xref: /optee_os/core/arch/arm/kernel/thread.c (revision 5e7638a863f42f6b400e0707fcb790057916451f)
1 /*
2  * Copyright (c) 2016, Linaro Limited
3  * Copyright (c) 2014, STMicroelectronics International N.V.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright notice,
10  * this list of conditions and the following disclaimer.
11  *
12  * 2. Redistributions in binary form must reproduce the above copyright notice,
13  * this list of conditions and the following disclaimer in the documentation
14  * and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 #include <platform_config.h>
29 #include <kernel/panic.h>
30 #include <kernel/thread.h>
31 #include <kernel/thread_defs.h>
32 #include "thread_private.h"
33 #include <sm/sm_defs.h>
34 #include <sm/sm.h>
35 #include <optee_msg.h>
36 #include <sm/optee_smc.h>
37 #include <arm.h>
38 #include <kernel/tz_proc_def.h>
39 #include <kernel/tz_proc.h>
40 #include <kernel/misc.h>
41 #include <mm/tee_mmu.h>
42 #include <mm/core_memprot.h>
43 #include <mm/tee_mmu_defs.h>
44 #include <mm/tee_mm.h>
45 #include <mm/tee_pager.h>
46 #include <kernel/tee_ta_manager.h>
47 #include <util.h>
48 #include <trace.h>
49 #include <assert.h>
50 
51 #ifdef ARM32
52 #define STACK_TMP_SIZE		1024
53 #define STACK_THREAD_SIZE	8192
54 
55 #if TRACE_LEVEL > 0
56 #define STACK_ABT_SIZE		2048
57 #else
58 #define STACK_ABT_SIZE		1024
59 #endif
60 
61 #endif /*ARM32*/
62 
63 #ifdef ARM64
64 #define STACK_TMP_SIZE		2048
65 #define STACK_THREAD_SIZE	8192
66 
67 #if TRACE_LEVEL > 0
68 #define STACK_ABT_SIZE		3072
69 #else
70 #define STACK_ABT_SIZE		1024
71 #endif
72 #endif /*ARM64*/
73 
74 #define RPC_MAX_NUM_PARAMS	2
75 
76 struct thread_ctx threads[CFG_NUM_THREADS];
77 
78 static struct thread_core_local thread_core_local[CFG_TEE_CORE_NB_CORE];
79 
80 #ifdef CFG_WITH_STACK_CANARIES
81 #ifdef ARM32
82 #define STACK_CANARY_SIZE	(4 * sizeof(uint32_t))
83 #endif
84 #ifdef ARM64
85 #define STACK_CANARY_SIZE	(8 * sizeof(uint32_t))
86 #endif
87 #define START_CANARY_VALUE	0xdededede
88 #define END_CANARY_VALUE	0xabababab
89 #define GET_START_CANARY(name, stack_num) name[stack_num][0]
90 #define GET_END_CANARY(name, stack_num) \
91 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
92 #else
93 #define STACK_CANARY_SIZE	0
94 #endif
95 
96 #define DECLARE_STACK(name, num_stacks, stack_size) \
97 	static uint32_t name[num_stacks][ \
98 		ROUNDUP(stack_size + STACK_CANARY_SIZE, STACK_ALIGNMENT) / \
99 		sizeof(uint32_t)] \
100 		__attribute__((section(".nozi.stack"), \
101 			       aligned(STACK_ALIGNMENT)))
102 
103 #define GET_STACK(stack) \
104 	((vaddr_t)(stack) + sizeof(stack) - STACK_CANARY_SIZE / 2)
105 
106 DECLARE_STACK(stack_tmp,	CFG_TEE_CORE_NB_CORE,	STACK_TMP_SIZE);
107 DECLARE_STACK(stack_abt,	CFG_TEE_CORE_NB_CORE,	STACK_ABT_SIZE);
108 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
109 DECLARE_STACK(stack_sm,		CFG_TEE_CORE_NB_CORE,	SM_STACK_SIZE);
110 #endif
111 #ifndef CFG_WITH_PAGER
112 DECLARE_STACK(stack_thread,	CFG_NUM_THREADS,	STACK_THREAD_SIZE);
113 #endif
114 
115 const vaddr_t stack_tmp_top[CFG_TEE_CORE_NB_CORE] = {
116 	GET_STACK(stack_tmp[0]),
117 #if CFG_TEE_CORE_NB_CORE > 1
118 	GET_STACK(stack_tmp[1]),
119 #endif
120 #if CFG_TEE_CORE_NB_CORE > 2
121 	GET_STACK(stack_tmp[2]),
122 #endif
123 #if CFG_TEE_CORE_NB_CORE > 3
124 	GET_STACK(stack_tmp[3]),
125 #endif
126 #if CFG_TEE_CORE_NB_CORE > 4
127 	GET_STACK(stack_tmp[4]),
128 #endif
129 #if CFG_TEE_CORE_NB_CORE > 5
130 	GET_STACK(stack_tmp[5]),
131 #endif
132 #if CFG_TEE_CORE_NB_CORE > 6
133 	GET_STACK(stack_tmp[6]),
134 #endif
135 #if CFG_TEE_CORE_NB_CORE > 7
136 	GET_STACK(stack_tmp[7]),
137 #endif
138 #if CFG_TEE_CORE_NB_CORE > 8
139 #error "Top of tmp stacks aren't defined for more than 8 CPUS"
140 #endif
141 };
142 
143 thread_smc_handler_t thread_std_smc_handler_ptr;
144 static thread_smc_handler_t thread_fast_smc_handler_ptr;
145 thread_fiq_handler_t thread_fiq_handler_ptr;
