Support fragmented memory sharing messages.
Bug: 132420445
Change-Id: I638f7fece9a8f83976c0e9ff2fd3ad66dac3ad25
diff --git a/inc/hf/api.h b/inc/hf/api.h
index bfeed7c..be825fd 100644
--- a/inc/hf/api.h
+++ b/inc/hf/api.h
@@ -71,3 +71,11 @@
struct ffa_value api_ffa_mem_reclaim(ffa_memory_handle_t handle,
ffa_memory_region_flags_t flags,
struct vcpu *current);
+struct ffa_value api_ffa_mem_frag_rx(ffa_memory_handle_t handle,
+ uint32_t fragment_offset,
+ ffa_vm_id_t sender_vm_id,
+ struct vcpu *current);
+struct ffa_value api_ffa_mem_frag_tx(ffa_memory_handle_t handle,
+ uint32_t fragment_length,
+ ffa_vm_id_t sender_vm_id,
+ struct vcpu *current);
diff --git a/inc/hf/ffa_memory.h b/inc/hf/ffa_memory.h
index 9715918..3637980 100644
--- a/inc/hf/ffa_memory.h
+++ b/inc/hf/ffa_memory.h
@@ -30,17 +30,34 @@
struct vm_locked from_locked, struct vm_locked to_locked,
struct ffa_memory_region *memory_region, uint32_t memory_share_length,
uint32_t fragment_length, uint32_t share_func, struct mpool *page_pool);
+struct ffa_value ffa_memory_send_continue(struct vm_locked from_locked,
+ void *fragment,
+ uint32_t fragment_length,
+ ffa_memory_handle_t handle,
+ struct mpool *page_pool);
+struct ffa_value ffa_memory_tee_send_continue(struct vm_locked from_locked,
+ struct vm_locked to_locked,
+ void *fragment,
+ uint32_t fragment_length,
+ ffa_memory_handle_t handle,
+ struct mpool *page_pool);
struct ffa_value ffa_memory_retrieve(struct vm_locked to_locked,
struct ffa_memory_region *retrieve_request,
uint32_t retrieve_request_length,
struct mpool *page_pool);
+struct ffa_value ffa_memory_retrieve_continue(struct vm_locked to_locked,
+ ffa_memory_handle_t handle,
+ uint32_t fragment_offset,
+ struct mpool *page_pool);
struct ffa_value ffa_memory_relinquish(
struct vm_locked from_locked,
struct ffa_mem_relinquish *relinquish_request, struct mpool *page_pool);
struct ffa_value ffa_memory_reclaim(struct vm_locked to_locked,
- ffa_memory_handle_t handle, bool clear,
+ ffa_memory_handle_t handle,
+ ffa_memory_region_flags_t flags,
struct mpool *page_pool);
struct ffa_value ffa_memory_tee_reclaim(struct vm_locked to_locked,
+ struct vm_locked from_locked,
ffa_memory_handle_t handle,
- struct ffa_memory_region *memory_region,
- bool clear, struct mpool *page_pool);
+ ffa_memory_region_flags_t flags,
+ struct mpool *page_pool);
diff --git a/inc/vmapi/hf/call.h b/inc/vmapi/hf/call.h
index 1416f77..204a248 100644
--- a/inc/vmapi/hf/call.h
+++ b/inc/vmapi/hf/call.h
@@ -175,6 +175,26 @@
.arg3 = flags});
}
+static inline struct ffa_value ffa_mem_frag_rx(ffa_memory_handle_t handle,
+ uint32_t fragment_offset)
+{
+ /* Note that sender MBZ at virtual instance. */
+ return ffa_call((struct ffa_value){.func = FFA_MEM_FRAG_RX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = fragment_offset});
+}
+
+static inline struct ffa_value ffa_mem_frag_tx(ffa_memory_handle_t handle,
+ uint32_t fragment_length)
+{
+ /* Note that sender MBZ at virtual instance. */
+ return ffa_call((struct ffa_value){.func = FFA_MEM_FRAG_TX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = fragment_length});
+}
+
/**
* Called by secondary VMs to receive a message. This will block until a message
* is received.
diff --git a/inc/vmapi/hf/ffa.h b/inc/vmapi/hf/ffa.h
index f7d7356..e6a3015 100644
--- a/inc/vmapi/hf/ffa.h
+++ b/inc/vmapi/hf/ffa.h
@@ -56,6 +56,8 @@
#define FFA_MEM_RETRIEVE_RESP_32 0x84000075
#define FFA_MEM_RELINQUISH_32 0x84000076
#define FFA_MEM_RECLAIM_32 0x84000077
+#define FFA_MEM_FRAG_RX_32 0x8400007A
+#define FFA_MEM_FRAG_TX_32 0x8400007B
/* FF-A error codes. */
#define FFA_NOT_SUPPORTED INT32_C(-1)
@@ -194,6 +196,7 @@
((ffa_memory_handle_t)(UINT64_C(1) << 63))
#define FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR \
((ffa_memory_handle_t)(UINT64_C(1) << 63))
+#define FFA_MEMORY_HANDLE_INVALID (~UINT64_C(0))
/** The ID of a VM. These are assigned sequentially starting with an offset. */
typedef uint16_t ffa_vm_id_t;
@@ -261,6 +264,11 @@
return ffa_assemble_handle(args.arg2, args.arg3);
}
+static inline ffa_memory_handle_t ffa_frag_handle(struct ffa_value args)
+{
+ return ffa_assemble_handle(args.arg1, args.arg2);
+}
+
static inline struct ffa_value ffa_mem_success(ffa_memory_handle_t handle)
{
return (struct ffa_value){.func = FFA_SUCCESS_32,
@@ -284,6 +292,11 @@
return ((uint32_t)vm_id << 16) | vcpu_index;
}
+static inline ffa_vm_id_t ffa_frag_sender(struct ffa_value args)
+{
+ return (args.arg4 >> 16) & 0xffff;
+}
+
/**
* A set of contiguous pages which is part of a memory region. This corresponds
* to table 40 of the FF-A 1.0 EAC specification, "Constituent memory region
@@ -469,14 +482,15 @@
}
uint32_t ffa_memory_region_init(
- struct ffa_memory_region *memory_region, ffa_vm_id_t sender,
- ffa_vm_id_t receiver,
+ struct ffa_memory_region *memory_region, size_t memory_region_max_size,
+ ffa_vm_id_t sender, ffa_vm_id_t receiver,
const struct ffa_memory_region_constituent constituents[],
uint32_t constituent_count, uint32_t tag,
ffa_memory_region_flags_t flags, enum ffa_data_access data_access,
enum ffa_instruction_access instruction_access,
enum ffa_memory_type type, enum ffa_memory_cacheability cacheability,
- enum ffa_memory_shareability shareability);
+ enum ffa_memory_shareability shareability, uint32_t *fragment_length,
+ uint32_t *total_length);
uint32_t ffa_memory_retrieve_request_init(
struct ffa_memory_region *memory_region, ffa_memory_handle_t handle,
ffa_vm_id_t sender, ffa_vm_id_t receiver, uint32_t tag,
@@ -487,10 +501,17 @@
uint32_t ffa_memory_lender_retrieve_request_init(
struct ffa_memory_region *memory_region, ffa_memory_handle_t handle,
ffa_vm_id_t sender);
-uint32_t ffa_retrieved_memory_region_init(
+bool ffa_retrieved_memory_region_init(
struct ffa_memory_region *response, size_t response_max_size,
ffa_vm_id_t sender, ffa_memory_attributes_t attributes,
ffa_memory_region_flags_t flags, ffa_memory_handle_t handle,
ffa_vm_id_t receiver, ffa_memory_access_permissions_t permissions,
+ uint32_t page_count, uint32_t total_constituent_count,
const struct ffa_memory_region_constituent constituents[],
- uint32_t constituent_count);
+ uint32_t fragment_constituent_count, uint32_t *total_length,
+ uint32_t *fragment_length);
+uint32_t ffa_memory_fragment_init(
+ struct ffa_memory_region_constituent *fragment,
+ size_t fragment_max_size,
+ const struct ffa_memory_region_constituent constituents[],
+ uint32_t constituent_count, uint32_t *fragment_length);
diff --git a/src/api.c b/src/api.c
index 41ccdac..d95c5c1 100644
--- a/src/api.c
+++ b/src/api.c
@@ -1473,8 +1473,20 @@
return ffa_error(FFA_INVALID_PARAMETERS);
}
- if (fragment_length != length) {
- dlog_verbose("Fragmentation not yet supported.\n");
+ if (fragment_length > length) {
+ dlog_verbose(
+ "Fragment length %d greater than total length %d.\n",
+ fragment_length, length);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ if (fragment_length < sizeof(struct ffa_memory_region) +
+ sizeof(struct ffa_memory_access)) {
+ dlog_verbose(
+ "Initial fragment length %d smaller than header size "
+ "%d.\n",
+ fragment_length,
+ sizeof(struct ffa_memory_region) +
+ sizeof(struct ffa_memory_access));
return ffa_error(FFA_INVALID_PARAMETERS);
}
@@ -1706,74 +1718,6 @@
return ret;
}
-static struct ffa_value ffa_mem_reclaim_tee(struct vm_locked to_locked,
- struct vm_locked from_locked,
- ffa_memory_handle_t handle,
- ffa_memory_region_flags_t flags,
- struct cpu *cpu)
-{
- struct ffa_value tee_ret;
- uint32_t length;
- uint32_t fragment_length;
- struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)cpu_get_buffer(cpu);
- uint32_t message_buffer_size = cpu_get_buffer_size(cpu);
- uint32_t request_length = ffa_memory_lender_retrieve_request_init(
- from_locked.vm->mailbox.recv, handle, to_locked.vm->id);
-
- CHECK(request_length <= HF_MAILBOX_SIZE);
-
- /* Retrieve memory region information from the TEE. */
- tee_ret = arch_tee_call(
- (struct ffa_value){.func = FFA_MEM_RETRIEVE_REQ_32,
- .arg1 = request_length,
- .arg2 = request_length});
- if (tee_ret.func == FFA_ERROR_32) {
- dlog_verbose("Got error %d from EL3.\n", tee_ret.arg2);
- return tee_ret;
- }
- if (tee_ret.func != FFA_MEM_RETRIEVE_RESP_32) {
- dlog_verbose(
- "Got %#x from EL3, expected FFA_MEM_RETRIEVE_RESP.\n",
- tee_ret.func);
- return ffa_error(FFA_INVALID_PARAMETERS);
- }
-
- length = tee_ret.arg1;
- fragment_length = tee_ret.arg2;
-
- if (fragment_length > HF_MAILBOX_SIZE ||
- fragment_length > message_buffer_size) {
- dlog_verbose("Invalid fragment length %d (max %d).\n", length,
- HF_MAILBOX_SIZE);
- return ffa_error(FFA_INVALID_PARAMETERS);
- }
-
- /* TODO: Support fragmentation. */
- if (fragment_length != length) {
- dlog_verbose(
- "Message fragmentation not yet supported (fragment "
- "length %d but length %d).\n",
- fragment_length, length);
- return ffa_error(FFA_INVALID_PARAMETERS);
- }
-
- /*
- * Copy the memory region descriptor to an internal buffer, so that the
- * sender can't change it underneath us.
- */
- memcpy_s(memory_region, message_buffer_size,
- from_locked.vm->mailbox.send, fragment_length);
-
- /*
- * Validate that transition is allowed (e.g. that caller is owner),
- * forward the reclaim request to the TEE, and update page tables.
- */
- return ffa_memory_tee_reclaim(to_locked, handle, memory_region,
- flags & FFA_MEM_RECLAIM_CLEAR,
- &api_page_pool);
-}
-
struct ffa_value api_ffa_mem_reclaim(ffa_memory_handle_t handle,
ffa_memory_region_flags_t flags,
struct vcpu *current)
@@ -1785,8 +1729,7 @@
FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR) {
struct vm_locked to_locked = vm_lock(to);
- ret = ffa_memory_reclaim(to_locked, handle,
- flags & FFA_MEM_RECLAIM_CLEAR,
+ ret = ffa_memory_reclaim(to_locked, handle, flags,
&api_page_pool);
vm_unlock(&to_locked);
@@ -1794,9 +1737,144 @@
struct vm *from = vm_find(HF_TEE_VM_ID);
struct two_vm_locked vm_to_from_lock = vm_lock_both(to, from);
- ret = ffa_mem_reclaim_tee(vm_to_from_lock.vm1,
- vm_to_from_lock.vm2, handle, flags,
- current->cpu);
+ ret = ffa_memory_tee_reclaim(vm_to_from_lock.vm1,
+ vm_to_from_lock.vm2, handle, flags,
+ &api_page_pool);
+
+ vm_unlock(&vm_to_from_lock.vm1);
+ vm_unlock(&vm_to_from_lock.vm2);
+ }
+
+ return ret;
+}
+
+struct ffa_value api_ffa_mem_frag_rx(ffa_memory_handle_t handle,
+ uint32_t fragment_offset,
+ ffa_vm_id_t sender_vm_id,
+ struct vcpu *current)
+{
+ struct vm *to = current->vm;
+ struct vm_locked to_locked;
+ struct ffa_value ret;
+
+ /* Sender ID MBZ at virtual instance. */
+ if (sender_vm_id != 0) {
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ to_locked = vm_lock(to);
+
+ if (msg_receiver_busy(to_locked, NULL, false)) {
+ /*
+ * Can't retrieve memory information if the mailbox is not
+ * available.
+ */
+ dlog_verbose("RX buffer not ready.\n");
+ ret = ffa_error(FFA_BUSY);
+ goto out;
+ }
+
+ ret = ffa_memory_retrieve_continue(to_locked, handle, fragment_offset,
+ &api_page_pool);
+
+out:
+ vm_unlock(&to_locked);
+ return ret;
+}
+
+struct ffa_value api_ffa_mem_frag_tx(ffa_memory_handle_t handle,
+ uint32_t fragment_length,
+ ffa_vm_id_t sender_vm_id,
+ struct vcpu *current)
+{
+ struct vm *from = current->vm;
+ const void *from_msg;
+ void *fragment_copy;
+ struct ffa_value ret;
+
+ /* Sender ID MBZ at virtual instance. */
+ if (sender_vm_id != 0) {
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ /*
+ * Check that the sender has configured its send buffer. If the TX
+ * mailbox at from_msg is configured (i.e. from_msg != NULL) then it can
+ * be safely accessed after releasing the lock since the TX mailbox
+ * address can only be configured once.
+ */
+ sl_lock(&from->lock);
+ from_msg = from->mailbox.send;
+ sl_unlock(&from->lock);
+
+ if (from_msg == NULL) {
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ /*
+ * Copy the fragment to a fresh page from the memory pool. This prevents
+ * the sender from changing it underneath us, and also lets us keep it
+ * around in the share state table if needed.
+ */
+ if (fragment_length > HF_MAILBOX_SIZE ||
+ fragment_length > MM_PPOOL_ENTRY_SIZE) {
+ dlog_verbose(
+ "Fragment length %d larger than mailbox size %d.\n",
+ fragment_length, HF_MAILBOX_SIZE);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ if (fragment_length < sizeof(struct ffa_memory_region_constituent) ||
+ fragment_length % sizeof(struct ffa_memory_region_constituent) !=
+ 0) {
+ dlog_verbose("Invalid fragment length %d.\n", fragment_length);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ fragment_copy = mpool_alloc(&api_page_pool);
+ if (fragment_copy == NULL) {
+ dlog_verbose("Failed to allocate fragment copy.\n");
+ return ffa_error(FFA_NO_MEMORY);
+ }
+ memcpy_s(fragment_copy, MM_PPOOL_ENTRY_SIZE, from_msg, fragment_length);
+
+ /*
+ * Hafnium doesn't support fragmentation of memory retrieve requests
+ * (because it doesn't support caller-specified mappings, so a request
+ * will never be larger than a single page), so this must be part of a
+ * memory send (i.e. donate, lend or share) request.
+ *
+ * We can tell from the handle whether the memory transaction is for the
+ * TEE or not.
+ */
+ if ((handle & FFA_MEMORY_HANDLE_ALLOCATOR_MASK) ==
+ FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR) {
+ struct vm_locked from_locked = vm_lock(from);
+
+ ret = ffa_memory_send_continue(from_locked, fragment_copy,
+ fragment_length, handle,
+ &api_page_pool);
+ /*
+ * `ffa_memory_send_continue` takes ownership of the
+ * fragment_copy, so we don't need to free it here.
+ */
+ vm_unlock(&from_locked);
+ } else {
+ struct vm *to = vm_find(HF_TEE_VM_ID);
+ struct two_vm_locked vm_to_from_lock = vm_lock_both(to, from);
+
+ /*
+ * The TEE RX buffer state is checked in
+ * `ffa_memory_tee_send_continue` rather than here, as we need
+ * to return `FFA_MEM_FRAG_RX` with the current offset rather
+ * than FFA_ERROR FFA_BUSY in case it is busy.
+ */
+
+ ret = ffa_memory_tee_send_continue(
+ vm_to_from_lock.vm2, vm_to_from_lock.vm1, fragment_copy,
+ fragment_length, handle, &api_page_pool);
+ /*
+ * `ffa_memory_tee_send_continue` takes ownership of the
+ * fragment_copy, so we don't need to free it here.
