Re: [XEN PATCH v3] xen/arm: ffa: reclaim shared memory on guest destroy
Hi Jens,
> On 5 Feb 2024, at 14:39, Jens Wiklander wrote:
>
> Hi Bertrand,
>
> On Thu, Feb 1, 2024 at 2:57 PM Bertrand Marquis
> wrote:
>>
>> Hi Jens,
>>
>>> On 17 Jan 2024, at 12:06, Jens Wiklander wrote:
>>>
>>> When an FF-A enabled guest is destroyed it may leave behind memory
>>> shared with SPs. This memory must be reclaimed before it's reused or an
>>> SP may make changes to memory used by a new unrelated guest. So when the
>>> domain is teared down add FF-A requests to reclaim all remaining shared
>>> memory.
>>>
>>> SPs in the secure world are notified using VM_DESTROYED that a guest has
>>> been destroyed. An SP is supposed to relinquish all shared memory to allow
>>> reclaiming the memory. The relinquish operation may need to be delayed if
>>> the shared memory is for instance part of a DMA operation.
>>>
>>> The domain reference counter is increased when the first FF-A shared
>>> memory is registered and the counter is decreased again when the last
>>> shared memory is reclaimed. If FF-A shared memory registrations remain
>>> at the end of of ffa_domain_teardown() a timer is set to try to reclaim
>>> the shared memory every second until the memory is reclaimed.
>>>
>>> A few minor style fixes with a removed empty line here and an added new
>>> line there.
>>>
>>> Signed-off-by: Jens Wiklander
>>> ---
>>>
>>> v3:
>>> - Mentioning in the commit message that there are some style fixes
>>> - Addressing review comments
>>> - Refactor the ffa_domain_teardown() path to let
>>> ffa_domain_teardown_continue() do most of the work.
>>>
>>> v2:
>>> - Update commit message to match the new implementation
>>> - Using a per domain bitfield to keep track of which SPs has been notified
>>> with VM_DESTROYED
>>> - Holding a domain reference counter to keep the domain as a zombie domain
>>> while there still is shared memory registrations remaining to be reclaimed
>>> - Using a timer to retry reclaiming remaining shared memory registrations
>>> ---
>>> xen/arch/arm/tee/ffa.c | 253 +
>>> 1 file changed, 204 insertions(+), 49 deletions(-)
>>>
>>> diff --git a/xen/arch/arm/tee/ffa.c b/xen/arch/arm/tee/ffa.c
>>> index 0793c1c7585d..80ebbf4f01c6 100644
>>> --- a/xen/arch/arm/tee/ffa.c
>>> +++ b/xen/arch/arm/tee/ffa.c
>>> @@ -54,6 +54,7 @@
>>> #include
>>> #include
>>> #include
>>> +#include
>>> #include
>>>
>>> #include
>>> @@ -144,6 +145,12 @@
>>> */
>>> #define FFA_MAX_SHM_COUNT 32
>>>
>>> +/*
>>> + * The time we wait until trying to tear down a domain again if it was
>>> + * blocked initially.
>>> + */
>>> +#define FFA_CTX_TEARDOWN_DELAY SECONDS(1)
>>> +
>>> /* FF-A-1.1-REL0 section 10.9.2 Memory region handle, page 167 */
>>> #define FFA_HANDLE_HYP_FLAG BIT(63, ULL)
>>> #define FFA_HANDLE_INVALID 0xULL
>>> @@ -384,11 +391,6 @@ struct ffa_ctx {
>>>unsigned int page_count;
>>>/* FF-A version used by the guest */
>>>uint32_t guest_vers;
>>> -/*
>>> - * Number of SPs that we have sent a VM created signal to, used in
>>> - * ffa_domain_teardown() to know which SPs need to be signalled.
>>> - */
>>> -uint16_t create_signal_count;
>>>bool rx_is_free;
>>>/* Used shared memory objects, struct ffa_shm_mem */
>>>struct list_head shm_list;
>>> @@ -402,6 +404,15 @@ struct ffa_ctx {
>>>spinlock_t tx_lock;
>>>spinlock_t rx_lock;
>>>spinlock_t lock;
>>> +/* Used if domain can't be torn down immediately */
>>> +struct domain *teardown_d;
>>> +struct list_head teardown_list;
>>> +s_time_t teardown_expire;
>>> +/*
>>> + * Used for ffa_domain_teardown() to keep track of which SPs should be
>>> + * notified that this guest is being destroyed.
