xref: /optee_os/core/arch/arm/kernel/thread.c (revision 82e1d963034803ba43a0f65a741f2ef109414b22)
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2016, Linaro Limited
4  * Copyright (c) 2014, STMicroelectronics International N.V.
5  */
6 
7 #include <platform_config.h>
8 
9 #include <arm.h>
10 #include <assert.h>
11 #include <keep.h>
12 #include <kernel/asan.h>
13 #include <kernel/misc.h>
14 #include <kernel/msg_param.h>
15 #include <kernel/panic.h>
16 #include <kernel/spinlock.h>
17 #include <kernel/tee_ta_manager.h>
18 #include <kernel/thread_defs.h>
19 #include <kernel/thread.h>
20 #include <mm/core_memprot.h>
21 #include <mm/mobj.h>
22 #include <mm/tee_mm.h>
23 #include <mm/tee_mmu.h>
24 #include <mm/tee_pager.h>
25 #include <optee_msg.h>
26 #include <smccc.h>
27 #include <sm/optee_smc.h>
28 #include <sm/sm.h>
29 #include <tee/tee_cryp_utl.h>
30 #include <tee/tee_fs_rpc.h>
31 #include <trace.h>
32 #include <util.h>
33 
34 #include "thread_private.h"
35 
36 #ifdef CFG_WITH_ARM_TRUSTED_FW
37 #define STACK_TMP_OFFS		0
38 #else
39 #define STACK_TMP_OFFS		SM_STACK_TMP_RESERVE_SIZE
40 #endif
41 
42 
43 #ifdef ARM32
44 #ifdef CFG_CORE_SANITIZE_KADDRESS
45 #define STACK_TMP_SIZE		(3072 + STACK_TMP_OFFS)
46 #else
47 #define STACK_TMP_SIZE		(1536 + STACK_TMP_OFFS)
48 #endif
49 #define STACK_THREAD_SIZE	8192
50 
51 #ifdef CFG_CORE_SANITIZE_KADDRESS
52 #define STACK_ABT_SIZE		3072
53 #else
54 #define STACK_ABT_SIZE		2048
55 #endif
56 
57 #endif /*ARM32*/
58 
59 #ifdef ARM64
60 #define STACK_TMP_SIZE		(2048 + STACK_TMP_OFFS)
61 #define STACK_THREAD_SIZE	8192
62 
63 #if TRACE_LEVEL > 0
64 #define STACK_ABT_SIZE		3072
65 #else
66 #define STACK_ABT_SIZE		1024
67 #endif
68 #endif /*ARM64*/
69 
70 struct thread_ctx threads[CFG_NUM_THREADS];
71 
72 struct thread_core_local thread_core_local[CFG_TEE_CORE_NB_CORE];
73 
74 #ifdef CFG_WITH_STACK_CANARIES
75 #ifdef ARM32
76 #define STACK_CANARY_SIZE	(4 * sizeof(uint32_t))
77 #endif
78 #ifdef ARM64
79 #define STACK_CANARY_SIZE	(8 * sizeof(uint32_t))
80 #endif
81 #define START_CANARY_VALUE	0xdededede
82 #define END_CANARY_VALUE	0xabababab
83 #define GET_START_CANARY(name, stack_num) name[stack_num][0]
84 #define GET_END_CANARY(name, stack_num) \
85 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
86 #else
87 #define STACK_CANARY_SIZE	0
88 #endif
89 
90 #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
91 linkage uint32_t name[num_stacks] \
92 		[ROUNDUP(stack_size + STACK_CANARY_SIZE, STACK_ALIGNMENT) / \
93 		sizeof(uint32_t)] \
94 		__attribute__((section(".nozi_stack." # name), \
95 			       aligned(STACK_ALIGNMENT)))
96 
97 #define STACK_SIZE(stack) (sizeof(stack) - STACK_CANARY_SIZE / 2)
98 
99 #define GET_STACK(stack) \
100 	((vaddr_t)(stack) + STACK_SIZE(stack))
101 
102 DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE, static);
103 DECLARE_STACK(stack_abt, CFG_TEE_CORE_NB_CORE, STACK_ABT_SIZE, static);
104 #ifndef CFG_WITH_PAGER
105 DECLARE_STACK(stack_thread, CFG_NUM_THREADS, STACK_THREAD_SIZE, static);
106 #endif
107 
108 const void *stack_tmp_export = (uint8_t *)stack_tmp + sizeof(stack_tmp[0]) -
109 			       (STACK_TMP_OFFS + STACK_CANARY_SIZE / 2);
110 const uint32_t stack_tmp_stride = sizeof(stack_tmp[0]);
111 
112 /*
113  * These stack setup info are required by secondary boot cores before they
114  * each locally enable the pager (the mmu). Hence kept in pager sections.
