Implement SPCI pull model for memory sharing.
Bug: 132420445
Change-Id: Iac21d7949bc54da13a4f25a317f5e83b2727638c
diff --git a/Makefile b/Makefile
index 01627c5..ecaa9c8 100644
--- a/Makefile
+++ b/Makefile
@@ -43,7 +43,7 @@
CHECKPATCH := $(CURDIR)/third_party/linux/scripts/checkpatch.pl \
- --ignore BRACES,SPDX_LICENSE_TAG,VOLATILE,SPLIT_STRING,AVOID_EXTERNS,USE_SPINLOCK_T,NEW_TYPEDEFS,INITIALISED_STATIC,FILE_PATH_CHANGES,EMBEDDED_FUNCTION_NAME,SINGLE_STATEMENT_DO_WHILE_MACRO,MACRO_WITH_FLOW_CONTROL,PREFER_PACKED,PREFER_ALIGNED --quiet
+ --ignore BRACES,SPDX_LICENSE_TAG,VOLATILE,SPLIT_STRING,AVOID_EXTERNS,USE_SPINLOCK_T,NEW_TYPEDEFS,INITIALISED_STATIC,FILE_PATH_CHANGES,EMBEDDED_FUNCTION_NAME,SINGLE_STATEMENT_DO_WHILE_MACRO,MACRO_WITH_FLOW_CONTROL,PREFER_PACKED,PREFER_ALIGNED,INDENTED_LABEL --quiet
# Specifies the grep pattern for ignoring specific files in checkpatch.
# C++ headers, *.hh, are automatically excluded.
diff --git a/inc/hf/api.h b/inc/hf/api.h
index c5ebe2a..d6de2cb 100644
--- a/inc/hf/api.h
+++ b/inc/hf/api.h
@@ -65,3 +65,11 @@
uint32_t fragment_length, uint32_t length,
uint32_t cookie, struct vcpu *current,
struct vcpu **next);
+struct spci_value api_spci_mem_retrieve_req(ipaddr_t address,
+ uint32_t page_count,
+ uint32_t fragment_length,
+ uint32_t length, uint32_t cookie,
+ struct vcpu *current);
+struct spci_value api_spci_mem_relinquish(struct vcpu *current);
+struct spci_value api_spci_mem_reclaim(uint32_t handle, uint32_t flags,
+ struct vcpu *current);
diff --git a/inc/hf/mm.h b/inc/hf/mm.h
index 43d4c79..6fb9296 100644
--- a/inc/hf/mm.h
+++ b/inc/hf/mm.h
@@ -79,6 +79,8 @@
/* clang-format on */
+#define MM_PPOOL_ENTRY_SIZE sizeof(struct mm_page_table)
+
struct mm_page_table {
alignas(PAGE_SIZE) pte_t entries[MM_PTE_PER_PAGE];
};
diff --git a/inc/hf/spci_memory.h b/inc/hf/spci_memory.h
index fc21e09..023a8ce 100644
--- a/inc/hf/spci_memory.h
+++ b/inc/hf/spci_memory.h
@@ -21,9 +21,19 @@
#include "vmapi/hf/spci.h"
-struct spci_value spci_memory_send(struct vm_locked to_locked,
- struct vm_locked from_locked,
+struct spci_value spci_memory_send(struct vm *to, struct vm_locked from_locked,
struct spci_memory_region *memory_region,
uint32_t memory_share_size,
uint32_t share_func,
struct mpool *page_pool);
+struct spci_value spci_memory_retrieve(
+ struct vm_locked to_locked,
+ struct spci_memory_retrieve_request *retrieve_request,
+ uint32_t retrieve_request_size, struct mpool *page_pool);
+struct spci_value spci_memory_relinquish(
+ struct vm_locked from_locked,
+ struct spci_mem_relinquish *relinquish_request,
+ struct mpool *page_pool);
+struct spci_value spci_memory_reclaim(struct vm_locked to_locked,
+ spci_memory_handle_t handle, bool clear,
+ struct mpool *page_pool);
diff --git a/inc/vmapi/hf/abi.h b/inc/vmapi/hf/abi.h
index 2802479..ed004b7 100644
--- a/inc/vmapi/hf/abi.h
+++ b/inc/vmapi/hf/abi.h
@@ -35,9 +35,6 @@
#define HF_SPCI_RUN_WAIT_FOR_INTERRUPT 0xff09
#define HF_SPCI_RUN_WAKE_UP 0xff0a
-/* Custom SPCI-like call for relinquishing memory in the push model. */
-#define HF_SPCI_MEM_RELINQUISH 0xffab
-
/* This matches what Trusty and its ATF module currently use. */
#define HF_DEBUG_LOG 0xbd000000
diff --git a/inc/vmapi/hf/call.h b/inc/vmapi/hf/call.h
index 5a1e097..f3557b6 100644
--- a/inc/vmapi/hf/call.h
+++ b/inc/vmapi/hf/call.h
@@ -159,16 +159,28 @@
.arg5 = cookie});
}
-static inline struct spci_value hf_spci_mem_relinquish(uint32_t fragment_length,
- uint32_t length,
- uint32_t cookie)
+static inline struct spci_value spci_mem_retrieve_req(uint32_t fragment_length,
+ uint32_t length,
+ uint32_t cookie)
{
- return spci_call((struct spci_value){.func = HF_SPCI_MEM_RELINQUISH,
+ return spci_call((struct spci_value){.func = SPCI_MEM_RETRIEVE_REQ_32,
.arg3 = fragment_length,
.arg4 = length,
.arg5 = cookie});
}
+static inline struct spci_value spci_mem_relinquish(void)
+{
+ return spci_call((struct spci_value){.func = SPCI_MEM_RELINQUISH_32});
+}
+
+static inline struct spci_value spci_mem_reclaim(uint32_t handle,
+ uint32_t flags)
+{
+ return spci_call((struct spci_value){
+ .func = SPCI_MEM_RECLAIM_32, .arg1 = handle, .arg2 = flags});
+}
+
/**
* Called by secondary VMs to receive a message. This will block until a message
* is received.
diff --git a/inc/vmapi/hf/spci.h b/inc/vmapi/hf/spci.h
index 98fad84..0422415 100644
--- a/inc/vmapi/hf/spci.h
+++ b/inc/vmapi/hf/spci.h
@@ -47,6 +47,10 @@
#define SPCI_MEM_DONATE_32 0x84000071
#define SPCI_MEM_LEND_32 0x84000072
#define SPCI_MEM_SHARE_32 0x84000073
+#define SPCI_MEM_RETRIEVE_REQ_32 0x84000074
+#define SPCI_MEM_RETRIEVE_RESP_32 0x84000075
+#define SPCI_MEM_RELINQUISH_32 0x84000076
+#define SPCI_MEM_RECLAIM_32 0x84000077
/* SPCI error codes. */
#define SPCI_NOT_SUPPORTED INT32_C(-1)
@@ -65,6 +69,8 @@
#define SPCI_MSG_SEND_NOTIFY 0x1
#define SPCI_MSG_SEND_NOTIFY_MASK 0x1
+#define SPCI_MEM_RECLAIM_CLEAR 0x1
+
#define SPCI_SLEEP_INDEFINITE 0
/**
@@ -157,6 +163,10 @@
/* clang-format on */
+#define SPCI_MEMORY_HANDLE_ALLOCATOR_MASK ((spci_memory_handle_t)(1U << 31))
+#define SPCI_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR \
+ ((spci_memory_handle_t)(1U << 31))
+
/** The ID of a VM. These are assigned sequentially starting with an offset. */
typedef uint16_t spci_vm_id_t;
typedef uint32_t spci_memory_handle_t;
@@ -208,6 +218,12 @@
return args.arg4;
}
+static inline spci_memory_handle_t spci_mem_success_handle(
+ struct spci_value args)
+{
+ return args.arg2;
+}
+
static inline spci_vm_id_t spci_vm_id(struct spci_value args)
{
return (args.arg1 >> 16) & 0xffff;
@@ -304,6 +320,132 @@
struct spci_memory_region_attributes attributes[];
};
+/**
+ * Retrieval attributes for a single receiver. This corresponds to table 138 of
+ * the SPCI beta specification, "Descriptor with properties to retrieve a memory
+ * region".
+ */
+struct spci_memory_retrieve_properties {
+ struct spci_memory_region_attributes attributes;
+ uint32_t page_count;
+ uint32_t constituent_count;
+ /** Reserved field, must be 0. */
+ uint32_t reserved;
+ struct spci_memory_region_constituent constituents[];
+};
+
+/**
+ * Descriptor used for SPCI_MEM_RETRIEVE_REQ. This corresponds to table 137 of
+ * the SPCI beta specification, "Descriptor to retrieve a donated, lent or
+ * shared memory region".
+ */
+struct spci_memory_retrieve_request {
+ /** Globally unique handle to identify the memory transaction. */
+ spci_memory_handle_t handle;
+ /** ID of the VM which sent the memory. */
+ spci_vm_id_t sender;
+ /** Reserved field, must be 0. */
+ uint16_t reserved_0;
+ /** Function ID of the memory sharing operation. */
+ uint32_t share_func;
+ /**
+ * An implementation defined value associated with the receiver and the
+ * memory region.
+ */
+ uint32_t tag;
+ /**
+ * The number of descriptors to specify the attributes with which the
+ * memory region will be mapped in the other recipients. Hafnium doesn't
+ * support multi-way memory sharing so this should always be 0.
+ */
+ uint32_t attribute_count;
+ /**
+ * The offset in bytes from the base address of this
+ * `spci_memory_retrieve_request` to the start of the first attribute
+ * descriptor.
+ */
+ uint32_t attribute_offset;
+ /**
+ * The number of `spci_memory_retrieve_properties` entries included
+ * in this retrieve request, i.e. the number of receivers including the
+ * caller and any stream endpoints for which the caller is a proxy.
+ * Hafnium doesn't support stream endpoints, so this should always be 1.
+ */
+ uint32_t retrieve_properties_count;
+ /** Reserved field, must be 0. */
+ uint32_t reserved_1;
+ /*
+ * 'Array' of `struct spci_memory_retrieve_properties` goes here, but it
+ * is not included in the struct as the entries are variable length. Use
+ * `spci_memory_retrieve_request_first_retrieve_properties` to get the
+ * first one.
+ */
+};
+
+/**
+ * Receiver address range descriptor. This corresponds to table 144 of the SPCI
+ * beta specification, "Descriptor with address ranges of retrieved memory
+ * region", and is included as part of the `spci_retrieved_memory_region`.
+ */
+struct spci_receiver_address_range {
+ /** Receiver VM ID. */
+ spci_vm_id_t receiver;
+ /** Reserved field, must be 0. */
+ uint16_t reserved_0;
+ /**
+ * The total number of 4 kiB pages included in this memory region. This
+ * must be equal to the sum of page counts specified in each
+ * `spci_memory_region_constituent`.
+ */
+ uint32_t page_count;
+ /**
+ * The number of constituents (`spci_memory_region_constituent`)
+ * included in this memory region range.
+ */
+ uint32_t constituent_count;
+ /** Reserved field, must be 0. */
+ uint32_t reserved_1;
+ /** An array of `constituent_count` memory region constituents. */
+ struct spci_memory_region_constituent constituents[];
+};
+
+/**
+ * Descriptor used for SPCI_MEM_RETRIEVE_RESP. This corresponds to table 143 of
+ * the SPCI beta specification, "Encoding of mapped address ranges of retrieved
+ * memory region".
+ */
+struct spci_retrieved_memory_region {
+ /**
+ * The number of `spci_receiver_address_range` entries included
+ * in this memory region.
+ */
+ uint32_t receiver_count;
+ /** Reserved field, must be 0. */
+ uint32_t reserved_0;
+ /** Reserved field, must be 0. */
+ uint64_t reserved_1;
+ /*
+ * 'Array' of `struct spci_receiver_address_range` goes here, but it is
+ * not included in the struct as the entries are variable length. Use
+ * `spci_retrieved_memory_region_first_receiver_range` to get the first
+ * one.
+ */
+};
+
+/**
+ * Descriptor used for SPCI_MEM_RELINQUISH requests. This corresponds to table
+ * 146 of the SPCI beta specification, "Descriptor to relinquish a memory
+ * region".
+ */
+struct spci_mem_relinquish {
+ spci_memory_handle_t handle;
+ uint32_t flags;
+ spci_vm_id_t sender;
+ uint16_t reserved;
+ uint32_t endpoint_count;
+ spci_vm_id_t endpoints[];
+};
+
static inline struct spci_memory_region_constituent
spci_memory_region_constituent_init(uint64_t address, uint32_t page_count)
{
@@ -332,6 +474,33 @@
memory_region->constituent_offset);
}
+/**
+ * Gets the first descriptor with address ranges of a retrieved memory region.
+ *
+ * Note that getting the second requires parsing the first, as they are variable
+ * length due to the variable number of constituents.
+ */
+static inline struct spci_receiver_address_range *
+spci_retrieved_memory_region_first_receiver_range(
+ struct spci_retrieved_memory_region *memory_region)
+{
+ return (struct spci_receiver_address_range *)(memory_region + 1);
+}
+
+/**
+ * Gets the first retrieval attributes descriptor of a memory region retrieval
+ * request.
+ *
+ * Note that getting the second requires parsing the first, as they are variable
+ * length due to the variable number of constituents.
+ */
+static inline struct spci_memory_retrieve_properties *
+spci_memory_retrieve_request_first_retrieve_properties(
+ struct spci_memory_retrieve_request *retrieve_request)
+{
+ return (struct spci_memory_retrieve_properties *)(retrieve_request + 1);
+}
+
uint32_t spci_memory_region_init(
struct spci_memory_region *memory_region, spci_vm_id_t sender,
spci_vm_id_t receiver,
@@ -340,3 +509,15 @@
spci_memory_region_flags_t flags, enum spci_memory_access access,
enum spci_memory_type type, enum spci_memory_cacheability cacheability,
enum spci_memory_shareability shareability);
+uint32_t spci_memory_retrieve_request_init(
+ struct spci_memory_retrieve_request *request,
+ spci_memory_handle_t handle, spci_vm_id_t sender, spci_vm_id_t receiver,
+ uint32_t share_func, uint32_t tag, uint32_t page_count,
+ enum spci_memory_access access, enum spci_memory_type type,
+ enum spci_memory_cacheability cacheability,
+ enum spci_memory_shareability shareability);
+uint32_t spci_retrieved_memory_region_init(
+ struct spci_retrieved_memory_region *response, size_t response_max_size,
+ spci_vm_id_t receiver,
+ const struct spci_memory_region_constituent constituents[],
+ uint32_t constituent_count, uint32_t page_count);
diff --git a/inc/vmapi/hf/types.h b/inc/vmapi/hf/types.h
index dc9f7a1..d0989c7 100644
--- a/inc/vmapi/hf/types.h
+++ b/inc/vmapi/hf/types.h
@@ -35,6 +35,8 @@
#endif
+#define HF_HYPERVISOR_VM_ID 0
+
/**
* An offset to use when assigning VM IDs.