>>> + */
>>> +unsigned long vm_destroy_bitmap[];
>>> };
>>>
>>> struct ffa_shm_mem {
>>> @@ -436,6 +447,12 @@ static void *ffa_tx __read_mostly;
>>> static DEFINE_SPINLOCK(ffa_rx_buffer_lock);
>>> static DEFINE_SPINLOCK(ffa_tx_buffer_lock);
>>>
>>> +
>>> +/* Used to track domains that could not be torn down immediately. */
>>> +static struct timer ffa_teardown_timer;
>>> +static struct list_head ffa_teardown_head;
>>> +static DEFINE_SPINLOCK(ffa_teardown_lock);
>>> +
>>> static bool ffa_get_version(uint32_t *vers)
>>> {
>>>const struct arm_smccc_1_2_regs arg = {
>>> @@ -853,7 +870,6 @@ static int32_t handle_partition_info_get(uint32_t w1,
>>> uint32_t w2, uint32_t w3,
>>>goto out_rx_release;
>>>}
>>>
>>> -
>>>memcpy(ctx->rx, ffa_rx, sz);
>>>}
>>>ctx->rx_is_free = false;
>>> @@ -992,53 +1008,75 @@ static void put_shm_pages(struct ffa_shm_mem *shm)
>>>}
>>> }
>>>
>>> -static bool inc_ctx_shm_count(struct ffa_ctx *ctx)
>>> +static bool inc_ctx_shm_count(struct domain *d, struct ffa_ctx *ctx)
>>> {
>>>bool ret = true;
>>>
>>>spin_lock(>lock);
>>> +
>>> +/*
>>> + * If this is the first shm added, increase the domain
Re: [XEN PATCH v3] xen/arm: ffa: reclaim shared memory on guest destroy
Hi Bertrand,
On Thu, Feb 1, 2024 at 2:57 PM Bertrand Marquis
wrote:
>
> Hi Jens,
>
> > On 17 Jan 2024, at 12:06, Jens Wiklander wrote:
> >
> > When an FF-A enabled guest is destroyed it may leave behind memory
> > shared with SPs. This memory must be reclaimed before it's reused or an
> > SP may make changes to memory used by a new unrelated guest. So when the
> > domain is teared down add FF-A requests to reclaim all remaining shared
> > memory.
> >
> > SPs in the secure world are notified using VM_DESTROYED that a guest has
> > been destroyed. An SP is supposed to relinquish all shared memory to allow
> > reclaiming the memory. The relinquish operation may need to be delayed if
> > the shared memory is for instance part of a DMA operation.
> >
> > The domain reference counter is increased when the first FF-A shared
> > memory is registered and the counter is decreased again when the last
> > shared memory is reclaimed. If FF-A shared memory registrations remain
> > at the end of of ffa_domain_teardown() a timer is set to try to reclaim
> > the shared memory every second until the memory is reclaimed.
> >
> > A few minor style fixes with a removed empty line here and an added new
> > line there.
> >
> > Signed-off-by: Jens Wiklander
> > ---
> >
> > v3:
> > - Mentioning in the commit message that there are some style fixes
> > - Addressing review comments
> > - Refactor the ffa_domain_teardown() path to let
> > ffa_domain_teardown_continue() do most of the work.
> >
> > v2:
> > - Update commit message to match the new implementation
> > - Using a per domain bitfield to keep track of which SPs has been notified
> > with VM_DESTROYED
> > - Holding a domain reference counter to keep the domain as a zombie domain
> > while there still is shared memory registrations remaining to be reclaimed
> > - Using a timer to retry reclaiming remaining shared memory registrations
> > ---
> > xen/arch/arm/tee/ffa.c | 253 +
> > 1 file changed, 204 insertions(+), 49 deletions(-)
> >
> > diff --git a/xen/arch/arm/tee/ffa.c b/xen/arch/arm/tee/ffa.c
> > index 0793c1c7585d..80ebbf4f01c6 100644
> > --- a/xen/arch/arm/tee/ffa.c
> > +++ b/xen/arch/arm/tee/ffa.c
> > @@ -54,6 +54,7 @@
> > #include
> > #include
> > #include
> > +#include
> > #include
> >
> > #include
> > @@ -144,6 +145,12 @@
> > */
> > #define FFA_MAX_SHM_COUNT 32
> >
> > +/*
> > + * The time we wait until trying to tear down a domain again if it was
> > + * blocked initially.
