test(fuzz): add FF-A fuzzing
Add necessary components for FF-A calls to be used in fuzzing framework
including bias tree, `run_ffa_fuzz` helper function, makefile additions,
and initial SMC description file with FF-A smc calls.
Can use ffa_smc_calls.txt to generate necessary header files.
Signed-off-by: Kathleen Capella <kathleen.capella@arm.com>
Change-Id: Ib19714342d31cacd818471686a7e4c8910fed5c3
diff --git a/smc_fuzz/src/ffa_fuzz_helper.c b/smc_fuzz/src/ffa_fuzz_helper.c
new file mode 100644
index 0000000..95cfa0c
--- /dev/null
+++ b/smc_fuzz/src/ffa_fuzz_helper.c
@@ -0,0 +1,485 @@
+/*
+ * Copyright (c) 2025, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arg_struct_def.h>
+#include "constraint.h"
+#include <ffa_fuzz_helper.h>
+#include <fuzz_names.h>
+#include <runtime_services/cactus_test_cmds.h>
+#include <runtime_services/ffa_endpoints.h>
+#include <runtime_services/spm_common.h>
+#include <stdint.h>
+
+#ifdef FFA_INCLUDE
+
+#define PRIMARY_LO ffa_get_uuid_lo((struct ffa_uuid){PRIMARY_UUID})
+#define PRIMARY_HI ffa_get_uuid_hi((struct ffa_uuid){PRIMARY_UUID})
+#define SECONDARY_LO ffa_get_uuid_lo((struct ffa_uuid){SECONDARY_UUID})
+#define SECONDARY_HI ffa_get_uuid_hi((struct ffa_uuid){SECONDARY_UUID})
+#define TERTIARY_LO ffa_get_uuid_lo((struct ffa_uuid){TERTIARY_UUID})
+#define TERTIARY_HI ffa_get_uuid_hi((struct ffa_uuid){TERTIARY_UUID})
+
+#define FFA_FUNC_ID_MIN 0x84000060
+#define FFA_FUNC_ID_MAX 0x8400008C
+#define MAX_VM_ID ((UINT64_C(1) << 16) - 1)
+#define FFA_FEAT_ID_MIN 0x0
+#define FFA_FEAT_ID_MAX 0xFF
+#define MAX_NUM_VCPUS 8
+#define MIN_VCPU_ID 0
+#define MAX_VCPU_ID (MAX_NUM_VCPUS - 1)
+
+void inputparameters_to_ffa_value(struct inputparameters ip,
+ struct ffa_value *args)
+{
+ args->arg1 = ip.x1;
+ args->arg2 = ip.x2;
+ args->arg3 = ip.x3;
+ args->arg4 = ip.x4;
+ args->arg5 = ip.x5;
+ args->arg6 = ip.x6;
+ args->arg7 = ip.x7;
+ args->arg8 = ip.x8;
+ args->arg9 = ip.x9;
+ args->arg10 = ip.x10;
+ args->arg11 = ip.x12;
+ args->arg12 = ip.x12;
+ args->arg13 = ip.x13;
+ args->arg14 = ip.x14;
+ args->arg15 = ip.x15;
+ args->arg16 = ip.x16;
+ args->arg17 = ip.x17;
+}
+
+static struct ffa_value ffa_call_with_params(struct inputparameters ip,
+ uint64_t ffa_function_id)
+{
+ struct ffa_value args = {.fid = ffa_function_id};
+
+ inputparameters_to_ffa_value(ip, &args);
+
+ return ffa_service_call(&args);
+}
+
+static bool is_info_get_regs_valid(struct inputparameters ip)
+{
+ uint64_t uuid_lo = ip.x1;
+ uint64_t uuid_hi = ip.x2;
+ uint64_t start = get_generated_value(
+ FFA_PARTITION_INFO_GET_REGS_CALL_ARG3_START, ip);
+ uint64_t tag = get_generated_value(
+ FFA_PARTITION_INFO_GET_REGS_CALL_ARG3_TAG, ip);
+
+ if ((uuid_lo == PRIMARY_LO && uuid_hi == PRIMARY_HI) ||
+ (uuid_lo == SECONDARY_LO && uuid_hi == SECONDARY_HI) ||
+ (uuid_lo == TERTIARY_LO && uuid_hi == TERTIARY_HI)) {
+ return (start == 0 && tag == 0);
+ } else if (uuid_lo == 0 && uuid_hi == 0) {
+ if (start == 0) {
+ return (tag == 0);
+ }
+ return (start < 4);
+ }
+ return false;
+}
+
+void run_ffa_fuzz(int funcid, struct memmod *mmod)
+{
+ /*
+ * For the SMC function id, apply constraints and generate input
+ * arguments based on sanity level, call the SMC, and do basic analysis
+ * and reporting of return results.