115  */
116 KEEP_PAGER(stack_tmp_export);
117 KEEP_PAGER(stack_tmp_stride);
118 
119 thread_smc_handler_t thread_std_smc_handler_ptr;
120 static thread_smc_handler_t thread_fast_smc_handler_ptr;
121 thread_nintr_handler_t thread_nintr_handler_ptr;
122 thread_pm_handler_t thread_cpu_on_handler_ptr;
123 thread_pm_handler_t thread_cpu_off_handler_ptr;
124 thread_pm_handler_t thread_cpu_suspend_handler_ptr;
125 thread_pm_handler_t thread_cpu_resume_handler_ptr;
126 thread_pm_handler_t thread_system_off_handler_ptr;
127 thread_pm_handler_t thread_system_reset_handler_ptr;
128 
129 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
130 static vaddr_t thread_user_kcode_va;
131 long thread_user_kcode_offset;
132 static size_t thread_user_kcode_size;
133 #endif
134 
135 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
136 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
137 long thread_user_kdata_sp_offset;
138 static uint8_t thread_user_kdata_page[
139 	ROUNDUP(sizeof(thread_core_local), SMALL_PAGE_SIZE)]
140 	__aligned(SMALL_PAGE_SIZE) __section(".nozi.kdata_page");
141 #endif
142 
143 static unsigned int thread_global_lock = SPINLOCK_UNLOCK;
144 static bool thread_prealloc_rpc_cache;
145 
146 static unsigned int thread_rpc_pnum;
147 
148 static void init_canaries(void)
149 {
150 #ifdef CFG_WITH_STACK_CANARIES
151 	size_t n;
152 #define INIT_CANARY(name)						\
153 	for (n = 0; n < ARRAY_SIZE(name); n++) {			\
154 		uint32_t *start_canary = &GET_START_CANARY(name, n);	\
155 		uint32_t *end_canary = &GET_END_CANARY(name, n);	\
156 									\
157 		*start_canary = START_CANARY_VALUE;			\
158 		*end_canary = END_CANARY_VALUE;				\
159 		DMSG("#Stack canaries for %s[%zu] with top at %p\n",	\
160 			#name, n, (void *)(end_canary - 1));		\
161 		DMSG("watch *%p\n", (void *)end_canary);		\
162 	}
163 
164 	INIT_CANARY(stack_tmp);
165 	INIT_CANARY(stack_abt);
166 #ifndef CFG_WITH_PAGER
167 	INIT_CANARY(stack_thread);
168 #endif
169 #endif/*CFG_WITH_STACK_CANARIES*/
170 }
171 
172 #define CANARY_DIED(stack, loc, n) \
173 	do { \
174 		EMSG_RAW("Dead canary at %s of '%s[%zu]'", #loc, #stack, n); \
175 		panic(); \
176 	} while (0)
177 
178 void thread_check_canaries(void)
179 {
180 #ifdef CFG_WITH_STACK_CANARIES
181 	size_t n;
182 
183 	for (n = 0; n < ARRAY_SIZE(stack_tmp); n++) {
184 		if (GET_START_CANARY(stack_tmp, n) != START_CANARY_VALUE)
185 			CANARY_DIED(stack_tmp, start, n);
186 		if (GET_END_CANARY(stack_tmp, n) != END_CANARY_VALUE)
187 			CANARY_DIED(stack_tmp, end, n);
188 	}
189 
190 	for (n = 0; n < ARRAY_SIZE(stack_abt); n++) {
191 		if (GET_START_CANARY(stack_abt, n) != START_CANARY_VALUE)
192 			CANARY_DIED(stack_abt, start, n);
193 		if (GET_END_CANARY(stack_abt, n) != END_CANARY_VALUE)
194 			CANARY_DIED(stack_abt, end, n);
195 
196 	}
197 #ifndef CFG_WITH_PAGER
198 	for (n = 0; n < ARRAY_SIZE(stack_thread); n++) {
199 		if (GET_START_CANARY(stack_thread, n) != START_CANARY_VALUE)
200 			CANARY_DIED(stack_thread, start, n);
201 		if (GET_END_CANARY(stack_thread, n) != END_CANARY_VALUE)
202 			CANARY_DIED(stack_thread, end, n);
203 	}
204 #endif
205 #endif/*CFG_WITH_STACK_CANARIES*/
206 }
207 
208 static void lock_global(void)
209 {
210 	cpu_spin_lock(&thread_global_lock);
211 }
212 
213 static void unlock_global(void)
214 {
215 	cpu_spin_unlock(&thread_global_lock);
216 }
217 
218 #ifdef ARM32
219 uint32_t thread_get_exceptions(void)
