xref: /optee_os/core/arch/arm/kernel/thread.c (revision 336e32995d9c419d9fc2a6fd5974f99761285415)
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2016, Linaro Limited
4  * Copyright (c) 2014, STMicroelectronics International N.V.
5  */
6 
7 #include <platform_config.h>
8 
9 #include <arm.h>
10 #include <assert.h>
11 #include <keep.h>
12 #include <kernel/asan.h>
13 #include <kernel/lockdep.h>
14 #include <kernel/misc.h>
15 #include <kernel/msg_param.h>
16 #include <kernel/panic.h>
17 #include <kernel/spinlock.h>
18 #include <kernel/tee_ta_manager.h>
19 #include <kernel/thread_defs.h>
20 #include <kernel/thread.h>
21 #include <mm/core_memprot.h>
22 #include <mm/mobj.h>
23 #include <mm/tee_mm.h>
24 #include <mm/tee_mmu.h>
25 #include <mm/tee_pager.h>
26 #include <optee_msg.h>
27 #include <optee_rpc_cmd.h>
28 #include <smccc.h>
29 #include <sm/optee_smc.h>
30 #include <sm/sm.h>
31 #include <tee/tee_cryp_utl.h>
32 #include <tee/tee_fs_rpc.h>
33 #include <trace.h>
34 #include <util.h>
35 
36 #include "thread_private.h"
37 
38 #ifdef CFG_WITH_ARM_TRUSTED_FW
39 #define STACK_TMP_OFFS		0
40 #else
41 #define STACK_TMP_OFFS		SM_STACK_TMP_RESERVE_SIZE
42 #endif
43 
44 
45 #ifdef ARM32
46 #ifdef CFG_CORE_SANITIZE_KADDRESS
47 #define STACK_TMP_SIZE		(3072 + STACK_TMP_OFFS)
48 #else
49 #define STACK_TMP_SIZE		(1536 + STACK_TMP_OFFS)
50 #endif
51 #define STACK_THREAD_SIZE	8192
52 
53 #ifdef CFG_CORE_SANITIZE_KADDRESS
54 #define STACK_ABT_SIZE		3072
55 #else
56 #define STACK_ABT_SIZE		2048
57 #endif
58 
59 #endif /*ARM32*/
60 
61 #ifdef ARM64
62 #define STACK_TMP_SIZE		(2048 + STACK_TMP_OFFS)
63 #define STACK_THREAD_SIZE	8192
64 
65 #if TRACE_LEVEL > 0
66 #define STACK_ABT_SIZE		3072
67 #else
68 #define STACK_ABT_SIZE		1024
69 #endif
70 #endif /*ARM64*/
71 
72 struct thread_ctx threads[CFG_NUM_THREADS];
73 
74 struct thread_core_local thread_core_local[CFG_TEE_CORE_NB_CORE];
75 
76 #ifdef CFG_WITH_STACK_CANARIES
77 #ifdef ARM32
78 #define STACK_CANARY_SIZE	(4 * sizeof(uint32_t))
79 #endif
80 #ifdef ARM64
81 #define STACK_CANARY_SIZE	(8 * sizeof(uint32_t))
82 #endif
83 #define START_CANARY_VALUE	0xdededede
84 #define END_CANARY_VALUE	0xabababab
85 #define GET_START_CANARY(name, stack_num) name[stack_num][0]
86 #define GET_END_CANARY(name, stack_num) \
87 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
88 #else
89 #define STACK_CANARY_SIZE	0
90 #endif
91 
92 #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
93 linkage uint32_t name[num_stacks] \
94 		[ROUNDUP(stack_size + STACK_CANARY_SIZE, STACK_ALIGNMENT) / \
95 		sizeof(uint32_t)] \
96 		__attribute__((section(".nozi_stack." # name), \
97 			       aligned(STACK_ALIGNMENT)))
98 
99 #define STACK_SIZE(stack) (sizeof(stack) - STACK_CANARY_SIZE / 2)
100 
101 #define GET_STACK(stack) \
102 	((vaddr_t)(stack) + STACK_SIZE(stack))
103 
104 DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE, static);
105 DECLARE_STACK(stack_abt, CFG_TEE_CORE_NB_CORE, STACK_ABT_SIZE, static);
106 #ifndef CFG_WITH_PAGER
107 DECLARE_STACK(stack_thread, CFG_NUM_THREADS, STACK_THREAD_SIZE, static);
108 #endif
109 
110 const void *stack_tmp_export = (uint8_t *)stack_tmp + sizeof(stack_tmp[0]) -
111 			       (STACK_TMP_OFFS + STACK_CANARY_SIZE / 2);
112 const uint32_t stack_tmp_stride = sizeof(stack_tmp[0]);
113 
114 /*
115  * These stack setup info are required by secondary boot cores before they
116  * each locally enable the pager (the mmu). Hence kept in pager sections.
117  */
118 KEEP_PAGER(stack_tmp_export);
119 KEEP_PAGER(stack_tmp_stride);
120 
121 thread_smc_handler_t thread_std_smc_handler_ptr;
122 static thread_smc_handler_t thread_fast_smc_handler_ptr;
123 thread_nintr_handler_t thread_nintr_handler_ptr;
124 thread_pm_handler_t thread_cpu_on_handler_ptr;
125 thread_pm_handler_t thread_cpu_off_handler_ptr;
126 thread_pm_handler_t thread_cpu_suspend_handler_ptr;
127 thread_pm_handler_t thread_cpu_resume_handler_ptr;
128 thread_pm_handler_t thread_system_off_handler_ptr;
129 thread_pm_handler_t thread_system_reset_handler_ptr;
130 
131 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
132 static vaddr_t thread_user_kcode_va;
133 long thread_user_kcode_offset;
134 static size_t thread_user_kcode_size;
135 #endif
136 
137 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
138 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
139 long thread_user_kdata_sp_offset;
140 static uint8_t thread_user_kdata_page[
141 	ROUNDUP(sizeof(thread_core_local), SMALL_PAGE_SIZE)]
142 	__aligned(SMALL_PAGE_SIZE) __section(".nozi.kdata_page");
143 #endif
144 
145 static unsigned int thread_global_lock = SPINLOCK_UNLOCK;
146 static bool thread_prealloc_rpc_cache;
147 
148 static unsigned int thread_rpc_pnum;
149 
150 static void init_canaries(void)
151 {
152 #ifdef CFG_WITH_STACK_CANARIES
153 	size_t n;
154 #define INIT_CANARY(name)						\
155 	for (n = 0; n < ARRAY_SIZE(name); n++) {			\
156 		uint32_t *start_canary = &GET_START_CANARY(name, n);	\
157 		uint32_t *end_canary = &GET_END_CANARY(name, n);	\
158 									\
159 		*start_canary = START_CANARY_VALUE;			\
160 		*end_canary = END_CANARY_VALUE;				\
161 		DMSG("#Stack canaries for %s[%zu] with top at %p\n",	\
162 			#name, n, (void *)(end_canary - 1));		\
163 		DMSG("watch *%p\n", (void *)end_canary);		\
164 	}
165 
166 	INIT_CANARY(stack_tmp);
167 	INIT_CANARY(stack_abt);
168 #ifndef CFG_WITH_PAGER
169 	INIT_CANARY(stack_thread);
170 #endif
171 #endif/*CFG_WITH_STACK_CANARIES*/
172 }
173 
174 #define CANARY_DIED(stack, loc, n) \
175 	do { \
176 		EMSG_RAW("Dead canary at %s of '%s[%zu]'", #loc, #stack, n); \
177 		panic(); \
178 	} while (0)
179 
180 void thread_check_canaries(void)
181 {
182 #ifdef CFG_WITH_STACK_CANARIES
183 	size_t n;