146 thread_pm_handler_t thread_cpu_on_handler_ptr;
147 thread_pm_handler_t thread_cpu_off_handler_ptr;
148 thread_pm_handler_t thread_cpu_suspend_handler_ptr;
149 thread_pm_handler_t thread_cpu_resume_handler_ptr;
150 thread_pm_handler_t thread_system_off_handler_ptr;
151 thread_pm_handler_t thread_system_reset_handler_ptr;
152 
153 
154 static unsigned int thread_global_lock = SPINLOCK_UNLOCK;
155 static bool thread_prealloc_rpc_cache;
156 
157 static void init_canaries(void)
158 {
159 #ifdef CFG_WITH_STACK_CANARIES
160 	size_t n;
161 #define INIT_CANARY(name)						\
162 	for (n = 0; n < ARRAY_SIZE(name); n++) {			\
163 		uint32_t *start_canary = &GET_START_CANARY(name, n);	\
164 		uint32_t *end_canary = &GET_END_CANARY(name, n);	\
165 									\
166 		*start_canary = START_CANARY_VALUE;			\
167 		*end_canary = END_CANARY_VALUE;				\
168 		DMSG("#Stack canaries for %s[%zu] with top at %p\n",	\
169 			#name, n, (void *)(end_canary - 1));		\
170 		DMSG("watch *%p\n", (void *)end_canary);		\
171 	}
172 
173 	INIT_CANARY(stack_tmp);
174 	INIT_CANARY(stack_abt);
175 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
176 	INIT_CANARY(stack_sm);
177 #endif
178 #ifndef CFG_WITH_PAGER
179 	INIT_CANARY(stack_thread);
180 #endif
181 #endif/*CFG_WITH_STACK_CANARIES*/
182 }
183 
184 void thread_check_canaries(void)
185 {
186 #ifdef CFG_WITH_STACK_CANARIES
187 	size_t n;
188 
189 	for (n = 0; n < ARRAY_SIZE(stack_tmp); n++) {
190 		assert(GET_START_CANARY(stack_tmp, n) == START_CANARY_VALUE);
191 		assert(GET_END_CANARY(stack_tmp, n) == END_CANARY_VALUE);
192 	}
193 
194 	for (n = 0; n < ARRAY_SIZE(stack_abt); n++) {
195 		assert(GET_START_CANARY(stack_abt, n) == START_CANARY_VALUE);
196 		assert(GET_END_CANARY(stack_abt, n) == END_CANARY_VALUE);
197 	}
198 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
199 	for (n = 0; n < ARRAY_SIZE(stack_sm); n++) {
200 		assert(GET_START_CANARY(stack_sm, n) == START_CANARY_VALUE);
201 		assert(GET_END_CANARY(stack_sm, n) == END_CANARY_VALUE);
202 	}
203 #endif
204 #ifndef CFG_WITH_PAGER
205 	for (n = 0; n < ARRAY_SIZE(stack_thread); n++) {
206 		assert(GET_START_CANARY(stack_thread, n) == START_CANARY_VALUE);
207 		assert(GET_END_CANARY(stack_thread, n) == END_CANARY_VALUE);
208 	}
209 #endif
210 #endif/*CFG_WITH_STACK_CANARIES*/
211 }
212 
213 static void lock_global(void)
214 {
215 	cpu_spin_lock(&thread_global_lock);
216 }
217 
218 static void unlock_global(void)
219 {
220 	cpu_spin_unlock(&thread_global_lock);
221 }
222 
223 #ifdef ARM32
224 uint32_t thread_get_exceptions(void)
225 {
226 	uint32_t cpsr = read_cpsr();
227 
228 	return (cpsr >> CPSR_F_SHIFT) & THREAD_EXCP_ALL;
229 }
230 
231 void thread_set_exceptions(uint32_t exceptions)
232 {
233 	uint32_t cpsr = read_cpsr();
234 
235 	cpsr &= ~(THREAD_EXCP_ALL << CPSR_F_SHIFT);
236 	cpsr |= ((exceptions & THREAD_EXCP_ALL) << CPSR_F_SHIFT);
237 	write_cpsr(cpsr);
238 }
239 #endif /*ARM32*/
240 
241 #ifdef ARM64
242 uint32_t thread_get_exceptions(void)
243 {
244 	uint32_t daif = read_daif();
245 
246 	return (daif >> DAIF_F_SHIFT) & THREAD_EXCP_ALL;
247 }
248 
249 void thread_set_exceptions(uint32_t exceptions)
250 {
251 	uint32_t daif = read_daif();
252 
253 	daif &= ~(THREAD_EXCP_ALL << DAIF_F_SHIFT);
254 	daif |= ((exceptions & THREAD_EXCP_ALL) << DAIF_F_SHIFT);
255 	write_daif(daif);
256 }
257 #endif /*ARM64*/
258 
259 uint32_t thread_mask_exceptions(uint32_t exceptions)
260 {
261 	uint32_t state = thread_get_exceptions();
262 
263 	thread_set_exceptions(state | (exceptions & THREAD_EXCP_ALL));
264 	return state;
265 }
266 
267 void thread_unmask_exceptions(uint32_t state)
268 {
269 	thread_set_exceptions(state & THREAD_EXCP_ALL);
270 }
271 
272 
273 struct thread_core_local *thread_get_core_local(void)
274 {
275 	uint32_t cpu_id = get_core_pos();
276 
277 	/*
278 	 * IRQs must be disabled before playing with core_local since
279 	 * we otherwise may be rescheduled to a different core in the
280 	 * middle of this function.