+ *
+ * An error return may not be a failure if the inputs are invalid,
+ * therefore failures are marked explicitly.
+ */
+ switch (funcid) {
+ case ffa_id_get_funcid: {
+ struct ffa_value args;
+ struct ffa_value ret;
+
+ args = (struct ffa_value){.fid = FFA_ID_GET};
+ ret = ffa_service_call(&args);
+
+ if (ret.fid == FFA_ERROR) {
+ printf("FAIL error code %d\n", ffa_error_code(ret));
+ }
+ break;
+ }
+ case ffa_partition_info_get_regs_funcid: {
+ uint64_t uuid_lo_values[] = {0, PRIMARY_LO, SECONDARY_LO,
+ TERTIARY_LO};
+ uint64_t uuid_hi_values[] = {0, PRIMARY_HI, SECONDARY_HI,
+ TERTIARY_HI};
+ struct inputparameters ip;
+ struct ffa_value args;
+ struct ffa_value ret;
+
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, uuid_lo_values, 2,
+ FFA_PARTITION_INFO_GET_REGS_CALL_ARG1_UUID_LO,
+ mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, uuid_hi_values, 2,
+ FFA_PARTITION_INFO_GET_REGS_CALL_ARG2_UUID_HI,
+ mmod, FUZZER_CONSTRAINT_EXCMODE);
+
+ ip = generate_args(FFA_PARTITION_INFO_GET_REGS_CALL,
+ SMC_FUZZ_SANITY_LEVEL);
+ inputparameters_to_ffa_value(ip, &args);
+ args.fid = FFA_PARTITION_INFO_GET_REGS_SMC64;
+
+ ret = ffa_service_call(&args);
+
+ if (is_info_get_regs_valid(ip) && ret.fid == FFA_ERROR) {
+ printf("FAIL error code %d\n", ffa_error_code(ret));
+ }
+ break;
+ }
+ case ffa_version_funcid: {
+ struct inputparameters ip;
+ struct ffa_value ret;
+ uint32_t version;
+
+ ip = generate_args(FFA_VERSION_CALL, SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, FFA_VERSION);
+ version = ret.fid;
+
+ if (version == FFA_ERROR_NOT_SUPPORTED) {
+ printf("FFA_VERSION_NOT_SUPPORTED\n");
+ }
+ break;
+ }
+ case ffa_msg_send_direct_req_32_funcid:
+ case ffa_msg_send_direct_req_64_funcid: {
+ uint64_t receiver_ids[] = {SP_ID(1), SP_ID(2), SP_ID(3)};
+ uint64_t sender_id[] = {HYP_ID};
+ uint64_t message_type[] = {0, 1};
+ uint64_t frmwrk_msg_type[] = {0, 1};
+ uint64_t msg_0_input[] = {CACTUS_ECHO_CMD,
+ CACTUS_REQ_ECHO_CMD}; /* Cactus cmd */
+ uint64_t msg_1_input[] = {100,
+ 200}; /* for echo cmds, echo_val */
+ struct inputparameters ip;
+ struct ffa_value ret;
+ uint64_t req_function_id;
+ uint64_t call_id;
+ uint64_t sender_arg;
+ uint64_t receiver_arg;
+ uint64_t msg_type_arg;
+ uint64_t frmwk_msg_type_arg;
+ uint64_t msg_0_arg;
+ uint64_t msg_1_arg;
+
+ if (funcid == ffa_msg_send_direct_req_32_funcid) {