184 
185 	for (n = 0; n < ARRAY_SIZE(stack_tmp); n++) {
186 		if (GET_START_CANARY(stack_tmp, n) != START_CANARY_VALUE)
187 			CANARY_DIED(stack_tmp, start, n);
188 		if (GET_END_CANARY(stack_tmp, n) != END_CANARY_VALUE)
189 			CANARY_DIED(stack_tmp, end, n);
190 	}
191 
192 	for (n = 0; n < ARRAY_SIZE(stack_abt); n++) {
193 		if (GET_START_CANARY(stack_abt, n) != START_CANARY_VALUE)
194 			CANARY_DIED(stack_abt, start, n);
195 		if (GET_END_CANARY(stack_abt, n) != END_CANARY_VALUE)
196 			CANARY_DIED(stack_abt, end, n);
197 
198 	}
199 #ifndef CFG_WITH_PAGER
200 	for (n = 0; n < ARRAY_SIZE(stack_thread); n++) {
201 		if (GET_START_CANARY(stack_thread, n) != START_CANARY_VALUE)
202 			CANARY_DIED(stack_thread, start, n);
203 		if (GET_END_CANARY(stack_thread, n) != END_CANARY_VALUE)
204 			CANARY_DIED(stack_thread, end, n);
205 	}
206 #endif
207 #endif/*CFG_WITH_STACK_CANARIES*/
208 }
209 
210 static void lock_global(void)
211 {
212 	cpu_spin_lock(&thread_global_lock);
213 }
214 
215 static void unlock_global(void)
216 {
217 	cpu_spin_unlock(&thread_global_lock);
218 }
219 
220 #ifdef ARM32
221 uint32_t thread_get_exceptions(void)
222 {
223 	uint32_t cpsr = read_cpsr();
224 
225 	return (cpsr >> CPSR_F_SHIFT) & THREAD_EXCP_ALL;
226 }
227 
228 void thread_set_exceptions(uint32_t exceptions)
229 {
230 	uint32_t cpsr = read_cpsr();
231 
232 	/* Foreign interrupts must not be unmasked while holding a spinlock */
233 	if (!(exceptions & THREAD_EXCP_FOREIGN_INTR))
234 		assert_have_no_spinlock();
235 
236 	cpsr &= ~(THREAD_EXCP_ALL << CPSR_F_SHIFT);
237 	cpsr |= ((exceptions & THREAD_EXCP_ALL) << CPSR_F_SHIFT);
238 	write_cpsr(cpsr);
239 }
240 #endif /*ARM32*/
241 
242 #ifdef ARM64
243 uint32_t thread_get_exceptions(void)
244 {
245 	uint32_t daif = read_daif();
246 
247 	return (daif >> DAIF_F_SHIFT) & THREAD_EXCP_ALL;
248 }
249 
250 void thread_set_exceptions(uint32_t exceptions)
251 {
252 	uint32_t daif = read_daif();
253 
254 	/* Foreign interrupts must not be unmasked while holding a spinlock */
255 	if (!(exceptions & THREAD_EXCP_FOREIGN_INTR))
256 		assert_have_no_spinlock();
257 
258 	daif &= ~(THREAD_EXCP_ALL << DAIF_F_SHIFT);
259 	daif |= ((exceptions & THREAD_EXCP_ALL) << DAIF_F_SHIFT);
260 	write_daif(daif);
261 }
262 #endif /*ARM64*/
263 
264 uint32_t thread_mask_exceptions(uint32_t exceptions)
265 {
266 	uint32_t state = thread_get_exceptions();
267 
268 	thread_set_exceptions(state | (exceptions & THREAD_EXCP_ALL));
269 	return state;
270 }
271 
272 void thread_unmask_exceptions(uint32_t state)
273 {
274 	thread_set_exceptions(state & THREAD_EXCP_ALL);
275 }
276 
277 
278 struct thread_core_local *thread_get_core_local(void)
279 {
280 	uint32_t cpu_id = get_core_pos();
281 
282 	/*
283 	 * Foreign interrupts must be disabled before playing with core_local
284 	 * since we otherwise may be rescheduled to a different core in the
285 	 * middle of this function.
286 	 */
287 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
288 
289 	assert(cpu_id < CFG_TEE_CORE_NB_CORE);
290 	return &thread_core_local[cpu_id];
291 }
292 
293 static void thread_lazy_save_ns_vfp(void)
294 {
295 #ifdef CFG_WITH_VFP
296 	struct thread_ctx *thr = threads + thread_get_id();
297 
298 	thr->vfp_state.ns_saved = false;
299 	vfp_lazy_save_state_init(&thr->vfp_state.ns);
300 #endif /*CFG_WITH_VFP*/
301 }
302 
303 static void thread_lazy_restore_ns_vfp(void)
304 {
305 #ifdef CFG_WITH_VFP
306 	struct thread_ctx *thr = threads + thread_get_id();
307 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
308 
309 	assert(!thr->vfp_state.sec_lazy_saved && !thr->vfp_state.sec_saved);
310 
311 	if (tuv && tuv->lazy_saved && !tuv->saved) {
312 		vfp_lazy_save_state_final(&tuv->vfp, false /*!force_save*/);
313 		tuv->saved = true;
314 	}
315 
316 	vfp_lazy_restore_state(&thr->vfp_state.ns, thr->vfp_state.ns_saved);
317 	thr->vfp_state.ns_saved = false;
318 #endif /*CFG_WITH_VFP*/
319 }
320 
321 #ifdef ARM32
322 static void init_regs(struct thread_ctx *thread,
323 		struct thread_smc_args *args)
324 {
325 	thread->regs.pc = (uint32_t)thread_std_smc_entry;
326 
327 	/*
328 	 * Stdcalls starts in SVC mode with masked foreign interrupts, masked
329 	 * Asynchronous abort and unmasked native interrupts.
330 	 */
331 	thread->regs.cpsr = read_cpsr() & ARM32_CPSR_E;
332 	thread->regs.cpsr |= CPSR_MODE_SVC | CPSR_A |
333 			(THREAD_EXCP_FOREIGN_INTR << ARM32_CPSR_F_SHIFT);
334 	/* Enable thumb mode if it's a thumb instruction */
335 	if (thread->regs.pc & 1)
336 		thread->regs.cpsr |= CPSR_T;
337 	/* Reinitialize stack pointer */
338 	thread->regs.svc_sp = thread->stack_va_end;
339 
340 	/*
341 	 * Copy arguments into context. This will make the
342 	 * arguments appear in r0-r7 when thread is started.
343 	 */
344 	thread->regs.r0 = args->a0;
345 	thread->regs.r1 = args->a1;
346 	thread->regs.r2 = args->a2;
347 	thread->regs.r3 = args->a3;
348 	thread->regs.r4 = args->a4;
349 	thread->regs.r5 = args->a5;
350 	thread->regs.r6 = args->a6;
351 	thread->regs.r7 = args->a7;
352 }
353 #endif /*ARM32*/
354 
355 #ifdef ARM64
356 static void init_regs(struct thread_ctx *thread,
357 		struct thread_smc_args *args)
358 {
359 	thread->regs.pc = (uint64_t)thread_std_smc_entry;
360 
361 	/*
362 	 * Stdcalls starts in SVC mode with masked foreign interrupts, masked
363 	 * Asynchronous abort and unmasked native interrupts.
364 	 */
365 	thread->regs.cpsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0,
366 				THREAD_EXCP_FOREIGN_INTR | DAIFBIT_ABT);
367 	/* Reinitialize stack pointer */
368 	thread->regs.sp = thread->stack_va_end;
369 
370 	/*
371 	 * Copy arguments into context. This will make the
372 	 * arguments appear in x0-x7 when thread is started.