* The offset is needed because VM ID 0 is reserved.
diff --git a/src/BUILD.gn b/src/BUILD.gn
index 04e0923..3220b4e 100644
--- a/src/BUILD.gn
+++ b/src/BUILD.gn
@@ -71,6 +71,7 @@
":std",
":string",
"//src/arch/${plat_arch}/hypervisor",
+ "//vmlib",
plat_boot_flow,
plat_console,
plat_iommu,
diff --git a/src/api.c b/src/api.c
index 39da4d8..981fd5d 100644
--- a/src/api.c
+++ b/src/api.c
@@ -49,6 +49,11 @@
"Currently, a page is mapped for the send and receive buffers so "
"the maximum request is the size of a page.");
+static_assert(MM_PPOOL_ENTRY_SIZE >= HF_MAILBOX_SIZE,
+ "The page pool entry size must be at least as big as the mailbox "
+ "size, so that memory region descriptors can be copied from the "
+ "mailbox for memory sharing.");
+
static struct mpool api_page_pool;
/**
@@ -380,7 +385,6 @@
case SPCI_MEM_DONATE_32:
case SPCI_MEM_LEND_32:
case SPCI_MEM_SHARE_32:
- case HF_SPCI_MEM_RELINQUISH:
return (struct spci_value){.func = receiver->mailbox.recv_func,
.arg3 = receiver->mailbox.recv_size,
.arg4 = receiver->mailbox.recv_size};
@@ -1453,9 +1457,7 @@
struct vm *from = current->vm;
struct vm *to;
const void *from_msg;
- uint32_t message_buffer_size;
struct spci_memory_region *memory_region;
- struct two_vm_locked vm_to_from_lock;
struct spci_value ret;
if (ipa_addr(address) != 0 || page_count != 0) {
@@ -1486,25 +1488,36 @@
}
/*
- * Copy the memory region descriptor to an internal buffer, so that the
- * sender can't change it underneath us.
+ * Copy the memory region descriptor to a fresh page from the memory
+ * pool. This prevents the sender from changing it underneath us, and
+ * also lets us keep it around in the share state table if needed.
*/
- memory_region =
- (struct spci_memory_region *)cpu_get_buffer(current->cpu);
- message_buffer_size = cpu_get_buffer_size(current->cpu);
- if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
+ if (length > HF_MAILBOX_SIZE || length > MM_PPOOL_ENTRY_SIZE) {
return spci_error(SPCI_INVALID_PARAMETERS);
}
- memcpy_s(memory_region, message_buffer_size, from_msg, length);
+ memory_region =
+ (struct spci_memory_region *)mpool_alloc(&api_page_pool);
+ if (memory_region == NULL) {
+ dlog_verbose("Failed to allocate memory region copy.\n");
+ return spci_error(SPCI_NO_MEMORY);
+ }
+ memcpy_s(memory_region, MM_PPOOL_ENTRY_SIZE, from_msg, length);
/* The sender must match the caller. */
if (memory_region->sender != from->id) {
- return spci_error(SPCI_INVALID_PARAMETERS);
+ dlog_verbose("Memory region sender doesn't match caller.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
}
if (memory_region->attribute_count != 1) {
/* Hafnium doesn't support multi-way memory sharing for now. */
- return spci_error(SPCI_NOT_SUPPORTED);
+ dlog_verbose(
+ "Multi-way memory sharing not supported (got %d "
+ "attribute descriptors, expected 0).\n",
+ memory_region->attribute_count);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
}
/*
@@ -1512,41 +1525,219 @@
*/
to = vm_find(memory_region->attributes[0].receiver);
if (to == NULL || to == from) {
+ dlog_verbose("Invalid receiver.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (to->id == HF_TEE_VM_ID) {
+ /*
+ * The 'to' VM lock is only needed in the case that it is the
+ * TEE VM.
+ */
+ struct two_vm_locked vm_to_from_lock = vm_lock_both(to, from);
+
+ if (msg_receiver_busy(vm_to_from_lock.vm1, from, false)) {
+ ret = spci_error(SPCI_BUSY);
+ goto out_unlock;
+ }
+
+ ret = spci_memory_send(to, vm_to_from_lock.vm2, memory_region,
+ length, share_func, &api_page_pool);
+ /*
+ * spci_memory_send takes ownership of the memory_region, so
+ * make sure we don't free it.
+ */
+ memory_region = NULL;
+
+ if (ret.func == SPCI_SUCCESS_32 && to->id == HF_TEE_VM_ID) {
+ /* Forward memory send message on to TEE. */
+ memcpy_s(to->mailbox.recv, SPCI_MSG_PAYLOAD_MAX,
+ memory_region, length);
+ mpool_free(&api_page_pool, memory_region);
+ memory_region = NULL;
+ to->mailbox.recv_size = length;
+ to->mailbox.recv_sender = from->id;
+ to->mailbox.recv_func = share_func;
+ ret = deliver_msg(vm_to_from_lock.vm1, from->id,
+ current, next);
+ }
+
+ out_unlock:
+ vm_unlock(&vm_to_from_lock.vm1);
+ vm_unlock(&vm_to_from_lock.vm2);
+ } else {
+ struct vm_locked from_locked = vm_lock(from);
+
+ ret = spci_memory_send(to, from_locked, memory_region, length,
+ share_func, &api_page_pool);
+ /*
+ * spci_memory_send takes ownership of the memory_region, so
+ * make sure we don't free it.
+ */
+ memory_region = NULL;
+
+ vm_unlock(&from_locked);
+ }
+
+out:
+ if (memory_region != NULL) {
+ mpool_free(&api_page_pool, memory_region);
+ }
+
+ return ret;
+}
+
+struct spci_value api_spci_mem_retrieve_req(ipaddr_t address,
+ uint32_t page_count,
+ uint32_t fragment_length,
+ uint32_t length, uint32_t cookie,
+ struct vcpu *current)
+{
+ struct vm *to = current->vm;
+ struct vm_locked to_locked;
+ const void *to_msg;
+ struct spci_memory_retrieve_request *retrieve_request;
+ uint32_t message_buffer_size;
+ struct spci_value ret;
+
+ if (ipa_addr(address) != 0 || page_count != 0) {
+ /*
+ * Hafnium only supports passing the descriptor in the TX
+ * mailbox.
+ */
return spci_error(SPCI_INVALID_PARAMETERS);
}
- vm_to_from_lock = vm_lock_both(to, from);
+ if (fragment_length == length && cookie != 0) {
+ /* Cookie is only allowed if there are multiple fragments. */
+ dlog_verbose("Unexpected cookie %d.\n", cookie);
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
- if (msg_receiver_busy(vm_to_from_lock.vm1, from, false)) {
+ retrieve_request =
+ (struct spci_memory_retrieve_request *)cpu_get_buffer(
+ current->cpu);
+ message_buffer_size = cpu_get_buffer_size(current->cpu);
+ if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
+ dlog_verbose("Retrieve request too long.\n");
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ to_locked = vm_lock(to);
+ to_msg = to->mailbox.send;
+
+ if (to_msg == NULL) {
+ dlog_verbose("TX buffer not setup.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ /*
+ * Copy the retrieve request descriptor to an internal buffer, so that
+ * the caller can't change it underneath us.
+ */
+ memcpy_s(retrieve_request, message_buffer_size, to_msg, length);
+
+ if (msg_receiver_busy(to_locked, NULL, false)) {
+ /*
+ * Can't retrieve memory information if the mailbox is not
+ * available.
+ */
+ dlog_verbose("RX buffer not ready.\n");
ret = spci_error(SPCI_BUSY);
goto out;
}
- ret = spci_memory_send(vm_to_from_lock.vm1, vm_to_from_lock.vm2,
- memory_region, length, share_func,
- &api_page_pool);
-
- if (ret.func == SPCI_SUCCESS_32) {
- /* Copy data to the destination Rx. */
- /*
- * TODO: Translate the <from> IPA addresses to <to> IPA
- * addresses. Currently we assume identity mapping of the stage
- * 2 translation. Removing this assumption relies on a mechanism
- * to handle scenarios where the memory region fits in the
- * source Tx buffer but cannot fit in the destination Rx buffer.
- * This mechanism will be defined at the spec level.
- */
- memcpy_s(to->mailbox.recv, SPCI_MSG_PAYLOAD_MAX, memory_region,
- length);
- to->mailbox.recv_size = length;
- to->mailbox.recv_sender = from->id;
- to->mailbox.recv_func = share_func;
- ret = deliver_msg(vm_to_from_lock.vm1, from->id, current, next);
- }
+ ret = spci_memory_retrieve(to_locked, retrieve_request, length,
+ &api_page_pool);
out:
- vm_unlock(&vm_to_from_lock.vm1);
- vm_unlock(&vm_to_from_lock.vm2);
+ vm_unlock(&to_locked);
+ return ret;
+}
+
+struct spci_value api_spci_mem_relinquish(struct vcpu *current)
+{
+ struct vm *from = current->vm;
+ struct vm_locked from_locked;
+ const void *from_msg;
+ struct spci_mem_relinquish *relinquish_request;
+ uint32_t message_buffer_size;
+ struct spci_value ret;
+ uint32_t length;
+
+ from_locked = vm_lock(from);
+ from_msg = from->mailbox.send;
+
+ if (from_msg == NULL) {
+ dlog_verbose("TX buffer not setup.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ /*
+ * Calculate length from relinquish descriptor before copying. We will
+ * check again later to make sure it hasn't changed.
+ */
+ length = sizeof(struct spci_mem_relinquish) +
+ ((struct spci_mem_relinquish *)from_msg)->endpoint_count *
+ sizeof(spci_vm_id_t);
+ /*
+ * Copy the relinquish descriptor to an internal buffer, so that the
+ * caller can't change it underneath us.
+ */
+ relinquish_request =
+ (struct spci_mem_relinquish *)cpu_get_buffer(current->cpu);
+ message_buffer_size = cpu_get_buffer_size(current->cpu);
+ if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
+ dlog_verbose("Relinquish message too long.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+ memcpy_s(relinquish_request, message_buffer_size, from_msg, length);
+
+ if (sizeof(struct spci_mem_relinquish) +
+ relinquish_request->endpoint_count * sizeof(spci_vm_id_t) !=
+ length) {
+ dlog_verbose(
+ "Endpoint count changed while copying to internal "
+ "buffer.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ ret = spci_memory_relinquish(from_locked, relinquish_request,
+ &api_page_pool);
+
+out:
+ vm_unlock(&from_locked);
+ return ret;
+}
+
+struct spci_value api_spci_mem_reclaim(uint32_t handle, uint32_t flags,
+ struct vcpu *current)
+{
+ struct vm *to = current->vm;
+ struct vm_locked to_locked;
+ struct spci_value ret;
+
+ to_locked = vm_lock(to);
+
+ if ((handle & SPCI_MEMORY_HANDLE_ALLOCATOR_MASK) ==
+ SPCI_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR) {
+ ret = spci_memory_reclaim(to_locked, handle,
+ flags & SPCI_MEM_RECLAIM_CLEAR,
+ &api_page_pool);
+ } else {
+ dlog_verbose(
+ "Tried to reclaim handle %#x not allocated by "
+ "hypervisor.\n",
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ vm_unlock(&to_locked);
return ret;
}
diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
index b4646d3..4a4f035 100644
--- a/src/arch/aarch64/hypervisor/handler.c
+++ b/src/arch/aarch64/hypervisor/handler.c
@@ -366,11 +366,21 @@
case SPCI_MEM_DONATE_32:
case SPCI_MEM_LEND_32:
case SPCI_MEM_SHARE_32:
- case HF_SPCI_MEM_RELINQUISH:
*args = api_spci_mem_send(func, ipa_init(args->arg1),
args->arg2, args->arg3, args->arg4,
args->arg5, current(), next);
return true;
+ case SPCI_MEM_RETRIEVE_REQ_32:
+ *args = api_spci_mem_retrieve_req(
+ ipa_init(args->arg1), args->arg2, args->arg3,
+ args->arg4, args->arg5, current());
+ return true;
+ case SPCI_MEM_RELINQUISH_32:
+ *args = api_spci_mem_relinquish(current());
+ return true;
+ case SPCI_MEM_RECLAIM_32:
+ *args = api_spci_mem_reclaim(args->arg1, args->arg2, current());
+ return true;
}
return false;
diff --git a/src/init.c b/src/init.c
index f944461..2f241b8 100644
--- a/src/init.c
+++ b/src/init.c
@@ -38,9 +38,7 @@
#include "vmapi/hf/call.h"
-alignas(alignof(
- struct mm_page_table)) char ptable_buf[sizeof(struct mm_page_table) *
- HEAP_PAGES];
+alignas(MM_PPOOL_ENTRY_SIZE) char ptable_buf[MM_PPOOL_ENTRY_SIZE * HEAP_PAGES];
static struct mpool ppool;
@@ -58,7 +56,7 @@
dlog_notice("Initialising hafnium\n");
- mpool_init(&ppool, sizeof(struct mm_page_table));
+ mpool_init(&ppool, MM_PPOOL_ENTRY_SIZE);
mpool_add_chunk(&ppool, ptable_buf, sizeof(ptable_buf));
if (!mm_init(&ppool)) {
diff --git a/src/spci_memory.c b/src/spci_memory.c
index afd6315..eeafc05 100644
--- a/src/spci_memory.c
+++ b/src/spci_memory.c
@@ -24,6 +24,16 @@
#include "hf/std.h"
#include "hf/vm.h"
+/** The maximum number of recipients a memory region may be sent to. */
+#define MAX_MEM_SHARE_RECIPIENTS 1
+
+/**
+ * The maximum number of memory sharing handles which may be active at once. A
+ * DONATE handle is active from when it is sent to when it is retrieved; a SHARE
+ * or LEND handle is active from when it is sent to when it is reclaimed.
+ */
+#define MAX_MEM_SHARES 100
+
static_assert(sizeof(struct spci_memory_region_constituent) % 16 == 0,
"struct spci_memory_region_constituent must be a multiple of 16 "
"bytes long.");
@@ -32,14 +42,227 @@
"bytes long.");
static_assert(sizeof(struct spci_memory_region) % 16 == 0,
"struct spci_memory_region must be a multiple of 16 bytes long.");
+static_assert(sizeof(struct spci_receiver_address_range) % 16 == 0,
+ "struct spci_receiver_address_range must be a multiple of 16 "
+ "bytes long.");
+static_assert(sizeof(struct spci_retrieved_memory_region) % 16 == 0,
+ "struct spci_retrieved_memory_region must be a multiple of 16 "
+ "bytes long.");
+static_assert(sizeof(struct spci_memory_retrieve_properties) % 16 == 0,
+ "struct spci_memory_retrieve_properties must be a multiple of 16 "
+ "bytes long.");
+static_assert(sizeof(struct spci_memory_retrieve_request) % 16 == 0,
+ "struct spci_memory_retrieve_request must be a multiple of 16 "
+ "bytes long.");
-struct spci_mem_transitions {
- uint32_t orig_from_mode;
- uint32_t orig_to_mode;
- uint32_t from_mode;
- uint32_t to_mode;
+struct spci_memory_share_state {
+ /**
+ * The memory region being shared, or NULL if this share state is
+ * unallocated.
+ */
+ struct spci_memory_region *memory_region;
+
+ /**
+ * The SPCI function used for sharing the memory. Must be one of
+ * SPCI_MEM_DONATE_32, SPCI_MEM_LEND_32 or SPCI_MEM_SHARE_32 if the
+ * share state is allocated, or 0.