220 {
221 	uint32_t cpsr = read_cpsr();
222 
223 	return (cpsr >> CPSR_F_SHIFT) & THREAD_EXCP_ALL;
224 }
225 
226 void thread_set_exceptions(uint32_t exceptions)
227 {
228 	uint32_t cpsr = read_cpsr();
229 
230 	/* Foreign interrupts must not be unmasked while holding a spinlock */
231 	if (!(exceptions & THREAD_EXCP_FOREIGN_INTR))
232 		assert_have_no_spinlock();
233 
234 	cpsr &= ~(THREAD_EXCP_ALL << CPSR_F_SHIFT);
235 	cpsr |= ((exceptions & THREAD_EXCP_ALL) << CPSR_F_SHIFT);
236 	write_cpsr(cpsr);
237 }
238 #endif /*ARM32*/
239 
240 #ifdef ARM64
241 uint32_t thread_get_exceptions(void)
242 {
243 	uint32_t daif = read_daif();
244 
245 	return (daif >> DAIF_F_SHIFT) & THREAD_EXCP_ALL;
246 }
247 
248 void thread_set_exceptions(uint32_t exceptions)
249 {
250 	uint32_t daif = read_daif();
251 
252 	/* Foreign interrupts must not be unmasked while holding a spinlock */
253 	if (!(exceptions & THREAD_EXCP_FOREIGN_INTR))
254 		assert_have_no_spinlock();
255 
256 	daif &= ~(THREAD_EXCP_ALL << DAIF_F_SHIFT);
257 	daif |= ((exceptions & THREAD_EXCP_ALL) << DAIF_F_SHIFT);
258 	write_daif(daif);
259 }
260 #endif /*ARM64*/
261 
262 uint32_t thread_mask_exceptions(uint32_t exceptions)
263 {
264 	uint32_t state = thread_get_exceptions();
265 
266 	thread_set_exceptions(state | (exceptions & THREAD_EXCP_ALL));
267 	return state;
268 }
269 
270 void thread_unmask_exceptions(uint32_t state)
271 {
272 	thread_set_exceptions(state & THREAD_EXCP_ALL);
273 }
274 
275 
276 struct thread_core_local *thread_get_core_local(void)
277 {
278 	uint32_t cpu_id = get_core_pos();
279 
280 	/*
281 	 * Foreign interrupts must be disabled before playing with core_local
282 	 * since we otherwise may be rescheduled to a different core in the
283 	 * middle of this function.
284 	 */
285 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
286 
287 	assert(cpu_id < CFG_TEE_CORE_NB_CORE);
288 	return &thread_core_local[cpu_id];
289 }
290 
291 static void thread_lazy_save_ns_vfp(void)
292 {
293 #ifdef CFG_WITH_VFP
294 	struct thread_ctx *thr = threads + thread_get_id();
295 
296 	thr->vfp_state.ns_saved = false;
297 #if defined(CFG_WITH_ARM_TRUSTED_FW)
298 	/*
299 	 * ARM TF saves and restores CPACR_EL1, so we must assume NS world
300 	 * uses VFP and always preserve the register file when secure world
301 	 * is about to use it
302 	 */
303 	thr->vfp_state.ns_force_save = true;
304 #endif
305 	vfp_lazy_save_state_init(&thr->vfp_state.ns);
306 #endif /*CFG_WITH_VFP*/
307 }
308 
309 static void thread_lazy_restore_ns_vfp(void)
310 {
311 #ifdef CFG_WITH_VFP
312 	struct thread_ctx *thr = threads + thread_get_id();
313 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
314 
315 	assert(!thr->vfp_state.sec_lazy_saved && !thr->vfp_state.sec_saved);
316 
317 	if (tuv && tuv->lazy_saved && !tuv->saved) {
318 		vfp_lazy_save_state_final(&tuv->vfp, false /*!force_save*/);
319 		tuv->saved = true;
320 	}
321 
322 	vfp_lazy_restore_state(&thr->vfp_state.ns, thr->vfp_state.ns_saved);
323 	thr->vfp_state.ns_saved = false;
324 #endif /*CFG_WITH_VFP*/
325 }
326 
327 #ifdef ARM32
328 static void init_regs(struct thread_ctx *thread,
329 		struct thread_smc_args *args)
330 {
331 	thread->regs.pc = (uint32_t)thread_std_smc_entry;
332 
333 	/*
334 	 * Stdcalls starts in SVC mode with masked foreign interrupts, masked
335 	 * Asynchronous abort and unmasked native interrupts.