281 	 */
282 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
283 
284 	assert(cpu_id < CFG_TEE_CORE_NB_CORE);
285 	return &thread_core_local[cpu_id];
286 }
287 
288 static void thread_lazy_save_ns_vfp(void)
289 {
290 #ifdef CFG_WITH_VFP
291 	struct thread_ctx *thr = threads + thread_get_id();
292 
293 	thr->vfp_state.ns_saved = false;
294 #if defined(ARM64) && defined(CFG_WITH_ARM_TRUSTED_FW)
295 	/*
296 	 * ARM TF saves and restores CPACR_EL1, so we must assume NS world
297 	 * uses VFP and always preserve the register file when secure world
298 	 * is about to use it
299 	 */
300 	thr->vfp_state.ns.force_save = true;
301 #endif
302 	vfp_lazy_save_state_init(&thr->vfp_state.ns);
303 #endif /*CFG_WITH_VFP*/
304 }
305 
306 static void thread_lazy_restore_ns_vfp(void)
307 {
308 #ifdef CFG_WITH_VFP
309 	struct thread_ctx *thr = threads + thread_get_id();
310 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
311 
312 	assert(!thr->vfp_state.sec_lazy_saved && !thr->vfp_state.sec_saved);
313 
314 	if (tuv && tuv->lazy_saved && !tuv->saved) {
315 		vfp_lazy_save_state_final(&tuv->vfp);
316 		tuv->saved = true;
317 	}
318 
319 	vfp_lazy_restore_state(&thr->vfp_state.ns, thr->vfp_state.ns_saved);
320 	thr->vfp_state.ns_saved = false;
321 #endif /*CFG_WITH_VFP*/
322 }
323 
324 #ifdef ARM32
325 static void init_regs(struct thread_ctx *thread,
326 		struct thread_smc_args *args)
327 {
328 	thread->regs.pc = (uint32_t)thread_std_smc_entry;
329 
330 	/*
331 	 * Stdcalls starts in SVC mode with masked IRQ, masked Asynchronous
332 	 * abort and unmasked FIQ.
333 	  */
334 	thread->regs.cpsr = read_cpsr() & ARM32_CPSR_E;
335 	thread->regs.cpsr |= CPSR_MODE_SVC | CPSR_I | CPSR_A;
336 	/* Enable thumb mode if it's a thumb instruction */
337 	if (thread->regs.pc & 1)
338 		thread->regs.cpsr |= CPSR_T;
339 	/* Reinitialize stack pointer */
340 	thread->regs.svc_sp = thread->stack_va_end;
341 
342 	/*
343 	 * Copy arguments into context. This will make the
344 	 * arguments appear in r0-r7 when thread is started.
345 	 */
346 	thread->regs.r0 = args->a0;
347 	thread->regs.r1 = args->a1;
348 	thread->regs.r2 = args->a2;
349 	thread->regs.r3 = args->a3;
350 	thread->regs.r4 = args->a4;
351 	thread->regs.r5 = args->a5;
352 	thread->regs.r6 = args->a6;
353 	thread->regs.r7 = args->a7;
354 }
355 #endif /*ARM32*/
356 
357 #ifdef ARM64
358 static void init_regs(struct thread_ctx *thread,
359 		struct thread_smc_args *args)
360 {
361 	thread->regs.pc = (uint64_t)thread_std_smc_entry;
362 
363 	/*
364 	 * Stdcalls starts in SVC mode with masked IRQ, masked Asynchronous
365 	 * abort and unmasked FIQ.
366 	  */
367 	thread->regs.cpsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0,
368 				    DAIFBIT_IRQ | DAIFBIT_ABT);
369 	/* Reinitialize stack pointer */
370 	thread->regs.sp = thread->stack_va_end;
371 
372 	/*
373 	 * Copy arguments into context. This will make the
374 	 * arguments appear in x0-x7 when thread is started.
375 	 */
376 	thread->regs.x[0] = args->a0;
377 	thread->regs.x[1] = args->a1;
378 	thread->regs.x[2] = args->a2;
379 	thread->regs.x[3] = args->a3;
380 	thread->regs.x[4] = args->a4;
381 	thread->regs.x[5] = args->a5;
382 	thread->regs.x[6] = args->a6;
383 	thread->regs.x[7] = args->a7;
384 }
385 #endif /*ARM64*/
386 
387 void thread_init_boot_thread(void)
388 {
389 	struct thread_core_local *l = thread_get_core_local();
390 	size_t n;
391 
392 	for (n = 0; n < CFG_NUM_THREADS; n++) {
393 		TAILQ_INIT(&threads[n].mutexes);
394 		TAILQ_INIT(&threads[n].tsd.sess_stack);
395 #ifdef CFG_SMALL_PAGE_USER_TA
396 		SLIST_INIT(&threads[n].tsd.pgt_cache);
397 #endif
398 	}
399 
400 	for (n = 0; n < CFG_TEE_CORE_NB_CORE; n++)
401 		thread_core_local[n].curr_thread = -1;
402 
403 	l->curr_thread = 0;
404 	threads[0].state = THREAD_STATE_ACTIVE;
405 }
406 
407 void thread_clr_boot_thread(void)
408 {
409 	struct thread_core_local *l = thread_get_core_local();
410 
411 	assert(l->curr_thread >= 0 && l->curr_thread < CFG_NUM_THREADS);
412 	assert(threads[l->curr_thread].state == THREAD_STATE_ACTIVE);
413 	assert(TAILQ_EMPTY(&threads[l->curr_thread].mutexes));
414 	threads[l->curr_thread].state = THREAD_STATE_FREE;
415 	l->curr_thread = -1;
416 }
417 
418 static void thread_alloc_and_run(struct thread_smc_args *args)
419 {
420 	size_t n;
421 	struct thread_core_local *l = thread_get_core_local();
422 	bool found_thread = false;
423 
424 	assert(l->curr_thread == -1);
425 
426 	lock_global();
427 
428 	for (n = 0; n < CFG_NUM_THREADS; n++) {
429 		if (threads[n].state == THREAD_STATE_FREE) {
430 			threads[n].state = THREAD_STATE_ACTIVE;
431 			found_thread = true;
432 			break;
433 		}
434 	}
435 
436 	unlock_global();
437 
438 	if (!found_thread) {
439 		args->a0 = OPTEE_SMC_RETURN_ETHREAD_LIMIT;
440 		return;
441 	}
442 
443 	l->curr_thread = n;
444 
445 	threads[n].flags = 0;
446 	init_regs(threads + n, args);
447 
448 	/* Save Hypervisor Client ID */
449 	threads[n].hyp_clnt_id = args->a7;
450 
451 	thread_lazy_save_ns_vfp();
452 	thread_resume(&threads[n].regs);
453 }
454 
455 #ifdef ARM32
456 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
457 		struct thread_smc_args *args)
458 {
459 	/*
460 	 * Update returned values from RPC, values will appear in
461 	 * r0-r3 when thread is resumed.