+ */
+ uint32_t share_func;
+
+ /**
+ * Whether each recipient has retrieved the memory region yet. The order
+ * of this array matches the order of the attribute descriptors in the
+ * memory region descriptor. Any entries beyond the attribute_count will
+ * always be false.
+ */
+ bool retrieved[MAX_MEM_SHARE_RECIPIENTS];
};
+/**
+ * Encapsulates the set of share states while the `share_states_lock` is held.
+ */
+struct share_states_locked {
+ struct spci_memory_share_state *share_states;
+};
+
+/**
+ * All access to members of a `struct spci_memory_share_state` must be guarded
+ * by this lock.
+ */
+static struct spinlock share_states_lock_instance = SPINLOCK_INIT;
+static struct spci_memory_share_state share_states[MAX_MEM_SHARES];
+
+/**
+ * Initialises the next available `struct spci_memory_share_state` and sets
+ * `handle` to its handle. Returns true on succes or false if none are
+ * available.
+ */
+static bool allocate_share_state(uint32_t share_func,
+ struct spci_memory_region *memory_region,
+ spci_memory_handle_t *handle)
+{
+ uint32_t i;
+
+ CHECK(memory_region != NULL);
+
+ sl_lock(&share_states_lock_instance);
+ for (i = 0; i < MAX_MEM_SHARES; ++i) {
+ if (share_states[i].share_func == 0) {
+ uint32_t j;
+ struct spci_memory_share_state *allocated_state =
+ &share_states[i];
+ allocated_state->share_func = share_func;
+ allocated_state->memory_region = memory_region;
+ for (j = 0; j < MAX_MEM_SHARE_RECIPIENTS; ++j) {
+ allocated_state->retrieved[j] = false;
+ }
+ *handle = i | SPCI_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR;
+ sl_unlock(&share_states_lock_instance);
+ return true;
+ }
+ }
+
+ sl_unlock(&share_states_lock_instance);
+ return false;
+}
+
+/** Locks the share states lock. */
+struct share_states_locked share_states_lock(void)
+{
+ sl_lock(&share_states_lock_instance);
+
+ return (struct share_states_locked){.share_states = share_states};
+}
+
+/** Unlocks the share states lock. */
+static void share_states_unlock(struct share_states_locked *share_states)
+{
+ CHECK(share_states->share_states != NULL);
+ share_states->share_states = NULL;
+ sl_unlock(&share_states_lock_instance);
+}
+
+/**
+ * If the given handle is a valid handle for an allocated share state then takes
+ * the lock, initialises `share_state_locked` to point to the share state and
+ * returns true. Otherwise returns false and doesn't take the lock.
+ */
+static bool get_share_state(struct share_states_locked share_states,
+ spci_memory_handle_t handle,
+ struct spci_memory_share_state **share_state_ret)
+{
+ struct spci_memory_share_state *share_state;
+ uint32_t index = handle & ~SPCI_MEMORY_HANDLE_ALLOCATOR_MASK;
+
+ if (index >= MAX_MEM_SHARES) {
+ return false;
+ }
+
+ share_state = &share_states.share_states[index];
+
+ if (share_state->share_func == 0) {
+ return false;
+ }
+
+ *share_state_ret = share_state;
+ return true;
+}
+
+/** Marks a share state as unallocated. */
+static void share_state_free(struct share_states_locked share_states,
+ struct spci_memory_share_state *share_state,
+ struct mpool *page_pool)
+{
+ CHECK(share_states.share_states != NULL);
+ share_state->share_func = 0;
+ mpool_free(page_pool, share_state->memory_region);
+ share_state->memory_region = NULL;
+}
+
+/**
+ * Marks the share state with the given handle as unallocated, or returns false
+ * if the handle was invalid.
+ */
+static bool share_state_free_handle(spci_memory_handle_t handle,
+ struct mpool *page_pool)
+{
+ struct share_states_locked share_states = share_states_lock();
+ struct spci_memory_share_state *share_state;
+
+ if (!get_share_state(share_states, handle, &share_state)) {
+ share_states_unlock(&share_states);
+ return false;
+ }
+
+ share_state_free(share_states, share_state, page_pool);
+ share_states_unlock(&share_states);
+
+ return true;
+}
+
+static void dump_memory_region(struct spci_memory_region *memory_region)
+{
+ uint32_t i;
+
+ if (LOG_LEVEL < LOG_LEVEL_VERBOSE) {
+ return;
+ }
+
+ dlog("from VM %d, tag %d, flags %#x, %d total pages in %d constituents "
+ "to %d recipients [",
+ memory_region->sender, memory_region->tag, memory_region->flags,
+ memory_region->page_count, memory_region->constituent_count,
+ memory_region->attribute_count);
+ for (i = 0; i < memory_region->attribute_count; ++i) {
+ if (i != 0) {
+ dlog(", ");
+ }
+ dlog("VM %d: %#x", memory_region->attributes[i].receiver,
+ memory_region->attributes[i].memory_attributes);
+ }
+ dlog("]");
+}
+
+static void dump_share_states(void)
+{
+ uint32_t i;
+
+ if (LOG_LEVEL < LOG_LEVEL_VERBOSE) {
+ return;
+ }
+
+ dlog("Current share states:\n");
+ sl_lock(&share_states_lock_instance);
+ for (i = 0; i < MAX_MEM_SHARES; ++i) {
+ if (share_states[i].share_func != 0) {
+ dlog("%d: ", i);
+ switch (share_states[i].share_func) {
+ case SPCI_MEM_SHARE_32:
+ dlog("SHARE");
+ break;
+ case SPCI_MEM_LEND_32:
+ dlog("LEND");
+ break;
+ case SPCI_MEM_DONATE_32:
+ dlog("DONATE");
+ break;
+ default:
+ dlog("invalid share_func %#x",
+ share_states[i].share_func);
+ }
+ dlog(" (");
+ dump_memory_region(share_states[i].memory_region);
+ if (share_states[i].retrieved[0]) {
+ dlog("): retrieved\n");
+ } else {
+ dlog("): not retrieved\n");
+ }
+ break;
+ }
+ }
+ sl_unlock(&share_states_lock_instance);
+}
+
/* TODO: Add device attributes: GRE, cacheability, shareability. */
static inline uint32_t spci_memory_attrs_to_mode(uint16_t memory_attributes)
{
@@ -64,188 +287,21 @@
}
/**
- * Obtain the next mode to apply to the two VMs.
- *
- * Returns true iff a state transition was found.
+ * Get the current mode in the stage-2 page table of the given vm of all the
+ * pages in the given constituents, if they all have the same mode, or return
+ * false if not.
*/
-static bool spci_msg_get_next_state(
- const struct spci_mem_transitions *transitions,
- uint32_t transition_count, uint32_t memory_to_attributes,
- uint32_t orig_from_mode, uint32_t orig_to_mode, uint32_t *from_mode,
- uint32_t *to_mode)
-{
- const uint32_t state_mask =
- MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
- const uint32_t orig_from_state = orig_from_mode & state_mask;
-
- for (uint32_t index = 0; index < transition_count; index++) {
- uint32_t table_orig_from_mode =
- transitions[index].orig_from_mode;
- uint32_t table_orig_to_mode = transitions[index].orig_to_mode;
-
- if (((orig_from_state) == table_orig_from_mode) &&
- ((orig_to_mode & state_mask) == table_orig_to_mode)) {
- *to_mode = transitions[index].to_mode |
- memory_to_attributes;
-
- *from_mode = transitions[index].from_mode |
- (~state_mask & orig_from_mode);
-
- return true;
- }
- }
- return false;
-}
-
-/**
- * Verify that all pages have the same mode, that the starting mode
- * constitutes a valid state and obtain the next mode to apply
- * to the two VMs.
- *
- * Returns:
- * The error code false indicates that:
- * 1) a state transition was not found;
- * 2) the pages being shared do not have the same mode within the <to>
- * or <from> VMs;
- * 3) The beginning and end IPAs are not page aligned;
- * 4) The requested share type was not handled.
- * Success is indicated by true.
- */
-static bool spci_msg_check_transition(
- struct vm *to, struct vm *from, uint32_t share_func,
- uint32_t *orig_from_mode,
+static bool constituents_get_mode(
+ struct vm_locked vm, uint32_t *orig_mode,
struct spci_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t memory_to_attributes,
- uint32_t *from_mode, uint32_t *to_mode)
+ uint32_t constituent_count)
{
- uint32_t orig_to_mode;
- const struct spci_mem_transitions *mem_transition_table;
- uint32_t transition_table_size;
uint32_t i;
- /*
- * TODO: Transition table does not currently consider the multiple
- * shared case.
- */
- static const struct spci_mem_transitions donate_transitions[] = {
- {
- /* 1) {O-EA, !O-NA} -> {!O-NA, O-EA} */
- .orig_from_mode = 0,
- .orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
- .from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
- .to_mode = 0,
- },
- {
- /*
- * Duplicate of 1) in order to cater for an alternative
- * representation of !O-NA:
- * (INVALID | UNOWNED | SHARED) and (INVALID | UNOWNED)
- * are both alternate representations of !O-NA.
- */
- /* 4) {O-EA, !O-NA} -> {!O-NA, O-EA} */
- .orig_from_mode = 0,
- .orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
- MM_MODE_SHARED,
- .from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
- MM_MODE_SHARED,
- .to_mode = 0,
- },
- };
-
- static const uint32_t size_donate_transitions =
- ARRAY_SIZE(donate_transitions);
-
- /*
- * This data structure holds the allowed state transitions for the
- * "lend" state machine. In this state machine the owner keeps ownership
- * but loses access to the lent pages.
- */
- static const struct spci_mem_transitions lend_transitions[] = {
- {
- /* 1) {O-EA, !O-NA} -> {O-NA, !O-EA} */
- .orig_from_mode = 0,
- .orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
- MM_MODE_SHARED,
- .from_mode = MM_MODE_INVALID,
- .to_mode = MM_MODE_UNOWNED,
- },
- {
- /*
- * Duplicate of 1) in order to cater for an alternative
- * representation of !O-NA:
- * (INVALID | UNOWNED | SHARED) and (INVALID | UNOWNED)
- * are both alternate representations of !O-NA.
- */
- /* 2) {O-EA, !O-NA} -> {O-NA, !O-EA} */
- .orig_from_mode = 0,
- .orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
- .from_mode = MM_MODE_INVALID,
- .to_mode = MM_MODE_UNOWNED,
- },
- };
-
- static const uint32_t size_lend_transitions =
- ARRAY_SIZE(lend_transitions);
-
- /*
- * This data structure holds the allowed state transitions for the
- * "share" state machine. In this state machine the owner keeps the
- * shared pages mapped on its stage2 table and keeps access as well.
- */
- static const struct spci_mem_transitions share_transitions[] = {
- {
- /* 1) {O-EA, !O-NA} -> {O-SA, !O-SA} */
- .orig_from_mode = 0,
- .orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
- MM_MODE_SHARED,
- .from_mode = MM_MODE_SHARED,
- .to_mode = MM_MODE_UNOWNED | MM_MODE_SHARED,
- },
- {
- /*
- * Duplicate of 1) in order to cater for an alternative
- * representation of !O-NA:
- * (INVALID | UNOWNED | SHARED) and (INVALID | UNOWNED)
- * are both alternate representations of !O-NA.
- */
- /* 2) {O-EA, !O-NA} -> {O-SA, !O-SA} */
- .orig_from_mode = 0,
- .orig_to_mode = MM_MODE_INVALID | MM_MODE_UNOWNED,
- .from_mode = MM_MODE_SHARED,
- .to_mode = MM_MODE_UNOWNED | MM_MODE_SHARED,
- },
- };
-
- static const uint32_t size_share_transitions =
- ARRAY_SIZE(share_transitions);
-
- static const struct spci_mem_transitions relinquish_transitions[] = {
- {
- /* 1) {!O-EA, O-NA} -> {!O-NA, O-EA} */
- .orig_from_mode = MM_MODE_UNOWNED,
- .orig_to_mode = MM_MODE_INVALID,
- .from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
- MM_MODE_SHARED,
- .to_mode = 0,
- },
- {
- /* 2) {!O-SA, O-SA} -> {!O-NA, O-EA} */
- .orig_from_mode = MM_MODE_UNOWNED | MM_MODE_SHARED,
- .orig_to_mode = MM_MODE_SHARED,
- .from_mode = MM_MODE_INVALID | MM_MODE_UNOWNED |
- MM_MODE_SHARED,
- .to_mode = 0,
- },
- };
-
- static const uint32_t size_relinquish_transitions =
- ARRAY_SIZE(relinquish_transitions);
-
if (constituent_count == 0) {
/*
- * Fail if there are no constituents. Otherwise
- * spci_msg_get_next_state would get an unitialised
- * *orig_from_mode and orig_to_mode.
+ * Fail if there are no constituents. Otherwise we would get an
+ * uninitialised *orig_mode.
*/
return false;
}
@@ -256,8 +312,7 @@
&constituents[i]));
size_t size = constituents[i].page_count * PAGE_SIZE;
ipaddr_t end = ipa_add(begin, size);
- uint32_t current_from_mode;
- uint32_t current_to_mode;
+ uint32_t current_mode;
/* Fail if addresses are not page-aligned. */
if (!is_aligned(ipa_addr(begin), PAGE_SIZE) ||
@@ -269,10 +324,8 @@
* Ensure that this constituent memory range is all mapped with
* the same mode.
*/
- if (!mm_vm_get_mode(&from->ptable, begin, end,
- ¤t_from_mode) ||
- !mm_vm_get_mode(&to->ptable, begin, end,
- ¤t_to_mode)) {
+ if (!mm_vm_get_mode(&vm.vm->ptable, begin, end,
+ ¤t_mode)) {
return false;
}
@@ -280,48 +333,191 @@
* Ensure that all constituents are mapped with the same mode.
*/
if (i == 0) {
- *orig_from_mode = current_from_mode;
- orig_to_mode = current_to_mode;
- } else if (current_from_mode != *orig_from_mode ||
- current_to_mode != orig_to_mode) {
+ *orig_mode = current_mode;
+ } else if (current_mode != *orig_mode) {
return false;
}
}
- /* Ensure the address range is normal memory and not a device. */
- if (*orig_from_mode & MM_MODE_D) {
+ return true;
+}
+
+/**
+ * Verify that all pages have the same mode, that the starting mode
+ * constitutes a valid state and obtain the next mode to apply
+ * to the sending VM.
+ *
+ * Returns:
+ * The error code false indicates that:
+ * 1) a state transition was not found;
+ * 2) the pages being shared do not have the same mode within the <from> VM;
+ * 3) The beginning and end IPAs are not page aligned;
+ * 4) The requested share type was not handled.
+ * Success is indicated by true.
+ *
+ */
+static bool spci_send_check_transition(
+ struct vm_locked from, uint32_t share_func, uint32_t *orig_from_mode,
+ struct spci_memory_region_constituent *constituents,
+ uint32_t constituent_count, uint32_t *from_mode)
+{
+ const uint32_t state_mask =
+ MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
+
+ if (!constituents_get_mode(from, orig_from_mode, constituents,
+ constituent_count)) {
return false;
}
+ /* Ensure the address range is normal memory and not a device. */
+ if (*orig_from_mode & MM_MODE_D) {
+ dlog_verbose("Can't share device memory (mode is %#x).\n",
+ *orig_from_mode);
+ return false;
+ }
+
+ /*
+ * Ensure the sender is the owner and has exclusive access to the
+ * memory.