373 	 */
374 	thread->regs.x[0] = args->a0;
375 	thread->regs.x[1] = args->a1;
376 	thread->regs.x[2] = args->a2;
377 	thread->regs.x[3] = args->a3;
378 	thread->regs.x[4] = args->a4;
379 	thread->regs.x[5] = args->a5;
380 	thread->regs.x[6] = args->a6;
381 	thread->regs.x[7] = args->a7;
382 
383 	/* Set up frame pointer as per the Aarch64 AAPCS */
384 	thread->regs.x[29] = 0;
385 }
386 #endif /*ARM64*/
387 
388 void thread_init_boot_thread(void)
389 {
390 	struct thread_core_local *l = thread_get_core_local();
391 	size_t n;
392 
393 	mutex_lockdep_init();
394 
395 	for (n = 0; n < CFG_NUM_THREADS; n++) {
396 		TAILQ_INIT(&threads[n].tsd.sess_stack);
397 		SLIST_INIT(&threads[n].tsd.pgt_cache);
398 	}
399 
400 	for (n = 0; n < CFG_TEE_CORE_NB_CORE; n++)
401 		thread_core_local[n].curr_thread = -1;
402 
403 	l->curr_thread = 0;
404 	threads[0].state = THREAD_STATE_ACTIVE;
405 }
406 
407 void thread_clr_boot_thread(void)
408 {
409 	struct thread_core_local *l = thread_get_core_local();
410 
411 	assert(l->curr_thread >= 0 && l->curr_thread < CFG_NUM_THREADS);
412 	assert(threads[l->curr_thread].state == THREAD_STATE_ACTIVE);
413 	threads[l->curr_thread].state = THREAD_STATE_FREE;
414 	l->curr_thread = -1;
415 }
416 
417 static void thread_alloc_and_run(struct thread_smc_args *args)
418 {
419 	size_t n;
420 	struct thread_core_local *l = thread_get_core_local();
421 	bool found_thread = false;
422 
423 	assert(l->curr_thread == -1);
424 
425 	lock_global();
426 
427 	for (n = 0; n < CFG_NUM_THREADS; n++) {
428 		if (threads[n].state == THREAD_STATE_FREE) {
429 			threads[n].state = THREAD_STATE_ACTIVE;
430 			found_thread = true;
431 			break;
432 		}
433 	}
434 
435 	unlock_global();
436 
437 	if (!found_thread) {
438 		args->a0 = OPTEE_SMC_RETURN_ETHREAD_LIMIT;
439 		return;
440 	}
441 
442 	l->curr_thread = n;
443 
444 	threads[n].flags = 0;
445 	init_regs(threads + n, args);
446 
447 	/* Save Hypervisor Client ID */
448 	threads[n].hyp_clnt_id = args->a7;
449 
450 	thread_lazy_save_ns_vfp();
451 	thread_resume(&threads[n].regs);
452 }
453 
454 #ifdef ARM32
455 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
456 		struct thread_smc_args *args)
457 {
458 	/*
459 	 * Update returned values from RPC, values will appear in
460 	 * r0-r3 when thread is resumed.
461 	 */
462 	regs->r0 = args->a0;
463 	regs->r1 = args->a1;
464 	regs->r2 = args->a2;
465 	regs->r3 = args->a3;
466 	regs->r4 = args->a4;
467 	regs->r5 = args->a5;
468 }
469 #endif /*ARM32*/
470 
471 #ifdef ARM64
472 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
473 		struct thread_smc_args *args)
474 {
475 	/*
476 	 * Update returned values from RPC, values will appear in
477 	 * x0-x3 when thread is resumed.
478 	 */
479 	regs->x[0] = args->a0;
480 	regs->x[1] = args->a1;
481 	regs->x[2] = args->a2;
482 	regs->x[3] = args->a3;
483 	regs->x[4] = args->a4;
484 	regs->x[5] = args->a5;
485 }
486 #endif /*ARM64*/
487 
488 #ifdef ARM32
489 static bool is_from_user(uint32_t cpsr)
490 {
491 	return (cpsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR;
492 }
493 #endif
494 
495 #ifdef ARM64
496 static bool is_from_user(uint32_t cpsr)
497 {
498 	if (cpsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT))
499 		return true;
500 	if (((cpsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) ==
501 	     SPSR_64_MODE_EL0)
502 		return true;
503 	return false;
504 }
505 #endif
506 
507 static bool is_user_mode(struct thread_ctx_regs *regs)
508 {
509 	return is_from_user((uint32_t)regs->cpsr);
510 }
511 
512 static void thread_resume_from_rpc(struct thread_smc_args *args)
513 {
514 	size_t n = args->a3; /* thread id */
515 	struct thread_core_local *l = thread_get_core_local();
516 	uint32_t rv = 0;
517 
518 	assert(l->curr_thread == -1);
519 
520 	lock_global();
521 
522 	if (n < CFG_NUM_THREADS &&
523 	    threads[n].state == THREAD_STATE_SUSPENDED &&
524 	    args->a7 == threads[n].hyp_clnt_id)
525 		threads[n].state = THREAD_STATE_ACTIVE;
526 	else
527 		rv = OPTEE_SMC_RETURN_ERESUME;
528 
529 	unlock_global();
530 
531 	if (rv) {
532 		args->a0 = rv;
533 		return;
534 	}
535 
536 	l->curr_thread = n;
537 
538 	if (is_user_mode(&threads[n].regs))
539 		tee_ta_update_session_utime_resume();
540 
541 	if (threads[n].have_user_map)
542 		core_mmu_set_user_map(&threads[n].user_map);
543 
544 	/*
545 	 * Return from RPC to request service of a foreign interrupt must not
546 	 * get parameters from non-secure world.
547 	 */
548 	if (threads[n].flags & THREAD_FLAGS_COPY_ARGS_ON_RETURN) {
549 		copy_a0_to_a5(&threads[n].regs, args);
550 		threads[n].flags &= ~THREAD_FLAGS_COPY_ARGS_ON_RETURN;
551 	}
552 
553 	thread_lazy_save_ns_vfp();
554 	thread_resume(&threads[n].regs);
555 }
556 
557 void thread_handle_fast_smc(struct thread_smc_args *args)
558 {
559 	thread_check_canaries();
560 	thread_fast_smc_handler_ptr(args);
561 	/* Fast handlers must not unmask any exceptions */
562 	assert(thread_get_exceptions() == THREAD_EXCP_ALL);
563 }
564 
565 void thread_handle_std_smc(struct thread_smc_args *args)
566 {
567 	thread_check_canaries();
568 
569 	if (args->a0 == OPTEE_SMC_CALL_RETURN_FROM_RPC)
570 		thread_resume_from_rpc(args);
571 	else
572 		thread_alloc_and_run(args);
573 }
574 
575 /**
576  * Free physical memory previously allocated with thread_rpc_alloc_arg()
577  *
578  * @cookie:	cookie received when allocating the buffer
579  */
580 static void thread_rpc_free_arg(uint64_t cookie)
581 {
582 	if (cookie) {
583 		uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
584 			OPTEE_SMC_RETURN_RPC_FREE
585 		};
586 
587 		reg_pair_from_64(cookie, rpc_args + 1, rpc_args + 2);
588 		thread_rpc(rpc_args);
589 	}
590 }
591 
592 /*
593  * Helper routine for the assembly function thread_std_smc_entry()
594  *
595  * Note: this function is weak just to make it possible to exclude it from
596  * the unpaged area.