+ req_function_id = FFA_MSG_SEND_DIRECT_REQ_SMC32;
+ call_id = FFA_MSG_SEND_DIRECT_REQ_32_CALL;
+ sender_arg =
+ FFA_MSG_SEND_DIRECT_REQ_32_CALL_ARG1_SENDER_ID;
+ receiver_arg =
+ FFA_MSG_SEND_DIRECT_REQ_32_CALL_ARG1_RECEIVER_ID;
+ msg_type_arg =
+ FFA_MSG_SEND_DIRECT_REQ_32_CALL_ARG2_MESSAGE_TYPE;
+ frmwk_msg_type_arg =
+ FFA_MSG_SEND_DIRECT_REQ_32_CALL_ARG2_FRMWK_MSG_TYPE;
+ msg_0_arg = FFA_MSG_SEND_DIRECT_REQ_32_CALL_ARG3_MSG_0;
+ msg_1_arg = FFA_MSG_SEND_DIRECT_REQ_32_CALL_ARG4_MSG_1;
+ } else {
+ req_function_id = FFA_MSG_SEND_DIRECT_REQ_SMC64;
+ call_id = FFA_MSG_SEND_DIRECT_REQ_64_CALL;
+ sender_arg =
+ FFA_MSG_SEND_DIRECT_REQ_64_CALL_ARG1_SENDER_ID;
+ receiver_arg =
+ FFA_MSG_SEND_DIRECT_REQ_64_CALL_ARG1_RECEIVER_ID;
+ msg_type_arg =
+ FFA_MSG_SEND_DIRECT_REQ_64_CALL_ARG2_MESSAGE_TYPE;
+ frmwk_msg_type_arg =
+ FFA_MSG_SEND_DIRECT_REQ_64_CALL_ARG2_FRMWK_MSG_TYPE;
+ msg_0_arg = FFA_MSG_SEND_DIRECT_REQ_64_CALL_ARG3_MSG_0;
+ msg_1_arg = FFA_MSG_SEND_DIRECT_REQ_64_CALL_ARG4_MSG_1;
+ }
+
+ setconstraint(FUZZER_CONSTRAINT_SVALUE, sender_id, 1,
+ sender_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, receiver_ids, 3,
+ receiver_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, message_type, 2,
+ msg_type_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, frmwrk_msg_type, 2,
+ frmwk_msg_type_arg, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, msg_0_input, 2,
+ msg_0_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_RANGE, msg_1_input, 2,
+ msg_1_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+
+ ip = generate_args(call_id, SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, req_function_id);
+
+ switch (ret.fid) {
+ case FFA_MSG_SEND_DIRECT_RESP_SMC64:
+ case FFA_MSG_SEND_DIRECT_RESP_SMC32:
+ printf("Received direct response, ret.arg4 = %ld\n",
+ ret.arg4);
+ break;
+ case FFA_ERROR:
+ printf("Direct request returned with FFA_ERROR code %d\n",
+ ffa_error_code(ret));
+ break;
+ case FFA_MSG_YIELD:
+ printf("FFA_MSG_SEND_DIRECT_REQ returned with FFA_MSG_YIELD\n");
+ break;
+ case FFA_INTERRUPT:
+ printf("FFA_MSG_SEND_DIRECT_REQ returned with FFA_INTERRUPT\n");
+ break;
+ default:
+ printf("FAIL FFA_MSG_SEND_DIRECT_REQ returned with 0x%lx\n",
+ ret.fid);
+ break;
+ }
+ break;
+ }
+ case ffa_msg_send_direct_resp_32_funcid:
+ case ffa_msg_send_direct_resp_64_funcid: {
+ uint64_t receiver_ids[] = {SP_ID(1), SP_ID(2), SP_ID(3)};
