blob: b369b266fe165d52a303cba066b2ba7d7c8f421d [file] [log] [blame]
Andrew Scull18834872018-10-12 11:48:09 +01001/*
Federico Recanati25053ee2022-03-14 15:01:53 +01002 * Copyright 2022 The Hafnium Authors.
Andrew Scull18834872018-10-12 11:48:09 +01003 *
Andrew Walbrane959ec12020-06-17 15:01:09 +01004 * Use of this source code is governed by a BSD-style
5 * license that can be found in the LICENSE file or at
6 * https://opensource.org/licenses/BSD-3-Clause.
Andrew Scull18834872018-10-12 11:48:09 +01007 */
8
Andrew Scull18c78fc2018-08-20 12:57:41 +01009#include "hf/api.h"
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +010010
Andrew Walbran318f5732018-11-20 16:23:42 +000011#include "hf/arch/cpu.h"
Daniel Boulbyb2fb80e2021-02-03 15:09:23 +000012#include "hf/arch/ffa.h"
J-Alves0a21db12024-03-28 12:43:30 +000013#include "hf/arch/memcpy_trapped.h"
Olivier Deprez96a2a262020-06-11 17:21:38 +020014#include "hf/arch/mm.h"
Olivier Deprez112d2b52020-09-30 07:39:23 +020015#include "hf/arch/other_world.h"
Andrew Walbran508e63c2018-12-20 17:02:37 +000016#include "hf/arch/timer.h"
Andrew Walbran318f5732018-11-20 16:23:42 +000017
Karl Meakin49ec1e42024-05-10 13:08:24 +010018#include "hf/bits.h"
Andrew Scull877ae4b2019-07-02 12:52:33 +010019#include "hf/check.h"
Andrew Walbran318f5732018-11-20 16:23:42 +000020#include "hf/dlog.h"
Karl Meakin902af082024-11-28 14:58:38 +000021#include "hf/ffa.h"
22#include "hf/ffa/cpu_cycles.h"
23#include "hf/ffa/direct_messaging.h"
24#include "hf/ffa/ffa_memory.h"
25#include "hf/ffa/indirect_messaging.h"
26#include "hf/ffa/interrupts.h"
27#include "hf/ffa/notifications.h"
Karl Meakin902af082024-11-28 14:58:38 +000028#include "hf/ffa/setup_and_discovery.h"
29#include "hf/ffa/vm.h"
Andrew Walbranb5ab43c2020-04-30 11:32:54 +010030#include "hf/ffa_internal.h"
31#include "hf/ffa_memory.h"
J-Alves33c47bf2022-09-29 11:36:20 +010032#include "hf/ffa_v1_0.h"
Daniel Boulbyf3cf28c2024-08-22 10:46:23 +010033#include "hf/hf_ipi.h"
Andrew Scull6386f252018-12-06 13:29:10 +000034#include "hf/mm.h"
Manish Pandeya5f39fb2020-09-11 09:47:11 +010035#include "hf/plat/interrupts.h"
Andrew Scull877ae4b2019-07-02 12:52:33 +010036#include "hf/static_assert.h"
Andrew Scull8d9e1212019-04-05 13:52:55 +010037#include "hf/std.h"
Madhukar Pappireddy32424db2024-09-25 15:06:19 -050038#include "hf/timer_mgmt.h"
Karl Meakinc5cebbc2024-06-17 11:30:27 +010039#include "hf/vcpu.h"
Andrew Scull18c78fc2018-08-20 12:57:41 +010040#include "hf/vm.h"
41
Andrew Scullf35a5c92018-08-07 18:09:46 +010042#include "vmapi/hf/call.h"
Andrew Walbranb5ab43c2020-04-30 11:32:54 +010043#include "vmapi/hf/ffa.h"
J-Alves126ab502022-09-29 11:37:33 +010044#include "vmapi/hf/ffa_v1_0.h"
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +010045
Daniel Boulby1ddb3d72021-12-16 18:16:50 +000046static_assert(sizeof(struct ffa_partition_info_v1_0) == 8,
Fuad Tabbae4efcc32020-07-16 15:37:27 +010047 "Partition information descriptor size doesn't match the one in "
48 "the FF-A 1.0 EAC specification, Table 82.");
Daniel Boulby1ddb3d72021-12-16 18:16:50 +000049static_assert(sizeof(struct ffa_partition_info) == 24,
50 "Partition information descriptor size doesn't match the one in "
51 "the FF-A 1.1 BETA0 EAC specification, Table 13.34.");
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -080052static_assert((sizeof(struct ffa_partition_info) & 7) == 0,
53 "Partition information descriptor must be a multiple of 8 bytes"
54 " for ffa_partition_info_get_regs to work correctly. Information"
55 " from this structure are returned in 8 byte registers and the"
56 " count of 8 byte registers is returned by the ABI.");
Wedson Almeida Filhoba641ef2018-12-03 04:19:44 +000057/*
58 * To eliminate the risk of deadlocks, we define a partial order for the
59 * acquisition of locks held concurrently by the same physical CPU. Our current
60 * ordering requirements are as follows:
61 *
Andrew Walbranc1ad4ce2019-05-09 11:41:39 +010062 * vm::lock -> vcpu::lock -> mm_stage1_lock -> dlog sl
Andrew Scull6386f252018-12-06 13:29:10 +000063 *
Andrew Scull4caadaf2019-07-03 13:13:47 +010064 * Locks of the same kind require the lock of lowest address to be locked first,
65 * see `sl_lock_both()`.
Wedson Almeida Filhoba641ef2018-12-03 04:19:44 +000066 */
67
Andrew Scullaa039b32018-10-04 15:02:26 +010068static_assert(HF_MAILBOX_SIZE == PAGE_SIZE,
Andrew Scull13652af2018-09-17 14:49:08 +010069 "Currently, a page is mapped for the send and receive buffers so "
70 "the maximum request is the size of a page.");
71
Andrew Walbran5de9c3d2020-02-10 13:35:29 +000072static_assert(MM_PPOOL_ENTRY_SIZE >= HF_MAILBOX_SIZE,
73 "The page pool entry size must be at least as big as the mailbox "
74 "size, so that memory region descriptors can be copied from the "
75 "mailbox for memory sharing.");
76
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -080077/*
78 * Maximum ffa_partition_info entries that can be returned by an invocation
79 * of FFA_PARTITION_INFO_GET_REGS_64 is size in bytes, of available
80 * registers/args in struct ffa_value divided by size of struct
81 * ffa_partition_info. For this ABI, arg3-arg17 in ffa_value can be used, i.e.
82 * 15 uint64_t fields. For FF-A v1.1, this value should be 5.
83 */
84#define MAX_INFO_REGS_ENTRIES_PER_CALL \
85 ((15 * sizeof(uint64_t)) / sizeof(struct ffa_partition_info))
86static_assert(MAX_INFO_REGS_ENTRIES_PER_CALL == 5,
87 "FF-A v1.1 supports no more than 5 entries"
88 " per FFA_PARTITION_INFO_GET_REGS64 calls");
89
Wedson Almeida Filho9ed8da52018-12-17 16:09:11 +000090static struct mpool api_page_pool;
Wedson Almeida Filho22d5eaa2018-12-16 00:38:49 +000091
92/**
Wedson Almeida Filho81568c42019-01-04 13:33:02 +000093 * Initialises the API page pool by taking ownership of the contents of the
94 * given page pool.
Wedson Almeida Filho22d5eaa2018-12-16 00:38:49 +000095 */
96void api_init(struct mpool *ppool)
97{
Wedson Almeida Filho9ed8da52018-12-17 16:09:11 +000098 mpool_init_from(&api_page_pool, ppool);
Wedson Almeida Filho22d5eaa2018-12-16 00:38:49 +000099}
100
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +0100101/**
J-Alvesad6a0432021-04-09 16:06:21 +0100102 * Get target VM vCPU:
103 * If VM is UP then return first vCPU.
104 * If VM is MP then return vCPU whose index matches current CPU index.
105 */
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -0500106struct vcpu *api_ffa_get_vm_vcpu(struct vm *vm, struct vcpu *current)
J-Alvesad6a0432021-04-09 16:06:21 +0100107{
108 ffa_vcpu_index_t current_cpu_index = cpu_index(current->cpu);
109 struct vcpu *vcpu = NULL;
110
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -0500111 CHECK((vm != NULL) && (current != NULL));
112
Karl Meakin82041822024-05-20 11:14:34 +0100113 if (vm_is_up(vm)) {
J-Alvesad6a0432021-04-09 16:06:21 +0100114 vcpu = vm_get_vcpu(vm, 0);
115 } else if (current_cpu_index < vm->vcpu_count) {
116 vcpu = vm_get_vcpu(vm, current_cpu_index);
117 }
118
119 return vcpu;
120}
121
122/**
J-Alvesfe7f7372020-11-09 11:32:12 +0000123 * Switches the physical CPU back to the corresponding vCPU of the VM whose ID
124 * is given as argument of the function.
125 *
126 * Called to change the context between SPs for direct messaging (when Hafnium
127 * is SPMC), and on the context of the remaining 'api_switch_to_*' functions.
128 *
129 * This function works for partitions that are:
J-Alvesad6a0432021-04-09 16:06:21 +0100130 * - UP migratable.
J-Alvesfe7f7372020-11-09 11:32:12 +0000131 * - MP with pinned Execution Contexts.
132 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600133struct vcpu *api_switch_to_vm(struct vcpu_locked current_locked,
134 struct ffa_value to_ret,
J-Alves19e20cf2023-08-02 12:48:55 +0100135 enum vcpu_state vcpu_state, ffa_id_t to_id)
J-Alvesfe7f7372020-11-09 11:32:12 +0000136{
137 struct vm *to_vm = vm_find(to_id);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600138 struct vcpu *next = api_ffa_get_vm_vcpu(to_vm, current_locked.vcpu);
J-Alvesfe7f7372020-11-09 11:32:12 +0000139
140 CHECK(next != NULL);
141
142 /* Set the return value for the target VM. */
143 arch_regs_set_retval(&next->regs, to_ret);
144
145 /* Set the current vCPU state. */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600146 current_locked.vcpu->state = vcpu_state;
J-Alvesfe7f7372020-11-09 11:32:12 +0000147
148 return next;
149}
150
151/**
Fuad Tabbab0ef2a42019-12-19 11:19:25 +0000152 * Switches the physical CPU back to the corresponding vCPU of the primary VM.
Andrew Scullaa039b32018-10-04 15:02:26 +0100153 *
154 * This triggers the scheduling logic to run. Run in the context of secondary VM
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100155 * to cause FFA_RUN to return and the primary VM to regain control of the CPU.
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +0100156 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600157struct vcpu *api_switch_to_primary(struct vcpu_locked current_locked,
J-Alves27b71962022-12-12 15:29:58 +0000158 struct ffa_value primary_ret,
159 enum vcpu_state secondary_state)
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +0100160{
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600161 return api_switch_to_vm(current_locked, primary_ret, secondary_state,
J-Alvesfe7f7372020-11-09 11:32:12 +0000162 HF_PRIMARY_VM_ID);
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +0100163}
164
165/**
Olivier Deprez2ebae3a2020-06-11 16:34:30 +0200166 * Choose next vCPU to run to be the counterpart vCPU in the other
167 * world (run the normal world if currently running in the secure
168 * world). Set current vCPU state to the given vcpu_state parameter.
169 * Set FF-A return values to the target vCPU in the other world.
170 *
171 * Called in context of a direct message response from a secure
172 * partition to a VM.
173 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600174struct vcpu *api_switch_to_other_world(struct vcpu_locked current_locked,
Manish Pandeya5f39fb2020-09-11 09:47:11 +0100175 struct ffa_value other_world_ret,
176 enum vcpu_state vcpu_state)
Olivier Deprez2ebae3a2020-06-11 16:34:30 +0200177{
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600178 return api_switch_to_vm(current_locked, other_world_ret, vcpu_state,
J-Alvesfe7f7372020-11-09 11:32:12 +0000179 HF_OTHER_WORLD_ID);
Olivier Deprez2ebae3a2020-06-11 16:34:30 +0200180}
181
182/**
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000183 * Returns true if the given vCPU is executing in context of an
184 * FFA_MSG_SEND_DIRECT_REQ invocation.
185 */
J-Alves27b71962022-12-12 15:29:58 +0000186bool is_ffa_direct_msg_request_ongoing(struct vcpu_locked locked)
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000187{
Kathleen Capellae468c112023-12-13 17:56:28 -0500188 return locked.vcpu->direct_request_origin.vm_id != HF_INVALID_VM_ID;
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000189}
190
191/**
Manish Pandeya5f39fb2020-09-11 09:47:11 +0100192 * Returns true if the VM owning the given vCPU is supporting managed exit and
193 * the vCPU is currently processing a managed exit.
194 */
195static bool api_ffa_is_managed_exit_ongoing(struct vcpu_locked vcpu_locked)
196{
Karl Meakin117c8082024-12-04 16:03:28 +0000197 return (ffa_vm_managed_exit_supported(vcpu_locked.vcpu->vm) &&
Manish Pandeya5f39fb2020-09-11 09:47:11 +0100198 vcpu_locked.vcpu->processing_managed_exit);
199}
200
201/**
Fuad Tabbab0ef2a42019-12-19 11:19:25 +0000202 * Returns to the primary VM and signals that the vCPU still has work to do so.
Andrew Scull33fecd32019-01-08 14:48:27 +0000203 */
204struct vcpu *api_preempt(struct vcpu *current)
205{
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600206 struct vcpu_locked current_locked;
207 struct vcpu *next;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100208 struct ffa_value ret = {
209 .func = FFA_INTERRUPT_32,
Olivier Deprez0d725f52022-07-06 14:20:27 +0200210 .arg1 = ffa_vm_vcpu(current->vm->id, vcpu_index(current)),
Andrew Scull33fecd32019-01-08 14:48:27 +0000211 };
212
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600213 current_locked = vcpu_lock(current);
214 next = api_switch_to_primary(current_locked, ret, VCPU_STATE_PREEMPTED);
215 vcpu_unlock(&current_locked);
216
217 return next;
Andrew Scull33fecd32019-01-08 14:48:27 +0000218}
219
220/**
Fuad Tabbab0ef2a42019-12-19 11:19:25 +0000221 * Puts the current vCPU in wait for interrupt mode, and returns to the primary
Fuad Tabbaed294af2019-12-20 10:43:01 +0000222 * VM.
Andrew Scullaa039b32018-10-04 15:02:26 +0100223 */
Wedson Almeida Filho00df6c72018-10-18 11:19:24 +0100224struct vcpu *api_wait_for_interrupt(struct vcpu *current)
Andrew Scullaa039b32018-10-04 15:02:26 +0100225{
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600226 struct vcpu_locked current_locked;
227 struct vcpu *next;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100228 struct ffa_value ret = {
229 .func = HF_FFA_RUN_WAIT_FOR_INTERRUPT,
230 .arg1 = ffa_vm_vcpu(current->vm->id, vcpu_index(current)),
Andrew Scull6d2db332018-10-10 15:28:17 +0100231 };
Wedson Almeida Filho81568c42019-01-04 13:33:02 +0000232
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600233 current_locked = vcpu_lock(current);
234 next = api_switch_to_primary(current_locked, ret,
Andrew Sculld6ee1102019-04-05 22:12:42 +0100235 VCPU_STATE_BLOCKED_INTERRUPT);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600236 vcpu_unlock(&current_locked);
237
238 return next;
Andrew Scullaa039b32018-10-04 15:02:26 +0100239}
240
241/**
Andrew Walbran33645652019-04-15 12:29:31 +0100242 * Puts the current vCPU in off mode, and returns to the primary VM.
243 */
244struct vcpu *api_vcpu_off(struct vcpu *current)
245{
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600246 struct vcpu_locked current_locked;
247 struct vcpu *next;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100248 struct ffa_value ret = {
249 .func = HF_FFA_RUN_WAIT_FOR_INTERRUPT,
250 .arg1 = ffa_vm_vcpu(current->vm->id, vcpu_index(current)),
Andrew Walbran33645652019-04-15 12:29:31 +0100251 };
252
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600253 current_locked = vcpu_lock(current);
Andrew Walbran33645652019-04-15 12:29:31 +0100254
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600255 next = api_switch_to_primary(current_locked, ret, VCPU_STATE_OFF);
256 vcpu_unlock(&current_locked);
257
258 return next;
Andrew Walbran33645652019-04-15 12:29:31 +0100259}
260
261/**
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -0500262 * The current vCPU is blocked on some resource and needs to relinquish
263 * control back to the execution context of the endpoint that originally
264 * allocated cycles to it.
Andrew Scull66d62bf2019-02-01 13:54:10 +0000265 */
Madhukar Pappireddy184501c2023-05-23 17:24:06 -0500266struct ffa_value api_yield(struct vcpu *current, struct vcpu **next,
267 struct ffa_value *args)
Andrew Scull66d62bf2019-02-01 13:54:10 +0000268{
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000269 struct ffa_value ret = (struct ffa_value){.func = FFA_SUCCESS_32};
270 struct vcpu_locked current_locked;
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -0500271 bool transition_allowed;
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -0500272 enum vcpu_state next_state = VCPU_STATE_RUNNING;
Madhukar Pappireddy184501c2023-05-23 17:24:06 -0500273 uint32_t timeout_low = 0;
274 uint32_t timeout_high = 0;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600275 struct vcpu_locked next_locked = (struct vcpu_locked){
276 .vcpu = NULL,
277 };
Madhukar Pappireddy184501c2023-05-23 17:24:06 -0500278
279 if (args != NULL) {
280 if (args->arg4 != 0U || args->arg5 != 0U || args->arg6 != 0U ||
281 args->arg7 != 0U) {
282 dlog_error(
283 "Parameters passed through registers X4-X7 "
284 "must be zero\n");
285 return ffa_error(FFA_INVALID_PARAMETERS);
286 }
287 timeout_low = (uint32_t)args->arg2 & 0xFFFFFFFF;
288 timeout_high = (uint32_t)args->arg3 & 0xFFFFFFFF;
289 }
Andrew Scull66d62bf2019-02-01 13:54:10 +0000290
Karl Meakin5e996992024-05-20 11:27:07 +0100291 if (vm_is_primary(current->vm)) {
Fuad Tabbab0ef2a42019-12-19 11:19:25 +0000292 /* NOOP on the primary as it makes the scheduling decisions. */
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000293 return ret;
Andrew Scull66d62bf2019-02-01 13:54:10 +0000294 }
295
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000296 current_locked = vcpu_lock(current);
Karl Meakin117c8082024-12-04 16:03:28 +0000297 transition_allowed = ffa_cpu_cycles_check_runtime_state_transition(
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600298 current_locked, current->vm->id, HF_INVALID_VM_ID, next_locked,
299 FFA_YIELD_32, &next_state);
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000300
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -0500301 if (!transition_allowed) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600302 ret = ffa_error(FFA_DENIED);
303 goto out;
Olivier Deprezee9d6a92019-11-26 09:14:11 +0000304 }
305
Madhukar Pappireddy65764072023-05-23 17:18:58 -0500306 /*
307 * The current vCPU is expected to move to BLOCKED state. However,
308 * under certain circumstances, it is allowed for the current vCPU
309 * to be resumed immediately without ever moving to BLOCKED state. One
310 * such scenario occurs when an SP's execution context attempts to
311 * yield cycles while handling secure interrupt. Refer to the comments
Karl Meakin117c8082024-12-04 16:03:28 +0000312 * in the SPMC variant of the ffa_cpu_cycles_yield_prepare function.
Madhukar Pappireddy65764072023-05-23 17:18:58 -0500313 */
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -0500314 assert(!vm_id_is_current_world(current->vm->id) ||
315 next_state == VCPU_STATE_BLOCKED);
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -0500316
Karl Meakin117c8082024-12-04 16:03:28 +0000317 ret = ffa_cpu_cycles_yield_prepare(current_locked, next, timeout_low,
318 timeout_high);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600319out:
320 vcpu_unlock(&current_locked);
321 return ret;
Andrew Scull66d62bf2019-02-01 13:54:10 +0000322}
323
324/**
Andrew Walbran33645652019-04-15 12:29:31 +0100325 * Switches to the primary so that it can switch to the target, or kick it if it
326 * is already running on a different physical CPU.
327 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600328static struct vcpu *api_wake_up_locked(struct vcpu_locked current_locked,
329 struct vcpu *target_vcpu)
Andrew Walbran33645652019-04-15 12:29:31 +0100330{
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100331 struct ffa_value ret = {
Andrew Walbran7e824602020-10-22 16:51:40 +0100332 .func = FFA_INTERRUPT_32,
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100333 .arg1 = ffa_vm_vcpu(target_vcpu->vm->id,
334 vcpu_index(target_vcpu)),
Andrew Walbran33645652019-04-15 12:29:31 +0100335 };
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600336
337 return api_switch_to_primary(current_locked, ret, VCPU_STATE_BLOCKED);
338}
339
340struct vcpu *api_wake_up(struct vcpu *current, struct vcpu *target_vcpu)
341{
342 struct vcpu_locked current_locked;
343 struct vcpu *next;
344
345 current_locked = vcpu_lock(current);
346 next = api_wake_up_locked(current_locked, target_vcpu);
347 vcpu_unlock(&current_locked);
348
349 return next;
Andrew Walbran33645652019-04-15 12:29:31 +0100350}
351
352/**
Andrew Scull38772ab2019-01-24 15:16:50 +0000353 * Aborts the vCPU and triggers its VM to abort fully.
Andrew Scull9726c252019-01-23 13:44:19 +0000354 */
355struct vcpu *api_abort(struct vcpu *current)
356{
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100357 struct ffa_value ret = ffa_error(FFA_ABORTED);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600358 struct vcpu_locked current_locked;
359 struct vcpu *next;
Madhukar Pappireddy9e09d7a2023-08-08 14:53:49 -0500360 struct vm_locked vm_locked;
Andrew Scull9726c252019-01-23 13:44:19 +0000361
Olivier Deprezf92e5d42020-11-13 16:00:54 +0100362 dlog_notice("Aborting VM %#x vCPU %u\n", current->vm->id,
Andrew Walbran17eebf92020-02-05 16:35:49 +0000363 vcpu_index(current));
Andrew Scull9726c252019-01-23 13:44:19 +0000364
Karl Meakin5e996992024-05-20 11:27:07 +0100365 if (vm_is_primary(current->vm)) {
Andrew Scull9726c252019-01-23 13:44:19 +0000366 /* TODO: what to do when the primary aborts? */
367 for (;;) {
368 /* Do nothing. */
369 }
370 }
371
372 atomic_store_explicit(&current->vm->aborting, true,
373 memory_order_relaxed);
374
Madhukar Pappireddy9e09d7a2023-08-08 14:53:49 -0500375 vm_locked = vm_lock(current->vm);
Karl Meakin117c8082024-12-04 16:03:28 +0000376 ffa_vm_free_resources(vm_locked);
Madhukar Pappireddy9e09d7a2023-08-08 14:53:49 -0500377 vm_unlock(&vm_locked);
Andrew Scull9726c252019-01-23 13:44:19 +0000378
Madhukar Pappireddybd10e572023-03-06 16:39:49 -0600379 current_locked = vcpu_lock(current);
380 next = api_switch_to_primary(current_locked, ret, VCPU_STATE_ABORTED);
381 vcpu_unlock(&current_locked);
382
383 return next;
Andrew Scull9726c252019-01-23 13:44:19 +0000384}
385
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000386/*
387 * Format the partition info descriptors according to the version supported
388 * by the endpoint and return the size of the array created.
389 */
390static struct ffa_value send_versioned_partition_info_descriptors(
Daniel Boulby191b5f02022-02-17 17:26:14 +0000391 struct vm_locked vm_locked, struct ffa_partition_info *partitions,
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000392 uint32_t vm_count)
393{
Daniel Boulby191b5f02022-02-17 17:26:14 +0000394 struct vm *vm = vm_locked.vm;
Karl Meakin0e617d92024-04-05 12:55:22 +0100395 enum ffa_version version = vm->ffa_version;
Daniel Boulby835e1592022-05-30 17:38:51 +0100396 uint32_t partition_info_size;
397 uint32_t buffer_size;
Federico Recanati644f0462022-03-17 12:04:00 +0100398 struct ffa_value ret;
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000399
J-Alvese8c8c2b2022-12-16 15:34:48 +0000400 /* Acquire receiver's RX buffer. */
Karl Meakin117c8082024-12-04 16:03:28 +0000401 if (!ffa_setup_acquire_receiver_rx(vm_locked, &ret)) {
J-Alvese8c8c2b2022-12-16 15:34:48 +0000402 dlog_verbose("Failed to acquire RX buffer for VM %x\n", vm->id);
403 return ret;
404 }
405
J-Alves122f1a12022-12-12 15:55:42 +0000406 if (vm_is_mailbox_busy(vm_locked)) {
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000407 /*
408 * Can't retrieve memory information if the mailbox is not
409 * available.
410 */
411 dlog_verbose("RX buffer not ready.\n");
Daniel Boulby191b5f02022-02-17 17:26:14 +0000412 return ffa_error(FFA_BUSY);
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000413 }
414
Karl Meakin0e617d92024-04-05 12:55:22 +0100415 if (version == FFA_VERSION_1_0) {
Daniel Boulby191b5f02022-02-17 17:26:14 +0000416 struct ffa_partition_info_v1_0 *recv_mailbox = vm->mailbox.recv;
417
Daniel Boulby835e1592022-05-30 17:38:51 +0100418 partition_info_size = sizeof(struct ffa_partition_info_v1_0);
419 buffer_size = partition_info_size * vm_count;
420 if (buffer_size > HF_MAILBOX_SIZE) {
Daniel Boulby191b5f02022-02-17 17:26:14 +0000421 dlog_error(
422 "Partition information does not fit in the "
J-Alves0a21db12024-03-28 12:43:30 +0000423 "VM's RX buffer.\n");
Daniel Boulby191b5f02022-02-17 17:26:14 +0000424 return ffa_error(FFA_NO_MEMORY);
425 }
426
427 for (uint32_t i = 0; i < vm_count; i++) {
428 /*
429 * Populate the VM's RX buffer with the partition
Kathleen Capella402fa852022-11-09 16:16:51 -0500430 * information. Clear properties bits that must be zero
431 * according to DEN0077A FF-A v1.0 REL Table 8.25.
Daniel Boulby191b5f02022-02-17 17:26:14 +0000432 */
433 recv_mailbox[i].vm_id = partitions[i].vm_id;
434 recv_mailbox[i].vcpu_count = partitions[i].vcpu_count;
Kathleen Capella402fa852022-11-09 16:16:51 -0500435 recv_mailbox[i].properties =
436 partitions[i].properties &
437 ~FFA_PARTITION_v1_0_RES_MASK;
Daniel Boulby191b5f02022-02-17 17:26:14 +0000438 }
439
440 } else {
Daniel Boulby835e1592022-05-30 17:38:51 +0100441 partition_info_size = sizeof(struct ffa_partition_info);
442 buffer_size = partition_info_size * vm_count;
J-Alves0a21db12024-03-28 12:43:30 +0000443
Daniel Boulby835e1592022-05-30 17:38:51 +0100444 if (buffer_size > HF_MAILBOX_SIZE) {
Daniel Boulby191b5f02022-02-17 17:26:14 +0000445 dlog_error(
446 "Partition information does not fit in the "
J-Alves0a824e92024-04-26 16:20:12 +0100447 "VM's RX buffer.\n");
Daniel Boulby191b5f02022-02-17 17:26:14 +0000448 return ffa_error(FFA_NO_MEMORY);
449 }
450
J-Alves0a21db12024-03-28 12:43:30 +0000451 /*
452 * Populate the VM's RX buffer with the partition information.
Daniel Boulby191b5f02022-02-17 17:26:14 +0000453 */
J-Alves0a21db12024-03-28 12:43:30 +0000454 if (!memcpy_trapped(vm->mailbox.recv, HF_MAILBOX_SIZE,
455 partitions, buffer_size)) {
456 dlog_error(
457 "%s: Failed to copy ffa_partition_info "
458 "descriptor\n",
459 __func__);
460 return ffa_error(FFA_ABORTED);
461 }
Daniel Boulby191b5f02022-02-17 17:26:14 +0000462 }
463
Daniel Boulby835e1592022-05-30 17:38:51 +0100464 vm->mailbox.recv_size = buffer_size;
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000465
466 /* Sender is Hypervisor in the normal world (TEE in secure world). */
Daniel Boulby191b5f02022-02-17 17:26:14 +0000467 vm->mailbox.recv_sender = HF_VM_ID_BASE;
468 vm->mailbox.recv_func = FFA_PARTITION_INFO_GET_32;
J-Alvese8c8c2b2022-12-16 15:34:48 +0000469 vm->mailbox.state = MAILBOX_STATE_FULL;
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000470
Daniel Boulby835e1592022-05-30 17:38:51 +0100471 /*
472 * Return the count of partition information descriptors in w2
473 * and the size of the descriptors in w3.
474 */
475 return (struct ffa_value){.func = FFA_SUCCESS_32,
476 .arg2 = vm_count,
477 .arg3 = partition_info_size};
Daniel Boulby1ddb3d72021-12-16 18:16:50 +0000478}
479
J-Alves7fb0fdb2024-10-09 11:28:07 +0100480/**
481 * Set properties accoridng to the version of the partition, and the FF-A
482 * features it supports.
483 */
484static ffa_partition_properties_t api_ffa_partitions_info_get_properties(
485 ffa_id_t caller_id, struct vm *vm)
486{
487 ffa_partition_properties_t properties;
488
Karl Meakin117c8082024-12-04 16:03:28 +0000489 properties = ffa_setup_partition_properties(caller_id, vm);
J-Alves7fb0fdb2024-10-09 11:28:07 +0100490 properties |= FFA_PARTITION_AARCH64_EXEC;
491
492 if (vm->ffa_version >= FFA_VERSION_1_1) {
493 properties |= vm_are_notifications_enabled(vm)
494 ? FFA_PARTITION_NOTIFICATION
495 : 0;
496 properties |= vm->messaging_method & FFA_PARTITION_INDIRECT_MSG;
497 }
498
Karl Meakina603e082024-08-02 17:57:27 +0100499 /*
500 * Only populate on calls from normal world,
501 * and if SP supports receiving direct message requests.
502 */
503 if (ffa_is_vm_id(caller_id) &&
504 (properties & FFA_PARTITION_DIRECT_REQ_RECV) != 0) {
505 if (vm->vm_availability_messages.vm_created) {
506 properties |= FFA_PARTITION_VM_CREATED;
507 }
508 if (vm->vm_availability_messages.vm_destroyed) {
509 properties |= FFA_PARTITION_VM_DESTROYED;
510 }
511 }
J-Alves7fb0fdb2024-10-09 11:28:07 +0100512 return properties;
513}
514
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100515static void api_ffa_fill_partition_info(
J-Alves7fb0fdb2024-10-09 11:28:07 +0100516 struct ffa_partition_info *out_partition, struct vm *vm,
517 ffa_id_t caller_id)
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800518{
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100519 out_partition->vm_id = vm->id;
520 out_partition->vcpu_count = vm->vcpu_count;
J-Alves7fb0fdb2024-10-09 11:28:07 +0100521 out_partition->properties =
522 api_ffa_partitions_info_get_properties(caller_id, vm);
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100523}
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800524
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100525/**
526 * Find VMs with UUID matching `uuid_to_find` , and fill `out_partitions` with
527 * partition infos. Returns number of VMs that matched.
528 * A null UUID matches against any VM.
529 * If `count_flag` is true, no partition infos are written to `out_partitions`,
530 * only the number of VMs that matched is returned.
531 */
532static ffa_vm_count_t api_ffa_fill_partitions_info_array(
533 struct ffa_partition_info out_partitions[], size_t out_partitions_len,
J-Alves7fb0fdb2024-10-09 11:28:07 +0100534 const struct ffa_uuid *uuid_to_find, bool count_flag,
Daniel Boulby48546b12025-01-08 18:22:13 +0000535 ffa_id_t caller_id, enum ffa_version caller_version)
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100536{
537 ffa_vm_count_t vms_found = 0;
538 bool match_any = ffa_uuid_is_null(uuid_to_find);
539
540 assert(vm_get_count() <= out_partitions_len);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800541
542 /*
543 * Iterate through the VMs to find the ones with a matching
544 * UUID. A Null UUID retrieves information for all VMs.
545 */
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100546 for (ffa_vm_count_t vm_idx = 0; vm_idx < vm_get_count(); vm_idx++) {
547 struct vm *vm = vm_find_index(vm_idx);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800548
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100549 for (size_t uuid_idx = 0; uuid_idx < PARTITION_MAX_UUIDS;
550 uuid_idx++) {
551 struct ffa_uuid uuid = vm->uuids[uuid_idx];
552 struct ffa_partition_info *out_partition =
553 &out_partitions[vms_found];
554
Kathleen Capellaa1de3c52023-08-28 20:10:02 -0400555 /*
556 * Null UUID indicates reaching the end of a
557 * partition's array of UUIDs.
558 */
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100559 if (ffa_uuid_is_null(&uuid)) {
Kathleen Capellaa1de3c52023-08-28 20:10:02 -0400560 break;
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800561 }
562
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100563 if (match_any || ffa_uuid_equal(uuid_to_find, &uuid)) {
564 vms_found++;
565
Kathleen Capellaa1de3c52023-08-28 20:10:02 -0400566 if (count_flag) {
567 continue;
568 }
569
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100570 api_ffa_fill_partition_info(out_partition, vm,
J-Alves7fb0fdb2024-10-09 11:28:07 +0100571 caller_id);
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100572 if (match_any) {
573 out_partition->uuid = uuid;
Kathleen Capellaa1de3c52023-08-28 20:10:02 -0400574 }
Daniel Boulby48546b12025-01-08 18:22:13 +0000575
576 /*
577 * Multiple UUIDs for a partition was only
578 * introduced in FF-A v1.2, so for any version
579 * less than v1.2 return only one UUID per
580 * partition.
581 */
582 if (caller_version < FFA_VERSION_1_2) {
583 break;
584 }
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800585 }
586 }
587 }
588
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100589 return vms_found;
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800590}
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800591
592static inline void api_ffa_pack_vmid_count_props(
J-Alves19e20cf2023-08-02 12:48:55 +0100593 uint64_t *xn, ffa_id_t vm_id, ffa_vcpu_count_t vcpu_count,
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800594 ffa_partition_properties_t properties)
595{
596 *xn = (uint64_t)vm_id;
597 *xn |= (uint64_t)vcpu_count << 16;
598 *xn |= (uint64_t)properties << 32;
599}
600
Raghu Krishnamurthy2d2b0f42023-04-23 09:54:45 -0700601/**
Raghu Krishnamurthye74d6532023-06-07 12:21:54 -0700602 * This function forwards the FFA_PARTITION_INFO_GET_REGS ABI to the other world
603 * when hafnium is the hypervisor to determine the secure partitions. When
604 * hafnium is the SPMC, this function forwards the call to the SPMD to discover
605 * SPMD logical partitions. The function returns true when partition information
606 * is filled in the partitions array and false if there are errors. Note that
607 * the SPMD and SPMC may return an FF-A error code of FFA_NOT_SUPPORTED when
608 * there are no SPMD logical partitions or no secure partitions respectively,
609 * and this is not considered a failure of the forwarded call. A caller is
610 * expected to check the return value before consuming the information in the
611 * partitions array passed in and ret_count.
