1 /* 2 * Copyright (c) 2015, Linaro Limited 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright notice, 9 * this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright notice, 12 * this list of conditions and the following disclaimer in the documentation 13 * and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 16 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 19 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <kernel/abort.h> 29 #include <kernel/misc.h> 30 #include <kernel/tee_ta_manager.h> 31 #include <kernel/panic.h> 32 #include <kernel/user_ta.h> 33 #include <kernel/unwind.h> 34 #include <mm/core_mmu.h> 35 #include <mm/tee_pager.h> 36 #include <tee/tee_svc.h> 37 #include <trace.h> 38 #include <arm.h> 39 40 enum fault_type { 41 FAULT_TYPE_USER_TA_PANIC, 42 FAULT_TYPE_USER_TA_VFP, 43 FAULT_TYPE_PAGEABLE, 44 FAULT_TYPE_IGNORE, 45 }; 46 47 #ifdef CFG_CORE_UNWIND 48 #ifdef ARM32 49 static void __print_stack_unwind(struct abort_info *ai) 50 { 51 struct unwind_state state; 52 53 memset(&state, 0, sizeof(state)); 54 state.registers[0] = ai->regs->r0; 55 state.registers[1] = ai->regs->r1; 56 state.registers[2] = ai->regs->r2; 57 state.registers[3] = ai->regs->r3; 58 state.registers[4] = ai->regs->r4; 59 state.registers[5] = ai->regs->r5; 60 state.registers[6] = ai->regs->r6; 61 state.registers[7] = ai->regs->r7; 62 state.registers[8] = ai->regs->r8; 63 state.registers[9] = ai->regs->r9; 64 state.registers[10] = ai->regs->r10; 65 state.registers[11] = ai->regs->r11; 66 state.registers[13] = read_mode_sp(ai->regs->spsr & CPSR_MODE_MASK); 67 state.registers[14] = read_mode_lr(ai->regs->spsr & CPSR_MODE_MASK); 68 state.registers[15] = ai->pc; 69 70 do { 71 EMSG_RAW(" pc 0x%08x", state.registers[15]); 72 } while (unwind_stack(&state)); 73 } 74 #endif /*ARM32*/ 75 76 #ifdef ARM64 77 static void __print_stack_unwind(struct abort_info *ai) 78 { 79 struct unwind_state state; 80 81 memset(&state, 0, sizeof(state)); 82 state.pc = ai->regs->elr; 83 state.fp = ai->regs->x29; 84 85 do { 86 EMSG_RAW("pc 0x%016" PRIx64, state.pc); 87 } while (unwind_stack(&state)); 88 } 89 #endif /*ARM64*/ 90 91 static void print_stack_unwind(struct abort_info *ai) 92 { 93 EMSG_RAW("Call stack:"); 94 __print_stack_unwind(ai); 95 } 96 #else /*CFG_CORE_UNWIND*/ 97 static void print_stack_unwind(struct abort_info *ai __unused) 98 { 99 } 100 #endif /*CFG_CORE_UNWIND*/ 101 102 static __maybe_unused const char *abort_type_to_str(uint32_t abort_type) 103 { 104 if (abort_type == ABORT_TYPE_DATA) 105 return "data"; 106 if (abort_type == ABORT_TYPE_PREFETCH) 107 return "prefetch"; 108 return "undef"; 109 } 110 111 static __maybe_unused const char *fault_to_str(uint32_t