+ uint64_t sender_id[] = {HYP_ID};
+ struct inputparameters ip;
+ struct ffa_value ret;
+ uint64_t resp_function_id;
+ uint64_t call_id;
+ uint64_t sender_arg;
+ uint64_t receiver_arg;
+ if (funcid == ffa_msg_send_direct_resp_32_funcid) {
+ resp_function_id = FFA_MSG_SEND_DIRECT_RESP_SMC32;
+ call_id = FFA_MSG_SEND_DIRECT_RESP_32_CALL;
+ sender_arg =
+ FFA_MSG_SEND_DIRECT_RESP_32_CALL_ARG1_SENDER_ID;
+ receiver_arg =
+ FFA_MSG_SEND_DIRECT_RESP_32_CALL_ARG1_RECEIVER_ID;
+ } else {
+ resp_function_id = FFA_MSG_SEND_DIRECT_RESP_SMC64;
+ call_id = FFA_MSG_SEND_DIRECT_RESP_64_CALL;
+ sender_arg =
+ FFA_MSG_SEND_DIRECT_RESP_64_CALL_ARG1_SENDER_ID;
+ receiver_arg =
+ FFA_MSG_SEND_DIRECT_RESP_64_CALL_ARG1_RECEIVER_ID;
+ }
+
+ setconstraint(FUZZER_CONSTRAINT_SVALUE, sender_id, 1,
+ sender_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, receiver_ids, 3,
+ receiver_arg, mmod, FUZZER_CONSTRAINT_EXCMODE);
+
+ ip = generate_args(call_id, SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, resp_function_id);
+
+ /* NWd cannot send a direct response. */
+ if (ret.fid == FFA_ERROR) {
+ printf("Direct response returned with FFA_ERROR code %d\n",
+ ffa_error_code(ret));
+ } else {
+ printf("FAIL FFA_MSG_SEND_DIRECT_RESP returned with 0x%lx\n",
+ ret.fid);
+ }
+ break;
+ }
+ case ffa_features_feat_id_funcid: {
+ /* Allow feature_ids in range of 8bits */
+ uint64_t feat_ids_range[] = {FFA_FEAT_ID_MIN, FFA_FEAT_ID_MAX};
+ struct inputparameters ip;
+ struct ffa_value ret;
+
+ setconstraint(FUZZER_CONSTRAINT_RANGE, feat_ids_range, 2,
+ FFA_FEATURES_FEAT_ID_CALL_ARG1_FEAT_ID, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+
+ ip = generate_args(FFA_FEATURES_FEAT_ID_CALL,
+ SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, FFA_FEATURES);
+ printf("ret.fid: { 0x%lx\n", ret.fid);
+ break;
+ }
+ case ffa_features_func_id_funcid: {
+ uint64_t ffa_funcid_range[] = {FFA_FUNC_ID_MIN,
+ FFA_FUNC_ID_MAX};
+ struct inputparameters ip;
+ struct ffa_value ret;
+ uint64_t funcid_gen_input;
+
+ setconstraint(FUZZER_CONSTRAINT_RANGE, ffa_funcid_range, 2,
+ FFA_FEATURES_FUNC_ID_CALL_ARG1_FUNC_ID, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+
+ ip = generate_args(FFA_FEATURES_FUNC_ID_CALL,
+ SMC_FUZZ_SANITY_LEVEL);
+
+ /*
+ * TODO: Would be a good use case for future fuzzing
+ * functionality having one field constraint dependent
+ * on value of another generated field.