+ */
+ if ((*orig_from_mode & state_mask) != 0) {
+ return false;
+ }
+
+ /* Find the appropriate new mode. */
+ *from_mode = ~state_mask & *orig_from_mode;
switch (share_func) {
case SPCI_MEM_DONATE_32:
- mem_transition_table = donate_transitions;
- transition_table_size = size_donate_transitions;
+ *from_mode |= MM_MODE_INVALID | MM_MODE_UNOWNED;
break;
case SPCI_MEM_LEND_32:
- mem_transition_table = lend_transitions;
- transition_table_size = size_lend_transitions;
+ *from_mode |= MM_MODE_INVALID;
break;
case SPCI_MEM_SHARE_32:
- mem_transition_table = share_transitions;
- transition_table_size = size_share_transitions;
- break;
-
- case HF_SPCI_MEM_RELINQUISH:
- mem_transition_table = relinquish_transitions;
- transition_table_size = size_relinquish_transitions;
+ *from_mode |= MM_MODE_SHARED;
break;
default:
return false;
}
- return spci_msg_get_next_state(mem_transition_table,
- transition_table_size,
- memory_to_attributes, *orig_from_mode,
- orig_to_mode, from_mode, to_mode);
+ return true;
+}
+
+static bool spci_relinquish_check_transition(
+ struct vm_locked from, uint32_t *orig_from_mode,
+ struct spci_memory_region_constituent *constituents,
+ uint32_t constituent_count, uint32_t *from_mode)
+{
+ const uint32_t state_mask =
+ MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
+ uint32_t orig_from_state;
+
+ if (!constituents_get_mode(from, orig_from_mode, constituents,
+ constituent_count)) {
+ return false;
+ }
+
+ /* Ensure the address range is normal memory and not a device. */
+ if (*orig_from_mode & MM_MODE_D) {
+ dlog_verbose("Can't relinquish device memory (mode is %#x).\n",
+ *orig_from_mode);
+ return false;
+ }
+
+ /*
+ * Ensure the relinquishing VM is not the owner but has access to the
+ * memory.
+ */
+ orig_from_state = *orig_from_mode & state_mask;
+ if ((orig_from_state & ~MM_MODE_SHARED) != MM_MODE_UNOWNED) {
+ dlog_verbose(
+ "Tried to relinquish memory in state %#x (masked %#x "
+ "but "
+ "should be %#x).\n",
+ *orig_from_mode, orig_from_state, MM_MODE_UNOWNED);
+ return false;
+ }
+
+ /* Find the appropriate new mode. */
+ *from_mode = (~state_mask & *orig_from_mode) | MM_MODE_UNMAPPED_MASK;
+
+ return true;
+}
+
+/**
+ * Verify that all pages have the same mode, that the starting mode
+ * constitutes a valid state and obtain the next mode to apply
+ * to the retrieving VM.
+ *
+ * Returns:
+ * The error code false indicates that:
+ * 1) a state transition was not found;
+ * 2) the pages being shared do not have the same mode within the <to> VM;
+ * 3) The beginning and end IPAs are not page aligned;
+ * 4) The requested share type was not handled.
+ * Success is indicated by true.
+ */
+static bool spci_retrieve_check_transition(
+ struct vm_locked to, uint32_t share_func,
+ struct spci_memory_region_constituent *constituents,
+ uint32_t constituent_count, uint32_t memory_to_attributes,
+ uint32_t *to_mode)
+{
+ uint32_t orig_to_mode;
+
+ if (!constituents_get_mode(to, &orig_to_mode, constituents,
+ constituent_count)) {
+ return false;
+ }
+
+ if (share_func == SPCI_MEM_RECLAIM_32) {
+ const uint32_t state_mask =
+ MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
+ uint32_t orig_to_state = orig_to_mode & state_mask;
+
+ if (orig_to_state != MM_MODE_INVALID &&
+ orig_to_state != MM_MODE_SHARED) {
+ return false;
+ }
+ } else {
+ /*
+ * Ensure the retriever has the expected state. We don't care
+ * about the MM_MODE_SHARED bit; either with or without it set
+ * are both valid representations of the !O-NA state.
+ */
+ if ((orig_to_mode & MM_MODE_UNMAPPED_MASK) !=
+ MM_MODE_UNMAPPED_MASK) {
+ return false;
+ }
+ }
+
+ /* Find the appropriate new mode. */
+ *to_mode = memory_to_attributes;
+ switch (share_func) {
+ case SPCI_MEM_DONATE_32:
+ *to_mode |= 0;
+ break;
+
+ case SPCI_MEM_LEND_32:
+ *to_mode |= MM_MODE_UNOWNED;
+ break;
+
+ case SPCI_MEM_SHARE_32:
+ *to_mode |= MM_MODE_UNOWNED | MM_MODE_SHARED;
+ break;
+
+ case SPCI_MEM_RECLAIM_32:
+ *to_mode |= 0;
+ break;
+
+ default:
+ return false;
+ }
+
+ return true;
}
/**
@@ -460,30 +656,27 @@
}
/**
- * Shares memory from the calling VM with another. The memory can be shared in
- * different modes.
+ * Validates and prepares memory to be sent from the calling VM to another.
*
- * This function requires the calling context to hold the <to> and <from> locks.
+ * This function requires the calling context to hold the <from> VM lock.
*
* Returns:
- * In case of error one of the following values is returned:
+ * In case of error, one of the following values is returned:
* 1) SPCI_INVALID_PARAMETERS - The endpoint provided parameters were
* erroneous;
* 2) SPCI_NO_MEMORY - Hafnium did not have sufficient memory to complete
* the request.
* Success is indicated by SPCI_SUCCESS.
*/
-static struct spci_value spci_share_memory(
- struct vm_locked to_locked, struct vm_locked from_locked,
+static struct spci_value spci_send_memory(
+ struct vm_locked from_locked,
struct spci_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t memory_to_attributes,
- uint32_t share_func, struct mpool *page_pool, bool clear)
+ uint32_t constituent_count, uint32_t share_func,
+ struct mpool *page_pool, bool clear)
{
- struct vm *to = to_locked.vm;
struct vm *from = from_locked.vm;
uint32_t orig_from_mode;
uint32_t from_mode;
- uint32_t to_mode;
struct mpool local_page_pool;
struct spci_value ret;
@@ -492,26 +685,17 @@
* not we would get alignment faults trying to read (32-bit) values.
*/
if (!is_aligned(constituents, 4)) {
- dlog_verbose("Constituents not aligned.\n");
- return spci_error(SPCI_INVALID_PARAMETERS);
- }
-
- /* Disallow reflexive shares as this suggests an error in the VM. */
- if (to == from) {
- dlog_verbose("Reflexive share.\n");
return spci_error(SPCI_INVALID_PARAMETERS);
}
/*
- * Check if the state transition is lawful for both VMs involved
- * in the memory exchange, ensure that all constituents of a memory
- * region being shared are at the same state.
+ * Check if the state transition is lawful for the sender, ensure that
+ * all constituents of a memory region being shared are at the same
+ * state.
*/
- if (!spci_msg_check_transition(to, from, share_func, &orig_from_mode,
- constituents, constituent_count,
- memory_to_attributes, &from_mode,
- &to_mode)) {
- dlog_verbose("Invalid transition.\n");
+ if (!spci_send_check_transition(from_locked, share_func,
+ &orig_from_mode, constituents,
+ constituent_count, &from_mode)) {
return spci_error(SPCI_INVALID_PARAMETERS);
}
@@ -523,16 +707,12 @@
mpool_init_with_fallback(&local_page_pool, page_pool);
/*
- * First reserve all required memory for the new page table entries in
- * both sender and recipient page tables without committing, to make
- * sure the entire operation will succeed without exhausting the page
- * pool.
+ * First reserve all required memory for the new page table entries
+ * without committing, to make sure the entire operation will succeed
+ * without exhausting the page pool.
*/
if (!spci_region_group_identity_map(from_locked, constituents,
constituent_count, from_mode,
- page_pool, false) ||
- !spci_region_group_identity_map(to_locked, constituents,
- constituent_count, to_mode,
page_pool, false)) {
/* TODO: partial defrag of failed range. */
ret = spci_error(SPCI_NO_MEMORY);
@@ -540,10 +720,10 @@
}
/*
- * First update the mapping for the sender so there is no overlap with
- * the recipient. This won't allocate because the transaction was
- * already prepared above, but may free pages in the case that a whole
- * block is being unmapped that was previously partially mapped.
+ * Update the mapping for the sender. This won't allocate because the
+ * transaction was already prepared above, but may free pages in the
+ * case that a whole block is being unmapped that was previously
+ * partially mapped.
*/
CHECK(spci_region_group_identity_map(from_locked, constituents,
constituent_count, from_mode,
@@ -566,6 +746,95 @@
goto out;
}
+ ret = (struct spci_value){.func = SPCI_SUCCESS_32};
+
+out:
+ mpool_fini(&local_page_pool);
+
+ /*
+ * Tidy up the page table by reclaiming failed mappings (if there was an
+ * error) or merging entries into blocks where possible (on success).
+ */
+ mm_vm_defrag(&from->ptable, page_pool);
+
+ return ret;
+}
+
+/**
+ * Validates and maps memory shared from one VM to another.
+ *
+ * This function requires the calling context to hold the <to> lock.
+ *
+ * Returns:
+ * In case of error, one of the following values is returned:
+ * 1) SPCI_INVALID_PARAMETERS - The endpoint provided parameters were
+ * erroneous;
+ * 2) SPCI_NO_MEMORY - Hafnium did not have sufficient memory to complete
+ * the request.
+ * Success is indicated by SPCI_SUCCESS.
+ */
+static struct spci_value spci_retrieve_memory(
+ struct vm_locked to_locked,
+ struct spci_memory_region_constituent *constituents,
+ uint32_t constituent_count, uint32_t memory_to_attributes,
+ uint32_t share_func, bool clear, struct mpool *page_pool)
+{
+ struct vm *to = to_locked.vm;
+ uint32_t to_mode;
+ struct mpool local_page_pool;
+ struct spci_value ret;
+
+ /*
+ * Make sure constituents are properly aligned to a 32-bit boundary. If
+ * not we would get alignment faults trying to read (32-bit) values.
+ */
+ if (!is_aligned(constituents, 4)) {
+ dlog_verbose("Constituents not aligned.\n");
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ /*
+ * Check if the state transition is lawful for the recipient, and ensure
+ * that all constituents of the memory region being retrieved are at the
+ * same state.
+ */
+ if (!spci_retrieve_check_transition(to_locked, share_func, constituents,
+ constituent_count,
+ memory_to_attributes, &to_mode)) {
+ dlog_verbose("Invalid transition.\n");
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ /*
+ * Create a local pool so any freed memory can't be used by another
+ * thread. This is to ensure the original mapping can be restored if the
+ * clear fails.
+ */
+ mpool_init_with_fallback(&local_page_pool, page_pool);
+
+ /*
+ * First reserve all required memory for the new page table entries in
+ * the recipient page tables without committing, to make sure the entire
+ * operation will succeed without exhausting the page pool.
+ */
+ if (!spci_region_group_identity_map(to_locked, constituents,
+ constituent_count, to_mode,
+ page_pool, false)) {
+ /* TODO: partial defrag of failed range. */
+ dlog_verbose(
+ "Insufficient memory to update recipient page "
+ "table.\n");
+ ret = spci_error(SPCI_NO_MEMORY);
+ goto out;
+ }
+
+ /* Clear the memory so no VM or device can see the previous contents. */
+ if (clear && !spci_clear_memory_constituents(
+ constituents, constituent_count, page_pool)) {
+ ret = spci_error(SPCI_NO_MEMORY);
+ goto out;
+ }
+
/*
* Complete the transfer by mapping the memory into the recipient. This
* won't allocate because the transaction was already prepared above, so
@@ -581,11 +850,88 @@
mpool_fini(&local_page_pool);
/*
- * Tidy up the page tables by reclaiming failed mappings (if there was
+ * Tidy up the page table by reclaiming failed mappings (if there was
* an error) or merging entries into blocks where possible (on success).
*/
mm_vm_defrag(&to->ptable, page_pool);
- mm_vm_defrag(&from->ptable, page_pool);
+
+ return ret;
+}
+
+static struct spci_value spci_relinquish_memory(
+ struct vm_locked from_locked,
+ struct spci_memory_region_constituent *constituents,
+ uint32_t constituent_count, struct mpool *page_pool, bool clear)
+{
+ uint32_t orig_from_mode;
+ uint32_t from_mode;
+ struct mpool local_page_pool;
+ struct spci_value ret;
+
+ if (!spci_relinquish_check_transition(from_locked, &orig_from_mode,
+ constituents, constituent_count,
+ &from_mode)) {
+ dlog_verbose("Invalid transition.\n");
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ /*
+ * Create a local pool so any freed memory can't be used by another
+ * thread. This is to ensure the original mapping can be restored if the
+ * clear fails.
+ */
+ mpool_init_with_fallback(&local_page_pool, page_pool);
+
+ /*
+ * First reserve all required memory for the new page table entries
+ * without committing, to make sure the entire operation will succeed
+ * without exhausting the page pool.
+ */
+ if (!spci_region_group_identity_map(from_locked, constituents,
+ constituent_count, from_mode,
+ page_pool, false)) {
+ /* TODO: partial defrag of failed range. */
+ ret = spci_error(SPCI_NO_MEMORY);
+ goto out;
+ }
+
+ /*
+ * Update the mapping for the sender. This won't allocate because the
+ * transaction was already prepared above, but may free pages in the
+ * case that a whole block is being unmapped that was previously
+ * partially mapped.
+ */
+ CHECK(spci_region_group_identity_map(from_locked, constituents,
+ constituent_count, from_mode,
+ &local_page_pool, true));
+
+ /* Clear the memory so no VM or device can see the previous contents. */
+ if (clear && !spci_clear_memory_constituents(
+ constituents, constituent_count, page_pool)) {
+ /*
+ * On failure, roll back by returning memory to the sender. This
+ * may allocate pages which were previously freed into
+ * `local_page_pool` by the call above, but will never allocate
+ * more pages than that so can never fail.
+ */
+ CHECK(spci_region_group_identity_map(
+ from_locked, constituents, constituent_count,
+ orig_from_mode, &local_page_pool, true));
+
+ ret = spci_error(SPCI_NO_MEMORY);
+ goto out;
+ }
+
+ ret = (struct spci_value){.func = SPCI_SUCCESS_32};
+
+out:
+ mpool_fini(&local_page_pool);
+
+ /*
+ * Tidy up the page table by reclaiming failed mappings (if there was an
+ * error) or merging entries into blocks where possible (on success).
+ */
+ mm_vm_defrag(&from_locked.vm->ptable, page_pool);
return ret;
}
@@ -598,19 +944,25 @@
*
* Assumes that the caller has already found and locked both VMs and ensured
* that the destination RX buffer is available, and copied the memory region
- * descriptor from the sender's TX buffer to a trusted internal buffer.
+ * descriptor from the sender's TX buffer to a freshly allocated page from
+ * Hafnium's internal pool.
+ *
+ * This function takes ownership of the `memory_region` passed in; it must not
+ * be freed by the caller.