> > + */
> > +#define FFA_CTX_TEARDOWN_DELAY SECONDS(1)
> > +
> > /* FF-A-1.1-REL0 section 10.9.2 Memory region handle, page 167 */
> > #define FFA_HANDLE_HYP_FLAG BIT(63, ULL)
> > #define FFA_HANDLE_INVALID 0xULL
> > @@ -384,11 +391,6 @@ struct ffa_ctx {
> > unsigned int page_count;
> > /* FF-A version used by the guest */
> > uint32_t guest_vers;
> > -/*
> > - * Number of SPs that we have sent a VM created signal to, used in
> > - * ffa_domain_teardown() to know which SPs need to be signalled.
> > - */
> > -uint16_t create_signal_count;
> > bool rx_is_free;
> > /* Used shared memory objects, struct ffa_shm_mem */
> > struct list_head shm_list;
> > @@ -402,6 +404,15 @@ struct ffa_ctx {
> > spinlock_t tx_lock;
> > spinlock_t rx_lock;
> > spinlock_t lock;
> > +/* Used if domain can't be torn down immediately */
> > +struct domain *teardown_d;
> > +struct list_head teardown_list;
> > +s_time_t teardown_expire;
> > +/*
> > + * Used for ffa_domain_teardown() to keep track of which SPs should be
> > + * notified that this guest is being destroyed.
> > + */
> > +unsigned long vm_destroy_bitmap[];
> > };
> >
> > struct ffa_shm_mem {
> > @@ -436,6 +447,12 @@ static void *ffa_tx __read_mostly;
> > static DEFINE_SPINLOCK(ffa_rx_buffer_lock);
> > static DEFINE_SPINLOCK(ffa_tx_buffer_lock);
> >
> > +
> > +/* Used to track domains that could not be torn down immediately. */
> > +static struct timer ffa_teardown_timer;
> > +static struct list_head ffa_teardown_head;
> > +static DEFINE_SPINLOCK(ffa_teardown_lock);
> > +
> > static bool ffa_get_version(uint32_t *vers)
> > {
> > const struct arm_smccc_1_2_regs arg = {
> > @@ -853,7 +870,6 @@ static int32_t handle_partition_info_get(uint32_t w1,
> > uint32_t w2, uint32_t w3,
> > goto out_rx_release;
> > }
> >
> > -
> > memcpy(ctx->rx, ffa_rx, sz);
> > }
> > ctx->rx_is_free = false;
> > @@ -992,53 +1008,75 @@ static void put_shm_pages(struct ffa_shm_mem *shm)
> > }
> > }
> >
> > -static bool inc_ctx_shm_count(struct ffa_ctx *ctx)
> > +static bool inc_ctx_shm_count(struct domain *d, struct ffa_ctx *ctx)
> > {
> > bool ret = true;
> >
> > spin_lock(>lock);
> > +
> > +/*
> > + * If this is the first shm added, increase the domain reference
> > + * counter as we need to keep domain around a bit
Re: [XEN PATCH v3] xen/arm: ffa: reclaim shared memory on guest destroy
Hi Jens,
> On 17 Jan 2024, at 12:06, Jens Wiklander wrote:
>
> When an FF-A enabled guest is destroyed it may leave behind memory
> shared with SPs. This memory must be reclaimed before it's reused or an
> SP may make changes to memory used by a new unrelated guest. So when the
> domain is teared down add FF-A requests to reclaim all remaining shared
> memory.
>
> SPs in the secure world are notified using VM_DESTROYED that a guest has
> been destroyed. An SP is supposed to relinquish all shared memory to allow
> reclaiming the memory. The relinquish operation may need to be delayed if
> the shared memory is for instance part of a DMA operation.
>
> The domain reference counter is increased when the first FF-A shared
> memory is registered and the counter is decreased again when the last
> shared memory is reclaimed. If FF-A shared memory registrations remain
> at the end of of ffa_domain_teardown() a timer is set to try to reclaim
> the shared memory every second until the memory is reclaimed.
>
> A few minor style fixes with a removed empty line here and an added new
> line there.
>
> Signed-off-by: Jens Wiklander
> ---
>
> v3:
> - Mentioning in the commit message that there are some style fixes
> - Addressing review comments
> - Refactor the ffa_domain_teardown() path to let
> ffa_domain_teardown_continue() do most of the work.
>
> v2:
> - Update commit message to match the new implementation
> - Using a per domain bitfield to keep track of which SPs has been notified
> with VM_DESTROYED
> - Holding a domain reference counter to keep the domain as a zombie domain
> while there still is shared memory registrations remaining to be reclaimed
> - Using a timer to retry reclaiming remaining shared memory registrations
> ---
> xen/arch/arm/tee/ffa.c | 253 +
> 1 file changed, 204 insertions(+), 49 deletions(-)
>
> diff --git a/xen/arch/arm/tee/ffa.c b/xen/arch/arm/tee/ffa.c
> index 0793c1c7585d..80ebbf4f01c6 100644
> --- a/xen/arch/arm/tee/ffa.c
> +++ b/xen/arch/arm/tee/ffa.c
> @@ -54,6 +54,7 @@
> #include
> #include
> #include
> +#include
> #include
>
> #include
> @@ -144,6 +145,12 @@
> */
> #define FFA_MAX_SHM_COUNT 32
>
> +/*
> + * The time we wait until trying to tear down a domain again if it was
> + * blocked initially.