336 	 */
337 	thread->regs.cpsr = read_cpsr() & ARM32_CPSR_E;
338 	thread->regs.cpsr |= CPSR_MODE_SVC | CPSR_A |
339 			(THREAD_EXCP_FOREIGN_INTR << ARM32_CPSR_F_SHIFT);
340 	/* Enable thumb mode if it's a thumb instruction */
341 	if (thread->regs.pc & 1)
342 		thread->regs.cpsr |= CPSR_T;
343 	/* Reinitialize stack pointer */
344 	thread->regs.svc_sp = thread->stack_va_end;
345 
346 	/*
347 	 * Copy arguments into context. This will make the
348 	 * arguments appear in r0-r7 when thread is started.
349 	 */
350 	thread->regs.r0 = args->a0;
351 	thread->regs.r1 = args->a1;
352 	thread->regs.r2 = args->a2;
353 	thread->regs.r3 = args->a3;
354 	thread->regs.r4 = args->a4;
355 	thread->regs.r5 = args->a5;
356 	thread->regs.r6 = args->a6;
357 	thread->regs.r7 = args->a7;
358 }
359 #endif /*ARM32*/
360 
361 #ifdef ARM64
362 static void init_regs(struct thread_ctx *thread,
363 		struct thread_smc_args *args)
364 {
365 	thread->regs.pc = (uint64_t)thread_std_smc_entry;
366 
367 	/*
368 	 * Stdcalls starts in SVC mode with masked foreign interrupts, masked
369 	 * Asynchronous abort and unmasked native interrupts.
370 	 */
371 	thread->regs.cpsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0,
372 				THREAD_EXCP_FOREIGN_INTR | DAIFBIT_ABT);
373 	/* Reinitialize stack pointer */
374 	thread->regs.sp = thread->stack_va_end;
375 
376 	/*
377 	 * Copy arguments into context. This will make the
378 	 * arguments appear in x0-x7 when thread is started.
379 	 */
380 	thread->regs.x[0] = args->a0;
381 	thread->regs.x[1] = args->a1;
382 	thread->regs.x[2] = args->a2;
383 	thread->regs.x[3] = args->a3;
384 	thread->regs.x[4] = args->a4;
385 	thread->regs.x[5] = args->a5;
386 	thread->regs.x[6] = args->a6;
387 	thread->regs.x[7] = args->a7;
388 
389 	/* Set up frame pointer as per the Aarch64 AAPCS */
390 	thread->regs.x[29] = 0;
391 }
392 #endif /*ARM64*/
393 
394 void thread_init_boot_thread(void)
395 {
396 	struct thread_core_local *l = thread_get_core_local();
397 	size_t n;
398 
399 	for (n = 0; n < CFG_NUM_THREADS; n++) {
400 		TAILQ_INIT(&threads[n].mutexes);
401 		TAILQ_INIT(&threads[n].tsd.sess_stack);
402 		SLIST_INIT(&threads[n].tsd.pgt_cache);
403 	}
404 
405 	for (n = 0; n < CFG_TEE_CORE_NB_CORE; n++)
406 		thread_core_local[n].curr_thread = -1;
407 
408 	l->curr_thread = 0;
409 	threads[0].state = THREAD_STATE_ACTIVE;
410 }
411 
412 void thread_clr_boot_thread(void)
413 {
414 	struct thread_core_local *l = thread_get_core_local();
415 
416 	assert(l->curr_thread >= 0 && l->curr_thread < CFG_NUM_THREADS);
417 	assert(threads[l->curr_thread].state == THREAD_STATE_ACTIVE);
418 	assert(TAILQ_EMPTY(&threads[l->curr_thread].mutexes));
419 	threads[l->curr_thread].state = THREAD_STATE_FREE;
420 	l->curr_thread = -1;
421 }
422 
423 static void thread_alloc_and_run(struct thread_smc_args *args)
424 {
425 	size_t n;
426 	struct thread_core_local *l = thread_get_core_local();
427 	bool found_thread = false;
428 
429 	assert(l->curr_thread == -1);
430 
