From nobody Mon Feb 9 22:40:00 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail(p=none dis=none) header.from=arm.com Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 177014035436345.34875123975735; Tue, 3 Feb 2026 09:39:14 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1219545.1528461 (Exim 4.92) (envelope-from ) id 1vnKMY-0002Eg-Sd; Tue, 03 Feb 2026 17:38:54 +0000 Received: by outflank-mailman (output) from mailman id 1219545.1528461; Tue, 03 Feb 2026 17:38:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1vnKMY-0002EX-PG; Tue, 03 Feb 2026 17:38:54 +0000 Received: by outflank-mailman (input) for mailman id 1219545; Tue, 03 Feb 2026 17:38:53 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1vnKMX-0000Zt-5S for xen-devel@lists.xenproject.org; Tue, 03 Feb 2026 17:38:53 +0000 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by se1-gles-flk1.inumbo.com (Halon) with ESMTP id 33bb85be-0127-11f1-9ccf-f158ae23cfc8; Tue, 03 Feb 2026 18:38:51 +0100 (CET) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 30E051063; Tue, 3 Feb 2026 09:38:44 -0800 (PST) Received: from C3HXLD123V.arm.com (unknown [10.57.54.220]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 89D673F632; Tue, 3 Feb 2026 09:38:49 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 33bb85be-0127-11f1-9ccf-f158ae23cfc8 From: Bertrand Marquis To: xen-devel@lists.xenproject.org Cc: Volodymyr Babchuk , Jens Wiklander , Stefano Stabellini , Julien Grall , Michal Orzel Subject: [PATCH 07/12] xen/arm: ffa: Fix RXTX_UNMAP ownership race Date: Tue, 3 Feb 2026 18:38:02 +0100 Message-ID: <971bf27b9a2cafa0ed405a638a532b6fbbf51142.1770115302.git.bertrand.marquis@arm.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1770140356936158500 Content-Type: text/plain; charset="utf-8" rxtx_unmap() checks RX ownership without holding the RX/TX locks and only enforces the ownership rule when FFA_RX_ACQUIRE is supported. This allows a vCPU to acquire RX between the check and unmap, and it lets RXTX_UNMAP proceed while RX is owned when buffers are not forwarded to firmware. Hold rx_lock/tx_lock across the ownership check and unmap, and deny RXTX_UNMAP whenever RX is owned, independent of RX_ACQUIRE support. For teardown, release RX ownership under the same lock window; use FFA_RX_RELEASE directly because rx_lock is held, and clear the local flag when the firmware path is unavailable. Functional impact: RXTX_UNMAP now reliably returns DENIED while RX is owned, and teardown releases/clears ownership without a race. Signed-off-by: Bertrand Marquis --- xen/arch/arm/tee/ffa_rxtx.c | 36 +++++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/tee/ffa_rxtx.c b/xen/arch/arm/tee/ffa_rxtx.c index eff95a7955d7..450ce102cbdc 100644 --- a/xen/arch/arm/tee/ffa_rxtx.c +++ b/xen/arch/arm/tee/ffa_rxtx.c @@ -220,7 +220,7 @@ err_unlock_rxtx: return ret; } =20 -static int32_t rxtx_unmap(struct domain *d) +static int32_t rxtx_unmap(struct domain *d, bool teardown) { struct ffa_ctx *ctx =3D d->arch.tee; int32_t ret =3D FFA_RET_OK; @@ -234,6 +234,36 @@ static int32_t rxtx_unmap(struct domain *d) goto err_unlock_rxtx; } =20 + if ( !ctx->rx_is_free ) + { + if ( teardown ) + { + if ( ffa_fw_supports_fid(FFA_RX_ACQUIRE) ) + { + int32_t rel_ret; + + /* Can't use ffa_rx_release() while holding rx_lock. */ + rel_ret =3D ffa_simple_call(FFA_RX_RELEASE, ctx->ffa_id, + 0, 0, 0); + if ( rel_ret ) + gdprintk(XENLOG_DEBUG, + "ffa: RX release during teardown failed: %d\n= ", + rel_ret); + else + ctx->rx_is_free =3D true; + } + else + ctx->rx_is_free =3D true; + } + else + { + gdprintk(XENLOG_DEBUG, + "ffa: RXTX_UNMAP denied, RX buffer owned by VM\n"); + ret =3D FFA_RET_DENIED; + goto err_unlock_rxtx; + } + } + if ( ffa_fw_supports_fid(FFA_RX_ACQUIRE) ) { ret =3D ffa_rxtx_unmap(ffa_get_vm_id(d)); @@ -261,7 +291,7 @@ err_unlock_rxtx: =20 int32_t ffa_handle_rxtx_unmap(void) { - return rxtx_unmap(current->domain); + return rxtx_unmap(current->domain, false); } =20 int32_t ffa_rx_acquire(struct ffa_ctx *ctx, void **buf, size_t *buf_size) @@ -369,7 +399,7 @@ int32_t ffa_rxtx_domain_init(struct domain *d) =20 void ffa_rxtx_domain_destroy(struct domain *d) { - rxtx_unmap(d); + rxtx_unmap(d, true); } =20 void *ffa_rxtx_spmc_rx_acquire(void) --=20 2.50.1 (Apple Git-155)