Hi Jens,
> On 24 Mar 2025, at 11:41, Jens Wiklander <jens.wiklan...@linaro.org> wrote:
>
> Hi Bertrand,
>
> On Mon, Mar 24, 2025 at 10:15 AM Bertrand Marquis
> <bertrand.marq...@arm.com> wrote:
>>
>> Add support for indirect messages between VMs.
>> This is only enabled if CONFIG_FFA_VM_TO_VM is selected.
>>
>> Signed-off-by: Bertrand Marquis <bertrand.marq...@arm.com>
>> ---
>> Changes in v3:
>> - Move vm to vm indirect message handling in a sub function to simplify
>> lock handling and make implementation easier to read
>> Changes in v2:
>> - Switch ifdef to IS_ENABLED
>> ---
>> xen/arch/arm/tee/ffa_msg.c | 96 ++++++++++++++++++++++++++++++++++----
>> 1 file changed, 88 insertions(+), 8 deletions(-)
>>
>> diff --git a/xen/arch/arm/tee/ffa_msg.c b/xen/arch/arm/tee/ffa_msg.c
>> index ee594e737fc7..c21083b5e68f 100644
>> --- a/xen/arch/arm/tee/ffa_msg.c
>> +++ b/xen/arch/arm/tee/ffa_msg.c
>> @@ -88,6 +88,72 @@ out:
>> resp.a7 & mask);
>> }
>>
>> +static int32_t ffa_msg_send2_vm(uint16_t dst_id,
>> + const struct ffa_part_msg_rxtx *src_msg)
>> +{
>> + struct domain *dst_d;
>> + struct ffa_ctx *dst_ctx;
>> + struct ffa_part_msg_rxtx *dst_msg;
>> + int err;
>> + int32_t ret;
>> +
>> + if ( dst_id == 0 )
>> + /* FF-A ID 0 is the hypervisor, this is not valid */
>> + return FFA_RET_INVALID_PARAMETERS;
>> +
>> + /* This is also checking that dest is not src */
>> + err = rcu_lock_live_remote_domain_by_id(dst_id - 1, &dst_d);
>> + if ( err )
>> + return FFA_RET_INVALID_PARAMETERS;
>> +
>> + if ( dst_d->arch.tee == NULL )
>> + {
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> + goto out_unlock;
>> + }
>> +
>> + dst_ctx = dst_d->arch.tee;
>> + if ( !dst_ctx->guest_vers )
>> + {
>> + ret = FFA_RET_INVALID_PARAMETERS;
>> + goto out_unlock;
>> + }
>> +
>> + /* we need to have enough space in the destination buffer */
>> + if ( dst_ctx->page_count * FFA_PAGE_SIZE <
>> + (sizeof(struct ffa_part_msg_rxtx) + src_msg->msg_size) )
>> + {
>> + ret = FFA_RET_NO_MEMORY;
>> + goto out_unlock;
>> + }
>> +
>> + /* This also checks that destination has set a Rx buffer */
>> + ret = ffa_rx_acquire(dst_d);
>> + if ( ret )
>> + goto out_unlock;
>> +
>> + dst_msg = dst_ctx->rx;
>> +
>> + /* prepare destination header */
>> + dst_msg->flags = 0;
>> + dst_msg->reserved = 0;
>> + dst_msg->msg_offset = sizeof(struct ffa_part_msg_rxtx);
>> + dst_msg->send_recv_id = src_msg->send_recv_id;
>> + dst_msg->msg_size = src_msg->msg_size;
>> +
>> + memcpy(dst_ctx->rx + sizeof(struct ffa_part_msg_rxtx),
>> + ((void *)src_msg) + src_msg->msg_offset, src_msg->msg_size);
>
> Is it possible for another core in the VM to modify
> src_msg->msg_offset or src_msg->msg_size after we check them but
> before we use them here (TOC/TOU)?
Yes there could be a possibility.
I will switch to a local copy of the header to prevent this.
Nice finding.
Cheers
Bertrand
>
> Cheers,
> Jens
>
>> +
>> + /* receiver rx buffer will be released by the receiver*/
>> +
>> +out_unlock:
>> + rcu_unlock_domain(dst_d);
>> + if ( !ret )
>> + ffa_raise_rx_buffer_full(dst_d);
>> +
>> + return ret;
>> +}
>> +
>> int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>> {
>> struct domain *src_d = current->domain;
>> @@ -96,9 +162,6 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs *regs)
>> uint16_t dst_id, src_id;
>> int32_t ret;
>>
>> - if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
>> - return FFA_RET_NOT_SUPPORTED;
>> -
>> if ( !spin_trylock(&src_ctx->tx_lock) )
>> return FFA_RET_BUSY;
>>
>> @@ -106,10 +169,10 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs
>> *regs)
>> src_id = src_msg->send_recv_id >> 16;
>> dst_id = src_msg->send_recv_id & GENMASK(15,0);
>>
>> - if ( src_id != ffa_get_vm_id(src_d) || !FFA_ID_IS_SECURE(dst_id) )
>> + if ( src_id != ffa_get_vm_id(src_d) )
>> {
>> ret = FFA_RET_INVALID_PARAMETERS;
>> - goto out_unlock_tx;
>> + goto out;
>> }
>>
>> /* check source message fits in buffer */
>> @@ -118,13 +181,30 @@ int32_t ffa_handle_msg_send2(struct cpu_user_regs
>> *regs)
>> src_msg->msg_offset < sizeof(struct ffa_part_msg_rxtx) )
>> {
>> ret = FFA_RET_INVALID_PARAMETERS;
>> - goto out_unlock_tx;
>> + goto out;
>> }
>>
>> - ret = ffa_simple_call(FFA_MSG_SEND2,
>> + if ( FFA_ID_IS_SECURE(dst_id) )
>> + {
>> + /* Message for a secure partition */
>> + if ( !ffa_fw_supports_fid(FFA_MSG_SEND2) )
>> + {
>> + ret = FFA_RET_NOT_SUPPORTED;
>> + goto out;
>> + }
>> +
>> + ret = ffa_simple_call(FFA_MSG_SEND2,
>> ((uint32_t)ffa_get_vm_id(src_d)) << 16, 0, 0, 0);
>> + }
>> + else if ( IS_ENABLED(CONFIG_FFA_VM_TO_VM) )
>> + {
>> + /* Message for a VM */
>> + ret = ffa_msg_send2_vm(dst_id, src_msg);
>> + }
>> + else
>> + ret = FFA_RET_INVALID_PARAMETERS;
>>
>> -out_unlock_tx:
>> +out:
>> spin_unlock(&src_ctx->tx_lock);
>> return ret;
>> }
>> --
>> 2.47.1