597  */
598 void __weak __thread_std_smc_entry(struct thread_smc_args *args)
599 {
600 	thread_std_smc_handler_ptr(args);
601 
602 	if (args->a0 == OPTEE_SMC_RETURN_OK) {
603 		struct thread_ctx *thr = threads + thread_get_id();
604 
605 		tee_fs_rpc_cache_clear(&thr->tsd);
606 		if (!thread_prealloc_rpc_cache) {
607 			thread_rpc_free_arg(mobj_get_cookie(thr->rpc_mobj));
608 			mobj_free(thr->rpc_mobj);
609 			thr->rpc_arg = 0;
610 			thr->rpc_mobj = NULL;
611 		}
612 	}
613 }
614 
615 void *thread_get_tmp_sp(void)
616 {
617 	struct thread_core_local *l = thread_get_core_local();
618 
619 	return (void *)l->tmp_stack_va_end;
620 }
621 
622 #ifdef ARM64
623 vaddr_t thread_get_saved_thread_sp(void)
624 {
625 	struct thread_core_local *l = thread_get_core_local();
626 	int ct = l->curr_thread;
627 
628 	assert(ct != -1);
629 	return threads[ct].kern_sp;
630 }
631 #endif /*ARM64*/
632 
633 vaddr_t thread_stack_start(void)
634 {
635 	struct thread_ctx *thr;
636 	int ct = thread_get_id_may_fail();
637 
638 	if (ct == -1)
639 		return 0;
640 
641 	thr = threads + ct;
642 	return thr->stack_va_end - STACK_THREAD_SIZE;
643 }
644 
645 size_t thread_stack_size(void)
646 {
647 	return STACK_THREAD_SIZE;
648 }
649 
650 bool thread_is_from_abort_mode(void)
651 {
652 	struct thread_core_local *l = thread_get_core_local();
653 
654 	return (l->flags >> THREAD_CLF_SAVED_SHIFT) & THREAD_CLF_ABORT;
655 }
656 
657 #ifdef ARM32
658 bool thread_is_in_normal_mode(void)
659 {
660 	return (read_cpsr() & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_SVC;
661 }
662 #endif
663 
664 #ifdef ARM64
665 bool thread_is_in_normal_mode(void)
666 {
667 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
668 	struct thread_core_local *l = thread_get_core_local();
669 	bool ret;
670 
671 	/* If any bit in l->flags is set we're handling some exception. */
672 	ret = !l->flags;
673 	thread_unmask_exceptions(exceptions);
674 
675 	return ret;
676 }
677 #endif
678 
679 void thread_state_free(void)
680 {
681 	struct thread_core_local *l = thread_get_core_local();
682 	int ct = l->curr_thread;
683 
684 	assert(ct != -1);
685 
686 	thread_lazy_restore_ns_vfp();
687 	tee_pager_release_phys(
688 		(void *)(threads[ct].stack_va_end - STACK_THREAD_SIZE),
689 		STACK_THREAD_SIZE);
690 
691 	lock_global();
692 
693 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
694 	threads[ct].state = THREAD_STATE_FREE;
695 	threads[ct].flags = 0;
696 	l->curr_thread = -1;
697 
698 	unlock_global();
699 }
700 
701 #ifdef CFG_WITH_PAGER
702 static void release_unused_kernel_stack(struct thread_ctx *thr,
703 					uint32_t cpsr __maybe_unused)
704 {
705 #ifdef ARM64
706 	/*
707 	 * If we're from user mode then thr->regs.sp is the saved user
708 	 * stack pointer and thr->kern_sp holds the last kernel stack
709 	 * pointer. But if we're from kernel mode then thr->kern_sp isn't
710 	 * up to date so we need to read from thr->regs.sp instead.
711 	 */
712 	vaddr_t sp = is_from_user(cpsr) ?  thr->kern_sp : thr->regs.sp;
713 #else
714 	vaddr_t sp = thr->regs.svc_sp;
715 #endif
716 	vaddr_t base = thr->stack_va_end - STACK_THREAD_SIZE;
717 	size_t len = sp - base;
718 
719 	tee_pager_release_phys((void *)base, len);
720 }
721 #else
722 static void release_unused_kernel_stack(struct thread_ctx *thr __unused,
723 					uint32_t cpsr __unused)
724 {
725 }
726 #endif
727 
728 int thread_state_suspend(uint32_t flags, uint32_t cpsr, vaddr_t pc)
729 {
730 	struct thread_core_local *l = thread_get_core_local();
731 	int ct = l->curr_thread;
732 
733 	assert(ct != -1);
734 
735 	thread_check_canaries();
736 
737 	release_unused_kernel_stack(threads + ct, cpsr);
738 
739 	if (is_from_user(cpsr)) {
740 		thread_user_save_vfp();
741 		tee_ta_update_session_utime_suspend();
742 		tee_ta_gprof_sample_pc(pc);
743 	}
744 	thread_lazy_restore_ns_vfp();
745 
746 	lock_global();
747 
748 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
749 	threads[ct].flags |= flags;
750 	threads[ct].regs.cpsr = cpsr;
751 	threads[ct].regs.pc = pc;
752 	threads[ct].state = THREAD_STATE_SUSPENDED;
753 
754 	threads[ct].have_user_map = core_mmu_user_mapping_is_active();
755 	if (threads[ct].have_user_map) {
756 		core_mmu_get_user_map(&threads[ct].user_map);
757 		core_mmu_set_user_map(NULL);
758 	}
759 
760 	l->curr_thread = -1;
761 
762 	unlock_global();
763 
764 	return ct;
765 }
766 
767 #ifdef ARM32
768 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
769 {
770 	l->tmp_stack_va_end = sp;
771 	thread_set_irq_sp(sp);
772 	thread_set_fiq_sp(sp);
773 }
774 
775 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
776 {
777 	l->abt_stack_va_end = sp;
778 	thread_set_abt_sp((vaddr_t)l);
779 	thread_set_und_sp((vaddr_t)l);
780 }
781 #endif /*ARM32*/
782 
783 #ifdef ARM64
784 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
785 {
786 	/*
787 	 * We're already using the tmp stack when this function is called
788 	 * so there's no need to assign it to any stack pointer. However,
789 	 * we'll need to restore it at different times so store it here.
790 	 */
791 	l->tmp_stack_va_end = sp;
792 }
793 
794 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
795 {
796 	l->abt_stack_va_end = sp;
797 }
798 #endif /*ARM64*/
799 
800 bool thread_init_stack(uint32_t thread_id, vaddr_t sp)
801 {
802 	if (thread_id >= CFG_NUM_THREADS)
803 		return false;
804 	threads[thread_id].stack_va_end = sp;
805 	return true;
806 }
807 
808 int thread_get_id_may_fail(void)
809 {
810 	/*
811 	 * thread_get_core_local() requires foreign interrupts to be disabled
812 	 */
813 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
814 	struct thread_core_local *l = thread_get_core_local();
815 	int ct = l->curr_thread;
816 
817 	thread_unmask_exceptions(exceptions);
818 	return ct;
819 }
820 
821 int thread_get_id(void)
822 {
823 	int ct = thread_get_id_may_fail();
824 
825 	assert(ct >= 0 && ct < CFG_NUM_THREADS);
826 	return ct;
827 }
828 
829 static void init_handlers(const struct thread_handlers *handlers)
830 {
831 	thread_std_smc_handler_ptr = handlers->std_smc;
832 	thread_fast_smc_handler_ptr = handlers->fast_smc;
833 	thread_nintr_handler_ptr = handlers->nintr;
834 	thread_cpu_on_handler_ptr = handlers->cpu_on;
835 	thread_cpu_off_handler_ptr = handlers->cpu_off;
836 	thread_cpu_suspend_handler_ptr = handlers->cpu_suspend;
837 	thread_cpu_resume_handler_ptr = handlers->cpu_resume;
838 	thread_system_off_handler_ptr = handlers->system_off;
839 	thread_system_reset_handler_ptr = handlers->system_reset;
840 }
841 
842 #ifdef CFG_WITH_PAGER
843 static void init_thread_stacks(void)
844 {
845 	size_t n;
846 
847 	/*
848 	 * Allocate virtual memory for thread stacks.