431 	lock_global();
432 
433 	for (n = 0; n < CFG_NUM_THREADS; n++) {
434 		if (threads[n].state == THREAD_STATE_FREE) {
435 			threads[n].state = THREAD_STATE_ACTIVE;
436 			found_thread = true;
437 			break;
438 		}
439 	}
440 
441 	unlock_global();
442 
443 	if (!found_thread) {
444 		args->a0 = OPTEE_SMC_RETURN_ETHREAD_LIMIT;
445 		return;
446 	}
447 
448 	l->curr_thread = n;
449 
450 	threads[n].flags = 0;
451 	init_regs(threads + n, args);
452 
453 	/* Save Hypervisor Client ID */
454 	threads[n].hyp_clnt_id = args->a7;
455 
456 	thread_lazy_save_ns_vfp();
457 	thread_resume(&threads[n].regs);
458 }
459 
460 #ifdef ARM32
461 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
462 		struct thread_smc_args *args)
463 {
464 	/*
465 	 * Update returned values from RPC, values will appear in
466 	 * r0-r3 when thread is resumed.
467 	 */
468 	regs->r0 = args->a0;
469 	regs->r1 = args->a1;
470 	regs->r2 = args->a2;
471 	regs->r3 = args->a3;
472 	regs->r4 = args->a4;
473 	regs->r5 = args->a5;
474 }
475 #endif /*ARM32*/
476 
477 #ifdef ARM64
478 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
479 		struct thread_smc_args *args)
480 {
481 	/*
482 	 * Update returned values from RPC, values will appear in
483 	 * x0-x3 when thread is resumed.
484 	 */
485 	regs->x[0] = args->a0;
486 	regs->x[1] = args->a1;
487 	regs->x[2] = args->a2;
488 	regs->x[3] = args->a3;
489 	regs->x[4] = args->a4;
490 	regs->x[5] = args->a5;
491 }
492 #endif /*ARM64*/
493 
494 #ifdef ARM32
495 static bool is_from_user(uint32_t cpsr)
496 {
497 	return (cpsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR;
498 }
499 #endif
500 
501 #ifdef ARM64
502 static bool is_from_user(uint32_t cpsr)
503 {
504 	if (cpsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT))
505 		return true;
506 	if (((cpsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) ==
507 	     SPSR_64_MODE_EL0)
508 		return true;
509 	return false;
510 }
511 #endif
512 
513 static bool is_user_mode(struct thread_ctx_regs *regs)
514 {
515 	return is_from_user((uint32_t)regs->cpsr);
516 }
517 
518 static void thread_resume_from_rpc(struct thread_smc_args *args)
519 {
520 	size_t n = args->a3; /* thread id */
521 	struct thread_core_local *l = thread_get_core_local();
522 	uint32_t rv = 0;
523 
524 	assert(l->curr_thread == -1);
525 
526 	lock_global();
527 
528 	if (n < CFG_NUM_THREADS &&
529 	    threads[n].state == THREAD_STATE_SUSPENDED &&
530 	    args->a7 == threads[n].hyp_clnt_id)
531 		threads[n].state = THREAD_STATE_ACTIVE;
532 	else
533 		rv = OPTEE_SMC_RETURN_ERESUME;
534 
535 	unlock_global();
536 
537 	if (rv) {
538 		args->a0 = rv;
539 		return;
540 	}
541 
542 	l->curr_thread = n;
543 
544 	if (is_user_mode(&threads[n].regs))
545 		tee_ta_update_session_utime_resume();
546 
547 	if (threads[n].have_user_map)
548 		core_mmu_set_user_map(&threads[n].user_map);
549 
550 	/*
551 	 * Return from RPC to request service of a foreign interrupt must not
552 	 * get parameters from non-secure world.