+ */
vm_unlock(&vm_to_from_lock.vm1);
vm_unlock(&vm_to_from_lock.vm2);
diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
index c67ede0..9a48895 100644
--- a/src/arch/aarch64/hypervisor/handler.c
+++ b/src/arch/aarch64/hypervisor/handler.c
@@ -382,6 +382,16 @@
ffa_assemble_handle(args->arg1, args->arg2), args->arg3,
current());
return true;
+ case FFA_MEM_FRAG_RX_32:
+ *args = api_ffa_mem_frag_rx(ffa_frag_handle(*args), args->arg3,
+ (args->arg4 >> 16) & 0xffff,
+ current());
+ return true;
+ case FFA_MEM_FRAG_TX_32:
+ *args = api_ffa_mem_frag_tx(ffa_frag_handle(*args), args->arg3,
+ (args->arg4 >> 16) & 0xffff,
+ current());
+ return true;
}
return false;
diff --git a/src/ffa_memory.c b/src/ffa_memory.c
index 47f45f5..849a7cb 100644
--- a/src/ffa_memory.c
+++ b/src/ffa_memory.c
@@ -36,6 +36,12 @@
*/
#define MAX_MEM_SHARES 100
+/**
+ * The maximum number of fragments into which a memory sharing message may be
+ * broken.
+ */
+#define MAX_FRAGMENTS 20
+
static_assert(sizeof(struct ffa_memory_region_constituent) % 16 == 0,
"struct ffa_memory_region_constituent must be a multiple of 16 "
"bytes long.");
@@ -53,12 +59,25 @@
"bytes long.");
struct ffa_memory_share_state {
+ ffa_memory_handle_t handle;
+
/**
* The memory region being shared, or NULL if this share state is
* unallocated.
*/
struct ffa_memory_region *memory_region;
+ struct ffa_memory_region_constituent *fragments[MAX_FRAGMENTS];
+
+ /** The number of constituents in each fragment. */
+ uint32_t fragment_constituent_counts[MAX_FRAGMENTS];
+
+ /**
+ * The number of valid elements in the `fragments` and
+ * `fragment_constituent_counts` arrays.
+ */
+ uint32_t fragment_count;
+
/**
* The FF-A function used for sharing the memory. Must be one of
* FFA_MEM_DONATE_32, FFA_MEM_LEND_32 or FFA_MEM_SHARE_32 if the
@@ -67,12 +86,18 @@
uint32_t share_func;
/**
- * Whether each recipient has retrieved the memory region yet. The order
- * of this array matches the order of the attribute descriptors in the
- * memory region descriptor. Any entries beyond the attribute_count will
- * always be false.
+ * True if all the fragments of this sharing request have been sent and
+ * Hafnium has updated the sender page table accordingly.
*/
- bool retrieved[MAX_MEM_SHARE_RECIPIENTS];
+ bool sending_complete;
+
+ /**
+ * How many fragments of the memory region each recipient has retrieved
+ * so far. The order of this array matches the order of the endpoint
+ * memory access descriptors in the memory region descriptor. Any
+ * entries beyond the receiver_count will always be 0.
+ */
+ uint32_t retrieved_fragment_count[MAX_MEM_SHARE_RECIPIENTS];
};
/**
@@ -90,36 +115,69 @@
static struct ffa_memory_share_state share_states[MAX_MEM_SHARES];
/**
- * Initialises the next available `struct ffa_memory_share_state` and sets
- * `handle` to its handle. Returns true on succes or false if none are
- * available.
+ * Buffer for retrieving memory region information from the TEE for when a
+ * region is reclaimed by a VM. Access to this buffer must be guarded by the VM
+ * lock of the TEE VM.
*/
-static bool allocate_share_state(uint32_t share_func,
- struct ffa_memory_region *memory_region,
- ffa_memory_handle_t *handle)
+alignas(PAGE_SIZE) static uint8_t
+ tee_retrieve_buffer[HF_MAILBOX_SIZE * MAX_FRAGMENTS];
+
+/**
+ * Initialises the next available `struct ffa_memory_share_state` and sets
+ * `share_state_ret` to a pointer to it. If `handle` is
+ * `FFA_MEMORY_HANDLE_INVALID` then allocates an appropriate handle, otherwise
+ * uses the provided handle which is assumed to be globally unique.
+ *
+ * Returns true on success or false if none are available.
+ */
+static bool allocate_share_state(
+ struct share_states_locked share_states, uint32_t share_func,
+ struct ffa_memory_region *memory_region, uint32_t fragment_length,
+ ffa_memory_handle_t handle,
+ struct ffa_memory_share_state **share_state_ret)
{
uint64_t i;
+ CHECK(share_states.share_states != NULL);
CHECK(memory_region != NULL);
- sl_lock(&share_states_lock_instance);
for (i = 0; i < MAX_MEM_SHARES; ++i) {
- if (share_states[i].share_func == 0) {
+ if (share_states.share_states[i].share_func == 0) {
uint32_t j;
struct ffa_memory_share_state *allocated_state =
- &share_states[i];
+ &share_states.share_states[i];
+ struct ffa_composite_memory_region *composite =
+ ffa_memory_region_get_composite(memory_region,
+ 0);
+
+ if (handle == FFA_MEMORY_HANDLE_INVALID) {
+ allocated_state->handle =
+ i |
+ FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR;
+ } else {
+ allocated_state->handle = handle;
+ }
allocated_state->share_func = share_func;
allocated_state->memory_region = memory_region;
+ allocated_state->fragment_count = 1;
+ allocated_state->fragments[0] = composite->constituents;
+ allocated_state->fragment_constituent_counts[0] =
+ (fragment_length -
+ ffa_composite_constituent_offset(memory_region,
+ 0)) /
+ sizeof(struct ffa_memory_region_constituent);
+ allocated_state->sending_complete = false;
for (j = 0; j < MAX_MEM_SHARE_RECIPIENTS; ++j) {
- allocated_state->retrieved[j] = false;
+ allocated_state->retrieved_fragment_count[j] =
+ 0;
}
- *handle = i | FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR;
- sl_unlock(&share_states_lock_instance);
+ if (share_state_ret != NULL) {
+ *share_state_ret = allocated_state;
+ }
return true;
}
}
- sl_unlock(&share_states_lock_instance);
return false;
}
@@ -140,29 +198,47 @@
}
/**
- * If the given handle is a valid handle for an allocated share state then takes
- * the lock, initialises `share_state_locked` to point to the share state and
- * returns true. Otherwise returns false and doesn't take the lock.
+ * If the given handle is a valid handle for an allocated share state then
+ * initialises `share_state_ret` to point to the share state and returns true.
+ * Otherwise returns false.
*/
static bool get_share_state(struct share_states_locked share_states,
ffa_memory_handle_t handle,
struct ffa_memory_share_state **share_state_ret)
{
struct ffa_memory_share_state *share_state;
- uint32_t index = handle & ~FFA_MEMORY_HANDLE_ALLOCATOR_MASK;
+ uint32_t index;
- if (index >= MAX_MEM_SHARES) {
- return false;
+ CHECK(share_states.share_states != NULL);
+ CHECK(share_state_ret != NULL);
+
+ /*
+ * First look for a share_state allocated by us, in which case the
+ * handle is based on the index.
+ */
+ if ((handle & FFA_MEMORY_HANDLE_ALLOCATOR_MASK) ==
+ FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR) {
+ index = handle & ~FFA_MEMORY_HANDLE_ALLOCATOR_MASK;
+ if (index < MAX_MEM_SHARES) {
+ share_state = &share_states.share_states[index];
+ if (share_state->share_func != 0) {
+ *share_state_ret = share_state;
+ return true;
+ }
+ }
}
- share_state = &share_states.share_states[index];
-
- if (share_state->share_func == 0) {
- return false;
+ /* Fall back to a linear scan. */
+ for (index = 0; index < MAX_MEM_SHARES; ++index) {
+ share_state = &share_states.share_states[index];
+ if (share_state->handle == handle &&
+ share_state->share_func != 0) {
+ *share_state_ret = share_state;
+ return true;
+ }
}
- *share_state_ret = share_state;
- return true;
+ return false;
}
/** Marks a share state as unallocated. */
@@ -170,31 +246,86 @@
struct ffa_memory_share_state *share_state,
struct mpool *page_pool)
{
+ uint32_t i;
+
CHECK(share_states.share_states != NULL);
share_state->share_func = 0;
+ share_state->sending_complete = false;
mpool_free(page_pool, share_state->memory_region);
+ /*
+ * First fragment is part of the same page as the `memory_region`, so it
+ * doesn't need to be freed separately.
+ */
+ share_state->fragments[0] = NULL;
+ share_state->fragment_constituent_counts[0] = 0;
+ for (i = 1; i < share_state->fragment_count; ++i) {
+ mpool_free(page_pool, share_state->fragments[i]);
+ share_state->fragments[i] = NULL;
+ share_state->fragment_constituent_counts[i] = 0;
+ }
+ share_state->fragment_count = 0;
share_state->memory_region = NULL;
}
-/**
- * Marks the share state with the given handle as unallocated, or returns false
- * if the handle was invalid.
- */
-static bool share_state_free_handle(ffa_memory_handle_t handle,
- struct mpool *page_pool)
+/** Checks whether the given share state has been fully sent. */
+static bool share_state_sending_complete(
+ struct share_states_locked share_states,
+ struct ffa_memory_share_state *share_state)
{
- struct share_states_locked share_states = share_states_lock();
- struct ffa_memory_share_state *share_state;
+ struct ffa_composite_memory_region *composite;
+ uint32_t expected_constituent_count;
+ uint32_t fragment_constituent_count_total = 0;
+ uint32_t i;
- if (!get_share_state(share_states, handle, &share_state)) {
- share_states_unlock(&share_states);
- return false;
+ /* Lock must be held. */
+ CHECK(share_states.share_states != NULL);
+
+ /*
+ * Share state must already be valid, or it's not possible to get hold
+ * of it.
+ */
+ CHECK(share_state->memory_region != NULL &&
+ share_state->share_func != 0);
+
+ composite =
+ ffa_memory_region_get_composite(share_state->memory_region, 0);
+ expected_constituent_count = composite->constituent_count;
+ for (i = 0; i < share_state->fragment_count; ++i) {
+ fragment_constituent_count_total +=
+ share_state->fragment_constituent_counts[i];
+ }
+ dlog_verbose(
+ "Checking completion: constituent count %d/%d from %d "
+ "fragments.\n",
+ fragment_constituent_count_total, expected_constituent_count,
+ share_state->fragment_count);
+
+ return fragment_constituent_count_total == expected_constituent_count;
+}
+
+/**
+ * Calculates the offset of the next fragment expected for the given share
+ * state.
+ */
+static uint32_t share_state_next_fragment_offset(
+ struct share_states_locked share_states,
+ struct ffa_memory_share_state *share_state)
+{
+ uint32_t next_fragment_offset;
+ uint32_t i;
+
+ /* Lock must be held. */
+ CHECK(share_states.share_states != NULL);
+
+ next_fragment_offset =
+ ffa_composite_constituent_offset(share_state->memory_region, 0);
+ for (i = 0; i < share_state->fragment_count; ++i) {
+ next_fragment_offset +=
+ share_state->fragment_constituent_counts[i] *
+ sizeof(struct ffa_memory_region_constituent);
}
- share_state_free(share_states, share_state, page_pool);
- share_states_unlock(&share_states);
-
- return true;
+ return next_fragment_offset;
}
static void dump_memory_region(struct ffa_memory_region *memory_region)
@@ -236,7 +367,7 @@
sl_lock(&share_states_lock_instance);
for (i = 0; i < MAX_MEM_SHARES; ++i) {
if (share_states[i].share_func != 0) {
- dlog("%d: ", i);
+ dlog("%#x: ", share_states[i].handle);
switch (share_states[i].share_func) {
case FFA_MEM_SHARE_32:
dlog("SHARE");
@@ -253,11 +384,14 @@
}
dlog(" (");
dump_memory_region(share_states[i].memory_region);
- if (share_states[i].retrieved[0]) {
- dlog("): retrieved\n");
+ if (share_states[i].sending_complete) {
+ dlog("): fully sent");
} else {
- dlog("): not retrieved\n");
+ dlog("): partially sent");
}
+ dlog(" with %d fragments, %d retrieved\n",
+ share_states[i].fragment_count,
+ share_states[i].retrieved_fragment_count[0]);
break;
}
}
@@ -303,12 +437,13 @@
*/
static struct ffa_value constituents_get_mode(
struct vm_locked vm, uint32_t *orig_mode,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count)
+ struct ffa_memory_region_constituent **fragments,
+ const uint32_t *fragment_constituent_counts, uint32_t fragment_count)
{
uint32_t i;
+ uint32_t j;
- if (constituent_count == 0) {
+ if (fragment_count == 0 || fragment_constituent_counts[0] == 0) {
/*
* Fail if there are no constituents. Otherwise we would get an
* uninitialised *orig_mode.
@@ -316,34 +451,43 @@
return ffa_error(FFA_INVALID_PARAMETERS);
}
- for (i = 0; i < constituent_count; ++i) {
- ipaddr_t begin = ipa_init(constituents[i].address);
- size_t size = constituents[i].page_count * PAGE_SIZE;
- ipaddr_t end = ipa_add(begin, size);
- uint32_t current_mode;
+ for (i = 0; i < fragment_count; ++i) {
+ for (j = 0; j < fragment_constituent_counts[i]; ++j) {
+ ipaddr_t begin = ipa_init(fragments[i][j].address);
+ size_t size = fragments[i][j].page_count * PAGE_SIZE;
+ ipaddr_t end = ipa_add(begin, size);
+ uint32_t current_mode;
- /* Fail if addresses are not page-aligned. */
- if (!is_aligned(ipa_addr(begin), PAGE_SIZE) ||
- !is_aligned(ipa_addr(end), PAGE_SIZE)) {
- return ffa_error(FFA_INVALID_PARAMETERS);
- }
+ /* Fail if addresses are not page-aligned. */
+ if (!is_aligned(ipa_addr(begin), PAGE_SIZE) ||
+ !is_aligned(ipa_addr(end), PAGE_SIZE)) {
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
- /*
- * Ensure that this constituent memory range is all mapped with
- * the same mode.
- */
- if (!mm_vm_get_mode(&vm.vm->ptable, begin, end,
- ¤t_mode)) {
- return ffa_error(FFA_DENIED);
- }
+ /*
+ * Ensure that this constituent memory range is all
+ * mapped with the same mode.
+ */
+ if (!mm_vm_get_mode(&vm.vm->ptable, begin, end,
+ ¤t_mode)) {
+ return ffa_error(FFA_DENIED);
+ }
- /*
- * Ensure that all constituents are mapped with the same mode.
- */
- if (i == 0) {
- *orig_mode = current_mode;
- } else if (current_mode != *orig_mode) {
- return ffa_error(FFA_DENIED);
+ /*
+ * Ensure that all constituents are mapped with the same
+ * mode.
+ */
+ if (i == 0) {
+ *orig_mode = current_mode;
+ } else if (current_mode != *orig_mode) {
+ dlog_verbose(
+ "Expected mode %#x but was %#x for %d "
+ "pages at %#x.\n",
+ *orig_mode, current_mode,
+ fragments[i][j].page_count,
+ ipa_addr(begin));
+ return ffa_error(FFA_DENIED);
+ }
}
}
@@ -367,8 +511,9 @@
static struct ffa_value ffa_send_check_transition(
struct vm_locked from, uint32_t share_func,
ffa_memory_access_permissions_t permissions, uint32_t *orig_from_mode,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t *from_mode)
+ struct ffa_memory_region_constituent **fragments,
+ uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ uint32_t *from_mode)
{
const uint32_t state_mask =
MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
@@ -376,9 +521,11 @@
ffa_memory_permissions_to_mode(permissions);
struct ffa_value ret;
- ret = constituents_get_mode(from, orig_from_mode, constituents,
- constituent_count);
+ ret = constituents_get_mode(from, orig_from_mode, fragments,
+ fragment_constituent_counts,
+ fragment_count);
if (ret.func != FFA_SUCCESS_32) {
+ dlog_verbose("Inconsistent modes.\n", fragment_count);
return ret;
}
@@ -429,16 +576,18 @@
static struct ffa_value ffa_relinquish_check_transition(
struct vm_locked from, uint32_t *orig_from_mode,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t *from_mode)
+ struct ffa_memory_region_constituent **fragments,
+ uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ uint32_t *from_mode)
{
const uint32_t state_mask =
MM_MODE_INVALID | MM_MODE_UNOWNED | MM_MODE_SHARED;
uint32_t orig_from_state;
struct ffa_value ret;
- ret = constituents_get_mode(from, orig_from_mode, constituents,
- constituent_count);
+ ret = constituents_get_mode(from, orig_from_mode, fragments,
+ fragment_constituent_counts,
+ fragment_count);
if (ret.func != FFA_SUCCESS_32) {
return ret;
}
@@ -458,8 +607,7 @@
if ((orig_from_state & ~MM_MODE_SHARED) != MM_MODE_UNOWNED) {
dlog_verbose(
"Tried to relinquish memory in state %#x (masked %#x "
- "but "
- "should be %#x).\n",
+ "but should be %#x).\n",
*orig_from_mode, orig_from_state, MM_MODE_UNOWNED);
return ffa_error(FFA_DENIED);
}
@@ -486,16 +634,18 @@
*/
static struct ffa_value ffa_retrieve_check_transition(
struct vm_locked to, uint32_t share_func,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t memory_to_attributes,
- uint32_t *to_mode)
+ struct ffa_memory_region_constituent **fragments,
+ uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ uint32_t memory_to_attributes, uint32_t *to_mode)
{
uint32_t orig_to_mode;
struct ffa_value ret;
- ret = constituents_get_mode(to, &orig_to_mode, constituents,
- constituent_count);
+ ret = constituents_get_mode(to, &orig_to_mode, fragments,
+ fragment_constituent_counts,
+ fragment_count);
if (ret.func != FFA_SUCCESS_32) {
+ dlog_verbose("Inconsistent modes.\n");
return ret;
}
@@ -540,6 +690,7 @@
break;
default:
+ dlog_error("Invalid share_func %#x.\n", share_func);
return ffa_error(FFA_INVALID_PARAMETERS);
}
@@ -566,22 +717,28 @@
*/
static bool ffa_region_group_identity_map(
struct vm_locked vm_locked,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, int mode, struct mpool *ppool, bool commit)
+ struct ffa_memory_region_constituent **fragments,
+ const uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ int mode, struct mpool *ppool, bool commit)
{
- /* Iterate over the memory region constituents. */
- for (uint32_t index = 0; index < constituent_count; index++) {
- size_t size = constituents[index].page_count * PAGE_SIZE;
- paddr_t pa_begin =
- pa_from_ipa(ipa_init(constituents[index].address));
- paddr_t pa_end = pa_add(pa_begin, size);
+ uint32_t i;
+ uint32_t j;
- if (commit) {
- vm_identity_commit(vm_locked, pa_begin, pa_end, mode,
- ppool, NULL);
- } else if (!vm_identity_prepare(vm_locked, pa_begin, pa_end,
- mode, ppool)) {
- return false;
+ /* Iterate over the memory region constituents within each fragment. */
+ for (i = 0; i < fragment_count; ++i) {
+ for (j = 0; j < fragment_constituent_counts[i]; ++j) {
+ size_t size = fragments[i][j].page_count * PAGE_SIZE;
+ paddr_t pa_begin =
+ pa_from_ipa(ipa_init(fragments[i][j].address));
+ paddr_t pa_end = pa_add(pa_begin, size);
+
+ if (commit) {
+ vm_identity_commit(vm_locked, pa_begin, pa_end,
+ mode, ppool, NULL);
+ } else if (!vm_identity_prepare(vm_locked, pa_begin,
+ pa_end, mode, ppool)) {
+ return false;
+ }
}
}
@@ -634,10 +791,12 @@
* flushed from the cache so the memory has been cleared across the system.