849 	 */
850 	for (n = 0; n < CFG_NUM_THREADS; n++) {
851 		tee_mm_entry_t *mm;
852 		vaddr_t sp;
853 
854 		/* Find vmem for thread stack and its protection gap */
855 		mm = tee_mm_alloc(&tee_mm_vcore,
856 				  SMALL_PAGE_SIZE + STACK_THREAD_SIZE);
857 		assert(mm);
858 
859 		/* Claim eventual physical page */
860 		tee_pager_add_pages(tee_mm_get_smem(mm), tee_mm_get_size(mm),
861 				    true);
862 
863 		/* Add the area to the pager */
864 		tee_pager_add_core_area(tee_mm_get_smem(mm) + SMALL_PAGE_SIZE,
865 					tee_mm_get_bytes(mm) - SMALL_PAGE_SIZE,
866 					TEE_MATTR_PRW | TEE_MATTR_LOCKED,
867 					NULL, NULL);
868 
869 		/* init effective stack */
870 		sp = tee_mm_get_smem(mm) + tee_mm_get_bytes(mm);
871 		asan_tag_access((void *)tee_mm_get_smem(mm), (void *)sp);
872 		if (!thread_init_stack(n, sp))
873 			panic("init stack failed");
874 	}
875 }
876 #else
877 static void init_thread_stacks(void)
878 {
879 	size_t n;
880 
881 	/* Assign the thread stacks */
882 	for (n = 0; n < CFG_NUM_THREADS; n++) {
883 		if (!thread_init_stack(n, GET_STACK(stack_thread[n])))
884 			panic("thread_init_stack failed");
885 	}
886 }
887 #endif /*CFG_WITH_PAGER*/
888 
889 static void init_user_kcode(void)
890 {
891 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
892 	vaddr_t v = (vaddr_t)thread_excp_vect;
893 	vaddr_t ve = (vaddr_t)thread_excp_vect_end;
894 
895 	thread_user_kcode_va = ROUNDDOWN(v, CORE_MMU_USER_CODE_SIZE);
896 	ve = ROUNDUP(ve, CORE_MMU_USER_CODE_SIZE);
897 	thread_user_kcode_size = ve - thread_user_kcode_va;
898 
899 	core_mmu_get_user_va_range(&v, NULL);
900 	thread_user_kcode_offset = thread_user_kcode_va - v;
901 
902 #if defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
903 	/*
904 	 * When transitioning to EL0 subtract SP with this much to point to
905 	 * this special kdata page instead. SP is restored by add this much
906 	 * while transitioning back to EL1.
907 	 */
908 	v += thread_user_kcode_size;
909 	thread_user_kdata_sp_offset = (vaddr_t)thread_core_local - v;
910 #endif
911 #endif /*CFG_CORE_UNMAP_CORE_AT_EL0*/
912 }
913 
914 void thread_init_primary(const struct thread_handlers *handlers)
915 {
916 	init_handlers(handlers);
917 
918 	/* Initialize canaries around the stacks */
919 	init_canaries();
920 
921 	init_thread_stacks();
922 	pgt_init();
923 
924 	init_user_kcode();
925 }
926 
927 static void init_sec_mon(size_t pos __maybe_unused)
928 {
929 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
930 	/* Initialize secure monitor */
931 	sm_init(GET_STACK(stack_tmp[pos]));
932 #endif
933 }
934 
935 static uint32_t __maybe_unused get_midr_implementer(uint32_t midr)
936 {
937 	return (midr >> MIDR_IMPLEMENTER_SHIFT) & MIDR_IMPLEMENTER_MASK;
938 }
939 
940 static uint32_t __maybe_unused get_midr_primary_part(uint32_t midr)
941 {
942 	return (midr >> MIDR_PRIMARY_PART_NUM_SHIFT) &
943 	       MIDR_PRIMARY_PART_NUM_MASK;
944 }
945 
946 #ifdef ARM64
947 static bool probe_workaround_available(void)
948 {
949 	int32_t r;
950 
951 	r = thread_smc(SMCCC_VERSION, 0, 0, 0);
952 	if (r < 0)
953 		return false;
954 	if (r < 0x10001)	/* compare with version 1.1 */
955 		return false;
956 
957 	/* Version >= 1.1, so SMCCC_ARCH_FEATURES is available */
958 	r = thread_smc(SMCCC_ARCH_FEATURES, SMCCC_ARCH_WORKAROUND_1, 0, 0);
959 	return r >= 0;
960 }
961 
962 static vaddr_t __maybe_unused select_vector(vaddr_t a)
963 {
964 	if (probe_workaround_available()) {
965 		DMSG("SMCCC_ARCH_WORKAROUND_1 (%#08" PRIx32 ") available",
966 		     SMCCC_ARCH_WORKAROUND_1);
967 		DMSG("SMC Workaround for CVE-2017-5715 used");
968 		return a;
969 	}
970 
971 	DMSG("SMCCC_ARCH_WORKAROUND_1 (%#08" PRIx32 ") unavailable",
972 	     SMCCC_ARCH_WORKAROUND_1);
973 	DMSG("SMC Workaround for CVE-2017-5715 not needed (if ARM-TF is up to date)");
974 	return (vaddr_t)thread_excp_vect;
975 }
976 #else
977 static vaddr_t __maybe_unused select_vector(vaddr_t a)
978 {
979 	return a;
980 }
981 #endif
982 
983 static vaddr_t get_excp_vect(void)
984 {
985 #ifdef CFG_CORE_WORKAROUND_SPECTRE_BP_SEC
986 	uint32_t midr = read_midr();
987 
988 	if (get_midr_implementer(midr) != MIDR_IMPLEMENTER_ARM)
989 		return (vaddr_t)thread_excp_vect;
990 
991 	switch (get_midr_primary_part(midr)) {
992 #ifdef ARM32
993 	case CORTEX_A8_PART_NUM:
994 	case CORTEX_A9_PART_NUM:
995 	case CORTEX_A17_PART_NUM:
996 #endif
997 	case CORTEX_A57_PART_NUM:
998 	case CORTEX_A72_PART_NUM:
999 	case CORTEX_A73_PART_NUM:
1000 	case CORTEX_A75_PART_NUM:
1001 		return select_vector((vaddr_t)thread_excp_vect_workaround);
1002 #ifdef ARM32
1003 	case CORTEX_A15_PART_NUM:
1004 		return select_vector((vaddr_t)thread_excp_vect_workaround_a15);
1005 #endif
1006 	default:
1007 		return (vaddr_t)thread_excp_vect;
1008 	}
1009 #endif /*CFG_CORE_WORKAROUND_SPECTRE_BP_SEC*/
1010 
1011 	return (vaddr_t)thread_excp_vect;
1012 }
1013 
1014 void thread_init_per_cpu(void)
1015 {
1016 	size_t pos = get_core_pos();
1017 	struct thread_core_local *l = thread_get_core_local();
1018 
1019 	init_sec_mon(pos);
1020 
1021 	set_tmp_stack(l, GET_STACK(stack_tmp[pos]) - STACK_TMP_OFFS);
1022 	set_abt_stack(l, GET_STACK(stack_abt[pos]));
1023 
1024 	thread_init_vbar(get_excp_vect());
1025 }
1026 
1027 struct thread_specific_data *thread_get_tsd(void)
1028 {
1029 	return &threads[thread_get_id()].tsd;
1030 }
1031 
1032 struct thread_ctx_regs *thread_get_ctx_regs(void)
1033 {
1034 	struct thread_core_local *l = thread_get_core_local();
1035 
1036 	assert(l->curr_thread != -1);
1037 	return &threads[l->curr_thread].regs;
1038 }
1039 
1040 void thread_set_foreign_intr(bool enable)
1041 {
1042 	/* thread_get_core_local() requires foreign interrupts to be disabled */
1043 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1044 	struct thread_core_local *l;
1045 
1046 	l = thread_get_core_local();
1047 
1048 	assert(l->curr_thread != -1);
1049 
1050 	if (enable) {
1051 		threads[l->curr_thread].flags |=
1052 					THREAD_FLAGS_FOREIGN_INTR_ENABLE;
1053 		thread_set_exceptions(exceptions & ~THREAD_EXCP_FOREIGN_INTR);
1054 	} else {
1055 		/*
1056 		 * No need to disable foreign interrupts here since they're
1057 		 * already disabled above.