> + */
> +#define FFA_CTX_TEARDOWN_DELAY SECONDS(1)
> +
> /* FF-A-1.1-REL0 section 10.9.2 Memory region handle, page 167 */
> #define FFA_HANDLE_HYP_FLAG BIT(63, ULL)
> #define FFA_HANDLE_INVALID 0xULL
> @@ -384,11 +391,6 @@ struct ffa_ctx {
> unsigned int page_count;
> /* FF-A version used by the guest */
> uint32_t guest_vers;
> -/*
> - * Number of SPs that we have sent a VM created signal to, used in
> - * ffa_domain_teardown() to know which SPs need to be signalled.
> - */
> -uint16_t create_signal_count;
> bool rx_is_free;
> /* Used shared memory objects, struct ffa_shm_mem */
> struct list_head shm_list;
> @@ -402,6 +404,15 @@ struct ffa_ctx {
> spinlock_t tx_lock;
> spinlock_t rx_lock;
> spinlock_t lock;
> +/* Used if domain can't be torn down immediately */
> +struct domain *teardown_d;
> +struct list_head teardown_list;
> +s_time_t teardown_expire;
> +/*
> + * Used for ffa_domain_teardown() to keep track of which SPs should be
> + * notified that this guest is being destroyed.
> + */
> +unsigned long vm_destroy_bitmap[];
> };
>
> struct ffa_shm_mem {
> @@ -436,6 +447,12 @@ static void *ffa_tx __read_mostly;
> static DEFINE_SPINLOCK(ffa_rx_buffer_lock);
> static DEFINE_SPINLOCK(ffa_tx_buffer_lock);
>
> +
> +/* Used to track domains that could not be torn down immediately. */
> +static struct timer ffa_teardown_timer;
> +static struct list_head ffa_teardown_head;
> +static DEFINE_SPINLOCK(ffa_teardown_lock);
> +
> static bool ffa_get_version(uint32_t *vers)
> {
> const struct arm_smccc_1_2_regs arg = {
> @@ -853,7 +870,6 @@ static int32_t handle_partition_info_get(uint32_t w1,
> uint32_t w2, uint32_t w3,
> goto out_rx_release;
> }
>
> -
> memcpy(ctx->rx, ffa_rx, sz);
> }
> ctx->rx_is_free = false;
> @@ -992,53 +1008,75 @@ static void put_shm_pages(struct ffa_shm_mem *shm)
> }
> }
>
> -static bool inc_ctx_shm_count(struct ffa_ctx *ctx)
> +static bool inc_ctx_shm_count(struct domain *d, struct ffa_ctx *ctx)
> {
> bool ret = true;
>
> spin_lock(>lock);
> +
> +/*
> + * If this is the first shm added, increase the domain reference
> + * counter as we need to keep domain around a bit longer to reclaim the
> + * shared memory in the teardown path.
> + */
> +if ( !ctx->shm_count )
> +get_knownalive_domain(d);
> +
> if (ctx->shm_count >= FFA_MAX_SHM_COUNT)
> ret = false;
> else
> ctx->shm_count++;
> +
> spin_unlock(>lock);
>
> return ret;
> }
>
>
[XEN PATCH v3] xen/arm: ffa: reclaim shared memory on guest destroy
When an FF-A enabled guest is destroyed it may leave behind memory
shared with SPs. This memory must be reclaimed before it's reused or an
SP may make changes to memory used by a new unrelated guest. So when the
domain is teared down add FF-A requests to reclaim all remaining shared
memory.
SPs in the secure world are notified using VM_DESTROYED that a guest has
been destroyed. An SP is supposed to relinquish all shared memory to allow
reclaiming the memory. The relinquish operation may need to be delayed if
the shared memory is for instance part of a DMA operation.
The domain reference counter is increased when the first FF-A shared
memory is registered and the counter is decreased again when the last
shared memory is reclaimed. If FF-A shared memory registrations remain
at the end of of ffa_domain_teardown() a timer is set to try to reclaim
the shared memory every second until the memory is reclaimed.