Raghu Krishnamurthy2d2b0f42023-04-23 09:54:45 -0700612 */
Raghu Krishnamurthye74d6532023-06-07 12:21:54 -0700613static bool api_ffa_partition_info_get_regs_forward(
614 const struct ffa_uuid *uuid, const uint16_t tag,
615 struct ffa_partition_info *partitions, uint16_t partitions_len,
616 ffa_vm_count_t *ret_count)
617{
618 (void)tag;
619 struct ffa_value ret;
620 uint16_t last_index = UINT16_MAX;
621 uint16_t curr_index = 0;
622 uint16_t start_index = 0;
623
Karl Meakin117c8082024-12-04 16:03:28 +0000624 if (!ffa_setup_partition_info_get_regs_forward_allowed()) {
Raghu Krishnamurthye74d6532023-06-07 12:21:54 -0700625 return true;
626 }
627
628 while (start_index <= last_index) {
629 ret = ffa_partition_info_get_regs(uuid, start_index, 0);
630 if (ffa_func_id(ret) != FFA_SUCCESS_64) {
631 /*
632 * If there are no logical partitions, SPMD returns
633 * NOT_SUPPORTED, that is not an error. If there are no
634 * secure partitions the SPMC returns NOT_SUPPORTED.
635 */
636 if ((ffa_func_id(ret) == FFA_ERROR_32) &&
637 (ffa_error_code(ret) == FFA_NOT_SUPPORTED)) {
638 return true;
639 }
640
641 return false;
642 }
643
644 if (!api_ffa_fill_partition_info_from_regs(
645 ret, start_index, partitions, partitions_len,
646 ret_count)) {
647 return false;
648 }
649
650 last_index = ffa_partition_info_regs_get_last_idx(ret);
651 curr_index = ffa_partition_info_regs_get_curr_idx(ret);
652 start_index = curr_index + 1;
653 }
654 return true;
655}
656
Raghu Krishnamurthy2d2b0f42023-04-23 09:54:45 -0700657bool api_ffa_fill_partition_info_from_regs(
658 struct ffa_value ret, uint16_t start_index,
659 struct ffa_partition_info *partitions, uint16_t partitions_len,
660 ffa_vm_count_t *ret_count)
661{
662 uint16_t vm_count = *ret_count;
663 uint16_t curr_index = 0;
664 uint8_t num_entries = 0;
665 uint8_t idx = 0;
666 /* List of pointers to args in return value. */
667 uint64_t *arg_ptrs[] = {
668 &ret.arg3,
669 &ret.arg4,
670 &ret.arg5,
671 &ret.arg6,
672 &ret.arg7,
673 &ret.extended_val.arg8,
674 &ret.extended_val.arg9,
675 &ret.extended_val.arg10,
676 &ret.extended_val.arg11,
677 &ret.extended_val.arg12,
678 &ret.extended_val.arg13,
679 &ret.extended_val.arg14,
680 &ret.extended_val.arg15,
681 &ret.extended_val.arg16,
682 &ret.extended_val.arg17,
683 };
684
685 if (vm_count > partitions_len) {
686 return false;
687 }
688
689 /*
690 * Tags are currently unused in the implementation. Expect it to be
691 * zero since the implementation does not provide a tag when calling
692 * the FFA_PARTITION_INFO_GET_REGS ABI.
693 */
694 assert(ffa_partition_info_regs_get_tag(ret) == 0);
695
696 /*
697 * Hafnium expects the size of the returned descriptor to be equal to
698 * the size of the structure in the FF-A 1.1 specification. When future
699 * enhancements are made, this assert can be relaxed.
700 */
701 assert(ffa_partition_info_regs_get_desc_size(ret) ==
702 sizeof(struct ffa_partition_info));
703
704 curr_index = ffa_partition_info_regs_get_curr_idx(ret);
705
706 /* FF-A 1.2 ALP0, section 14.9.2 Usage rule 7. */
707 assert(start_index <= curr_index);
708
709 num_entries = curr_index - start_index + 1;
710 if (num_entries > (partitions_len - vm_count) ||
711 num_entries > MAX_INFO_REGS_ENTRIES_PER_CALL) {
712 return false;
713 }
714
715 while (num_entries) {
716 uint64_t info = *(arg_ptrs[(ptrdiff_t)(idx++)]);
717 uint64_t uuid_lo = *(arg_ptrs[(ptrdiff_t)(idx++)]);
718 uint64_t uuid_high = *(arg_ptrs[(ptrdiff_t)(idx++)]);
719
720 partitions[vm_count].vm_id = info & 0xFFFF;
721 partitions[vm_count].vcpu_count = (info >> 16) & 0xFFFF;
722 partitions[vm_count].properties = (info >> 32);
723 partitions[vm_count].uuid.uuid[0] = uuid_lo & 0xFFFFFFFF;
724 partitions[vm_count].uuid.uuid[1] =
725 (uuid_lo >> 32) & 0xFFFFFFFF;
726 partitions[vm_count].uuid.uuid[2] = uuid_high & 0xFFFFFFFF;
727 partitions[vm_count].uuid.uuid[3] =
728 (uuid_high >> 32) & 0xFFFFFFFF;
729 vm_count++;
730 num_entries--;
731 }
732
733 *ret_count = vm_count;
734 return true;
735}
736
Raghu Krishnamurthy7592bcb2022-12-25 13:09:00 -0800737struct ffa_value api_ffa_partition_info_get_regs(struct vcpu *current,
738 const struct ffa_uuid *uuid,
739 const uint16_t start_index,
740 const uint16_t tag)
741{
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800742 struct vm *current_vm = current->vm;
Raghu Krishnamurthyef432cb2022-12-29 06:56:32 -0800743 static struct ffa_partition_info partitions[2 * MAX_VMS];
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800744 bool uuid_is_null = ffa_uuid_is_null(uuid);
745 ffa_vm_count_t vm_count = 0;
746 struct ffa_value ret = ffa_error(FFA_INVALID_PARAMETERS);
747 uint16_t max_idx = 0;
748 uint16_t curr_idx = 0;
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800749 uint8_t num_entries_to_ret = 0;
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800750 uint8_t arg_idx = 3;
751
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800752 /* list of pointers to args in return value */
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800753 uint64_t *arg_ptrs[] = {
754 &(ret).func,
755 &(ret).arg1,
756 &(ret).arg2,
757 &(ret).arg3,
758 &(ret).arg4,
759 &(ret).arg5,
760 &(ret).arg6,
761 &(ret).arg7,
762 &(ret).extended_val.arg8,
763 &(ret).extended_val.arg9,
764 &(ret).extended_val.arg10,
765 &(ret).extended_val.arg11,
766 &(ret).extended_val.arg12,
767 &(ret).extended_val.arg13,
768 &(ret).extended_val.arg14,
769 &(ret).extended_val.arg15,
770 &(ret).extended_val.arg16,
771 &(ret).extended_val.arg17,
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800772 };
773
774 /* TODO: Add support for using tags */
775 if (tag != 0) {
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800776 dlog_error("Tag not 0. Unsupported tag. %d\n", tag);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800777 return ffa_error(FFA_RETRY);
778 }
779
780 memset_s(&partitions, sizeof(partitions), 0, sizeof(partitions));
781
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100782 vm_count = api_ffa_fill_partitions_info_array(
Daniel Boulby48546b12025-01-08 18:22:13 +0000783 partitions, ARRAY_SIZE(partitions), uuid, false, current_vm->id,
784 current_vm->ffa_version);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800785
786 /* If UUID is Null vm_count must not be zero at this stage. */
787 CHECK(!uuid_is_null || vm_count != 0);
788
Raghu Krishnamurthyef432cb2022-12-29 06:56:32 -0800789 /*
790 * When running the Hypervisor:
791 * - If UUID is Null the Hypervisor forwards the query to the SPMC for
792 * it to fill with secure partitions information.
Raghu Krishnamurthy2d2b0f42023-04-23 09:54:45 -0700793 * When running the SPMC, the SPMC forwards the call to the SPMD to
794 * discover any EL3 SPMD logical partitions, if the call came from an
795 * SP. Otherwise, the call is not forwarded.
Raghu Krishnamurthyef432cb2022-12-29 06:56:32 -0800796 * TODO: Note that for this ABI, forwarding on every invocation when
797 * uuid is Null is inefficient,and if performance becomes a problem,
798 * this would be a good place to optimize using strategies such as
799 * caching info etc. For now, assuming this inefficiency is not a major
800 * issue.
801 * - If UUID is non-Null vm_count may be zero because the UUID matches
802 * a secure partition and the query is forwarded to the SPMC.
803 * When running the SPMC:
804 * - If UUID is non-Null and vm_count is zero it means there is no such
805 * partition identified in the system.
806 */
Raghu Krishnamurthy2d2b0f42023-04-23 09:54:45 -0700807 if (vm_id_is_current_world(current_vm->id)) {
Raghu Krishnamurthye74d6532023-06-07 12:21:54 -0700808 if (!api_ffa_partition_info_get_regs_forward(
809 uuid, tag, partitions, ARRAY_SIZE(partitions),
810 &vm_count)) {
Raghu Krishnamurthy2d2b0f42023-04-23 09:54:45 -0700811 dlog_error(
812 "Failed to forward "
813 "ffa_partition_info_get_regs.\n");
814 return ffa_error(FFA_DENIED);
815 }
Raghu Krishnamurthyef432cb2022-12-29 06:56:32 -0800816 }
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800817
818 /*
819 * Unrecognized UUID: does not match any of the VMs (or SPs)
820 * and is not Null.
821 */
Raghu Krishnamurthyef432cb2022-12-29 06:56:32 -0800822 if (vm_count == 0 || vm_count > ARRAY_SIZE(partitions)) {
Olivier Deprez89da0a42023-09-01 17:38:33 +0200823 dlog_verbose(
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800824 "Invalid parameters. vm_count = %d (must not be zero "
Karl Meakine8937d92024-03-19 16:04:25 +0000825 "or > %lu)\n",
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800826 vm_count, ARRAY_SIZE(partitions));
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800827 return ffa_error(FFA_INVALID_PARAMETERS);
828 }
829
830 if (start_index >= vm_count) {
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800831 dlog_error(
832 "start index = %d vm_count = %d (start_index must be "
833 "less than vm_count)\n",
834 start_index, vm_count);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800835 return ffa_error(FFA_INVALID_PARAMETERS);
836 }
837
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800838 max_idx = vm_count - 1;
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800839 num_entries_to_ret = (max_idx - start_index) + 1;
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800840 num_entries_to_ret =
841 MIN(num_entries_to_ret, MAX_INFO_REGS_ENTRIES_PER_CALL);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800842 curr_idx = start_index + num_entries_to_ret - 1;
843 assert(curr_idx <= max_idx);
844
845 ret.func = FFA_SUCCESS_64;
846 ret.arg2 = (sizeof(struct ffa_partition_info) & 0xFFFF) << 48;
847 ret.arg2 |= curr_idx << 16;
848 ret.arg2 |= max_idx;
849
850 if (num_entries_to_ret > 1) {
851 ret.extended_val.valid = 1;
852 }
853
854 for (uint16_t idx = start_index; idx <= curr_idx; ++idx) {
Raghu Krishnamurthybefdcc82023-02-24 06:41:56 -0800855 uint64_t *xn_0 = arg_ptrs[arg_idx++];
856 uint64_t *xn_1 = arg_ptrs[arg_idx++];
857 uint64_t *xn_2 = arg_ptrs[arg_idx++];
858
859 api_ffa_pack_vmid_count_props(xn_0, partitions[idx].vm_id,
860 partitions[idx].vcpu_count,
861 partitions[idx].properties);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800862 if (uuid_is_null) {
Karl Meakin9478e322024-09-23 17:47:09 +0100863 ffa_uuid_to_u64x2(xn_1, xn_2, &partitions[idx].uuid);
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800864 }
Raghu Krishnamurthycded31b2023-04-23 15:07:35 -0700865 assert(arg_idx <= ARRAY_SIZE(arg_ptrs));
Raghu Krishnamurthyf67776f2022-12-26 10:10:05 -0800866 }
867
868 return ret;
Raghu Krishnamurthy7592bcb2022-12-25 13:09:00 -0800869}
870
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100871struct ffa_value api_ffa_partition_info_get(struct vcpu *current,
Daniel Boulbyb46cad12021-12-13 17:47:21 +0000872 const struct ffa_uuid *uuid,
873 const uint32_t flags)
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100874{
875 struct vm *current_vm = current->vm;
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100876 ffa_vm_count_t vm_count = 0;
Olivier Deprez013f4d62022-11-21 15:46:20 +0100877 bool count_flag = (flags & FFA_PARTITION_COUNT_FLAG_MASK) ==
Daniel Boulbyb46cad12021-12-13 17:47:21 +0000878 FFA_PARTITION_COUNT_FLAG;
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100879 bool uuid_is_null = ffa_uuid_is_null(uuid);
Daniel Boulbyce541842022-05-31 15:54:31 +0100880 struct ffa_partition_info partitions[2 * MAX_VMS] = {0};
Daniel Boulby191b5f02022-02-17 17:26:14 +0000881 struct vm_locked vm_locked;
882 struct ffa_value ret;
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100883
Daniel Boulbyb46cad12021-12-13 17:47:21 +0000884 /* Bits 31:1 Must Be Zero */
Olivier Deprez013f4d62022-11-21 15:46:20 +0100885 if ((flags & ~FFA_PARTITION_COUNT_FLAG_MASK) != 0) {
Daniel Boulbyb46cad12021-12-13 17:47:21 +0000886 return ffa_error(FFA_INVALID_PARAMETERS);
887 }
888
Karl Meakinfb9c2a22024-08-19 14:29:37 +0100889 vm_count = api_ffa_fill_partitions_info_array(
890 partitions, ARRAY_SIZE(partitions), uuid, count_flag,
Daniel Boulby48546b12025-01-08 18:22:13 +0000891 current_vm->id, current_vm->ffa_version);
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100892
Olivier Depreze562e542020-06-11 17:31:54 +0200893 /* If UUID is Null vm_count must not be zero at this stage. */
894 CHECK(!uuid_is_null || vm_count != 0);
895
896 /*
897 * When running the Hypervisor:
898 * - If UUID is Null the Hypervisor forwards the query to the SPMC for
899 * it to fill with secure partitions information.
Daniel Boulbyb46cad12021-12-13 17:47:21 +0000900 * - If UUID is non-Null vm_count may be zero because the UUID matches
Olivier Depreze562e542020-06-11 17:31:54 +0200901 * a secure partition and the query is forwarded to the SPMC.
902 * When running the SPMC:
903 * - If UUID is non-Null and vm_count is zero it means there is no such
904 * partition identified in the system.
905 */
Karl Meakin117c8082024-12-04 16:03:28 +0000906 vm_count = ffa_setup_partition_info_get_forward(uuid, flags, partitions,
907 vm_count);
Olivier Depreze562e542020-06-11 17:31:54 +0200908
909 /*
910 * Unrecognized UUID: does not match any of the VMs (or SPs)
911 * and is not Null.
912 */
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100913 if (vm_count == 0) {
914 return ffa_error(FFA_INVALID_PARAMETERS);
915 }
916
Daniel Boulbyb46cad12021-12-13 17:47:21 +0000917 /*
918 * If the count flag is set we don't need to return the partition info
919 * descriptors.
920 */
921 if (count_flag) {
922 return (struct ffa_value){.func = FFA_SUCCESS_32,
923 .arg2 = vm_count};
924 }
925
Daniel Boulby191b5f02022-02-17 17:26:14 +0000926 vm_locked = vm_lock(current_vm);
927 ret = send_versioned_partition_info_descriptors(vm_locked, partitions,
928 vm_count);
929 vm_unlock(&vm_locked);
930 return ret;
Fuad Tabbae4efcc32020-07-16 15:37:27 +0100931}
932
Andrew Scull9726c252019-01-23 13:44:19 +0000933/**
Andrew Scull55c4d8b2018-12-18 18:50:18 +0000934 * Returns the ID of the VM.
935 */
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100936struct ffa_value api_ffa_id_get(const struct vcpu *current)
Andrew Scull55c4d8b2018-12-18 18:50:18 +0000937{
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100938 return (struct ffa_value){.func = FFA_SUCCESS_32,
939 .arg2 = current->vm->id};
Andrew Scull55c4d8b2018-12-18 18:50:18 +0000940}
941
942/**
Olivier Deprez421677d2021-06-18 12:18:53 +0200943 * Returns the SPMC FF-A ID at NS virtual/physical and secure virtual
944 * FF-A instances.
945 * DEN0077A FF-A v1.1 Beta0 section 13.9 FFA_SPM_ID_GET.
Daniel Boulbyb2fb80e2021-02-03 15:09:23 +0000946 */
947struct ffa_value api_ffa_spm_id_get(void)
948{
Karl Meakin0e617d92024-04-05 12:55:22 +0100949 if (FFA_VERSION_1_1 <= FFA_VERSION_COMPILED) {
950 /*
951 * Return the SPMC ID that was fetched during FF-A
952 * initialization.
953 */
954 return (struct ffa_value){.func = FFA_SUCCESS_32,
955 .arg2 = arch_ffa_spmc_id_get()};
956 }
957
J-Alves3829fc02021-03-18 12:49:18 +0000958 return ffa_error(FFA_NOT_SUPPORTED);
Daniel Boulbyb2fb80e2021-02-03 15:09:23 +0000959}
960
961/**
Wedson Almeida Filho03306112018-11-26 00:08:03 +0000962 * This function is called by the architecture-specific context switching
Fuad Tabbab0ef2a42019-12-19 11:19:25 +0000963 * function to indicate that register state for the given vCPU has been saved
964 * and can therefore be used by other pCPUs.
Wedson Almeida Filho03306112018-11-26 00:08:03 +0000965 */
966void api_regs_state_saved(struct vcpu *vcpu)
967{
968 sl_lock(&vcpu->lock);
969 vcpu->regs_available = true;
970 sl_unlock(&vcpu->lock);
971}
J-Alves0ffce752024-10-09 14:37:10 +0100972
Wedson Almeida Filhoea62e2e2019-01-09 19:14:59 +0000973/**
J-Alves2ced1672022-12-12 14:35:38 +0000974 * Constructs the return value from a successful FFA_MSG_WAIT call, when used
975 * with FFA_MSG_SEND_32.
Andrew Walbrand4d2fa12019-10-01 16:47:25 +0100976 */
J-Alves27b71962022-12-12 15:29:58 +0000977struct ffa_value ffa_msg_recv_return(const struct vm *receiver)
Andrew Walbrand4d2fa12019-10-01 16:47:25 +0100978{
Andrew Walbrane7ad3c02019-12-24 17:03:04 +0000979 switch (receiver->mailbox.recv_func) {
Andrew Walbranb5ab43c2020-04-30 11:32:54 +0100980 case FFA_MSG_SEND_32:
981 return (struct ffa_value){
982 .func = FFA_MSG_SEND_32,
Andrew Walbrane7ad3c02019-12-24 17:03:04 +0000983 .arg1 = (receiver->mailbox.recv_sender << 16) |
984 receiver->id,
985 .arg3 = receiver->mailbox.recv_size};
J-Alvesd9e7c8f2024-09-11 13:37:25 +0100986 default:
Federico Recanati25053ee2022-03-14 15:01:53 +0100987 return (struct ffa_value){
988 .func = FFA_RUN_32,
989 /*
990 * TODO: FFA_RUN should return vCPU and VM ID in arg1.
991 * Retrieving vCPU requires a rework of the function,
992 * while receiver ID must be set because it's checked by
993 * other APIs (eg: FFA_NOTIFICATION_GET).
994 */
995 .arg1 = receiver->id};
Andrew Walbrane7ad3c02019-12-24 17:03:04 +0000996 }
Andrew Walbrand4d2fa12019-10-01 16:47:25 +0100997}
998
J-Alvese8c8c2b2022-12-16 15:34:48 +0000999/**
1000 * Change the state of mailbox to empty, such that the ownership is given to the
1001 * Partition manager.
Karl Meakin1064a9c2024-06-04 17:20:43 +01001002 * Returns FFA_SUCCESS if the mailbox was reset successfully, FFA_ERROR
1003 * otherwise.
J-Alvese8c8c2b2022-12-16 15:34:48 +00001004 */
Karl Meakin1064a9c2024-06-04 17:20:43 +01001005static struct ffa_value api_release_mailbox(struct vm_locked vm_locked)
J-Alvese8c8c2b2022-12-16 15:34:48 +00001006{
Karl Meakin1064a9c2024-06-04 17:20:43 +01001007 struct ffa_value ret = {.func = FFA_SUCCESS_32};
J-Alves19e20cf2023-08-02 12:48:55 +01001008 ffa_id_t vm_id = vm_locked.vm->id;
J-Alvese8c8c2b2022-12-16 15:34:48 +00001009
1010 switch (vm_locked.vm->mailbox.state) {
1011 case MAILBOX_STATE_EMPTY:
1012 dlog_verbose("Mailbox of %x is empty.\n", vm_id);
Karl Meakin1064a9c2024-06-04 17:20:43 +01001013 ret = ffa_error(FFA_DENIED);
J-Alves31f8bef2023-07-14 12:46:28 +01001014 break;
J-Alvese8c8c2b2022-12-16 15:34:48 +00001015 case MAILBOX_STATE_FULL:
1016 /* Check it doesn't have pending RX full notifications. */
1017 if (vm_are_fwk_notifications_pending(vm_locked)) {
1018 dlog_verbose(
1019 "Mailbox of endpoint %x has pending "
1020 "messages.\n",
1021 vm_id);
Karl Meakin1064a9c2024-06-04 17:20:43 +01001022 ret = ffa_error(FFA_DENIED);
J-Alvese8c8c2b2022-12-16 15:34:48 +00001023 }
1024 break;
1025 case MAILBOX_STATE_OTHER_WORLD_OWNED:
1026 /*
1027 * The SPMC shouldn't let SP's mailbox get into this state.
1028 * For the Hypervisor, the VM may call FFA_RX_RELEASE, whilst
1029 * the mailbox is in this state. In that case, we should report
1030 * error.
1031 */
1032 if (vm_id_is_current_world(vm_id)) {
1033 dlog_verbose(
Karl Meakin1064a9c2024-06-04 17:20:43 +01001034 "Mailbox of endpoint %x is in an incorrect "
1035 "state.\n",
J-Alvese8c8c2b2022-12-16 15:34:48 +00001036 vm_id);
Karl Meakin1064a9c2024-06-04 17:20:43 +01001037 ret = ffa_error(FFA_ABORTED);
J-Alvese8c8c2b2022-12-16 15:34:48 +00001038 }
1039 break;
1040 }
1041
Karl Meakin1064a9c2024-06-04 17:20:43 +01001042 if (ret.func == FFA_SUCCESS_32) {
1043 vm_locked.vm->mailbox.state = MAILBOX_STATE_EMPTY;
J-Alvese8c8c2b2022-12-16 15:34:48 +00001044 }
1045
Karl Meakin1064a9c2024-06-04 17:20:43 +01001046 return ret;
J-Alvese8c8c2b2022-12-16 15:34:48 +00001047}
1048
Kathleen Capelladb6a08b2023-10-04 13:42:39 -04001049/*
1050 * Helper to check if extended arguments (corresponding to regs x8-x17)
1051 * are zeroed out.
1052 */
Kathleen Capella036cc592023-11-30 18:26:15 -05001053bool api_extended_args_are_zero(struct ffa_value *args)
Kathleen Capelladb6a08b2023-10-04 13:42:39 -04001054{
1055 if (args->extended_val.arg8 != 0U || args->extended_val.arg9 != 0U ||
1056 args->extended_val.arg10 != 0U || args->extended_val.arg11 != 0U ||
1057 args->extended_val.arg12 != 0U || args->extended_val.arg13 != 0U ||
1058 args->extended_val.arg14 != 0U || args->extended_val.arg15 != 0U ||
1059 args->extended_val.arg16 != 0U || args->extended_val.arg17 != 0U) {
1060 return false;
1061 }
1062 return true;
1063}
1064
Kathleen Capellabe1a0b72024-08-16 12:56:39 -04001065static void api_ffa_msg_wait_rx_release(struct vcpu *current)
1066{
1067 struct vm_locked vm_locked;
1068
Karl Meakin117c8082024-12-04 16:03:28 +00001069 vm_locked = ffa_vm_find_locked(current->vm->id);
Kathleen Capellabe1a0b72024-08-16 12:56:39 -04001070 if (vm_locked.vm == NULL) {
1071 return;
1072 }
1073
1074 api_release_mailbox(vm_locked);
1075
1076 if (vm_locked.vm->mailbox.state != MAILBOX_STATE_EMPTY) {
1077 dlog_warning("Mailbox not released to producer\n");
1078 }
1079
1080 vm_unlock(&vm_locked);
1081}
1082
Kathleen Capella7253bd52024-08-14 17:36:09 -04001083static bool api_retain_rx_buffer_ownership(struct ffa_value args)
1084{
1085 return ((args.arg2 & FFA_MSG_WAIT_FLAG_RETAIN_RX) != 0U);
1086}
1087
Madhukar Pappireddy5522c672021-12-17 16:35:51 -06001088struct ffa_value api_ffa_msg_wait(struct vcpu *current, struct vcpu **next,
1089 struct ffa_value *args)
1090{
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001091 struct vcpu_locked current_locked;
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05001092 enum vcpu_state next_state = VCPU_STATE_RUNNING;
J-Alvese8c8c2b2022-12-16 15:34:48 +00001093 struct ffa_value ret;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001094 struct vcpu_locked next_locked = (struct vcpu_locked){
1095 .vcpu = NULL,
1096 };
Madhukar Pappireddy5522c672021-12-17 16:35:51 -06001097
Kathleen Capella7253bd52024-08-14 17:36:09 -04001098 if (args->arg1 != 0U || args->arg3 != 0U || args->arg4 != 0U ||
1099 args->arg5 != 0U || args->arg6 != 0U || args->arg7 != 0U) {
Madhukar Pappireddy5522c672021-12-17 16:35:51 -06001100 return ffa_error(FFA_INVALID_PARAMETERS);
1101 }
1102
Kathleen Capella7253bd52024-08-14 17:36:09 -04001103 if (current->vm->ffa_version >= FFA_VERSION_1_2) {
1104 if (!api_extended_args_are_zero(args)) {
1105 return ffa_error(FFA_INVALID_PARAMETERS);
1106 }
1107 } else {
1108 if (args->arg2 != 0U) {
1109 return ffa_error(FFA_INVALID_PARAMETERS);
1110 }
Kathleen Capelladb6a08b2023-10-04 13:42:39 -04001111 }
1112
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001113 current_locked = vcpu_lock(current);
Karl Meakin117c8082024-12-04 16:03:28 +00001114 if (!ffa_cpu_cycles_check_runtime_state_transition(
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001115 current_locked, current->vm->id, HF_INVALID_VM_ID,
1116 next_locked, FFA_MSG_WAIT_32, &next_state)) {
1117 ret = ffa_error(FFA_DENIED);
1118 goto out;
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001119 }
1120
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05001121 assert(!vm_id_is_current_world(current->vm->id) ||
1122 next_state == VCPU_STATE_WAITING);
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001123
Karl Meakin117c8082024-12-04 16:03:28 +00001124 ret = ffa_cpu_cycles_msg_wait_prepare(current_locked, next);
Kathleen Capellabe1a0b72024-08-16 12:56:39 -04001125
1126 /*
1127 * To maintain partial ordering of locks, release vCPU lock before
1128 * releasing the VM's RX buffer, a process which requires locking the
1129 * VM.
1130 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001131out:
1132 vcpu_unlock(&current_locked);
Kathleen Capellabe1a0b72024-08-16 12:56:39 -04001133
Kathleen Capella7253bd52024-08-14 17:36:09 -04001134 if (ret.func != FFA_ERROR_32 &&
1135 !api_retain_rx_buffer_ownership(*args)) {
Kathleen Capellabe1a0b72024-08-16 12:56:39 -04001136 api_ffa_msg_wait_rx_release(current);
1137 }
J-Alvese8c8c2b2022-12-16 15:34:48 +00001138 return ret;
Madhukar Pappireddy5522c672021-12-17 16:35:51 -06001139}
1140
Andrew Walbrand4d2fa12019-10-01 16:47:25 +01001141/**
Madhukar Pappireddy32424db2024-09-25 15:06:19 -05001142 * Inject virtual timer interrupt to next vCPU if its timer has expired.
1143 */
Daniel Boulbyd49d0772025-01-15 11:19:36 +00001144static void api_inject_arch_timer_interrupt(struct vcpu_locked next_locked)
Madhukar Pappireddy32424db2024-09-25 15:06:19 -05001145{
1146 struct vcpu *next = next_locked.vcpu;
1147
1148 if (arch_timer_expired(&next->regs)) {
1149 /* Make virtual timer interrupt pending. */
Daniel Boulby3c1506b2025-02-25 10:49:51 +00001150 vcpu_virt_interrupt_inject(next_locked, HF_VIRTUAL_TIMER_INTID);
Madhukar Pappireddy32424db2024-09-25 15:06:19 -05001151 }
1152}
1153
1154/**
Fuad Tabbab0ef2a42019-12-19 11:19:25 +00001155 * Prepares the vCPU to run by updating its state and fetching whether a return
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001156 * value needs to be forced onto the vCPU.
1157 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001158static bool api_vcpu_prepare_run(struct vcpu_locked current_locked,
1159 struct vcpu_locked vcpu_next_locked,
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001160 struct ffa_value *run_ret)
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001161{
Max Shvetsov40108e72020-08-27 12:39:50 +01001162 struct vm_locked vm_locked;
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001163 bool ret;
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001164 uint64_t timer_remaining_ns = FFA_SLEEP_INDEFINITE;
Olivier Deprez04168ed2022-09-26 09:20:00 +02001165 bool vcpu_was_init_state = false;
J-Alves6e2abc62021-12-02 14:58:56 +00001166 bool need_vm_lock;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001167 struct two_vcpu_locked vcpus_locked;
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001168
J-Alves478faac2024-10-23 10:35:57 +01001169 const struct ffa_value ffa_run_abi =
1170 (struct ffa_value){.func = FFA_RUN_32};
1171 const struct ffa_value *ffa_run_ret = NULL;
1172
Andrew Scullb06d1752019-02-04 10:15:48 +00001173 /*
Andrew Walbrand81c7d82019-11-27 18:34:46 +00001174 * Check that the registers are available so that the vCPU can be run.
Andrew Scullb06d1752019-02-04 10:15:48 +00001175 *
Andrew Scull4caadaf2019-07-03 13:13:47 +01001176 * The VM lock is not needed in the common case so it must only be taken
1177 * when it is going to be needed. This ensures there are no inter-vCPU
1178 * dependencies in the common run case meaning the sensitive context
1179 * switch performance is consistent.
Andrew Scullb06d1752019-02-04 10:15:48 +00001180 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001181 struct vcpu *vcpu = vcpu_next_locked.vcpu;
1182 struct vcpu *current = current_locked.vcpu;
Max Shvetsov40108e72020-08-27 12:39:50 +01001183
Andrew Walbrand81c7d82019-11-27 18:34:46 +00001184 /* The VM needs to be locked to deliver mailbox messages. */
J-Alves6e2abc62021-12-02 14:58:56 +00001185 need_vm_lock = vcpu->state == VCPU_STATE_WAITING ||
1186 (!vcpu->vm->el0_partition &&
1187 (vcpu->state == VCPU_STATE_BLOCKED_INTERRUPT ||
1188 vcpu->state == VCPU_STATE_BLOCKED ||
1189 vcpu->state == VCPU_STATE_PREEMPTED));
1190
Andrew Walbrand81c7d82019-11-27 18:34:46 +00001191 if (need_vm_lock) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001192 vcpu_unlock(&vcpu_next_locked);
1193 vcpu_unlock(&current_locked);
Max Shvetsov40108e72020-08-27 12:39:50 +01001194 vm_locked = vm_lock(vcpu->vm);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001195
1196 /* Lock both vCPUs at once to avoid deadlock. */
1197 vcpus_locked = vcpu_lock_both(current, vcpu);
1198 current_locked = vcpus_locked.vcpu1;
1199 vcpu_next_locked = vcpus_locked.vcpu2;
Andrew Walbrand81c7d82019-11-27 18:34:46 +00001200 }
1201
1202 /*
1203 * If the vCPU is already running somewhere then we can't run it here
1204 * simultaneously. While it is actually running then the state should be
1205 * `VCPU_STATE_RUNNING` and `regs_available` should be false. Once it
1206 * stops running but while Hafnium is in the process of switching back
1207 * to the primary there will be a brief period while the state has been
1208 * updated but `regs_available` is still false (until
1209 * `api_regs_state_saved` is called). We can't start running it again
1210 * until this has finished, so count this state as still running for the
1211 * purposes of this check.
1212 */
1213 if (vcpu->state == VCPU_STATE_RUNNING || !vcpu->regs_available) {
1214 /*
1215 * vCPU is running on another pCPU.
1216 *
1217 * It's okay not to return the sleep duration here because the
1218 * other physical CPU that is currently running this vCPU will
1219 * return the sleep duration if needed.
1220 */
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001221 *run_ret = ffa_error(FFA_BUSY);
Andrew Walbrand81c7d82019-11-27 18:34:46 +00001222 ret = false;
1223 goto out;
Andrew Scullb06d1752019-02-04 10:15:48 +00001224 }
Andrew Scull9726c252019-01-23 13:44:19 +00001225
1226 if (atomic_load_explicit(&vcpu->vm->aborting, memory_order_relaxed)) {
Andrew Sculld6ee1102019-04-05 22:12:42 +01001227 if (vcpu->state != VCPU_STATE_ABORTED) {
Kathleen Capella6e9765b2023-07-11 17:44:58 -04001228 dlog_verbose("VM %#x was aborted, cannot run vCPU %u\n",
1229 vcpu->vm->id, vcpu_index(vcpu));
Andrew Sculld6ee1102019-04-05 22:12:42 +01001230 vcpu->state = VCPU_STATE_ABORTED;
Andrew Scull9726c252019-01-23 13:44:19 +00001231 }
Kathleen Capella6ab05132023-05-10 12:27:35 -04001232 *run_ret = ffa_error(FFA_ABORTED);
Andrew Scull9726c252019-01-23 13:44:19 +00001233 ret = false;
1234 goto out;
1235 }
1236
Andrew Walbran508e63c2018-12-20 17:02:37 +00001237 switch (vcpu->state) {
Andrew Sculld6ee1102019-04-05 22:12:42 +01001238 case VCPU_STATE_RUNNING:
1239 case VCPU_STATE_OFF:
1240 case VCPU_STATE_ABORTED:
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001241 ret = false;
1242 goto out;
Andrew Scullb06d1752019-02-04 10:15:48 +00001243
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001244 case VCPU_STATE_WAITING:
1245 /*
Olivier Deprezb2808332023-02-02 15:25:40 +01001246 * An initial FFA_RUN is necessary for SP's secondary vCPUs to
1247 * reach the message wait loop.