*/
static bool ffa_clear_memory_constituents(
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, struct mpool *page_pool)
+ struct ffa_memory_region_constituent **fragments,
+ const uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ struct mpool *page_pool)
{
struct mpool local_page_pool;
+ uint32_t i;
struct mm_stage1_locked stage1_locked;
bool ret = false;
@@ -648,18 +807,23 @@
*/
mpool_init_with_fallback(&local_page_pool, page_pool);
- /* Iterate over the memory region constituents. */
- for (uint32_t i = 0; i < constituent_count; ++i) {
- size_t size = constituents[i].page_count * PAGE_SIZE;
- paddr_t begin = pa_from_ipa(ipa_init(constituents[i].address));
- paddr_t end = pa_add(begin, size);
+ /* Iterate over the memory region constituents within each fragment. */
+ for (i = 0; i < fragment_count; ++i) {
+ uint32_t j;
- if (!clear_memory(begin, end, &local_page_pool)) {
- /*
- * api_clear_memory will defrag on failure, so no need
- * to do it here.
- */
- goto out;
+ for (j = 0; j < fragment_constituent_counts[j]; ++j) {
+ size_t size = fragments[i][j].page_count * PAGE_SIZE;
+ paddr_t begin =
+ pa_from_ipa(ipa_init(fragments[i][j].address));
+ paddr_t end = pa_add(begin, size);
+
+ if (!clear_memory(begin, end, &local_page_pool)) {
+ /*
+ * api_clear_memory will defrag on failure, so
+ * no need to do it here.
+ */
+ goto out;
+ }
}
}
@@ -695,12 +859,13 @@
*/
static struct ffa_value ffa_send_check_update(
struct vm_locked from_locked,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t share_func,
- ffa_memory_access_permissions_t permissions, struct mpool *page_pool,
- bool clear)
+ struct ffa_memory_region_constituent **fragments,
+ uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ uint32_t share_func, ffa_memory_access_permissions_t permissions,
+ struct mpool *page_pool, bool clear)
{
struct vm *from = from_locked.vm;
+ uint32_t i;
uint32_t orig_from_mode;
uint32_t from_mode;
struct mpool local_page_pool;
@@ -710,8 +875,11 @@
* Make sure constituents are properly aligned to a 64-bit boundary. If
* not we would get alignment faults trying to read (64-bit) values.
*/
- if (!is_aligned(constituents, 8)) {
- return ffa_error(FFA_INVALID_PARAMETERS);
+ for (i = 0; i < fragment_count; ++i) {
+ if (!is_aligned(fragments[i], 8)) {
+ dlog_verbose("Constituents not aligned.\n");
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
}
/*
@@ -720,9 +888,11 @@
* state.
*/
ret = ffa_send_check_transition(from_locked, share_func, permissions,
- &orig_from_mode, constituents,
- constituent_count, &from_mode);
+ &orig_from_mode, fragments,
+ fragment_constituent_counts,
+ fragment_count, &from_mode);
if (ret.func != FFA_SUCCESS_32) {
+ dlog_verbose("Invalid transition for send.\n");
return ret;
}
@@ -738,9 +908,9 @@
* without committing, to make sure the entire operation will succeed
* without exhausting the page pool.
*/
- if (!ffa_region_group_identity_map(from_locked, constituents,
- constituent_count, from_mode,
- page_pool, false)) {
+ if (!ffa_region_group_identity_map(
+ from_locked, fragments, fragment_constituent_counts,
+ fragment_count, from_mode, page_pool, false)) {
/* TODO: partial defrag of failed range. */
ret = ffa_error(FFA_NO_MEMORY);
goto out;
@@ -752,13 +922,14 @@
* case that a whole block is being unmapped that was previously
* partially mapped.
*/
- CHECK(ffa_region_group_identity_map(from_locked, constituents,
- constituent_count, from_mode,
- &local_page_pool, true));
+ CHECK(ffa_region_group_identity_map(
+ from_locked, fragments, fragment_constituent_counts,
+ fragment_count, from_mode, &local_page_pool, true));
/* Clear the memory so no VM or device can see the previous contents. */
if (clear && !ffa_clear_memory_constituents(
- constituents, constituent_count, page_pool)) {
+ fragments, fragment_constituent_counts,
+ fragment_count, page_pool)) {
/*
* On failure, roll back by returning memory to the sender. This
* may allocate pages which were previously freed into
@@ -766,8 +937,9 @@
* more pages than that so can never fail.
*/
CHECK(ffa_region_group_identity_map(
- from_locked, constituents, constituent_count,
- orig_from_mode, &local_page_pool, true));
+ from_locked, fragments, fragment_constituent_counts,
+ fragment_count, orig_from_mode, &local_page_pool,
+ true));
ret = ffa_error(FFA_NO_MEMORY);
goto out;
@@ -802,22 +974,25 @@
*/
static struct ffa_value ffa_retrieve_check_update(
struct vm_locked to_locked,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, uint32_t memory_to_attributes,
- uint32_t share_func, bool clear, struct mpool *page_pool)
+ struct ffa_memory_region_constituent **fragments,
+ uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ uint32_t memory_to_attributes, uint32_t share_func, bool clear,
+ struct mpool *page_pool)
{
struct vm *to = to_locked.vm;
+ uint32_t i;
uint32_t to_mode;
struct mpool local_page_pool;
struct ffa_value ret;
/*
- * Make sure constituents are properly aligned to a 32-bit boundary. If
- * not we would get alignment faults trying to read (32-bit) values.
+ * Make sure constituents are properly aligned to a 64-bit boundary. If
+ * not we would get alignment faults trying to read (64-bit) values.
*/
- if (!is_aligned(constituents, 4)) {
- dlog_verbose("Constituents not aligned.\n");
- return ffa_error(FFA_INVALID_PARAMETERS);
+ for (i = 0; i < fragment_count; ++i) {
+ if (!is_aligned(fragments[i], 8)) {
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
}
/*
@@ -825,11 +1000,11 @@
* that all constituents of the memory region being retrieved are at the
* same state.
*/
- ret = ffa_retrieve_check_transition(to_locked, share_func, constituents,
- constituent_count,
- memory_to_attributes, &to_mode);
+ ret = ffa_retrieve_check_transition(
+ to_locked, share_func, fragments, fragment_constituent_counts,
+ fragment_count, memory_to_attributes, &to_mode);
if (ret.func != FFA_SUCCESS_32) {
- dlog_verbose("Invalid transition.\n");
+ dlog_verbose("Invalid transition for retrieve.\n");
return ret;
}
@@ -845,9 +1020,9 @@
* the recipient page tables without committing, to make sure the entire
* operation will succeed without exhausting the page pool.
*/
- if (!ffa_region_group_identity_map(to_locked, constituents,
- constituent_count, to_mode,
- page_pool, false)) {
+ if (!ffa_region_group_identity_map(
+ to_locked, fragments, fragment_constituent_counts,
+ fragment_count, to_mode, page_pool, false)) {
/* TODO: partial defrag of failed range. */
dlog_verbose(
"Insufficient memory to update recipient page "
@@ -858,7 +1033,8 @@
/* Clear the memory so no VM or device can see the previous contents. */
if (clear && !ffa_clear_memory_constituents(
- constituents, constituent_count, page_pool)) {
+ fragments, fragment_constituent_counts,
+ fragment_count, page_pool)) {
ret = ffa_error(FFA_NO_MEMORY);
goto out;
}
@@ -868,9 +1044,9 @@
* won't allocate because the transaction was already prepared above, so
* it doesn't need to use the `local_page_pool`.
*/
- CHECK(ffa_region_group_identity_map(to_locked, constituents,
- constituent_count, to_mode,
- page_pool, true));
+ CHECK(ffa_region_group_identity_map(
+ to_locked, fragments, fragment_constituent_counts,
+ fragment_count, to_mode, page_pool, true));
ret = (struct ffa_value){.func = FFA_SUCCESS_32};
@@ -915,10 +1091,10 @@
ffa_memory_region_flags_t tee_flags;
/*
- * Make sure constituents are properly aligned to a 32-bit boundary. If
- * not we would get alignment faults trying to read (32-bit) values.
+ * Make sure constituents are properly aligned to a 64-bit boundary. If
+ * not we would get alignment faults trying to read (64-bit) values.
*/
- if (!is_aligned(constituents, 4)) {
+ if (!is_aligned(constituents, 8)) {
dlog_verbose("Constituents not aligned.\n");
return ffa_error(FFA_INVALID_PARAMETERS);
}
@@ -929,8 +1105,8 @@
* same state.
*/
ret = ffa_retrieve_check_transition(to_locked, FFA_MEM_RECLAIM_32,
- constituents, constituent_count,
- memory_to_attributes, &to_mode);
+ &constituents, &constituent_count,
+ 1, memory_to_attributes, &to_mode);
if (ret.func != FFA_SUCCESS_32) {
dlog_verbose("Invalid transition.\n");
return ret;
@@ -948,8 +1124,8 @@
* the recipient page tables without committing, to make sure the entire
* operation will succeed without exhausting the page pool.
*/
- if (!ffa_region_group_identity_map(to_locked, constituents,
- constituent_count, to_mode,
+ if (!ffa_region_group_identity_map(to_locked, &constituents,
+ &constituent_count, 1, to_mode,
page_pool, false)) {
/* TODO: partial defrag of failed range. */
dlog_verbose(
@@ -973,8 +1149,8 @@
if (ret.func != FFA_SUCCESS_32) {
dlog_verbose(
- "Got %#x (%d) from TEE in response to "
- "FFA_MEM_RECLAIM_32, expected FFA_SUCCESS_32.\n",
+ "Got %#x (%d) from TEE in response to FFA_MEM_RECLAIM, "
+ "expected FFA_SUCCESS.\n",
ret.func, ret.arg2);
goto out;
}
@@ -985,8 +1161,8 @@
* transaction was already prepared above, so it doesn't need to use the
* `local_page_pool`.
*/
- CHECK(ffa_region_group_identity_map(to_locked, constituents,
- constituent_count, to_mode,
+ CHECK(ffa_region_group_identity_map(to_locked, &constituents,
+ &constituent_count, 1, to_mode,
page_pool, true));
ret = (struct ffa_value){.func = FFA_SUCCESS_32};
@@ -1005,19 +1181,20 @@
static struct ffa_value ffa_relinquish_check_update(
struct vm_locked from_locked,
- struct ffa_memory_region_constituent *constituents,
- uint32_t constituent_count, struct mpool *page_pool, bool clear)
+ struct ffa_memory_region_constituent **fragments,
+ uint32_t *fragment_constituent_counts, uint32_t fragment_count,
+ struct mpool *page_pool, bool clear)
{
uint32_t orig_from_mode;
uint32_t from_mode;
struct mpool local_page_pool;
struct ffa_value ret;
- ret = ffa_relinquish_check_transition(from_locked, &orig_from_mode,
- constituents, constituent_count,
- &from_mode);
+ ret = ffa_relinquish_check_transition(
+ from_locked, &orig_from_mode, fragments,
+ fragment_constituent_counts, fragment_count, &from_mode);
if (ret.func != FFA_SUCCESS_32) {
- dlog_verbose("Invalid transition.\n");
+ dlog_verbose("Invalid transition for relinquish.\n");
return ret;
}
@@ -1033,9 +1210,9 @@
* without committing, to make sure the entire operation will succeed
* without exhausting the page pool.
*/
- if (!ffa_region_group_identity_map(from_locked, constituents,
- constituent_count, from_mode,
- page_pool, false)) {
+ if (!ffa_region_group_identity_map(
+ from_locked, fragments, fragment_constituent_counts,
+ fragment_count, from_mode, page_pool, false)) {
/* TODO: partial defrag of failed range. */
ret = ffa_error(FFA_NO_MEMORY);
goto out;
@@ -1047,13 +1224,14 @@
* case that a whole block is being unmapped that was previously
* partially mapped.
*/
- CHECK(ffa_region_group_identity_map(from_locked, constituents,
- constituent_count, from_mode,
- &local_page_pool, true));
+ CHECK(ffa_region_group_identity_map(
+ from_locked, fragments, fragment_constituent_counts,
+ fragment_count, from_mode, &local_page_pool, true));
/* Clear the memory so no VM or device can see the previous contents. */
if (clear && !ffa_clear_memory_constituents(
- constituents, constituent_count, page_pool)) {
+ fragments, fragment_constituent_counts,
+ fragment_count, page_pool)) {
/*
* On failure, roll back by returning memory to the sender. This
* may allocate pages which were previously freed into
@@ -1061,8 +1239,9 @@
* more pages than that so can never fail.
*/
CHECK(ffa_region_group_identity_map(
- from_locked, constituents, constituent_count,
- orig_from_mode, &local_page_pool, true));
+ from_locked, fragments, fragment_constituent_counts,
+ fragment_count, orig_from_mode, &local_page_pool,
+ true));
ret = ffa_error(FFA_NO_MEMORY);
goto out;
@@ -1083,6 +1262,45 @@
}
/**
+ * Complete a memory sending operation by checking that it is valid, updating
+ * the sender page table, and then either marking the share state as having
+ * completed sending (on success) or freeing it (on failure).
+ *
+ * Returns FFA_SUCCESS with the handle encoded, or the relevant FFA_ERROR.
+ */
+static struct ffa_value ffa_memory_send_complete(
+ struct vm_locked from_locked, struct share_states_locked share_states,
+ struct ffa_memory_share_state *share_state, struct mpool *page_pool)
+{
+ struct ffa_memory_region *memory_region = share_state->memory_region;
+ struct ffa_value ret;
+
+ /* Lock must be held. */
+ CHECK(share_states.share_states != NULL);
+
+ /* Check that state is valid in sender page table and update. */
+ ret = ffa_send_check_update(
+ from_locked, share_state->fragments,
+ share_state->fragment_constituent_counts,
+ share_state->fragment_count, share_state->share_func,
+ memory_region->receivers[0].receiver_permissions.permissions,
+ page_pool, memory_region->flags & FFA_MEMORY_REGION_FLAG_CLEAR);
+ if (ret.func != FFA_SUCCESS_32) {
+ /*
+ * Free share state, it failed to send so it can't be retrieved.
+ */
+ dlog_verbose("Complete failed, freeing share state.\n");
+ share_state_free(share_states, share_state, page_pool);
+ return ret;
+ }
+
+ share_state->sending_complete = true;
+ dlog_verbose("Marked sending complete.\n");
+
+ return ffa_mem_success(share_state->handle);
+}
+
+/**
* Check that the given `memory_region` represents a valid memory send request
* of the given `share_func` type, return the clear flag and permissions via the
* respective output parameters, and update the permissions if necessary.
@@ -1149,6 +1367,13 @@
.composite_memory_region_offset);
return ffa_error(FFA_INVALID_PARAMETERS);
}
+ if (fragment_length < memory_share_length &&
+ fragment_length < HF_MAILBOX_SIZE) {
+ dlog_warning(
+ "Initial fragment length %d smaller than mailbox "
+ "size.\n",
+ fragment_length);
+ }
/*
* Clear is not allowed for memory sharing, as the sender still has
@@ -1250,6 +1475,96 @@
}
/**
+ * Gets the share state for continuing an operation to donate, lend or share
+ * memory, and checks that it is a valid request.
+ *
+ * Returns FFA_SUCCESS if the request was valid, or the relevant FFA_ERROR if
+ * not.