*/
-struct spci_value spci_memory_send(struct vm_locked to_locked,
- struct vm_locked from_locked,
+struct spci_value spci_memory_send(struct vm *to, struct vm_locked from_locked,
struct spci_memory_region *memory_region,
uint32_t memory_share_size,
uint32_t share_func, struct mpool *page_pool)
{
- uint32_t memory_to_attributes;
+ struct spci_memory_region_constituent *constituents =
+ spci_memory_region_get_constituents(memory_region);
+ uint32_t constituent_count = memory_region->constituent_count;
uint32_t attributes_size;
uint32_t constituents_size;
- struct spci_memory_region_constituent *constituents;
- uint32_t constituent_count = memory_region->constituent_count;
+ bool clear;
+ struct spci_value ret;
+ spci_memory_handle_t handle;
/*
* Ensure the number of constituents are within the memory
@@ -624,42 +976,416 @@
sizeof(struct spci_memory_region) + attributes_size ||
memory_share_size !=
memory_region->constituent_offset + constituents_size) {
+ dlog_verbose("Invalid size %d or constituent offset %d.\n",
+ memory_share_size,
+ memory_region->constituent_offset);
+ mpool_free(page_pool, memory_region);
return spci_error(SPCI_INVALID_PARAMETERS);
}
/* The sender must match the message sender. */
if (memory_region->sender != from_locked.vm->id) {
+ dlog_verbose("Invalid sender %d.\n", memory_region->sender);
+ mpool_free(page_pool, memory_region);
return spci_error(SPCI_INVALID_PARAMETERS);
}
/* We only support a single recipient. */
if (memory_region->attribute_count != 1) {
+ dlog_verbose("Multiple recipients not supported.\n");
+ mpool_free(page_pool, memory_region);
return spci_error(SPCI_NOT_SUPPORTED);
}
/* The recipient must match the message recipient. */
- if (memory_region->attributes[0].receiver != to_locked.vm->id) {
+ if (memory_region->attributes[0].receiver != to->id) {
+ mpool_free(page_pool, memory_region);
return spci_error(SPCI_INVALID_PARAMETERS);
}
- switch (share_func) {
- case SPCI_MEM_DONATE_32:
- case SPCI_MEM_LEND_32:
- case SPCI_MEM_SHARE_32:
- memory_to_attributes = spci_memory_attrs_to_mode(
- memory_region->attributes[0].memory_attributes);
- break;
- case HF_SPCI_MEM_RELINQUISH:
- memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
- break;
- default:
- dlog_error("Invalid memory sharing message.\n");
+ clear = memory_region->flags & SPCI_MEMORY_REGION_FLAG_CLEAR;
+ /*
+ * Clear is not allowed for memory sharing, as the sender still has
+ * access to the memory.
+ */
+ if (clear && share_func == SPCI_MEM_SHARE_32) {
+ dlog_verbose("Memory can't be cleared while being shared.\n");
return spci_error(SPCI_INVALID_PARAMETERS);
}
+ /*
+ * Allocate a share state before updating the page table. Otherwise if
+ * updating the page table succeeded but allocating the share state
+ * failed then it would leave the memory in a state where nobody could
+ * get it back.
+ */
+ if (to->id != HF_TEE_VM_ID &&
+ !allocate_share_state(share_func, memory_region, &handle)) {
+ dlog_verbose("Failed to allocate share state.\n");
+ mpool_free(page_pool, memory_region);
+ return spci_error(SPCI_NO_MEMORY);
+ }
+
+ dump_share_states();
+
+ /* Check that state is valid in sender page table and update. */
+ ret = spci_send_memory(from_locked, constituents, constituent_count,
+ share_func, page_pool, clear);
+ if (ret.func != SPCI_SUCCESS_32) {
+ if (to->id != HF_TEE_VM_ID) {
+ /* Free share state. */
+ bool freed = share_state_free_handle(handle, page_pool);
+
+ CHECK(freed);
+ }
+
+ return ret;
+ }
+
+ if (to->id == HF_TEE_VM_ID) {
+ /* Return directly, no need to allocate share state. */
+ return (struct spci_value){.func = SPCI_SUCCESS_32};
+ }
+
+ return (struct spci_value){.func = SPCI_SUCCESS_32, .arg2 = handle};
+}
+
+struct spci_value spci_memory_retrieve(
+ struct vm_locked to_locked,
+ struct spci_memory_retrieve_request *retrieve_request,
+ uint32_t retrieve_request_size, struct mpool *page_pool)
+{
+ uint32_t expected_retrieve_request_size =
+ sizeof(struct spci_memory_retrieve_request) +
+ retrieve_request->retrieve_properties_count *
+ sizeof(struct spci_memory_retrieve_properties);
+ spci_memory_handle_t handle = retrieve_request->handle;
+ struct spci_memory_region *memory_region;
+ struct spci_memory_retrieve_properties *retrieve_properties;
+ uint32_t memory_to_attributes;
+ struct spci_memory_region_constituent *constituents;
+ uint32_t constituent_count;
+ struct share_states_locked share_states;
+ struct spci_memory_share_state *share_state;
+ struct spci_value ret;
+ uint32_t response_size;
+
+ dump_share_states();
+
+ if (retrieve_request_size != expected_retrieve_request_size) {
+ dlog_verbose(
+ "Invalid length for SPCI_MEM_RETRIEVE_REQ, expected %d "
+ "but was %d.\n",
+ expected_retrieve_request_size, retrieve_request_size);
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ share_states = share_states_lock();
+ if (!get_share_state(share_states, handle, &share_state)) {
+ dlog_verbose("Invalid handle %#x for SPCI_MEM_RETRIEVE_REQ.\n",
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (retrieve_request->share_func != share_state->share_func) {
+ dlog_verbose(
+ "Incorrect transaction type %#x for "
+ "SPCI_MEM_RETRIEVE_REQ, expected %#x for handle %#x.\n",
+ retrieve_request->share_func, share_state->share_func,
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ memory_region = share_state->memory_region;
+ CHECK(memory_region != NULL);
+
+ if (retrieve_request->sender != memory_region->sender) {
+ dlog_verbose(
+ "Incorrect sender ID %d for SPCI_MEM_RETRIEVE_REQ, "
+ "expected %d for handle %#x.\n",
+ retrieve_request->sender, memory_region->sender,
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (retrieve_request->tag != memory_region->tag) {
+ dlog_verbose(
+ "Incorrect tag %d for SPCI_MEM_RETRIEVE_REQ, expected "
+ "%d for handle %#x.\n",
+ retrieve_request->tag, memory_region->tag, handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (memory_region->attributes[0].receiver != to_locked.vm->id) {
+ dlog_verbose(
+ "Incorrect receiver VM ID %d for "
+ "SPCI_MEM_RETRIEVE_REQ, expected %d for handle %#x.\n",
+ to_locked.vm->id, memory_region->attributes[0].receiver,
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (share_state->retrieved[0]) {
+ dlog_verbose("Memory with handle %#x already retrieved.\n",
+ handle);
+ ret = spci_error(SPCI_DENIED);
+ goto out;
+ }
+
+ if (retrieve_request->attribute_count != 0) {
+ dlog_verbose(
+ "Multi-way memory sharing not supported (got %d "
+ "attribute descriptors on SPCI_MEM_RETRIEVE_REQ, "
+ "expected 0).\n",
+ retrieve_request->attribute_count);
+ ret = spci_error(SPCI_NOT_SUPPORTED);
+ goto out;
+ }
+
+ if (retrieve_request->retrieve_properties_count != 1) {
+ dlog_verbose(
+ "Stream endpoints not supported (got %d retrieve "
+ "properties descriptors on SPCI_MEM_RETRIEVE_REQ, "
+ "expected 1).\n",
+ retrieve_request->retrieve_properties_count);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ retrieve_properties =
+ spci_memory_retrieve_request_first_retrieve_properties(
+ retrieve_request);
+
+ if (retrieve_properties->attributes.receiver != to_locked.vm->id) {
+ dlog_verbose(
+ "Retrieve properties receiver VM ID %d didn't match "
+ "caller of SPCI_MEM_RETRIEVE_REQ.\n",
+ retrieve_properties->attributes.receiver);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (retrieve_properties->page_count != memory_region->page_count) {
+ dlog_verbose(
+ "Incorrect page count %d for "
+ "SPCI_MEM_RETRIEVE_REQ, expected %d for handle %#x.\n",
+ retrieve_properties->page_count,
+ memory_region->page_count, handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (retrieve_properties->constituent_count != 0) {
+ dlog_verbose(
+ "Retriever specified address ranges not supported (got "
+ "%d).\n",
+ retrieve_properties->constituent_count);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ memory_to_attributes = spci_memory_attrs_to_mode(
+ memory_region->attributes[0].memory_attributes);
+
+ constituents = spci_memory_region_get_constituents(memory_region);
+ constituent_count = memory_region->constituent_count;
+ ret = spci_retrieve_memory(to_locked, constituents, constituent_count,
+ memory_to_attributes,
+ share_state->share_func, false, page_pool);
+ if (ret.func != SPCI_SUCCESS_32) {
+ goto out;
+ }
+
+ /*
+ * Copy response to RX buffer of caller and deliver the message. This
+ * must be done before the share_state is (possibly) freed.
+ */
+ response_size = spci_retrieved_memory_region_init(
+ to_locked.vm->mailbox.recv, HF_MAILBOX_SIZE, to_locked.vm->id,
+ constituents, constituent_count, memory_region->page_count);
+ to_locked.vm->mailbox.recv_size = response_size;
+ to_locked.vm->mailbox.recv_sender = HF_HYPERVISOR_VM_ID;
+ to_locked.vm->mailbox.recv_func = SPCI_MEM_RETRIEVE_RESP_32;
+ to_locked.vm->mailbox.state = MAILBOX_STATE_READ;
+
+ if (share_state->share_func == SPCI_MEM_DONATE_32) {
+ /*
+ * Memory that has been donated can't be relinquished, so no
+ * need to keep the share state around.
+ */
+ share_state_free(share_states, share_state, page_pool);
+ dlog_verbose("Freed share state for donate.\n");
+ } else {
+ share_state->retrieved[0] = true;
+ }
+
+ ret = (struct spci_value){.func = SPCI_MEM_RETRIEVE_RESP_32,
+ .arg3 = response_size,
+ .arg4 = response_size};
+
+out:
+ share_states_unlock(&share_states);
+ dump_share_states();
+ return ret;
+}
+
+struct spci_value spci_memory_relinquish(
+ struct vm_locked from_locked,
+ struct spci_mem_relinquish *relinquish_request, struct mpool *page_pool)
+{
+ spci_memory_handle_t handle = relinquish_request->handle;
+ struct share_states_locked share_states;
+ struct spci_memory_share_state *share_state;
+ struct spci_memory_region *memory_region;
+ bool clear;
+ struct spci_memory_region_constituent *constituents;
+ uint32_t constituent_count;
+ struct spci_value ret;
+
+ if (relinquish_request->endpoint_count != 0) {
+ dlog_verbose(
+ "Stream endpoints not supported (got %d extra "
+ "endpoints on SPCI_MEM_RELINQUISH, expected 0).\n",
+ relinquish_request->endpoint_count);
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ if (relinquish_request->sender != from_locked.vm->id) {
+ dlog_verbose(
+ "VM ID %d in relinquish message doesn't match calling "
+ "VM ID %d.\n",
+ relinquish_request->sender, from_locked.vm->id);
+ return spci_error(SPCI_INVALID_PARAMETERS);
+ }
+
+ dump_share_states();
+
+ share_states = share_states_lock();
+ if (!get_share_state(share_states, handle, &share_state)) {
+ dlog_verbose("Invalid handle %#x for SPCI_MEM_RELINQUISH.\n",
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ memory_region = share_state->memory_region;
+ CHECK(memory_region != NULL);
+
+ if (memory_region->attributes[0].receiver != from_locked.vm->id) {
+ dlog_verbose(
+ "VM ID %d tried to relinquish memory region with "
+ "handle %#x but receiver was %d.\n",
+ from_locked.vm->id, handle,
+ memory_region->attributes[0].receiver);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (!share_state->retrieved[0]) {
+ dlog_verbose(
+ "Memory with handle %#x not yet retrieved, can't "
+ "relinquish.\n",
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ clear = relinquish_request->flags & SPCI_MEMORY_REGION_FLAG_CLEAR;
+
+ /*
+ * Clear is not allowed for memory that was shared, as the original
+ * sender still has access to the memory.
+ */
+ if (clear && share_state->share_func == SPCI_MEM_SHARE_32) {
+ dlog_verbose("Memory which was shared can't be cleared.\n");
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
constituents = spci_memory_region_get_constituents(memory_region);
- return spci_share_memory(
- to_locked, from_locked, constituents, constituent_count,
- memory_to_attributes, share_func, page_pool,
- memory_region->flags & SPCI_MEMORY_REGION_FLAG_CLEAR);
+ constituent_count = memory_region->constituent_count;
+ ret = spci_relinquish_memory(from_locked, constituents,
+ constituent_count, page_pool, clear);
+
+ if (ret.func == SPCI_SUCCESS_32) {
+ /*
+ * Mark memory handle as not retrieved, so it can be reclaimed
+ * (or retrieved again).
+ */
+ share_state->retrieved[0] = false;
+ }
+
+out:
+ share_states_unlock(&share_states);
+ dump_share_states();
+ return ret;
+}
+
+/**
+ * Validates that the reclaim transition is allowed for the given handle,
+ * updates the page table of the reclaiming VM, and frees the internal state
+ * associated with the handle.
+ */
+struct spci_value spci_memory_reclaim(struct vm_locked to_locked,
+ spci_memory_handle_t handle, bool clear,
+ struct mpool *page_pool)
+{
+ struct share_states_locked share_states;
+ struct spci_memory_share_state *share_state;
+ struct spci_memory_region *memory_region;
+ struct spci_memory_region_constituent *constituents;
+ uint32_t constituent_count;
+ uint32_t memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
+ struct spci_value ret;
+
+ dump_share_states();
+
+ share_states = share_states_lock();
+ if (!get_share_state(share_states, handle, &share_state)) {
+ dlog_verbose("Invalid handle %#x for SPCI_MEM_RECLAIM.\n",
+ handle);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ memory_region = share_state->memory_region;
+ CHECK(memory_region != NULL);
+
+ if (to_locked.vm->id != memory_region->sender) {
+ dlog_verbose(
+ "VM %d attempted to reclaim memory handle %#x "
+ "originally sent by VM %d.\n",
+ to_locked.vm->id, handle, memory_region->sender);
+ ret = spci_error(SPCI_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (share_state->retrieved[0]) {
+ dlog_verbose(
+ "Tried to reclaim memory handle %#x that has not been "
+ "relinquished.\n",
+ handle);
+ ret = spci_error(SPCI_DENIED);
+ goto out;
+ }
+
+ constituents = spci_memory_region_get_constituents(memory_region);
+ constituent_count = memory_region->constituent_count;
+ ret = spci_retrieve_memory(to_locked, constituents, constituent_count,
+ memory_to_attributes, SPCI_MEM_RECLAIM_32,
+ clear, page_pool);
+
+ if (ret.func == SPCI_SUCCESS_32) {
+ share_state_free(share_states, share_state, page_pool);
+ dlog_verbose("Freed share state after successful reclaim.\n");
+ }
+
+out:
+ share_states_unlock(&share_states);
+ return ret;
}
diff --git a/test/inc/test/vmapi/spci.h b/test/inc/test/vmapi/spci.h
index ae6df07..24e9fc5 100644
--- a/test/inc/test/vmapi/spci.h
+++ b/test/inc/test/vmapi/spci.h
@@ -31,3 +31,12 @@
};
struct mailbox_buffers set_up_mailbox(void);
+spci_memory_handle_t send_memory_and_retrieve_request(
+ uint32_t share_func, void *tx_buffer, spci_vm_id_t sender,
+ spci_vm_id_t recipient,
+ struct spci_memory_region_constituent constituents[],
+ uint32_t constituent_count, spci_memory_region_flags_t flags,
+ enum spci_memory_access access);
+spci_vm_id_t retrieve_memory_from_message(void *recv_buf, void *send_buf,
+ struct spci_value msg_ret,
+ spci_memory_handle_t *handle);
diff --git a/test/vmapi/common/spci.c b/test/vmapi/common/spci.c
index a175cea..c3176b3 100644
--- a/test/vmapi/common/spci.c
+++ b/test/vmapi/common/spci.c
@@ -41,3 +41,95 @@
.recv = recv_page,
};
}
+
+/*
+ * Helper function to send memory to a VM then send a message with the retrieve
+ * request it needs to retrieve it.