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001248 */
Olivier Deprezb2808332023-02-02 15:25:40 +01001249 if (vcpu->rt_model == RTM_SP_INIT) {
1250 /*
1251 * TODO: this should be removed, but omitting it makes
1252 * normal world arch gicv3 tests failing.
1253 */
1254 vcpu->rt_model = RTM_NONE;
Olivier Deprez04168ed2022-09-26 09:20:00 +02001255
1256 vcpu_was_init_state = true;
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001257 break;
1258 }
1259
J-Alves6e2abc62021-12-02 14:58:56 +00001260 assert(need_vm_lock == true);
J-Alves478faac2024-10-23 10:35:57 +01001261 if (!vm_locked.vm->el0_partition) {
Karl Meakin117c8082024-12-04 16:03:28 +00001262 ffa_interrupts_inject_notification_pending_interrupt(
Daniel Boulbyd49d0772025-01-15 11:19:36 +00001263 vcpu_next_locked, vm_locked);
J-Alves6e2abc62021-12-02 14:58:56 +00001264 }
1265
J-Alves478faac2024-10-23 10:35:57 +01001266 /* Provide reference to the return value. */
1267 ffa_run_ret = &ffa_run_abi;
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001268
J-Alves478faac2024-10-23 10:35:57 +01001269 break;
Andrew Sculld6ee1102019-04-05 22:12:42 +01001270 case VCPU_STATE_BLOCKED_INTERRUPT:
J-Alves6e2abc62021-12-02 14:58:56 +00001271 if (need_vm_lock &&
Karl Meakin117c8082024-12-04 16:03:28 +00001272 ffa_interrupts_inject_notification_pending_interrupt(
Daniel Boulbyd49d0772025-01-15 11:19:36 +00001273 vcpu_next_locked, vm_locked)) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001274 assert(vcpu_interrupt_count_get(vcpu_next_locked) > 0);
J-Alves6e2abc62021-12-02 14:58:56 +00001275 break;
1276 }
1277
Andrew Scullb06d1752019-02-04 10:15:48 +00001278 /* Allow virtual interrupts to be delivered. */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001279 if (vcpu_interrupt_count_get(vcpu_next_locked) > 0) {
Andrew Scullb06d1752019-02-04 10:15:48 +00001280 break;
1281 }
1282
Andrew Walbran508e63c2018-12-20 17:02:37 +00001283 if (arch_timer_enabled(&vcpu->regs)) {
Andrew Walbran4692a3a2020-08-07 12:42:01 +01001284 timer_remaining_ns =
Andrew Walbran2fc856a2019-11-04 15:17:24 +00001285 arch_timer_remaining_ns(&vcpu->regs);
1286
1287 /*
1288 * The timer expired so allow the interrupt to be
1289 * delivered.
1290 */
1291 if (timer_remaining_ns == 0) {
1292 break;
1293 }
Andrew Walbran4692a3a2020-08-07 12:42:01 +01001294 }
Andrew Walbran2fc856a2019-11-04 15:17:24 +00001295
Andrew Walbran4692a3a2020-08-07 12:42:01 +01001296 /*
1297 * The vCPU is not ready to run, return the appropriate code to
1298 * the primary which called vcpu_run.
1299 */
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001300 run_ret->func = HF_FFA_RUN_WAIT_FOR_INTERRUPT;
Andrew Walbran4692a3a2020-08-07 12:42:01 +01001301 run_ret->arg1 = ffa_vm_vcpu(vcpu->vm->id, vcpu_index(vcpu));
1302 run_ret->arg2 = timer_remaining_ns;
Andrew Walbran508e63c2018-12-20 17:02:37 +00001303
1304 ret = false;
1305 goto out;
Andrew Scullb06d1752019-02-04 10:15:48 +00001306
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001307 case VCPU_STATE_BLOCKED:
1308 /* A blocked vCPU is run unconditionally. Fall through. */
1309 case VCPU_STATE_PREEMPTED:
J-Alves6e2abc62021-12-02 14:58:56 +00001310 /* Check NPI is to be injected here. */
1311 if (need_vm_lock) {
Karl Meakin117c8082024-12-04 16:03:28 +00001312 ffa_interrupts_inject_notification_pending_interrupt(
Daniel Boulbyd49d0772025-01-15 11:19:36 +00001313 vcpu_next_locked, vm_locked);
J-Alves6e2abc62021-12-02 14:58:56 +00001314 }
Andrew Walbran508e63c2018-12-20 17:02:37 +00001315 break;
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001316 default:
1317 /*
1318 * Execution not expected to reach here. Deny the request
1319 * gracefully.
1320 */
1321 *run_ret = ffa_error(FFA_DENIED);
1322 ret = false;
1323 goto out;
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001324 }
1325
J-Alves5d65fe72025-02-18 16:02:32 +00001326 ffa_cpu_cycles_init_schedule_mode_ffa_run(current_locked,
1327 vcpu_next_locked);
Madhukar Pappireddy1480fce2022-06-21 18:09:25 -05001328
Madhukar Pappireddy106bfc32024-09-25 15:47:11 -05001329 timer_migrate_to_other_cpu(current_locked.vcpu->cpu, vcpu_next_locked);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001330 vcpu->cpu = current_locked.vcpu->cpu;
J-Alves478faac2024-10-23 10:35:57 +01001331
1332 vcpu_set_running(vcpu_next_locked, ffa_run_ret);
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001333
Olivier Deprez04168ed2022-09-26 09:20:00 +02001334 if (vcpu_was_init_state) {
1335 vcpu_set_phys_core_idx(vcpu);
1336 vcpu_set_boot_info_gp_reg(vcpu);
J-Alves7ac49052022-02-08 17:20:53 +00001337 }
J-Alves7ac49052022-02-08 17:20:53 +00001338
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001339 ret = true;
1340
1341out:
Andrew Scullb06d1752019-02-04 10:15:48 +00001342 if (need_vm_lock) {
Max Shvetsov40108e72020-08-27 12:39:50 +01001343 vm_unlock(&vm_locked);
Andrew Scullb06d1752019-02-04 10:15:48 +00001344 }
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001345 return ret;
1346}
1347
J-Alves19e20cf2023-08-02 12:48:55 +01001348struct ffa_value api_ffa_run(ffa_id_t vm_id, ffa_vcpu_index_t vcpu_idx,
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05001349 struct vcpu *current, struct vcpu **next)
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01001350{
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001351 struct vm *vm;
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01001352 struct vcpu *vcpu;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001353 struct ffa_value ret = ffa_error(FFA_INVALID_PARAMETERS);
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05001354 enum vcpu_state next_state = VCPU_STATE_RUNNING;
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001355 struct vcpu_locked current_locked;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001356 struct vcpu_locked vcpu_next_locked;
1357 struct two_vcpu_locked vcpus_locked;
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01001358
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001359 current_locked = vcpu_lock(current);
Karl Meakin117c8082024-12-04 16:03:28 +00001360 if (!ffa_cpu_cycles_run_checks(current_locked, vm_id, vcpu_idx, &ret,
1361 next)) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001362 goto out;
Andrew Scull7364a8e2018-07-19 15:39:29 +01001363 }
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01001364
Karl Meakin117c8082024-12-04 16:03:28 +00001365 if (ffa_cpu_cycles_run_forward(vm_id, vcpu_idx, &ret)) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001366 goto out;
Raghu Krishnamurthy62f97a72021-07-27 02:14:59 -07001367 }
1368
Andrew Scull19503262018-09-20 14:48:39 +01001369 /* The requested VM must exist. */
Andrew Walbran42347a92019-05-09 13:59:03 +01001370 vm = vm_find(vm_id);
Andrew Scull19503262018-09-20 14:48:39 +01001371 if (vm == NULL) {
Andrew Scull6d2db332018-10-10 15:28:17 +01001372 goto out;
Andrew Scull19503262018-09-20 14:48:39 +01001373 }
1374
Fuad Tabbaed294af2019-12-20 10:43:01 +00001375 /* The requested vCPU must exist. */
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001376 if (vcpu_idx >= vm->vcpu_count) {
Andrew Scull6d2db332018-10-10 15:28:17 +01001377 goto out;
Andrew Scull7364a8e2018-07-19 15:39:29 +01001378 }
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01001379
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001380 /*
1381 * Refer Figure 8.13 Scenario 1 of the FF-A v1.1 EAC spec. SPMC
1382 * bypasses the intermediate execution contexts and resumes the
1383 * SP execution context that was originally preempted.
1384 */
1385 if (*next != NULL) {
1386 vcpu = *next;
1387 } else {
1388 vcpu = vm_get_vcpu(vm, vcpu_idx);
1389 }
1390
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001391 /*
1392 * Unlock current vCPU to allow it to be locked together with next
1393 * vcpu.
1394 */
1395 vcpu_unlock(&current_locked);
1396
1397 /* Lock both vCPUs at once to avoid deadlock. */
1398 vcpus_locked = vcpu_lock_both(current, vcpu);
1399 current_locked = vcpus_locked.vcpu1;
1400 vcpu_next_locked = vcpus_locked.vcpu2;
1401
Karl Meakin117c8082024-12-04 16:03:28 +00001402 if (!ffa_cpu_cycles_check_runtime_state_transition(
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001403 current_locked, current->vm->id, HF_INVALID_VM_ID,
1404 vcpu_next_locked, FFA_RUN_32, &next_state)) {
1405 ret = ffa_error(FFA_DENIED);
1406 goto out_vcpu;
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001407 }
1408
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001409 if (!api_vcpu_prepare_run(current_locked, vcpu_next_locked, &ret)) {
1410 goto out_vcpu;
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001411 }
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001412
Fuad Tabbaed294af2019-12-20 10:43:01 +00001413 /* Switch to the vCPU. */
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001414 *next = vcpu;
Wedson Almeida Filho03306112018-11-26 00:08:03 +00001415
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05001416 assert(!vm_id_is_current_world(current->vm->id) ||
1417 next_state == VCPU_STATE_BLOCKED);
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001418 current->state = VCPU_STATE_BLOCKED;
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05001419
Andrew Scull33fecd32019-01-08 14:48:27 +00001420 /*
1421 * Set a placeholder return code to the scheduler. This will be
1422 * overwritten when the switch back to the primary occurs.
1423 */
J-Alvesbd32c972024-02-02 16:20:04 +00001424 ret = api_ffa_interrupt_return(0);
Andrew Scull33fecd32019-01-08 14:48:27 +00001425
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001426out_vcpu:
1427 vcpu_unlock(&vcpu_next_locked);
1428
Andrew Scull6d2db332018-10-10 15:28:17 +01001429out:
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06001430 vcpu_unlock(&current_locked);
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001431 return ret;
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01001432}
1433
1434/**
Andrew Scull81e85092018-12-12 12:56:20 +00001435 * Check that the mode indicates memory that is valid, owned and exclusive.
1436 */
Andrew Walbran1281ed42019-10-22 17:23:40 +01001437static bool api_mode_valid_owned_and_exclusive(uint32_t mode)
Andrew Scull81e85092018-12-12 12:56:20 +00001438{
Andrew Scullb5f49e02019-10-02 13:20:47 +01001439 return (mode & (MM_MODE_D | MM_MODE_INVALID | MM_MODE_UNOWNED |
1440 MM_MODE_SHARED)) == 0;
Andrew Scull81e85092018-12-12 12:56:20 +00001441}
1442
1443/**
Manish Pandeyd34f8892020-06-19 17:41:07 +01001444 * Configures the hypervisor's stage-1 view of the send and receive pages.
Andrew Sculle1322792019-07-01 17:46:10 +01001445 */
Karl Meakin738bee12024-01-12 15:19:45 +00001446static struct ffa_value api_vm_configure_stage1(
1447 struct mm_stage1_locked mm_stage1_locked, struct vm_locked vm_locked,
1448 paddr_t pa_send_begin, paddr_t pa_send_end, paddr_t pa_recv_begin,
1449 paddr_t pa_recv_end, uint32_t extra_attributes,
1450 struct mpool *local_page_pool)
Andrew Sculle1322792019-07-01 17:46:10 +01001451{
Karl Meakin738bee12024-01-12 15:19:45 +00001452 struct ffa_value ret;
Andrew Sculle1322792019-07-01 17:46:10 +01001453
Karl Meakin738bee12024-01-12 15:19:45 +00001454 /*
1455 * Map the send page as read-only in the SPMC/hypervisor address space.
1456 */
Andrew Sculle1322792019-07-01 17:46:10 +01001457 vm_locked.vm->mailbox.send =
1458 mm_identity_map(mm_stage1_locked, pa_send_begin, pa_send_end,
Olivier Deprez96a2a262020-06-11 17:21:38 +02001459 MM_MODE_R | extra_attributes, local_page_pool);
Andrew Sculle1322792019-07-01 17:46:10 +01001460 if (!vm_locked.vm->mailbox.send) {
Karl Meakin738bee12024-01-12 15:19:45 +00001461 ret = ffa_error(FFA_NO_MEMORY);
1462 goto out;
Andrew Sculle1322792019-07-01 17:46:10 +01001463 }
1464
1465 /*
Karl Meakin738bee12024-01-12 15:19:45 +00001466 * Map the receive page as writable in the SPMC/hypervisor address
1467 * space. On failure, unmap the send page before returning.
Andrew Sculle1322792019-07-01 17:46:10 +01001468 */
1469 vm_locked.vm->mailbox.recv =
1470 mm_identity_map(mm_stage1_locked, pa_recv_begin, pa_recv_end,
Olivier Deprez96a2a262020-06-11 17:21:38 +02001471 MM_MODE_W | extra_attributes, local_page_pool);
Andrew Sculle1322792019-07-01 17:46:10 +01001472 if (!vm_locked.vm->mailbox.recv) {
Karl Meakin738bee12024-01-12 15:19:45 +00001473 ret = ffa_error(FFA_NO_MEMORY);
Andrew Sculle1322792019-07-01 17:46:10 +01001474 goto fail_undo_send;
1475 }
1476
Karl Meakin738bee12024-01-12 15:19:45 +00001477 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
Andrew Sculle1322792019-07-01 17:46:10 +01001478 goto out;
1479
1480 /*
1481 * The following mappings will not require more memory than is available
1482 * in the local pool.
1483 */
1484fail_undo_send:
1485 vm_locked.vm->mailbox.send = NULL;
Andrew Scull7e8de322019-07-02 13:00:56 +01001486 CHECK(mm_unmap(mm_stage1_locked, pa_send_begin, pa_send_end,
1487 local_page_pool));
Andrew Sculle1322792019-07-01 17:46:10 +01001488
Andrew Sculle1322792019-07-01 17:46:10 +01001489out:
Andrew Sculle1322792019-07-01 17:46:10 +01001490 return ret;
1491}
1492
1493/**
Manish Pandeyd34f8892020-06-19 17:41:07 +01001494 * Sanity checks and configures the send and receive pages in the VM stage-2
1495 * and hypervisor stage-1 page tables.
1496 *
1497 * Returns:
1498 * - FFA_ERROR FFA_INVALID_PARAMETERS if the given addresses are not properly
Daniel Boulby6f8941e2021-06-14 18:27:18 +01001499 * aligned, are the same or have invalid attributes.
Manish Pandeyd34f8892020-06-19 17:41:07 +01001500 * - FFA_ERROR FFA_NO_MEMORY if the hypervisor was unable to map the buffers
1501 * due to insuffient page table memory.
Daniel Boulby6f8941e2021-06-14 18:27:18 +01001502 * - FFA_ERROR FFA_DENIED if the pages are already mapped.
Manish Pandeyd34f8892020-06-19 17:41:07 +01001503 * - FFA_SUCCESS on success if no further action is needed.
Andrew Sculle1322792019-07-01 17:46:10 +01001504 */
Manish Pandeyd34f8892020-06-19 17:41:07 +01001505
1506struct ffa_value api_vm_configure_pages(
1507 struct mm_stage1_locked mm_stage1_locked, struct vm_locked vm_locked,
1508 ipaddr_t send, ipaddr_t recv, uint32_t page_count,
1509 struct mpool *local_page_pool)
Andrew Sculle1322792019-07-01 17:46:10 +01001510{
Manish Pandeyd34f8892020-06-19 17:41:07 +01001511 struct ffa_value ret;
1512 paddr_t pa_send_begin;
1513 paddr_t pa_send_end;
1514 paddr_t pa_recv_begin;
1515 paddr_t pa_recv_end;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001516 uint32_t orig_send_mode = 0;
1517 uint32_t orig_recv_mode = 0;
Olivier Deprez96a2a262020-06-11 17:21:38 +02001518 uint32_t extra_attributes;
Manish Pandeyd34f8892020-06-19 17:41:07 +01001519
1520 /* We only allow these to be setup once. */
1521 if (vm_locked.vm->mailbox.send || vm_locked.vm->mailbox.recv) {
Karl Meakin738bee12024-01-12 15:19:45 +00001522 dlog_error("%s: Mailboxes have already been setup for VM %#x\n",
1523 __func__, vm_locked.vm->id);
Manish Pandeyd34f8892020-06-19 17:41:07 +01001524 ret = ffa_error(FFA_DENIED);
1525 goto out;
1526 }
1527
1528 /* Hafnium only supports a fixed size of RX/TX buffers. */
1529 if (page_count != HF_MAILBOX_SIZE / FFA_PAGE_SIZE) {
Karl Meakine8937d92024-03-19 16:04:25 +00001530 dlog_error("%s: Page count must be %zu, it is %d\n", __func__,
Karl Meakin738bee12024-01-12 15:19:45 +00001531 HF_MAILBOX_SIZE / FFA_PAGE_SIZE, page_count);
Manish Pandeyd34f8892020-06-19 17:41:07 +01001532 ret = ffa_error(FFA_INVALID_PARAMETERS);
1533 goto out;
1534 }
1535
1536 /* Fail if addresses are not page-aligned. */
1537 if (!is_aligned(ipa_addr(send), PAGE_SIZE) ||
1538 !is_aligned(ipa_addr(recv), PAGE_SIZE)) {
Karl Meakin738bee12024-01-12 15:19:45 +00001539 dlog_error("%s: Mailbox buffers not page-aligned\n", __func__);
Manish Pandeyd34f8892020-06-19 17:41:07 +01001540 ret = ffa_error(FFA_INVALID_PARAMETERS);
1541 goto out;
1542 }
1543
1544 /* Convert to physical addresses. */
1545 pa_send_begin = pa_from_ipa(send);
1546 pa_send_end = pa_add(pa_send_begin, HF_MAILBOX_SIZE);
1547 pa_recv_begin = pa_from_ipa(recv);
1548 pa_recv_end = pa_add(pa_recv_begin, HF_MAILBOX_SIZE);
1549
1550 /* Fail if the same page is used for the send and receive pages. */
1551 if (pa_addr(pa_send_begin) == pa_addr(pa_recv_begin)) {
Karl Meakin738bee12024-01-12 15:19:45 +00001552 dlog_error("%s: Mailbox buffers overlap\n", __func__);
Manish Pandeyd34f8892020-06-19 17:41:07 +01001553 ret = ffa_error(FFA_INVALID_PARAMETERS);
1554 goto out;
1555 }
Andrew Sculle1322792019-07-01 17:46:10 +01001556
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001557 /* Set stage 2 translation tables only for virtual FF-A instances. */
1558 if (vm_id_is_current_world(vm_locked.vm->id)) {
1559 /*
1560 * Ensure the pages are valid, owned and exclusive to the VM and
1561 * that the VM has the required access to the memory.
1562 */
1563 if (!vm_mem_get_mode(vm_locked, send, ipa_add(send, PAGE_SIZE),
1564 &orig_send_mode) ||
1565 !api_mode_valid_owned_and_exclusive(orig_send_mode) ||
1566 (orig_send_mode & MM_MODE_R) == 0 ||
1567 (orig_send_mode & MM_MODE_W) == 0) {
1568 dlog_error(
1569 "VM doesn't have required access rights to map "
1570 "TX buffer in stage 2.\n");
1571 ret = ffa_error(FFA_INVALID_PARAMETERS);
1572 goto out;
1573 }
Manish Pandeyd34f8892020-06-19 17:41:07 +01001574
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001575 if (!vm_mem_get_mode(vm_locked, recv, ipa_add(recv, PAGE_SIZE),
1576 &orig_recv_mode) ||
1577 !api_mode_valid_owned_and_exclusive(orig_recv_mode) ||
1578 (orig_recv_mode & MM_MODE_R) == 0) {
1579 dlog_error(
1580 "VM doesn't have required access rights to map "
1581 "RX buffer in stage 2.\n");
1582 ret = ffa_error(FFA_INVALID_PARAMETERS);
1583 goto out;
1584 }
Andrew Sculle1322792019-07-01 17:46:10 +01001585
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001586 /* Take memory ownership away from the VM and mark as shared. */
1587 uint32_t mode = MM_MODE_UNOWNED | MM_MODE_SHARED | MM_MODE_R |
1588 MM_MODE_W;
1589 if (vm_locked.vm->el0_partition) {
1590 mode |= MM_MODE_USER | MM_MODE_NG;
1591 }
Raghu Krishnamurthy95c3a272021-02-26 18:09:41 -08001592
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001593 if (!vm_identity_map(vm_locked, pa_send_begin, pa_send_end,
1594 mode, local_page_pool, NULL)) {
1595 dlog_error(
1596 "Cannot allocate a new entry in stage 2 "
1597 "translation table.\n");
1598 ret = ffa_error(FFA_NO_MEMORY);
1599 goto out;
1600 }
Andrew Sculle1322792019-07-01 17:46:10 +01001601
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001602 mode = MM_MODE_UNOWNED | MM_MODE_SHARED | MM_MODE_R;
1603 if (vm_locked.vm->el0_partition) {
1604 mode |= MM_MODE_USER | MM_MODE_NG;
1605 }
Raghu Krishnamurthy95c3a272021-02-26 18:09:41 -08001606
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001607 if (!vm_identity_map(vm_locked, pa_recv_begin, pa_recv_end,
1608 mode, local_page_pool, NULL)) {
1609 /* TODO: partial defrag of failed range. */
1610 /* Recover any memory consumed in failed mapping. */
Karl Meakin738bee12024-01-12 15:19:45 +00001611 dlog_error("%s: cannot map recv page\n", __func__);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001612 vm_ptable_defrag(vm_locked, local_page_pool);
Karl Meakin738bee12024-01-12 15:19:45 +00001613 ret = ffa_error(FFA_NO_MEMORY);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001614 goto fail_undo_send;
1615 }
Karl Meakin738bee12024-01-12 15:19:45 +00001616 } else {
1617 ret = arch_other_world_vm_configure_rxtx_map(
1618 vm_locked, local_page_pool, pa_send_begin, pa_send_end,
1619 pa_recv_begin, pa_recv_end);
1620 if (ret.func != FFA_SUCCESS_32) {
1621 goto out;
1622 }
Andrew Sculle1322792019-07-01 17:46:10 +01001623 }
1624
Olivier Deprez96a2a262020-06-11 17:21:38 +02001625 /* Get extra send/recv pages mapping attributes for the given VM ID. */
1626 extra_attributes = arch_mm_extra_attributes_from_vm(vm_locked.vm->id);
1627
Raghu Krishnamurthy95c3a272021-02-26 18:09:41 -08001628 /*
1629 * For EL0 partitions, since both the partition and the hypervisor code
1630 * use the EL2&0 translation regime, it is critical to mark the mappings
1631 * of the send and recv buffers as non-global in the TLB. For one, if we
1632 * dont mark it as non-global, it would cause TLB conflicts since there
1633 * would be an identity mapping with non-global attribute in the
1634 * partitions page tables, but another identity mapping in the
1635 * hypervisor page tables with the global attribute. The other issue is
1636 * one of security, we dont want other partitions to be able to access
1637 * other partitions buffers through cached translations.
1638 */
1639 if (vm_locked.vm->el0_partition) {
1640 extra_attributes |= MM_MODE_NG;
1641 }
1642
Karl Meakin738bee12024-01-12 15:19:45 +00001643 ret = api_vm_configure_stage1(
1644 mm_stage1_locked, vm_locked, pa_send_begin, pa_send_end,
1645 pa_recv_begin, pa_recv_end, extra_attributes, local_page_pool);
1646 if (ret.func != FFA_SUCCESS_32) {
Andrew Sculle1322792019-07-01 17:46:10 +01001647 goto fail_undo_send_and_recv;
1648 }
1649
Manish Pandeyd34f8892020-06-19 17:41:07 +01001650 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
Andrew Sculle1322792019-07-01 17:46:10 +01001651 goto out;
1652
Andrew Sculle1322792019-07-01 17:46:10 +01001653fail_undo_send_and_recv:
Andrew Scull3c257452019-11-26 13:32:50 +00001654 CHECK(vm_identity_map(vm_locked, pa_recv_begin, pa_recv_end,
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001655 orig_recv_mode, local_page_pool, NULL));
Andrew Sculle1322792019-07-01 17:46:10 +01001656
1657fail_undo_send:
Andrew Scull3c257452019-11-26 13:32:50 +00001658 CHECK(vm_identity_map(vm_locked, pa_send_begin, pa_send_end,
Manish Pandeyd34f8892020-06-19 17:41:07 +01001659 orig_send_mode, local_page_pool, NULL));
Andrew Sculle1322792019-07-01 17:46:10 +01001660
1661out:
Andrew Sculle1322792019-07-01 17:46:10 +01001662 return ret;
1663}
1664
Karl Meakinb9705e22024-04-05 13:58:28 +01001665/**
1666 * Read the buffer addresses and VM ID of an FFA_RXTX_MAP request. Handles
1667 * forwarded messages by reading from the hypervisor's TX buffer.
1668 *
1669 * Returns the VM/SP ID on success.
1670 *
1671 * Returns `HF_INVALID_VM_ID` when the arguments provided via the ABI
1672 * FFA_RXTX_MAP indicate the SPMC should retrieve the RXTX description from the
1673 * Hypervisor RXTX buffers, and the hypervisor hasn't given its own RXTX buffers
1674 * for the SPMC to map.
1675 */
1676static ffa_id_t api_get_rxtx_description(struct vm *current_vm, ipaddr_t *send,
1677 ipaddr_t *recv, uint32_t *page_count)
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001678{
Karl Meakinb9705e22024-04-05 13:58:28 +01001679 bool forwarded;
1680 struct vm_locked vm_locked;
1681 ffa_id_t owner_vm_id;
1682 struct ffa_endpoint_rx_tx_descriptor *endpoint_desc;
1683 struct ffa_composite_memory_region *rx_region;
1684 struct ffa_composite_memory_region *tx_region;
1685
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001686 /*
1687 * If the message has been forwarded the effective addresses are in
1688 * hypervisor's TX buffer.
1689 */
Karl Meakinb9705e22024-04-05 13:58:28 +01001690 forwarded = (current_vm->id == HF_OTHER_WORLD_ID) &&
1691 (ipa_addr(*send) == 0) && (ipa_addr(*recv) == 0) &&
1692 (*page_count == 0);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001693
1694 if (forwarded) {
Karl Meakinb9705e22024-04-05 13:58:28 +01001695 vm_locked = vm_lock(current_vm);
1696 endpoint_desc = (struct ffa_endpoint_rx_tx_descriptor *)
1697 vm_locked.vm->mailbox.send;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001698
Karl Meakinb9705e22024-04-05 13:58:28 +01001699 if (endpoint_desc == NULL) {
1700 dlog_error(
1701 "Trying to access RXTX description, but "
1702 "hypervisor has not provided RXTX buffers\n");
1703 vm_unlock(&vm_locked);
1704 return HF_INVALID_VM_ID;
1705 }
1706
1707 rx_region = ffa_endpoint_get_rx_memory_region(endpoint_desc);
1708 tx_region = ffa_endpoint_get_tx_memory_region(endpoint_desc);
1709
1710 owner_vm_id = endpoint_desc->endpoint_id;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001711 *recv = ipa_init(rx_region->constituents[0].address);
1712 *send = ipa_init(tx_region->constituents[0].address);
1713 *page_count = rx_region->constituents[0].page_count;
J-Alves28ad9b42022-12-08 12:19:43 +00001714
1715 vm_unlock(&vm_locked);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001716 } else {
Karl Meakinb9705e22024-04-05 13:58:28 +01001717 owner_vm_id = current_vm->id;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001718 }
Karl Meakinb9705e22024-04-05 13:58:28 +01001719
1720 return owner_vm_id;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001721}
Karl Meakinb9705e22024-04-05 13:58:28 +01001722
Andrew Sculle1322792019-07-01 17:46:10 +01001723/**
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001724 * Configures the VM to send/receive data through the specified pages. The pages
Manish Pandeyd34f8892020-06-19 17:41:07 +01001725 * must not be shared. Locking of the page tables combined with a local memory
1726 * pool ensures there will always be enough memory to recover from any errors
1727 * that arise. The stage-1 page tables must be locked so memory cannot be taken
1728 * by another core which could result in this transaction being unable to roll
1729 * back in the case of an error.
Wedson Almeida Filhoea62e2e2019-01-09 19:14:59 +00001730 *
1731 * Returns:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001732 * - FFA_ERROR FFA_INVALID_PARAMETERS if the given addresses are not properly
Daniel Boulby6f8941e2021-06-14 18:27:18 +01001733 * aligned, are the same or have invalid attributes.
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001734 * - FFA_ERROR FFA_NO_MEMORY if the hypervisor was unable to map the buffers
Andrew Walbranbfffb0f2019-11-05 14:02:34 +00001735 * due to insuffient page table memory.
Daniel Boulby6f8941e2021-06-14 18:27:18 +01001736 * - FFA_ERROR FFA_DENIED if the pages are already mapped.
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001737 * - FFA_SUCCESS on success if no further action is needed.
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001738 */
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001739struct ffa_value api_ffa_rxtx_map(ipaddr_t send, ipaddr_t recv,
Federico Recanati9f1b6532022-04-14 13:15:28 +02001740 uint32_t page_count, struct vcpu *current)
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001741{
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01001742 struct ffa_value ret;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001743 struct vm_locked owner_vm_locked;
Manish Pandeyd34f8892020-06-19 17:41:07 +01001744 struct mm_stage1_locked mm_stage1_locked;
1745 struct mpool local_page_pool;
J-Alves19e20cf2023-08-02 12:48:55 +01001746 ffa_id_t owner_vm_id;
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001747
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001748 /*
1749 * Get the original buffer addresses and VM ID in case of forwarded
1750 * message.
1751 */
Karl Meakinb9705e22024-04-05 13:58:28 +01001752 owner_vm_id = api_get_rxtx_description(current->vm, &send, &recv,
1753 &page_count);
1754 if (owner_vm_id == HF_INVALID_VM_ID) {
1755 return ffa_error(FFA_INVALID_PARAMETERS);
1756 }
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001757
Karl Meakin117c8082024-12-04 16:03:28 +00001758 owner_vm_locked = ffa_vm_find_locked_create(owner_vm_id);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001759 if (owner_vm_locked.vm == NULL) {
1760 dlog_error("Cannot map RX/TX for VM ID %#x, not found.\n",
1761 owner_vm_id);
1762 return ffa_error(FFA_DENIED);
1763 }
Andrew Scull220e6212018-12-21 18:09:00 +00001764
Andrew Scull3c0a90a2019-07-01 11:55:53 +01001765 /*
Manish Pandeyd34f8892020-06-19 17:41:07 +01001766 * Create a local pool so any freed memory can't be used by another
1767 * thread. This is to ensure the original mapping can be restored if any
1768 * stage of the process fails.
Andrew Scull3c0a90a2019-07-01 11:55:53 +01001769 */
Manish Pandeyd34f8892020-06-19 17:41:07 +01001770 mpool_init_with_fallback(&local_page_pool, &api_page_pool);
1771
Manish Pandeyd34f8892020-06-19 17:41:07 +01001772 mm_stage1_locked = mm_lock_stage1();
Andrew Scull220e6212018-12-21 18:09:00 +00001773
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001774 ret = api_vm_configure_pages(mm_stage1_locked, owner_vm_locked, send,
1775 recv, page_count, &local_page_pool);
Manish Pandeyd34f8892020-06-19 17:41:07 +01001776 if (ret.func != FFA_SUCCESS_32) {
Andrew Walbranbfffb0f2019-11-05 14:02:34 +00001777 goto exit;
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001778 }
1779
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001780 /* Forward buffer mapping to SPMC if coming from a VM. */
Karl Meakin117c8082024-12-04 16:03:28 +00001781 ffa_setup_rxtx_map_forward(owner_vm_locked);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001782
Federico Recanati9f1b6532022-04-14 13:15:28 +02001783 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
Andrew Scull220e6212018-12-21 18:09:00 +00001784
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001785exit:
Manish Pandeyd34f8892020-06-19 17:41:07 +01001786 mpool_fini(&local_page_pool);
Manish Pandeyd34f8892020-06-19 17:41:07 +01001787 mm_unlock_stage1(&mm_stage1_locked);
Federico Recanati8d8b1cf2022-04-14 13:16:00 +02001788 vm_unlock(&owner_vm_locked);
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01001789
1790 return ret;
1791}
1792
1793/**
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001794 * Unmaps the RX/TX buffer pair with a partition or partition manager from the
1795 * translation regime of the caller. Unmap the region for the hypervisor and
1796 * set the memory region to owned and exclusive for the component. Since the
1797 * memory region mapped in the page table, when the buffers were originally
1798 * created we can safely remap it.
1799 *
1800 * Returns:
1801 * - FFA_ERROR FFA_INVALID_PARAMETERS if there is no buffer pair registered on
1802 * behalf of the caller.
1803 * - FFA_SUCCESS on success if no further action is needed.