462 	 */
463 	regs->r0 = args->a0;
464 	regs->r1 = args->a1;
465 	regs->r2 = args->a2;
466 	regs->r3 = args->a3;
467 	regs->r4 = args->a4;
468 	regs->r5 = args->a5;
469 }
470 #endif /*ARM32*/
471 
472 #ifdef ARM64
473 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
474 		struct thread_smc_args *args)
475 {
476 	/*
477 	 * Update returned values from RPC, values will appear in
478 	 * x0-x3 when thread is resumed.
479 	 */
480 	regs->x[0] = args->a0;
481 	regs->x[1] = args->a1;
482 	regs->x[2] = args->a2;
483 	regs->x[3] = args->a3;
484 	regs->x[4] = args->a4;
485 	regs->x[5] = args->a5;
486 }
487 #endif /*ARM64*/
488 
489 static void thread_resume_from_rpc(struct thread_smc_args *args)
490 {
491 	size_t n = args->a3; /* thread id */
492 	struct thread_core_local *l = thread_get_core_local();
493 	uint32_t rv = 0;
494 
495 	assert(l->curr_thread == -1);
496 
497 	lock_global();
498 
499 	if (n < CFG_NUM_THREADS &&
500 	    threads[n].state == THREAD_STATE_SUSPENDED &&
501 	    args->a7 == threads[n].hyp_clnt_id)
502 		threads[n].state = THREAD_STATE_ACTIVE;
503 	else
504 		rv = OPTEE_SMC_RETURN_ERESUME;
505 
506 	unlock_global();
507 
508 	if (rv) {
509 		args->a0 = rv;
510 		return;
511 	}
512 
513 	l->curr_thread = n;
514 
515 	if (threads[n].have_user_map)
516 		core_mmu_set_user_map(&threads[n].user_map);
517 
518 	/*
519 	 * Return from RPC to request service of an IRQ must not
520 	 * get parameters from non-secure world.
521 	 */
522 	if (threads[n].flags & THREAD_FLAGS_COPY_ARGS_ON_RETURN) {
523 		copy_a0_to_a5(&threads[n].regs, args);
524 		threads[n].flags &= ~THREAD_FLAGS_COPY_ARGS_ON_RETURN;
525 	}
526 
527 	thread_lazy_save_ns_vfp();
528 	thread_resume(&threads[n].regs);
529 }
530 
531 void thread_handle_fast_smc(struct thread_smc_args *args)
532 {
533 	thread_check_canaries();
534 	thread_fast_smc_handler_ptr(args);
535 	/* Fast handlers must not unmask any exceptions */
536 	assert(thread_get_exceptions() == THREAD_EXCP_ALL);
537 }
538 
539 void thread_handle_std_smc(struct thread_smc_args *args)
540 {
541 	thread_check_canaries();
542 
543 	if (args->a0 == OPTEE_SMC_CALL_RETURN_FROM_RPC)
544 		thread_resume_from_rpc(args);
545 	else
546 		thread_alloc_and_run(args);
547 }
548 
549 /* Helper routine for the assembly function thread_std_smc_entry() */
550 void __thread_std_smc_entry(struct thread_smc_args *args)
551 {
552 	struct thread_ctx *thr = threads + thread_get_id();
553 
554 	if (!thr->rpc_arg) {
555 		paddr_t parg;
556 		uint64_t carg;
557 		void *arg;
558 
559 		thread_rpc_alloc_arg(
560 			OPTEE_MSG_GET_ARG_SIZE(RPC_MAX_NUM_PARAMS),
561 			&parg, &carg);
562 		if (!parg || !ALIGNMENT_IS_OK(parg, struct optee_msg_arg) ||
563 		    !(arg = phys_to_virt(parg, CORE_MEM_NSEC_SHM))) {
564 			thread_rpc_free_arg(carg);
565 			args->a0 = OPTEE_SMC_RETURN_ENOMEM;
566 			return;
567 		}
568 
569 		thr->rpc_arg = arg;
570 		thr->rpc_carg = carg;
571 	}
572 
573 	thread_std_smc_handler_ptr(args);
574 
575 	if (!thread_prealloc_rpc_cache) {
576 		thread_rpc_free_arg(thr->rpc_carg);
577 		thr->rpc_carg = 0;
578 		thr->rpc_arg = 0;
579 	}
580 }
581 
582 void *thread_get_tmp_sp(void)
583 {
584 	struct thread_core_local *l = thread_get_core_local();
585 
586 	return (void *)l->tmp_stack_va_end;
587 }
588 
589 #ifdef ARM64
590 vaddr_t thread_get_saved_thread_sp(void)
591 {
592 	struct thread_core_local *l = thread_get_core_local();
593 	int ct = l->curr_thread;
594 
595 	assert(ct != -1);
596 	return threads[ct].kern_sp;
597 }
598 #endif /*ARM64*/
599 
600 bool thread_addr_is_in_stack(vaddr_t va)
601 {
602 	struct thread_ctx *thr = threads + thread_get_id();
603 
604 	return va < thr->stack_va_end &&
605 	       va >= (thr->stack_va_end - STACK_THREAD_SIZE);
606 }
607 
608 void thread_state_free(void)
609 {
610 	struct thread_core_local *l = thread_get_core_local();
611 	int ct = l->curr_thread;
612 
613 	assert(ct != -1);
614 	assert(TAILQ_EMPTY(&threads[ct].mutexes));
615 
616 	thread_lazy_restore_ns_vfp();
617 	tee_pager_release_phys(
618 		(void *)(threads[ct].stack_va_end - STACK_THREAD_SIZE),
619 		STACK_THREAD_SIZE);
620 
621 	lock_global();
622 
623 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