+ */
+static struct ffa_value ffa_memory_send_continue_validate(
+ struct share_states_locked share_states, ffa_memory_handle_t handle,
+ struct ffa_memory_share_state **share_state_ret, ffa_vm_id_t from_vm_id,
+ struct mpool *page_pool)
+{
+ struct ffa_memory_share_state *share_state;
+ struct ffa_memory_region *memory_region;
+
+ CHECK(share_state_ret != NULL);
+
+ /*
+ * Look up the share state by handle and make sure that the VM ID
+ * matches.
+ */
+ if (!get_share_state(share_states, handle, &share_state)) {
+ dlog_verbose(
+ "Invalid handle %#x for memory send continuation.\n",
+ handle);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ memory_region = share_state->memory_region;
+
+ if (memory_region->sender != from_vm_id) {
+ dlog_verbose("Invalid sender %d.\n", memory_region->sender);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ if (share_state->sending_complete) {
+ dlog_verbose(
+ "Sending of memory handle %#x is already complete.\n",
+ handle);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ if (share_state->fragment_count == MAX_FRAGMENTS) {
+ /*
+ * Log a warning as this is a sign that MAX_FRAGMENTS should
+ * probably be increased.
+ */
+ dlog_warning(
+ "Too many fragments for memory share with handle %#x; "
+ "only %d supported.\n",
+ handle, MAX_FRAGMENTS);
+ /* Free share state, as it's not possible to complete it. */
+ share_state_free(share_states, share_state, page_pool);
+ return ffa_error(FFA_NO_MEMORY);
+ }
+
+ *share_state_ret = share_state;
+
+ return (struct ffa_value){.func = FFA_SUCCESS_32};
+}
+
+/**
+ * Forwards a memory send continuation message on to the TEE.
+ */
+static struct ffa_value memory_send_continue_tee_forward(
+ struct vm_locked tee_locked, ffa_vm_id_t sender_vm_id, void *fragment,
+ uint32_t fragment_length, ffa_memory_handle_t handle)
+{
+ struct ffa_value ret;
+
+ memcpy_s(tee_locked.vm->mailbox.recv, FFA_MSG_PAYLOAD_MAX, fragment,
+ fragment_length);
+ tee_locked.vm->mailbox.recv_size = fragment_length;
+ tee_locked.vm->mailbox.recv_sender = sender_vm_id;
+ tee_locked.vm->mailbox.recv_func = FFA_MEM_FRAG_TX_32;
+ tee_locked.vm->mailbox.state = MAILBOX_STATE_RECEIVED;
+ ret = arch_tee_call(
+ (struct ffa_value){.func = FFA_MEM_FRAG_TX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = fragment_length,
+ .arg4 = (uint64_t)sender_vm_id << 16});
+ /*
+ * After the call to the TEE completes it must have finished reading its
+ * RX buffer, so it is ready for another message.
+ */
+ tee_locked.vm->mailbox.state = MAILBOX_STATE_EMPTY;
+
+ return ret;
+}
+
+/**
* Validates a call to donate, lend or share memory to a non-TEE VM and then
* updates the stage-2 page tables. Specifically, check if the message length
* and number of memory region constituents match, and if the transition is
@@ -1271,8 +1586,8 @@
{
ffa_memory_access_permissions_t permissions;
struct ffa_value ret;
- ffa_memory_handle_t handle;
- struct ffa_composite_memory_region *composite;
+ struct share_states_locked share_states;
+ struct ffa_memory_share_state *share_state;
/*
* If there is an error validating the `memory_region` then we need to
@@ -1302,33 +1617,38 @@
break;
}
+ share_states = share_states_lock();
/*
* Allocate a share state before updating the page table. Otherwise if
* updating the page table succeeded but allocating the share state
* failed then it would leave the memory in a state where nobody could
* get it back.
*/
- if (!allocate_share_state(share_func, memory_region, &handle)) {
+ if (!allocate_share_state(share_states, share_func, memory_region,
+ fragment_length, FFA_MEMORY_HANDLE_INVALID,
+ &share_state)) {
dlog_verbose("Failed to allocate share state.\n");
mpool_free(page_pool, memory_region);
- return ffa_error(FFA_NO_MEMORY);
+ ret = ffa_error(FFA_NO_MEMORY);
+ goto out;
}
+ if (fragment_length == memory_share_length) {
+ /* No more fragments to come, everything fit in one message. */
+ ret = ffa_memory_send_complete(from_locked, share_states,
+ share_state, page_pool);
+ } else {
+ ret = (struct ffa_value){
+ .func = FFA_MEM_FRAG_RX_32,
+ .arg1 = (uint32_t)share_state->handle,
+ .arg2 = (uint32_t)(share_state->handle >> 32),
+ .arg3 = fragment_length};
+ }
+
+out:
+ share_states_unlock(&share_states);
dump_share_states();
-
- /* Check that state is valid in sender page table and update. */
- composite = ffa_memory_region_get_composite(memory_region, 0);
- ret = ffa_send_check_update(
- from_locked, composite->constituents,
- composite->constituent_count, share_func, permissions,
- page_pool, memory_region->flags & FFA_MEMORY_REGION_FLAG_CLEAR);
- if (ret.func != FFA_SUCCESS_32) {
- /* Free share state. */
- CHECK(share_state_free_handle(handle, page_pool));
- return ret;
- }
-
- return ffa_mem_success(handle);
+ return ret;
}
/**
@@ -1352,7 +1672,6 @@
{
ffa_memory_access_permissions_t permissions;
struct ffa_value ret;
- struct ffa_composite_memory_region *composite;
/*
* If there is an error validating the `memory_region` then we need to
@@ -1366,26 +1685,336 @@
goto out;
}
- /* Check that state is valid in sender page table and update. */
- composite = ffa_memory_region_get_composite(memory_region, 0);
- ret = ffa_send_check_update(
- from_locked, composite->constituents,
- composite->constituent_count, share_func, permissions,
- page_pool, memory_region->flags & FFA_MEMORY_REGION_FLAG_CLEAR);
- if (ret.func != FFA_SUCCESS_32) {
- goto out;
+ if (fragment_length == memory_share_length) {
+ /* No more fragments to come, everything fit in one message. */
+ struct ffa_composite_memory_region *composite =
+ ffa_memory_region_get_composite(memory_region, 0);
+ struct ffa_memory_region_constituent *constituents =
+ composite->constituents;
+
+ ret = ffa_send_check_update(
+ from_locked, &constituents,
+ &composite->constituent_count, 1, share_func,
+ permissions, page_pool,
+ memory_region->flags & FFA_MEMORY_REGION_FLAG_CLEAR);
+ if (ret.func != FFA_SUCCESS_32) {
+ goto out;
+ }
+
+ /* Forward memory send message on to TEE. */
+ ret = memory_send_tee_forward(
+ to_locked, from_locked.vm->id, share_func,
+ memory_region, memory_share_length, fragment_length);
+ } else {
+ struct share_states_locked share_states = share_states_lock();
+ ffa_memory_handle_t handle;
+
+ /*
+ * We need to wait for the rest of the fragments before we can
+ * check whether the transaction is valid and unmap the memory.
+ * Call the TEE so it can do its initial validation and assign a
+ * handle, and allocate a share state to keep what we have so
+ * far.
+ */
+ ret = memory_send_tee_forward(
+ to_locked, from_locked.vm->id, share_func,
+ memory_region, memory_share_length, fragment_length);
+ if (ret.func == FFA_ERROR_32) {
+ goto out_unlock;
+ } else if (ret.func != FFA_MEM_FRAG_RX_32) {
+ dlog_warning(
+ "Got %#x from TEE in response to %#x for "
+ "fragment with with %d/%d, expected "
+ "FFA_MEM_FRAG_RX.\n",
+ ret.func, share_func, fragment_length,
+ memory_share_length);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out_unlock;
+ }
+ handle = ffa_frag_handle(ret);
+ if (ret.arg3 != fragment_length) {
+ dlog_warning(
+ "Got unexpected fragment offset %d for "
+ "FFA_MEM_FRAG_RX from TEE (expected %d).\n",
+ ret.arg3, fragment_length);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out_unlock;
+ }
+ if (ffa_frag_sender(ret) != from_locked.vm->id) {
+ dlog_warning(
+ "Got unexpected sender ID %d for "
+ "FFA_MEM_FRAG_RX from TEE (expected %d).\n",
+ ffa_frag_sender(ret), from_locked.vm->id);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out_unlock;
+ }
+
+ if (!allocate_share_state(share_states, share_func,
+ memory_region, fragment_length,
+ handle, NULL)) {
+ dlog_verbose("Failed to allocate share state.\n");
+ ret = ffa_error(FFA_NO_MEMORY);
+ goto out_unlock;
+ }
+ /*
+ * Don't free the memory region fragment, as it has been stored
+ * in the share state.
+ */
+ memory_region = NULL;
+ out_unlock:
+ share_states_unlock(&share_states);
}
- /* Forward memory send message on to TEE. */
- ret = memory_send_tee_forward(to_locked, from_locked.vm->id, share_func,
- memory_region, memory_share_length,
- fragment_length);
+out:
+ if (memory_region != NULL) {
+ mpool_free(page_pool, memory_region);
+ }
+ dump_share_states();
+ return ret;
+}
+
+/**
+ * Continues an operation to donate, lend or share memory to a non-TEE VM. If
+ * this is the last fragment then checks that the transition is valid for the
+ * type of memory sending operation and updates the stage-2 page tables of the
+ * sender.
+ *
+ * Assumes that the caller has already found and locked the sender VM and copied
+ * the memory region descriptor from the sender's TX buffer to a freshly
+ * allocated page from Hafnium's internal pool.
+ *
+ * This function takes ownership of the `fragment` passed in; it must not be
+ * freed by the caller.
+ */
+struct ffa_value ffa_memory_send_continue(struct vm_locked from_locked,
+ void *fragment,
+ uint32_t fragment_length,
+ ffa_memory_handle_t handle,
+ struct mpool *page_pool)
+{
+ struct share_states_locked share_states = share_states_lock();
+ struct ffa_memory_share_state *share_state;
+ struct ffa_value ret;
+ struct ffa_memory_region *memory_region;
+
+ ret = ffa_memory_send_continue_validate(share_states, handle,
+ &share_state,
+ from_locked.vm->id, page_pool);
+ if (ret.func != FFA_SUCCESS_32) {
+ goto out_free_fragment;
+ }
+ memory_region = share_state->memory_region;
+
+ if (memory_region->receivers[0].receiver_permissions.receiver ==
+ HF_TEE_VM_ID) {
+ dlog_error(
+ "Got hypervisor-allocated handle for memory send to "
+ "TEE. This should never happen, and indicates a bug in "
+ "EL3 code.\n");
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out_free_fragment;
+ }
+
+ /* Add this fragment. */
+ share_state->fragments[share_state->fragment_count] = fragment;
+ share_state->fragment_constituent_counts[share_state->fragment_count] =
+ fragment_length / sizeof(struct ffa_memory_region_constituent);
+ share_state->fragment_count++;
+
+ /* Check whether the memory send operation is now ready to complete. */
+ if (share_state_sending_complete(share_states, share_state)) {
+ ret = ffa_memory_send_complete(from_locked, share_states,
+ share_state, page_pool);
+ } else {
+ ret = (struct ffa_value){
+ .func = FFA_MEM_FRAG_RX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = share_state_next_fragment_offset(share_states,
+ share_state)};
+ }
+ goto out;
+
+out_free_fragment:
+ mpool_free(page_pool, fragment);
out:
- mpool_free(page_pool, memory_region);
+ share_states_unlock(&share_states);
return ret;
}
+/**
+ * Continues an operation to donate, lend or share memory to the TEE VM. If this
+ * is the last fragment then checks that the transition is valid for the type of
+ * memory sending operation and updates the stage-2 page tables of the sender.
+ *
+ * Assumes that the caller has already found and locked the sender VM and copied
+ * the memory region descriptor from the sender's TX buffer to a freshly
+ * allocated page from Hafnium's internal pool.
+ *
+ * This function takes ownership of the `memory_region` passed in and will free
+ * it when necessary; it must not be freed by the caller.
+ */
+struct ffa_value ffa_memory_tee_send_continue(struct vm_locked from_locked,
+ struct vm_locked to_locked,
+ void *fragment,
+ uint32_t fragment_length,
+ ffa_memory_handle_t handle,
+ struct mpool *page_pool)
+{
+ struct share_states_locked share_states = share_states_lock();
+ struct ffa_memory_share_state *share_state;
+ struct ffa_value ret;
+ struct ffa_memory_region *memory_region;
+
+ ret = ffa_memory_send_continue_validate(share_states, handle,
+ &share_state,
+ from_locked.vm->id, page_pool);
+ if (ret.func != FFA_SUCCESS_32) {
+ goto out_free_fragment;
+ }
+ memory_region = share_state->memory_region;
+
+ if (memory_region->receivers[0].receiver_permissions.receiver !=
+ HF_TEE_VM_ID) {
+ dlog_error(
+ "Got SPM-allocated handle for memory send to non-TEE "
+ "VM. This should never happen, and indicates a bug.\n");
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out_free_fragment;
+ }
+
+ if (to_locked.vm->mailbox.state != MAILBOX_STATE_EMPTY ||
+ to_locked.vm->mailbox.recv == NULL) {
+ /*
+ * If the TEE RX buffer is not available, tell the sender to
+ * retry by returning the current offset again.
+ */
+ ret = (struct ffa_value){
+ .func = FFA_MEM_FRAG_RX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = share_state_next_fragment_offset(share_states,
+ share_state),
+ };
+ goto out_free_fragment;
+ }
+
+ /* Add this fragment. */
+ share_state->fragments[share_state->fragment_count] = fragment;
+ share_state->fragment_constituent_counts[share_state->fragment_count] =
+ fragment_length / sizeof(struct ffa_memory_region_constituent);
+ share_state->fragment_count++;
+
+ /* Check whether the memory send operation is now ready to complete. */
+ if (share_state_sending_complete(share_states, share_state)) {
+ ret = ffa_memory_send_complete(from_locked, share_states,
+ share_state, page_pool);
+
+ if (ret.func == FFA_SUCCESS_32) {
+ /*
+ * Forward final fragment on to the TEE so that
+ * it can complete the memory sending operation.
+ */
+ ret = memory_send_continue_tee_forward(
+ to_locked, from_locked.vm->id, fragment,
+ fragment_length, handle);
+
+ if (ret.func != FFA_SUCCESS_32) {
+ /*
+ * The error will be passed on to the caller,
+ * but log it here too.
+ */
+ dlog_verbose(
+ "TEE didn't successfully complete "
+ "memory send operation; returned %#x "
+ "(%d).\n",
+ ret.func, ret.arg2);
+ }
+ /* Free share state. */
+ share_state_free(share_states, share_state, page_pool);
+ } else {
+ /* Abort sending to TEE. */
+ struct ffa_value tee_ret =
+ arch_tee_call((struct ffa_value){
+ .func = FFA_MEM_RECLAIM_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32)});
+
+ if (tee_ret.func != FFA_SUCCESS_32) {
+ /*
+ * Nothing we can do if TEE doesn't abort
+ * properly, just log it.
+ */
+ dlog_verbose(
+ "TEE didn't successfully abort failed "
+ "memory send operation; returned %#x "
+ "(%d).\n",
+ tee_ret.func, tee_ret.arg2);
+ }
+ /*
+ * We don't need to free the share state in this case
+ * because ffa_memory_send_complete does that already.
+ */
+ }
+ } else {
+ uint32_t next_fragment_offset =
+ share_state_next_fragment_offset(share_states,
+ share_state);
+
+ ret = memory_send_continue_tee_forward(
+ to_locked, from_locked.vm->id, fragment,
+ fragment_length, handle);
+
+ if (ret.func != FFA_MEM_FRAG_RX_32 ||
+ ffa_frag_handle(ret) != handle ||
+ ret.arg3 != next_fragment_offset ||
+ ffa_frag_sender(ret) != from_locked.vm->id) {
+ dlog_verbose(
+ "Got unexpected result from forwarding "
+ "FFA_MEM_FRAG_TX to TEE: %#x (handle %#x, "
+ "offset %d, sender %d); expected "
+ "FFA_MEM_FRAG_RX (handle %#x, offset %d, "
+ "sender %d).\n",
+ ret.func, ffa_frag_handle(ret), ret.arg3,
+ ffa_frag_sender(ret), handle,
+ next_fragment_offset, from_locked.vm->id);
+ /* Free share state. */
+ share_state_free(share_states, share_state, page_pool);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ ret = (struct ffa_value){.func = FFA_MEM_FRAG_RX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = next_fragment_offset};
+ }
+ goto out;
+
+out_free_fragment:
+ mpool_free(page_pool, fragment);
+
+out:
+ share_states_unlock(&share_states);
+ return ret;
+}
+
+/** Clean up after the receiver has finished retrieving a memory region. */
+static void ffa_memory_retrieve_complete(
+ struct share_states_locked share_states,
+ struct ffa_memory_share_state *share_state, struct mpool *page_pool)
+{
+ if (share_state->share_func == FFA_MEM_DONATE_32) {
+ /*
+ * Memory that has been donated can't be relinquished,
+ * so no need to keep the share state around.