fault_descr) 112 { 113 114 switch (core_mmu_get_fault_type(fault_descr)) { 115 case CORE_MMU_FAULT_ALIGNMENT: 116 return " (alignment fault)"; 117 case CORE_MMU_FAULT_TRANSLATION: 118 return " (translation fault)"; 119 case CORE_MMU_FAULT_READ_PERMISSION: 120 return " (read permission fault)"; 121 case CORE_MMU_FAULT_WRITE_PERMISSION: 122 return " (write permission fault)"; 123 default: 124 return ""; 125 } 126 } 127 128 static __maybe_unused void print_detailed_abort( 129 struct abort_info *ai __maybe_unused, 130 const char *ctx __maybe_unused) 131 { 132 EMSG_RAW("\n"); 133 EMSG_RAW("%s %s-abort at address 0x%" PRIxVA "%s\n", 134 ctx, abort_type_to_str(ai->abort_type), ai->va, 135 fault_to_str(ai->fault_descr)); 136 #ifdef ARM32 137 EMSG_RAW(" fsr 0x%08x ttbr0 0x%08x ttbr1 0x%08x cidr 0x%X\n", 138 ai->fault_descr, read_ttbr0(), read_ttbr1(), 139 read_contextidr()); 140 EMSG_RAW(" cpu #%zu cpsr 0x%08x\n", 141 get_core_pos(), ai->regs->spsr); 142 EMSG_RAW(" r0 0x%08x r4 0x%08x r8 0x%08x r12 0x%08x\n", 143 ai->regs->r0, ai->regs->r4, ai->regs->r8, ai->regs->ip); 144 EMSG_RAW(" r1 0x%08x r5 0x%08x r9 0x%08x sp 0x%08x\n", 145 ai->regs->r1, ai->regs->r5, ai->regs->r9, 146 read_mode_sp(ai->regs->spsr & CPSR_MODE_MASK)); 147 EMSG_RAW(" r2 0x%08x r6 0x%08x r10 0x%08x lr 0x%08x\n", 148 ai->regs->r2, ai->regs->r6, ai->regs->r10, 149 read_mode_lr(ai->regs->spsr & CPSR_MODE_MASK)); 150 EMSG_RAW(" r3 0x%08x r7 0x%08x r11 0x%08x pc 0x%08x\n", 151 ai->regs->r3, ai->regs->r7, ai->regs->r11, ai->pc); 152 #endif /*ARM32*/ 153 #ifdef ARM64 154 EMSG_RAW(" esr 0x%08x ttbr0 0x%08" PRIx64 " ttbr1 0x%08" PRIx64 " cidr 0x%X\n", 155 ai->fault_descr, read_ttbr0_el1(), read_ttbr1_el1(), 156 read_contextidr_el1()); 157 EMSG_RAW(" cpu #%zu cpsr 0x%08x\n", 158 get_core_pos(), (uint32_t)ai->regs->spsr); 159 EMSG_RAW("x0 %016" PRIx64 " x1 %016" PRIx64, 160 ai->regs->x0, ai->regs->x1); 161 EMSG_RAW("x2 %016" PRIx64 " x3 %016" PRIx64, 162 ai->regs->x2, ai->regs->x3); 163 EMSG_RAW("x4 %016" PRIx64 " x5 %016" PRIx64, 164 ai->regs->x4, ai->regs->x5); 165 EMSG_RAW("x6 %016" PRIx64 " x7 %016" PRIx64, 166 ai->regs->x6, ai->regs->x7); 167 EMSG_RAW("x8 %016" PRIx64 " x9 %016" PRIx64, 168 ai->regs->x8, ai->regs->x9); 169 EMSG_RAW("x10 %016" PRIx64 " x11 %016" PRIx64, 170 ai->regs->x10, ai->regs->x11); 171 EMSG_RAW("x12 %016" PRIx64 " x13 %016" PRIx64, 172 ai->regs->x12, ai->regs->x13); 173 EMSG_RAW("x14 %016" PRIx64 " x15 %016" PRIx64, 174 ai->regs->x14, ai->regs->x15); 175 EMSG_RAW("x16 %016" PRIx64 " x17 %016" PRIx64, 176 ai->regs->x16, ai->regs->x17); 177 EMSG_RAW("x18 %016" PRIx64 " x19 %016" PRIx64, 178 ai->regs->x18, ai->regs->x19); 179 EMSG_RAW("x20 %016" PRIx64 " x21 %016" PRIx64, 180 ai->regs->x20, ai->regs->x21); 181 EMSG_RAW("x22 %016" PRIx64 " x23 %016" PRIx64, 182 ai->regs->x22, ai->regs->x23); 183 EMSG_RAW("x24 %016" PRIx64 " x25 %016" PRIx64, 184 ai->regs->x24, ai->regs->x25); 185 EMSG_RAW("x26 %016" PRIx64 " x27 %016" PRIx64, 186 ai->regs->x26, ai->regs->x27); 187 EMSG_RAW("x28 %016" PRIx64 " x29 %016" PRIx64, 188 ai->regs->x28, ai->regs->x29); 189 EMSG_RAW("x30 %016" PRIx64 " elr %016" PRIx64, 190 ai->regs->x30, ai->regs->elr); 191 EMSG_RAW("sp_el0 %016" PRIx64, ai->regs->sp_el0); 192 #endif /*ARM64*/ 193 } 194 195 static void print_user_abort(struct abort_info *ai __maybe_unused) 196 { 197 #ifdef CFG_TEE_CORE_TA_TRACE 198 print_detailed_abort(ai, "user TA"); 199 tee_ta_dump_current(); 200 #endif 201 } 202 203 void abort_print(struct abort_info *ai __maybe_unused) 204 { 205 #if (TRACE_LEVEL >= TRACE_INFO) 206 print_detailed_abort(ai, "core"); 207 #endif /*TRACE_LEVEL >= TRACE_DEBUG*/ 208 } 209 210 void abort_print_error(struct abort_info *ai) 211 { 212 #if (TRACE_LEVEL >= TRACE_INFO) 213 /* full verbose log at DEBUG level */ 214 print_detailed_abort(ai, "core"); 215 #else 216 #ifdef ARM32 217 EMSG("%s-abort at 0x%" PRIxVA "\n" 218 "FSR 0x%x PC 0x%x TTBR0 0x%X CONTEXIDR 0x%X\n" 219 "CPUID 0x%x CPSR 0x%x (read from SPSR)", 220 abort_type_to_str(ai->abort_type), 221 ai->va, ai->fault_descr, ai->pc, read_ttbr0(), read_contextidr(), 222 read_mpidr(), read_spsr()); 223 #endif /*ARM32*/ 224 #ifdef ARM64 225 EMSG("%s-abort at 0x%" PRIxVA "\n" 226 "ESR 0x%x PC 0x%x TTBR0 0x%" PRIx64 " CONTEXIDR 0x%X\n" 227 "CPUID 0x%" PRIx64 " CPSR 0x%x (read from SPSR)", 228 abort_type_to_str(ai->abort_type), 229 ai->va, ai->fault_descr, ai->pc, read_ttbr0_el1(), 230 read_contextidr_el1(), 231 read_mpidr_el1(), (uint32_t)ai->regs->spsr); 232 #endif /*ARM64*/ 233 #endif /*TRACE_LEVEL >= TRACE_DEBUG*/ 234 print_stack_unwind(ai); 235 } 236 237 #ifdef ARM32 238 static void set_abort_info(uint32_t abort_type, struct thread_abort_regs *regs, 239 struct abort_info *ai) 240 { 241 switch (abort_type) { 242 case ABORT_TYPE_DATA: 243 ai->fault_descr = read_dfsr(); 244 ai->va = read_dfar(); 245 break; 246 case ABORT_TYPE_PREFETCH: 247 ai->fault_descr = read_ifsr(); 248 ai->va = read_ifar(); 249 break; 250 default: 251 ai->fault_descr = 0; 252 ai->va = regs->elr; 253 break; 254 } 255 ai->abort_type = abort_type; 256 ai->pc = regs->elr; 257 ai->regs = regs; 258 } 259 #endif /*ARM32*/ 260 261 #ifdef ARM64 262 static void set_abort_info(uint32_t abort_type __unused, 263 struct thread_abort_regs *regs, struct abort_info *ai) 264 { 265 ai->fault_descr = read_esr_el1(); 266 switch ((ai->fault_descr >> ESR_EC_SHIFT) & ESR_EC_MASK) { 