624 	threads[ct].state = THREAD_STATE_FREE;
625 	threads[ct].flags = 0;
626 	l->curr_thread = -1;
627 
628 	unlock_global();
629 }
630 
631 #ifdef ARM32
632 static bool is_from_user(uint32_t cpsr)
633 {
634 	return (cpsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR;
635 }
636 #endif
637 
638 #ifdef ARM64
639 static bool is_from_user(uint32_t cpsr)
640 {
641 	if (cpsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT))
642 		return true;
643 	if (((cpsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) ==
644 	     SPSR_64_MODE_EL0)
645 		return true;
646 	return false;
647 }
648 #endif
649 
650 #ifdef CFG_WITH_PAGER
651 static void release_unused_kernel_stack(struct thread_ctx *thr)
652 {
653 	vaddr_t sp = thr->regs.svc_sp;
654 	vaddr_t base = thr->stack_va_end - STACK_THREAD_SIZE;
655 	size_t len = sp - base;
656 
657 	tee_pager_release_phys((void *)base, len);
658 }
659 #else
660 static void release_unused_kernel_stack(struct thread_ctx *thr __unused)
661 {
662 }
663 #endif
664 
665 int thread_state_suspend(uint32_t flags, uint32_t cpsr, vaddr_t pc)
666 {
667 	struct thread_core_local *l = thread_get_core_local();
668 	int ct = l->curr_thread;
669 
670 	assert(ct != -1);
671 
672 	thread_check_canaries();
673 
674 	release_unused_kernel_stack(threads + ct);
675 
676 	if (is_from_user(cpsr))
677 		thread_user_save_vfp();
678 	thread_lazy_restore_ns_vfp();
679 
680 	lock_global();
681 
682 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
683 	threads[ct].flags |= flags;
684 	threads[ct].regs.cpsr = cpsr;
685 	threads[ct].regs.pc = pc;
686 	threads[ct].state = THREAD_STATE_SUSPENDED;
687 
688 	threads[ct].have_user_map = core_mmu_user_mapping_is_active();
689 	if (threads[ct].have_user_map) {
690 		core_mmu_get_user_map(&threads[ct].user_map);
691 		core_mmu_set_user_map(NULL);
692 	}
693 
694 	l->curr_thread = -1;
695 
696 	unlock_global();
697 
698 	return ct;
699 }
700 
701 #ifdef ARM32
702 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
703 {
704 	l->tmp_stack_va_end = sp;
705 	thread_set_irq_sp(sp);
706 	thread_set_fiq_sp(sp);
707 }
708 
709 static void set_abt_stack(struct thread_core_local *l __unused, vaddr_t sp)
710 {
711 	thread_set_abt_sp(sp);
712 }
713 #endif /*ARM32*/
714 
715 #ifdef ARM64
716 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
717 {
718 	/*
719 	 * We're already using the tmp stack when this function is called
720 	 * so there's no need to assign it to any stack pointer. However,
721 	 * we'll need to restore it at different times so store it here.
722 	 */
723 	l->tmp_stack_va_end = sp;
724 }
725 
726 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
727 {
728 	l->abt_stack_va_end = sp;
729 }
730 #endif /*ARM64*/
731 
732 bool thread_init_stack(uint32_t thread_id, vaddr_t sp)
733 {
734 	if (thread_id >= CFG_NUM_THREADS)
735 		return false;
736 	threads[thread_id].stack_va_end = sp;
737 	return true;
738 }
739 
740 int thread_get_id_may_fail(void)
741 {
742 	/* thread_get_core_local() requires IRQs to be disabled */
743 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
744 	struct thread_core_local *l = thread_get_core_local();
745 	int ct = l->curr_thread;
746 
747 	thread_unmask_exceptions(exceptions);
748 	return ct;
749 }
750 
751 int thread_get_id(void)
752 {
753 	int ct = thread_get_id_may_fail();
754 
755 	assert((ct >= 0) && (ct < CFG_NUM_THREADS));
756 	return ct;
757 }
758 
759 static void init_handlers(const struct thread_handlers *handlers)
760 {
761 	thread_std_smc_handler_ptr = handlers->std_smc;
762 	thread_fast_smc_handler_ptr = handlers->fast_smc;
763 	thread_fiq_handler_ptr = handlers->fiq;
764 	thread_cpu_on_handler_ptr = handlers->cpu_on;
765 	thread_cpu_off_handler_ptr = handlers->cpu_off;
766 	thread_cpu_suspend_handler_ptr = handlers->cpu_suspend;
767 	thread_cpu_resume_handler_ptr = handlers->cpu_resume;
768 	thread_system_off_handler_ptr = handlers->system_off;
769 	thread_system_reset_handler_ptr = handlers->system_reset;
770 }
771 
772 
773 #ifdef CFG_WITH_PAGER
774 static void init_thread_stacks(void)
775 {
776 	size_t n;
777 
778 	/*
779 	 * Allocate virtual memory for thread stacks.