+ */
+spci_memory_handle_t send_memory_and_retrieve_request(
+ uint32_t share_func, void *tx_buffer, spci_vm_id_t sender,
+ spci_vm_id_t recipient,
+ struct spci_memory_region_constituent constituents[],
+ uint32_t constituent_count, spci_memory_region_flags_t flags,
+ enum spci_memory_access access)
+{
+ uint32_t msg_size;
+ struct spci_value ret;
+ uint32_t page_count = 0;
+ uint32_t handle;
+ uint32_t i;
+
+ /* Send the memory. */
+ msg_size = spci_memory_region_init(
+ tx_buffer, sender, recipient, constituents, constituent_count,
+ 0, flags, access, SPCI_MEMORY_NORMAL_MEM,
+ SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
+ switch (share_func) {
+ case SPCI_MEM_DONATE_32:
+ ret = spci_mem_donate(msg_size, msg_size, 0);
+ break;
+ case SPCI_MEM_LEND_32:
+ ret = spci_mem_lend(msg_size, msg_size, 0);
+ break;
+ case SPCI_MEM_SHARE_32:
+ ret = spci_mem_share(msg_size, msg_size, 0);
+ break;
+ default:
+ FAIL("Invalid share_func %#x.\n", share_func);
+ /* Never reached, but needed to keep clang-analyser happy. */
+ return 0;
+ }
+ EXPECT_EQ(ret.func, SPCI_SUCCESS_32);
+ handle = spci_mem_success_handle(ret);
+
+ /* Count pages. */
+ for (i = 0; i < constituent_count; ++i) {
+ page_count += constituents[i].page_count;
+ }
+
+ /*
+ * Send the appropriate retrieve request to the VM so that it can use it
+ * to retrieve the memory.
+ */
+ msg_size = spci_memory_retrieve_request_init(
+ tx_buffer, handle, sender, recipient, share_func, 0, page_count,
+ access, SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
+ SPCI_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(spci_msg_send(sender, recipient, msg_size, 0).func,
+ SPCI_SUCCESS_32);
+
+ return handle;
+}
+
+/*
+ * Use the retrieve request from the recieve buffer to retrieve a memory region
+ * which has been sent to us. Returns the sender, and the handle via a return
+ * parameter.
+ */
+spci_vm_id_t retrieve_memory_from_message(void *recv_buf, void *send_buf,
+ struct spci_value msg_ret,
+ spci_memory_handle_t *handle)
+{
+ uint32_t msg_size;
+ struct spci_value ret;
+ struct spci_retrieved_memory_region *memory_region;
+ spci_vm_id_t sender;
+
+ EXPECT_EQ(msg_ret.func, SPCI_MSG_SEND_32);
+ msg_size = spci_msg_send_size(msg_ret);
+ sender = spci_msg_send_sender(msg_ret);
+
+ if (handle != NULL) {
+ struct spci_memory_retrieve_request *retrieve_request =
+ (struct spci_memory_retrieve_request *)recv_buf;
+ *handle = retrieve_request->handle;
+ }
+ memcpy_s(send_buf, HF_MAILBOX_SIZE, recv_buf, msg_size);
+ spci_rx_release();
+ ret = spci_mem_retrieve_req(msg_size, msg_size, 0);
+ EXPECT_EQ(ret.func, SPCI_MEM_RETRIEVE_RESP_32);
+ memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+ EXPECT_EQ(memory_region->receiver_count, 1);
+
+ return sender;
+}
diff --git a/test/vmapi/primary_with_secondaries/memory_sharing.c b/test/vmapi/primary_with_secondaries/memory_sharing.c
index 17f8bc1..5050f11 100644
--- a/test/vmapi/primary_with_secondaries/memory_sharing.c
+++ b/test/vmapi/primary_with_secondaries/memory_sharing.c
@@ -160,27 +160,18 @@
* Tries relinquishing memory with different VMs and asserts that
* it will fail.
*/
-static void check_cannot_relinquish_memory(
- struct mailbox_buffers mb,
- struct spci_memory_region_constituent constituents[],
- int constituent_count)
+static void check_cannot_relinquish_memory(struct mailbox_buffers mb,
+ spci_memory_handle_t handle)
{
uint32_t vms[] = {HF_PRIMARY_VM_ID, SERVICE_VM1, SERVICE_VM2};
size_t i;
- size_t j;
for (i = 0; i < ARRAY_SIZE(vms); ++i) {
- for (j = 0; j < ARRAY_SIZE(vms); ++j) {
- uint32_t msg_size = spci_memory_region_init(
- mb.send, vms[j], vms[i], constituents,
- constituent_count, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_SPCI_ERROR(
- hf_spci_mem_relinquish(msg_size, msg_size, 0),
- SPCI_INVALID_PARAMETERS);
- }
+ *(struct spci_mem_relinquish *)mb.send =
+ (struct spci_mem_relinquish){.handle = handle,
+ .sender = vms[i]};
+ EXPECT_SPCI_ERROR(spci_mem_relinquish(),
+ SPCI_INVALID_PARAMETERS);
}
}
@@ -198,7 +189,6 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
@@ -207,13 +197,9 @@
memset_s(ptr, sizeof(pages), 'a', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(run_res.func, SPCI_YIELD_32);
@@ -238,10 +224,10 @@
*/
TEST(memory_sharing, share_concurrently_and_get_back)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
@@ -251,20 +237,18 @@
/* Dirty the memory before sharing it. */
memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be returned. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
+ EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 'c');
}
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -300,7 +284,7 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
+ spci_memory_handle_t handle;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish", mb.send);
@@ -313,18 +297,16 @@
2),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
run_res = spci_run(SERVICE_VM1, 0);
/* Let the memory be returned. */
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
/* Ensure that the secondary VM accessed the region. */
for (int i = 0; i < PAGE_SIZE; ++i) {
@@ -344,7 +326,6 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_donate_relinquish", mb.send);
@@ -357,13 +338,9 @@
2),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/*
* Let the service access the memory, and try and fail to relinquish it.
@@ -380,7 +357,6 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
@@ -390,16 +366,15 @@
/* Dirty the memory before giving it. */
memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
- /* Let the memory be returned. */
+ /* Let the memory be returned, and retrieve it. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ SERVICE_VM1);
+
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 'c');
}
@@ -415,10 +390,10 @@
*/
TEST(memory_sharing, lend_and_get_back)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
@@ -428,20 +403,18 @@
/* Dirty the memory before lending it. */
memset_s(ptr, sizeof(pages), 'c', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be returned. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
+ EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 'd');
}
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -449,54 +422,50 @@
}
/**
- * After memory has been returned, it is free to be shared again.
+ * After memory has been returned, it is free to be lent again.
*/
-TEST(memory_sharing, reshare_after_return)
+TEST(memory_sharing, relend_after_return)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
- uint32_t msg_size;
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish", mb.send);
- /* Share the memory initially. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ /* Lend the memory initially. */
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be returned. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
- /* Share the memory again after it has been returned. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ /* Lend the memory again after it has been returned. */
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Observe the service doesn't fault when accessing the memory. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
}
/**
- * After memory has been returned, it is free to be shared with another VM.
+ * After memory has been returned, it is free to be lent to another VM.
*/
-TEST(memory_sharing, share_elsewhere_after_return)
+TEST(memory_sharing, lend_elsewhere_after_return)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
- uint32_t msg_size;
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
@@ -504,26 +473,21 @@
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish", mb.send);
SERVICE_SELECT(SERVICE_VM2, "spci_memory_lend_relinquish", mb.send);
- /* Share the memory initially. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ /* Lend the memory initially. */
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be returned. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
/* Share the memory with a different VM after it has been returned. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -537,21 +501,23 @@
{
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
- struct spci_memory_region *memory_region;
- struct spci_memory_region_constituent *constituents;
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
uint8_t *ptr;
SERVICE_SELECT(SERVICE_VM1, "give_memory_and_fault", mb.send);
/* Have the memory be given. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ SERVICE_VM1);
/* Check the memory was cleared. */
- memory_region = (struct spci_memory_region *)mb.recv;
- constituents = spci_memory_region_get_constituents(memory_region);
+ memory_region = (struct spci_retrieved_memory_region *)mb.recv;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 0);
}
@@ -569,21 +535,23 @@
{
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
- struct spci_memory_region *memory_region;
- struct spci_memory_region_constituent *constituents;
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
uint8_t *ptr;
SERVICE_SELECT(SERVICE_VM1, "lend_memory_and_fault", mb.send);
/* Have the memory be lent. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, SPCI_MEM_LEND_32);
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ SERVICE_VM1);
/* Check the memory was cleared. */
- memory_region = (struct spci_memory_region *)mb.recv;
- constituents = spci_memory_region_get_constituents(memory_region);
+ memory_region = (struct spci_retrieved_memory_region *)mb.recv;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 0);
}
@@ -602,11 +570,10 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
uint64_t address;
- SERVICE_SELECT(SERVICE_VM1, "spci_donate_check_upper_bound", mb.send);
- SERVICE_SELECT(SERVICE_VM2, "spci_donate_check_upper_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM1, "spci_check_upper_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM2, "spci_check_upper_bound", mb.send);
/* Initialise the memory before giving it. */
memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -624,12 +591,9 @@
*/
pages[0] = 0;
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -653,12 +617,9 @@
* Use the second secondary VM for this test as the first is now in an
* exception loop.
*/
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM2, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -673,11 +634,10 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
uint64_t address;
- SERVICE_SELECT(SERVICE_VM1, "spci_donate_check_lower_bound", mb.send);
- SERVICE_SELECT(SERVICE_VM2, "spci_donate_check_lower_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM1, "spci_check_lower_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM2, "spci_check_lower_bound", mb.send);
/* Initialise the memory before donating it. */
memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -695,12 +655,9 @@
*/
pages[0] = 0;
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -724,12 +681,9 @@
* Use the second secondary VM for this test as the first is now in an
* exception loop.
*/
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM2, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -745,7 +699,6 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_return", mb.send);
SERVICE_SELECT(SERVICE_VM2, "spci_memory_return", mb.send);
@@ -757,26 +710,21 @@
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
run_res = spci_run(SERVICE_VM1, 0);
/* Let the memory be returned. */
- EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ SERVICE_VM1);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/* Share the memory with another VM. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -792,7 +740,6 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_donate_secondary_and_fault", mb.send);
SERVICE_SELECT(SERVICE_VM2, "spci_memory_receive", mb.send);
@@ -809,12 +756,9 @@
EXPECT_EQ(run_res.func, SPCI_MSG_WAIT_32);
/* Donate memory. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be sent from VM1 to VM2. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -840,10 +784,10 @@
*/
TEST(memory_sharing, donate_twice)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_donate_twice", mb.send);
SERVICE_SELECT(SERVICE_VM2, "spci_memory_receive", mb.send);
@@ -856,12 +800,9 @@
};
/* Donate memory to VM1. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be received. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -875,12 +816,12 @@
check_cannot_donate_memory(mb, constituents, ARRAY_SIZE(constituents),
-1);
/* Fail to relinquish memory from any VM. */
- check_cannot_relinquish_memory(mb, constituents,
- ARRAY_SIZE(constituents));
+ check_cannot_relinquish_memory(mb, handle);
/* Let the memory be sent from VM1 to PRIMARY (returned). */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ SERVICE_VM1);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/* Check we have access again. */
@@ -1009,16 +950,14 @@
SPCI_INVALID_PARAMETERS);
/* Successfully donate to VM1. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Receive and return memory from VM1. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ SERVICE_VM1);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/* Use VM1 to fail to donate memory from the primary to VM2. */
@@ -1075,6 +1014,7 @@
TEST(memory_sharing, lend_invalid_source)
{
struct spci_value run_res;
+ spci_memory_handle_t handle;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
uint32_t msg_size;
@@ -1097,17 +1037,15 @@
SPCI_INVALID_PARAMETERS);
/* Lend memory to VM1. */
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Receive and return memory from VM1. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
/* Try to lend memory from primary in VM1. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1121,9 +1059,9 @@
TEST(memory_sharing, lend_relinquish_X_RW)
{
struct spci_value run_res;
+ spci_memory_handle_t handle;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_RW", mb.send);
@@ -1134,13 +1072,9 @@
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1148,19 +1082,16 @@
/* Let service write to and return memory. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
/* Re-initialise the memory before giving it. */
memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1177,10 +1108,10 @@
*/
TEST(memory_sharing, share_relinquish_X_RW)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_RW", mb.send);
@@ -1191,13 +1122,9 @@
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1211,19 +1138,16 @@
/* Let service write to and return memory. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
/* Re-initialise the memory before giving it. */
memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1247,9 +1171,9 @@
TEST(memory_sharing, share_relinquish_NX_RW)
{
struct spci_value run_res;
+ spci_memory_handle_t handle;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_RW", mb.send);
@@ -1260,13 +1184,9 @@
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_NX,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_NX);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1279,19 +1199,16 @@
/* Let service write to and return memory. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
/* Re-initialise the memory before giving it. */
memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_NX,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_NX);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1309,14 +1226,51 @@
}
/**
+ * Test that memory which is shared cannot be cleared when it is relinquished.
+ */
+TEST(memory_sharing, share_relinquish_clear)
+{
+ struct mailbox_buffers mb = set_up_mailbox();
+ uint8_t *ptr = pages;
+ spci_memory_handle_t handle;
+ struct spci_value run_res;
+ size_t i;
+
+ SERVICE_SELECT(SERVICE_VM1, "spci_memory_share_relinquish_clear",
+ mb.send);
+
+ /* Initialise the memory before giving it. */
+ memset_s(ptr, sizeof(pages) * 2, 'b', PAGE_SIZE * 2);
+
+ struct spci_memory_region_constituent constituents[] = {
+ spci_memory_region_constituent_init((uint64_t)pages, 2),
+ };
+
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_NX);
+
+ /* Let the memory be received, fail to be cleared, and then returned. */
+ run_res = spci_run(SERVICE_VM1, 0);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
+ EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
+
+ /* Check that it has not been cleared. */
+ for (i = 0; i < PAGE_SIZE * 2; ++i) {
+ ASSERT_EQ(ptr[i], 'b');
+ };
+}
+
+/**
* Exercise execution permissions for lending memory.