1804 */
J-Alves19e20cf2023-08-02 12:48:55 +01001805struct ffa_value api_ffa_rxtx_unmap(ffa_id_t allocator_id, struct vcpu *current)
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001806{
1807 struct vm *vm = current->vm;
1808 struct vm_locked vm_locked;
J-Alves19e20cf2023-08-02 12:48:55 +01001809 ffa_id_t owner_vm_id;
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001810 struct mm_stage1_locked mm_stage1_locked;
1811 paddr_t send_pa_begin;
1812 paddr_t send_pa_end;
1813 paddr_t recv_pa_begin;
1814 paddr_t recv_pa_end;
Federico Recanati8da9e332022-02-10 11:00:17 +01001815 struct ffa_value ret = (struct ffa_value){.func = FFA_SUCCESS_32};
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001816
J-Alves661e1b72023-08-02 13:39:40 +01001817 if (vm->id == HF_HYPERVISOR_VM_ID && !ffa_is_vm_id(allocator_id)) {
Olivier Deprez106c8ce2024-02-08 11:49:02 +01001818 dlog_verbose(
J-Alves9bd324a2023-01-12 10:52:52 +00001819 "The Hypervisor must specify a valid VM ID in register "
1820 "W1, if FFA_RXTX_UNMAP call forwarded to SPM.\n");
1821 return ffa_error(FFA_INVALID_PARAMETERS);
1822 }
1823
Federico Recanati8da9e332022-02-10 11:00:17 +01001824 /* Ensure `allocator_id` is set only at Non-Secure Physical instance. */
1825 if (vm_id_is_current_world(vm->id) && (allocator_id != 0)) {
J-Alves9bd324a2023-01-12 10:52:52 +00001826 dlog_error(
1827 "The register W1 (containing ID) must be 0 at virtual "
1828 "instances.\n");
Federico Recanati8da9e332022-02-10 11:00:17 +01001829 return ffa_error(FFA_INVALID_PARAMETERS);
1830 }
1831
1832 /* VM ID of which buffers have to be unmapped. */
1833 owner_vm_id = (allocator_id != 0) ? allocator_id : vm->id;
1834
Karl Meakin117c8082024-12-04 16:03:28 +00001835 vm_locked = ffa_vm_find_locked(owner_vm_id);
Federico Recanati8da9e332022-02-10 11:00:17 +01001836 vm = vm_locked.vm;
1837 if (vm == NULL) {
1838 dlog_error("Cannot unmap RX/TX for VM ID %#x, not found.\n",
1839 owner_vm_id);
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001840 return ffa_error(FFA_INVALID_PARAMETERS);
1841 }
1842
1843 /* Get send and receive buffers. */
1844 if (vm->mailbox.send == NULL || vm->mailbox.recv == NULL) {
Olivier Deprez86d87ae2021-08-19 14:27:46 +02001845 dlog_verbose(
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001846 "No buffer pair registered on behalf of the caller.\n");
Federico Recanati8da9e332022-02-10 11:00:17 +01001847 ret = ffa_error(FFA_INVALID_PARAMETERS);
1848 goto out;
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001849 }
1850
1851 /* Currently a mailbox size of 1 page is assumed. */
1852 send_pa_begin = pa_from_va(va_from_ptr(vm->mailbox.send));
1853 send_pa_end = pa_add(send_pa_begin, HF_MAILBOX_SIZE);
1854 recv_pa_begin = pa_from_va(va_from_ptr(vm->mailbox.recv));
1855 recv_pa_end = pa_add(recv_pa_begin, HF_MAILBOX_SIZE);
1856
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001857 mm_stage1_locked = mm_lock_stage1();
1858
Federico Recanati8da9e332022-02-10 11:00:17 +01001859 /* Reset stage 2 mapping only for virtual FF-A instances. */
1860 if (vm_id_is_current_world(owner_vm_id)) {
1861 /*
1862 * Set the memory region of the buffers back to the default mode
1863 * for the VM. Since this memory region was already mapped for
1864 * the RXTX buffers we can safely remap them.
1865 */
1866 CHECK(vm_identity_map(vm_locked, send_pa_begin, send_pa_end,
1867 MM_MODE_R | MM_MODE_W | MM_MODE_X,
1868 &api_page_pool, NULL));
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001869
Federico Recanati8da9e332022-02-10 11:00:17 +01001870 CHECK(vm_identity_map(vm_locked, recv_pa_begin, recv_pa_end,
1871 MM_MODE_R | MM_MODE_W | MM_MODE_X,
1872 &api_page_pool, NULL));
Karl Meakin738bee12024-01-12 15:19:45 +00001873 } else {
1874 ret = arch_other_world_vm_configure_rxtx_unmap(
1875 vm_locked, &api_page_pool, send_pa_begin, send_pa_end,
1876 recv_pa_begin, recv_pa_end);
1877 if (ret.func != FFA_SUCCESS_32) {
1878 goto out;
1879 }
Federico Recanati8da9e332022-02-10 11:00:17 +01001880 }
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001881
1882 /* Unmap the buffers in the partition manager. */
1883 CHECK(mm_unmap(mm_stage1_locked, send_pa_begin, send_pa_end,
1884 &api_page_pool));
1885 CHECK(mm_unmap(mm_stage1_locked, recv_pa_begin, recv_pa_end,
1886 &api_page_pool));
1887
1888 vm->mailbox.send = NULL;
1889 vm->mailbox.recv = NULL;
Karl Meakin117c8082024-12-04 16:03:28 +00001890 ffa_vm_destroy(vm_locked);
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001891
Federico Recanati8da9e332022-02-10 11:00:17 +01001892 /* Forward buffer unmapping to SPMC if coming from a VM. */
Karl Meakin117c8082024-12-04 16:03:28 +00001893 ffa_setup_rxtx_unmap_forward(vm_locked);
Federico Recanati8da9e332022-02-10 11:00:17 +01001894
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001895 mm_unlock_stage1(&mm_stage1_locked);
Federico Recanati8da9e332022-02-10 11:00:17 +01001896
1897out:
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001898 vm_unlock(&vm_locked);
1899
Federico Recanati8da9e332022-02-10 11:00:17 +01001900 return ret;
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001901}
1902
Karl Meakin355d5c22024-12-12 18:04:56 +00001903static struct ffa_value api_ffa_msg_send2_copy_data(
1904 struct ffa_partition_rxtx_header *header, struct vm *receiver_vm,
Karl Meakina78337f2024-12-12 23:30:06 +00001905 struct vm_locked sender_locked)
Karl Meakin355d5c22024-12-12 18:04:56 +00001906{
Karl Meakina78337f2024-12-12 23:30:06 +00001907 const void *sender_tx_buffer = sender_locked.vm->mailbox.send;
Karl Meakin355d5c22024-12-12 18:04:56 +00001908 uint32_t total_size;
Karl Meakina78337f2024-12-12 23:30:06 +00001909 uint32_t min_offset;
Karl Meakin355d5c22024-12-12 18:04:56 +00001910
Karl Meakina78337f2024-12-12 23:30:06 +00001911 switch (sender_locked.vm->ffa_version) {
1912 case FFA_VERSION_1_0:
1913 dlog_verbose("Indirect messaging not supported in v1.0\n");
1914 return ffa_error(FFA_NOT_SUPPORTED);
1915 case FFA_VERSION_1_1:
1916 min_offset = FFA_RXTX_HEADER_SIZE_V1_1;
1917 break;
1918 default:
1919 min_offset = FFA_RXTX_HEADER_SIZE;
1920 break;
1921 }
1922
1923 if (header->offset < min_offset) {
1924 dlog_error(
1925 "Indirect message payload overlaps with header (%u < "
1926 "%u, version = %#x)\n",
1927 header->offset, min_offset,
1928 sender_locked.vm->ffa_version);
Karl Meakin355d5c22024-12-12 18:04:56 +00001929 return ffa_error(FFA_INVALID_PARAMETERS);
1930 }
1931
Karl Meakina78337f2024-12-12 23:30:06 +00001932 /*
1933 * Check the size of transfer.
1934 * Check for overflow in the sum so that very large offsets and/or sizes
1935 * do not pass the check.
1936 */
1937 if (add_overflow(header->offset, header->size, &total_size)) {
1938 dlog_error(
1939 "Overflow calculating message size (offset = %u, size "
1940 "= %u)\n",
1941 header->offset, header->size);
1942 return ffa_error(FFA_INVALID_PARAMETERS);
1943 }
1944
1945 if (total_size > FFA_MSG_PAYLOAD_MAX) {
1946 dlog_error("Message is too big (%u > %zu)\n", total_size,
1947 FFA_MSG_PAYLOAD_MAX);
Karl Meakin355d5c22024-12-12 18:04:56 +00001948 return ffa_error(FFA_INVALID_PARAMETERS);
1949 }
1950
1951 /* Copy data. */
1952 if (!memcpy_trapped(receiver_vm->mailbox.recv, FFA_MSG_PAYLOAD_MAX,
1953 sender_tx_buffer, total_size)) {
1954 dlog_error(
Karl Meakina78337f2024-12-12 23:30:06 +00001955 "%s: Failed to copy message to receiver's (%x) RX "
Karl Meakin355d5c22024-12-12 18:04:56 +00001956 "buffer.\n",
1957 __func__, receiver_vm->id);
1958 return ffa_error(FFA_ABORTED);
1959 }
1960
1961 receiver_vm->mailbox.recv_size = total_size;
1962 receiver_vm->mailbox.recv_sender = header->sender;
1963 receiver_vm->mailbox.recv_func = FFA_MSG_SEND2_32;
1964 receiver_vm->mailbox.state = MAILBOX_STATE_FULL;
1965
1966 return (struct ffa_value){.func = FFA_SUCCESS_32};
1967}
1968
Daniel Boulby9e420ca2021-07-07 15:03:49 +01001969/**
Federico Recanati25053ee2022-03-14 15:01:53 +01001970 * Copies data from the sender's send buffer to the recipient's receive buffer
1971 * and notifies the receiver.
1972 */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00001973struct ffa_value api_ffa_msg_send2(ffa_id_t sender_id, uint32_t flags,
Federico Recanati25053ee2022-03-14 15:01:53 +01001974 struct vcpu *current)
1975{
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00001976 struct vm *current_vm = current->vm;
1977 struct vm *receiver_vm;
1978 struct vm_locked receiver_locked;
Federico Recanati25053ee2022-03-14 15:01:53 +01001979 struct vm_locked sender_locked;
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00001980 const void *sender_tx_buffer;
Federico Recanati25053ee2022-03-14 15:01:53 +01001981 struct ffa_value ret;
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00001982 ffa_id_t header_sender_id;
1983 ffa_id_t header_receiver_id;
Federico Recanati25053ee2022-03-14 15:01:53 +01001984
Karl Meakina5ea9092024-05-28 15:40:33 +01001985 alignas(8) struct ffa_partition_rxtx_header header;
1986
Federico Recanati25053ee2022-03-14 15:01:53 +01001987 /* Only Hypervisor can set `sender_vm_id` when forwarding messages. */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00001988 if (current_vm->id != HF_HYPERVISOR_VM_ID && sender_id != 0) {
Federico Recanati25053ee2022-03-14 15:01:53 +01001989 dlog_error("Sender VM ID must be zero.\n");
1990 return ffa_error(FFA_INVALID_PARAMETERS);
1991 }
1992
Federico Recanati25053ee2022-03-14 15:01:53 +01001993 /*
1994 * Get message sender's mailbox, which can be different to the `from` vm
1995 * when the message is forwarded.
1996 */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00001997 sender_id = (sender_id != 0) ? sender_id : current_vm->id;
1998 sender_locked = ffa_vm_find_locked(sender_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01001999 if (sender_locked.vm == NULL) {
2000 dlog_error("Cannot send message from VM ID %#x, not found.\n",
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002001 sender_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01002002 return ffa_error(FFA_DENIED);
2003 }
2004
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002005 sender_tx_buffer = sender_locked.vm->mailbox.send;
2006 if (sender_tx_buffer == NULL) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002007 dlog_error("Cannot retrieve TX buffer for VM ID %#x.\n",
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002008 sender_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01002009 ret = ffa_error(FFA_DENIED);
2010 goto out_unlock_sender;
2011 }
2012
2013 /*
2014 * Copy message header as safety measure to avoid multiple accesses to
2015 * unsafe memory which could be 'corrupted' between safety checks and
2016 * final buffer copy.
Karl Meakina78337f2024-12-12 23:30:06 +00002017 * This includes the UUID added in v1.2. Messages that do not specify a
2018 * UUID (v1.1 or earlier) will leave the UUID unspecified, so this is
2019 * backwards compatible.
Federico Recanati25053ee2022-03-14 15:01:53 +01002020 */
Karl Meakinbf580c22024-12-12 14:31:06 +00002021 if (!memcpy_trapped(&header, sizeof(header), sender_tx_buffer,
J-Alves8a5fd9d2024-04-09 11:22:49 +01002022 FFA_RXTX_HEADER_SIZE)) {
2023 dlog_error(
2024 "%s: Failed to copy message from sender's(%x) TX "
2025 "buffer.\n",
2026 __func__, sender_locked.vm->id);
2027 ret = ffa_error(FFA_ABORTED);
2028 goto out_unlock_sender;
2029 }
2030
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002031 header_sender_id = header.sender;
2032 header_receiver_id = header.receiver;
Federico Recanati25053ee2022-03-14 15:01:53 +01002033
2034 /* Ensure Sender IDs from API and from message header match. */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002035 if (sender_id != header_sender_id) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002036 dlog_error(
2037 "Message sender VM ID (%#x) doesn't match header's VM "
2038 "ID (%#x).\n",
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002039 sender_id, header_sender_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01002040 ret = ffa_error(FFA_INVALID_PARAMETERS);
2041 goto out_unlock_sender;
2042 }
2043
2044 /* Disallow reflexive requests as this suggests an error in the VM. */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002045 if (header_receiver_id == header_sender_id) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002046 dlog_error("Sender and receive VM IDs must be different.\n");
2047 ret = ffa_error(FFA_INVALID_PARAMETERS);
2048 goto out_unlock_sender;
2049 }
2050
Federico Recanati7b39ff22022-03-14 15:01:53 +01002051 /* `flags` can be set only at secure virtual FF-A instances. */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002052 if (ffa_is_vm_id(header_sender_id) && flags != 0) {
Federico Recanati7b39ff22022-03-14 15:01:53 +01002053 dlog_error("flags must be zero.\n");
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002054 ret = ffa_error(FFA_INVALID_PARAMETERS);
2055 goto out_unlock_sender;
Federico Recanati7b39ff22022-03-14 15:01:53 +01002056 }
2057
Federico Recanati25053ee2022-03-14 15:01:53 +01002058 /*
2059 * Check if the message has to be forwarded to the SPMC, in
2060 * this case return, the SPMC will handle the buffer copy.
2061 */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002062 if (ffa_indirect_msg_send2_forward(header_receiver_id, header_sender_id,
2063 &ret)) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002064 goto out_unlock_sender;
2065 }
2066
2067 /* Ensure the receiver VM exists. */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002068 receiver_locked = ffa_vm_find_locked(header_receiver_id);
2069 receiver_vm = receiver_locked.vm;
Federico Recanati25053ee2022-03-14 15:01:53 +01002070
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002071 if (receiver_vm == NULL) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002072 dlog_error("Cannot deliver message to VM %#x, not found.\n",
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002073 header_receiver_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01002074 ret = ffa_error(FFA_INVALID_PARAMETERS);
2075 goto out_unlock_sender;
2076 }
2077
2078 /*
2079 * Check sender and receiver can use indirect messages.
2080 * Sender is the VM/SP who originally sent the message, not the
2081 * hypervisor possibly relaying it.
2082 */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002083 if (!ffa_indirect_msg_is_supported(sender_locked, receiver_locked)) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002084 dlog_verbose("VM %#x doesn't support indirect message\n",
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002085 header_sender_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01002086 ret = ffa_error(FFA_DENIED);
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002087 goto out_unlock_both;
Federico Recanati25053ee2022-03-14 15:01:53 +01002088 }
2089
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002090 if (vm_is_mailbox_busy(receiver_locked)) {
Federico Recanati25053ee2022-03-14 15:01:53 +01002091 dlog_error(
2092 "Cannot deliver message to VM %#x, RX buffer not "
2093 "ready.\n",
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002094 header_receiver_id);
Federico Recanati25053ee2022-03-14 15:01:53 +01002095 ret = ffa_error(FFA_BUSY);
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002096 goto out_unlock_both;
Federico Recanati25053ee2022-03-14 15:01:53 +01002097 }
2098
Federico Recanati644f0462022-03-17 12:04:00 +01002099 /* Acquire receiver's RX buffer. */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002100 if (!ffa_setup_acquire_receiver_rx(receiver_locked, &ret)) {
2101 dlog_error("Failed to acquire RX buffer for VM %#x\n",
2102 receiver_vm->id);
2103 goto out_unlock_both;
Federico Recanati644f0462022-03-17 12:04:00 +01002104 }
2105
Karl Meakina78337f2024-12-12 23:30:06 +00002106 ret = api_ffa_msg_send2_copy_data(&header, receiver_vm, sender_locked);
Karl Meakin355d5c22024-12-12 18:04:56 +00002107 if (ret.func != FFA_SUCCESS_32) {
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002108 goto out_unlock_both;
Federico Recanati25053ee2022-03-14 15:01:53 +01002109 }
2110
J-Alves3bb82592023-01-23 11:20:54 +00002111 /*
2112 * Set framework notifications, only if the SP has enabled
2113 * receipt of notifications.
2114 * If VMs have provided the RX buffer it is implied they already
2115 * support indirect messaging, and therefore framework notifications.
2116 */
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002117 if (ffa_is_vm_id(receiver_locked.vm->id) ||
2118 vm_are_notifications_enabled(receiver_locked.vm)) {
J-Alves3bb82592023-01-23 11:20:54 +00002119 ffa_notifications_bitmap_t rx_buffer_full =
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002120 ffa_is_vm_id(header_sender_id)
J-Alves3bb82592023-01-23 11:20:54 +00002121 ? FFA_NOTIFICATION_HYP_BUFFER_FULL_MASK
2122 : FFA_NOTIFICATION_SPM_BUFFER_FULL_MASK;
Federico Recanati25053ee2022-03-14 15:01:53 +01002123
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002124 vm_notifications_framework_set_pending(receiver_locked,
J-Alves3bb82592023-01-23 11:20:54 +00002125 rx_buffer_full);
2126
2127 if ((FFA_NOTIFICATIONS_FLAG_DELAY_SRI & flags) == 0) {
2128 dlog_verbose("SRI was NOT delayed. vcpu: %u!\n",
2129 vcpu_index(current));
Karl Meakin117c8082024-12-04 16:03:28 +00002130 ffa_notifications_sri_trigger_not_delayed(current->cpu);
J-Alves3bb82592023-01-23 11:20:54 +00002131 } else {
Karl Meakin117c8082024-12-04 16:03:28 +00002132 ffa_notifications_sri_set_delayed(current->cpu);
J-Alves3bb82592023-01-23 11:20:54 +00002133 }
Federico Recanati25053ee2022-03-14 15:01:53 +01002134 }
2135
2136 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
2137
Karl Meakin8e3d7bc2024-12-12 15:52:19 +00002138out_unlock_both:
2139 vm_unlock(&receiver_locked);
Federico Recanati25053ee2022-03-14 15:01:53 +01002140
2141out_unlock_sender:
2142 vm_unlock(&sender_locked);
2143
2144 return ret;
2145}
2146
2147/**
Andrew Walbran8a0f5ca2019-11-05 13:12:23 +00002148 * Releases the caller's mailbox so that a new message can be received. The
2149 * caller must have copied out all data they wish to preserve as new messages
2150 * will overwrite the old and will arrive asynchronously.
Wedson Almeida Filhoea62e2e2019-01-09 19:14:59 +00002151 *
2152 * Returns:
Federico Recanati7bef0b92022-03-17 14:56:22 +01002153 * - FFA_ERROR FFA_INVALID_PARAMETERS if message is forwarded to SPMC but
2154 * there's no buffer pair mapped.
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002155 * - FFA_ERROR FFA_DENIED on failure, if the mailbox hasn't been read.
2156 * - FFA_SUCCESS on success if no further action is needed.
2157 * - FFA_RX_RELEASE if it was called by the primary VM and the primary VM now
Andrew Walbran8a0f5ca2019-11-05 13:12:23 +00002158 * needs to wake up or kick waiters. Waiters should be retrieved by calling
Wedson Almeida Filhoea62e2e2019-01-09 19:14:59 +00002159 * hf_mailbox_waiter_get.
2160 */
J-Alves19e20cf2023-08-02 12:48:55 +01002161struct ffa_value api_ffa_rx_release(ffa_id_t receiver_id, struct vcpu *current)
Wedson Almeida Filhoea62e2e2019-01-09 19:14:59 +00002162{
Federico Recanati7bef0b92022-03-17 14:56:22 +01002163 struct vm *current_vm = current->vm;
2164 struct vm *vm;
2165 struct vm_locked vm_locked;
J-Alves19e20cf2023-08-02 12:48:55 +01002166 ffa_id_t current_vm_id = current_vm->id;
2167 ffa_id_t release_vm_id;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002168 struct ffa_value ret;
Wedson Almeida Filhoea62e2e2019-01-09 19:14:59 +00002169
Federico Recanati7bef0b92022-03-17 14:56:22 +01002170 /* `receiver_id` can be set only at Non-Secure Physical interface. */
2171 if (vm_id_is_current_world(current_vm_id) && (receiver_id != 0)) {
2172 dlog_error("Invalid `receiver_id`, must be zero.\n");
2173 return ffa_error(FFA_INVALID_PARAMETERS);
2174 }
2175
2176 /*
2177 * VM ID to be released: `receiver_id` if message has been forwarded by
2178 * Hypervisor to release a VM's buffer, current VM ID otherwise.
2179 */
2180 if (vm_id_is_current_world(current_vm_id) || (receiver_id == 0)) {
2181 release_vm_id = current_vm_id;
2182 } else {
2183 release_vm_id = receiver_id;
2184 }
2185
Karl Meakin117c8082024-12-04 16:03:28 +00002186 vm_locked = ffa_vm_find_locked(release_vm_id);
Federico Recanati7bef0b92022-03-17 14:56:22 +01002187 vm = vm_locked.vm;
2188 if (vm == NULL) {
2189 dlog_error("No buffer registered for VM ID %#x.\n",
2190 release_vm_id);
2191 return ffa_error(FFA_INVALID_PARAMETERS);
2192 }
2193
Karl Meakin117c8082024-12-04 16:03:28 +00002194 if (ffa_setup_rx_release_forward(vm_locked, &ret)) {
Federico Recanati7bef0b92022-03-17 14:56:22 +01002195 goto out;
2196 }
2197
Karl Meakin1064a9c2024-06-04 17:20:43 +01002198 ret = api_release_mailbox(vm_locked);
Federico Recanati7bef0b92022-03-17 14:56:22 +01002199
2200out:
2201 vm_unlock(&vm_locked);
Wedson Almeida Filho2f94ec12018-07-26 16:00:48 +01002202
2203 return ret;
Wedson Almeida Filho3fcbcff2018-07-10 23:53:39 +01002204}
Andrew Walbran318f5732018-11-20 16:23:42 +00002205
2206/**
Federico Recanati644f0462022-03-17 12:04:00 +01002207 * Acquire ownership of an RX buffer before writing to it. Both
2208 * Hypervisor and SPMC are producers of VM's RX buffer, and they
2209 * could contend for the same buffer. SPMC owns VM's RX buffer after
2210 * it's mapped in its translation regime. This ABI should be
2211 * used by the Hypervisor to get the ownership of a VM's RX buffer
2212 * from the SPMC solving the aforementioned possible contention.
2213 *
2214 * Returns:
2215 * - FFA_DENIED: callee cannot relinquish ownership of RX buffer.
2216 * - FFA_INVALID_PARAMETERS: there is no buffer pair registered for the VM.
2217 * - FFA_NOT_SUPPORTED: function not implemented at the FF-A instance.
2218 */
J-Alves19e20cf2023-08-02 12:48:55 +01002219struct ffa_value api_ffa_rx_acquire(ffa_id_t receiver_id, struct vcpu *current)
Federico Recanati644f0462022-03-17 12:04:00 +01002220{
2221 struct vm_locked receiver_locked;
2222 struct vm *receiver;
2223 struct ffa_value ret;
2224
2225 if ((current->vm->id != HF_HYPERVISOR_VM_ID) ||
J-Alves661e1b72023-08-02 13:39:40 +01002226 !ffa_is_vm_id(receiver_id)) {
Federico Recanati644f0462022-03-17 12:04:00 +01002227 dlog_error(
2228 "FFA_RX_ACQUIRE not supported at this FF-A "
2229 "instance.\n");
2230 return ffa_error(FFA_NOT_SUPPORTED);
2231 }
2232
Karl Meakin117c8082024-12-04 16:03:28 +00002233 receiver_locked = ffa_vm_find_locked(receiver_id);
Federico Recanati644f0462022-03-17 12:04:00 +01002234 receiver = receiver_locked.vm;
2235
2236 if (receiver == NULL || receiver->mailbox.recv == NULL) {
2237 dlog_error("Cannot retrieve RX buffer for VM ID %#x.\n",
2238 receiver_id);
2239 ret = ffa_error(FFA_INVALID_PARAMETERS);
2240 goto out;
2241 }
2242
2243 if (receiver->mailbox.state != MAILBOX_STATE_EMPTY) {
2244 dlog_error("Mailbox busy for VM ID %#x.\n", receiver_id);
2245 ret = ffa_error(FFA_DENIED);
2246 goto out;
2247 }
2248
J-Alvese8c8c2b2022-12-16 15:34:48 +00002249 receiver->mailbox.state = MAILBOX_STATE_OTHER_WORLD_OWNED;
Federico Recanati644f0462022-03-17 12:04:00 +01002250
2251 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
2252
2253out:
2254 vm_unlock(&receiver_locked);
2255
2256 return ret;
2257}
2258
J-Alvescc542042024-07-24 19:13:22 +01002259/*
2260 * Returns true if intid relates with either of those:
2261 * - NPI
2262 * - ME
2263 * - Virtual Timer.
Daniel Boulbyf3cf28c2024-08-22 10:46:23 +01002264 * - IPI
J-Alvescc542042024-07-24 19:13:22 +01002265 *
2266 * These are VIs with no expected interrupt descriptor.
2267 */
2268static bool api_is_maintenance_virtual_interrupt(uint32_t intid)
2269{
2270 return intid == HF_NOTIFICATION_PENDING_INTID ||
2271 intid == HF_MANAGED_EXIT_INTID ||
Daniel Boulbyf3cf28c2024-08-22 10:46:23 +01002272 intid == HF_VIRTUAL_TIMER_INTID || intid == HF_IPI_INTID;
J-Alvescc542042024-07-24 19:13:22 +01002273}
2274
Federico Recanati644f0462022-03-17 12:04:00 +01002275/**
Andrew Walbran318f5732018-11-20 16:23:42 +00002276 * Enables or disables a given interrupt ID for the calling vCPU.
2277 *
2278 * Returns 0 on success, or -1 if the intid is invalid.
2279 */
Manish Pandey35e452f2021-02-18 21:36:34 +00002280int64_t api_interrupt_enable(uint32_t intid, bool enable,
2281 enum interrupt_type type, struct vcpu *current)
Andrew Walbran318f5732018-11-20 16:23:42 +00002282{
Manish Pandey35e452f2021-02-18 21:36:34 +00002283 struct vcpu_locked current_locked;
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002284 struct interrupts *interrupts = &current->interrupts;
J-Alvescc542042024-07-24 19:13:22 +01002285 struct interrupt_descriptor *int_desc = NULL;
2286 struct vm *vm = current->vm;
2287 struct vm_locked vm_locked;
2288
2289 int64_t ret = -1;
Wedson Almeida Filho81568c42019-01-04 13:33:02 +00002290
Andrew Walbran318f5732018-11-20 16:23:42 +00002291 if (intid >= HF_NUM_INTIDS) {
2292 return -1;
2293 }
2294
J-Alvescc542042024-07-24 19:13:22 +01002295 vm_locked = vm_lock(vm);
Manish Pandey35e452f2021-02-18 21:36:34 +00002296 current_locked = vcpu_lock(current);
J-Alvescc542042024-07-24 19:13:22 +01002297
2298 int_desc = vm_interrupt_set_enable(vm_locked, intid, enable);
2299
2300 if (!api_is_maintenance_virtual_interrupt(intid)) {
2301 if (int_desc == NULL) {
2302 dlog_error("%s: invalid interrupt ID.\n", __func__);
2303 goto out;
2304 }
2305
2306 plat_interrupts_configure_interrupt(*int_desc);
2307 }
2308
Andrew Walbran318f5732018-11-20 16:23:42 +00002309 if (enable) {
Andrew Walbran3d84a262018-12-13 14:41:19 +00002310 /*
2311 * If it is pending and was not enabled before, increment the
2312 * count.
2313 */
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002314 if (vcpu_is_virt_interrupt_pending(interrupts, intid) &&
2315 !vcpu_is_virt_interrupt_enabled(interrupts, intid)) {
2316 vcpu_interrupt_count_increment(current_locked,
2317 interrupts, intid);
Andrew Walbran3d84a262018-12-13 14:41:19 +00002318 }
J-Alvescc542042024-07-24 19:13:22 +01002319
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002320 vcpu_virt_interrupt_set_enabled(interrupts, intid);
2321 vcpu_virt_interrupt_set_type(interrupts, intid, type);
Andrew Walbran318f5732018-11-20 16:23:42 +00002322 } else {
Andrew Walbran3d84a262018-12-13 14:41:19 +00002323 /*
2324 * If it is pending and was enabled before, decrement the count.
2325 */
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002326 if (vcpu_is_virt_interrupt_pending(interrupts, intid) &&
2327 vcpu_is_virt_interrupt_enabled(interrupts, intid)) {
2328 vcpu_interrupt_count_decrement(current_locked,
2329 interrupts, intid);
Andrew Walbran3d84a262018-12-13 14:41:19 +00002330 }
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002331 vcpu_virt_interrupt_clear_enabled(interrupts, intid);
2332 vcpu_virt_interrupt_set_type(interrupts, intid,
2333 INTERRUPT_TYPE_IRQ);
Andrew Walbran318f5732018-11-20 16:23:42 +00002334 }
2335
J-Alvescc542042024-07-24 19:13:22 +01002336 ret = 0;
2337
2338out:
2339 vm_unlock(&vm_locked);
Manish Pandey35e452f2021-02-18 21:36:34 +00002340 vcpu_unlock(&current_locked);
J-Alvescc542042024-07-24 19:13:22 +01002341
2342 return ret;
Andrew Walbran318f5732018-11-20 16:23:42 +00002343}
2344
2345/**
2346 * Returns the ID of the next pending interrupt for the calling vCPU, and
2347 * acknowledges it (i.e. marks it as no longer pending). Returns
2348 * HF_INVALID_INTID if there are no pending interrupts.
2349 */
Madhukar Pappireddyc64d0642024-08-07 16:55:46 -05002350uint32_t api_interrupt_get(struct vcpu_locked current_locked)
Andrew Walbran318f5732018-11-20 16:23:42 +00002351{
Raghu Krishnamurthy61a025b2022-07-20 08:37:04 -07002352 uint32_t i;
Andrew Walbran318f5732018-11-20 16:23:42 +00002353 uint32_t first_interrupt = HF_INVALID_INTID;
Madhukar Pappireddyc64d0642024-08-07 16:55:46 -05002354 struct interrupts *interrupts = &current_locked.vcpu->interrupts;
Andrew Walbran318f5732018-11-20 16:23:42 +00002355
2356 /*
2357 * Find the first enabled and pending interrupt ID, return it, and
2358 * deactivate it.
2359 */
Andrew Walbran318f5732018-11-20 16:23:42 +00002360 for (i = 0; i < HF_NUM_INTIDS / INTERRUPT_REGISTER_BITS; ++i) {
2361 uint32_t enabled_and_pending =
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002362 interrupts->interrupt_enabled.bitmap[i] &
2363 interrupts->interrupt_pending.bitmap[i];
Wedson Almeida Filho81568c42019-01-04 13:33:02 +00002364
Andrew Walbran318f5732018-11-20 16:23:42 +00002365 if (enabled_and_pending != 0) {
Andrew Walbran3d84a262018-12-13 14:41:19 +00002366 uint8_t bit_index = ctz(enabled_and_pending);
Daniel Boulby4ca50f02022-07-29 18:29:34 +01002367
2368 first_interrupt =
2369 i * INTERRUPT_REGISTER_BITS + bit_index;
Manish Pandey35e452f2021-02-18 21:36:34 +00002370
Andrew Walbran3d84a262018-12-13 14:41:19 +00002371 /*
2372 * Mark it as no longer pending and decrement the count.
2373 */
J-Alvesb8730e92024-08-07 18:28:55 +01002374 vcpu_interrupt_clear_decrement(current_locked,
2375 first_interrupt);
Andrew Walbran318f5732018-11-20 16:23:42 +00002376 break;
2377 }
2378 }
Andrew Walbran318f5732018-11-20 16:23:42 +00002379
Andrew Walbran318f5732018-11-20 16:23:42 +00002380 return first_interrupt;
2381}
2382
2383/**
Karl Meakin6eeec8e2024-03-07 18:07:20 +00002384 * Negotiate the FF-A version to be used for this FF-A instance.
2385 * See section 13.2 of the FF-A v1.2 ALP1 spec.
2386 *
2387 * Returns Hafnium's version number (`FFA_VERSION_COMPILED`) on success.
2388 * Returns `FFA_NOT_SUPPORTED` on error:
2389 * - The version is invalid (highest bit set).
2390 * - The requested version is incompatible.
2391 * - The version has already been negotiated and cannot be changed.
2392 */
Daniel Boulbybaeaf2e2021-12-09 11:42:36 +00002393struct ffa_value api_ffa_version(struct vcpu *current,
Karl Meakin0e617d92024-04-05 12:55:22 +01002394 enum ffa_version requested_version)
Jose Marinhofc0b2b62019-06-06 11:18:45 +01002395{
Karl Meakin0e617d92024-04-05 12:55:22 +01002396 static_assert(sizeof(enum ffa_version) == 4,
2397 "enum ffa_version must be 4 bytes wide");
2398
Karl Meakin6eeec8e2024-03-07 18:07:20 +00002399 const struct ffa_value error = {.func = (uint32_t)FFA_NOT_SUPPORTED};
Daniel Boulbybaeaf2e2021-12-09 11:42:36 +00002400 struct vm_locked current_vm_locked;
2401
Karl Meakin0e617d92024-04-05 12:55:22 +01002402 if (!ffa_version_is_valid(requested_version)) {
2403 dlog_error(
2404 "FFA_VERSION: requested version %#x is invalid "
2405 "(highest bit must be zero)\n",
2406 requested_version);
Karl Meakin6eeec8e2024-03-07 18:07:20 +00002407 return error;
Andrew Walbran9fd29072020-04-22 12:12:14 +01002408 }
Jose Marinhofc0b2b62019-06-06 11:18:45 +01002409
Karl Meakin0e617d92024-04-05 12:55:22 +01002410 if (!ffa_versions_are_compatible(requested_version,
2411 FFA_VERSION_COMPILED)) {
Karl Meakin6eeec8e2024-03-07 18:07:20 +00002412 dlog_error(
2413 "FFA_VERSION: requested version v%u.%u is not "
2414 "compatible with v%u.%u\n",
2415 ffa_version_get_major(requested_version),
2416 ffa_version_get_minor(requested_version),
2417 ffa_version_get_major(FFA_VERSION_COMPILED),
2418 ffa_version_get_minor(FFA_VERSION_COMPILED));
2419 return error;
J-Alves3cc9d6f2023-07-20 16:46:15 +01002420 }
2421
Daniel Boulbybaeaf2e2021-12-09 11:42:36 +00002422 current_vm_locked = vm_lock(current->vm);
Karl Meakin6eeec8e2024-03-07 18:07:20 +00002423
2424 if (current_vm_locked.vm->ffa_version_negotiated &&
2425 requested_version != current_vm_locked.vm->ffa_version) {
2426 vm_unlock(&current_vm_locked);
2427 dlog_error(
2428 "FFA_VERSION: Cannot change FF-A version after other "
2429 "FF-A calls have been made\n");
2430 return error;
2431 }
2432
Daniel Boulbybaeaf2e2021-12-09 11:42:36 +00002433 current_vm_locked.vm->ffa_version = requested_version;
2434 vm_unlock(&current_vm_locked);
2435
Karl Meakin6eeec8e2024-03-07 18:07:20 +00002436 return (struct ffa_value){.func = (uint32_t)FFA_VERSION_COMPILED};
Jose Marinhofc0b2b62019-06-06 11:18:45 +01002437}
Andrew Walbranc1ad4ce2019-05-09 11:41:39 +01002438
Jose Marinhoc0f4ff22019-10-09 10:37:42 +01002439/**
Karl Meakin49ec1e42024-05-10 13:08:24 +01002440 * Helper for success return of FFA_FEATURES.