553 	 */
554 	if (threads[n].flags & THREAD_FLAGS_COPY_ARGS_ON_RETURN) {
555 		copy_a0_to_a5(&threads[n].regs, args);
556 		threads[n].flags &= ~THREAD_FLAGS_COPY_ARGS_ON_RETURN;
557 	}
558 
559 	thread_lazy_save_ns_vfp();
560 	thread_resume(&threads[n].regs);
561 }
562 
563 void thread_handle_fast_smc(struct thread_smc_args *args)
564 {
565 	thread_check_canaries();
566 	thread_fast_smc_handler_ptr(args);
567 	/* Fast handlers must not unmask any exceptions */
568 	assert(thread_get_exceptions() == THREAD_EXCP_ALL);
569 }
570 
571 void thread_handle_std_smc(struct thread_smc_args *args)
572 {
573 	thread_check_canaries();
574 
575 	if (args->a0 == OPTEE_SMC_CALL_RETURN_FROM_RPC)
576 		thread_resume_from_rpc(args);
577 	else
578 		thread_alloc_and_run(args);
579 }
580 
581 /**
582  * Free physical memory previously allocated with thread_rpc_alloc_arg()
583  *
584  * @cookie:	cookie received when allocating the buffer
585  */
586 static void thread_rpc_free_arg(uint64_t cookie)
587 {
588 	if (cookie) {
589 		uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
590 			OPTEE_SMC_RETURN_RPC_FREE
591 		};
592 
593 		reg_pair_from_64(cookie, rpc_args + 1, rpc_args + 2);
594 		thread_rpc(rpc_args);
595 	}
596 }
597 
598 /*
599  * Helper routine for the assembly function thread_std_smc_entry()
600  *
601  * Note: this function is weak just to make it possible to exclude it from
602  * the unpaged area.
603  */
604 void __weak __thread_std_smc_entry(struct thread_smc_args *args)
605 {
606 	thread_std_smc_handler_ptr(args);
607 
608 	if (args->a0 == OPTEE_SMC_RETURN_OK) {
609 		struct thread_ctx *thr = threads + thread_get_id();
610 
611 		tee_fs_rpc_cache_clear(&thr->tsd);
612 		if (!thread_prealloc_rpc_cache) {
613 			thread_rpc_free_arg(thr->rpc_carg);
614 			mobj_free(thr->rpc_mobj);
615 			thr->rpc_carg = 0;
616 			thr->rpc_arg = 0;
617 			thr->rpc_mobj = NULL;
618 		}
619 	}
620 }
621 
622 void *thread_get_tmp_sp(void)
623 {
624 	struct thread_core_local *l = thread_get_core_local();
625 
626 	return (void *)l->tmp_stack_va_end;
627 }
628 
629 #ifdef ARM64
630 vaddr_t thread_get_saved_thread_sp(void)
631 {
632 	struct thread_core_local *l = thread_get_core_local();
633 	int ct = l->curr_thread;
634 
635 	assert(ct != -1);
636 	return threads[ct].kern_sp;
637 }
638 #endif /*ARM64*/
639 
640 vaddr_t thread_stack_start(void)
641 {
642 	struct thread_ctx *thr;
643 	int ct = thread_get_id_may_fail();
644 
645 	if (ct == -1)
646 		return 0;
647 
648 	thr = threads + ct;
649 	return thr->stack_va_end - STACK_THREAD_SIZE;
650 }
651 
652 size_t thread_stack_size(void)
653 {
654 	return STACK_THREAD_SIZE;
655 }
656 
657 bool thread_is_from_abort_mode(void)
658 {
659 	struct thread_core_local *l = thread_get_core_local();
660 
661 	return (l->flags >> THREAD_CLF_SAVED_SHIFT) & THREAD_CLF_ABORT;
662 }
663 
664 #ifdef ARM32
665 bool thread_is_in_normal_mode(void)
666 {
667 	return (read_cpsr() & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_SVC;
668 }
669 #endif
670 
671 #ifdef ARM64
672 bool thread_is_in_normal_mode(void)
673 {
674 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
675 	struct thread_core_local *l = thread_get_core_local();
676 	bool ret;
677 
678 	/* If any bit in l->flags is set we're handling some exception. */
679 	ret = !l->flags;
680 	thread_unmask_exceptions(exceptions);
681 
682 	return ret;
683 }
684 #endif
685 
686 void thread_state_free(void)
687 {
688 	struct thread_core_local *l = thread_get_core_local();
689 	int ct = l->curr_thread;
690 
691 	assert(ct != -1);
692 	assert(TAILQ_EMPTY(&threads[ct].mutexes));
693 
694 	thread_lazy_restore_ns_vfp();
695 	tee_pager_release_phys(
696 		(void *)(threads[ct].stack_va_end - STACK_THREAD_SIZE),
697 		STACK_THREAD_SIZE);
698 
699 	lock_global();
700 
701 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
702 	threads[ct].state = THREAD_STATE_FREE;
703 	threads[ct].flags = 0;
704 	l->curr_thread = -1;
705 
706 	unlock_global();
707 }
708 
709 #ifdef CFG_WITH_PAGER
710 static void release_unused_kernel_stack(struct thread_ctx *thr,
711 					uint32_t cpsr __maybe_unused)
712 {
713 #ifdef ARM64
714 	/*
715 	 * If we're from user mode then thr->regs.sp is the saved user
716 	 * stack pointer and thr->kern_sp holds the last kernel stack
717 	 * pointer. But if we're from kernel mode then thr->kern_sp isn't
718 	 * up to date so we need to read from thr->regs.sp instead.