1058 		 */
1059 		threads[l->curr_thread].flags &=
1060 					~THREAD_FLAGS_FOREIGN_INTR_ENABLE;
1061 	}
1062 }
1063 
1064 void thread_restore_foreign_intr(void)
1065 {
1066 	/* thread_get_core_local() requires foreign interrupts to be disabled */
1067 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1068 	struct thread_core_local *l;
1069 
1070 	l = thread_get_core_local();
1071 
1072 	assert(l->curr_thread != -1);
1073 
1074 	if (threads[l->curr_thread].flags & THREAD_FLAGS_FOREIGN_INTR_ENABLE)
1075 		thread_set_exceptions(exceptions & ~THREAD_EXCP_FOREIGN_INTR);
1076 }
1077 
1078 #ifdef CFG_WITH_VFP
1079 uint32_t thread_kernel_enable_vfp(void)
1080 {
1081 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1082 	struct thread_ctx *thr = threads + thread_get_id();
1083 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1084 
1085 	assert(!vfp_is_enabled());
1086 
1087 	if (!thr->vfp_state.ns_saved) {
1088 		vfp_lazy_save_state_final(&thr->vfp_state.ns,
1089 					  true /*force_save*/);
1090 		thr->vfp_state.ns_saved = true;
1091 	} else if (thr->vfp_state.sec_lazy_saved &&
1092 		   !thr->vfp_state.sec_saved) {
1093 		/*
1094 		 * This happens when we're handling an abort while the
1095 		 * thread was using the VFP state.
1096 		 */
1097 		vfp_lazy_save_state_final(&thr->vfp_state.sec,
1098 					  false /*!force_save*/);
1099 		thr->vfp_state.sec_saved = true;
1100 	} else if (tuv && tuv->lazy_saved && !tuv->saved) {
1101 		/*
1102 		 * This can happen either during syscall or abort
1103 		 * processing (while processing a syscall).
1104 		 */
1105 		vfp_lazy_save_state_final(&tuv->vfp, false /*!force_save*/);
1106 		tuv->saved = true;
1107 	}
1108 
1109 	vfp_enable();
1110 	return exceptions;
1111 }
1112 
1113 void thread_kernel_disable_vfp(uint32_t state)
1114 {
1115 	uint32_t exceptions;
1116 
1117 	assert(vfp_is_enabled());
1118 
1119 	vfp_disable();
1120 	exceptions = thread_get_exceptions();
1121 	assert(exceptions & THREAD_EXCP_FOREIGN_INTR);
1122 	exceptions &= ~THREAD_EXCP_FOREIGN_INTR;
1123 	exceptions |= state & THREAD_EXCP_FOREIGN_INTR;
1124 	thread_set_exceptions(exceptions);
1125 }
1126 
1127 void thread_kernel_save_vfp(void)
1128 {
1129 	struct thread_ctx *thr = threads + thread_get_id();
1130 
1131 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1132 	if (vfp_is_enabled()) {
1133 		vfp_lazy_save_state_init(&thr->vfp_state.sec);
1134 		thr->vfp_state.sec_lazy_saved = true;
1135 	}
1136 }
1137 
1138 void thread_kernel_restore_vfp(void)
1139 {
1140 	struct thread_ctx *thr = threads + thread_get_id();
1141 
1142 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1143 	assert(!vfp_is_enabled());
1144 	if (thr->vfp_state.sec_lazy_saved) {
1145 		vfp_lazy_restore_state(&thr->vfp_state.sec,
1146 				       thr->vfp_state.sec_saved);
1147 		thr->vfp_state.sec_saved = false;
1148 		thr->vfp_state.sec_lazy_saved = false;
1149 	}
1150 }
1151 
1152 void thread_user_enable_vfp(struct thread_user_vfp_state *uvfp)
1153 {
1154 	struct thread_ctx *thr = threads + thread_get_id();
1155 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1156 
1157 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1158 	assert(!vfp_is_enabled());
1159 
1160 	if (!thr->vfp_state.ns_saved) {
1161 		vfp_lazy_save_state_final(&thr->vfp_state.ns,
1162 					  true /*force_save*/);
1163 		thr->vfp_state.ns_saved = true;
1164 	} else if (tuv && uvfp != tuv) {
1165 		if (tuv->lazy_saved && !tuv->saved) {
1166 			vfp_lazy_save_state_final(&tuv->vfp,
1167 						  false /*!force_save*/);
1168 			tuv->saved = true;
1169 		}
1170 	}
1171 
1172 	if (uvfp->lazy_saved)
1173 		vfp_lazy_restore_state(&uvfp->vfp, uvfp->saved);
1174 	uvfp->lazy_saved = false;
1175 	uvfp->saved = false;
1176 
1177 	thr->vfp_state.uvfp = uvfp;
1178 	vfp_enable();
1179 }
1180 
1181 void thread_user_save_vfp(void)
1182 {
1183 	struct thread_ctx *thr = threads + thread_get_id();
1184 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1185 
1186 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1187 	if (!vfp_is_enabled())
1188 		return;
1189 
1190 	assert(tuv && !tuv->lazy_saved && !tuv->saved);
1191 	vfp_lazy_save_state_init(&tuv->vfp);
1192 	tuv->lazy_saved = true;
1193 }
1194 
1195 void thread_user_clear_vfp(struct thread_user_vfp_state *uvfp)
1196 {
1197 	struct thread_ctx *thr = threads + thread_get_id();
1198 
1199 	if (uvfp == thr->vfp_state.uvfp)
1200 		thr->vfp_state.uvfp = NULL;
1201 	uvfp->lazy_saved = false;
1202 	uvfp->saved = false;
1203 }
1204 #endif /*CFG_WITH_VFP*/
1205 
1206 #ifdef ARM32
1207 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1208 {
1209 	uint32_t s;
1210 
1211 	if (!is_32bit)
1212 		return false;
1213 
1214 	s = read_spsr();
1215 	s &= ~(CPSR_MODE_MASK | CPSR_T | CPSR_IT_MASK1 | CPSR_IT_MASK2);
1216 	s |= CPSR_MODE_USR;
1217 	if (entry_func & 1)
1218 		s |= CPSR_T;
1219 	*spsr = s;
1220 	return true;
1221 }
1222 #endif
1223 
1224 #ifdef ARM64
1225 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1226 {
1227 	uint32_t s;
1228 
1229 	if (is_32bit) {
1230 		s = read_daif() & (SPSR_32_AIF_MASK << SPSR_32_AIF_SHIFT);
1231 		s |= SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT;
1232 		s |= (entry_func & SPSR_32_T_MASK) << SPSR_32_T_SHIFT;
1233 	} else {
1234 		s = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
1235 	}
1236 
1237 	*spsr = s;
1238 	return true;
1239 }
1240 #endif
1241 
1242 uint32_t thread_enter_user_mode(unsigned long a0, unsigned long a1,
1243 		unsigned long a2, unsigned long a3, unsigned long user_sp,
1244 		unsigned long entry_func, bool is_32bit,
1245 		uint32_t *exit_status0, uint32_t *exit_status1)
1246 {
1247 	uint32_t spsr;
1248 
1249 	tee_ta_update_session_utime_resume();
1250 
1251 	if (!get_spsr(is_32bit, entry_func, &spsr)) {
1252 		*exit_status0 = 1; /* panic */
1253 		*exit_status1 = 0xbadbadba;
1254 		return 0;
1255 	}
1256 	return __thread_enter_user_mode(a0, a1, a2, a3, user_sp, entry_func,