J-Alves6f72ca82021-11-01 12:34:58 +00002441 */
2442struct ffa_value api_ffa_feature_success(uint32_t arg2)
2443{
2444 return (struct ffa_value){
Karl Meakin49ec1e42024-05-10 13:08:24 +01002445 .func = FFA_SUCCESS_32,
2446 .arg1 = 0U,
2447 .arg2 = arg2,
2448 };
J-Alves6f72ca82021-11-01 12:34:58 +00002449}
2450
Karl Meakin9c5b1d32024-06-24 12:10:36 +01002451static struct ffa_value ffa_features_function(uint32_t func,
2452 uint32_t input_property,
2453 struct vcpu *current)
Jose Marinhoc0f4ff22019-10-09 10:37:42 +01002454{
Karl Meakin0e617d92024-04-05 12:55:22 +01002455 const enum ffa_version ffa_version = current->vm->ffa_version;
Karl Meakinf1ed5f12024-02-22 15:57:36 +00002456 const bool el0_partition = current->vm->el0_partition;
2457
Karl Meakin9c5b1d32024-06-24 12:10:36 +01002458 switch (func) {
J-Alves6f72ca82021-11-01 12:34:58 +00002459 /* Check support of the given Function ID. */
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002460 case FFA_ERROR_32:
2461 case FFA_SUCCESS_32:
2462 case FFA_INTERRUPT_32:
2463 case FFA_VERSION_32:
2464 case FFA_FEATURES_32:
2465 case FFA_RX_RELEASE_32:
Daniel Boulby9e420ca2021-07-07 15:03:49 +01002466 case FFA_RXTX_UNMAP_32:
Fuad Tabbae4efcc32020-07-16 15:37:27 +01002467 case FFA_PARTITION_INFO_GET_32:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002468 case FFA_ID_GET_32:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002469 case FFA_MSG_WAIT_32:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002470 case FFA_RUN_32:
J-Alves95fbb312024-03-20 15:19:16 +00002471 case FFA_MEM_DONATE_64:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002472 case FFA_MEM_DONATE_32:
2473 case FFA_MEM_LEND_32:
J-Alves95fbb312024-03-20 15:19:16 +00002474 case FFA_MEM_LEND_64:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002475 case FFA_MEM_SHARE_32:
J-Alves95fbb312024-03-20 15:19:16 +00002476 case FFA_MEM_SHARE_64:
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01002477 case FFA_MEM_RETRIEVE_RESP_32:
2478 case FFA_MEM_RELINQUISH_32:
2479 case FFA_MEM_RECLAIM_32:
J-Alvesff676c12022-05-13 17:25:33 +01002480 case FFA_MEM_FRAG_RX_32:
2481 case FFA_MEM_FRAG_TX_32:
J-Alvesbc3de8b2020-12-07 14:32:04 +00002482 case FFA_MSG_SEND_DIRECT_RESP_64:
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002483 case FFA_MSG_SEND_DIRECT_RESP_32:
J-Alvesbc3de8b2020-12-07 14:32:04 +00002484 case FFA_MSG_SEND_DIRECT_REQ_64:
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002485 case FFA_MSG_SEND_DIRECT_REQ_32:
Karl Meakin0e617d92024-04-05 12:55:22 +01002486
Daniel Boulbyb2fb80e2021-02-03 15:09:23 +00002487 /* FF-A v1.1 features. */
2488 case FFA_SPM_ID_GET_32:
J-Alves6f72ca82021-11-01 12:34:58 +00002489 case FFA_NOTIFICATION_BITMAP_CREATE_32:
2490 case FFA_NOTIFICATION_BITMAP_DESTROY_32:
2491 case FFA_NOTIFICATION_BIND_32:
2492 case FFA_NOTIFICATION_UNBIND_32:
2493 case FFA_NOTIFICATION_SET_32:
2494 case FFA_NOTIFICATION_GET_32:
2495 case FFA_NOTIFICATION_INFO_GET_64:
Federico Recanati25053ee2022-03-14 15:01:53 +01002496 case FFA_MSG_SEND2_32:
Karl Meakin0e617d92024-04-05 12:55:22 +01002497 if (FFA_VERSION_1_1 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002498 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002499 }
2500
Kathleen Capellae4fe2962023-09-01 17:08:47 -04002501 /* FF-A v1.2 features. */
2502 case FFA_CONSOLE_LOG_32:
2503 case FFA_CONSOLE_LOG_64:
Raghu Krishnamurthy7592bcb2022-12-25 13:09:00 -08002504 case FFA_PARTITION_INFO_GET_REGS_64:
Kathleen Capella41fea932023-06-23 17:39:28 -04002505 case FFA_MSG_SEND_DIRECT_REQ2_64:
Kathleen Capella087e5022023-09-07 18:04:15 -04002506 case FFA_MSG_SEND_DIRECT_RESP2_64:
Karl Meakin0e617d92024-04-05 12:55:22 +01002507 if (FFA_VERSION_1_2 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002508 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002509 }
2510
Karl Meakin49ec1e42024-05-10 13:08:24 +01002511 return api_ffa_feature_success(0);
2512
Karl Meakin5a222642024-06-20 10:23:37 +01002513 /* These functions are only supported on S-EL0 partitions. */
2514 case FFA_MEM_PERM_GET_32:
2515 case FFA_MEM_PERM_SET_32:
2516 case FFA_MEM_PERM_GET_64:
2517 case FFA_MEM_PERM_SET_64:
2518 if (!(vm_id_is_current_world(current->vm->id) &&
2519 el0_partition)) {
2520 dlog_verbose(
2521 "FFA_FEATURE: %s is only supported on S-EL0 "
2522 "partitions\n",
Karl Meakin9c5b1d32024-06-24 12:10:36 +01002523 ffa_func_name(func));
Karl Meakin5a222642024-06-20 10:23:37 +01002524 return ffa_error(FFA_NOT_SUPPORTED);
2525 }
2526 return api_ffa_feature_success(0);
2527
Karl Meakin1a8c0cd2024-06-20 10:26:12 +01002528 case FFA_SECONDARY_EP_REGISTER_64:
2529 if (FFA_VERSION_COMPILED < FFA_VERSION_1_1) {
2530 return ffa_error(FFA_NOT_SUPPORTED);
2531 }
2532
2533 if (!(vm_id_is_current_world(current->vm->id) &&
2534 current->vm->vcpu_count > 1)) {
2535 dlog_verbose(
2536 "FFA_FEATURE: %s is only supported on SPs with "
2537 "more than 1 vCPU\n",
Karl Meakin9c5b1d32024-06-24 12:10:36 +01002538 ffa_func_name(func));
Karl Meakin1a8c0cd2024-06-20 10:26:12 +01002539 return ffa_error(FFA_NOT_SUPPORTED);
2540 }
2541 return api_ffa_feature_success(0);
2542
Karl Meakin650cb142024-06-20 10:31:57 +01002543 /*
2544 * This function is restricted to the secure virtual FF-A instance (i.e.
2545 * only report success to SPs).
2546 */
2547 case FFA_YIELD_32:
2548 if (!vm_id_is_current_world(current->vm->id)) {
2549 dlog_verbose(
2550 "FFA_FEATURES: %s is only supported at secure "
2551 "virtual FF-A instance\n",
2552 ffa_func_name(FFA_YIELD_32));
2553 return ffa_error(FFA_NOT_SUPPORTED);
2554 }
2555 return api_ffa_feature_success(0);
2556
Karl Meakin0fd67292024-02-06 17:33:05 +00002557 case FFA_RXTX_MAP_64: {
Karl Meakin0e617d92024-04-05 12:55:22 +01002558 if (FFA_VERSION_1_2 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002559 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002560 }
2561
Karl Meakin0fd67292024-02-06 17:33:05 +00002562 uint32_t arg2 = 0;
2563 struct ffa_features_rxtx_map_params params = {
2564 .min_buf_size = FFA_RXTX_MAP_MIN_BUF_4K,
2565 .mbz = 0,
2566 .max_buf_size =
Karl Meakin0e617d92024-04-05 12:55:22 +01002567 (ffa_version >= FFA_VERSION_1_2)
Karl Meakin0fd67292024-02-06 17:33:05 +00002568 ? FFA_RXTX_MAP_MAX_BUF_PAGE_COUNT
2569 : 0,
2570 };
2571
2572 memcpy_s(&arg2, sizeof(arg2), &params, sizeof(params));
Karl Meakin49ec1e42024-05-10 13:08:24 +01002573 return api_ffa_feature_success(arg2);
Karl Meakin0fd67292024-02-06 17:33:05 +00002574 }
2575
J-Alves95fbb312024-03-20 15:19:16 +00002576 case FFA_MEM_RETRIEVE_REQ_64:
Karl Meakin49ec1e42024-05-10 13:08:24 +01002577 case FFA_MEM_RETRIEVE_REQ_32: {
Karl Meakin0e617d92024-04-05 12:55:22 +01002578 if (FFA_VERSION_1_2 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002579 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002580 }
2581
Karl Meakin49ec1e42024-05-10 13:08:24 +01002582 if (ANY_BITS_SET(input_property,
2583 FFA_FEATURES_MEM_RETRIEVE_REQ_MBZ_HI_BIT,
2584 FFA_FEATURES_MEM_RETRIEVE_REQ_MBZ_LO_BIT) ||
2585 IS_BIT_SET(input_property,
2586 FFA_FEATURES_MEM_RETRIEVE_REQ_MBZ_BIT)) {
2587 dlog_warning(
2588 "FFA_FEATURES: Bits[%u:%u] and Bit[%u] of "
2589 "input_property should be 0 (input_property = "
2590 "%#x)\n",
2591 FFA_FEATURES_MEM_RETRIEVE_REQ_MBZ_HI_BIT,
2592 FFA_FEATURES_MEM_RETRIEVE_REQ_MBZ_LO_BIT,
2593 FFA_FEATURES_MEM_RETRIEVE_REQ_MBZ_BIT,
Karl Meakin34b8ae92023-01-13 13:33:07 +00002594 input_property);
Karl Meakin34b8ae92023-01-13 13:33:07 +00002595 }
2596
Karl Meakin0e617d92024-04-05 12:55:22 +01002597 if (ffa_version >= FFA_VERSION_1_1 &&
2598 (input_property &
2599 FFA_FEATURES_MEM_RETRIEVE_REQ_NS_SUPPORT) == 0U) {
Karl Meakin4e8e4792024-07-05 16:28:42 +01002600 dlog_verbose(
2601 "FFA_FEATURES: NS bit support must be 1\n");
Karl Meakin6fd6c1d2024-05-13 12:09:13 +01002602 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin34b8ae92023-01-13 13:33:07 +00002603 }
2604
2605 return api_ffa_feature_success(
2606 FFA_FEATURES_MEM_RETRIEVE_REQ_BUFFER_SUPPORT |
Karl Meakin49ec1e42024-05-10 13:08:24 +01002607 FFA_FEATURES_MEM_RETRIEVE_REQ_NS_SUPPORT |
Karl Meakin34b8ae92023-01-13 13:33:07 +00002608 FFA_FEATURES_MEM_RETRIEVE_REQ_HYPERVISOR_SUPPORT);
Karl Meakin49ec1e42024-05-10 13:08:24 +01002609 }
J-Alves6f72ca82021-11-01 12:34:58 +00002610
Karl Meakin9c5b1d32024-06-24 12:10:36 +01002611 default:
2612 return ffa_error(FFA_NOT_SUPPORTED);
2613 }
2614}
2615
2616static struct ffa_value ffa_features_feature(enum ffa_feature_id feature,
2617 uint32_t input_property,
2618 struct vcpu *current)
2619{
2620 const bool el0_partition = current->vm->el0_partition;
2621
2622 if (ANY_BITS_SET(feature, FFA_FEATURES_FEATURE_MBZ_HI_BIT,
2623 FFA_FEATURES_FEATURE_MBZ_LO_BIT)) {
2624 dlog_verbose(
2625 "FFA_FEATURES: feature ID %#x is invalid (bits [%u:%u] "
2626 "must be zero)\n",
2627 feature, FFA_FEATURES_FEATURE_MBZ_HI_BIT,
2628 FFA_FEATURES_FEATURE_MBZ_LO_BIT);
2629 return ffa_error(FFA_NOT_SUPPORTED);
2630 }
2631 if (input_property != 0) {
2632 dlog_verbose(
2633 "FFA_FEATURES: input_property must be 0 "
2634 "(input_property = %#x)\n",
2635 input_property);
2636 return ffa_error(FFA_NOT_SUPPORTED);
2637 }
2638
2639 switch (feature) {
J-Alves6f72ca82021-11-01 12:34:58 +00002640 /* Check support of a feature provided respective feature ID. */
Karl Meakin17c9ad32024-04-12 16:41:00 +01002641
2642 /*
2643 * For NPI and MEI, report the IDs as supported only to partitions at
2644 * the virtual FF-A instances.
2645 */
J-Alves6f72ca82021-11-01 12:34:58 +00002646 case FFA_FEATURE_NPI:
Karl Meakin0e617d92024-04-05 12:55:22 +01002647 if (FFA_VERSION_1_2 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002648 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002649 }
2650
Karl Meakinf1ed5f12024-02-22 15:57:36 +00002651 if (el0_partition) {
2652 return ffa_error(FFA_NOT_SUPPORTED);
2653 }
Karl Meakin17c9ad32024-04-12 16:41:00 +01002654 if (!vm_id_is_current_world(current->vm->id)) {
2655 return ffa_error(FFA_NOT_SUPPORTED);
2656 }
J-Alves6f72ca82021-11-01 12:34:58 +00002657 return api_ffa_feature_success(HF_NOTIFICATION_PENDING_INTID);
Karl Meakin17c9ad32024-04-12 16:41:00 +01002658
2659 case FFA_FEATURE_MEI:
Karl Meakin0e617d92024-04-05 12:55:22 +01002660 if (FFA_VERSION_1_2 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002661 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002662 }
J-Alvesc4d9ae82024-05-14 10:15:03 +01002663 if (el0_partition) {
2664 return ffa_error(FFA_NOT_SUPPORTED);
2665 }
Karl Meakin17c9ad32024-04-12 16:41:00 +01002666 if (!vm_id_is_current_world(current->vm->id)) {
2667 return ffa_error(FFA_NOT_SUPPORTED);
2668 }
2669 return api_ffa_feature_success(HF_MANAGED_EXIT_INTID);
2670
J-Alves6f72ca82021-11-01 12:34:58 +00002671 case FFA_FEATURE_SRI:
Karl Meakin0e617d92024-04-05 12:55:22 +01002672 if (FFA_VERSION_1_2 > FFA_VERSION_COMPILED) {
Karl Meakin4271ff92024-05-13 12:33:15 +01002673 return ffa_error(FFA_NOT_SUPPORTED);
Karl Meakin0e617d92024-04-05 12:55:22 +01002674 }
2675
Karl Meakincb6642c2024-02-27 14:43:45 +00002676 if (!ffa_is_vm_id(current->vm->id)) {
2677 return ffa_error(FFA_NOT_SUPPORTED);
2678 }
J-Alves6f72ca82021-11-01 12:34:58 +00002679 return api_ffa_feature_success(HF_SCHEDULE_RECEIVER_INTID);
Karl Meakin0e617d92024-04-05 12:55:22 +01002680
J-Alves6f72ca82021-11-01 12:34:58 +00002681 /* Platform specific feature support. */
Jose Marinhoc0f4ff22019-10-09 10:37:42 +01002682 default:
Karl Meakin4271ff92024-05-13 12:33:15 +01002683 return ffa_error(FFA_NOT_SUPPORTED);
Jose Marinhoc0f4ff22019-10-09 10:37:42 +01002684 }
2685}
Andrew Walbrane908c4a2019-12-02 17:13:47 +00002686
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002687/**
Karl Meakin9c5b1d32024-06-24 12:10:36 +01002688 * Discovery function returning information about the implementation of optional
2689 * FF-A interfaces. See section 13.3 of the FF-A v1.2 ALP1 spec.
2690 *
2691 * `function_or_feature_id` is interpreted as either a function ID or a feature
2692 * ID, depending on the value of bit 31.
2693 * When it is a feature ID, bits [30:8] MBZ and input_property MBZ.
2694 *
2695 * Returns `FFA_SUCCESS` if the interface is supported.
2696 * Returns `FFA_NOT_SUPPORTED` if the interface is not supported or the
2697 * parameters are invalid.
2698 */
2699struct ffa_value api_ffa_features(uint32_t function_or_feature_id,
2700 uint32_t input_property, struct vcpu *current)
2701{
2702 return IS_BIT_UNSET(function_or_feature_id, FFA_FEATURES_FEATURE_BIT)
2703 ? ffa_features_feature(function_or_feature_id,
2704 input_property, current)
2705 : ffa_features_function(function_or_feature_id,
2706 input_property, current);
2707}
2708
2709/**
Kathleen Capella41fea932023-06-23 17:39:28 -04002710 * FF-A specification states that x2/w2 Must Be Zero for FFA_MSG_SEND_DIRECT_REQ
2711 * and FFA_MSG_SEND_DIRECT_RESP interfaces when used for partition messages. See
2712 * FF-A v1.2 Table 16.6: FFA_MSG_SEND_DIRECT_REQ function syntax.
J-Alves645eabe2021-02-22 16:08:27 +00002713 */
2714static inline bool api_ffa_dir_msg_is_arg2_zero(struct ffa_value args)
2715{
2716 return args.arg2 == 0U;
2717}
2718
2719/**
J-Alves76d99af2021-03-10 17:42:11 +00002720 * Limits size of arguments in ffa_value structure to 32-bit.
2721 */
2722static struct ffa_value api_ffa_value_copy32(struct ffa_value args)
2723{
2724 return (struct ffa_value){
2725 .func = (uint32_t)args.func,
2726 .arg1 = (uint32_t)args.arg1,
Karl Meakin06e8b732024-09-20 18:26:49 +01002727 .arg2 = (uint32_t)args.arg2,
J-Alves76d99af2021-03-10 17:42:11 +00002728 .arg3 = (uint32_t)args.arg3,
2729 .arg4 = (uint32_t)args.arg4,
2730 .arg5 = (uint32_t)args.arg5,
2731 .arg6 = (uint32_t)args.arg6,
2732 .arg7 = (uint32_t)args.arg7,
2733 };
2734}
2735
2736/**
Kathleen Capella41fea932023-06-23 17:39:28 -04002737 * Helper to copy direct message payload, depending on SMC used, direct
Karl Meakin06e8b732024-09-20 18:26:49 +01002738 * messaging interface used, and expected registers size. Can be used for both
2739 * framework messages and standard messages.
J-Alves76d99af2021-03-10 17:42:11 +00002740 */
2741static struct ffa_value api_ffa_dir_msg_value(struct ffa_value args)
2742{
Karl Meakin06e8b732024-09-20 18:26:49 +01002743 switch (args.func) {
2744 case FFA_MSG_SEND_DIRECT_REQ_32:
2745 case FFA_MSG_SEND_DIRECT_RESP_32:
2746 args = api_ffa_value_copy32(args);
2747 if (!ffa_is_framework_msg(args)) {
2748 args.arg2 = 0;
2749 }
2750 break;
J-Alves76d99af2021-03-10 17:42:11 +00002751
Karl Meakin06e8b732024-09-20 18:26:49 +01002752 case FFA_MSG_SEND_DIRECT_REQ_64:
2753 case FFA_MSG_SEND_DIRECT_RESP_64:
2754 if (!ffa_is_framework_msg(args)) {
2755 args.arg2 = 0;
2756 }
2757 break;
Kathleen Capella41fea932023-06-23 17:39:28 -04002758
Karl Meakin06e8b732024-09-20 18:26:49 +01002759 case FFA_MSG_SEND_DIRECT_REQ2_64:
Kathleen Capelladb6a08b2023-10-04 13:42:39 -04002760 args.extended_val.valid = true;
Karl Meakin06e8b732024-09-20 18:26:49 +01002761 break;
Kathleen Capelladb6a08b2023-10-04 13:42:39 -04002762
Karl Meakin06e8b732024-09-20 18:26:49 +01002763 case FFA_MSG_SEND_DIRECT_RESP2_64:
Kathleen Capella087e5022023-09-07 18:04:15 -04002764 args.arg2 = 0;
2765 args.arg3 = 0;
Karl Meakin06e8b732024-09-20 18:26:49 +01002766 break;
2767 default:
2768 panic("Invalid direct message function %#x\n", args.func);
2769 break;
Kathleen Capella087e5022023-09-07 18:04:15 -04002770 }
2771
Kathleen Capella41fea932023-06-23 17:39:28 -04002772 return args;
2773}
2774
Karl Meakinfb9c2a22024-08-19 14:29:37 +01002775/**
2776 * Return a pointer to the first UUID in `uuids` that is equal to
2777 * `target_uuid`. If `target_uuid` is 0-0-0-0, it matches any UUID.
2778 */
2779static struct ffa_uuid *ffa_uuid_find(struct ffa_uuid *uuids,
2780 size_t uuids_count,
2781 struct ffa_uuid target_uuid)
2782{
2783 if (ffa_uuid_is_null(&target_uuid)) {
2784 return &uuids[0];
2785 }
2786
2787 for (size_t i = 0; i < uuids_count; i++) {
2788 if (ffa_uuid_is_null(&uuids[i])) {
2789 break;
2790 }
2791 if (ffa_uuid_equal(&target_uuid, &uuids[i])) {
2792 return &uuids[i];
2793 }
2794 }
2795 return NULL;
2796}
2797
Kathleen Capella41fea932023-06-23 17:39:28 -04002798static bool api_ffa_dir_msg_req2_is_uuid_valid(struct vm *receiver_vm,
2799 struct ffa_value args)
2800{
2801 struct ffa_uuid target_uuid;
2802
Karl Meakin9478e322024-09-23 17:47:09 +01002803 ffa_uuid_from_u64x2(args.arg2, args.arg3, &target_uuid);
Kathleen Capella41fea932023-06-23 17:39:28 -04002804
Karl Meakinfb9c2a22024-08-19 14:29:37 +01002805 return ffa_uuid_find(receiver_vm->uuids, PARTITION_MAX_UUIDS,
2806 target_uuid) != NULL;
J-Alves76d99af2021-03-10 17:42:11 +00002807}
2808
2809/**
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002810 * Send an FF-A direct message request.
Kathleen Capella41fea932023-06-23 17:39:28 -04002811 * This handler covers both FFA_MSG_SEND_DIRECT_REQ_32/64
2812 * and FFA_MSG_SEND_DIRECT_REQ2_64 (introduced in FF-A v1.2) with function-based
2813 * checks to accomodate for the difference between the ABIs.
2814 *
2815 * FFA_MSG_SEND_DIRECT_REQ2_64 works mostly the same as
2816 * FFA_MSG_SEND_DIRECT_REQ_32/64, but adds the ability to send a direct message
2817 * request to a specified UUID within a partition and the usage of an extended
2818 * range of registers (x4-x17, instead of x4-x7) to be used as part of the
2819 * message payload.
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002820 */
Karl Meakin13f09812024-10-28 16:33:23 +00002821struct ffa_value api_ffa_msg_send_direct_req(struct ffa_value args,
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002822 struct vcpu *current,
2823 struct vcpu **next)
2824{
Karl Meakin13f09812024-10-28 16:33:23 +00002825 ffa_id_t sender_vm_id = ffa_sender(args);
2826 ffa_id_t receiver_vm_id = ffa_receiver(args);
J-Alves17228f72021-04-20 17:13:19 +01002827 struct ffa_value ret;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002828 struct vm *receiver_vm;
J-Alves6e2abc62021-12-02 14:58:56 +00002829 struct vm_locked receiver_locked;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002830 struct vcpu *receiver_vcpu;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06002831 struct vcpu_locked current_locked;
2832 struct vcpu_locked receiver_vcpu_locked;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002833 struct two_vcpu_locked vcpus_locked;
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05002834 enum vcpu_state next_state = VCPU_STATE_RUNNING;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002835
Kathleen Capella41fea932023-06-23 17:39:28 -04002836 if ((args.func == FFA_MSG_SEND_DIRECT_REQ_32 ||
2837 args.func == FFA_MSG_SEND_DIRECT_REQ_64) &&
Karl Meakin06e8b732024-09-20 18:26:49 +01002838 !ffa_is_framework_msg(args) &&
Kathleen Capella41fea932023-06-23 17:39:28 -04002839 !api_ffa_dir_msg_is_arg2_zero(args)) {
Karl Meakin06e8b732024-09-20 18:26:49 +01002840 dlog_verbose("Direct messaging: w2 must be zero (w2 = %#lx)\n",
2841 args.arg2);
J-Alves645eabe2021-02-22 16:08:27 +00002842 return ffa_error(FFA_INVALID_PARAMETERS);
2843 }
2844
Karl Meakin06e8b732024-09-20 18:26:49 +01002845 if (ffa_is_framework_msg(args) &&
Karl Meakinfa1dcb82025-02-10 16:47:50 +00002846 ffa_direct_msg_handle_framework_msg(args, &ret)) {
Karl Meakin06e8b732024-09-20 18:26:49 +01002847 return ret;
2848 }
2849
Karl Meakin117c8082024-12-04 16:03:28 +00002850 if (!ffa_direct_msg_is_direct_request_valid(current, sender_vm_id,
2851 receiver_vm_id)) {
J-Alvese0caac32022-12-19 14:37:08 +00002852 dlog_verbose("Invalid direct message request.\n");
J-Alvesaa336102021-03-01 13:02:45 +00002853 return ffa_error(FFA_INVALID_PARAMETERS);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002854 }
2855
Karl Meakin117c8082024-12-04 16:03:28 +00002856 if (ffa_direct_msg_direct_request_forward(receiver_vm_id, args, &ret)) {
Karl Meakin06e8b732024-09-20 18:26:49 +01002857 dlog_verbose("Direct message request forwarded\n");
J-Alves17228f72021-04-20 17:13:19 +01002858 return ret;
2859 }
2860
J-Alvesbd32c972024-02-02 16:20:04 +00002861 ret = api_ffa_interrupt_return(0);
J-Alves17228f72021-04-20 17:13:19 +01002862
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002863 receiver_vm = vm_find(receiver_vm_id);
2864 if (receiver_vm == NULL) {
J-Alves88a13542021-12-14 15:39:52 +00002865 dlog_verbose("Invalid Receiver!\n");
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002866 return ffa_error(FFA_INVALID_PARAMETERS);
2867 }
2868
Kathleen Capella41fea932023-06-23 17:39:28 -04002869 if (args.func == FFA_MSG_SEND_DIRECT_REQ2_64 &&
2870 !api_ffa_dir_msg_req2_is_uuid_valid(receiver_vm, args)) {
2871 dlog_verbose("UUID unrecognized for this VM\n");
2872 return ffa_error(FFA_INVALID_PARAMETERS);
2873 }
2874
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002875 /*
J-Alves439ac972021-11-18 17:32:03 +00002876 * Check if sender supports sending direct message req, and if
2877 * receiver supports receipt of direct message requests.
2878 */
Karl Meakin117c8082024-12-04 16:03:28 +00002879 if (!ffa_direct_msg_is_direct_request_supported(
2880 current->vm, receiver_vm, args.func)) {
Karl Meakin06e8b732024-09-20 18:26:49 +01002881 dlog_verbose("Direct message request not supported\n");
J-Alves439ac972021-11-18 17:32:03 +00002882 return ffa_error(FFA_DENIED);
2883 }
2884
2885 /*
Olivier Deprezc13a8692022-04-08 17:47:14 +02002886 * Per FF-A EAC spec section 4.4.1 the firmware framework supports
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002887 * UP (migratable) or MP partitions with a number of vCPUs matching the
2888 * number of PEs in the system. It further states that MP partitions
2889 * accepting direct request messages cannot migrate.
2890 */
J-Alvesad6a0432021-04-09 16:06:21 +01002891 receiver_vcpu = api_ffa_get_vm_vcpu(receiver_vm, current);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002892 if (receiver_vcpu == NULL) {
J-Alves88a13542021-12-14 15:39:52 +00002893 dlog_verbose("Invalid vCPU!\n");
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002894 return ffa_error(FFA_INVALID_PARAMETERS);
2895 }
2896
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06002897 /*
2898 * If VM must be locked, it must be done before any of its vCPUs are
2899 * locked.
2900 */
J-Alves6e2abc62021-12-02 14:58:56 +00002901 receiver_locked = vm_lock(receiver_vm);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06002902
2903 /* Lock both vCPUs at once to avoid deadlock. */
2904 vcpus_locked = vcpu_lock_both(current, receiver_vcpu);
2905 current_locked = vcpus_locked.vcpu1;
2906 receiver_vcpu_locked = vcpus_locked.vcpu2;
2907
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002908 /*
2909 * If destination vCPU is executing or already received an
2910 * FFA_MSG_SEND_DIRECT_REQ then return to caller hinting recipient is
2911 * busy. There is a brief period of time where the vCPU state has
2912 * changed but regs_available is still false thus consider this case as
2913 * the vCPU not yet ready to receive a direct message request.
2914 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06002915 if (is_ffa_direct_msg_request_ongoing(receiver_vcpu_locked) ||
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002916 receiver_vcpu->state == VCPU_STATE_RUNNING ||
2917 !receiver_vcpu->regs_available) {
J-Alves88a13542021-12-14 15:39:52 +00002918 dlog_verbose("Receiver is busy with another request.\n");
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002919 ret = ffa_error(FFA_BUSY);
2920 goto out;
2921 }
2922
Karl Meakin117c8082024-12-04 16:03:28 +00002923 if (!ffa_cpu_cycles_check_runtime_state_transition(
J-Alves7ea3f7e2024-03-27 11:05:11 +00002924 current_locked, sender_vm_id, HF_INVALID_VM_ID,
2925 receiver_vcpu_locked, args.func, &next_state)) {
2926 ret = ffa_error(FFA_DENIED);
2927 goto out;
2928 }
2929
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002930 if (atomic_load_explicit(&receiver_vcpu->vm->aborting,
2931 memory_order_relaxed)) {
2932 if (receiver_vcpu->state != VCPU_STATE_ABORTED) {
Kathleen Capella6e9765b2023-07-11 17:44:58 -04002933 dlog_verbose(
2934 "Receiver VM %#x aborted, cannot run vCPU %u\n",
2935 receiver_vcpu->vm->id,
2936 vcpu_index(receiver_vcpu));
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002937 receiver_vcpu->state = VCPU_STATE_ABORTED;
2938 }
2939
2940 ret = ffa_error(FFA_ABORTED);
2941 goto out;
2942 }
2943
2944 switch (receiver_vcpu->state) {
2945 case VCPU_STATE_OFF:
2946 case VCPU_STATE_RUNNING:
2947 case VCPU_STATE_ABORTED:
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002948 case VCPU_STATE_BLOCKED_INTERRUPT:
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05002949 case VCPU_STATE_BLOCKED:
2950 case VCPU_STATE_PREEMPTED:
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002951 ret = ffa_error(FFA_BUSY);
2952 goto out;
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05002953 case VCPU_STATE_WAITING:
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002954 /*
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05002955 * We expect target vCPU to be in WAITING state after either
2956 * having called ffa_msg_wait or sent a direct message response.
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002957 */
2958 break;
2959 }
2960
Madhukar Pappireddy32424db2024-09-25 15:06:19 -05002961 /* Inject timer interrupt if timer has expired. */
Daniel Boulbyd49d0772025-01-15 11:19:36 +00002962 api_inject_arch_timer_interrupt(receiver_vcpu_locked);
Madhukar Pappireddy106bfc32024-09-25 15:47:11 -05002963 timer_migrate_to_other_cpu(current->cpu, receiver_vcpu_locked);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002964
2965 /* The receiver vCPU runs upon direct message invocation */
2966 receiver_vcpu->cpu = current->cpu;
2967 receiver_vcpu->state = VCPU_STATE_RUNNING;
2968 receiver_vcpu->regs_available = false;
Kathleen Capellae468c112023-12-13 17:56:28 -05002969 receiver_vcpu->direct_request_origin.is_ffa_req2 =
2970 (args.func == FFA_MSG_SEND_DIRECT_REQ2_64);
2971 receiver_vcpu->direct_request_origin.vm_id = sender_vm_id;
Karl Meakin06e8b732024-09-20 18:26:49 +01002972 receiver_vcpu->direct_request_origin.is_framework =
2973 ffa_is_framework_msg(args);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002974
J-Alves76d99af2021-03-10 17:42:11 +00002975 arch_regs_set_retval(&receiver_vcpu->regs, api_ffa_dir_msg_value(args));
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002976
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05002977 assert(!vm_id_is_current_world(current->vm->id) ||
2978 next_state == VCPU_STATE_BLOCKED);
Madhukar Pappireddyb11e0d12021-08-02 19:44:35 -05002979 current->state = VCPU_STATE_BLOCKED;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002980
Karl Meakin117c8082024-12-04 16:03:28 +00002981 ffa_direct_msg_wind_call_chain_ffa_direct_req(
Raghu Krishnamurthya9ccf122023-03-27 20:42:01 -07002982 current_locked, receiver_vcpu_locked, sender_vm_id);
Madhukar Pappireddy49fe6702022-06-21 17:52:23 -05002983
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002984 /* Switch to receiver vCPU targeted to by direct msg request */
2985 *next = receiver_vcpu;
2986
J-Alves6e2abc62021-12-02 14:58:56 +00002987 if (!receiver_locked.vm->el0_partition) {
2988 /*
2989 * If the scheduler in the system is giving CPU cycles to the
2990 * receiver, due to pending notifications, inject the NPI
2991 * interrupt. Following call assumes that '*next' has been set
2992 * to receiver_vcpu.
2993 */
Karl Meakin117c8082024-12-04 16:03:28 +00002994 ffa_interrupts_inject_notification_pending_interrupt(
Daniel Boulbyd49d0772025-01-15 11:19:36 +00002995 receiver_vcpu_locked, receiver_locked);
J-Alves6e2abc62021-12-02 14:58:56 +00002996 }
2997
Olivier Deprezee9d6a92019-11-26 09:14:11 +00002998 /*
2999 * Since this flow will lead to a VM switch, the return value will not
3000 * be applied to current vCPU.