+ */
+ share_state_free(share_states, share_state, page_pool);
+ dlog_verbose("Freed share state for donate.\n");
+ }
+}
+
struct ffa_value ffa_memory_retrieve(struct vm_locked to_locked,
struct ffa_memory_region *retrieve_request,
uint32_t retrieve_request_length,
@@ -1408,11 +2037,12 @@
enum ffa_instruction_access requested_instruction_access;
ffa_memory_access_permissions_t permissions;
uint32_t memory_to_attributes;
- struct ffa_composite_memory_region *composite;
struct share_states_locked share_states;
struct ffa_memory_share_state *share_state;
struct ffa_value ret;
- uint32_t response_length;
+ struct ffa_composite_memory_region *composite;
+ uint32_t total_length;
+ uint32_t fragment_length;
dump_share_states();
@@ -1507,7 +2137,16 @@
goto out;
}
- if (share_state->retrieved[0]) {
+ if (!share_state->sending_complete) {
+ dlog_verbose(
+ "Memory with handle %#x not fully sent, can't "
+ "retrieve.\n",
+ handle);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (share_state->retrieved_fragment_count[0] != 0) {
dlog_verbose("Memory with handle %#x already retrieved.\n",
handle);
ret = ffa_error(FFA_DENIED);
@@ -1599,10 +2238,10 @@
}
memory_to_attributes = ffa_memory_permissions_to_mode(permissions);
- composite = ffa_memory_region_get_composite(memory_region, 0);
ret = ffa_retrieve_check_update(
- to_locked, composite->constituents,
- composite->constituent_count, memory_to_attributes,
+ to_locked, share_state->fragments,
+ share_state->fragment_constituent_counts,
+ share_state->fragment_count, memory_to_attributes,
share_state->share_func, false, page_pool);
if (ret.func != FFA_SUCCESS_32) {
goto out;
@@ -1613,30 +2252,149 @@
* must be done before the share_state is (possibly) freed.
*/
/* TODO: combine attributes from sender and request. */
- response_length = ffa_retrieved_memory_region_init(
+ composite = ffa_memory_region_get_composite(memory_region, 0);
+ /*
+ * Constituents which we received in the first fragment should always
+ * fit in the first fragment we are sending, because the header is the
+ * same size in both cases and we have a fixed message buffer size. So
+ * `ffa_retrieved_memory_region_init` should never fail.
+ */
+ CHECK(ffa_retrieved_memory_region_init(
to_locked.vm->mailbox.recv, HF_MAILBOX_SIZE,
memory_region->sender, memory_region->attributes,
memory_region->flags, handle, to_locked.vm->id, permissions,
- composite->constituents, composite->constituent_count);
- to_locked.vm->mailbox.recv_size = response_length;
+ composite->page_count, composite->constituent_count,
+ share_state->fragments[0],
+ share_state->fragment_constituent_counts[0], &total_length,
+ &fragment_length));
+ to_locked.vm->mailbox.recv_size = fragment_length;
to_locked.vm->mailbox.recv_sender = HF_HYPERVISOR_VM_ID;
to_locked.vm->mailbox.recv_func = FFA_MEM_RETRIEVE_RESP_32;
to_locked.vm->mailbox.state = MAILBOX_STATE_READ;
- if (share_state->share_func == FFA_MEM_DONATE_32) {
- /*
- * Memory that has been donated can't be relinquished, so no
- * need to keep the share state around.
- */
- share_state_free(share_states, share_state, page_pool);
- dlog_verbose("Freed share state for donate.\n");
- } else {
- share_state->retrieved[0] = true;
+ share_state->retrieved_fragment_count[0] = 1;
+ if (share_state->retrieved_fragment_count[0] ==
+ share_state->fragment_count) {
+ ffa_memory_retrieve_complete(share_states, share_state,
+ page_pool);
}
ret = (struct ffa_value){.func = FFA_MEM_RETRIEVE_RESP_32,
- .arg1 = response_length,
- .arg2 = response_length};
+ .arg1 = total_length,
+ .arg2 = fragment_length};
+
+out:
+ share_states_unlock(&share_states);
+ dump_share_states();
+ return ret;
+}
+
+struct ffa_value ffa_memory_retrieve_continue(struct vm_locked to_locked,
+ ffa_memory_handle_t handle,
+ uint32_t fragment_offset,
+ struct mpool *page_pool)
+{
+ struct ffa_memory_region *memory_region;
+ struct share_states_locked share_states;
+ struct ffa_memory_share_state *share_state;
+ struct ffa_value ret;
+ uint32_t fragment_index;
+ uint32_t retrieved_constituents_count;
+ uint32_t i;
+ uint32_t expected_fragment_offset;
+ uint32_t remaining_constituent_count;
+ uint32_t fragment_length;
+
+ dump_share_states();
+
+ share_states = share_states_lock();
+ if (!get_share_state(share_states, handle, &share_state)) {
+ dlog_verbose("Invalid handle %#x for FFA_MEM_FRAG_RX.\n",
+ handle);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ memory_region = share_state->memory_region;
+ CHECK(memory_region != NULL);
+
+ if (memory_region->receivers[0].receiver_permissions.receiver !=
+ to_locked.vm->id) {
+ dlog_verbose(
+ "Caller of FFA_MEM_FRAG_RX (%d) is not receiver (%d) "
+ "of handle %#x.\n",
+ to_locked.vm->id,
+ memory_region->receivers[0]
+ .receiver_permissions.receiver,
+ handle);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (!share_state->sending_complete) {
+ dlog_verbose(
+ "Memory with handle %#x not fully sent, can't "
+ "retrieve.\n",
+ handle);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (share_state->retrieved_fragment_count[0] == 0 ||
+ share_state->retrieved_fragment_count[0] >=
+ share_state->fragment_count) {
+ dlog_verbose(
+ "Retrieval of memory with handle %#x not yet started "
+ "or already completed (%d/%d fragments retrieved).\n",
+ handle, share_state->retrieved_fragment_count[0],
+ share_state->fragment_count);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ fragment_index = share_state->retrieved_fragment_count[0];
+
+ /*
+ * Check that the given fragment offset is correct by counting how many
+ * constituents were in the fragments previously sent.
+ */
+ retrieved_constituents_count = 0;
+ for (i = 0; i < fragment_index; ++i) {
+ retrieved_constituents_count +=
+ share_state->fragment_constituent_counts[i];
+ }
+ expected_fragment_offset =
+ ffa_composite_constituent_offset(memory_region, 0) +
+ retrieved_constituents_count *
+ sizeof(struct ffa_memory_region_constituent);
+ if (fragment_offset != expected_fragment_offset) {
+ dlog_verbose("Fragment offset was %d but expected %d.\n",
+ fragment_offset, expected_fragment_offset);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ remaining_constituent_count = ffa_memory_fragment_init(
+ to_locked.vm->mailbox.recv, HF_MAILBOX_SIZE,
+ share_state->fragments[fragment_index],
+ share_state->fragment_constituent_counts[fragment_index],
+ &fragment_length);
+ CHECK(remaining_constituent_count == 0);
+ to_locked.vm->mailbox.recv_size = fragment_length;
+ to_locked.vm->mailbox.recv_sender = HF_HYPERVISOR_VM_ID;
+ to_locked.vm->mailbox.recv_func = FFA_MEM_FRAG_TX_32;
+ to_locked.vm->mailbox.state = MAILBOX_STATE_READ;
+ share_state->retrieved_fragment_count[0]++;
+ if (share_state->retrieved_fragment_count[0] ==
+ share_state->fragment_count) {
+ ffa_memory_retrieve_complete(share_states, share_state,
+ page_pool);
+ }
+
+ ret = (struct ffa_value){.func = FFA_MEM_FRAG_TX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = fragment_length};
out:
share_states_unlock(&share_states);
@@ -1653,7 +2411,6 @@
struct ffa_memory_share_state *share_state;
struct ffa_memory_region *memory_region;
bool clear;
- struct ffa_composite_memory_region *composite;
struct ffa_value ret;
if (relinquish_request->endpoint_count != 1) {
@@ -1682,6 +2439,15 @@
goto out;
}
+ if (!share_state->sending_complete) {
+ dlog_verbose(
+ "Memory with handle %#x not fully sent, can't "
+ "relinquish.\n",
+ handle);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
memory_region = share_state->memory_region;
CHECK(memory_region != NULL);
@@ -1697,9 +2463,10 @@
goto out;
}
- if (!share_state->retrieved[0]) {
+ if (share_state->retrieved_fragment_count[0] !=
+ share_state->fragment_count) {
dlog_verbose(
- "Memory with handle %#x not yet retrieved, can't "
+ "Memory with handle %#x not yet fully retrieved, can't "
"relinquish.\n",
handle);
ret = ffa_error(FFA_INVALID_PARAMETERS);
@@ -1718,17 +2485,17 @@
goto out;
}
- composite = ffa_memory_region_get_composite(memory_region, 0);
- ret = ffa_relinquish_check_update(from_locked, composite->constituents,
- composite->constituent_count,
- page_pool, clear);
+ ret = ffa_relinquish_check_update(
+ from_locked, share_state->fragments,
+ share_state->fragment_constituent_counts,
+ share_state->fragment_count, page_pool, clear);
if (ret.func == FFA_SUCCESS_32) {
/*
* Mark memory handle as not retrieved, so it can be reclaimed
* (or retrieved again).
*/
- share_state->retrieved[0] = false;
+ share_state->retrieved_fragment_count[0] = 0;
}
out:
@@ -1743,13 +2510,13 @@
* associated with the handle.
*/
struct ffa_value ffa_memory_reclaim(struct vm_locked to_locked,
- ffa_memory_handle_t handle, bool clear,
+ ffa_memory_handle_t handle,
+ ffa_memory_region_flags_t flags,
struct mpool *page_pool)
{
struct share_states_locked share_states;
struct ffa_memory_share_state *share_state;
struct ffa_memory_region *memory_region;
- struct ffa_composite_memory_region *composite;
uint32_t memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
struct ffa_value ret;
@@ -1775,7 +2542,16 @@
goto out;
}
- if (share_state->retrieved[0]) {
+ if (!share_state->sending_complete) {
+ dlog_verbose(
+ "Memory with handle %#x not fully sent, can't "
+ "reclaim.\n",
+ handle);
+ ret = ffa_error(FFA_INVALID_PARAMETERS);
+ goto out;
+ }
+
+ if (share_state->retrieved_fragment_count[0] != 0) {
dlog_verbose(
"Tried to reclaim memory handle %#x that has not been "
"relinquished.\n",
@@ -1784,11 +2560,11 @@
goto out;
}
- composite = ffa_memory_region_get_composite(memory_region, 0);
- ret = ffa_retrieve_check_update(to_locked, composite->constituents,
- composite->constituent_count,
- memory_to_attributes,
- FFA_MEM_RECLAIM_32, clear, page_pool);
+ ret = ffa_retrieve_check_update(
+ to_locked, share_state->fragments,
+ share_state->fragment_constituent_counts,
+ share_state->fragment_count, memory_to_attributes,
+ FFA_MEM_RECLAIM_32, flags & FFA_MEM_RECLAIM_CLEAR, page_pool);
if (ret.func == FFA_SUCCESS_32) {
share_state_free(share_states, share_state, page_pool);
@@ -1801,16 +2577,113 @@
}
/**
- * Validates that the reclaim transition is allowed for the given memory region
- * and updates the page table of the reclaiming VM.
+ * Validates that the reclaim transition is allowed for the memory region with
+ * the given handle which was previously shared with the TEE, tells the TEE to
+ * mark it as reclaimed, and updates the page table of the reclaiming VM.
+ *
+ * To do this information about the memory region is first fetched from the TEE.
*/
struct ffa_value ffa_memory_tee_reclaim(struct vm_locked to_locked,
+ struct vm_locked from_locked,
ffa_memory_handle_t handle,
- struct ffa_memory_region *memory_region,
- bool clear, struct mpool *page_pool)
+ ffa_memory_region_flags_t flags,
+ struct mpool *page_pool)
{
- uint32_t memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
+ uint32_t request_length = ffa_memory_lender_retrieve_request_init(
+ from_locked.vm->mailbox.recv, handle, to_locked.vm->id);
+ struct ffa_value tee_ret;
+ uint32_t length;
+ uint32_t fragment_length;
+ uint32_t fragment_offset;
+ struct ffa_memory_region *memory_region;
struct ffa_composite_memory_region *composite;
+ uint32_t memory_to_attributes = MM_MODE_R | MM_MODE_W | MM_MODE_X;
+
+ CHECK(request_length <= HF_MAILBOX_SIZE);
+ CHECK(from_locked.vm->id == HF_TEE_VM_ID);
+
+ /* Retrieve memory region information from the TEE. */
+ tee_ret = arch_tee_call(
+ (struct ffa_value){.func = FFA_MEM_RETRIEVE_REQ_32,
+ .arg1 = request_length,
+ .arg2 = request_length});
+ if (tee_ret.func == FFA_ERROR_32) {
+ dlog_verbose("Got error %d from EL3.\n", tee_ret.arg2);
+ return tee_ret;
+ }
+ if (tee_ret.func != FFA_MEM_RETRIEVE_RESP_32) {
+ dlog_verbose(
+ "Got %#x from EL3, expected FFA_MEM_RETRIEVE_RESP.\n",
+ tee_ret.func);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ length = tee_ret.arg1;
+ fragment_length = tee_ret.arg2;
+
+ if (fragment_length > HF_MAILBOX_SIZE || fragment_length > length ||
+ length > sizeof(tee_retrieve_buffer)) {
+ dlog_verbose("Invalid fragment length %d/%d (max %d/%d).\n",
+ fragment_length, length, HF_MAILBOX_SIZE,
+ sizeof(tee_retrieve_buffer));
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+
+ /*
+ * Copy the first fragment of the memory region descriptor to an
+ * internal buffer.
+ */
+ memcpy_s(tee_retrieve_buffer, sizeof(tee_retrieve_buffer),
+ from_locked.vm->mailbox.send, fragment_length);
+
+ /* Fetch the remaining fragments into the same buffer. */
+ fragment_offset = fragment_length;
+ while (fragment_offset < length) {
+ tee_ret = arch_tee_call(
+ (struct ffa_value){.func = FFA_MEM_FRAG_RX_32,
+ .arg1 = (uint32_t)handle,
+ .arg2 = (uint32_t)(handle >> 32),
+ .arg3 = fragment_offset});
+ if (tee_ret.func != FFA_MEM_FRAG_TX_32) {
+ dlog_verbose(
+ "Got %#x (%d) from TEE in response to "
+ "FFA_MEM_FRAG_RX, expected FFA_MEM_FRAG_TX.\n",
+ tee_ret.func, tee_ret.arg2);
+ return tee_ret;
+ }
+ if (ffa_frag_handle(tee_ret) != handle) {
+ dlog_verbose(
+ "Got FFA_MEM_FRAG_TX for unexpected handle %#x "
+ "in response to FFA_MEM_FRAG_RX for handle "
+ "%#x.\n",
+ ffa_frag_handle(tee_ret), handle);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ if (ffa_frag_sender(tee_ret) != 0) {
+ dlog_verbose(
+ "Got FFA_MEM_FRAG_TX with unexpected sender %d "
+ "(expected 0).\n",
+ ffa_frag_sender(tee_ret));
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ fragment_length = tee_ret.arg3;
+ if (fragment_length > HF_MAILBOX_SIZE ||
+ fragment_offset + fragment_length > length) {
+ dlog_verbose(
+ "Invalid fragment length %d at offset %d (max "
+ "%d).\n",
+ fragment_length, fragment_offset,
+ HF_MAILBOX_SIZE);
+ return ffa_error(FFA_INVALID_PARAMETERS);
+ }
+ memcpy_s(tee_retrieve_buffer + fragment_offset,
+ sizeof(tee_retrieve_buffer) - fragment_offset,
+ from_locked.vm->mailbox.send, fragment_length);
+
+ fragment_offset += fragment_length;
+ }
+
+ memory_region = (struct ffa_memory_region *)tee_retrieve_buffer;
if (memory_region->receiver_count != 1) {
/* Only one receiver supported by Hafnium for now. */
@@ -1818,7 +2691,7 @@
"Multiple recipients not supported (got %d, expected "
"1).\n",
memory_region->receiver_count);
- return ffa_error(FFA_NOT_SUPPORTED);
+ return ffa_error(FFA_INVALID_PARAMETERS);
}
if (memory_region->handle != handle) {
@@ -1841,11 +2714,12 @@
composite = ffa_memory_region_get_composite(memory_region, 0);
/*
- * Forward the request to the TEE and then map the memory back into the
- * caller's stage-2 page table.
+ * Validate that the reclaim transition is allowed for the given memory
+ * region, forward the request to the TEE and then map the memory back
+ * into the caller's stage-2 page table.