1257 					spsr, exit_status0, exit_status1);
1258 }
1259 
1260 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
1261 void thread_get_user_kcode(struct mobj **mobj, size_t *offset,
1262 			   vaddr_t *va, size_t *sz)
1263 {
1264 	core_mmu_get_user_va_range(va, NULL);
1265 	*mobj = mobj_tee_ram;
1266 	*offset = thread_user_kcode_va - TEE_RAM_START;
1267 	*sz = thread_user_kcode_size;
1268 }
1269 #endif
1270 
1271 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
1272 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
1273 void thread_get_user_kdata(struct mobj **mobj, size_t *offset,
1274 			   vaddr_t *va, size_t *sz)
1275 {
1276 	vaddr_t v;
1277 
1278 	core_mmu_get_user_va_range(&v, NULL);
1279 	*va = v + thread_user_kcode_size;
1280 	*mobj = mobj_tee_ram;
1281 	*offset = (vaddr_t)thread_user_kdata_page - TEE_RAM_START;
1282 	*sz = sizeof(thread_user_kdata_page);
1283 }
1284 #endif
1285 
1286 bool thread_disable_prealloc_rpc_cache(uint64_t *cookie)
1287 {
1288 	bool rv;
1289 	size_t n;
1290 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1291 
1292 	lock_global();
1293 
1294 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1295 		if (threads[n].state != THREAD_STATE_FREE) {
1296 			rv = false;
1297 			goto out;
1298 		}
1299 	}
1300 
1301 	rv = true;
1302 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1303 		if (threads[n].rpc_arg) {
1304 			*cookie = mobj_get_cookie(threads[n].rpc_mobj);
1305 			mobj_free(threads[n].rpc_mobj);
1306 			threads[n].rpc_arg = NULL;
1307 			goto out;
1308 		}
1309 	}
1310 
1311 	*cookie = 0;
1312 	thread_prealloc_rpc_cache = false;
1313 out:
1314 	unlock_global();
1315 	thread_unmask_exceptions(exceptions);
1316 	return rv;
1317 }
1318 
1319 bool thread_enable_prealloc_rpc_cache(void)
1320 {
1321 	bool rv;
1322 	size_t n;
1323 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1324 
1325 	lock_global();
1326 
1327 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1328 		if (threads[n].state != THREAD_STATE_FREE) {
1329 			rv = false;
1330 			goto out;
1331 		}
1332 	}
1333 
1334 	rv = true;
1335 	thread_prealloc_rpc_cache = true;
1336 out:
1337 	unlock_global();
1338 	thread_unmask_exceptions(exceptions);
1339 	return rv;
1340 }
1341 
1342 /**
1343  * Allocates data for struct optee_msg_arg.
1344  *
1345  * @size:	size in bytes of struct optee_msg_arg
1346  *
1347  * @returns	mobj that describes allocated buffer or NULL on error
1348  */
1349 static struct mobj *thread_rpc_alloc_arg(size_t size)
1350 {
1351 	paddr_t pa;
1352 	uint64_t co;
1353 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1354 		OPTEE_SMC_RETURN_RPC_ALLOC, size
1355 	};
1356 	struct mobj *mobj = NULL;
1357 
1358 	thread_rpc(rpc_args);
1359 
1360 	pa = reg_pair_to_64(rpc_args[1], rpc_args[2]);
1361 	co = reg_pair_to_64(rpc_args[4], rpc_args[5]);
1362 
1363 	if (!ALIGNMENT_IS_OK(pa, struct optee_msg_arg))
1364 		goto err;
1365 
1366 	/* Check if this region is in static shared space */
1367 	if (core_pbuf_is(CORE_MEM_NSEC_SHM, pa, size))
1368 		mobj = mobj_shm_alloc(pa, size, co);
1369 	else if ((!(pa & SMALL_PAGE_MASK)) && size <= SMALL_PAGE_SIZE)
1370 		mobj = mobj_mapped_shm_alloc(&pa, 1, 0, co);
1371 
1372 	if (!mobj)
1373 		goto err;
1374 
1375 	return mobj;
1376 err:
1377 	thread_rpc_free_arg(co);
1378 	mobj_free(mobj);
1379 	return NULL;
1380 }
1381 
1382 static bool set_rmem(struct optee_msg_param *param,
1383 		     struct thread_param *tpm)
1384 {
1385 	param->attr = tpm->attr - THREAD_PARAM_ATTR_MEMREF_IN +
1386 		      OPTEE_MSG_ATTR_TYPE_RMEM_INPUT;
1387 	param->u.rmem.offs = tpm->u.memref.offs;
1388 	param->u.rmem.size = tpm->u.memref.size;
1389 	if (tpm->u.memref.mobj) {
1390 		param->u.rmem.shm_ref = mobj_get_cookie(tpm->u.memref.mobj);
1391 		if (!param->u.rmem.shm_ref)
1392 			return false;
1393 	} else {
1394 		param->u.rmem.shm_ref = 0;
1395 	}
1396 
1397 	return true;
1398 }
1399 
1400 static bool set_tmem(struct optee_msg_param *param,
1401 		     struct thread_param *tpm)
1402 {
1403 	paddr_t pa = 0;
1404 	uint64_t shm_ref = 0;
1405 	struct mobj *mobj = tpm->u.memref.mobj;
1406 
1407 	param->attr = tpm->attr - THREAD_PARAM_ATTR_MEMREF_IN +
1408 		      OPTEE_MSG_ATTR_TYPE_TMEM_INPUT;
1409 	if (mobj) {
1410 		shm_ref = mobj_get_cookie(mobj);
1411 		if (!shm_ref)
1412 			return false;
1413 		if (mobj_get_pa(mobj, tpm->u.memref.offs, 0, &pa))
1414 			return false;
1415 	}
1416 
1417 	param->u.tmem.size = tpm->u.memref.size;
1418 	param->u.tmem.buf_ptr = pa;
1419 	param->u.tmem.shm_ref = shm_ref;
1420 
1421 	return true;
1422 }
1423 
1424 static uint32_t get_rpc_arg(uint32_t cmd, size_t num_params,
1425 			    struct thread_param *params, void **arg_ret,
1426 			    uint64_t *carg_ret)
1427 {
1428 	struct thread_ctx *thr = threads + thread_get_id();
1429 	struct optee_msg_arg *arg = thr->rpc_arg;
1430 	size_t sz = OPTEE_MSG_GET_ARG_SIZE(THREAD_RPC_MAX_NUM_PARAMS);
1431 
1432 	if (num_params > THREAD_RPC_MAX_NUM_PARAMS)
1433 		return TEE_ERROR_BAD_PARAMETERS;
1434 
1435 	if (!arg) {
1436 		struct mobj *mobj = thread_rpc_alloc_arg(sz);
1437 
1438 		if (!mobj)
1439 			return TEE_ERROR_OUT_OF_MEMORY;
1440 
1441 		arg = mobj_get_va(mobj, 0);
1442 		if (!arg) {
1443 			thread_rpc_free_arg(mobj_get_cookie(mobj));
1444 			return TEE_ERROR_OUT_OF_MEMORY;
1445 		}
1446 
1447 		thr->rpc_arg = arg;
1448 		thr->rpc_mobj = mobj;
1449 	}
1450 
1451 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
1452 	arg->cmd = cmd;
1453 	arg->num_params = num_params;
1454 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1455 
1456 	for (size_t n = 0; n < num_params; n++) {
1457 		switch (params[n].attr) {
1458 		case THREAD_PARAM_ATTR_NONE:
1459 			arg->params[n].attr = OPTEE_MSG_ATTR_TYPE_NONE;
1460 			break;
1461 		case THREAD_PARAM_ATTR_VALUE_IN:
1462 		case THREAD_PARAM_ATTR_VALUE_OUT:
1463 		case THREAD_PARAM_ATTR_VALUE_INOUT:
1464 			arg->params[n].attr = params[n].attr -
1465 					      THREAD_PARAM_ATTR_VALUE_IN +