780 	 */
781 	for (n = 0; n < CFG_NUM_THREADS; n++) {
782 		tee_mm_entry_t *mm;
783 		vaddr_t sp;
784 
785 		/* Find vmem for thread stack and its protection gap */
786 		mm = tee_mm_alloc(&tee_mm_vcore,
787 				  SMALL_PAGE_SIZE + STACK_THREAD_SIZE);
788 		TEE_ASSERT(mm);
789 
790 		/* Claim eventual physical page */
791 		tee_pager_add_pages(tee_mm_get_smem(mm), tee_mm_get_size(mm),
792 				    true);
793 
794 		/* Add the area to the pager */
795 		tee_pager_add_core_area(tee_mm_get_smem(mm) + SMALL_PAGE_SIZE,
796 					tee_mm_get_bytes(mm) - SMALL_PAGE_SIZE,
797 					TEE_PAGER_AREA_RW | TEE_PAGER_AREA_LOCK,
798 					NULL, NULL);
799 
800 		/* init effective stack */
801 		sp = tee_mm_get_smem(mm) + tee_mm_get_bytes(mm);
802 		if (!thread_init_stack(n, sp))
803 			panic();
804 	}
805 }
806 #else
807 static void init_thread_stacks(void)
808 {
809 	size_t n;
810 
811 	/* Assign the thread stacks */
812 	for (n = 0; n < CFG_NUM_THREADS; n++) {
813 		if (!thread_init_stack(n, GET_STACK(stack_thread[n])))
814 			panic();
815 	}
816 }
817 #endif /*CFG_WITH_PAGER*/
818 
819 void thread_init_primary(const struct thread_handlers *handlers)
820 {
821 	init_handlers(handlers);
822 
823 	/* Initialize canaries around the stacks */
824 	init_canaries();
825 
826 	init_thread_stacks();
827 	pgt_init();
828 }
829 
830 static void init_sec_mon(size_t pos __maybe_unused)
831 {
832 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
833 	/* Initialize secure monitor */
834 	sm_init(GET_STACK(stack_sm[pos]));
835 	sm_set_entry_vector(thread_vector_table);
836 #endif
837 }
838 
839 void thread_init_per_cpu(void)
840 {
841 	size_t pos = get_core_pos();
842 	struct thread_core_local *l = thread_get_core_local();
843 
844 	init_sec_mon(pos);
845 
846 	set_tmp_stack(l, GET_STACK(stack_tmp[pos]));
847 	set_abt_stack(l, GET_STACK(stack_abt[pos]));
848 
849 	thread_init_vbar();
850 }
851 
852 struct thread_specific_data *thread_get_tsd(void)
853 {
854 	return &threads[thread_get_id()].tsd;
855 }
856 
857 struct thread_ctx_regs *thread_get_ctx_regs(void)
858 {
859 	struct thread_core_local *l = thread_get_core_local();
860 
861 	assert(l->curr_thread != -1);
862 	return &threads[l->curr_thread].regs;
863 }
864 
865 void thread_set_irq(bool enable)
866 {
867 	/* thread_get_core_local() requires IRQs to be disabled */
868 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
869 	struct thread_core_local *l;
870 
871 	l = thread_get_core_local();
872 
873 	assert(l->curr_thread != -1);
874 
875 	if (enable) {
876 		threads[l->curr_thread].flags |= THREAD_FLAGS_IRQ_ENABLE;
877 		thread_set_exceptions(exceptions & ~THREAD_EXCP_IRQ);
878 	} else {
879 		/*
880 		 * No need to disable IRQ here since it's already disabled
881 		 * above.
882 		 */
883 		threads[l->curr_thread].flags &= ~THREAD_FLAGS_IRQ_ENABLE;
884 	}
885 }
886 
887 void thread_restore_irq(void)
888 {
889 	/* thread_get_core_local() requires IRQs to be disabled */
890 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
891 	struct thread_core_local *l;
892 
893 	l = thread_get_core_local();
894 
895 	assert(l->curr_thread != -1);
896 
897 	if (threads[l->curr_thread].flags & THREAD_FLAGS_IRQ_ENABLE)
898 		thread_set_exceptions(exceptions & ~THREAD_EXCP_IRQ);
899 }
900 
901 #ifdef CFG_WITH_VFP
902 uint32_t thread_kernel_enable_vfp(void)
903 {
904 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
905 	struct thread_ctx *thr = threads + thread_get_id();
906 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
907 
908 	assert(!vfp_is_enabled());
909 
910 	if (!thr->vfp_state.ns_saved) {
911 		vfp_lazy_save_state_final(&thr->vfp_state.ns);
912 		thr->vfp_state.ns_saved = true;
913 	} else if (thr->vfp_state.sec_lazy_saved &&
914 		   !thr->vfp_state.sec_saved) {
915 		/*
916 		 * This happens when we're handling an abort while the
917 		 * thread was using the VFP state.
918 		 */
919 		vfp_lazy_save_state_final(&thr->vfp_state.sec);
920 		thr->vfp_state.sec_saved = true;
921 	} else if (tuv && tuv->lazy_saved && !tuv->saved) {
922 		/*
923 		 * This can happen either during syscall or abort
924 		 * processing (while processing a syscall).
925 		 */
926 		vfp_lazy_save_state_final(&tuv->vfp);
927 		tuv->saved = true;
928 	}
929 
930 	vfp_enable();
931 	return exceptions;
932 }
933 
934 void thread_kernel_disable_vfp(uint32_t state)
935 {
936 	uint32_t exceptions;
937 
938 	assert(vfp_is_enabled());
939 
940 	vfp_disable();
941 	exceptions = thread_get_exceptions();
942 	assert(exceptions & THREAD_EXCP_IRQ);
943 	exceptions &= ~THREAD_EXCP_IRQ;
944 	exceptions |= state & THREAD_EXCP_IRQ;
945 	thread_set_exceptions(exceptions);
946 }
947 
948 void thread_kernel_save_vfp(void)
949 {
950 	struct thread_ctx *thr = threads + thread_get_id();
951 
952 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
953 	if (vfp_is_enabled()) {
954 		vfp_lazy_save_state_init(&thr->vfp_state.sec);
955 		thr->vfp_state.sec_lazy_saved = true;
956 	}
957 }
958 
959 void thread_kernel_restore_vfp(void)
960 {
961 	struct thread_ctx *thr = threads + thread_get_id();
962 
963 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
964 	assert(!vfp_is_enabled());
965 	if (thr->vfp_state.sec_lazy_saved) {