A few minor style fixes with a removed empty line here and an added new
line there.
Signed-off-by: Jens Wiklander
---
v3:
- Mentioning in the commit message that there are some style fixes
- Addressing review comments
- Refactor the ffa_domain_teardown() path to let
ffa_domain_teardown_continue() do most of the work.
v2:
- Update commit message to match the new implementation
- Using a per domain bitfield to keep track of which SPs has been notified
with VM_DESTROYED
- Holding a domain reference counter to keep the domain as a zombie domain
while there still is shared memory registrations remaining to be reclaimed
- Using a timer to retry reclaiming remaining shared memory registrations
---
xen/arch/arm/tee/ffa.c | 253 +
1 file changed, 204 insertions(+), 49 deletions(-)
diff --git a/xen/arch/arm/tee/ffa.c b/xen/arch/arm/tee/ffa.c
index 0793c1c7585d..80ebbf4f01c6 100644
--- a/xen/arch/arm/tee/ffa.c
+++ b/xen/arch/arm/tee/ffa.c
@@ -54,6 +54,7 @@
#include
#include
#include
+#include
#include
#include
@@ -144,6 +145,12 @@
*/
#define FFA_MAX_SHM_COUNT 32
+/*
+ * The time we wait until trying to tear down a domain again if it was
+ * blocked initially.
+ */
+#define FFA_CTX_TEARDOWN_DELAY SECONDS(1)
+
/* FF-A-1.1-REL0 section 10.9.2 Memory region handle, page 167 */
#define FFA_HANDLE_HYP_FLAG BIT(63, ULL)
#define FFA_HANDLE_INVALID 0xULL
@@ -384,11 +391,6 @@ struct ffa_ctx {
unsigned int page_count;
/* FF-A version used by the guest */
uint32_t guest_vers;
-/*
- * Number of SPs that we have sent a VM created signal to, used in
- * ffa_domain_teardown() to know which SPs need to be signalled.
- */
-uint16_t create_signal_count;
bool rx_is_free;
/* Used shared memory objects, struct ffa_shm_mem */
struct list_head shm_list;
@@ -402,6 +404,15 @@ struct ffa_ctx {
spinlock_t tx_lock;
spinlock_t rx_lock;
spinlock_t lock;
+/* Used if domain can't be torn down immediately */
+struct domain *teardown_d;
+struct list_head teardown_list;
+s_time_t teardown_expire;
+/*
+ * Used for ffa_domain_teardown() to keep track of which SPs should be
+ * notified that this guest is being destroyed.
+ */
+unsigned long vm_destroy_bitmap[];
};
struct ffa_shm_mem {
@@ -436,6 +447,12 @@ static void *ffa_tx __read_mostly;
static DEFINE_SPINLOCK(ffa_rx_buffer_lock);
static DEFINE_SPINLOCK(ffa_tx_buffer_lock);
+
+/* Used to track domains that could not be torn down immediately. */
+static struct timer ffa_teardown_timer;
+static struct list_head ffa_teardown_head;
+static DEFINE_SPINLOCK(ffa_teardown_lock);
+
static bool ffa_get_version(uint32_t *vers)
{
const struct arm_smccc_1_2_regs arg = {
@@ -853,7 +870,6 @@ static int32_t handle_partition_info_get(uint32_t w1,
uint32_t w2, uint32_t w3,
goto out_rx_release;
}
-
memcpy(ctx->rx, ffa_rx, sz);
}
ctx->rx_is_free = false;
@@ -992,53 +1008,75 @@ static void put_shm_pages(struct ffa_shm_mem *shm)
}
}
-static bool inc_ctx_shm_count(struct ffa_ctx *ctx)
+static bool inc_ctx_shm_count(struct domain *d, struct ffa_ctx *ctx)
{
bool ret = true;
spin_lock(>lock);
+
+/*
+ * If this is the first shm added, increase the domain reference
+ * counter as we need to keep domain around a bit longer to reclaim the
+ * shared memory in the teardown path.
+ */
+if ( !ctx->shm_count )
+get_knownalive_domain(d);
+
if (ctx->shm_count >= FFA_MAX_SHM_COUNT)
ret = false;
else
ctx->shm_count++;
+
spin_unlock(>lock);
return ret;
}
-static void dec_ctx_shm_count(struct ffa_ctx *ctx)
+static void dec_ctx_shm_count(struct domain *d, struct ffa_ctx *ctx)
{
spin_lock(>lock);
+
ASSERT(ctx->shm_count > 0);
ctx->shm_count--;
+
+/*
+ * If this was the last shm removed, let go of the domain reference we
+ *