267 case ESR_EC_IABT_EL0: 268 case ESR_EC_IABT_EL1: 269 ai->abort_type = ABORT_TYPE_PREFETCH; 270 ai->va = read_far_el1(); 271 break; 272 case ESR_EC_DABT_EL0: 273 case ESR_EC_DABT_EL1: 274 case ESR_EC_SP_ALIGN: 275 ai->abort_type = ABORT_TYPE_DATA; 276 ai->va = read_far_el1(); 277 break; 278 default: 279 ai->abort_type = ABORT_TYPE_UNDEF; 280 ai->va = regs->elr; 281 } 282 ai->pc = regs->elr; 283 ai->regs = regs; 284 } 285 #endif /*ARM64*/ 286 287 #ifdef ARM32 288 static void handle_user_ta_panic(struct abort_info *ai) 289 { 290 /* 291 * It was a user exception, stop user execution and return 292 * to TEE Core. 293 */ 294 ai->regs->r0 = TEE_ERROR_TARGET_DEAD; 295 ai->regs->r1 = true; 296 ai->regs->r2 = 0xdeadbeef; 297 ai->regs->elr = (uint32_t)thread_unwind_user_mode; 298 ai->regs->spsr = read_cpsr(); 299 ai->regs->spsr &= ~CPSR_MODE_MASK; 300 ai->regs->spsr |= CPSR_MODE_SVC; 301 ai->regs->spsr &= ~CPSR_FIA; 302 ai->regs->spsr |= read_spsr() & CPSR_FIA; 303 /* Select Thumb or ARM mode */ 304 if (ai->regs->elr & 1) 305 ai->regs->spsr |= CPSR_T; 306 else 307 ai->regs->spsr &= ~CPSR_T; 308 } 309 #endif /*ARM32*/ 310 311 #ifdef ARM64 312 static void handle_user_ta_panic(struct abort_info *ai) 313 { 314 uint32_t daif; 315 316 /* 317 * It was a user exception, stop user execution and return 318 * to TEE Core. 319 */ 320 ai->regs->x0 = TEE_ERROR_TARGET_DEAD; 321 ai->regs->x1 = true; 322 ai->regs->x2 = 0xdeadbeef; 323 ai->regs->elr = (vaddr_t)thread_unwind_user_mode; 324 ai->regs->sp_el0 = thread_get_saved_thread_sp(); 325 326 daif = (ai->regs->spsr >> SPSR_32_AIF_SHIFT) & SPSR_32_AIF_MASK; 327 /* XXX what about DAIF_D? */ 328 ai->regs->spsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0, daif); 329 } 330 #endif /*ARM64*/ 331 332 #ifdef CFG_WITH_VFP 333 static void handle_user_ta_vfp(void) 334 { 335 TEE_Result res; 336 struct tee_ta_session *s; 337 338 res = tee_ta_get_current_session(&s); 339 if (res != TEE_SUCCESS) 340 panic(); 341 342 thread_user_enable_vfp(&to_user_ta_ctx(s->ctx)->vfp); 343 } 344 #endif /*CFG_WITH_VFP*/ 345 346 #ifdef ARM32 347 /* Returns true if the exception originated from user mode */ 348 static bool is_user_exception(struct abort_info *ai) 349 { 350 return (ai->regs->spsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR; 351 } 352 #endif /*ARM32*/ 353 354 #ifdef ARM64 355 /* Returns true if the exception originated from user mode */ 356 static bool is_user_exception(struct abort_info *ai) 357 { 358 uint32_t spsr = ai->regs->spsr; 359 360 if (spsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT)) 361 return true; 362 if (((spsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) == 363 SPSR_64_MODE_EL0) 364 