966 		vfp_lazy_restore_state(&thr->vfp_state.sec,
967 				       thr->vfp_state.sec_saved);
968 		thr->vfp_state.sec_saved = false;
969 		thr->vfp_state.sec_lazy_saved = false;
970 	}
971 }
972 
973 void thread_user_enable_vfp(struct thread_user_vfp_state *uvfp)
974 {
975 	struct thread_ctx *thr = threads + thread_get_id();
976 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
977 
978 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
979 	assert(!vfp_is_enabled());
980 
981 	if (!thr->vfp_state.ns_saved) {
982 		vfp_lazy_save_state_final(&thr->vfp_state.ns);
983 		thr->vfp_state.ns_saved = true;
984 	} else if (tuv && uvfp != tuv) {
985 		if (tuv->lazy_saved && !tuv->saved) {
986 			vfp_lazy_save_state_final(&tuv->vfp);
987 			tuv->saved = true;
988 		}
989 	}
990 
991 	if (uvfp->lazy_saved)
992 		vfp_lazy_restore_state(&uvfp->vfp, uvfp->saved);
993 	uvfp->lazy_saved = false;
994 	uvfp->saved = false;
995 
996 	thr->vfp_state.uvfp = uvfp;
997 	vfp_enable();
998 }
999 
1000 void thread_user_save_vfp(void)
1001 {
1002 	struct thread_ctx *thr = threads + thread_get_id();
1003 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1004 
1005 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
1006 	if (!vfp_is_enabled())
1007 		return;
1008 
1009 	assert(tuv && !tuv->lazy_saved && !tuv->saved);
1010 	vfp_lazy_save_state_init(&tuv->vfp);
1011 	tuv->lazy_saved = true;
1012 }
1013 
1014 void thread_user_clear_vfp(struct thread_user_vfp_state *uvfp)
1015 {
1016 	struct thread_ctx *thr = threads + thread_get_id();
1017 
1018 	if (uvfp == thr->vfp_state.uvfp)
1019 		thr->vfp_state.uvfp = NULL;
1020 	uvfp->lazy_saved = false;
1021 	uvfp->saved = false;
1022 }
1023 #endif /*CFG_WITH_VFP*/
1024 
1025 #ifdef ARM32
1026 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1027 {
1028 	uint32_t s;
1029 
1030 	if (!is_32bit)
1031 		return false;
1032 
1033 	s = read_spsr();
1034 	s &= ~(CPSR_MODE_MASK | CPSR_T | CPSR_IT_MASK1 | CPSR_IT_MASK2);
1035 	s |= CPSR_MODE_USR;
1036 	if (entry_func & 1)
1037 		s |= CPSR_T;
1038 	*spsr = s;
1039 	return true;
1040 }
1041 #endif
1042 
1043 #ifdef ARM64
1044 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1045 {
1046 	uint32_t s;
1047 
1048 	if (is_32bit) {
1049 		s = read_daif() & (SPSR_32_AIF_MASK << SPSR_32_AIF_SHIFT);
1050 		s |= SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT;
1051 		s |= (entry_func & SPSR_32_T_MASK) << SPSR_32_T_SHIFT;
1052 	} else {
1053 		s = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
1054 	}
1055 
1056 	*spsr = s;
1057 	return true;
1058 }
1059 #endif
1060 
1061 uint32_t thread_enter_user_mode(unsigned long a0, unsigned long a1,
1062 		unsigned long a2, unsigned long a3, unsigned long user_sp,
1063 		unsigned long entry_func, bool is_32bit,
1064 		uint32_t *exit_status0, uint32_t *exit_status1)
1065 {
1066 	uint32_t spsr;
1067 
1068 	if (!get_spsr(is_32bit, entry_func, &spsr)) {
1069 		*exit_status0 = 1; /* panic */
1070 		*exit_status1 = 0xbadbadba;
1071 		return 0;
1072 	}
1073 	return __thread_enter_user_mode(a0, a1, a2, a3, user_sp, entry_func,
1074 					spsr, exit_status0, exit_status1);
1075 }
1076 
1077 void thread_add_mutex(struct mutex *m)
1078 {
1079 	struct thread_core_local *l = thread_get_core_local();
1080 	int ct = l->curr_thread;
1081 
1082 	assert(ct != -1 && threads[ct].state == THREAD_STATE_ACTIVE);
1083 	assert(m->owner_id == -1);
1084 	m->owner_id = ct;
1085 	TAILQ_INSERT_TAIL(&threads[ct].mutexes, m, link);
1086 }
1087 
1088 void thread_rem_mutex(struct mutex *m)
1089 {
1090 	struct thread_core_local *l = thread_get_core_local();
1091 	int ct = l->curr_thread;
1092 
1093 	assert(ct != -1 && threads[ct].state == THREAD_STATE_ACTIVE);
1094 	assert(m->owner_id == ct);
1095 	m->owner_id = -1;
1096 	TAILQ_REMOVE(&threads[ct].mutexes, m, link);
1097 }
1098 
1099 bool thread_disable_prealloc_rpc_cache(uint64_t *cookie)
1100 {
1101 	bool rv;
1102 	size_t n;
1103 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
1104 
1105 	lock_global();
1106 
1107 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1108 		if (threads[n].state != THREAD_STATE_FREE) {
1109 			rv = false;
1110 			goto out;
1111 		}
1112 	}
1113 
1114 	rv = true;
1115 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1116 		if (threads[n].rpc_arg) {
1117 			*cookie = threads[n].rpc_carg;
1118 			threads[n].rpc_carg = 0;
1119 			threads[n].rpc_arg = NULL;
1120 			goto out;
1121 		}
1122 	}
1123 
1124 	*cookie = 0;
1125 	thread_prealloc_rpc_cache = false;
1126 out:
1127 	unlock_global();
1128 	thread_unmask_exceptions(exceptions);
1129 	return rv;
1130 }
1131 
1132 bool thread_enable_prealloc_rpc_cache(void)
1133 {
1134 	bool rv;
1135 	size_t n;
1136 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
1137 
1138 	lock_global();
1139 
1140 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1141 		if (threads[n].state != THREAD_STATE_FREE) {
1142 			rv = false;
1143 			goto out;
1144 		}
1145 	}
1146 
1147 	rv = true;
1148 	thread_prealloc_rpc_cache = true;
1149 out:
1150 	unlock_global();
1151 	thread_unmask_exceptions(exceptions);
1152 	return rv;
1153 }
1154 
1155 static uint32_t rpc_cmd_nolock(uint32_t cmd, size_t num_params,
1156 		struct optee_msg_param *params)