1466 					      OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1467 			arg->params[n].u.value.a = params[n].u.value.a;
1468 			arg->params[n].u.value.b = params[n].u.value.b;
1469 			arg->params[n].u.value.c = params[n].u.value.c;
1470 			break;
1471 		case THREAD_PARAM_ATTR_MEMREF_IN:
1472 		case THREAD_PARAM_ATTR_MEMREF_OUT:
1473 		case THREAD_PARAM_ATTR_MEMREF_INOUT:
1474 			if (!params[n].u.memref.mobj ||
1475 			    mobj_matches(params[n].u.memref.mobj,
1476 					 CORE_MEM_NSEC_SHM)) {
1477 				if (!set_tmem(arg->params + n, params + n))
1478 					return TEE_ERROR_BAD_PARAMETERS;
1479 			} else  if (mobj_matches(params[n].u.memref.mobj,
1480 						 CORE_MEM_REG_SHM)) {
1481 				if (!set_rmem(arg->params + n, params + n))
1482 					return TEE_ERROR_BAD_PARAMETERS;
1483 			} else {
1484 				return TEE_ERROR_BAD_PARAMETERS;
1485 			}
1486 			break;
1487 		default:
1488 			return TEE_ERROR_BAD_PARAMETERS;
1489 		}
1490 	}
1491 
1492 	*arg_ret = arg;
1493 	*carg_ret = mobj_get_cookie(thr->rpc_mobj);
1494 
1495 	return TEE_SUCCESS;
1496 }
1497 
1498 static uint32_t get_rpc_arg_res(struct optee_msg_arg *arg, size_t num_params,
1499 				struct thread_param *params)
1500 {
1501 	for (size_t n = 0; n < num_params; n++) {
1502 		switch (params[n].attr) {
1503 		case THREAD_PARAM_ATTR_VALUE_OUT:
1504 		case THREAD_PARAM_ATTR_VALUE_INOUT:
1505 			params[n].u.value.a = arg->params[n].u.value.a;
1506 			params[n].u.value.b = arg->params[n].u.value.b;
1507 			params[n].u.value.c = arg->params[n].u.value.c;
1508 			break;
1509 		case THREAD_PARAM_ATTR_MEMREF_OUT:
1510 		case THREAD_PARAM_ATTR_MEMREF_INOUT:
1511 			/*
1512 			 * rmem.size and tmem.size is the same type and
1513 			 * location.
1514 			 */
1515 			params[n].u.memref.size = arg->params[n].u.rmem.size;
1516 			break;
1517 		default:
1518 			break;
1519 		}
1520 	}
1521 
1522 	return arg->ret;
1523 }
1524 
1525 uint32_t thread_rpc_cmd(uint32_t cmd, size_t num_params,
1526 			struct thread_param *params)
1527 {
1528 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1529 	void *arg = NULL;
1530 	uint64_t carg = 0;
1531 	uint32_t ret = 0;
1532 
1533 	/* The source CRYPTO_RNG_SRC_JITTER_RPC is safe to use here */
1534 	plat_prng_add_jitter_entropy(CRYPTO_RNG_SRC_JITTER_RPC,
1535 				     &thread_rpc_pnum);
1536 
1537 	ret = get_rpc_arg(cmd, num_params, params, &arg, &carg);
1538 	if (ret)
1539 		return ret;
1540 
1541 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1542 	thread_rpc(rpc_args);
1543 
1544 	return get_rpc_arg_res(arg, num_params, params);
1545 }
1546 
1547 /**
1548  * Free physical memory previously allocated with thread_rpc_alloc()
1549  *
1550  * @cookie:	cookie received when allocating the buffer
1551  * @bt:		must be the same as supplied when allocating
1552  * @mobj:	mobj that describes allocated buffer
1553  *
1554  * This function also frees corresponding mobj.
1555  */
1556 static void thread_rpc_free(unsigned int bt, uint64_t cookie, struct mobj *mobj)
1557 {
1558 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1559 	void *arg = NULL;
1560 	uint64_t carg = 0;
1561 	struct thread_param param = THREAD_PARAM_VALUE(IN, bt, cookie, 0);
1562 	uint32_t ret = get_rpc_arg(OPTEE_RPC_CMD_SHM_FREE, 1, &param,
1563 				   &arg, &carg);
1564 
1565 	mobj_free(mobj);
1566 
1567 	if (!ret) {
1568 		reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1569 		thread_rpc(rpc_args);
1570 	}
1571 }
1572 
1573 static struct mobj *get_rpc_alloc_res(struct optee_msg_arg *arg,
1574 				      unsigned int bt)
1575 {
1576 	struct mobj *mobj = NULL;
1577 	uint64_t cookie = 0;
1578 
1579 	if (arg->ret || arg->num_params != 1)
1580 		return NULL;
1581 
1582 	if (arg->params[0].attr == OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT) {
1583 		cookie = arg->params[0].u.tmem.shm_ref;
1584 		mobj = mobj_shm_alloc(arg->params[0].u.tmem.buf_ptr,
1585 				      arg->params[0].u.tmem.size,
1586 				      cookie);
1587 	} else if (arg->params[0].attr == (OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT |
1588 					   OPTEE_MSG_ATTR_NONCONTIG)) {
1589 		cookie = arg->params[0].u.tmem.shm_ref;
1590 		mobj = msg_param_mobj_from_noncontig(
1591 			arg->params[0].u.tmem.buf_ptr,
1592 			arg->params[0].u.tmem.size,
1593 			cookie,
1594 			true);
1595 	} else {
1596 		return NULL;
1597 	}
1598 
1599 	if (!mobj) {
1600 		thread_rpc_free(bt, cookie, mobj);
1601 		return NULL;
1602 	}
1603 
1604 	assert(mobj_is_nonsec(mobj));
1605 
1606 	return mobj;
1607 }
1608 
1609 /**
1610  * Allocates shared memory buffer via RPC
1611  *
1612  * @size:	size in bytes of shared memory buffer
1613  * @align:	required alignment of buffer
1614  * @bt:		buffer type OPTEE_RPC_SHM_TYPE_*
1615  *
1616  * Returns a pointer to MOBJ for the memory on success, or NULL on failure.
1617  */
1618 static struct mobj *thread_rpc_alloc(size_t size, size_t align, unsigned int bt)
1619 {
1620 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1621 	void *arg = NULL;
1622 	uint64_t carg = 0;
1623 	struct thread_param param = THREAD_PARAM_VALUE(IN, bt, size, align);
1624 	uint32_t ret = get_rpc_arg(OPTEE_RPC_CMD_SHM_ALLOC, 1, &param,
1625 				   &arg, &carg);
1626 
1627 	if (ret)
1628 		return NULL;
1629 
1630 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1631 	thread_rpc(rpc_args);
1632 
1633 	return get_rpc_alloc_res(arg, bt);
1634 }
1635 
1636 struct mobj *thread_rpc_alloc_payload(size_t size)
1637 {
1638 	return thread_rpc_alloc(size, 8, OPTEE_RPC_SHM_TYPE_APPL);
1639 }
1640 
1641 void thread_rpc_free_payload(struct mobj *mobj)
1642 {
1643 	thread_rpc_free(OPTEE_RPC_SHM_TYPE_APPL, mobj_get_cookie(mobj),
1644 			mobj);
1645 }
1646 
1647 struct mobj *thread_rpc_alloc_global_payload(size_t size)
1648 {
1649 	return thread_rpc_alloc(size, 8, OPTEE_RPC_SHM_TYPE_GLOBAL);
1650 }
1651 
1652 void thread_rpc_free_global_payload(struct mobj *mobj)
1653 {
1654 	thread_rpc_free(OPTEE_RPC_SHM_TYPE_GLOBAL, mobj_get_cookie(mobj),
1655 			mobj);
1656 }
1657