*/
TEST(memory_sharing, lend_relinquish_RW_X)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_X", mb.send);
@@ -1331,24 +1285,19 @@
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Attempt to execute from memory. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_NX,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_NX);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1360,10 +1309,10 @@
*/
TEST(memory_sharing, lend_relinquish_RO_X)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
SERVICE_SELECT(SERVICE_VM1, "spci_memory_lend_relinquish_X", mb.send);
@@ -1378,24 +1327,19 @@
spci_memory_region_constituent_init((uint64_t)pages, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
/* Attempt to execute from memory. */
run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, HF_SPCI_MEM_RELINQUISH);
+ EXPECT_EQ(run_res.func, SPCI_MSG_SEND_32);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_mem_reclaim(handle, 0).func, SPCI_SUCCESS_32);
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_NX,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_NX);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1422,13 +1366,10 @@
spci_memory_region_constituent_init((uint64_t)pages, 2),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ /* Lend memory to VM1. */
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1481,13 +1422,9 @@
(uint64_t)pages + PAGE_SIZE * 2, 2),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RO_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RO_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1527,6 +1464,7 @@
*/
TEST(memory_sharing, lend_twice)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
@@ -1544,13 +1482,10 @@
(uint64_t)pages + PAGE_SIZE * 3, 1),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ /* Lend memory to VM1. */
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1566,8 +1501,7 @@
check_cannot_donate_memory(mb, constituents, ARRAY_SIZE(constituents),
SERVICE_VM1);
/* Fail to relinquish from any VM. */
- check_cannot_relinquish_memory(mb, constituents,
- ARRAY_SIZE(constituents));
+ check_cannot_relinquish_memory(mb, handle);
/* Now attempt to share only a portion of the same area of memory. */
struct spci_memory_region_constituent constituents_subsection[] = {
@@ -1579,8 +1513,6 @@
check_cannot_donate_memory(mb, constituents_subsection,
ARRAY_SIZE(constituents_subsection),
SERVICE_VM1);
- check_cannot_relinquish_memory(mb, constituents_subsection,
- ARRAY_SIZE(constituents_subsection));
/* Attempt to lend again with different permissions. */
constituents[0].page_count = 1;
@@ -1603,6 +1535,7 @@
*/
TEST(memory_sharing, share_twice)
{
+ spci_memory_handle_t handle;
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
@@ -1618,13 +1551,9 @@
spci_memory_region_constituent_init((uint64_t)pages, 2),
};
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
-
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_SHARE_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
/* Let the memory be accessed. */
run_res = spci_run(SERVICE_VM1, 0);
@@ -1642,8 +1571,7 @@
check_cannot_donate_memory(mb, constituents, ARRAY_SIZE(constituents),
SERVICE_VM1);
/* Fail to relinquish from any VM. */
- check_cannot_relinquish_memory(mb, constituents,
- ARRAY_SIZE(constituents));
+ check_cannot_relinquish_memory(mb, handle);
/* Attempt to share again with different permissions. */
constituents[0].page_count = 1;
@@ -1662,7 +1590,40 @@
}
/**
- * Memory can be cleared while being shared.
+ * Memory can be cleared while being lent.
+ */
+TEST(memory_sharing, lend_clear)
+{
+ struct mailbox_buffers mb = set_up_mailbox();
+ uint8_t *ptr = pages;
+ spci_memory_handle_t handle;
+ size_t i;
+
+ SERVICE_SELECT(SERVICE_VM1, "spci_memory_return", mb.send);
+
+ /* Initialise the memory before giving it. */
+ memset_s(ptr, sizeof(pages) * 2, 'b', PAGE_SIZE * 2);
+
+ struct spci_memory_region_constituent constituents[] = {
+ spci_memory_region_constituent_init((uint64_t)pages, 2),
+ };
+
+ /* Lend memory with clear flag. */
+ handle = send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents),
+ SPCI_MEMORY_REGION_FLAG_CLEAR, SPCI_MEMORY_RO_X);
+ /* Take it back again. */
+ spci_mem_reclaim(handle, 0);
+
+ /* Check that it has not been cleared. */
+ for (i = 0; i < PAGE_SIZE * 2; ++i) {
+ ASSERT_EQ(ptr[i], 0);
+ };
+}
+
+/**
+ * Memory cannot be cleared while being shared.
*/
TEST(memory_sharing, share_clear)
{
@@ -1685,11 +1646,12 @@
ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
SPCI_MEMORY_RO_X, SPCI_MEMORY_NORMAL_MEM,
SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_share(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ EXPECT_SPCI_ERROR(spci_mem_share(msg_size, msg_size, 0),
+ SPCI_INVALID_PARAMETERS);
- /* Check that it has been cleared. */
+ /* Check that it has not been cleared. */
for (i = 0; i < PAGE_SIZE * 2; ++i) {
- ASSERT_EQ(ptr[i], 0);
+ ASSERT_EQ(ptr[i], 'b');
};
}
@@ -1701,11 +1663,10 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
uint64_t address;
- SERVICE_SELECT(SERVICE_VM1, "spci_lend_check_upper_bound", mb.send);
- SERVICE_SELECT(SERVICE_VM2, "spci_lend_check_upper_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM1, "spci_check_upper_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM2, "spci_check_upper_bound", mb.send);
/* Initialise the memory before lending it. */
memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -1723,12 +1684,9 @@
*/
pages[0] = 0;
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1752,12 +1710,9 @@
* Use the second secondary VM for this test as the first is now in an
* exception loop.
*/
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM2, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1772,11 +1727,10 @@
struct spci_value run_res;
struct mailbox_buffers mb = set_up_mailbox();
uint8_t *ptr = pages;
- uint32_t msg_size;
uint64_t address;
- SERVICE_SELECT(SERVICE_VM1, "spci_lend_check_lower_bound", mb.send);
- SERVICE_SELECT(SERVICE_VM2, "spci_lend_check_lower_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM1, "spci_check_lower_bound", mb.send);
+ SERVICE_SELECT(SERVICE_VM2, "spci_check_lower_bound", mb.send);
/* Initialise the memory before lending it. */
memset_s(ptr, sizeof(pages), 'b', 4 * PAGE_SIZE);
@@ -1794,12 +1748,9 @@
*/
pages[0] = 0;
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -1823,12 +1774,9 @@
* Use the second secondary VM for this test as the first is now in an
* exception loop.
*/
- msg_size = spci_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2,
+ constituents, ARRAY_SIZE(constituents), 0, SPCI_MEMORY_RW_X);
run_res = spci_run(SERVICE_VM2, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
diff --git a/test/vmapi/primary_with_secondaries/services/memory.c b/test/vmapi/primary_with_secondaries/services/memory.c
index 1ffabc4..0a1c561 100644
--- a/test/vmapi/primary_with_secondaries/services/memory.c
+++ b/test/vmapi/primary_with_secondaries/services/memory.c
@@ -32,25 +32,21 @@
{
/* Loop, writing message to the shared memory. */
for (;;) {
- struct spci_value ret = spci_msg_wait();
- uint8_t *ptr;
size_t i;
void *recv_buf = SERVICE_RECV_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
- spci_vm_id_t sender = memory_region->sender;
+ void *send_buf = SERVICE_SEND_BUFFER();
- EXPECT_EQ(ret.func, SPCI_MEM_SHARE_32);
-
- ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
-
- /* Check the memory was cleared. */
- for (i = 0; i < PAGE_SIZE; ++i) {
- ASSERT_EQ(ptr[i], 0);
- }
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, NULL);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
+ uint8_t *ptr =
+ (uint8_t *)spci_memory_region_constituent_get_address(
+ &range->constituents[0]);
/* Allow the memory to be populated. */
EXPECT_EQ(spci_yield().func, SPCI_SUCCESS_32);
@@ -69,17 +65,15 @@
TEST_SERVICE(give_memory_and_fault)
{
void *send_buf = SERVICE_SEND_BUFFER();
-
- /* Give memory to the primary. */
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)&page, 1),
};
- uint32_t msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+
+ /* Give memory to the primary. */
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
+ constituents, ARRAY_SIZE(constituents),
+ SPCI_MEMORY_REGION_FLAG_CLEAR, SPCI_MEMORY_RW_X);
exception_setup(NULL, exception_handler_yield_data_abort);
@@ -92,17 +86,15 @@
TEST_SERVICE(lend_memory_and_fault)
{
void *send_buf = SERVICE_SEND_BUFFER();
-
- /* Lend memory to the primary. */
struct spci_memory_region_constituent constituents[] = {
spci_memory_region_constituent_init((uint64_t)&page, 1),
};
- uint32_t msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, SPCI_MEMORY_REGION_FLAG_CLEAR,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_lend(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+
+ /* Lend memory to the primary. */
+ send_memory_and_retrieve_request(
+ SPCI_MEM_LEND_32, send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
+ constituents, ARRAY_SIZE(constituents),
+ SPCI_MEMORY_REGION_FLAG_CLEAR, SPCI_MEMORY_RW_X);
exception_setup(NULL, exception_handler_yield_data_abort);
@@ -116,24 +108,21 @@
{
struct spci_value ret = spci_msg_wait();
uint8_t *ptr;
- uint32_t msg_size;
size_t i;
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region;
- struct spci_memory_region_constituent *constituents;
exception_setup(NULL, exception_handler_yield_data_abort);
- /* The memory may have been sent in one of several different ways. */
- EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
- ret.func == SPCI_MEM_LEND_32 ||
- ret.func == SPCI_MEM_SHARE_32);
-
- memory_region = (struct spci_memory_region *)recv_buf;
- constituents = spci_memory_region_get_constituents(memory_region);
+ spci_vm_id_t sender =
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
/* Check that one has access to the shared region. */
for (i = 0; i < PAGE_SIZE; ++i) {
@@ -141,13 +130,11 @@
}
/* Give the memory back and notify the sender. */
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), memory_region->sender, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), sender,
+ range->constituents, range->constituent_count, 0,
+ SPCI_MEMORY_RW_X);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
/*
* Try and access the memory which will cause a fault unless the memory
@@ -158,66 +145,77 @@
FAIL("Exception not generated by invalid access.");
}
-TEST_SERVICE(spci_donate_check_upper_bound)
+/**
+ * Attempt to modify above the upper bound of a memory region sent to us.
+ */
+TEST_SERVICE(spci_check_upper_bound)
{
- struct spci_value ret = spci_msg_wait();
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
uint8_t *ptr;
uint8_t index;
+
void *recv_buf = SERVICE_RECV_BUFFER();
- struct spci_memory_region *memory_region;
- struct spci_memory_region_constituent *constituents;
+ void *send_buf = SERVICE_SEND_BUFFER();
+ struct spci_value ret = spci_msg_wait();
exception_setup(NULL, exception_handler_yield_data_abort);
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
-
- memory_region = (struct spci_memory_region *)recv_buf;
- constituents = spci_memory_region_get_constituents(memory_region);
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
/* Choose which constituent we want to test. */
index = *(uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[index]);
+ &range->constituents[index]);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/*
- * Check that one cannot access out of bounds after donated
- * region. This should trigger the exception handler.
+ * Check that we can't access out of bounds after the region sent to us.
+ * This should trigger the exception handler.
*/
ptr[PAGE_SIZE]++;
FAIL("Exception not generated by access out of bounds.");
}
-TEST_SERVICE(spci_donate_check_lower_bound)
+/**
+ * Attempt to modify below the lower bound of a memory region sent to us.
+ */
+TEST_SERVICE(spci_check_lower_bound)
{
- struct spci_value ret = spci_msg_wait();
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
uint8_t *ptr;
uint8_t index;
+
void *recv_buf = SERVICE_RECV_BUFFER();
- struct spci_memory_region *memory_region;
- struct spci_memory_region_constituent *constituents;
+ void *send_buf = SERVICE_SEND_BUFFER();
+ struct spci_value ret = spci_msg_wait();
exception_setup(NULL, exception_handler_yield_data_abort);
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
-
- memory_region = (struct spci_memory_region *)recv_buf;
- constituents = spci_memory_region_get_constituents(memory_region);
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
/* Choose which constituent we want to test. */
index = *(uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[index]);
+ &range->constituents[index]);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/*
- * Check that one cannot access out of bounds after donated
- * region. This should trigger the exception handler.
+ * Check that we can't access out of bounds before the region sent to
+ * us. This should trigger the exception handler.
*/
ptr[-1]++;
+
FAIL("Exception not generated by access out of bounds.");
}
@@ -226,31 +224,31 @@
*/
TEST_SERVICE(spci_donate_secondary_and_fault)
{
- struct spci_value ret = spci_msg_wait();
uint8_t *ptr;
- uint32_t msg_size;
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender =
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
+ ASSERT_EQ(sender, HF_PRIMARY_VM_ID);
exception_setup(NULL, exception_handler_yield_data_abort);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
/* Donate memory to next VM. */
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), SERVICE_VM2, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), SERVICE_VM2,
+ range->constituents, range->constituent_count, 0,
+ SPCI_MEMORY_RW_X);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
/* Ensure that we are unable to modify memory any more. */
ptr[0] = 'c';
@@ -264,26 +262,29 @@
TEST_SERVICE(spci_donate_twice)
{
uint32_t msg_size;
- struct spci_value ret = spci_msg_wait();
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent constituent =
- spci_memory_region_get_constituents(memory_region)[0];
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender =
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
+ struct spci_memory_region_constituent constituent =
+ range->constituents[0];
+
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/* Yield to allow attempt to re donate from primary. */
spci_yield();
/* Give the memory back and notify the sender. */
- msg_size = spci_memory_region_init(
- send_buf, SERVICE_VM1, HF_PRIMARY_VM_ID, &constituent, 1, 0, 0,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK, SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(SPCI_MEM_DONATE_32, send_buf,
+ hf_vm_get_id(), sender, &constituent,
+ 1, 0, SPCI_MEMORY_RW_X);
/* Attempt to donate the memory to another VM. */
msg_size = spci_memory_region_init(
@@ -302,19 +303,22 @@
*/
TEST_SERVICE(spci_memory_receive)
{
+ void *recv_buf = SERVICE_RECV_BUFFER();
+ void *send_buf = SERVICE_SEND_BUFFER();
+
for (;;) {
struct spci_value ret = spci_msg_wait();
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
uint8_t *ptr;
- void *recv_buf = SERVICE_RECV_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
-
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
+
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
ptr[0] = 'd';
spci_yield();
@@ -331,28 +335,28 @@
TEST_SERVICE(spci_donate_invalid_source)
{
uint32_t msg_size;
- struct spci_value ret = spci_msg_wait();
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender =
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
/* Give the memory back and notify the sender. */
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_mem_donate(msg_size, msg_size, 0).func, SPCI_SUCCESS_32);
+ send_memory_and_retrieve_request(
+ SPCI_MEM_DONATE_32, send_buf, hf_vm_get_id(), sender,
+ range->constituents, range->constituent_count, 0,
+ SPCI_MEMORY_RW_X);
/* Fail to donate the memory from the primary to VM2. */
msg_size = spci_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
+ send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, range->constituents,
+ range->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
SPCI_MEMORY_OUTER_SHAREABLE);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
@@ -367,28 +371,26 @@
/* Loop, giving memory back to the sender. */
for (;;) {
- struct spci_value ret = spci_msg_wait();
uint8_t *ptr;
uint8_t *ptr2;
uint32_t count;
uint32_t count2;
- uint32_t msg_size;
size_t i;
+ spci_memory_handle_t handle;
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
- /*
- * The memory may have been sent in one of several different
- * ways.