3001 */
3002
3003out:
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003004 vcpu_unlock(&receiver_vcpu_locked);
J-Alves6e2abc62021-12-02 14:58:56 +00003005 vm_unlock(&receiver_locked);
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003006 vcpu_unlock(&current_locked);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003007
3008 return ret;
3009}
3010
3011/**
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003012 * Resume the target vCPU after the current vCPU sent a direct response.
3013 * Current vCPU moves to waiting state.
3014 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003015void api_ffa_resume_direct_resp_target(struct vcpu_locked current_locked,
3016 struct vcpu **next,
J-Alves19e20cf2023-08-02 12:48:55 +01003017 ffa_id_t receiver_vm_id,
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003018 struct ffa_value to_ret,
3019 bool is_nwd_call_chain)
3020{
Karl Meakinfa1dcb82025-02-10 16:47:50 +00003021 if (ffa_direct_msg_is_spmd_lp_id(receiver_vm_id) ||
Raghu Krishnamurthya9ccf122023-03-27 20:42:01 -07003022 !vm_id_is_current_world(receiver_vm_id)) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003023 *next = api_switch_to_other_world(current_locked, to_ret,
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003024 VCPU_STATE_WAITING);
3025
3026 /* End of NWd scheduled call chain. */
3027 assert(!is_nwd_call_chain ||
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003028 (current_locked.vcpu->call_chain.prev_node == NULL));
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003029 } else if (receiver_vm_id == HF_PRIMARY_VM_ID) {
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003030 *next = api_switch_to_primary(current_locked, to_ret,
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003031 VCPU_STATE_WAITING);
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003032 } else if (vm_id_is_current_world(receiver_vm_id)) {
3033 /*
3034 * It is expected the receiver_vm_id to be from an SP, otherwise
Karl Meakin117c8082024-12-04 16:03:28 +00003035 * 'ffa_direct_msg_is_direct_response_valid' should have
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003036 * made function return error before getting to this point.
3037 */
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003038 *next = api_switch_to_vm(current_locked, to_ret,
3039 VCPU_STATE_WAITING, receiver_vm_id);
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003040 } else {
3041 panic("Invalid direct message response invocation");
3042 }
3043}
3044
Karl Meakin50ef9112024-10-28 16:41:44 +00003045static bool api_ffa_msg_send_direct_resp_validate_args(struct ffa_value args,
3046 struct vcpu *current)
3047{
3048 ffa_id_t sender_vm_id = ffa_sender(args);
3049 ffa_id_t receiver_vm_id = ffa_receiver(args);
3050
3051 /*
3052 * If using FFA_MSG_SEND_DIRECT_RESP, the caller's
3053 * - x2 MBZ for partition messages
3054 * - x8-x17 SBZ if caller's FF-A version >= FF-A v1.2
3055 */
3056 if (args.func != FFA_MSG_SEND_DIRECT_RESP2_64) {
3057 if (!ffa_is_framework_msg(args) &&
3058 !api_ffa_dir_msg_is_arg2_zero(args)) {
3059 dlog_verbose("%s: w2 Must Be Zero",
3060 ffa_func_name(args.func));
3061 return false;
3062 }
3063
3064 if (current->vm->ffa_version >= FFA_VERSION_1_2 &&
3065 !api_extended_args_are_zero(&args)) {
3066 return false;
3067 }
3068 }
3069
Karl Meakin117c8082024-12-04 16:03:28 +00003070 if (!ffa_direct_msg_is_direct_response_valid(current, sender_vm_id,
3071 receiver_vm_id)) {
Karl Meakin50ef9112024-10-28 16:41:44 +00003072 dlog_verbose("Invalid direct response call.\n");
3073 return false;
3074 }
3075
3076 return true;
3077}
3078
3079static bool api_ffa_msg_send_direct_resp_validate_ongoing_request(
3080 struct ffa_value args, struct vcpu_locked current_locked)
3081{
3082 bool req_framework =
3083 current_locked.vcpu->direct_request_origin.is_framework;
3084 bool resp_framework = ffa_is_framework_msg(args);
3085 bool received_req2 =
3086 current_locked.vcpu->direct_request_origin.is_ffa_req2;
3087
3088 if (!is_ffa_direct_msg_request_ongoing(current_locked)) {
3089 return false;
3090 }
3091
3092 if (req_framework && !resp_framework) {
3093 dlog_verbose(
3094 "Mismatch in framework message bit: request was a %s "
3095 "message, but response is a %s message\n",
3096 req_framework ? "framework" : "non-framework",
3097 resp_framework ? "framework" : "non-framework");
3098 return false;
3099 }
3100
3101 if (args.func != FFA_MSG_SEND_DIRECT_RESP2_64 && received_req2) {
3102 dlog_verbose(
3103 "FFA_MSG_SEND_DIRECT_RESP must be used with "
3104 "FFA_MSG_SEND_DIRECT_REQ\n");
3105 return false;
3106 }
3107
3108 if (args.func == FFA_MSG_SEND_DIRECT_RESP2_64 && !received_req2) {
3109 dlog_verbose(
3110 "FFA_MSG_SEND_DIRECT_RESP2 must be used with "
3111 "FFA_MSG_SEND_DIRECT_REQ2\n");
3112 return false;
3113 }
3114
3115 return true;
3116}
3117
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003118/**
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003119 * Send an FF-A direct message response.
Kathleen Capella087e5022023-09-07 18:04:15 -04003120 * This handler covers both FFA_MSG_SEND_DIRECT_RESP_32/64
3121 * and FFA_MSG_SEND_DIRECT_RESP2_64 (introduced in FF-A v1.2) with
3122 * function-based checks to accomodate for the difference between the ABIs.
3123 *
3124 * FFA_MSG_SEND_DIRECT_RESP2_64 is used to respond to requests sent via
3125 * FFA_MSG_SEND_DIRECT_REQ2_64 and adds the usage of an extended range
3126 * of registers (x4-x17, instead of x4-x7) to be used as part of the
3127 * message payload.
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003128 */
Karl Meakin13f09812024-10-28 16:33:23 +00003129struct ffa_value api_ffa_msg_send_direct_resp(struct ffa_value args,
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003130 struct vcpu *current,
3131 struct vcpu **next)
3132{
Karl Meakin13f09812024-10-28 16:33:23 +00003133 ffa_id_t sender_vm_id = ffa_sender(args);
3134 ffa_id_t receiver_vm_id = ffa_receiver(args);
Olivier Deprez2ebae3a2020-06-11 16:34:30 +02003135 struct vcpu_locked current_locked;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003136 struct vcpu_locked next_locked = (struct vcpu_locked){
3137 .vcpu = NULL,
3138 };
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05003139 enum vcpu_state next_state = VCPU_STATE_RUNNING;
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003140 struct ffa_value ret = (struct ffa_value){.func = FFA_INTERRUPT_32};
Madhukar Pappireddy2f76e492022-09-06 15:21:59 -05003141 struct ffa_value signal_interrupt =
3142 (struct ffa_value){.func = FFA_INTERRUPT_32};
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003143 struct ffa_value to_ret = api_ffa_dir_msg_value(args);
3144 struct two_vcpu_locked vcpus_locked;
J-Alves645eabe2021-02-22 16:08:27 +00003145
Karl Meakin50ef9112024-10-28 16:41:44 +00003146 if (!api_ffa_msg_send_direct_resp_validate_args(args, current)) {
J-Alvesaa336102021-03-01 13:02:45 +00003147 return ffa_error(FFA_INVALID_PARAMETERS);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003148 }
3149
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003150 current_locked = vcpu_lock(current);
3151
Karl Meakin117c8082024-12-04 16:03:28 +00003152 if (!ffa_cpu_cycles_check_runtime_state_transition(
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003153 current_locked, sender_vm_id, receiver_vm_id, next_locked,
3154 args.func, &next_state)) {
3155 ret = ffa_error(FFA_DENIED);
3156 goto out;
Madhukar Pappireddyc857ac22022-06-21 17:37:53 -05003157 }
3158
Madhukar Pappireddyd456ac22023-06-26 15:29:34 -05003159 assert(!vm_id_is_current_world(current->vm->id) ||
3160 next_state == VCPU_STATE_WAITING);
Madhukar Pappireddy469fa712022-06-21 18:53:33 -05003161
Karl Meakin50ef9112024-10-28 16:41:44 +00003162 if (!api_ffa_msg_send_direct_resp_validate_ongoing_request(
3163 args, current_locked)) {
Kathleen Capellae468c112023-12-13 17:56:28 -05003164 ret = ffa_error(FFA_DENIED);
3165 goto out;
3166 }
3167
Manish Pandeya5f39fb2020-09-11 09:47:11 +01003168 if (api_ffa_is_managed_exit_ongoing(current_locked)) {
J-Alvesbd32c972024-02-02 16:20:04 +00003169 struct interrupts *interrupts = &current->interrupts;
3170
Madhukar Pappireddy7945bb52024-08-20 15:22:41 -05003171 CHECK(current->scheduling_mode != SPMC_MODE);
Madhukar Pappireddyed4ab942021-08-03 14:22:53 -05003172
Madhukar Pappireddy025a4512024-10-14 22:09:19 -05003173 plat_interrupts_set_priority_mask(
3174 current->prev_interrupt_priority);
Madhukar Pappireddya1019112022-06-21 18:57:44 -05003175 /*
3176 * A SP may be signaled a managed exit but actually not trap
3177 * the virtual interrupt, probably because it has virtual
3178 * interrupts masked, and emit direct resp. In this case the
3179 * managed exit operation is considered completed and it would
3180 * also need to clear the pending managed exit flag for the SP
3181 * vCPU.
3182 */
Manish Pandeya5f39fb2020-09-11 09:47:11 +01003183 current->processing_managed_exit = false;
Madhukar Pappireddya1019112022-06-21 18:57:44 -05003184
3185 if (vcpu_is_virt_interrupt_pending(interrupts,
3186 HF_MANAGED_EXIT_INTID)) {
J-Alvesb8730e92024-08-07 18:28:55 +01003187 vcpu_interrupt_clear_decrement(current_locked,
3188 HF_MANAGED_EXIT_INTID);
Madhukar Pappireddya1019112022-06-21 18:57:44 -05003189 }
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003190 }
3191
Kathleen Capellae468c112023-12-13 17:56:28 -05003192 /* Clear direct request origin vm_id and request type for the caller. */
3193 current->direct_request_origin.is_ffa_req2 = false;
3194 current->direct_request_origin.vm_id = HF_INVALID_VM_ID;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003195
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003196 api_ffa_resume_direct_resp_target(current_locked, next, receiver_vm_id,
3197 to_ret, false);
3198
3199 /*
3200 * Unlock current vCPU to allow it to be locked together with next
3201 * vcpu.
3202 */
Olivier Deprez2ebae3a2020-06-11 16:34:30 +02003203 vcpu_unlock(&current_locked);
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003204
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003205 /* Lock both vCPUs at once to avoid deadlock. */
3206 vcpus_locked = vcpu_lock_both(current, *next);
3207 current_locked = vcpus_locked.vcpu1;
3208 next_locked = vcpus_locked.vcpu2;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003209
Madhukar Pappireddy32424db2024-09-25 15:06:19 -05003210 /* Inject timer interrupt if timer has expired. */
Daniel Boulbyd49d0772025-01-15 11:19:36 +00003211 api_inject_arch_timer_interrupt(next_locked);
Karl Meakin117c8082024-12-04 16:03:28 +00003212 ffa_direct_msg_unwind_call_chain_ffa_direct_resp(current_locked,
3213 next_locked);
J-Alvesbd32c972024-02-02 16:20:04 +00003214
3215 /*
3216 * Check if there is a pending secure interrupt.
3217 * If there is, return back to the caller with FFA_INTERRUPT,
3218 * and set the `next` vcpu in a preempted state.
3219 */
Karl Meakin117c8082024-12-04 16:03:28 +00003220 if (ffa_interrupts_intercept_call(current_locked, next_locked,
3221 &signal_interrupt)) {
J-Alvesbd32c972024-02-02 16:20:04 +00003222 ret = signal_interrupt;
3223 *next = NULL;
3224 }
3225
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003226 vcpu_unlock(&next_locked);
Madhukar Pappireddyc0fb87e2022-06-21 17:59:15 -05003227
Madhukar Pappireddybd10e572023-03-06 16:39:49 -06003228out:
3229 vcpu_unlock(&current_locked);
3230 return ret;
Olivier Deprezee9d6a92019-11-26 09:14:11 +00003231}
3232
J-Alves84658fc2021-06-17 14:37:32 +01003233static bool api_memory_region_check_flags(
3234 struct ffa_memory_region *memory_region, uint32_t share_func)
3235{
3236 switch (share_func) {
J-Alves95fbb312024-03-20 15:19:16 +00003237 case FFA_MEM_SHARE_64:
J-Alves84658fc2021-06-17 14:37:32 +01003238 case FFA_MEM_SHARE_32:
3239 if ((memory_region->flags & FFA_MEMORY_REGION_FLAG_CLEAR) !=
3240 0U) {
3241 return false;
3242 }
3243 /* Intentional fall-through */
J-Alves95fbb312024-03-20 15:19:16 +00003244 case FFA_MEM_LEND_64:
J-Alves84658fc2021-06-17 14:37:32 +01003245 case FFA_MEM_LEND_32:
J-Alves95fbb312024-03-20 15:19:16 +00003246 case FFA_MEM_DONATE_64:
J-Alves84658fc2021-06-17 14:37:32 +01003247 case FFA_MEM_DONATE_32: {
3248 /* Bits 31:2 Must Be Zero. */
3249 ffa_memory_receiver_flags_t to_mask =
3250 ~(FFA_MEMORY_REGION_FLAG_CLEAR |
3251 FFA_MEMORY_REGION_FLAG_TIME_SLICE);
3252
3253 if ((memory_region->flags & to_mask) != 0U) {
3254 return false;
3255 }
3256 break;
3257 }
3258 default:
3259 panic("Check for mem send calls only.\n");
3260 }
3261
3262 /* Last check reserved values are 0 */
3263 return true;
3264}
3265
J-Alves33c47bf2022-09-29 11:36:20 +01003266/*
3267 * Convert memory transaction descriptor from FF-A v1.0 to FF-A v1.1 EAC0.
3268 */
3269static void api_ffa_memory_region_v1_1_from_v1_0(
3270 struct ffa_memory_region_v1_0 *memory_region_v1_0,
3271 struct ffa_memory_region *memory_region_v1_1)
3272{
3273 memory_region_v1_1->sender = memory_region_v1_0->sender;
J-Alves00847062022-10-03 17:08:44 +01003274 memory_region_v1_1->handle = memory_region_v1_0->handle;
Karl Meakin84710f32023-10-12 15:14:49 +01003275 memory_region_v1_1->attributes =
3276 ffa_memory_attributes_extend(memory_region_v1_0->attributes);
J-Alves33c47bf2022-09-29 11:36:20 +01003277 memory_region_v1_1->flags = memory_region_v1_0->flags;
3278 memory_region_v1_1->tag = memory_region_v1_0->tag;
3279 memory_region_v1_1->memory_access_desc_size =
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003280 sizeof(struct ffa_memory_access_v1_0);
J-Alves33c47bf2022-09-29 11:36:20 +01003281 memory_region_v1_1->receiver_count = memory_region_v1_0->receiver_count;
Daniel Boulby41ef8ba2023-10-13 17:01:22 +01003282 memory_region_v1_1->receivers_offset = sizeof(struct ffa_memory_region);
J-Alves33c47bf2022-09-29 11:36:20 +01003283
3284 /* Zero reserved fields. */
3285 for (uint32_t i = 0; i < 3U; i++) {
3286 memory_region_v1_1->reserved[i] = 0U;
3287 }
3288}
3289
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003290/**
3291 * Updates a v1.0 transaction descriptor to v1.1. This gives us the
3292 * memory_access_desc_size field we need for forwards compatability.
3293 * Copy the receivers and composite descriptors to the new struct.
3294 * We also check the fields in the v1.0 transaction descriptor and return:
3295 * - FFA_ERROR FFA_INVALID_PARAMETERS: If any of the fields are not valid
3296 * values, eg the reserved fields are not 0, receiver_count is too large or
3297 * composite offsets are not 0 for retrieve requests or in bounds for send
3298 * requests.
3299 * - FFA ERROR FFA_NOT_SUPPORTED: If an invalid ffa_version is supplied to the
3300 * function. Or the fragment length is more than a single page.
3301 * - FFA_ERROR FFA_NO_MEMORY: If we do not have enough memory for a scratch
3302 * memory transaction descriptor.
3303 * - FFA_SUCCESS: If a successful update has occured.
J-Alves33c47bf2022-09-29 11:36:20 +01003304 */
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003305static struct ffa_value api_ffa_memory_transaction_descriptor_v1_1_from_v1_0(
3306 void *allocated, uint32_t *fragment_length, uint32_t *total_length,
Karl Meakin0e617d92024-04-05 12:55:22 +01003307 enum ffa_version ffa_version, bool send_transaction)
J-Alves33c47bf2022-09-29 11:36:20 +01003308{
3309 struct ffa_memory_region_v1_0 *memory_region_v1_0;
3310 struct ffa_memory_region *memory_region_v1_1 = NULL;
3311 struct ffa_composite_memory_region *composite_v1_0;
3312 struct ffa_composite_memory_region *composite_v1_1;
3313 size_t receivers_length;
3314 size_t space_left;
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003315 size_t receivers_end;
J-Alves33c47bf2022-09-29 11:36:20 +01003316 size_t composite_offset_v1_1;
3317 size_t composite_offset_v1_0;
3318 size_t fragment_constituents_size;
3319 size_t fragment_length_v1_1;
3320
J-Alves33c47bf2022-09-29 11:36:20 +01003321 assert(fragment_length != NULL);
3322 assert(total_length != NULL);
3323
Karl Meakin0e617d92024-04-05 12:55:22 +01003324 if (ffa_version >= FFA_VERSION_1_1) {
J-Alves33c47bf2022-09-29 11:36:20 +01003325 return (struct ffa_value){.func = FFA_SUCCESS_32};
3326 }
3327
Karl Meakin0e617d92024-04-05 12:55:22 +01003328 if (ffa_version != FFA_VERSION_1_0) {
J-Alves33c47bf2022-09-29 11:36:20 +01003329 dlog_verbose("%s: Unsupported FF-A version %x\n", __func__,
3330 ffa_version);
3331 return ffa_error(FFA_NOT_SUPPORTED);
3332 }
3333
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003334 dlog_verbose(
J-Alves0a824e92024-04-26 16:20:12 +01003335 "Updating memory transaction descriptor from v1.0 to v1.1.\n");
J-Alves33c47bf2022-09-29 11:36:20 +01003336
3337 memory_region_v1_0 = (struct ffa_memory_region_v1_0 *)allocated;
3338
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003339 receivers_length = sizeof(struct ffa_memory_access_v1_0) *
J-Alves33c47bf2022-09-29 11:36:20 +01003340 memory_region_v1_0->receiver_count;
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003341 receivers_end = sizeof(struct ffa_memory_region) + receivers_length;
J-Alves33c47bf2022-09-29 11:36:20 +01003342
3343 /*
3344 * Check the specified composite offset of v1.0 descriptor, and that all
3345 * receivers were configured with the same offset.
3346 */
3347 composite_offset_v1_0 =
3348 memory_region_v1_0->receivers[0].composite_memory_region_offset;
3349
J-Alves33c47bf2022-09-29 11:36:20 +01003350 /* Determine the composite offset for v1.1 descriptor. */
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003351 if (send_transaction) {
3352 fragment_constituents_size =
3353 *fragment_length - composite_offset_v1_0 -
3354 sizeof(struct ffa_composite_memory_region);
3355 fragment_length_v1_1 =
3356 receivers_end +
3357 sizeof(struct ffa_composite_memory_region) +
3358 fragment_constituents_size;
3359 composite_offset_v1_1 = receivers_end;
3360 } else {
3361 fragment_constituents_size = 0;
3362 fragment_length_v1_1 = receivers_end;
3363 composite_offset_v1_1 = 0;
3364 }
J-Alves33c47bf2022-09-29 11:36:20 +01003365
3366 /*
3367 * Currently only support the simpler cases: memory transaction
3368 * in a single fragment that fits in a MM_PPOOL_ENTRY_SIZE.
3369 * TODO: allocate the entries needed for this fragment_length_v1_1.
3370 * - Check corner when v1.1 descriptor converted size surpasses
3371 * the size of the entry.
3372 */
3373 if (fragment_length_v1_1 > MM_PPOOL_ENTRY_SIZE) {
3374 dlog_verbose(
Karl Meakine8937d92024-03-19 16:04:25 +00003375 "Translation of FF-A v1.0 descriptors for over %lu is "
J-Alves33c47bf2022-09-29 11:36:20 +01003376 "unsupported.",
3377 MM_PPOOL_ENTRY_SIZE);
3378 return ffa_error(FFA_NOT_SUPPORTED);
3379 }
3380
3381 space_left = fragment_length_v1_1;
3382
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003383 /*
3384 * Allocate a page of memory to construct the v1.1 memory descriptor.
3385 * Earlier we checked that the fragment_length_v1_1 would not be larger
3386 * than a page.
3387 */
J-Alves33c47bf2022-09-29 11:36:20 +01003388 memory_region_v1_1 =
3389 (struct ffa_memory_region *)mpool_alloc(&api_page_pool);
3390 if (memory_region_v1_1 == NULL) {
3391 return ffa_error(FFA_NO_MEMORY);
3392 }
3393
3394 /* Translate header from v1.0 to v1.1. */
3395 api_ffa_memory_region_v1_1_from_v1_0(memory_region_v1_0,
3396 memory_region_v1_1);
3397
3398 space_left -= sizeof(struct ffa_memory_region);
3399
3400 /* Copy memory access information. */
Daniel Boulby41ef8ba2023-10-13 17:01:22 +01003401 memcpy_s((uint8_t *)memory_region_v1_1 +
3402 memory_region_v1_1->receivers_offset,
3403 space_left, memory_region_v1_0->receivers, receivers_length);
J-Alves33c47bf2022-09-29 11:36:20 +01003404
3405 /* Initialize the memory access descriptors with composite offset. */
3406 for (uint32_t i = 0; i < memory_region_v1_1->receiver_count; i++) {
3407 struct ffa_memory_access *receiver =
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003408 ffa_memory_region_get_receiver(memory_region_v1_1, i);
3409 assert(receiver != NULL);
J-Alves33c47bf2022-09-29 11:36:20 +01003410 receiver->composite_memory_region_offset =
3411 composite_offset_v1_1;
3412 }
3413
3414 space_left -= receivers_length;
3415
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003416 /* Composite memory descriptors to copy. */
3417 if (send_transaction) {
3418 /* Init v1.1 composite. */
3419 composite_v1_1 = (struct ffa_composite_memory_region
3420 *)((uint8_t *)memory_region_v1_1 +
3421 composite_offset_v1_1);
J-Alves33c47bf2022-09-29 11:36:20 +01003422
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003423 composite_v1_0 = ffa_memory_region_get_composite_v1_0(
3424 memory_region_v1_0, 0);
3425 composite_v1_1->constituent_count =
3426 composite_v1_0->constituent_count;
3427 composite_v1_1->page_count = composite_v1_0->page_count;
J-Alves33c47bf2022-09-29 11:36:20 +01003428
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003429 space_left -= sizeof(struct ffa_composite_memory_region);
J-Alves33c47bf2022-09-29 11:36:20 +01003430
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003431 /* Initialize v1.1 constituents. */
3432 memcpy_s(composite_v1_1->constituents, space_left,
3433 composite_v1_0->constituents,
3434 fragment_constituents_size);
J-Alves33c47bf2022-09-29 11:36:20 +01003435
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003436 space_left -= fragment_constituents_size;
3437 }
3438
J-Alves33c47bf2022-09-29 11:36:20 +01003439 assert(space_left == 0U);
3440
J-Alves33c47bf2022-09-29 11:36:20 +01003441 /*
3442 * Remove the v1.0 fragment size, and resultant size of v1.1 fragment.
3443 */
3444 *total_length = *total_length - *fragment_length + fragment_length_v1_1;
3445 *fragment_length = fragment_length_v1_1;
3446
3447 /*
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003448 * After successfully updating to v1.1 copy the descriptor to the
3449 * internal buffer given as a parameter (used to prevent TOCTOU attacks)
3450 * and free the scratch memory used to construct it.
J-Alves33c47bf2022-09-29 11:36:20 +01003451 */
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003452 memcpy_s(allocated, MM_PPOOL_ENTRY_SIZE, memory_region_v1_1,
3453 *fragment_length);
3454 mpool_free(&api_page_pool, memory_region_v1_1);
J-Alves33c47bf2022-09-29 11:36:20 +01003455
3456 return (struct ffa_value){.func = FFA_SUCCESS_32};
3457}
3458
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003459struct ffa_value api_ffa_mem_send(uint32_t share_func, uint32_t length,
3460 uint32_t fragment_length, ipaddr_t address,
Andrew Walbran1a86aa92020-05-15 17:22:28 +01003461 uint32_t page_count, struct vcpu *current)
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003462{
3463 struct vm *from = current->vm;
3464 struct vm *to;
3465 const void *from_msg;
J-Alves33c47bf2022-09-29 11:36:20 +01003466 void *allocated_entry;
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003467 struct ffa_memory_region *memory_region = NULL;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003468 struct ffa_value ret;
J-Alves363f5722022-04-25 17:37:37 +01003469 bool targets_other_world = false;
Karl Meakin0e617d92024-04-05 12:55:22 +01003470 enum ffa_version ffa_version;
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003471
3472 if (ipa_addr(address) != 0 || page_count != 0) {
3473 /*
3474 * Hafnium only supports passing the descriptor in the TX
3475 * mailbox.
3476 */
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003477 return ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003478 }
3479
Andrew Walbranca808b12020-05-15 17:22:28 +01003480 if (fragment_length > length) {
3481 dlog_verbose(
3482 "Fragment length %d greater than total length %d.\n",
3483 fragment_length, length);
3484 return ffa_error(FFA_INVALID_PARAMETERS);
3485 }
J-Alves33c47bf2022-09-29 11:36:20 +01003486
3487 if (fragment_length > HF_MAILBOX_SIZE ||
3488 fragment_length > MM_PPOOL_ENTRY_SIZE) {
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003489 return ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003490 }
3491
3492 /*
3493 * Check that the sender has configured its send buffer. If the TX
3494 * mailbox at from_msg is configured (i.e. from_msg != NULL) then it can
3495 * be safely accessed after releasing the lock since the TX mailbox
3496 * address can only be configured once.
3497 */
3498 sl_lock(&from->lock);
3499 from_msg = from->mailbox.send;
J-Alves33c47bf2022-09-29 11:36:20 +01003500 ffa_version = from->ffa_version;
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003501 sl_unlock(&from->lock);
3502
3503 if (from_msg == NULL) {
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003504 return ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003505 }
3506
3507 /*
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003508 * Copy the memory region descriptor to a fresh page from the memory
3509 * pool. This prevents the sender from changing it underneath us, and
3510 * also lets us keep it around in the share state table if needed.
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003511 */
J-Alves33c47bf2022-09-29 11:36:20 +01003512 allocated_entry = mpool_alloc(&api_page_pool);
3513 if (allocated_entry == NULL) {
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003514 dlog_verbose("Failed to allocate memory region copy.\n");
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003515 return ffa_error(FFA_NO_MEMORY);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003516 }
J-Alves33c47bf2022-09-29 11:36:20 +01003517
J-Alves8f2150d2024-03-28 16:15:56 +00003518 if (!memcpy_trapped(allocated_entry, MM_PPOOL_ENTRY_SIZE, from_msg,
3519 fragment_length)) {
3520 dlog_error(
3521 "%s: Failed to copy FF-A memory region descriptor.\n",
3522 __func__);
3523 return ffa_error(FFA_ABORTED);
3524 }
J-Alves33c47bf2022-09-29 11:36:20 +01003525
Daniel Boulbyc7dc9322023-10-27 15:12:07 +01003526 if (!ffa_memory_region_sanity_check(allocated_entry, ffa_version,
3527 fragment_length, true)) {
3528 ret = ffa_error(FFA_INVALID_PARAMETERS);
3529 goto out;
3530 }
3531
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003532 ret = api_ffa_memory_transaction_descriptor_v1_1_from_v1_0(
3533 allocated_entry, &fragment_length, &length, ffa_version, true);
J-Alves33c47bf2022-09-29 11:36:20 +01003534 if (ret.func != FFA_SUCCESS_32) {
3535 goto out;
3536 }
3537
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003538 memory_region = allocated_entry;
3539
J-Alves33c47bf2022-09-29 11:36:20 +01003540 if (fragment_length < sizeof(struct ffa_memory_region) +
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003541 memory_region->memory_access_desc_size) {
J-Alves33c47bf2022-09-29 11:36:20 +01003542 dlog_verbose(
3543 "Initial fragment length %d smaller than header size "
Karl Meakine8937d92024-03-19 16:04:25 +00003544 "%lu.\n",
J-Alves33c47bf2022-09-29 11:36:20 +01003545 fragment_length,
3546 sizeof(struct ffa_memory_region) +
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003547 memory_region->memory_access_desc_size);
3548 ret = ffa_error(FFA_INVALID_PARAMETERS);
3549 goto out;
J-Alves33c47bf2022-09-29 11:36:20 +01003550 }
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003551
J-Alves84658fc2021-06-17 14:37:32 +01003552 if (!api_memory_region_check_flags(memory_region, share_func)) {
3553 dlog_verbose(
3554 "Memory region reserved arguments must be zero.\n");
3555 ret = ffa_error(FFA_INVALID_PARAMETERS);
3556 goto out;
3557 }
3558
J-Alves363f5722022-04-25 17:37:37 +01003559 if (memory_region->receiver_count == 0U) {
3560 dlog_verbose("Receiver count can't be 0.\n");
3561 ret = ffa_error(FFA_INVALID_PARAMETERS);
3562 goto out;
3563 }
3564
J-Alves95fbb312024-03-20 15:19:16 +00003565 if ((share_func == FFA_MEM_DONATE_32 ||
3566 share_func == FFA_MEM_DONATE_64) &&
J-Alves363f5722022-04-25 17:37:37 +01003567 memory_region->receiver_count != 1U) {
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003568 dlog_verbose(
J-Alves0a824e92024-04-26 16:20:12 +01003569 "FFA_MEM_DONATE only supports one recipient. Specified "
3570 "%u\n",
J-Alves363f5722022-04-25 17:37:37 +01003571 memory_region->receiver_count);
3572 ret = ffa_error(FFA_INVALID_PARAMETERS);
3573 goto out;
3574 }
3575
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003576 /*
3577 * Ensure that the receiver VM exists and isn't the same as the sender.
J-Alves363f5722022-04-25 17:37:37 +01003578 * If there is a receiver from the other world, track it for later
3579 * forwarding if needed.
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003580 */
J-Alves363f5722022-04-25 17:37:37 +01003581 for (uint32_t i = 0U; i < memory_region->receiver_count; i++) {
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003582 struct ffa_memory_access *receiver =
3583 ffa_memory_region_get_receiver(memory_region, i);
J-Alvesc9227c82024-04-24 21:00:58 +01003584 ffa_id_t receiver_id;
3585
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003586 assert(receiver != NULL);
J-Alvesc9227c82024-04-24 21:00:58 +01003587
3588 receiver_id = receiver->receiver_permissions.receiver;
Daniel Boulbyd5ae44b2023-12-12 12:18:11 +00003589
J-Alves363f5722022-04-25 17:37:37 +01003590 to = vm_find(receiver_id);
3591
J-Alves7de61af2024-03-27 10:29:46 +00003592 if ((vm_id_is_current_world(receiver_id) && to == NULL) ||
3593 to == from) {
J-Alves363f5722022-04-25 17:37:37 +01003594 dlog_verbose("%s: invalid receiver.\n", __func__);
3595 ret = ffa_error(FFA_INVALID_PARAMETERS);
3596 goto out;
3597 }
3598
Karl Meakin117c8082024-12-04 16:03:28 +00003599 if (!ffa_memory_is_send_valid(
J-Alvesc9227c82024-04-24 21:00:58 +01003600 receiver_id, from->id, share_func,
3601 memory_region->receiver_count > 1)) {
J-Alves363f5722022-04-25 17:37:37 +01003602 ret = ffa_error(FFA_DENIED);
3603 goto out;
3604 }
3605
3606 /* Capture if any of the receivers is from the other world. */
3607 if (!targets_other_world) {
3608 targets_other_world =
3609 !vm_id_is_current_world(receiver_id);
3610 }
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003611 }
3612
J-Alves363f5722022-04-25 17:37:37 +01003613 if (targets_other_world) {
Karl Meakin117c8082024-12-04 16:03:28 +00003614 ret = ffa_memory_other_world_mem_send(
J-Alves66652252022-07-06 09:49:51 +01003615 from, share_func, &memory_region, length,
3616 fragment_length, &api_page_pool);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003617 } else {
3618 struct vm_locked from_locked = vm_lock(from);
3619
Andrew Walbran1a86aa92020-05-15 17:22:28 +01003620 ret = ffa_memory_send(from_locked, memory_region, length,
3621 fragment_length, share_func,
3622 &api_page_pool);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003623 /*
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003624 * ffa_memory_send takes ownership of the memory_region, so
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003625 * make sure we don't free it.
3626 */
3627 memory_region = NULL;
3628
3629 vm_unlock(&from_locked);
3630 }
3631
3632out:
3633 if (memory_region != NULL) {
3634 mpool_free(&api_page_pool, memory_region);
3635 }
3636
3637 return ret;
3638}
3639
J-Alvesc7270b72024-09-12 10:16:34 +01003640/**
3641 * An FFA_MEM_RETRIEVE_REQ from the hypervisor must specify the handle of the
3642 * memory transaction it is querying and all other fields must be 0.