+ */
+ funcid_gen_input = get_generated_value(
+ FFA_FEATURES_FUNC_ID_CALL_ARG1_FUNC_ID, ip);
+ if (SMC_FUZZ_SANITY_LEVEL == SANITY_LEVEL_3 &&
+ funcid_gen_input == FFA_MEM_RETRIEVE_REQ_SMC32) {
+ // Set arg2 to a certain value
+ ip.x2 = 0x10;
+ }
+
+ ret = ffa_call_with_params(ip, FFA_FEATURES);
+ printf("ret.fid: { 0x%lx\n", ret.fid);
+ break;
+ }
+ case ffa_run_funcid: {
+ uint64_t target_ids[] = {SP_ID(1), SP_ID(2), SP_ID(3)};
+ uint64_t target_vcpu_ids[] = {MIN_VCPU_ID, MAX_VCPU_ID};
+ struct inputparameters ip;
+ struct ffa_value ret;
+
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, target_ids, 3,
+ FFA_RUN_CALL_ARG1_TARGET_VM_ID, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_RANGE, target_vcpu_ids, 2,
+ FFA_RUN_CALL_ARG1_TARGET_VCPU_ID, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+ ip = generate_args(FFA_RUN_CALL, SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, FFA_RUN);
+
+ switch (ret.fid) {
+ case FFA_ERROR:
+ printf("FFA_RUN returned with FFA_ERROR code %d\n",
+ ffa_error_code(ret));
+ break;
+
+ case FFA_INTERRUPT:
+ case FFA_MSG_WAIT:
+ case FFA_MSG_YIELD:
+ case FFA_MSG_SEND_DIRECT_RESP_SMC64:
+ case FFA_MSG_SEND_DIRECT_RESP_SMC32:
+ printf("FFA_RUN successfully returned with 0x%lx\n",
+ ret.fid);
+ break;
+ default:
+ printf("FAIL FFA_RUN returned with 0x%lx\n", ret.fid);
+ break;
+ }
+ break;
+ }
+ case ffa_notification_bitmap_create_funcid: {
+ uint64_t vm_id[] = {0, MAX_VM_ID};
+ uint64_t n_vcpus[] = {0, MAX_NUM_VCPUS};
+ struct inputparameters ip;
+ struct ffa_value ret;
+ uint64_t gen_vm_id;
+ uint64_t gen_n_vcpus;
+
+ setconstraint(FUZZER_CONSTRAINT_RANGE, n_vcpus, 2,
+ FFA_NOTIFICATION_BITMAP_CREATE_CALL_ARG2_N_VCPUS,
+ mmod, FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_RANGE, vm_id, 2,
+ FFA_NOTIFICATION_BITMAP_CREATE_CALL_ARG1_VM_ID,
+ mmod, FUZZER_CONSTRAINT_EXCMODE);
+
+ ip = generate_args(FFA_NOTIFICATION_BITMAP_CREATE_CALL,
+ SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, FFA_NOTIFICATION_BITMAP_CREATE);
+
+ gen_vm_id = get_generated_value(
+ FFA_NOTIFICATION_BITMAP_CREATE_CALL_ARG1_VM_ID, ip);
+ gen_n_vcpus = get_generated_value(
+ FFA_NOTIFICATION_BITMAP_CREATE_CALL_ARG2_N_VCPUS, ip);
+
+ if (ret.fid == FFA_SUCCESS_SMC32 ||
+ ret.fid == FFA_SUCCESS_SMC64) {
+ printf("FFA_NOTIFICATION_BITMAP_CREATE succeeded for "
+ "VM %lld with vCPU count %lld\n",
+ gen_vm_id, gen_n_vcpus);
+ } else if (ret.fid == FFA_ERROR) {
+ printf("FFA_NOTIFICATION_BITMAP_CREATE returned with "
+ "FFA_ERROR code %d\n",
+ ffa_error_code(ret));
+ } else {
+ printf("FAIL FFA_NOTIFICATION_BITMAP_CREATE returned with 0x%lx\n",
+ ret.fid);
+ }
+ break;
+ }
+ case ffa_notification_bind_funcid: {
+ uint64_t sps[] = {SP_ID(1), SP_ID(2), SP_ID(3)};
+ uint64_t vm_ids[] = {0, MAX_VM_ID};
+ uint64_t max_bitmap_value = 0xFFFFFFFF;
+ uint64_t bitmap_range[] = {0, max_bitmap_value};
+ struct inputparameters ip;
+ struct ffa_value ret;
+
+ setconstraint(FUZZER_CONSTRAINT_RANGE, vm_ids, 2,