1157 {
1158 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1159 	struct thread_ctx *thr = threads + thread_get_id();
1160 	struct optee_msg_arg *arg = thr->rpc_arg;
1161 	uint64_t carg = thr->rpc_carg;
1162 	const size_t params_size = sizeof(struct optee_msg_param) * num_params;
1163 	size_t n;
1164 
1165 	TEE_ASSERT(arg && carg && num_params <= RPC_MAX_NUM_PARAMS);
1166 
1167 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(RPC_MAX_NUM_PARAMS));
1168 	arg->cmd = cmd;
1169 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1170 	arg->num_params = num_params;
1171 	memcpy(OPTEE_MSG_GET_PARAMS(arg), params, params_size);
1172 
1173 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1174 	thread_rpc(rpc_args);
1175 	for (n = 0; n < num_params; n++) {
1176 		switch (params[n].attr & OPTEE_MSG_ATTR_TYPE_MASK) {
1177 		case OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT:
1178 		case OPTEE_MSG_ATTR_TYPE_VALUE_INOUT:
1179 		case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT:
1180 		case OPTEE_MSG_ATTR_TYPE_RMEM_INOUT:
1181 		case OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT:
1182 		case OPTEE_MSG_ATTR_TYPE_TMEM_INOUT:
1183 			memcpy(params + n, OPTEE_MSG_GET_PARAMS(arg) + n,
1184 			       sizeof(struct optee_msg_param));
1185 			break;
1186 		default:
1187 			break;
1188 		}
1189 	}
1190 	return arg->ret;
1191 }
1192 
1193 uint32_t thread_rpc_cmd(uint32_t cmd, size_t num_params,
1194 		struct optee_msg_param *params)
1195 {
1196 	uint32_t ret;
1197 
1198 	ret = rpc_cmd_nolock(cmd, num_params, params);
1199 
1200 	return ret;
1201 }
1202 
1203 void thread_rpc_alloc_arg(size_t size, paddr_t *arg, uint64_t *cookie)
1204 {
1205 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1206 		OPTEE_SMC_RETURN_RPC_ALLOC, size};
1207 
1208 	thread_rpc(rpc_args);
1209 	*arg = reg_pair_to_64(rpc_args[1], rpc_args[2]);
1210 	*cookie = reg_pair_to_64(rpc_args[4], rpc_args[5]);
1211 }
1212 
1213 /**
1214  * Allocates shared memory buffer via RPC
1215  *
1216  * @size:	size in bytes of shared memory buffer
1217  * @align:	required alignment of buffer
1218  * @bt:		buffer type OPTEE_MSG_RPC_SHM_TYPE_*
1219  * @payload:	returned physical pointer to buffer, 0 if allocation
1220  *		failed.
1221  * @cookie:	returned cookie used when freeing the buffer
1222  */
1223 static void thread_rpc_alloc(size_t size, size_t align, unsigned bt,
1224 			paddr_t *payload, uint64_t *cookie)
1225 {
1226 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1227 	struct thread_ctx *thr = threads + thread_get_id();
1228 	struct optee_msg_arg *arg = thr->rpc_arg;
1229 	uint64_t carg = thr->rpc_carg;
1230 	struct optee_msg_param *params = OPTEE_MSG_GET_PARAMS(arg);
1231 
1232 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(1));
1233 	arg->cmd = OPTEE_MSG_RPC_CMD_SHM_ALLOC;
1234 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1235 	arg->num_params = 1;
1236 
1237 	params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1238 	params[0].u.value.a = bt;
1239 	params[0].u.value.b = size;
1240 	params[0].u.value.c = align;
1241 
1242 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1243 	thread_rpc(rpc_args);
1244 	if (arg->ret != TEE_SUCCESS)
1245 		goto fail;
1246 
1247 	if (arg->num_params != 1)
1248 		goto fail;
1249 
1250 	if (params[0].attr != OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT)
1251 		goto fail;
1252 
1253 	*payload = params[0].u.tmem.buf_ptr;
1254 	*cookie = params[0].u.tmem.shm_ref;
1255 	return;
1256 fail:
1257 	*payload = 0;
1258 	*cookie = 0;
1259 }
1260 
1261 /**
1262  * Free physical memory previously allocated with thread_rpc_alloc()
1263  *
1264  * @cookie:	cookie received when allocating the buffer
1265  * @bt:		 must be the same as supplied when allocating
1266  */
1267 static void thread_rpc_free(unsigned bt, uint64_t cookie)
1268 {
1269 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1270 	struct thread_ctx *thr = threads + thread_get_id();
1271 	struct optee_msg_arg *arg = thr->rpc_arg;
1272 	uint64_t carg = thr->rpc_carg;
1273 	struct optee_msg_param *params = OPTEE_MSG_GET_PARAMS(arg);
1274 
1275 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(1));
1276 	arg->cmd = OPTEE_MSG_RPC_CMD_SHM_FREE;
1277 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1278 	arg->num_params = 1;
1279 
1280 	params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1281 	params[0].u.value.a = bt;
1282 	params[0].u.value.b = cookie;
1283 	params[0].u.value.c = 0;
1284 
1285 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1286 	thread_rpc(rpc_args);
1287 }
1288 
1289 
1290 void thread_rpc_free_arg(uint64_t cookie)
1291 {
1292 	if (cookie) {
1293 		uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1294 			OPTEE_SMC_RETURN_RPC_FREE};
1295 
1296 		reg_pair_from_64(cookie, rpc_args + 1, rpc_args + 2);
1297 		thread_rpc(rpc_args);
1298 	}
1299 }
1300 
1301 void thread_rpc_alloc_payload(size_t size, paddr_t *payload, uint64_t *cookie)
1302 {
1303 	thread_rpc_alloc(size, 8, OPTEE_MSG_RPC_SHM_TYPE_APPL, payload, cookie);
1304 }
1305 
1306 void thread_rpc_free_payload(uint64_t cookie)
1307 {
1308 	thread_rpc_free(OPTEE_MSG_RPC_SHM_TYPE_APPL, cookie);
1309 }
1310