3643 */
3644static bool api_ffa_memory_hypervisor_retrieve_request_validate(
3645 struct ffa_memory_region *request, enum ffa_version version)
3646{
3647 switch (version) {
3648 case FFA_VERSION_1_0: {
3649 struct ffa_memory_region_v1_0 *request_v1_0 =
3650 (struct ffa_memory_region_v1_0 *)request;
3651
3652 return request_v1_0->sender == 0U &&
3653 request_v1_0->attributes.shareability == 0U &&
3654 request_v1_0->attributes.cacheability == 0U &&
3655 request_v1_0->attributes.type == 0U &&
3656 request_v1_0->attributes.security == 0U &&
3657 request_v1_0->flags == 0U && request_v1_0->tag == 0U &&
3658 request_v1_0->receiver_count == 0U &&
Karl Meakin117c8082024-12-04 16:03:28 +00003659 ffa_memory_is_handle_allocated_by_current_world(
J-Alvesc7270b72024-09-12 10:16:34 +01003660 request_v1_0->handle);
3661 }
3662 default:
3663 return request->sender == 0U &&
3664 request->attributes.shareability == 0U &&
3665 request->attributes.cacheability == 0U &&
3666 request->attributes.type == 0U &&
3667 request->attributes.security == 0U &&
3668 request->flags == 0U && request->tag == 0U &&
3669 request->memory_access_desc_size == 0U &&
3670 request->receiver_count == 0U &&
3671 request->receivers_offset == 0U &&
Karl Meakin117c8082024-12-04 16:03:28 +00003672 ffa_memory_is_handle_allocated_by_current_world(
J-Alvesc7270b72024-09-12 10:16:34 +01003673 request->handle);
3674 }
3675}
3676
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003677struct ffa_value api_ffa_mem_retrieve_req(uint32_t length,
3678 uint32_t fragment_length,
3679 ipaddr_t address, uint32_t page_count,
3680 struct vcpu *current)
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003681{
3682 struct vm *to = current->vm;
3683 struct vm_locked to_locked;
3684 const void *to_msg;
J-Alves00847062022-10-03 17:08:44 +01003685 void *retrieve_msg;
3686 struct ffa_memory_region *retrieve_request = NULL;
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003687 uint32_t message_buffer_size;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003688 struct ffa_value ret;
Karl Meakin0e617d92024-04-05 12:55:22 +01003689 enum ffa_version ffa_version;
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003690
3691 if (ipa_addr(address) != 0 || page_count != 0) {
3692 /*
3693 * Hafnium only supports passing the descriptor in the TX
3694 * mailbox.
3695 */
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003696 return ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003697 }
3698
Andrew Walbrana65a1322020-04-06 19:32:32 +01003699 if (fragment_length != length) {
J-Alves33c47bf2022-09-29 11:36:20 +01003700 dlog_verbose("Fragmentation not supported.\n");
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003701 return ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003702 }
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003703
J-Alves00847062022-10-03 17:08:44 +01003704 retrieve_msg = cpu_get_buffer(current->cpu);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003705 message_buffer_size = cpu_get_buffer_size(current->cpu);
3706 if (length > HF_MAILBOX_SIZE || length > message_buffer_size) {
3707 dlog_verbose("Retrieve request too long.\n");
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003708 return ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003709 }
3710
3711 to_locked = vm_lock(to);
3712 to_msg = to->mailbox.send;
J-Alves00847062022-10-03 17:08:44 +01003713 ffa_version = to->ffa_version;
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003714
3715 if (to_msg == NULL) {
3716 dlog_verbose("TX buffer not setup.\n");
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003717 ret = ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003718 goto out;
3719 }
3720
3721 /*
3722 * Copy the retrieve request descriptor to an internal buffer, so that
3723 * the caller can't change it underneath us.
3724 */
J-Alves8f2150d2024-03-28 16:15:56 +00003725 if (!memcpy_trapped(retrieve_msg, message_buffer_size, to_msg,
3726 length)) {
3727 dlog_error(
3728 "%s: Failed to copy FF-A retrieve request "
3729 "descriptor.\n",
3730 __func__);
3731 ret = ffa_error(FFA_ABORTED);
3732 goto out;
3733 }
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003734
J-Alvese8c8c2b2022-12-16 15:34:48 +00003735 if ((vm_is_mailbox_other_world_owned(to_locked) &&
Karl Meakin117c8082024-12-04 16:03:28 +00003736 !ffa_setup_acquire_receiver_rx(to_locked, &ret)) ||
J-Alvese8c8c2b2022-12-16 15:34:48 +00003737 vm_is_mailbox_busy(to_locked)) {
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003738 /*
J-Alvese8c8c2b2022-12-16 15:34:48 +00003739 * Can't retrieve memory information if the mailbox is
3740 * not available.
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003741 */
J-Alves59ed0042022-07-28 18:26:41 +01003742 dlog_verbose("%s: RX buffer not ready.\n", __func__);
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003743 ret = ffa_error(FFA_BUSY);
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003744 goto out;
3745 }
3746
Daniel Boulby296ee702023-11-28 13:36:55 +00003747 if (!is_ffa_hypervisor_retrieve_request(retrieve_msg)) {
Daniel Boulby44e9b3b2024-01-17 12:21:44 +00003748 if (!ffa_memory_region_sanity_check(retrieve_msg, ffa_version,
3749 fragment_length, false)) {
3750 ret = ffa_error(FFA_INVALID_PARAMETERS);
3751 goto out;
3752 }
3753 /*
3754 * If required, transform the retrieve request to FF-A v1.1.
3755 */
3756 ret = api_ffa_memory_transaction_descriptor_v1_1_from_v1_0(
3757 retrieve_msg, &fragment_length, &length, ffa_version,
3758 false);
Daniel Boulbyc7dc9322023-10-27 15:12:07 +01003759
Daniel Boulby44e9b3b2024-01-17 12:21:44 +00003760 if (ret.func != FFA_SUCCESS_32) {
3761 goto out;
3762 }
J-Alvesc7270b72024-09-12 10:16:34 +01003763 } else {
3764 if (!api_ffa_memory_hypervisor_retrieve_request_validate(
3765 retrieve_msg, ffa_version)) {
3766 dlog_verbose(
3767 "All fields except the handle in the "
3768 "memory access descriptor must be zero for a "
3769 "hypervisor retrieve request.\n");
3770 ret = ffa_error(FFA_INVALID_PARAMETERS);
3771 goto out;
3772 }
J-Alves00847062022-10-03 17:08:44 +01003773 }
3774
Daniel Boulby36e0bdb2023-10-09 12:00:41 +01003775 retrieve_request = retrieve_msg;
Kathleen Capella578784f2023-09-01 18:03:27 -04003776
Karl Meakin117c8082024-12-04 16:03:28 +00003777 if (ffa_memory_is_handle_allocated_by_current_world(
J-Alvesb5084cf2022-07-06 14:20:12 +01003778 retrieve_request->handle)) {
3779 ret = ffa_memory_retrieve(to_locked, retrieve_request, length,
3780 &api_page_pool);
3781 } else {
Daniel Boulbyfdd59f72023-10-19 16:43:19 +01003782 dlog_error("Invalid FF-A memory handle.\n");
3783 ret = ffa_error(FFA_INVALID_PARAMETERS);
J-Alvesb5084cf2022-07-06 14:20:12 +01003784 }
Andrew Walbrane908c4a2019-12-02 17:13:47 +00003785out:
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003786 vm_unlock(&to_locked);
3787 return ret;
3788}
3789
J-Alvesa39a8442024-04-26 15:41:47 +01003790/**
3791 * Copies the memory relinquish descriptor from the partition's TX buffer, to
3792 * the buffer of the local CPU. Do it safely, and return error if:
3793 * - FFA_ABORTED: if the `memcpy_trapped` fails.
3794 * - FFA_INVALID_PARAMETERS: if the size of the full memory relinquish
3795 * descriptor doesn't fit the local CPU buffer.
3796 *
3797 * Returns FFA_SUCCESS if copying goes well, and sets 'out_relinquish'
3798 * to the address of the cpu buffer with the relinquish descriptor.
3799 */
3800static struct ffa_value api_get_ffa_mem_relinquish_descriptor(
3801 struct vcpu *current, const void *from_msg,
3802 struct ffa_mem_relinquish **out_relinquish)
3803{
3804 struct ffa_mem_relinquish *relinquish_request;
3805 uint32_t from_msg_size;
3806 uint32_t total_from_msg_size;
3807 uint32_t dst_size;
3808 vaddr_t dst;
3809 vaddr_t src;
3810
3811 assert(from_msg != NULL);
3812 assert(out_relinquish != NULL);
3813
3814 /*
3815 * Copy the relinquish descriptor to an internal buffer, so that the
3816 * caller can't change it underneath us.
3817 */
3818 relinquish_request =
3819 (struct ffa_mem_relinquish *)cpu_get_buffer(current->cpu);
3820
3821 /* Set the destination for the copy. */
3822 dst = va_from_ptr(relinquish_request);
3823 src = va_from_ptr(from_msg);
3824
3825 dst_size = cpu_get_buffer_size(current->cpu);
3826
3827 /* Only copy the size to start with. */
3828 from_msg_size = sizeof(struct ffa_mem_relinquish);
3829 total_from_msg_size = from_msg_size;
3830
3831 if (!memcpy_trapped(ptr_from_va(dst), dst_size, ptr_from_va(src),
3832 from_msg_size)) {
3833 dlog_error(
3834 "%s: Failed to copy FF-A memory relinquish "
3835 "descriptor.\n",
3836 __func__);
3837 return ffa_error(FFA_ABORTED);
3838 }
3839
3840 if (relinquish_request->endpoint_count != 1) {
3841 dlog_error("%s: relinquish descriptor must have 1 endpoint\n",
3842 __func__);
3843 return ffa_error(FFA_INVALID_PARAMETERS);
3844 }
3845
3846 /*
3847 * Increment the `dst` to the position right after the copied header.
3848 * Increment the `src` to point at the list of endpoints.
3849 *
3850 * Calculate the new `dst_size` which is the size of the allocated cpu
3851 * buffer, minus the size of the copied memory relinquish header.
3852 *
3853 * Only after the above: determine the new `from_msg_size` in accordance
3854 * to the endpoint count.
3855 */
3856 dst = va_add(dst, from_msg_size);
3857 src = va_add(src, from_msg_size);
3858
3859 /*
3860 * Check if it is safe to copy the rest of the message.
3861 * This also serves as a santiy check to 'endpoint_count'.
3862 * The size of what is left in the descriptor, based on endpoint_count,
3863 * shall not be bigger than the size of the mailbox minus the size of
3864 * the header which was previously copied in this function.
3865 */
3866 dst_size -= from_msg_size;
3867 from_msg_size = relinquish_request->endpoint_count * sizeof(ffa_id_t);
3868 total_from_msg_size += from_msg_size;
3869
3870 if (total_from_msg_size > HF_MAILBOX_SIZE ||
3871 total_from_msg_size > dst_size) {
3872 dlog_verbose(
3873 "Relinquish message too long. Endpoint count: %u\n",
3874 relinquish_request->endpoint_count);
3875 return ffa_error(FFA_INVALID_PARAMETERS);
3876 }
3877
3878 /* Copy the remaining fragment. */
3879 if (!memcpy_trapped(ptr_from_va(dst), dst_size, ptr_from_va(src),
3880 from_msg_size)) {
3881 dlog_error("%s: Failed to copy FF-A relinquish request.\n",
3882 __func__);
3883 return ffa_error(FFA_ABORTED);
3884 }
3885
3886 /*
3887 * Set the output address for the relinquish descriptor to the current
3888 * cpu's buffer.
3889 */
3890 *out_relinquish = relinquish_request;
3891
3892 return (struct ffa_value){.func = FFA_SUCCESS_32};
3893}
3894
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003895struct ffa_value api_ffa_mem_relinquish(struct vcpu *current)
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003896{
3897 struct vm *from = current->vm;
3898 struct vm_locked from_locked;
3899 const void *from_msg;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003900 struct ffa_value ret;
J-Alvesa39a8442024-04-26 15:41:47 +01003901 struct ffa_mem_relinquish *relinquish_request;
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003902
3903 from_locked = vm_lock(from);
3904 from_msg = from->mailbox.send;
3905
3906 if (from_msg == NULL) {
3907 dlog_verbose("TX buffer not setup.\n");
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003908 ret = ffa_error(FFA_INVALID_PARAMETERS);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003909 goto out;
3910 }
3911
J-Alvesa39a8442024-04-26 15:41:47 +01003912 ret = api_get_ffa_mem_relinquish_descriptor(current, from_msg,
3913 &relinquish_request);
3914
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003915 /*
J-Alvesa39a8442024-04-26 15:41:47 +01003916 * If the descriptor was safely copied, continue with the handling of
3917 * the retrieve request.
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003918 */
J-Alvesa39a8442024-04-26 15:41:47 +01003919 if (ret.func == FFA_SUCCESS_32) {
3920 ret = ffa_memory_relinquish(from_locked, relinquish_request,
3921 &api_page_pool);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003922 }
J-Alves8f2150d2024-03-28 16:15:56 +00003923
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003924out:
3925 vm_unlock(&from_locked);
3926 return ret;
3927}
3928
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003929struct ffa_value api_ffa_mem_reclaim(ffa_memory_handle_t handle,
3930 ffa_memory_region_flags_t flags,
3931 struct vcpu *current)
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003932{
3933 struct vm *to = current->vm;
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003934 struct ffa_value ret;
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003935
Karl Meakin117c8082024-12-04 16:03:28 +00003936 if (ffa_memory_is_handle_allocated_by_current_world(handle)) {
Andrew Walbran290b0c92020-02-03 16:37:14 +00003937 struct vm_locked to_locked = vm_lock(to);
3938
Andrew Walbranca808b12020-05-15 17:22:28 +01003939 ret = ffa_memory_reclaim(to_locked, handle, flags,
Andrew Walbranb5ab43c2020-04-30 11:32:54 +01003940 &api_page_pool);
Andrew Walbran5de9c3d2020-02-10 13:35:29 +00003941
Andrew Walbran290b0c92020-02-03 16:37:14 +00003942 vm_unlock(&to_locked);
3943 } else {
Karl Meakin117c8082024-12-04 16:03:28 +00003944 ret = ffa_memory_other_world_mem_reclaim(to, handle, flags,
3945 &api_page_pool);
Andrew Walbranca808b12020-05-15 17:22:28 +01003946 }
3947
3948 return ret;
3949}
3950
3951struct ffa_value api_ffa_mem_frag_rx(ffa_memory_handle_t handle,
3952 uint32_t fragment_offset,
J-Alves19e20cf2023-08-02 12:48:55 +01003953 ffa_id_t sender_vm_id,
Andrew Walbranca808b12020-05-15 17:22:28 +01003954 struct vcpu *current)
3955{
3956 struct vm *to = current->vm;
3957 struct vm_locked to_locked;
3958 struct ffa_value ret;
3959
3960 /* Sender ID MBZ at virtual instance. */
J-Alves59ed0042022-07-28 18:26:41 +01003961 if (vm_id_is_current_world(to->id)) {
3962 if (sender_vm_id != 0) {
3963 dlog_verbose("%s: Invalid sender.\n", __func__);
3964 return ffa_error(FFA_INVALID_PARAMETERS);
3965 }
Andrew Walbranca808b12020-05-15 17:22:28 +01003966 }
3967
3968 to_locked = vm_lock(to);
3969
J-Alves122f1a12022-12-12 15:55:42 +00003970 if (vm_is_mailbox_busy(to_locked)) {
Andrew Walbranca808b12020-05-15 17:22:28 +01003971 /*
3972 * Can't retrieve memory information if the mailbox is not
3973 * available.
3974 */
J-Alves59ed0042022-07-28 18:26:41 +01003975 dlog_verbose("%s: RX buffer not ready partition %x.\n",
3976 __func__, to_locked.vm->id);
Andrew Walbranca808b12020-05-15 17:22:28 +01003977 ret = ffa_error(FFA_BUSY);
3978 goto out;
3979 }
3980
J-Alvesc3fd9752024-04-04 11:45:33 +01003981 /*
3982 * Whilst copying the fragments, initialize the remaining constituents
3983 * in the CPU's internal structure, and later copy from the CPU buffer
3984 * into the partition's RX buffer. In the case SPMC is doing a retrieve
3985 * request for a VM/Hypervisor in an RME enabled system, there is no
3986 * guarantee the RX buffer is in the NS PAS. Accessing the buffer with
3987 * the wrong security state attribute would then result in an GPF.
3988 * The fragment is initialized in an internal buffer, and is later
3989 * copied to the RX buffer using the 'memcpy_trapped' which allows to
3990 * smoothly terminate the operation if the access has been preempted by
3991 * a GPF exception.
3992 */
3993 ret = ffa_memory_retrieve_continue(
3994 to_locked, handle, fragment_offset, sender_vm_id,
3995 cpu_get_buffer(current->cpu), &api_page_pool);
Andrew Walbranca808b12020-05-15 17:22:28 +01003996out:
3997 vm_unlock(&to_locked);
3998 return ret;
3999}
4000
4001struct ffa_value api_ffa_mem_frag_tx(ffa_memory_handle_t handle,
4002 uint32_t fragment_length,
J-Alves19e20cf2023-08-02 12:48:55 +01004003 ffa_id_t sender_vm_id,
Andrew Walbranca808b12020-05-15 17:22:28 +01004004 struct vcpu *current)
4005{
4006 struct vm *from = current->vm;
4007 const void *from_msg;
4008 void *fragment_copy;
4009 struct ffa_value ret;
4010
4011 /* Sender ID MBZ at virtual instance. */
J-Alvesfdd29272022-07-19 13:16:31 +01004012 if (vm_id_is_current_world(from->id) && sender_vm_id != 0) {
4013 dlog_verbose("Invalid sender.");
Andrew Walbranca808b12020-05-15 17:22:28 +01004014 return ffa_error(FFA_INVALID_PARAMETERS);
4015 }
4016
4017 /*
4018 * Check that the sender has configured its send buffer. If the TX
4019 * mailbox at from_msg is configured (i.e. from_msg != NULL) then it can
4020 * be safely accessed after releasing the lock since the TX mailbox
4021 * address can only be configured once.
4022 */
4023 sl_lock(&from->lock);
4024 from_msg = from->mailbox.send;
4025 sl_unlock(&from->lock);
4026
4027 if (from_msg == NULL) {
J-Alves59ed0042022-07-28 18:26:41 +01004028 dlog_verbose("Mailbox from %x is not set.\n", from->id);
Andrew Walbranca808b12020-05-15 17:22:28 +01004029 return ffa_error(FFA_INVALID_PARAMETERS);
4030 }
4031
4032 /*
4033 * Copy the fragment to a fresh page from the memory pool. This prevents
4034 * the sender from changing it underneath us, and also lets us keep it
4035 * around in the share state table if needed.
4036 */
4037 if (fragment_length > HF_MAILBOX_SIZE ||
4038 fragment_length > MM_PPOOL_ENTRY_SIZE) {
4039 dlog_verbose(
Karl Meakine8937d92024-03-19 16:04:25 +00004040 "Fragment length %d larger than mailbox size %zu.\n",
Andrew Walbranca808b12020-05-15 17:22:28 +01004041 fragment_length, HF_MAILBOX_SIZE);
4042 return ffa_error(FFA_INVALID_PARAMETERS);
4043 }
4044 if (fragment_length < sizeof(struct ffa_memory_region_constituent) ||
4045 fragment_length % sizeof(struct ffa_memory_region_constituent) !=
4046 0) {
4047 dlog_verbose("Invalid fragment length %d.\n", fragment_length);
4048 return ffa_error(FFA_INVALID_PARAMETERS);
4049 }
4050 fragment_copy = mpool_alloc(&api_page_pool);
4051 if (fragment_copy == NULL) {
4052 dlog_verbose("Failed to allocate fragment copy.\n");
4053 return ffa_error(FFA_NO_MEMORY);
4054 }
J-Alves8f2150d2024-03-28 16:15:56 +00004055
4056 if (!memcpy_trapped(fragment_copy, MM_PPOOL_ENTRY_SIZE, from_msg,
4057 fragment_length)) {
4058 dlog_error("%s: Failed to copy fragment.\n", __func__);
4059 return ffa_error(FFA_ABORTED);
4060 }
Andrew Walbranca808b12020-05-15 17:22:28 +01004061
4062 /*
4063 * Hafnium doesn't support fragmentation of memory retrieve requests
4064 * (because it doesn't support caller-specified mappings, so a request
4065 * will never be larger than a single page), so this must be part of a
4066 * memory send (i.e. donate, lend or share) request.
4067 *
4068 * We can tell from the handle whether the memory transaction is for the
J-Alvesfdd29272022-07-19 13:16:31 +01004069 * other world or not.
Andrew Walbranca808b12020-05-15 17:22:28 +01004070 */
Karl Meakin117c8082024-12-04 16:03:28 +00004071 if (ffa_memory_is_handle_allocated_by_current_world(handle)) {
Andrew Walbranca808b12020-05-15 17:22:28 +01004072 struct vm_locked from_locked = vm_lock(from);
4073
4074 ret = ffa_memory_send_continue(from_locked, fragment_copy,
4075 fragment_length, handle,
4076 &api_page_pool);
4077 /*
4078 * `ffa_memory_send_continue` takes ownership of the
4079 * fragment_copy, so we don't need to free it here.
4080 */
4081 vm_unlock(&from_locked);
4082 } else {
Karl Meakin117c8082024-12-04 16:03:28 +00004083 ret = ffa_memory_other_world_mem_send_continue(
J-Alvesfdd29272022-07-19 13:16:31 +01004084 from, fragment_copy, fragment_length, handle,
4085 &api_page_pool);
Andrew Walbran290b0c92020-02-03 16:37:14 +00004086 }
Andrew Walbrane908c4a2019-12-02 17:13:47 +00004087
4088 return ret;
4089}
Max Shvetsov40108e72020-08-27 12:39:50 +01004090
Olivier Deprezd614d322021-06-18 15:21:00 +02004091/**
4092 * Register an entry point for a vCPU in warm boot cases.
4093 * DEN0077A FF-A v1.1 Beta0 section 18.3.2.1 FFA_SECONDARY_EP_REGISTER.
4094 */
Max Shvetsov40108e72020-08-27 12:39:50 +01004095struct ffa_value api_ffa_secondary_ep_register(ipaddr_t entry_point,
4096 struct vcpu *current)
4097{
4098 struct vm_locked vm_locked;
Olivier Deprezb2808332023-02-02 15:25:40 +01004099 struct vcpu_locked current_locked;
Max Shvetsov40108e72020-08-27 12:39:50 +01004100
Olivier Deprezd614d322021-06-18 15:21:00 +02004101 /*
4102 * Reject if interface is not supported at this FF-A instance
4103 * (DEN0077A FF-A v1.1 Beta0 Table 18.29) or the VM is UP.
4104 */
Karl Meakin117c8082024-12-04 16:03:28 +00004105 if (!ffa_setup_is_secondary_ep_register_supported() ||
Karl Meakin82041822024-05-20 11:14:34 +01004106 vm_is_up(current->vm)) {
Olivier Deprezd614d322021-06-18 15:21:00 +02004107 return ffa_error(FFA_NOT_SUPPORTED);
4108 }
4109
4110 /*
4111 * No further check is made on the address validity
4112 * (FF-A v1.1 Beta0 Table 18.29) as the VM boundaries are not known
4113 * from the VM or vCPU structure.
4114 * DEN0077A FF-A v1.1 Beta0 section 18.3.2.1.1:
4115 * For each SP [...] the Framework assumes that the same entry point
4116 * address is used for initializing any execution context during a
4117 * secondary cold boot.
4118 * If this function is invoked multiple times, then the entry point
4119 * address specified in the last valid invocation must be used by the
4120 * callee.
4121 */
Olivier Deprezb2808332023-02-02 15:25:40 +01004122 current_locked = vcpu_lock(current);
4123 if (current->rt_model != RTM_SP_INIT) {
4124 dlog_error(
4125 "FFA_SECONDARY_EP_REGISTER can only be called while "
4126 "vCPU in run-time state for initialization.\n");
4127 vcpu_unlock(&current_locked);
4128 return ffa_error(FFA_DENIED);
Olivier Deprezd614d322021-06-18 15:21:00 +02004129 }
Olivier Deprezb2808332023-02-02 15:25:40 +01004130 vcpu_unlock(&current_locked);
Olivier Deprezd614d322021-06-18 15:21:00 +02004131
Olivier Deprezb2808332023-02-02 15:25:40 +01004132 vm_locked = vm_lock(current->vm);
Max Shvetsov40108e72020-08-27 12:39:50 +01004133 vm_locked.vm->secondary_ep = entry_point;
4134 vm_unlock(&vm_locked);
4135
Olivier Deprezb2808332023-02-02 15:25:40 +01004136 return (struct ffa_value){.func = FFA_SUCCESS_32};
Max Shvetsov40108e72020-08-27 12:39:50 +01004137}
J-Alvesa0f317d2021-06-09 13:31:59 +01004138
J-Alves19e20cf2023-08-02 12:48:55 +01004139struct ffa_value api_ffa_notification_bitmap_create(ffa_id_t vm_id,
J-Alvesa0f317d2021-06-09 13:31:59 +01004140 ffa_vcpu_count_t vcpu_count,
4141 struct vcpu *current)
4142{
J-Alves7ccaccf2024-02-01 14:25:23 +00004143 const struct ffa_value ret =
Karl Meakin117c8082024-12-04 16:03:28 +00004144 ffa_notifications_is_bitmap_access_valid(current, vm_id);
J-Alves7ccaccf2024-02-01 14:25:23 +00004145
4146 if (ffa_func_id(ret) != FFA_SUCCESS_32) {
4147 dlog_verbose(
4148 "FFA_NOTIFICATION_BITMAP_CREATE to be used by "
4149 "hypervisor for valid NWd VM IDs only (%x).\n",
4150 vm_id);
4151 return ret;
J-Alvesa0f317d2021-06-09 13:31:59 +01004152 }
4153
Karl Meakin117c8082024-12-04 16:03:28 +00004154 return ffa_notifications_bitmap_create(vm_id, vcpu_count);
J-Alvesa0f317d2021-06-09 13:31:59 +01004155}
4156
J-Alves19e20cf2023-08-02 12:48:55 +01004157struct ffa_value api_ffa_notification_bitmap_destroy(ffa_id_t vm_id,
J-Alvesa0f317d2021-06-09 13:31:59 +01004158 struct vcpu *current)
4159{
J-Alves7ccaccf2024-02-01 14:25:23 +00004160 const struct ffa_value ret =
Karl Meakin117c8082024-12-04 16:03:28 +00004161 ffa_notifications_is_bitmap_access_valid(current, vm_id);
J-Alves7ccaccf2024-02-01 14:25:23 +00004162
4163 if (ffa_func_id(ret) != FFA_SUCCESS_32) {
4164 dlog_verbose(
4165 "FFA_NOTIFICATION_BITMAP_DESTROY to be used by "
4166 "hypervisor for valid NWd VM IDs only (%x).\n",
4167 vm_id);
4168 return ret;
J-Alvesa0f317d2021-06-09 13:31:59 +01004169 }
4170
Karl Meakin117c8082024-12-04 16:03:28 +00004171 return ffa_notifications_bitmap_destroy(vm_id);
J-Alvesa0f317d2021-06-09 13:31:59 +01004172}
J-Alvesc003a7a2021-03-18 13:06:53 +00004173
4174struct ffa_value api_ffa_notification_update_bindings(
J-Alves19e20cf2023-08-02 12:48:55 +01004175 ffa_id_t sender_vm_id, ffa_id_t receiver_vm_id, uint32_t flags,
J-Alvesc003a7a2021-03-18 13:06:53 +00004176 ffa_notifications_bitmap_t notifications, bool is_bind,
4177 struct vcpu *current)
4178{
4179 struct ffa_value ret = {.func = FFA_SUCCESS_32};
4180 struct vm_locked receiver_locked;
4181 const bool is_per_vcpu = (flags & FFA_NOTIFICATION_FLAG_PER_VCPU) != 0U;
J-Alves19e20cf2023-08-02 12:48:55 +01004182 const ffa_id_t id_to_update = is_bind ? sender_vm_id : HF_INVALID_VM_ID;
4183 const ffa_id_t id_to_validate =
J-Alvesc003a7a2021-03-18 13:06:53 +00004184 is_bind ? HF_INVALID_VM_ID : sender_vm_id;
J-Alves1daeaea2022-09-06 17:41:24 +01004185 const uint32_t flags_mbz =
4186 is_bind ? ~FFA_NOTIFICATIONS_FLAG_PER_VCPU : ~0U;
4187
4188 if ((flags_mbz & flags) != 0U) {
4189 return ffa_error(FFA_INVALID_PARAMETERS);
4190 }
J-Alvesc003a7a2021-03-18 13:06:53 +00004191
Karl Meakin117c8082024-12-04 16:03:28 +00004192 if (!ffa_notifications_is_bind_valid(current, sender_vm_id,
4193 receiver_vm_id)) {
J-Alvesc003a7a2021-03-18 13:06:53 +00004194 dlog_verbose("Invalid use of notifications bind interface.\n");
4195 return ffa_error(FFA_INVALID_PARAMETERS);
4196 }
4197
Karl Meakin117c8082024-12-04 16:03:28 +00004198 if (ffa_notifications_update_bindings_forward(
J-Alvesb15e9402021-09-08 11:44:42 +01004199 receiver_vm_id, sender_vm_id, flags, notifications, is_bind,
4200 &ret)) {
J-Alvesb15e9402021-09-08 11:44:42 +01004201 return ret;
4202 }
4203
J-Alvesc003a7a2021-03-18 13:06:53 +00004204 if (notifications == 0U) {
Karl Meakine8937d92024-03-19 16:04:25 +00004205 dlog_verbose("No notifications have been specified %lx.\n",
J-Alves1512acc2024-02-01 16:57:10 +00004206 notifications);
J-Alvesc003a7a2021-03-18 13:06:53 +00004207 return ffa_error(FFA_INVALID_PARAMETERS);
4208 }
4209
4210 /**
4211 * This check assumes receiver is the current VM, and has been enforced
Karl Meakin117c8082024-12-04 16:03:28 +00004212 * by 'ffa_notifications_is_bind_valid'.
J-Alvesc003a7a2021-03-18 13:06:53 +00004213 */
Karl Meakin117c8082024-12-04 16:03:28 +00004214 receiver_locked = ffa_vm_find_locked(receiver_vm_id);
J-Alvesc003a7a2021-03-18 13:06:53 +00004215
4216 if (receiver_locked.vm == NULL) {
4217 dlog_verbose("Receiver doesn't exist!\n");
J-Alves7333dcf2024-02-01 17:25:10 +00004218 return ffa_error(FFA_INVALID_PARAMETERS);
J-Alvesc003a7a2021-03-18 13:06:53 +00004219 }
4220
J-Alves3e55c4d2024-10-09 14:24:07 +01004221 if (receiver_locked.vm->ffa_version < FFA_VERSION_1_1) {
4222 dlog_verbose(
4223 "%s: caller (%x) version should be GE to FF-A v1.1.\n",
4224 __func__, receiver_locked.vm->id);
4225 ret = ffa_error(FFA_NOT_SUPPORTED);
4226 goto out;
4227 }
4228
J-Alves09ff9d82021-11-02 11:55:20 +00004229 if (!vm_locked_are_notifications_enabled(receiver_locked)) {
J-Alvesc003a7a2021-03-18 13:06:53 +00004230 dlog_verbose("Notifications are not enabled.\n");
4231 ret = ffa_error(FFA_NOT_SUPPORTED);
4232 goto out;
4233 }
4234
4235 if (is_bind && vm_id_is_current_world(sender_vm_id) &&
4236 vm_find(sender_vm_id) == NULL) {
4237 dlog_verbose("Sender VM does not exist!\n");
4238 ret = ffa_error(FFA_INVALID_PARAMETERS);
4239 goto out;
4240 }
4241
4242 /*
4243 * Can't bind/unbind notifications if at least one is bound to a
4244 * different sender.
4245 */
4246 if (!vm_notifications_validate_bound_sender(
J-Alves661e1b72023-08-02 13:39:40 +01004247 receiver_locked, ffa_is_vm_id(sender_vm_id), id_to_validate,
4248 notifications)) {
J-Alvesf0208142024-02-01 17:28:58 +00004249 dlog_verbose(
Karl Meakine8937d92024-03-19 16:04:25 +00004250 "Sender %x not permitted to set notifications %lx to "
J-Alvesf0208142024-02-01 17:28:58 +00004251 "%x.\n",
4252 sender_vm_id, notifications, receiver_vm_id);
J-Alvesc003a7a2021-03-18 13:06:53 +00004253 ret = ffa_error(FFA_DENIED);
4254 goto out;
4255 }
4256
4257 /**
4258 * Check if there is a pending notification within those specified in
4259 * the bitmap.
4260 */
4261 if (vm_are_notifications_pending(receiver_locked,
J-Alves661e1b72023-08-02 13:39:40 +01004262 ffa_is_vm_id(sender_vm_id),
J-Alvesc003a7a2021-03-18 13:06:53 +00004263 notifications)) {
Karl Meakine8937d92024-03-19 16:04:25 +00004264 dlog_verbose("Notifications within '%lx' pending.\n",
J-Alvesc003a7a2021-03-18 13:06:53 +00004265 notifications);
4266 ret = ffa_error(FFA_DENIED);
4267 goto out;
4268 }
4269
4270 vm_notifications_update_bindings(
J-Alves661e1b72023-08-02 13:39:40 +01004271 receiver_locked, ffa_is_vm_id(sender_vm_id), id_to_update,
J-Alvesc003a7a2021-03-18 13:06:53 +00004272 notifications, is_per_vcpu && is_bind);
4273
4274out:
4275 vm_unlock(&receiver_locked);
4276 return ret;
4277}
J-Alvesaa79c012021-07-09 14:29:45 +01004278
4279struct ffa_value api_ffa_notification_set(
J-Alves19e20cf2023-08-02 12:48:55 +01004280 ffa_id_t sender_vm_id, ffa_id_t receiver_vm_id, uint32_t flags,
J-Alvesaa79c012021-07-09 14:29:45 +01004281 ffa_notifications_bitmap_t notifications, struct vcpu *current)
4282{
4283 struct ffa_value ret;
4284 struct vm_locked receiver_locked;
J-Alvesaa79c012021-07-09 14:29:45 +01004285 /*
4286 * Check if is per-vCPU or global, and extracting vCPU ID according
4287 * to table 17.19 of the FF-A v1.1 Beta 0 spec.
4288 */
4289 bool is_per_vcpu = (flags & FFA_NOTIFICATION_FLAG_PER_VCPU) != 0U;
4290 ffa_vcpu_index_t vcpu_id = (uint16_t)(flags >> 16);
J-Alves6b754a12024-02-14 14:26:30 +00004291 const uint32_t flags_mbz =
4292 ~(FFA_NOTIFICATIONS_FLAG_PER_VCPU |
4293 FFA_NOTIFICATIONS_FLAG_DELAY_SRI | (0xFFFFU << 16));
J-Alves41c5da32024-06-19 10:05:05 +01004294 const bool delay_sri = (FFA_NOTIFICATIONS_FLAG_DELAY_SRI & flags) != 0U;
J-Alves6b754a12024-02-14 14:26:30 +00004295
4296 if ((flags_mbz & flags) != 0U) {
4297 dlog_verbose("%s: caller shouldn't set bits that MBZ.\n",
4298 __func__);
4299 return ffa_error(FFA_INVALID_PARAMETERS);
4300 }
J-Alvesaa79c012021-07-09 14:29:45 +01004301
J-Alves30ac91d2024-02-14 15:33:12 +00004302 /* Global notifications must target any vCPU. */
4303 if (!is_per_vcpu && vcpu_id != 0U) {
4304 dlog_verbose(
4305 "For global notifications vCPU ID MBZ in call to set "
4306 "notifications.\n");
4307 return ffa_error(FFA_INVALID_PARAMETERS);
4308 }
4309
Karl Meakin117c8082024-12-04 16:03:28 +00004310 if (!ffa_notifications_is_set_valid(current, sender_vm_id,
4311 receiver_vm_id)) {
J-Alvesaa79c012021-07-09 14:29:45 +01004312 dlog_verbose("Invalid use of notifications set interface.\n");
4313 return ffa_error(FFA_INVALID_PARAMETERS);
4314 }
4315
4316 if (notifications == 0U) {
4317 dlog_verbose("No notifications have been specified.\n");
4318 return ffa_error(FFA_INVALID_PARAMETERS);
4319 }
4320
J-Alves41c5da32024-06-19 10:05:05 +01004321 /*
4322 * The 'Delay Schedule Receiver interrupt flag' only applies to the
4323 * secure virtual FF-A instance.