*/
return ffa_tee_reclaim_check_update(
to_locked, handle, composite->constituents,
- composite->constituent_count, memory_to_attributes, clear,
- page_pool);
+ composite->constituent_count, memory_to_attributes,
+ flags & FFA_MEM_RECLAIM_CLEAR, page_pool);
}
diff --git a/test/inc/test/vmapi/ffa.h b/test/inc/test/vmapi/ffa.h
index c01008e..8a43349 100644
--- a/test/inc/test/vmapi/ffa.h
+++ b/test/inc/test/vmapi/ffa.h
@@ -40,9 +40,20 @@
enum ffa_data_access retrieve_data_access,
enum ffa_instruction_access send_instruction_access,
enum ffa_instruction_access retrieve_instruction_access);
-ffa_vm_id_t retrieve_memory_from_message(void *recv_buf, void *send_buf,
- struct ffa_value msg_ret,
- ffa_memory_handle_t *handle);
+ffa_memory_handle_t send_memory_and_retrieve_request_force_fragmented(
+ uint32_t share_func, void *tx_buffer, ffa_vm_id_t sender,
+ ffa_vm_id_t recipient,
+ struct ffa_memory_region_constituent constituents[],
+ uint32_t constituent_count, ffa_memory_region_flags_t flags,
+ enum ffa_data_access send_data_access,
+ enum ffa_data_access retrieve_data_access,
+ enum ffa_instruction_access send_instruction_access,
+ enum ffa_instruction_access retrieve_instruction_access);
+ffa_vm_id_t retrieve_memory_from_message(
+ void *recv_buf, void *send_buf, struct ffa_value msg_ret,
+ ffa_memory_handle_t *handle,
+ struct ffa_memory_region *memory_region_ret,
+ size_t memory_region_max_size);
ffa_vm_id_t retrieve_memory_from_message_expect_fail(void *recv_buf,
void *send_buf,
struct ffa_value msg_ret,
diff --git a/test/vmapi/common/ffa.c b/test/vmapi/common/ffa.c
index a313267..b1c9ccb 100644
--- a/test/vmapi/common/ffa.c
+++ b/test/vmapi/common/ffa.c
@@ -56,35 +56,75 @@
enum ffa_instruction_access send_instruction_access,
enum ffa_instruction_access retrieve_instruction_access)
{
+ uint32_t total_length;
+ uint32_t fragment_length;
uint32_t msg_size;
struct ffa_value ret;
+ const ffa_memory_handle_t INVALID_FRAGMENT_HANDLE = 0xffffffffffffffff;
+ ffa_memory_handle_t fragment_handle = INVALID_FRAGMENT_HANDLE;
ffa_memory_handle_t handle;
+ uint32_t remaining_constituent_count;
+ uint32_t sent_length;
- /* Send the memory. */
- msg_size = ffa_memory_region_init(
- tx_buffer, sender, recipient, constituents, constituent_count,
- 0, flags, send_data_access, send_instruction_access,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ /* Send the first fragment of the memory. */
+ remaining_constituent_count = ffa_memory_region_init(
+ tx_buffer, HF_MAILBOX_SIZE, sender, recipient, constituents,
+ constituent_count, 0, flags, send_data_access,
+ send_instruction_access, FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE,
+ &total_length, &fragment_length);
+ if (remaining_constituent_count == 0) {
+ EXPECT_EQ(total_length, fragment_length);
+ }
switch (share_func) {
case FFA_MEM_DONATE_32:
- ret = ffa_mem_donate(msg_size, msg_size);
+ ret = ffa_mem_donate(total_length, fragment_length);
break;
case FFA_MEM_LEND_32:
- ret = ffa_mem_lend(msg_size, msg_size);
+ ret = ffa_mem_lend(total_length, fragment_length);
break;
case FFA_MEM_SHARE_32:
- ret = ffa_mem_share(msg_size, msg_size);
+ ret = ffa_mem_share(total_length, fragment_length);
break;
default:
FAIL("Invalid share_func %#x.\n", share_func);
/* Never reached, but needed to keep clang-analyser happy. */
return 0;
}
+ sent_length = fragment_length;
+
+ /* Send the remaining fragments. */
+ while (remaining_constituent_count != 0) {
+ dlog_verbose("%d constituents left to send.\n",
+ remaining_constituent_count);
+ EXPECT_EQ(ret.func, FFA_MEM_FRAG_RX_32);
+ if (fragment_handle == INVALID_FRAGMENT_HANDLE) {
+ fragment_handle = ffa_frag_handle(ret);
+ } else {
+ EXPECT_EQ(ffa_frag_handle(ret), fragment_handle);
+ }
+ EXPECT_EQ(ret.arg3, sent_length);
+ /* Sender MBZ at virtual instance. */
+ EXPECT_EQ(ffa_frag_sender(ret), 0);
+
+ remaining_constituent_count = ffa_memory_fragment_init(
+ tx_buffer, HF_MAILBOX_SIZE,
+ constituents + constituent_count -
+ remaining_constituent_count,
+ remaining_constituent_count, &fragment_length);
+
+ ret = ffa_mem_frag_tx(fragment_handle, fragment_length);
+ sent_length += fragment_length;
+ }
+
+ EXPECT_EQ(sent_length, total_length);
EXPECT_EQ(ret.func, FFA_SUCCESS_32);
handle = ffa_mem_success_handle(ret);
EXPECT_EQ(handle & FFA_MEMORY_HANDLE_ALLOCATOR_MASK,
FFA_MEMORY_HANDLE_ALLOCATOR_HYPERVISOR);
+ if (fragment_handle != INVALID_FRAGMENT_HANDLE) {
+ EXPECT_EQ(handle, fragment_handle);
+ }
/*
* Send the appropriate retrieve request to the VM so that it can use it
@@ -95,6 +135,87 @@
retrieve_data_access, retrieve_instruction_access,
FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_LE(msg_size, HF_MAILBOX_SIZE);
+ EXPECT_EQ(ffa_msg_send(sender, recipient, msg_size, 0).func,
+ FFA_SUCCESS_32);
+
+ return handle;
+}
+
+/*
+ * Helper function to send memory to a VM then send a message with the retrieve
+ * request it needs to retrieve it, forcing the request to be made in at least
+ * two fragments even if it could fit in one.
+ */
+ffa_memory_handle_t send_memory_and_retrieve_request_force_fragmented(
+ uint32_t share_func, void *tx_buffer, ffa_vm_id_t sender,
+ ffa_vm_id_t recipient,
+ struct ffa_memory_region_constituent constituents[],
+ uint32_t constituent_count, ffa_memory_region_flags_t flags,
+ enum ffa_data_access send_data_access,
+ enum ffa_data_access retrieve_data_access,
+ enum ffa_instruction_access send_instruction_access,
+ enum ffa_instruction_access retrieve_instruction_access)
+{
+ uint32_t total_length;
+ uint32_t fragment_length;
+ uint32_t msg_size;
+ uint32_t remaining_constituent_count;
+ struct ffa_value ret;
+ ffa_memory_handle_t handle;
+
+ /* Send everything except the last constituent in the first fragment. */
+ remaining_constituent_count = ffa_memory_region_init(
+ tx_buffer, HF_MAILBOX_SIZE, sender, recipient, constituents,
+ constituent_count, 0, flags, send_data_access,
+ send_instruction_access, FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE,
+ &total_length, &fragment_length);
+ EXPECT_EQ(remaining_constituent_count, 0);
+ EXPECT_EQ(total_length, fragment_length);
+ /* Don't include the last constituent in the first fragment. */
+ fragment_length -= sizeof(struct ffa_memory_region_constituent);
+ switch (share_func) {
+ case FFA_MEM_DONATE_32:
+ ret = ffa_mem_donate(total_length, fragment_length);
+ break;
+ case FFA_MEM_LEND_32:
+ ret = ffa_mem_lend(total_length, fragment_length);
+ break;
+ case FFA_MEM_SHARE_32:
+ ret = ffa_mem_share(total_length, fragment_length);
+ break;
+ default:
+ FAIL("Invalid share_func %#x.\n", share_func);
+ /* Never reached, but needed to keep clang-analyser happy. */
+ return 0;
+ }
+ EXPECT_EQ(ret.func, FFA_MEM_FRAG_RX_32);
+ EXPECT_EQ(ret.arg3, fragment_length);
+ /* Sender MBZ at virtual instance. */
+ EXPECT_EQ(ffa_frag_sender(ret), 0);
+
+ handle = ffa_frag_handle(ret);
+
+ /* Send the last constituent in a separate fragment. */
+ remaining_constituent_count = ffa_memory_fragment_init(
+ tx_buffer, HF_MAILBOX_SIZE,
+ &constituents[constituent_count - 1], 1, &fragment_length);
+ EXPECT_EQ(remaining_constituent_count, 0);
+ ret = ffa_mem_frag_tx(handle, fragment_length);
+ EXPECT_EQ(ret.func, FFA_SUCCESS_32);
+ EXPECT_EQ(ffa_mem_success_handle(ret), handle);
+
+ /*
+ * Send the appropriate retrieve request to the VM so that it can use it
+ * to retrieve the memory.
+ */
+ msg_size = ffa_memory_retrieve_request_init(
+ tx_buffer, handle, sender, recipient, 0, 0,
+ retrieve_data_access, retrieve_instruction_access,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_LE(msg_size, HF_MAILBOX_SIZE);
EXPECT_EQ(ffa_msg_send(sender, recipient, msg_size, 0).func,
FFA_SUCCESS_32);
@@ -103,36 +224,88 @@
/*
* Use the retrieve request from the receive buffer to retrieve a memory region
- * which has been sent to us. Returns the sender, and the handle via a return
+ * which has been sent to us. Copies all the fragments into the provided buffer
+ * if any, and checks that the total length of all fragments is no more than
+ * `memory_region_max_size`. Returns the sender, and the handle via a return
* parameter.
*/
-ffa_vm_id_t retrieve_memory_from_message(void *recv_buf, void *send_buf,
- struct ffa_value msg_ret,
- ffa_memory_handle_t *handle)
+ffa_vm_id_t retrieve_memory_from_message(
+ void *recv_buf, void *send_buf, struct ffa_value msg_ret,
+ ffa_memory_handle_t *handle,
+ struct ffa_memory_region *memory_region_ret,
+ size_t memory_region_max_size)
{
uint32_t msg_size;
struct ffa_value ret;
struct ffa_memory_region *memory_region;
ffa_vm_id_t sender;
+ struct ffa_memory_region *retrieve_request;
+ ffa_memory_handle_t handle_;
+ uint32_t fragment_length;
+ uint32_t total_length;
+ uint32_t fragment_offset;
EXPECT_EQ(msg_ret.func, FFA_MSG_SEND_32);
msg_size = ffa_msg_send_size(msg_ret);
sender = ffa_msg_send_sender(msg_ret);
+ retrieve_request = (struct ffa_memory_region *)recv_buf;
+ handle_ = retrieve_request->handle;
if (handle != NULL) {
- struct ffa_memory_region *retrieve_request =
- (struct ffa_memory_region *)recv_buf;
- *handle = retrieve_request->handle;
+ *handle = handle_;
}
memcpy_s(send_buf, HF_MAILBOX_SIZE, recv_buf, msg_size);
ffa_rx_release();
ret = ffa_mem_retrieve_req(msg_size, msg_size);
EXPECT_EQ(ret.func, FFA_MEM_RETRIEVE_RESP_32);
+ total_length = ret.arg1;
+ fragment_length = ret.arg2;
+ EXPECT_GE(fragment_length,
+ sizeof(struct ffa_memory_region) +
+ sizeof(struct ffa_memory_access) +
+ sizeof(struct ffa_composite_memory_region));
+ EXPECT_LE(fragment_length, HF_MAILBOX_SIZE);
+ EXPECT_LE(fragment_length, total_length);
memory_region = (struct ffa_memory_region *)recv_buf;
EXPECT_EQ(memory_region->receiver_count, 1);
EXPECT_EQ(memory_region->receivers[0].receiver_permissions.receiver,
hf_vm_get_id());
+ /* Copy into the return buffer. */
+ if (memory_region_ret != NULL) {
+ memcpy_s(memory_region_ret, memory_region_max_size,
+ memory_region, fragment_length);
+ }
+
+ /*
+ * Release the RX buffer now that we have read everything we need from
+ * it.
+ */
+ memory_region = NULL;
+ EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+
+ /* Retrieve the remaining fragments. */
+ fragment_offset = fragment_length;
+ while (fragment_offset < total_length) {
+ ret = ffa_mem_frag_rx(handle_, fragment_offset);
+ EXPECT_EQ(ret.func, FFA_MEM_FRAG_TX_32);
+ EXPECT_EQ(ffa_frag_handle(ret), handle_);
+ /* Sender MBZ at virtual instance. */
+ EXPECT_EQ(ffa_frag_sender(ret), 0);
+ fragment_length = ret.arg3;
+ EXPECT_GT(fragment_length, 0);
+ ASSERT_LE(fragment_offset + fragment_length,
+ memory_region_max_size);
+ if (memory_region_ret != NULL) {
+ memcpy_s((uint8_t *)memory_region_ret + fragment_offset,
+ memory_region_max_size - fragment_offset,
+ recv_buf, fragment_length);
+ }
+ fragment_offset += fragment_length;
+ EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ }
+ EXPECT_EQ(fragment_offset, total_length);
+
return sender;
}
diff --git a/test/vmapi/primary_with_secondaries/memory_sharing.c b/test/vmapi/primary_with_secondaries/memory_sharing.c
index 1b3c1d9..303021c 100644
--- a/test/vmapi/primary_with_secondaries/memory_sharing.c
+++ b/test/vmapi/primary_with_secondaries/memory_sharing.c
@@ -26,7 +26,16 @@
#include "test/vmapi/exception_handler.h"
#include "test/vmapi/ffa.h"
-alignas(PAGE_SIZE) static uint8_t pages[4 * PAGE_SIZE];
+/*
+ * A number of pages that is large enough that it must take two fragments to
+ * share.
+ */
+#define FRAGMENTED_SHARE_PAGE_COUNT \
+ (PAGE_SIZE / sizeof(struct ffa_memory_region_constituent))
+
+alignas(PAGE_SIZE) static uint8_t
+ pages[FRAGMENTED_SHARE_PAGE_COUNT * PAGE_SIZE];
+static uint8_t retrieve_buffer[HF_MAILBOX_SIZE];
/**
* Helper function to test sending memory in the different configurations.
@@ -72,9 +81,11 @@
for (m = 0;
m < ARRAY_SIZE(cacheability);
++m) {
- uint32_t msg_size =
+ uint32_t msg_size;
+ EXPECT_EQ(
ffa_memory_region_init(
mb.send,
+ HF_MAILBOX_SIZE,
HF_PRIMARY_VM_ID,
vms[i],
constituents,
@@ -85,8 +96,10 @@
[k],
FFA_MEMORY_NORMAL_MEM,
cacheability[m],
- shareability
- [l]);
+ shareability[l],
+ NULL,
+ &msg_size),
+ 0);
struct ffa_value ret =
send_function(msg_size,
msg_size);
@@ -101,9 +114,11 @@
}
for (m = 0; m < ARRAY_SIZE(device);
++m) {
- uint32_t msg_size =
+ uint32_t msg_size;
+ EXPECT_EQ(
ffa_memory_region_init(
mb.send,
+ HF_MAILBOX_SIZE,
HF_PRIMARY_VM_ID,
vms[i],
constituents,
@@ -114,8 +129,10 @@
[k],
FFA_MEMORY_DEVICE_MEM,
device[m],
- shareability
- [l]);
+ shareability[l],
+ NULL,
+ &msg_size),
+ 0);
struct ffa_value ret =
send_function(msg_size,
msg_size);
@@ -180,12 +197,15 @@
if (vms[i] == avoid_vm) {
continue;
}
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, vms[i], constituents,
- constituent_count, 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ vms[i], constituents, constituent_count, 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
ret = ffa_mem_donate(msg_size, msg_size);
EXPECT_EQ(ret.func, FFA_ERROR_32);
EXPECT_TRUE(ret.arg2 == FFA_DENIED ||
@@ -363,6 +383,98 @@
}
/**
+ * Check that memory can be lent and retrieved with multiple fragments.
+ */
+TEST(memory_sharing, lend_fragmented_relinquish)
+{
+ struct ffa_value run_res;
+ struct mailbox_buffers mb = set_up_mailbox();
+ uint8_t *ptr = pages;
+ uint32_t i;
+ ffa_memory_handle_t handle;
+ struct ffa_memory_region_constituent
+ constituents[FRAGMENTED_SHARE_PAGE_COUNT];
+
+ SERVICE_SELECT(SERVICE_VM1, "ffa_memory_lend_relinquish", mb.send);
+
+ /* Initialise the memory before giving it. */
+ memset_s(ptr, sizeof(pages), 'b',
+ PAGE_SIZE * FRAGMENTED_SHARE_PAGE_COUNT);
+
+ for (i = 0; i < ARRAY_SIZE(constituents); ++i) {
+ constituents[i].address = (uint64_t)pages + i * PAGE_SIZE;
+ constituents[i].page_count = 1;
+ constituents[i].reserved = 0;
+ }
+
+ handle = send_memory_and_retrieve_request(
+ FFA_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, FFA_DATA_ACCESS_RW,
+ FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_X);
+
+ run_res = ffa_run(SERVICE_VM1, 0);
+
+ /* Let the memory be returned. */
+ EXPECT_EQ(run_res.func, FFA_MSG_SEND_32);
+ EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ EXPECT_EQ(ffa_mem_reclaim(handle, 0).func, FFA_SUCCESS_32);
+
+ /* Ensure that the secondary VM accessed the region. */
+ for (int i = 0; i < PAGE_SIZE * FRAGMENTED_SHARE_PAGE_COUNT; ++i) {
+ ASSERT_EQ(ptr[i], 'c');
+ }
+
+ run_res = ffa_run(SERVICE_VM1, 0);
+ EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
+ 1);
+}
+
+/**
+ * Check that memory can be lent with multiple fragments even though it could
+ * fit in one.