- */
- EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
- ret.func == SPCI_MEM_LEND_32 ||
- ret.func == SPCI_MEM_SHARE_32);
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
+ struct spci_memory_region_constituent *constituents =
+ range->constituents;
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
&constituents[0]);
@@ -396,6 +398,8 @@
ptr2 = (uint8_t *)spci_memory_region_constituent_get_address(
&constituents[1]);
count2 = constituents[1].page_count;
+ /* Relevant information read, mailbox can be cleared. */
+ EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
/* Check that one has access to the shared region. */
for (i = 0; i < PAGE_SIZE * count; ++i) {
@@ -406,15 +410,11 @@
}
/* Give the memory back and notify the sender. */
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), memory_region->sender,
- constituents, memory_region->constituent_count, 0, 0,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- /* Relevant information read, mailbox can be cleared. */
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
- EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+ *(struct spci_mem_relinquish *)send_buf =
+ (struct spci_mem_relinquish){.handle = handle,
+ .sender = hf_vm_get_id()};
+ EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
SPCI_SUCCESS_32);
/*
@@ -431,39 +431,38 @@
TEST_SERVICE(spci_memory_donate_relinquish)
{
for (;;) {
- struct spci_value ret = spci_msg_wait();
- uint8_t *ptr;
- uint32_t msg_size;
size_t i;
+ spci_memory_handle_t handle;
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
+ uint8_t *ptr;
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
+ struct spci_value ret = spci_msg_wait();
- EXPECT_EQ(ret.func, SPCI_MEM_DONATE_32);
+ retrieve_memory_from_message(recv_buf, send_buf, ret, &handle);
+ memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
+ &range->constituents[0]);
/* Check that we have access to the shared region. */
for (i = 0; i < PAGE_SIZE; ++i) {
ptr[i]++;
}
+
/*
* Attempt to relinquish the memory, which should fail because
* it was donated not lent.
*/
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
- constituents, memory_region->constituent_count, 0, 0,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
+ *(struct spci_mem_relinquish *)send_buf =
+ (struct spci_mem_relinquish){.handle = handle,
+ .sender = hf_vm_get_id()};
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
- EXPECT_SPCI_ERROR(hf_spci_mem_relinquish(msg_size, msg_size, 0),
+ EXPECT_SPCI_ERROR(spci_mem_relinquish(),
SPCI_INVALID_PARAMETERS);
/* Ensure we still have access to the memory. */
@@ -474,44 +473,79 @@
}
/**
+ * Receive memory that has been shared, try to relinquish it with the clear flag
+ * set (and expect to fail), and then relinquish without any flags.
+ */
+TEST_SERVICE(spci_memory_share_relinquish_clear)
+{
+ exception_setup(NULL, exception_handler_yield_data_abort);
+
+ /* Loop, receiving memory and relinquishing it. */
+ for (;;) {
+ spci_memory_handle_t handle;
+
+ void *recv_buf = SERVICE_RECV_BUFFER();
+ void *send_buf = SERVICE_SEND_BUFFER();
+
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle);
+
+ /*
+ * Mailbox can be cleared, we don't actually care what the
+ * memory region is.
+ */
+ EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
+
+ /* Trying to relinquish the memory and clear it should fail. */
+ *(struct spci_mem_relinquish *)send_buf =
+ (struct spci_mem_relinquish){
+ .handle = handle,
+ .sender = hf_vm_get_id(),
+ .flags = SPCI_MEMORY_REGION_FLAG_CLEAR};
+ EXPECT_SPCI_ERROR(spci_mem_relinquish(),
+ SPCI_INVALID_PARAMETERS);
+
+ /* Give the memory back and notify the sender. */
+ *(struct spci_mem_relinquish *)send_buf =
+ (struct spci_mem_relinquish){.handle = handle,
+ .sender = hf_vm_get_id()};
+ EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
+ SPCI_SUCCESS_32);
+ }
+}
+
+/**
* Receive memory and attempt to donate from primary VM.
*/
TEST_SERVICE(spci_lend_invalid_source)
{
+ spci_memory_handle_t handle;
uint32_t msg_size;
- struct spci_value ret = spci_msg_wait();
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
-
- EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
-
- /* Attempt to relinquish to this same VM. */
- msg_size = spci_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, hf_vm_get_id(), constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_SPCI_ERROR(hf_spci_mem_relinquish(msg_size, msg_size, 0),
- SPCI_INVALID_PARAMETERS);
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender =
+ retrieve_memory_from_message(recv_buf, send_buf, ret, &handle);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
/* Give the memory back and notify the sender. */
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+ *(struct spci_mem_relinquish *)send_buf = (struct spci_mem_relinquish){
+ .handle = handle, .sender = hf_vm_get_id()};
+ EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
SPCI_SUCCESS_32);
/* Ensure we cannot lend from the primary to another secondary. */
msg_size = spci_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
+ send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, range->constituents,
+ range->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
SPCI_MEMORY_OUTER_SHAREABLE);
EXPECT_SPCI_ERROR(spci_mem_lend(msg_size, msg_size, 0),
@@ -519,8 +553,8 @@
/* Ensure we cannot share from the primary to another secondary. */
msg_size = spci_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- memory_region->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
+ send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2, range->constituents,
+ range->constituent_count, 0, 0, SPCI_MEMORY_RW_X,
SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
SPCI_MEMORY_OUTER_SHAREABLE);
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
@@ -538,21 +572,25 @@
exception_setup(NULL, exception_handler_yield_instruction_abort);
for (;;) {
- struct spci_value ret = spci_msg_wait();
- uint64_t *ptr;
- uint32_t msg_size;
-
+ spci_memory_handle_t handle;
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
+ range->constituents;
+ uint64_t *ptr =
+ (uint64_t *)spci_memory_region_constituent_get_address(
+ &constituents[0]);
- EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
+ EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
- ptr = (uint64_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
/*
* Verify that the instruction in memory is the encoded RET
* instruction.
@@ -562,14 +600,11 @@
__asm__ volatile("blr %0" ::"r"(ptr));
/* Release the memory again. */
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
- constituents, memory_region->constituent_count, 0, 0,
- SPCI_MEMORY_RW_X, SPCI_MEMORY_NORMAL_MEM,
- SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
- EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+ *(struct spci_mem_relinquish *)send_buf =
+ (struct spci_mem_relinquish){.handle = handle,
+ .sender = hf_vm_get_id()};
+ EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
SPCI_SUCCESS_32);
}
}
@@ -582,27 +617,22 @@
exception_setup(NULL, exception_handler_yield_data_abort);
for (;;) {
- struct spci_value ret = spci_msg_wait();
+ spci_memory_handle_t handle;
uint8_t *ptr;
- uint32_t msg_size;
size_t i;
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
+ struct spci_value ret = spci_msg_wait();
+ spci_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle);
+ struct spci_retrieved_memory_region *memory_region =
+ (struct spci_retrieved_memory_region *)recv_buf;
+ struct spci_receiver_address_range *range =
+ spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
struct spci_memory_region_constituent constituent_copy =
- constituents[0];
-
- /*
- * The memory may have been sent in one of several different
- * ways.
- */
- EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
- ret.func == SPCI_MEM_LEND_32 ||
- ret.func == SPCI_MEM_SHARE_32);
+ range->constituents[0];
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
@@ -622,80 +652,16 @@
ptr[i]++;
}
- msg_size = spci_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID,
- &constituent_copy, 1, 0, 0, SPCI_MEMORY_RW_X,
- SPCI_MEMORY_NORMAL_MEM, SPCI_MEMORY_CACHE_WRITE_BACK,
- SPCI_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(hf_spci_mem_relinquish(msg_size, msg_size, 0).func,
+ /* Give the memory back and notify the sender. */
+ *(struct spci_mem_relinquish *)send_buf =
+ (struct spci_mem_relinquish){.handle = handle,
+ .sender = hf_vm_get_id()};
+ EXPECT_EQ(spci_mem_relinquish().func, SPCI_SUCCESS_32);
+ EXPECT_EQ(spci_msg_send(hf_vm_get_id(), sender, 0, 0).func,
SPCI_SUCCESS_32);
}
}
-/**
- * Attempt to modify above the upper bound for the lent memory.
- */
-TEST_SERVICE(spci_lend_check_upper_bound)
-{
- struct spci_value ret = spci_msg_wait();
- uint8_t *ptr;
- uint8_t index;
-
- void *recv_buf = SERVICE_RECV_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
-
- EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
-
- exception_setup(NULL, exception_handler_yield_data_abort);
-
- /* Choose which constituent we want to test. */
- index = *(uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
- ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[index]);
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-
- /* Check that one cannot access after lent region. */
- ASSERT_EQ(ptr[PAGE_SIZE], 0);
-
- FAIL("Exception not generated by invalid access.");
-}
-
-/**
- * Attempt to modify below the lower bound for the lent memory.
- */
-TEST_SERVICE(spci_lend_check_lower_bound)
-{
- struct spci_value ret = spci_msg_wait();
- uint8_t *ptr;
- uint8_t index;
-
- void *recv_buf = SERVICE_RECV_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
-
- exception_setup(NULL, exception_handler_yield_data_abort);
-
- EXPECT_EQ(ret.func, SPCI_MEM_LEND_32);
-
- /* Choose which constituent we want to test. */
- index = *(uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[0]);
- ptr = (uint8_t *)spci_memory_region_constituent_get_address(
- &constituents[index]);
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-
- /* Check that one cannot access after lent region. */
- ptr[-1]++;
-
- FAIL("Exception not generated by invalid access.");
-}
-
TEST_SERVICE(spci_memory_lend_twice)
{
struct spci_value ret = spci_msg_wait();
@@ -705,17 +671,15 @@
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
- struct spci_memory_region *memory_region =
- (struct spci_memory_region *)recv_buf;
- struct spci_memory_region_constituent *constituents =
- spci_memory_region_get_constituents(memory_region);
- struct spci_memory_region_constituent constituent_copy =
- constituents[0];
+ struct spci_retrieved_memory_region *memory_region;
+ struct spci_receiver_address_range *range;
+ struct spci_memory_region_constituent constituent_copy;
- /* The memory may have been sent in one of several different ways. */
- EXPECT_TRUE(ret.func == SPCI_MEM_DONATE_32 ||
- ret.func == SPCI_MEM_LEND_32 ||
- ret.func == SPCI_MEM_SHARE_32);
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
+ memory_region = (struct spci_retrieved_memory_region *)recv_buf;
+ range = spci_retrieved_memory_region_first_receiver_range(
+ memory_region);
+ constituent_copy = range->constituents[0];
EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
diff --git a/test/vmapi/primary_with_secondaries/unmapped.c b/test/vmapi/primary_with_secondaries/unmapped.c
index 43619f5..64fa9a0 100644
--- a/test/vmapi/primary_with_secondaries/unmapped.c
+++ b/test/vmapi/primary_with_secondaries/unmapped.c
@@ -46,14 +46,6 @@
SERVICE_SELECT(SERVICE_VM1, "straddling_data_unmapped", mb.send);
- /*
- * First we get a message about the memory being donated to us, then we
- * get the trap.
- */
- run_res = spci_run(SERVICE_VM1, 0);
- EXPECT_EQ(run_res.func, SPCI_MEM_DONATE_32);
- EXPECT_EQ(spci_rx_release().func, SPCI_SUCCESS_32);
-
run_res = spci_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
1);
diff --git a/vmlib/spci.c b/vmlib/spci.c
index e5fccba..55347cf 100644
--- a/vmlib/spci.c
+++ b/vmlib/spci.c
@@ -16,14 +16,29 @@
#include "hf/spci.h"
+#include <stddef.h>
+
#include "hf/types.h"
+#if defined(__linux__) && defined(__KERNEL__)
+#include <linux/kernel.h>
+#include <linux/string.h>
+
+/* Linux doesn't have a checked memcpy, so just use the unchecked version. */
+void memcpy_s(void *dest, size_t destsz, const void *src, size_t count)
+{
+ memcpy(dest, src, count);
+}
+
/*
- * Copied from hf/arch/std.h because we can't include Hafnium internal headers
- * here.
+ * Use macro from Linux because we can't include Hafnium internal headers here.
*/
#ifndef align_up
-#define align_up(v, a) (((uintptr_t)(v) + ((a)-1)) & ~((a)-1))
+#define align_up(v, a) ALIGN((v), (a))
+#endif
+
+#else
+#include "hf/std.h"
#endif
/**
@@ -90,3 +105,68 @@
return memory_region->constituent_offset + constituents_length;
}
+
+uint32_t spci_memory_retrieve_request_init(
+ struct spci_memory_retrieve_request *request,
+ spci_memory_handle_t handle, spci_vm_id_t sender, spci_vm_id_t receiver,
+ uint32_t share_func, uint32_t tag, uint32_t page_count,
+ enum spci_memory_access access, enum spci_memory_type type,
+ enum spci_memory_cacheability cacheability,
+ enum spci_memory_shareability shareability)
+{
+ struct spci_memory_retrieve_properties *retrieve_properties =
+ spci_memory_retrieve_request_first_retrieve_properties(request);
+ uint16_t attributes = 0;
+
+ /* Set memory region's page attributes. */
+ spci_set_memory_access_attr(&attributes, access);
+ spci_set_memory_type_attr(&attributes, type);
+ spci_set_memory_cacheability_attr(&attributes, cacheability);
+ spci_set_memory_shareability_attr(&attributes, shareability);
+
+ request->reserved_0 = 0;
+ request->reserved_1 = 0;
+ request->handle = handle;
+ request->sender = sender;
+ request->share_func = share_func;
+ request->tag = tag;
+ request->attribute_count = 0;
+ request->attribute_offset = 0;
+ request->retrieve_properties_count = 1;
+
+ retrieve_properties->attributes.receiver = receiver;
+ retrieve_properties->attributes.memory_attributes = attributes;
+ retrieve_properties->page_count = page_count;
+ retrieve_properties->constituent_count = 0;
+ retrieve_properties->reserved = 0;
+
+ return sizeof(struct spci_memory_retrieve_request) +
+ sizeof(struct spci_memory_retrieve_properties);
+}
+
+uint32_t spci_retrieved_memory_region_init(
+ struct spci_retrieved_memory_region *response, size_t response_max_size,
+ spci_vm_id_t receiver,
+ const struct spci_memory_region_constituent constituents[],
+ uint32_t constituent_count, uint32_t page_count)
+{
+ struct spci_receiver_address_range *response_range =
+ spci_retrieved_memory_region_first_receiver_range(response);
+
+ response->receiver_count = 1;
+ response_range->receiver = receiver;
+ response_range->page_count = page_count;
+ response_range->constituent_count = constituent_count;
+ memcpy_s(response_range->constituents,
+ response_max_size -
+ sizeof(struct spci_retrieved_memory_region) -
+ sizeof(struct spci_receiver_address_range),
+ constituents,
+ constituent_count *
+ sizeof(struct spci_memory_region_constituent));
+
+ return sizeof(struct spci_retrieved_memory_region) +
+ sizeof(struct spci_receiver_address_range) +
+ constituent_count *
+ sizeof(struct spci_memory_region_constituent);
+}