4324 */
4325 if (!vm_id_is_current_world(sender_vm_id) && delay_sri) {
4326 dlog_verbose(
4327 "The delay SRI flag can only be set at the secure "
4328 "virtual FF-A instance.\n");
4329 return ffa_error(FFA_INVALID_PARAMETERS);
4330 }
4331
Karl Meakin117c8082024-12-04 16:03:28 +00004332 if (ffa_notifications_set_forward(sender_vm_id, receiver_vm_id, flags,
4333 notifications, &ret)) {
J-Alvesde7bd2f2021-09-09 19:54:35 +01004334 return ret;
4335 }
4336
J-Alvesaa79c012021-07-09 14:29:45 +01004337 /*
4338 * This check assumes receiver is the current VM, and has been enforced
Karl Meakin117c8082024-12-04 16:03:28 +00004339 * by 'ffa_notifications_is_set_valid'.
J-Alvesaa79c012021-07-09 14:29:45 +01004340 */
Karl Meakin117c8082024-12-04 16:03:28 +00004341 receiver_locked = ffa_vm_find_locked(receiver_vm_id);
J-Alvesaa79c012021-07-09 14:29:45 +01004342
4343 if (receiver_locked.vm == NULL) {
4344 dlog_verbose("Receiver ID is not valid.\n");
4345 return ffa_error(FFA_INVALID_PARAMETERS);
4346 }
4347
J-Alves09ff9d82021-11-02 11:55:20 +00004348 if (!vm_locked_are_notifications_enabled(receiver_locked)) {
J-Alvesaa79c012021-07-09 14:29:45 +01004349 dlog_verbose("Receiver's notifications not enabled.\n");
4350 ret = ffa_error(FFA_DENIED);
4351 goto out;
4352 }
4353
4354 /*
J-Alves89c22132024-02-14 15:44:41 +00004355 * Check the if the notifications are bound as global if per-vCPU flag
4356 * is set, or if they are bound as per-vCPU and caller setting as
4357 * global. In either case, return FFA_INVALID_PARAMETERS.
4358 */
4359 if (vm_notifications_validate_binding(
4360 receiver_locked, ffa_is_vm_id(sender_vm_id), sender_vm_id,
4361 notifications, !is_per_vcpu)) {
Karl Meakine8937d92024-03-19 16:04:25 +00004362 dlog_verbose("Notifications in %lx are %s\n", notifications,
J-Alves89c22132024-02-14 15:44:41 +00004363 !is_per_vcpu ? "global" : "per-vCPU");
4364 ret = ffa_error(FFA_INVALID_PARAMETERS);
4365 goto out;
4366 }
4367
4368 /*
J-Alvesaa79c012021-07-09 14:29:45 +01004369 * If notifications are not bound to the sender, they wouldn't be
4370 * enabled either for the receiver.
4371 */
4372 if (!vm_notifications_validate_binding(
J-Alves661e1b72023-08-02 13:39:40 +01004373 receiver_locked, ffa_is_vm_id(sender_vm_id), sender_vm_id,
4374 notifications, is_per_vcpu)) {
J-Alvesaa79c012021-07-09 14:29:45 +01004375 dlog_verbose("Notifications bindings not valid.\n");
4376 ret = ffa_error(FFA_DENIED);
4377 goto out;
4378 }
4379
4380 if (is_per_vcpu && vcpu_id >= receiver_locked.vm->vcpu_count) {
4381 dlog_verbose("Invalid VCPU ID!\n");
4382 ret = ffa_error(FFA_INVALID_PARAMETERS);
4383 goto out;
4384 }
4385
J-Alves7461ef22021-10-18 17:21:33 +01004386 /* Set notifications pending. */
J-Alves5a16c962022-03-25 12:32:51 +00004387 vm_notifications_partition_set_pending(
J-Alves661e1b72023-08-02 13:39:40 +01004388 receiver_locked, ffa_is_vm_id(sender_vm_id), notifications,
J-Alves5a16c962022-03-25 12:32:51 +00004389 vcpu_id, is_per_vcpu);
4390
Karl Meakine8937d92024-03-19 16:04:25 +00004391 dlog_verbose("Set the notifications: %lx.\n", notifications);
J-Alvesaa79c012021-07-09 14:29:45 +01004392
J-Alves41c5da32024-06-19 10:05:05 +01004393 if (!delay_sri) {
J-Alves13394022021-06-30 13:48:49 +01004394 dlog_verbose("SRI was NOT delayed. vcpu: %u!\n",
4395 vcpu_index(current));
Karl Meakin117c8082024-12-04 16:03:28 +00004396 ffa_notifications_sri_trigger_not_delayed(current->cpu);
J-Alves13394022021-06-30 13:48:49 +01004397 } else {
Karl Meakin117c8082024-12-04 16:03:28 +00004398 ffa_notifications_sri_set_delayed(current->cpu);
J-Alves13394022021-06-30 13:48:49 +01004399 }
J-Alvesaa79c012021-07-09 14:29:45 +01004400
J-Alves13394022021-06-30 13:48:49 +01004401 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
J-Alvesaa79c012021-07-09 14:29:45 +01004402out:
4403 vm_unlock(&receiver_locked);
4404
4405 return ret;
4406}
4407
4408static struct ffa_value api_ffa_notification_get_success_return(
4409 ffa_notifications_bitmap_t from_sp, ffa_notifications_bitmap_t from_vm,
4410 ffa_notifications_bitmap_t from_framework)
4411{
4412 return (struct ffa_value){
4413 .func = FFA_SUCCESS_32,
4414 .arg1 = 0U,
4415 .arg2 = (uint32_t)from_sp,
4416 .arg3 = (uint32_t)(from_sp >> 32),
4417 .arg4 = (uint32_t)from_vm,
4418 .arg5 = (uint32_t)(from_vm >> 32),
4419 .arg6 = (uint32_t)from_framework,
4420 .arg7 = (uint32_t)(from_framework >> 32),
4421 };
4422}
4423
J-Alves19e20cf2023-08-02 12:48:55 +01004424struct ffa_value api_ffa_notification_get(ffa_id_t receiver_vm_id,
J-Alvesaa79c012021-07-09 14:29:45 +01004425 ffa_vcpu_index_t vcpu_id,
4426 uint32_t flags, struct vcpu *current)
4427{
J-Alves663682a2022-03-25 13:56:51 +00004428 ffa_notifications_bitmap_t framework_notifications = 0;
J-Alvesaa79c012021-07-09 14:29:45 +01004429 ffa_notifications_bitmap_t sp_notifications = 0;
4430 ffa_notifications_bitmap_t vm_notifications = 0;
4431 struct vm_locked receiver_locked;
4432 struct ffa_value ret;
J-Alvesfc95a302022-04-22 14:18:23 +01004433 const uint32_t flags_mbz = ~(FFA_NOTIFICATION_FLAG_BITMAP_HYP |
4434 FFA_NOTIFICATION_FLAG_BITMAP_SPM |
4435 FFA_NOTIFICATION_FLAG_BITMAP_SP |
4436 FFA_NOTIFICATION_FLAG_BITMAP_VM);
4437
4438 /* The FF-A v1.1 EAC0 specification states bits [31:4] Must Be Zero. */
4439 if ((flags & flags_mbz) != 0U) {
4440 dlog_verbose(
4441 "Invalid flags bit(s) set in notifications get. [31:4] "
4442 "MBZ(%x)\n",
4443 flags);
4444 return ffa_error(FFA_INVALID_PARAMETERS);
4445 }
J-Alvesaa79c012021-07-09 14:29:45 +01004446
4447 /*
J-Alvesfc95a302022-04-22 14:18:23 +01004448 * Following check should capture wrong uses of the interface,
4449 * depending on whether Hafnium is SPMC or hypervisor. On the
4450 * rest of the function it is assumed this condition is met.
J-Alvesaa79c012021-07-09 14:29:45 +01004451 */
Karl Meakin117c8082024-12-04 16:03:28 +00004452 if (!ffa_notifications_is_get_valid(current, receiver_vm_id, flags)) {
J-Alvesaa79c012021-07-09 14:29:45 +01004453 dlog_verbose("Invalid use of notifications get interface.\n");
4454 return ffa_error(FFA_INVALID_PARAMETERS);
4455 }
4456
4457 /*
4458 * This check assumes receiver is the current VM, and has been enforced
Karl Meakinfa1dcb82025-02-10 16:47:50 +00004459 * by `ffa_notifications_is_get_valid`.
J-Alvesaa79c012021-07-09 14:29:45 +01004460 */
Karl Meakin117c8082024-12-04 16:03:28 +00004461 receiver_locked = ffa_vm_find_locked(receiver_vm_id);
J-Alvesaa79c012021-07-09 14:29:45 +01004462
4463 /*
Karl Meakinfa1dcb82025-02-10 16:47:50 +00004464 * `ffa_notifications_is_get_valid` ensures following is never
J-Alvesaa79c012021-07-09 14:29:45 +01004465 * true.
4466 */
4467 CHECK(receiver_locked.vm != NULL);
4468
J-Alves60458812024-03-22 11:57:10 +00004469 if (receiver_locked.vm->vcpu_count <= vcpu_id) {
J-Alves1abb3342022-01-05 11:59:10 +00004470 dlog_verbose(
Karl Meakine8937d92024-03-19 16:04:25 +00004471 "Invalid VCPU ID %u. vcpu count %u current core: "
4472 "%zu!\n",
J-Alves1abb3342022-01-05 11:59:10 +00004473 vcpu_id, receiver_locked.vm->vcpu_count,
4474 cpu_index(current->cpu));
J-Alvesaa79c012021-07-09 14:29:45 +01004475 ret = ffa_error(FFA_INVALID_PARAMETERS);
4476 goto out;
4477 }
4478
4479 if ((flags & FFA_NOTIFICATION_FLAG_BITMAP_SP) != 0U) {
Karl Meakin117c8082024-12-04 16:03:28 +00004480 ret = ffa_notifications_get_from_sp(receiver_locked, vcpu_id,
4481 &sp_notifications);
Karl Meakinf9c73ce2024-07-30 17:37:13 +01004482 if (ret.func == FFA_ERROR_32) {
J-Alves98ff9562021-09-09 14:39:41 +01004483 dlog_verbose("Failed to get notifications from sps.");
4484 goto out;
4485 }
J-Alvesaa79c012021-07-09 14:29:45 +01004486 }
4487
4488 if ((flags & FFA_NOTIFICATION_FLAG_BITMAP_VM) != 0U) {
J-Alves5136dda2022-03-25 12:26:38 +00004489 vm_notifications = vm_notifications_partition_get_pending(
J-Alvesaa79c012021-07-09 14:29:45 +01004490 receiver_locked, true, vcpu_id);
4491 }
4492
J-Alvesd605a092022-03-28 14:20:48 +01004493 if ((flags & FFA_NOTIFICATION_FLAG_BITMAP_HYP) != 0U ||
4494 (flags & FFA_NOTIFICATION_FLAG_BITMAP_SPM) != 0U) {
Karl Meakin117c8082024-12-04 16:03:28 +00004495 ret = ffa_notifications_get_framework_notifications(
Karl Meakinf9c73ce2024-07-30 17:37:13 +01004496 receiver_locked, &framework_notifications, flags,
4497 vcpu_id);
4498 if (ret.func == FFA_ERROR_32) {
J-Alvesd605a092022-03-28 14:20:48 +01004499 dlog_verbose(
4500 "Failed to get notifications from "
4501 "framework.\n");
4502 goto out;
4503 }
4504 }
4505
J-Alves663682a2022-03-25 13:56:51 +00004506 ret = api_ffa_notification_get_success_return(
4507 sp_notifications, vm_notifications, framework_notifications);
J-Alvesaa79c012021-07-09 14:29:45 +01004508
J-Alves6e2abc62021-12-02 14:58:56 +00004509 if (!receiver_locked.vm->el0_partition &&
4510 !vm_are_global_notifications_pending(receiver_locked)) {
4511 vm_notifications_set_npi_injected(receiver_locked, false);
4512 }
4513
J-Alvesaa79c012021-07-09 14:29:45 +01004514out:
4515 vm_unlock(&receiver_locked);
4516
4517 return ret;
4518}
J-Alvesc8e8a222021-06-08 17:33:52 +01004519
4520/**
4521 * Prepares successful return for FFA_NOTIFICATION_INFO_GET, as described by
4522 * the section 17.7.1 of the FF-A v1.1 Beta0 specification.
4523 */
4524static struct ffa_value api_ffa_notification_info_get_success_return(
4525 const uint16_t *ids, uint32_t ids_count, const uint32_t *lists_sizes,
J-Alvesfe23ebe2021-10-13 16:07:07 +01004526 uint32_t lists_count)
J-Alvesc8e8a222021-06-08 17:33:52 +01004527{
4528 struct ffa_value ret = (struct ffa_value){.func = FFA_SUCCESS_64};
4529
4530 /*
4531 * Copying content of ids into ret structure. Use 5 registers (x3-x7) to
4532 * hold the list of ids.
4533 */
4534 memcpy_s(&ret.arg3,
4535 sizeof(ret.arg3) * FFA_NOTIFICATIONS_INFO_GET_REGS_RET, ids,
4536 sizeof(ids[0]) * ids_count);
4537
4538 /*
4539 * According to the spec x2 should have:
4540 * - Bit flagging if there are more notifications pending;
4541 * - The total number of elements (i.e. total list size);
4542 * - The number of VCPU IDs within each VM specific list.
4543 */
J-Alvesfe23ebe2021-10-13 16:07:07 +01004544 ret.arg2 = vm_notifications_pending_not_retrieved_by_scheduler()
4545 ? FFA_NOTIFICATIONS_INFO_GET_FLAG_MORE_PENDING
4546 : 0;
J-Alvesc8e8a222021-06-08 17:33:52 +01004547
4548 ret.arg2 |= (lists_count & FFA_NOTIFICATIONS_LISTS_COUNT_MASK)
4549 << FFA_NOTIFICATIONS_LISTS_COUNT_SHIFT;
4550
4551 for (unsigned int i = 0; i < lists_count; i++) {
4552 ret.arg2 |= (lists_sizes[i] & FFA_NOTIFICATIONS_LIST_SIZE_MASK)
4553 << FFA_NOTIFICATIONS_LIST_SHIFT(i + 1);
4554 }
4555
4556 return ret;
4557}
4558
4559struct ffa_value api_ffa_notification_info_get(struct vcpu *current)
4560{
4561 /*
4562 * Following set of variables should be populated with the return info.
4563 * At a successfull handling of this interface, they should be used
4564 * to populate the 'ret' structure in accordance to the table 17.29
4565 * of the FF-A v1.1 Beta0 specification.
4566 */
4567 uint16_t ids[FFA_NOTIFICATIONS_INFO_GET_MAX_IDS];
4568 uint32_t lists_sizes[FFA_NOTIFICATIONS_INFO_GET_MAX_IDS] = {0};
4569 uint32_t lists_count = 0;
4570 uint32_t ids_count = 0;
4571 bool list_is_full = false;
J-Alves13394022021-06-30 13:48:49 +01004572 struct ffa_value result;
J-Alvesc8e8a222021-06-08 17:33:52 +01004573
4574 /*
4575 * This interface can only be called at NS virtual/physical FF-A
4576 * instance by the endpoint implementing the primary scheduler and the
4577 * Hypervisor/OS kernel.
4578 * In the SPM, following check passes if call has been forwarded from
4579 * the hypervisor.
4580 */
Karl Meakin5e996992024-05-20 11:27:07 +01004581
4582 if (!vm_is_primary(current->vm)) {
J-Alvesc8e8a222021-06-08 17:33:52 +01004583 dlog_verbose(
4584 "Only the receiver's scheduler can use this "
4585 "interface\n");
4586 return ffa_error(FFA_NOT_SUPPORTED);
4587 }
4588
J-Alvesca058c22021-09-10 14:02:07 +01004589 /*
4590 * Forward call to the other world, and fill the arrays used to assemble
4591 * return.
4592 */
Karl Meakin117c8082024-12-04 16:03:28 +00004593 ffa_notifications_info_get_forward(ids, &ids_count, lists_sizes,
4594 &lists_count,
4595 FFA_NOTIFICATIONS_INFO_GET_MAX_IDS);
J-Alvesca058c22021-09-10 14:02:07 +01004596
4597 list_is_full = ids_count == FFA_NOTIFICATIONS_INFO_GET_MAX_IDS;
4598
J-Alvesc8e8a222021-06-08 17:33:52 +01004599 /* Get notifications' info from this world */
4600 for (ffa_vm_count_t index = 0; index < vm_get_count() && !list_is_full;
4601 ++index) {
4602 struct vm_locked vm_locked = vm_lock(vm_find_index(index));
4603
4604 list_is_full = vm_notifications_info_get(
4605 vm_locked, ids, &ids_count, lists_sizes, &lists_count,
4606 FFA_NOTIFICATIONS_INFO_GET_MAX_IDS);
4607
4608 vm_unlock(&vm_locked);
4609 }
4610
4611 if (!list_is_full) {
4612 /* Grab notifications info from other world */
Karl Meakin117c8082024-12-04 16:03:28 +00004613 ffa_vm_notifications_info_get(
J-Alvesc8e8a222021-06-08 17:33:52 +01004614 ids, &ids_count, lists_sizes, &lists_count,
4615 FFA_NOTIFICATIONS_INFO_GET_MAX_IDS);
4616 }
4617
4618 if (ids_count == 0) {
J-Alvesca058c22021-09-10 14:02:07 +01004619 dlog_verbose(
4620 "Notification info get has no data to retrieve.\n");
J-Alves13394022021-06-30 13:48:49 +01004621 result = ffa_error(FFA_NO_DATA);
4622 } else {
4623 result = api_ffa_notification_info_get_success_return(
J-Alvesfe23ebe2021-10-13 16:07:07 +01004624 ids, ids_count, lists_sizes, lists_count);
J-Alvesc8e8a222021-06-08 17:33:52 +01004625 }
4626
J-Alves13394022021-06-30 13:48:49 +01004627 return result;
J-Alvesc8e8a222021-06-08 17:33:52 +01004628}
Raghu Krishnamurthyea6d25f2021-09-14 15:27:06 -07004629
4630struct ffa_value api_ffa_mem_perm_get(vaddr_t base_addr, struct vcpu *current)
4631{
4632 struct vm_locked vm_locked;
4633 struct ffa_value ret = ffa_error(FFA_INVALID_PARAMETERS);
4634 bool mode_ret = false;
4635 uint32_t mode = 0;
4636
Karl Meakin117c8082024-12-04 16:03:28 +00004637 if (!ffa_memory_is_mem_perm_get_valid(current)) {
J-Alves5a099172024-02-22 14:34:51 +00004638 return ffa_error(FFA_DENIED);
Raghu Krishnamurthyea6d25f2021-09-14 15:27:06 -07004639 }
4640
4641 if (!(current->vm->el0_partition)) {
4642 return ffa_error(FFA_DENIED);
4643 }
4644
4645 vm_locked = vm_lock(current->vm);
4646
4647 /*
4648 * mm_get_mode is used to check if the given base_addr page is already
4649 * mapped. If the page is unmapped, return error. If the page is mapped
4650 * appropriate attributes are returned to the caller. Note that
4651 * mm_get_mode returns true if the address is in the valid VA range as
4652 * supported by the architecture and MMU configurations, as opposed to
4653 * whether a page is mapped or not. For a page to be known as mapped,
4654 * the API must return true AND the returned mode must not have
4655 * MM_MODE_INVALID set.
4656 */
4657 mode_ret = mm_get_mode(&vm_locked.vm->ptable, base_addr,
4658 va_add(base_addr, PAGE_SIZE), &mode);
4659 if (!mode_ret || (mode & MM_MODE_INVALID)) {
4660 ret = ffa_error(FFA_INVALID_PARAMETERS);
4661 goto out;
4662 }
4663
4664 /* No memory should be marked RWX */
4665 CHECK((mode & (MM_MODE_R | MM_MODE_W | MM_MODE_X)) !=
4666 (MM_MODE_R | MM_MODE_W | MM_MODE_X));
4667
4668 /*
4669 * S-EL0 partitions are expected to have all their pages marked as
4670 * non-global.
4671 */
4672 CHECK((mode & (MM_MODE_NG | MM_MODE_USER)) ==
4673 (MM_MODE_NG | MM_MODE_USER));
4674
4675 if (mode & MM_MODE_W) {
4676 /* No memory should be writeable but not readable. */
4677 CHECK(mode & MM_MODE_R);
4678 ret = (struct ffa_value){.func = FFA_SUCCESS_32,
4679 .arg2 = (uint32_t)(FFA_MEM_PERM_RW)};
4680 } else if (mode & MM_MODE_R) {
4681 ret = (struct ffa_value){.func = FFA_SUCCESS_32,
4682 .arg2 = (uint32_t)(FFA_MEM_PERM_RX)};
4683 if (!(mode & MM_MODE_X)) {
4684 ret.arg2 = (uint32_t)(FFA_MEM_PERM_RO);
4685 }
4686 }
4687out:
4688 vm_unlock(&vm_locked);
4689 return ret;
4690}
4691
4692struct ffa_value api_ffa_mem_perm_set(vaddr_t base_addr, uint32_t page_count,
4693 uint32_t mem_perm, struct vcpu *current)
4694{
4695 struct vm_locked vm_locked;
4696 struct ffa_value ret;
4697 bool mode_ret = false;
4698 uint32_t original_mode;
4699 uint32_t new_mode;
4700 struct mpool local_page_pool;
4701
Karl Meakin117c8082024-12-04 16:03:28 +00004702 if (!ffa_memory_is_mem_perm_set_valid(current)) {
J-Alves5a099172024-02-22 14:34:51 +00004703 return ffa_error(FFA_DENIED);
Raghu Krishnamurthyea6d25f2021-09-14 15:27:06 -07004704 }
4705
4706 if (!(current->vm->el0_partition)) {
4707 return ffa_error(FFA_DENIED);
4708 }
4709
4710 if (!is_aligned(va_addr(base_addr), PAGE_SIZE)) {
4711 return ffa_error(FFA_INVALID_PARAMETERS);
4712 }
4713
4714 if ((mem_perm != FFA_MEM_PERM_RW) && (mem_perm != FFA_MEM_PERM_RO) &&
4715 (mem_perm != FFA_MEM_PERM_RX)) {
4716 return ffa_error(FFA_INVALID_PARAMETERS);
4717 }
4718
4719 /*
4720 * Create a local pool so any freed memory can't be used by another
4721 * thread. This is to ensure the original mapping can be restored if any
4722 * stage of the process fails.
4723 */
4724 mpool_init_with_fallback(&local_page_pool, &api_page_pool);
4725
4726 vm_locked = vm_lock(current->vm);
4727
4728 /*
4729 * All regions accessible by the partition are mapped during boot. If we
4730 * cannot get a successful translation for the page range, the request
4731 * to change permissions is rejected.
4732 * mm_get_mode is used to check if the given address range is already
4733 * mapped. If the range is unmapped, return error. If the range is
4734 * mapped appropriate attributes are returned to the caller. Note that
4735 * mm_get_mode returns true if the address is in the valid VA range as
4736 * supported by the architecture and MMU configurations, as opposed to
4737 * whether a page is mapped or not. For a page to be known as mapped,
4738 * the API must return true AND the returned mode must not have
4739 * MM_MODE_INVALID set.
4740 */
4741
4742 mode_ret = mm_get_mode(&vm_locked.vm->ptable, base_addr,
4743 va_add(base_addr, page_count * PAGE_SIZE),
4744 &original_mode);
4745 if (!mode_ret || (original_mode & MM_MODE_INVALID)) {
4746 ret = ffa_error(FFA_INVALID_PARAMETERS);
4747 goto out;
4748 }
4749
4750 /* Device memory cannot be marked as executable */
4751 if ((original_mode & MM_MODE_D) && (mem_perm == FFA_MEM_PERM_RX)) {
4752 ret = ffa_error(FFA_INVALID_PARAMETERS);
4753 goto out;
4754 }
4755
4756 new_mode = MM_MODE_USER | MM_MODE_NG;
4757
4758 if (mem_perm == FFA_MEM_PERM_RW) {
4759 new_mode |= MM_MODE_R | MM_MODE_W;
4760 } else if (mem_perm == FFA_MEM_PERM_RX) {
4761 new_mode |= MM_MODE_R | MM_MODE_X;
4762 } else if (mem_perm == FFA_MEM_PERM_RO) {
4763 new_mode |= MM_MODE_R;
4764 }
4765
4766 /*
4767 * Safe to re-map memory, since we know the requested permissions are
4768 * valid, and the memory requested to be re-mapped is also valid.
4769 */
4770 if (!mm_identity_prepare(
4771 &vm_locked.vm->ptable, pa_from_va(base_addr),
4772 pa_from_va(va_add(base_addr, page_count * PAGE_SIZE)),
4773 new_mode, &local_page_pool)) {
4774 /*
4775 * Defrag the table into the local page pool.
4776 * mm_identity_prepare could have allocated or freed pages to
4777 * split blocks or tables etc.
4778 */
4779 mm_stage1_defrag(&vm_locked.vm->ptable, &local_page_pool);
4780
4781 /*
4782 * Guaranteed to succeed mapping with old mode since the mapping
4783 * with old mode already existed and we have a local page pool
4784 * that should have sufficient memory to go back to the original
4785 * state.
4786 */
4787 CHECK(mm_identity_prepare(
4788 &vm_locked.vm->ptable, pa_from_va(base_addr),
4789 pa_from_va(va_add(base_addr, page_count * PAGE_SIZE)),
4790 original_mode, &local_page_pool));
4791 mm_identity_commit(
4792 &vm_locked.vm->ptable, pa_from_va(base_addr),
4793 pa_from_va(va_add(base_addr, page_count * PAGE_SIZE)),
4794 original_mode, &local_page_pool);
4795
4796 mm_stage1_defrag(&vm_locked.vm->ptable, &api_page_pool);
4797 ret = ffa_error(FFA_NO_MEMORY);
4798 goto out;
4799 }
4800
4801 mm_identity_commit(
4802 &vm_locked.vm->ptable, pa_from_va(base_addr),
4803 pa_from_va(va_add(base_addr, page_count * PAGE_SIZE)), new_mode,
4804 &local_page_pool);
4805
4806 ret = (struct ffa_value){.func = FFA_SUCCESS_32};
4807
4808out:
4809 mpool_fini(&local_page_pool);
4810 vm_unlock(&vm_locked);
4811
4812 return ret;
4813}
Maksims Svecovs71b76702022-05-20 15:32:58 +01004814
4815/**
Karl Meakinc5cebbc2024-06-17 11:30:27 +01004816 * Send the contents of the given vCPU's log buffer to the log, preceded
Karl Meakin705b56e2024-05-22 10:04:32 +01004817 * by the VM ID and followed by a newline.
4818 */
Karl Meakin6f1f1212024-07-16 10:18:16 +01004819void api_flush_log_buffer(struct vcpu_locked *vcpu_locked)
Karl Meakin705b56e2024-05-22 10:04:32 +01004820{
Karl Meakin6f1f1212024-07-16 10:18:16 +01004821 /*
4822 * NOTE: This line is parsed by `hftest.py`.
4823 * If you change the format, make sure to update
4824 * `HFTEST_CTRL_JSON_REGEX` as well.
4825 */
4826 struct vcpu *vcpu = vcpu_locked->vcpu;
4827 struct log_buffer *buffer = &vcpu->log_buffer;
4828 ffa_id_t vm_id = vcpu->vm->id;
4829 ffa_id_t vcpu_id = vcpu_index(vcpu);
4830
Karl Meakin7de26952024-06-14 14:50:19 +01004831 buffer->chars[buffer->len] = '\0';
Olivier Deprezbd432092024-07-26 14:01:12 +02004832 dlog("[%x %u] %s\n", vm_id, vcpu_id, buffer->chars);
Karl Meakin7de26952024-06-14 14:50:19 +01004833 buffer->len = 0;
Karl Meakin705b56e2024-05-22 10:04:32 +01004834}
4835
4836/**
Karl Meakin740f74f2024-02-14 18:04:48 +00004837 * Implements FF-A v1.2 FFA_CONSOLE_LOG ABI for buffered logging.
Maksims Svecovs71b76702022-05-20 15:32:58 +01004838 */
4839struct ffa_value api_ffa_console_log(const struct ffa_value args,
4840 struct vcpu *current)
4841{
Karl Meakin740f74f2024-02-14 18:04:48 +00004842 /* Maximum number of characters is 128: 16 registers of 8 bytes each. */
4843 char chars[128] = {0};
Karl Meakin0e617d92024-04-05 12:55:22 +01004844 const bool v1_2 = current->vm->ffa_version >= FFA_VERSION_1_2;
Karl Meakin740f74f2024-02-14 18:04:48 +00004845 const bool log32 = args.func == FFA_CONSOLE_LOG_32;
Maksims Svecovs71b76702022-05-20 15:32:58 +01004846
Karl Meakin740f74f2024-02-14 18:04:48 +00004847 /*
4848 * 32bit: always 6 registers
4849 * 64bit and less than v1.2: 6 registers
4850 * 64bit and v1.2 or greater: 16 registers
4851 */
Karl Meakin66a38bd2024-05-28 16:00:56 +01004852 /* NOLINTNEXTLINE(readability-avoid-nested-conditional-operator) */
Karl Meakin740f74f2024-02-14 18:04:48 +00004853 const size_t registers_max = log32 ? 6 : (v1_2 ? 16 : 6);
4854 const size_t chars_max =
4855 registers_max * (log32 ? sizeof(uint32_t) : sizeof(uint64_t));
4856 const size_t chars_count = args.arg1;
Karl Meakinc5cebbc2024-06-17 11:30:27 +01004857 struct vcpu_locked vcpu_locked;
4858 struct log_buffer *log_buffer;
Karl Meakin740f74f2024-02-14 18:04:48 +00004859
4860 assert(args.func == FFA_CONSOLE_LOG_32 ||
4861 args.func == FFA_CONSOLE_LOG_64);
4862
4863 if (chars_count == 0 || chars_count > chars_max) {
Maksims Svecovs71b76702022-05-20 15:32:58 +01004864 return ffa_error(FFA_INVALID_PARAMETERS);
4865 }
4866
Karl Meakin740f74f2024-02-14 18:04:48 +00004867 if (log32) {
4868 uint32_t *registers = (uint32_t *)chars;
Maksims Svecovs71b76702022-05-20 15:32:58 +01004869
Karl Meakin740f74f2024-02-14 18:04:48 +00004870 registers[0] = args.arg2 & 0xffffffff;
4871 registers[1] = args.arg3 & 0xffffffff;
4872 registers[2] = args.arg4 & 0xffffffff;
4873 registers[3] = args.arg5 & 0xffffffff;
4874 registers[4] = args.arg6 & 0xffffffff;
4875 registers[5] = args.arg7 & 0xffffffff;
4876 } else {
4877 uint64_t *registers = (uint64_t *)chars;
4878
4879 registers[0] = args.arg2;
4880 registers[1] = args.arg3;
4881 registers[2] = args.arg4;
4882 registers[3] = args.arg5;
4883 registers[4] = args.arg6;
4884 registers[5] = args.arg7;
4885 if (v1_2) {
4886 registers[6] = args.extended_val.arg8;
4887 registers[7] = args.extended_val.arg9;
4888 registers[8] = args.extended_val.arg10;
4889 registers[9] = args.extended_val.arg11;
4890 registers[10] = args.extended_val.arg12;
4891 registers[11] = args.extended_val.arg13;
4892 registers[12] = args.extended_val.arg14;
4893 registers[13] = args.extended_val.arg15;
4894 registers[14] = args.extended_val.arg16;
4895 registers[15] = args.extended_val.arg17;
4896 }
4897 }
4898
Karl Meakinc5cebbc2024-06-17 11:30:27 +01004899 vcpu_locked = vcpu_lock(current);
4900 log_buffer = &current->log_buffer;
Karl Meakin7de26952024-06-14 14:50:19 +01004901
Karl Meakin740f74f2024-02-14 18:04:48 +00004902 for (size_t i = 0; i < chars_count; i++) {
4903 bool flush = false;
4904 const char c = chars[i];
4905
4906 if (c == '\n' || c == '\0') {
4907 flush = true;
4908 } else {
Karl Meakin7de26952024-06-14 14:50:19 +01004909 log_buffer->chars[log_buffer->len++] = c;
4910 flush = log_buffer->len == LOG_BUFFER_SIZE;
Karl Meakin740f74f2024-02-14 18:04:48 +00004911 }
4912
4913 if (flush) {
Karl Meakin6f1f1212024-07-16 10:18:16 +01004914 api_flush_log_buffer(&vcpu_locked);
Karl Meakin740f74f2024-02-14 18:04:48 +00004915 }
4916 }
Maksims Svecovs71b76702022-05-20 15:32:58 +01004917
Karl Meakinc5cebbc2024-06-17 11:30:27 +01004918 vcpu_unlock(&vcpu_locked);
Maksims Svecovs71b76702022-05-20 15:32:58 +01004919 return (struct ffa_value){.func = FFA_SUCCESS_32};
4920}
Daniel Boulbyf3cf28c2024-08-22 10:46:23 +01004921
4922/**
4923 * Send an IPI interrupt to a target vcpu belonging to the
4924 * sender that isn't itself.
4925 */
Daniel Boulby84d49b62024-11-04 18:25:59 +00004926int64_t api_hf_interrupt_send_ipi(uint32_t target_vcpu_id, struct vcpu *current)
Daniel Boulbyf3cf28c2024-08-22 10:46:23 +01004927{
4928 struct vm *vm = current->vm;
4929 ffa_vcpu_index_t target_vcpu_index = vcpu_id_to_index(target_vcpu_id);
4930
Daniel Boulby84d49b62024-11-04 18:25:59 +00004931 if (target_vcpu_index >= vm->vcpu_count ||
Daniel Boulbyf3cf28c2024-08-22 10:46:23 +01004932 target_vcpu_index == cpu_index(current->cpu)) {
4933 dlog_verbose("Invalid vCPU %d for IPI.\n", target_vcpu_id);
4934 return -1;
4935 }
4936
4937 dlog_verbose("Injecting IPI to target vCPU%d for %#x\n", target_vcpu_id,
4938 vm->id);
4939
4940 hf_ipi_send_interrupt(vm, target_vcpu_index);
4941
4942 return 0;
4943}