+ */
+TEST(memory_sharing, lend_force_fragmented_relinquish)
+{
+ struct ffa_value run_res;
+ struct mailbox_buffers mb = set_up_mailbox();
+ uint8_t *ptr = pages;
+ ffa_memory_handle_t handle;
+
+ SERVICE_SELECT(SERVICE_VM1, "ffa_memory_lend_relinquish", mb.send);
+
+ /* Initialise the memory before giving it. */
+ memset_s(ptr, sizeof(pages), 'b', PAGE_SIZE);
+
+ struct ffa_memory_region_constituent constituents[] = {
+ {.address = (uint64_t)pages, .page_count = 1},
+ {.address = (uint64_t)pages + PAGE_SIZE, .page_count = 2},
+ };
+
+ handle = send_memory_and_retrieve_request_force_fragmented(
+ FFA_MEM_LEND_32, mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, FFA_DATA_ACCESS_RW,
+ FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_X);
+
+ run_res = ffa_run(SERVICE_VM1, 0);
+
+ /* Let the memory be returned. */
+ EXPECT_EQ(run_res.func, FFA_MSG_SEND_32);
+ EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ EXPECT_EQ(ffa_mem_reclaim(handle, 0).func, FFA_SUCCESS_32);
+
+ /* Ensure that the secondary VM accessed the region. */
+ for (int i = 0; i < PAGE_SIZE; ++i) {
+ ASSERT_EQ(ptr[i], 'c');
+ }
+
+ run_res = ffa_run(SERVICE_VM1, 0);
+ EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
+ 1);
+}
+
+/**
* Check that memory that is donated can't be relinquished.
*/
TEST(memory_sharing, donate_relinquish)
@@ -419,13 +531,13 @@
/* Let the memory be returned, and retrieve it. */
run_res = ffa_run(SERVICE_VM1, 0);
- EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL,
+ NULL, HF_MAILBOX_SIZE),
SERVICE_VM1);
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 'c');
}
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
run_res = ffa_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -566,11 +678,12 @@
/* Have the memory be given. */
run_res = ffa_run(SERVICE_VM1, 0);
- EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ memory_region = (struct ffa_memory_region *)retrieve_buffer;
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL,
+ memory_region, HF_MAILBOX_SIZE),
SERVICE_VM1);
/* Check the memory was cleared. */
- memory_region = (struct ffa_memory_region *)mb.recv;
ASSERT_EQ(memory_region->receiver_count, 1);
ASSERT_NE(memory_region->receivers[0].composite_memory_region_offset,
0);
@@ -579,7 +692,6 @@
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 0);
}
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
run_res = ffa_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -601,11 +713,12 @@
/* Have the memory be lent. */
run_res = ffa_run(SERVICE_VM1, 0);
- EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ memory_region = (struct ffa_memory_region *)retrieve_buffer;
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL,
+ memory_region, HF_MAILBOX_SIZE),
SERVICE_VM1);
/* Check the memory was cleared. */
- memory_region = (struct ffa_memory_region *)mb.recv;
ASSERT_EQ(memory_region->receiver_count, 1);
ASSERT_NE(memory_region->receivers[0].composite_memory_region_offset,
0);
@@ -614,7 +727,6 @@
for (int i = 0; i < PAGE_SIZE; ++i) {
ASSERT_EQ(ptr[i], 0);
}
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
run_res = ffa_run(SERVICE_VM1, 0);
EXPECT_EQ(exception_handler_receive_exception_count(&run_res, mb.recv),
@@ -774,9 +886,9 @@
run_res = ffa_run(SERVICE_VM1, 0);
/* Let the memory be returned. */
- EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL,
+ NULL, HF_MAILBOX_SIZE),
SERVICE_VM1);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/* Share the memory with another VM. */
send_memory_and_retrieve_request(
@@ -883,9 +995,9 @@
/* Let the memory be sent from VM1 to PRIMARY (returned). */
run_res = ffa_run(SERVICE_VM1, 0);
- EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL,
+ NULL, HF_MAILBOX_SIZE),
SERVICE_VM1);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/* Check we have access again. */
ptr[0] = 'f';
@@ -910,11 +1022,15 @@
{.address = (uint64_t)pages, .page_count = 1},
};
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ HF_PRIMARY_VM_ID, constituents,
+ ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
@@ -935,11 +1051,14 @@
{.address = (uint64_t)pages, .page_count = 1},
};
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RW,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ HF_PRIMARY_VM_ID, constituents,
+ ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RW,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_lend(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
}
@@ -959,11 +1078,14 @@
{.address = (uint64_t)pages, .page_count = 1},
};
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RW,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ HF_PRIMARY_VM_ID, constituents,
+ ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RW,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_share(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
}
@@ -988,27 +1110,37 @@
};
/* Try invalid configurations. */
- msg_size = ffa_memory_region_init(
- mb.send, SERVICE_VM1, HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(
+ ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, SERVICE_VM1, HF_PRIMARY_VM_ID,
+ constituents, ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
- msg_size = ffa_memory_region_init(
- mb.send, SERVICE_VM1, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, SERVICE_VM1, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
- msg_size = ffa_memory_region_init(
- mb.send, SERVICE_VM2, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, SERVICE_VM2, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
@@ -1021,9 +1153,9 @@
/* Receive and return memory from VM1. */
run_res = ffa_run(SERVICE_VM1, 0);
- EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL),
+ EXPECT_EQ(retrieve_memory_from_message(mb.recv, mb.send, run_res, NULL,
+ NULL, HF_MAILBOX_SIZE),
SERVICE_VM1);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/* Use VM1 to fail to donate memory from the primary to VM2. */
run_res = ffa_run(SERVICE_VM1, 0);
@@ -1052,24 +1184,33 @@
{.address = (uint64_t)pages + PAGE_SIZE + j,
.page_count = 1},
};
- uint32_t msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
- constituents, ARRAY_SIZE(constituents), 0, 0,
- FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ uint32_t msg_size;
+ EXPECT_EQ(
+ ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE,
+ HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents),
+ 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL,
+ &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1,
- constituents, ARRAY_SIZE(constituents), 0, 0,
- FFA_DATA_ACCESS_RW,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(
+ ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE,
+ HF_PRIMARY_VM_ID, SERVICE_VM1,
+ constituents, ARRAY_SIZE(constituents),
+ 0, 0, FFA_DATA_ACCESS_RW,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL,
+ &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_lend(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
}
@@ -1096,11 +1237,14 @@
};
/* Check cannot swap VM IDs. */
- msg_size = ffa_memory_region_init(
- mb.send, SERVICE_VM1, HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RW,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, SERVICE_VM1,
+ HF_PRIMARY_VM_ID, constituents,
+ ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RW,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_lend(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
@@ -1471,23 +1615,29 @@
constituents[0].page_count = 1;
for (int i = 1; i < PAGE_SIZE * 2; i++) {
constituents[0].address = (uint64_t)pages + PAGE_SIZE;
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0,
- FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, constituents,
+ ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_DENIED);
}
/* Ensure we can't donate to the only borrower. */
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM1, constituents, ARRAY_SIZE(constituents),
+ 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size), FFA_DENIED);
}
@@ -1530,23 +1680,29 @@
constituents[0].page_count = 1;
for (int i = 1; i < PAGE_SIZE * 2; i++) {
constituents[0].address = (uint64_t)pages + PAGE_SIZE;
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0,
- FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, constituents,
+ ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_DENIED);
}
/* Ensure we can't donate to the only borrower. */
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM1, constituents, ARRAY_SIZE(constituents),
+ 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size), FFA_DENIED);
}
@@ -1609,12 +1765,16 @@
constituents[0].page_count = 1;
for (int i = 0; i < 2; i++) {
constituents[0].address = (uint64_t)pages + i * PAGE_SIZE;
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RO,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, constituents,
+ ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_RO,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_lend(msg_size, msg_size), FFA_DENIED);
}
}
@@ -1668,12 +1828,16 @@
constituents[0].page_count = 1;
for (int i = 0; i < 2; i++) {
constituents[0].address = (uint64_t)pages + i * PAGE_SIZE;
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM2, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_RO,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, constituents,
+ ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_RO,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_share(msg_size, msg_size), FFA_DENIED);
}
}
@@ -1732,12 +1896,14 @@
{.address = (uint64_t)pages, .page_count = 2},
};
- msg_size = ffa_memory_region_init(
- mb.send, HF_PRIMARY_VM_ID, SERVICE_VM1, constituents,
- ARRAY_SIZE(constituents), 0, FFA_MEMORY_REGION_FLAG_CLEAR,
- FFA_DATA_ACCESS_RO, FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ mb.send, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM1, constituents, ARRAY_SIZE(constituents),
+ 0, FFA_MEMORY_REGION_FLAG_CLEAR, FFA_DATA_ACCESS_RO,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_share(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
diff --git a/test/vmapi/primary_with_secondaries/services/memory.c b/test/vmapi/primary_with_secondaries/services/memory.c
index 2c598d0..02c686c 100644
--- a/test/vmapi/primary_with_secondaries/services/memory.c
+++ b/test/vmapi/primary_with_secondaries/services/memory.c
@@ -28,6 +28,7 @@
#include "test/vmapi/ffa.h"
alignas(PAGE_SIZE) static uint8_t page[PAGE_SIZE];
+static uint8_t retrieve_buffer[PAGE_SIZE * 2];
TEST_SERVICE(memory_increment)
{
@@ -38,10 +39,11 @@
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender = retrieve_memory_from_message(
- recv_buf, send_buf, ret, NULL);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, NULL, memory_region,
+ HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
uint8_t *ptr = (uint8_t *)composite->constituents[0].address;
@@ -60,7 +62,6 @@
}
/* Signal completion and reset. */
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
ffa_msg_send(hf_vm_get_id(), sender, sizeof(ptr), 0);
}
}
@@ -121,10 +122,10 @@
exception_setup(NULL, exception_handler_yield_data_abort);
- ffa_vm_id_t sender =
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, NULL, memory_region, HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
@@ -141,7 +142,6 @@
composite->constituents, composite->constituent_count, 0,
FFA_DATA_ACCESS_NOT_SPECIFIED, FFA_DATA_ACCESS_RW,
FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_INSTRUCTION_ACCESS_X);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/*
* Try and access the memory which will cause a fault unless the memory
@@ -168,14 +168,14 @@
exception_setup(NULL, exception_handler_yield_data_abort);
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
- memory_region = (struct ffa_memory_region *)recv_buf;
+ memory_region = (struct ffa_memory_region *)retrieve_buffer;
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL,
+ memory_region, HF_MAILBOX_SIZE);
composite = ffa_memory_region_get_composite(memory_region, 0);
/* Choose which constituent we want to test. */
index = *(uint8_t *)composite->constituents[0].address;
ptr = (uint8_t *)composite->constituents[index].address;
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/*
* Check that we can't access out of bounds after the region sent to us.
@@ -202,14 +202,14 @@
exception_setup(NULL, exception_handler_yield_data_abort);
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
- memory_region = (struct ffa_memory_region *)recv_buf;
+ memory_region = (struct ffa_memory_region *)retrieve_buffer;
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL,
+ memory_region, HF_MAILBOX_SIZE);
composite = ffa_memory_region_get_composite(memory_region, 0);
/* Choose which constituent we want to test. */
index = *(uint8_t *)composite->constituents[0].address;
ptr = (uint8_t *)composite->constituents[index].address;
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/*
* Check that we can't access out of bounds before the region sent to
@@ -230,10 +230,10 @@
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender =
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, NULL, memory_region, HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
@@ -248,7 +248,6 @@
composite->constituents, composite->constituent_count, 0,
FFA_DATA_ACCESS_NOT_SPECIFIED, FFA_DATA_ACCESS_RW,
FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_INSTRUCTION_ACCESS_X);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
/* Ensure that we are unable to modify memory any more. */
ptr[0] = 'c';
@@ -266,17 +265,15 @@
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender =
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, NULL, memory_region, HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
struct ffa_memory_region_constituent constituent =
composite->constituents[0];
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
-
/* Yield to allow attempt to re donate from primary. */
ffa_yield();
@@ -288,11 +285,14 @@
FFA_INSTRUCTION_ACCESS_X);
/* Attempt to donate the memory to another VM. */
- msg_size = ffa_memory_region_init(
- send_buf, hf_vm_get_id(), SERVICE_VM2, &constituent, 1, 0, 0,
- FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(
+ ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, hf_vm_get_id(), SERVICE_VM2,
+ &constituent, 1, 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size), FFA_DENIED);
ffa_yield();
@@ -309,16 +309,16 @@
for (;;) {
struct ffa_value ret = ffa_msg_wait();
- struct ffa_memory_region *memory_region;
+ struct ffa_memory_region *memory_region =
+ (struct ffa_memory_region *)retrieve_buffer;
struct ffa_composite_memory_region *composite;
uint8_t *ptr;
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
- memory_region = (struct ffa_memory_region *)recv_buf;
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL,
+ memory_region, HF_MAILBOX_SIZE);
composite = ffa_memory_region_get_composite(memory_region, 0);
ptr = (uint8_t *)composite->constituents[0].address;
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
ptr[0] = 'd';
ffa_yield();
@@ -338,10 +338,10 @@
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender =
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, NULL, memory_region, HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
@@ -353,13 +353,15 @@
FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_INSTRUCTION_ACCESS_X);
/* Fail to donate the memory from the primary to VM2. */
- msg_size = ffa_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2,
- composite->constituents, composite->constituent_count, 0, 0,
- FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ EXPECT_EQ(ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, composite->constituents,
+ composite->constituent_count, 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_donate(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
ffa_yield();
@@ -371,10 +373,6 @@
/* Loop, giving memory back to the sender. */
for (;;) {
- uint8_t *ptr;
- uint8_t *ptr2;
- uint32_t count;
- uint32_t count2;
size_t i;
ffa_memory_handle_t handle;
@@ -382,31 +380,32 @@
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender = retrieve_memory_from_message(
- recv_buf, send_buf, ret, &handle);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle, memory_region,
+ sizeof(retrieve_buffer));
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
- struct ffa_memory_region_constituent *constituents =
- composite->constituents;
+ struct ffa_memory_region_constituent *constituents;
+ uint8_t *first_ptr;
/* ASSERT_TRUE isn't enough for clang-analyze. */
CHECK(composite != NULL);
+ constituents = composite->constituents;
+ first_ptr = (uint8_t *)constituents[0].address;
- ptr = (uint8_t *)constituents[0].address;
- count = constituents[0].page_count;
- ptr2 = (uint8_t *)constituents[1].address;
- count2 = constituents[1].page_count;
- /* Relevant information read, mailbox can be cleared. */
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ /*
+ * Check that we can read and write every page that was shared.
+ */
+ for (i = 0; i < composite->constituent_count; ++i) {
+ uint8_t *ptr = (uint8_t *)constituents[i].address;
+ uint32_t count = constituents[i].page_count;
+ size_t j;
- /* Check that one has access to the shared region. */
- for (i = 0; i < PAGE_SIZE * count; ++i) {
- ptr[i]++;
- }
- for (i = 0; i < PAGE_SIZE * count2; ++i) {
- ptr2[i]++;
+ for (j = 0; j < PAGE_SIZE * count; ++j) {
+ ptr[j]++;
+ }
}
/* Give the memory back and notify the sender. */
@@ -416,10 +415,10 @@
FFA_SUCCESS_32);
/*
- * Try and access the memory which will cause a fault unless the
+ * Try to access the memory, which will cause a fault unless the
* memory has been shared back again.
*/
- ptr[0] = 123;
+ first_ptr[0] = 123;
}
}
@@ -439,8 +438,9 @@
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- retrieve_memory_from_message(recv_buf, send_buf, ret, &handle);
- memory_region = (struct ffa_memory_region *)recv_buf;
+ memory_region = (struct ffa_memory_region *)retrieve_buffer;
+ retrieve_memory_from_message(recv_buf, send_buf, ret, &handle,
+ memory_region, HF_MAILBOX_SIZE);
composite = ffa_memory_region_get_composite(memory_region, 0);
ptr = (uint8_t *)composite->constituents[0].address;
@@ -455,7 +455,6 @@
* it was donated not lent.
*/
ffa_mem_relinquish_init(send_buf, handle, 0, hf_vm_get_id());
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
EXPECT_FFA_ERROR(ffa_mem_relinquish(), FFA_INVALID_PARAMETERS);
/* Ensure we still have access to the memory. */
@@ -482,13 +481,8 @@
struct ffa_value ret = ffa_msg_wait();
ffa_vm_id_t sender = retrieve_memory_from_message(
- recv_buf, send_buf, ret, &handle);
-
- /*
- * Mailbox can be cleared, we don't actually care what the
- * memory region is.
- */
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ recv_buf, send_buf, ret, &handle, NULL,
+ HF_MAILBOX_SIZE);
/* Trying to relinquish the memory and clear it should fail. */
ffa_mem_relinquish_init(send_buf, handle,
@@ -515,10 +509,11 @@
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender =
- retrieve_memory_from_message(recv_buf, send_buf, ret, &handle);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender =
+ retrieve_memory_from_message(recv_buf, send_buf, ret, &handle,
+ memory_region, HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
@@ -529,23 +524,26 @@
FFA_SUCCESS_32);
/* Ensure we cannot lend from the primary to another secondary. */
- msg_size = ffa_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2,
- composite->constituents, composite->constituent_count, 0, 0,
- FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_X,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, composite->constituents,
+ composite->constituent_count, 0, 0,
+ FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_X,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_lend(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
/* Ensure we cannot share from the primary to another secondary. */
- msg_size = ffa_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2,
- composite->constituents, composite->constituent_count, 0, 0,
- FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_X,
- FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
+ EXPECT_EQ(ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, composite->constituents,
+ composite->constituent_count, 0, 0,
+ FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_X,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_share(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
@@ -564,10 +562,11 @@
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender = retrieve_memory_from_message(
- recv_buf, send_buf, ret, &handle);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle, memory_region,
+ HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
struct ffa_memory_region_constituent *constituents;
@@ -579,8 +578,6 @@
constituents = composite->constituents;
ptr = (uint64_t *)constituents[0].address;
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
-
/*
* Verify that the instruction in memory is the encoded RET
* instruction.