+ FFA_NOTIFICATION_BIND_CALL_ARG1_RECEIVER_ID, mmod,
+ FUZZER_CONSTRAINT_ACCMODE);
+ setconstraint(FUZZER_CONSTRAINT_RANGE, vm_ids, 2,
+ FFA_NOTIFICATION_BIND_CALL_ARG1_SENDER_ID, mmod,
+ FUZZER_CONSTRAINT_ACCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, sps, 3,
+ FFA_NOTIFICATION_BIND_CALL_ARG1_RECEIVER_ID, mmod,
+ FUZZER_CONSTRAINT_ACCMODE);
+ setconstraint(FUZZER_CONSTRAINT_VECTOR, sps, 3,
+ FFA_NOTIFICATION_BIND_CALL_ARG1_SENDER_ID, mmod,
+ FUZZER_CONSTRAINT_ACCMODE);
+ setconstraint(FUZZER_CONSTRAINT_RANGE, bitmap_range, 2,
+ FFA_NOTIFICATION_BIND_CALL_ARG3_BITMAP, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+ setconstraint(FUZZER_CONSTRAINT_RANGE, bitmap_range, 2,
+ FFA_NOTIFICATION_BIND_CALL_ARG4_BITMAP, mmod,
+ FUZZER_CONSTRAINT_EXCMODE);
+ ip = generate_args(FFA_NOTIFICATION_BIND_CALL,
+ SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, FFA_NOTIFICATION_BIND);
+
+ if (ret.fid == FFA_SUCCESS_SMC32 ||
+ ret.fid == FFA_SUCCESS_SMC64) {
+ printf("FFA_NOTIFICATION_BIND succeeded\n");
+ } else if (ret.fid == FFA_ERROR) {
+ printf("FFA_NOTIFICATION_BIND returned with FFA_ERROR code %d\n",
+ ffa_error_code(ret));
+ } else {
+ printf("FAIL FFA_NOTIFICATION_BIND returned with 0x%lx\n",
+ ret.fid);
+ }
+ break;
+ }
+ case ffa_notification_bitmap_destroy_funcid: {
+ uint64_t vm_id[] = {0, MAX_VM_ID};
+ struct inputparameters ip;
+ struct ffa_value ret;
+ uint64_t gen_vm_id;
+
+ gen_vm_id = get_generated_value(
+ FFA_NOTIFICATION_BITMAP_DESTROY_CALL_ARG1_VM_ID, ip);
+
+ setconstraint(FUZZER_CONSTRAINT_RANGE, vm_id, 2,
+ FFA_NOTIFICATION_BITMAP_DESTROY_CALL_ARG1_VM_ID,
+ mmod, FUZZER_CONSTRAINT_EXCMODE);
+ ip = generate_args(FFA_NOTIFICATION_BITMAP_DESTROY_CALL,
+ SMC_FUZZ_SANITY_LEVEL);
+ ret = ffa_call_with_params(ip, FFA_NOTIFICATION_BITMAP_DESTROY);
+
+ gen_vm_id = get_generated_value(
+ FFA_NOTIFICATION_BITMAP_DESTROY_CALL_ARG1_VM_ID, ip);
+
+ if (ret.fid == FFA_SUCCESS_SMC32 ||
+ ret.fid == FFA_SUCCESS_SMC64) {
+ printf("FFA_NOTIFICATION_BITMAP_DESTROY succeeded for VM %lld\n",
+ gen_vm_id);
+ } else if (ret.fid == FFA_ERROR) {
+ printf("FFA_NOTIFICATION_BITMAP_CREATE returned with FFA_ERROR code %d\n",
+ ffa_error_code(ret));
+ } else {
+ printf("FAIL FFA_NOTIFICATION_BITMAP_CREATE returned with 0x%lx\n",
+ ret.fid);
+ }
+ break;
+ }
+ default:
+ break;
+ }
+}
+#endif
diff --git a/smc_fuzz/src/runtestfunction_helpers.c b/smc_fuzz/src/runtestfunction_helpers.c
index fbee707..7ef55e8 100644
--- a/smc_fuzz/src/runtestfunction_helpers.c
+++ b/smc_fuzz/src/runtestfunction_helpers.c
@@ -5,12 +5,12 @@
*/
#include <arg_struct_def.h>
+#include <ffa_fuzz_helper.h>
#include <sdei_fuzz_helper.h>
#include "smcmalloc.h"
#include <tsp_fuzz_helper.h>
int cntid = 0;
-
#include <vendor_fuzz_helper.h>
/*
@@ -23,6 +23,9 @@
#ifdef SDEI_INCLUDE
run_sdei_fuzz(funcid, mmod, inrange, cntid);
#endif
+#ifdef FFA_INCLUDE
+ run_ffa_fuzz(funcid, mmod);
+#endif
run_tsp_fuzz(funcid);
#ifdef VEN_INCLUDE
run_ven_el3_fuzz(funcid, mmod);