFA_RET_INVALID_PARAMETERS;
>> +        goto out_unlock;
>> +    }
>> +
>> +    /* we need to have enough space in the destination buffer */
>> +    if ( dst_ctx->page_count * FFA_PAGE_SIZE <
>> +            (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
>> +    {
>> +        ret = FFA_RET_NO_MEMORY;
>> +        goto out_unlock;
>> +    }
>> +
>> +    /* This also checks that destination has set a Rx buffer */
>> +    ret = ffa_rx_acquire(dst_d);
>> +    if ( ret )
>> +        goto out_unlock;
>> +
>> +    dst_msg = dst_ctx->rx;
>> +
>> +    /* prepare destination header */
>> +    dst_msg->flags = 0;
>> +    dst_msg->reserved = 0;
>> +    dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
>> +    dst_msg->send_recv_id = src_msg->send_recv_id;
>> +    dst_msg->msg_size = src_msg->msg_size;
>> +
>> +    memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
>> +           ((void *)src_msg) + src_msg->msg_offset, src_msg->msg_size);
> 
> Is it possible for another core in the VM to modify
> src_msg->msg_offset or src_msg->msg_size after we check them but
> before we use them here (TOC/TOU)?

Yes there could be a possibility.
I will switch to a local copy of the header to prevent this.

Nice finding.

Cheers
Bertrand

> 
> Cheers,
> Jens
> 
>> +
>> +    /* receiver rx buffer will be released by the receiver*/
>> +
>> +out_unlock:
>> +    rcu_unlock_domain(dst_d);
>> +    if ( !ret )
>> +        ffa_raise_rx_buffer_full(dst_d);
>> +
>> +    return ret;
>> +}
>> +
>> int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>> {
>>     struct domain *src_d = current->domain;
>> @@ -96,9 +162,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>>     uint16_t dst_id, src_id;
>>     int32_t ret;
>> 
>> -    if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
>> -        return FFA_RET_NOT_SUPPORTED;
>> -
>>     if ( !spin_trylock(&src_ctx->tx_lock) )
>>         return FFA_RET_BUSY;
>> 
>> @@ -106,10 +169,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>>     src_id = src_msg->send_recv_id >> 16;
>>     dst_id = src_msg->send_recv_id & GENMASK(15,0);
>> 
>> -    if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
>> +    if ( src_id != ffa_get_vm_id(src_d) )
>>     {
>>         ret = FFA_RET_INVALID_PARAMETERS;
>> -        goto out_unlock_tx;
>> +        goto out;
>>     }
>> 
>>     /* check source message fits in buffer */
>> @@ -118,13 +181,30 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>>          src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
>>     {
>>         ret = FFA_RET_INVALID_PARAMETERS;
>> -        goto out_unlock_tx;
>> +        goto out;
>>     }
>> 
>> -    ret = ffa_simple_call(FFA_MSG_SEND2,
>> +    if ( FFA_ID_IS_SECURE(dst_id) )
>> +    {
>> +        /* Message for a secure partition */
>> +        if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
>> +        {
>> +            ret = FFA_RET_NOT_SUPPORTED;
>> +            goto out;
>> +        }
>> +
>> +        ret = ffa_simple_call(FFA_MSG_SEND2,
>>                           ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
>> +    }
>> +    else if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
>> +    {
>> +        /* Message for a VM */
>> +        ret = ffa_msg_send2_vm(dst_id, src_msg);
>> +    }
>> +    else
>> +        ret = FFA_RET_INVALID_PARAMETERS;
>> 
>> -out_unlock_tx:
>> +out:
>>     spin_unlock(&src_ctx->tx_lock);
>>     return ret;
>> }
>> --
>> 2.47.1
diff mbox series

Patch

diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
index ee594e737fc7..c21083b5e68f 100644
--- a/xen/arch/arm/tee/ffa_msg.c
+++ b/xen/arch/arm/tee/ffa_msg.c
@@ -88,6 +88,72 @@  out:
                  resp.a7 & mask);
 }
 