@@ -630,17 +627,16 @@
void *recv_buf = SERVICE_RECV_BUFFER();
void *send_buf = SERVICE_SEND_BUFFER();
struct ffa_value ret = ffa_msg_wait();
- ffa_vm_id_t sender = retrieve_memory_from_message(
- recv_buf, send_buf, ret, &handle);
struct ffa_memory_region *memory_region =
- (struct ffa_memory_region *)recv_buf;
+ (struct ffa_memory_region *)retrieve_buffer;
+ ffa_vm_id_t sender = retrieve_memory_from_message(
+ recv_buf, send_buf, ret, &handle, memory_region,
+ HF_MAILBOX_SIZE);
struct ffa_composite_memory_region *composite =
ffa_memory_region_get_composite(memory_region, 0);
struct ffa_memory_region_constituent constituent_copy =
composite->constituents[0];
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
-
ptr = (uint8_t *)constituent_copy.address;
/* Check that we have read access. */
@@ -677,13 +673,12 @@
struct ffa_composite_memory_region *composite;
struct ffa_memory_region_constituent constituent_copy;
- retrieve_memory_from_message(recv_buf, send_buf, ret, NULL);
- memory_region = (struct ffa_memory_region *)recv_buf;
+ memory_region = (struct ffa_memory_region *)retrieve_buffer;
+ retrieve_memory_from_message(recv_buf, send_buf, ret, NULL,
+ memory_region, HF_MAILBOX_SIZE);
composite = ffa_memory_region_get_composite(memory_region, 0);
constituent_copy = composite->constituents[0];
- EXPECT_EQ(ffa_rx_release().func, FFA_SUCCESS_32);
-
ptr = (uint8_t *)constituent_copy.address;
/* Check that we have read access. */
@@ -700,20 +695,24 @@
constituent_copy.address = (uint64_t)ptr + i;
/* Fail to lend or share the memory from the primary. */
- msg_size = ffa_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2,
- &constituent_copy, 1, 0, 0, FFA_DATA_ACCESS_RW,
- FFA_INSTRUCTION_ACCESS_X, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, &constituent_copy, 1, 0, 0,
+ FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_X,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_lend(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
- msg_size = ffa_memory_region_init(
- send_buf, HF_PRIMARY_VM_ID, SERVICE_VM2,
- &constituent_copy, 1, 0, 0, FFA_DATA_ACCESS_RW,
- FFA_INSTRUCTION_ACCESS_X, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK,
- FFA_MEMORY_OUTER_SHAREABLE);
+ EXPECT_EQ(ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, HF_PRIMARY_VM_ID,
+ SERVICE_VM2, &constituent_copy, 1, 0, 0,
+ FFA_DATA_ACCESS_RW, FFA_INSTRUCTION_ACCESS_X,
+ FFA_MEMORY_NORMAL_MEM,
+ FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
EXPECT_FFA_ERROR(ffa_mem_share(msg_size, msg_size),
FFA_INVALID_PARAMETERS);
}
diff --git a/test/vmapi/primary_with_secondaries/services/unmapped.c b/test/vmapi/primary_with_secondaries/services/unmapped.c
index ec85310..35a2444 100644
--- a/test/vmapi/primary_with_secondaries/services/unmapped.c
+++ b/test/vmapi/primary_with_secondaries/services/unmapped.c
@@ -43,11 +43,16 @@
struct ffa_memory_region_constituent constituents[] = {
{.address = (uint64_t)(&pages[PAGE_SIZE]), .page_count = 1},
};
- uint32_t msg_size = ffa_memory_region_init(
- send_buf, hf_vm_get_id(), HF_PRIMARY_VM_ID, constituents,
- ARRAY_SIZE(constituents), 0, 0, FFA_DATA_ACCESS_NOT_SPECIFIED,
- FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED, FFA_MEMORY_NORMAL_MEM,
- FFA_MEMORY_CACHE_WRITE_BACK, FFA_MEMORY_OUTER_SHAREABLE);
+ uint32_t msg_size;
+ EXPECT_EQ(ffa_memory_region_init(
+ send_buf, HF_MAILBOX_SIZE, hf_vm_get_id(),
+ HF_PRIMARY_VM_ID, constituents,
+ ARRAY_SIZE(constituents), 0, 0,
+ FFA_DATA_ACCESS_NOT_SPECIFIED,
+ FFA_INSTRUCTION_ACCESS_NOT_SPECIFIED,
+ FFA_MEMORY_NORMAL_MEM, FFA_MEMORY_CACHE_WRITE_BACK,
+ FFA_MEMORY_OUTER_SHAREABLE, NULL, &msg_size),
+ 0);
exception_setup(NULL, exception_handler_yield_data_abort);
EXPECT_EQ(ffa_mem_donate(msg_size, msg_size).func, FFA_SUCCESS_32);
diff --git a/vmlib/ffa.c b/vmlib/ffa.c
index c32b2b6..2040171 100644
--- a/vmlib/ffa.c
+++ b/vmlib/ffa.c
@@ -29,24 +29,15 @@
#endif
/**
- * Initialises the given `ffa_memory_region` and copies the constituent
- * information to it. Returns the length in bytes occupied by the data copied to
- * `memory_region` (attributes, constituents and memory region header size).
+ * Initialises the header of the given `ffa_memory_region`, not including the
+ * composite memory region offset.
*/
-static uint32_t ffa_memory_region_init_internal(
+static void ffa_memory_region_init_header(
struct ffa_memory_region *memory_region, ffa_vm_id_t sender,
ffa_memory_attributes_t attributes, ffa_memory_region_flags_t flags,
ffa_memory_handle_t handle, uint32_t tag, ffa_vm_id_t receiver,
- ffa_memory_access_permissions_t permissions,
- const struct ffa_memory_region_constituent constituents[],
- uint32_t constituent_count)
+ ffa_memory_access_permissions_t permissions)
{
- struct ffa_composite_memory_region *composite_memory_region;
- uint32_t index;
- uint32_t constituents_length =
- constituent_count *
- sizeof(struct ffa_memory_region_constituent);
-
memory_region->sender = sender;
memory_region->attributes = attributes;
memory_region->reserved_0 = 0;
@@ -59,6 +50,48 @@
memory_region->receivers[0].receiver_permissions.permissions =
permissions;
memory_region->receivers[0].receiver_permissions.flags = 0;
+ memory_region->receivers[0].reserved_0 = 0;
+}
+
+/**
+ * Initialises the given `ffa_memory_region` and copies as many as possible of
+ * the given constituents to it.
+ *
+ * Returns the number of constituents remaining which wouldn't fit, and (via
+ * return parameters) the size in bytes of the first fragment of data copied to
+ * `memory_region` (attributes, constituents and memory region header size), and
+ * the total size of the memory sharing message including all constituents.
+ */
+uint32_t ffa_memory_region_init(
+ struct ffa_memory_region *memory_region, size_t memory_region_max_size,
+ ffa_vm_id_t sender, ffa_vm_id_t receiver,
+ const struct ffa_memory_region_constituent constituents[],
+ uint32_t constituent_count, uint32_t tag,
+ ffa_memory_region_flags_t flags, enum ffa_data_access data_access,
+ enum ffa_instruction_access instruction_access,
+ enum ffa_memory_type type, enum ffa_memory_cacheability cacheability,
+ enum ffa_memory_shareability shareability, uint32_t *total_length,
+ uint32_t *fragment_length)
+{
+ ffa_memory_access_permissions_t permissions = 0;
+ ffa_memory_attributes_t attributes = 0;
+ struct ffa_composite_memory_region *composite_memory_region;
+ uint32_t fragment_max_constituents;
+ uint32_t count_to_copy;
+ uint32_t i;
+ uint32_t constituents_offset;
+
+ /* Set memory region's permissions. */
+ ffa_set_data_access_attr(&permissions, data_access);
+ ffa_set_instruction_access_attr(&permissions, instruction_access);
+
+ /* Set memory region's page attributes. */
+ ffa_set_memory_type_attr(&attributes, type);
+ ffa_set_memory_cacheability_attr(&attributes, cacheability);
+ ffa_set_memory_shareability_attr(&attributes, shareability);
+
+ ffa_memory_region_init_header(memory_region, sender, attributes, flags,
+ 0, tag, receiver, permissions);
/*
* Note that `sizeof(struct_ffa_memory_region)` and `sizeof(struct
* ffa_memory_access)` must both be multiples of 16 (as verified by the
@@ -70,63 +103,56 @@
sizeof(struct ffa_memory_region) +
memory_region->receiver_count *
sizeof(struct ffa_memory_access);
- memory_region->receivers[0].reserved_0 = 0;
composite_memory_region =
ffa_memory_region_get_composite(memory_region, 0);
-
composite_memory_region->page_count = 0;
composite_memory_region->constituent_count = constituent_count;
composite_memory_region->reserved_0 = 0;
- for (index = 0; index < constituent_count; index++) {
- composite_memory_region->constituents[index] =
- constituents[index];
- composite_memory_region->page_count +=
- constituents[index].page_count;
+ constituents_offset =
+ memory_region->receivers[0].composite_memory_region_offset +
+ sizeof(struct ffa_composite_memory_region);
+ fragment_max_constituents =
+ (memory_region_max_size - constituents_offset) /
+ sizeof(struct ffa_memory_region_constituent);
+
+ count_to_copy = constituent_count;
+ if (count_to_copy > fragment_max_constituents) {
+ count_to_copy = fragment_max_constituents;
}
- /*
- * TODO: Add assert ensuring that the specified message
- * length is not greater than FFA_MSG_PAYLOAD_MAX.
- */
+ for (i = 0; i < constituent_count; ++i) {
+ if (i < count_to_copy) {
+ composite_memory_region->constituents[i] =
+ constituents[i];
+ }
+ composite_memory_region->page_count +=
+ constituents[i].page_count;
+ }
- return memory_region->receivers[0].composite_memory_region_offset +
- sizeof(struct ffa_composite_memory_region) + constituents_length;
+ if (total_length != NULL) {
+ *total_length =
+ constituents_offset +
+ composite_memory_region->constituent_count *
+ sizeof(struct ffa_memory_region_constituent);
+ }
+ if (fragment_length != NULL) {
+ *fragment_length =
+ constituents_offset +
+ count_to_copy *
+ sizeof(struct ffa_memory_region_constituent);
+ }
+
+ return composite_memory_region->constituent_count - count_to_copy;
}
/**
- * Initialises the given `ffa_memory_region` and copies the constituent
- * information to it. Returns the length in bytes occupied by the data copied to
- * `memory_region` (attributes, constituents and memory region header size).
+ * Initialises the given `ffa_memory_region` to be used for an
+ * `FFA_MEM_RETRIEVE_REQ` by the receiver of a memory transaction.
+ *
+ * Returns the size of the message written.
*/
-uint32_t ffa_memory_region_init(
- struct ffa_memory_region *memory_region, ffa_vm_id_t sender,
- ffa_vm_id_t receiver,
- const struct ffa_memory_region_constituent constituents[],
- uint32_t constituent_count, uint32_t tag,
- ffa_memory_region_flags_t flags, enum ffa_data_access data_access,
- enum ffa_instruction_access instruction_access,
- enum ffa_memory_type type, enum ffa_memory_cacheability cacheability,
- enum ffa_memory_shareability shareability)
-{
- ffa_memory_access_permissions_t permissions = 0;
- ffa_memory_attributes_t attributes = 0;
-
- /* Set memory region's permissions. */
- ffa_set_data_access_attr(&permissions, data_access);
- ffa_set_instruction_access_attr(&permissions, instruction_access);
-
- /* Set memory region's page attributes. */
- ffa_set_memory_type_attr(&attributes, type);
- ffa_set_memory_cacheability_attr(&attributes, cacheability);
- ffa_set_memory_shareability_attr(&attributes, shareability);
-
- return ffa_memory_region_init_internal(
- memory_region, sender, attributes, flags, 0, tag, receiver,
- permissions, constituents, constituent_count);
-}
-
uint32_t ffa_memory_retrieve_request_init(
struct ffa_memory_region *memory_region, ffa_memory_handle_t handle,
ffa_vm_id_t sender, ffa_vm_id_t receiver, uint32_t tag,
@@ -147,18 +173,8 @@
ffa_set_memory_cacheability_attr(&attributes, cacheability);
ffa_set_memory_shareability_attr(&attributes, shareability);
- memory_region->sender = sender;
- memory_region->attributes = attributes;
- memory_region->reserved_0 = 0;
- memory_region->flags = flags;
- memory_region->reserved_1 = 0;
- memory_region->handle = handle;
- memory_region->tag = tag;
- memory_region->receiver_count = 1;
- memory_region->receivers[0].receiver_permissions.receiver = receiver;
- memory_region->receivers[0].receiver_permissions.permissions =
- permissions;
- memory_region->receivers[0].receiver_permissions.flags = 0;
+ ffa_memory_region_init_header(memory_region, sender, attributes, flags,
+ handle, tag, receiver, permissions);
/*
* Offset 0 in this case means that the hypervisor should allocate the
* address ranges. This is the only configuration supported by Hafnium,
@@ -171,6 +187,12 @@
memory_region->receiver_count * sizeof(struct ffa_memory_access);
}
+/**
+ * Initialises the given `ffa_memory_region` to be used for an
+ * `FFA_MEM_RETRIEVE_REQ` from the hypervisor to the TEE.
+ *
+ * Returns the size of the message written.
+ */
uint32_t ffa_memory_lender_retrieve_request_init(
struct ffa_memory_region *memory_region, ffa_memory_handle_t handle,
ffa_vm_id_t sender)
@@ -187,16 +209,100 @@
return sizeof(struct ffa_memory_region);
}
-uint32_t ffa_retrieved_memory_region_init(
+/**
+ * Initialises the given `ffa_memory_region` to be used for an
+ * `FFA_MEM_RETRIEVE_RESP`, including the given constituents for the first
+ * fragment.
+ *
+ * Returns true on success, or false if the given constituents won't all fit in
+ * the first fragment.
+ */
+bool ffa_retrieved_memory_region_init(
struct ffa_memory_region *response, size_t response_max_size,
ffa_vm_id_t sender, ffa_memory_attributes_t attributes,
ffa_memory_region_flags_t flags, ffa_memory_handle_t handle,
ffa_vm_id_t receiver, ffa_memory_access_permissions_t permissions,
+ uint32_t page_count, uint32_t total_constituent_count,
const struct ffa_memory_region_constituent constituents[],
- uint32_t constituent_count)
+ uint32_t fragment_constituent_count, uint32_t *total_length,
+ uint32_t *fragment_length)
{
- /* TODO: Check against response_max_size first. */
- return ffa_memory_region_init_internal(
- response, sender, attributes, flags, handle, 0, receiver,
- permissions, constituents, constituent_count);
+ struct ffa_composite_memory_region *composite_memory_region;
+ uint32_t i;
+ uint32_t constituents_offset;
+
+ ffa_memory_region_init_header(response, sender, attributes, flags,
+ handle, 0, receiver, permissions);
+ /*
+ * Note that `sizeof(struct_ffa_memory_region)` and `sizeof(struct
+ * ffa_memory_access)` must both be multiples of 16 (as verified by the
+ * asserts in `ffa_memory.c`, so it is guaranteed that the offset we
+ * calculate here is aligned to a 64-bit boundary and so 64-bit values
+ * can be copied without alignment faults.
+ */
+ response->receivers[0].composite_memory_region_offset =
+ sizeof(struct ffa_memory_region) +
+ response->receiver_count * sizeof(struct ffa_memory_access);
+
+ composite_memory_region = ffa_memory_region_get_composite(response, 0);
+ composite_memory_region->page_count = page_count;
+ composite_memory_region->constituent_count = total_constituent_count;
+ composite_memory_region->reserved_0 = 0;
+
+ constituents_offset =
+ response->receivers[0].composite_memory_region_offset +
+ sizeof(struct ffa_composite_memory_region);
+ if (constituents_offset +
+ fragment_constituent_count *
+ sizeof(struct ffa_memory_region_constituent) >
+ response_max_size) {
+ return false;
+ }
+
+ for (i = 0; i < fragment_constituent_count; ++i) {
+ composite_memory_region->constituents[i] = constituents[i];
+ }
+
+ if (total_length != NULL) {
+ *total_length =
+ constituents_offset +
+ composite_memory_region->constituent_count *
+ sizeof(struct ffa_memory_region_constituent);
+ }
+ if (fragment_length != NULL) {
+ *fragment_length =
+ constituents_offset +
+ fragment_constituent_count *
+ sizeof(struct ffa_memory_region_constituent);
+ }
+
+ return true;
+}
+
+uint32_t ffa_memory_fragment_init(
+ struct ffa_memory_region_constituent *fragment,
+ size_t fragment_max_size,
+ const struct ffa_memory_region_constituent constituents[],
+ uint32_t constituent_count, uint32_t *fragment_length)
+{
+ uint32_t fragment_max_constituents =
+ fragment_max_size /
+ sizeof(struct ffa_memory_region_constituent);
+ uint32_t count_to_copy = constituent_count;
+ uint32_t i;
+
+ if (count_to_copy > fragment_max_constituents) {
+ count_to_copy = fragment_max_constituents;
+ }
+
+ for (i = 0; i < count_to_copy; ++i) {
+ fragment[i] = constituents[i];
+ }
+
+ if (fragment_length != NULL) {
+ *fragment_length = count_to_copy *
+ sizeof(struct ffa_memory_region_constituent);
+ }
+
+ return constituent_count - count_to_copy;
}