return true; 365 return false; 366 } 367 #endif /*ARM64*/ 368 369 #ifdef ARM32 370 /* Returns true if the exception originated from abort mode */ 371 static bool is_abort_in_abort_handler(struct abort_info *ai) 372 { 373 return (ai->regs->spsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_ABT; 374 } 375 #endif /*ARM32*/ 376 377 #ifdef ARM64 378 /* Returns true if the exception originated from abort mode */ 379 static bool is_abort_in_abort_handler(struct abort_info *ai __unused) 380 { 381 return false; 382 } 383 #endif /*ARM64*/ 384 385 #ifdef ARM32 386 387 #define T32_INSTR(w1, w0) \ 388 ((((uint32_t)(w0) & 0xffff) << 16) | ((uint32_t)(w1) & 0xffff)) 389 390 #define T32_VTRANS32_MASK T32_INSTR(0xff << 8, (7 << 9) | 1 << 4) 391 #define T32_VTRANS32_VAL T32_INSTR(0xee << 8, (5 << 9) | 1 << 4) 392 393 #define T32_VTRANS64_MASK T32_INSTR((0xff << 8) | (7 << 5), 7 << 9) 394 #define T32_VTRANS64_VAL T32_INSTR((0xec << 8) | (2 << 5), 5 << 9) 395 396 #define T32_VLDST_MASK T32_INSTR((0xff << 8) | (1 << 4), 0) 397 #define T32_VLDST_VAL T32_INSTR( 0xf9 << 8 , 0) 398 399 #define T32_VXLDST_MASK T32_INSTR(0xfc << 8, 7 << 9) 400 #define T32_VXLDST_VAL T32_INSTR(0xec << 8, 5 << 9) 401 402 #define T32_VPROC_MASK T32_INSTR(0xef << 8, 0) 403 #define T32_VPROC_VAL T32_VPROC_MASK 404 405 #define A32_INSTR(x) ((uint32_t)(x)) 406 407 #define A32_VTRANS32_MASK A32_INSTR((0xf << 24) | (7 << 9) | (1 << 4)) 408 #define A32_VTRANS32_VAL A32_INSTR((0xe << 24) | (5 << 9) | (1 << 4)) 409 410 #define A32_VTRANS64_MASK A32_INSTR((0x7f << 21) | (7 << 9)) 411 #define A32_VTRANS64_VAL A32_INSTR((0x62 << 21) | (5 << 9)) 412 413 #define A32_VLDST_MASK A32_INSTR((0xff << 24) | (1 << 20)) 414 #define A32_VLDST_VAL A32_INSTR((0xf4 << 24)) 415 416 #define A32_VXLDST_MASK A32_INSTR((7 << 25) | (7 << 9)) 417 #define A32_VXLDST_VAL A32_INSTR((6 << 25) | (5 << 9)) 418 419 #define A32_VPROC_MASK A32_INSTR(0x7f << 25) 420 #define A32_VPROC_VAL A32_INSTR(0x79 << 25) 421 422 static bool is_vfp_fault(struct abort_info *ai) 423 { 424 TEE_Result res; 425 uint32_t instr; 426 427 if ((ai->abort_type != ABORT_TYPE_UNDEF) || vfp_is_enabled()) 428 return false; 429 430 res = tee_svc_copy_from_user(NULL, &instr, (void *)ai->pc, 431 sizeof(instr)); 432 if (res != TEE_SUCCESS) 433 return false; 434 435 if (ai->regs->spsr & CPSR_T) { 436 /* Thumb mode */ 437 return ((instr & T32_VTRANS32_MASK) == T32_VTRANS32_VAL) || 438 ((instr & T32_VTRANS64_MASK) == T32_VTRANS64_VAL) || 439 ((instr & T32_VLDST_MASK) == T32_VLDST_VAL) || 440 ((instr & T32_VXLDST_MASK) == T32_VXLDST_VAL) || 441 ((instr & T32_VPROC_MASK) == T32_VPROC_VAL); 442 } else { 443 /* ARM mode */ 444 return ((instr & A32_VTRANS32_MASK) == A32_VTRANS32_VAL) || 445 ((instr & A32_VTRANS64_MASK) == A32_VTRANS64_VAL) || 446 ((instr & A32_VLDST_MASK) == A32_VLDST_VAL) || 447 ((instr & A32_VXLDST_MASK) == A32_VXLDST_VAL) || 448 ((instr & A32_VPROC_MASK) == A32_VPROC_VAL); 449 } 450 } 451 #endif /*ARM32*/ 452 453 #ifdef ARM64 454 static bool is_vfp_fault(struct abort_info *ai) 455 { 456 switch ((ai->fault_descr >> ESR_EC_SHIFT) & ESR_EC_MASK) { 457 case ESR_EC_FP_ASIMD: 458 case ESR_EC_AARCH32_FP: 459 case ESR_EC_AARCH64_FP: 460 return true; 461 default: 462 return false; 463 } 464 } 465 #endif /*ARM64*/ 466 467 static enum fault_type get_fault_type(struct abort_info *ai) 468 { 469 if (is_user_exception(ai)) { 470 if (is_vfp_fault(ai)) 471 return FAULT_TYPE_USER_TA_VFP; 472 print_user_abort(ai); 473 DMSG("[abort] abort in User mode (TA will panic)"); 474 return FAULT_TYPE_USER_TA_PANIC; 475 } 476 477 if (is_abort_in_abort_handler(ai)) { 478 abort_print_error(ai); 479 EMSG("[abort] abort in abort handler (trap CPU)"); 480 panic(); 481 } 482 483 if (ai->abort_type == ABORT_TYPE_UNDEF) { 484 abort_print_error(ai); 485 EMSG("[abort] undefined abort (trap CPU)"); 486 panic(); 487 } 488 489 switch (core_mmu_get_fault_type(ai->fault_descr)) { 490 case CORE_MMU_FAULT_ALIGNMENT: 491 abort_print_error(ai); 492 EMSG("[abort] alignement fault! (trap CPU)"); 493 panic(); 494 break; 495 496 case CORE_MMU_FAULT_ACCESS_BIT: 497 abort_print_error(ai); 498 EMSG("[abort] access bit fault! (trap CPU)"); 499 panic(); 500 break; 501 502 case CORE_MMU_FAULT_DEBUG_EVENT: 503 abort_print(ai); 504 DMSG("[abort] Ignoring debug event!"); 505 return FAULT_TYPE_IGNORE; 506 507 case CORE_MMU_FAULT_TRANSLATION: 508 case CORE_MMU_FAULT_WRITE_PERMISSION: 509 case CORE_MMU_FAULT_READ_PERMISSION: 510 return FAULT_TYPE_PAGEABLE; 511 512 case CORE_MMU_FAULT_ASYNC_EXTERNAL: 513 abort_print(ai); 514 DMSG("[abort] Ignoring async external abort!"); 515 return FAULT_TYPE_IGNORE; 516 517 case CORE_MMU_FAULT_OTHER: 518 default: 519 abort_print(ai); 520 DMSG("[abort] Unhandled fault!"); 521 return FAULT_TYPE_IGNORE; 522 } 523 } 524 525 void abort_handler(uint32_t abort_type, struct thread_abort_regs *regs) 526 { 527 struct abort_info ai; 528 529 set_abort_info(abort_type, regs, &ai); 530 531 switch (get_fault_type(&ai)) { 532 case FAULT_TYPE_IGNORE: 533 break; 534 case FAULT_TYPE_USER_TA_PANIC: 535 vfp_disable(); 536 handle_user_ta_panic(&ai); 537 break; 538 #ifdef CFG_WITH_VFP 539 case FAULT_TYPE_USER_TA_VFP: 540 handle_user_ta_vfp(); 541 break; 542 #endif 543 case FAULT_TYPE_PAGEABLE: 544 default: 545 thread_kernel_save_vfp(); 546 tee_pager_handle_fault(&ai); 547 thread_kernel_restore_vfp(); 548 break; 549 } 550 } 551