+static int32_t ffa_msg_send2_vm(uint16_t dst_id,
+                                const struct ffa_part_msg_rxtx *src_msg)
+{
+    struct domain *dst_d;
+    struct ffa_ctx *dst_ctx;
+    struct ffa_part_msg_rxtx *dst_msg;
+    int err;
+    int32_t ret;
+
+    if ( dst_id == 0 )
+        /* FF-A ID 0 is the hypervisor, this is not valid */
+        return FFA_RET_INVALID_PARAMETERS;
+
+    /* This is also checking that dest is not src */
+    err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
+    if ( err )
+        return FFA_RET_INVALID_PARAMETERS;
+
+    if ( dst_d->arch.tee == NULL )
+    {
+        ret = FFA_RET_INVALID_PARAMETERS;
+        goto out_unlock;
+    }
+
+    dst_ctx = dst_d->arch.tee;
+    if ( !dst_ctx->guest_vers )
+    {
+        ret = FFA_RET_INVALID_PARAMETERS;
+        goto out_unlock;
+    }
+
+    /* we need to have enough space in the destination buffer */
+    if ( dst_ctx->page_count * FFA_PAGE_SIZE <
+            (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
+    {
+        ret = FFA_RET_NO_MEMORY;
+        goto out_unlock;
+    }
+
+    /* This also checks that destination has set a Rx buffer */
+    ret = ffa_rx_acquire(dst_d);
+    if ( ret )
+        goto out_unlock;
+
+    dst_msg = dst_ctx->rx;
+
+    /* prepare destination header */
+    dst_msg->flags = 0;
+    dst_msg->reserved = 0;
+    dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
+    dst_msg->send_recv_id = src_msg->send_recv_id;
+    dst_msg->msg_size = src_msg->msg_size;
+
+    memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
+           ((void *)src_msg) + src_msg->msg_offset, src_msg->msg_size);
+
+    /* receiver rx buffer will be released by the receiver*/
+
+out_unlock:
+    rcu_unlock_domain(dst_d);
+    if ( !ret )
+        ffa_raise_rx_buffer_full(dst_d);
+
+    return ret;
+}
+
 int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
 {
     struct domain *src_d = current->domain;
@@ -96,9 +162,6 @@  int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
     uint16_t dst_id, src_id;
     int32_t ret;
 
-    if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
-        return FFA_RET_NOT_SUPPORTED;
-
     if ( !spin_trylock(&src_ctx->tx_lock) )
         return FFA_RET_BUSY;
 
@@ -106,10 +169,10 @@  int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
     src_id = src_msg->send_recv_id >> 16;
     dst_id = src_msg->send_recv_id & GENMASK(15,0);
 
-    if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
+    if ( src_id != ffa_get_vm_id(src_d) )
     {
         ret = FFA_RET_INVALID_PARAMETERS;
-        goto out_unlock_tx;
+        goto out;
     }
 
     /* check source message fits in buffer */
@@ -118,13 +181,30 @@  int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
          src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
     {
         ret = FFA_RET_INVALID_PARAMETERS;
-        goto out_unlock_tx;
+        goto out;
     }
 
-    ret = ffa_simple_call(FFA_MSG_SEND2,
+    if ( FFA_ID_IS_SECURE(dst_id) )
+    {
+        /* Message for a secure partition */
+        if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
+        {
+            ret = FFA_RET_NOT_SUPPORTED;
+            goto out;
+        }
+
+        ret = ffa_simple_call(FFA_MSG_SEND2,
                           ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
+    }
+    else if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
+    {
+        /* Message for a VM */
+        ret = ffa_msg_send2_vm(dst_id, src_msg);
+    }
+    else
+        ret = FFA_RET_INVALID_PARAMETERS;
 
-out_unlock_tx:
+out:
     spin_unlock(&src_ctx->tx_lock);
     return ret;
 }