719 	 */
720 	vaddr_t sp = is_from_user(cpsr) ?  thr->kern_sp : thr->regs.sp;
721 #else
722 	vaddr_t sp = thr->regs.svc_sp;
723 #endif
724 	vaddr_t base = thr->stack_va_end - STACK_THREAD_SIZE;
725 	size_t len = sp - base;
726 
727 	tee_pager_release_phys((void *)base, len);
728 }
729 #else
730 static void release_unused_kernel_stack(struct thread_ctx *thr __unused,
731 					uint32_t cpsr __unused)
732 {
733 }
734 #endif
735 
736 int thread_state_suspend(uint32_t flags, uint32_t cpsr, vaddr_t pc)
737 {
738 	struct thread_core_local *l = thread_get_core_local();
739 	int ct = l->curr_thread;
740 
741 	assert(ct != -1);
742 
743 	thread_check_canaries();
744 
745 	release_unused_kernel_stack(threads + ct, cpsr);
746 
747 	if (is_from_user(cpsr)) {
748 		thread_user_save_vfp();
749 		tee_ta_update_session_utime_suspend();
750 		tee_ta_gprof_sample_pc(pc);
751 	}
752 	thread_lazy_restore_ns_vfp();
753 
754 	lock_global();
755 
756 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
757 	threads[ct].flags |= flags;
758 	threads[ct].regs.cpsr = cpsr;
759 	threads[ct].regs.pc = pc;
760 	threads[ct].state = THREAD_STATE_SUSPENDED;
761 
762 	threads[ct].have_user_map = core_mmu_user_mapping_is_active();
763 	if (threads[ct].have_user_map) {
764 		core_mmu_get_user_map(&threads[ct].user_map);
765 		core_mmu_set_user_map(NULL);
766 	}
767 
768 	l->curr_thread = -1;
769 
770 	unlock_global();
771 
772 	return ct;
773 }
774 
775 #ifdef ARM32
776 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
777 {
778 	l->tmp_stack_va_end = sp;
779 	thread_set_irq_sp(sp);
780 	thread_set_fiq_sp(sp);
781 }
782 
783 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
784 {
785 	l->abt_stack_va_end = sp;
786 	thread_set_abt_sp((vaddr_t)l);
787 	thread_set_und_sp((vaddr_t)l);
788 }
789 #endif /*ARM32*/
790 
791 #ifdef ARM64
792 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
793 {
794 	/*
795 	 * We're already using the tmp stack when this function is called
796 	 * so there's no need to assign it to any stack pointer. However,
797 	 * we'll need to restore it at different times so store it here.
798 	 */
799 	l->tmp_stack_va_end = sp;
800 }
801 
802 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
803 {
804 	l->abt_stack_va_end = sp;
805 }
806 #endif /*ARM64*/
807 
808 bool thread_init_stack(uint32_t thread_id, vaddr_t sp)
809 {
810 	if (thread_id >= CFG_NUM_THREADS)
811 		return false;
812 	threads[thread_id].stack_va_end = sp;
813 	return true;
814 }
815 
816 int thread_get_id_may_fail(void)
817 {
818 	/*
819 	 * thread_get_core_local() requires foreign interrupts to be disabled
820 	 */
821 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
822 	struct thread_core_local *l = thread_get_core_local();
823 	int ct = l->curr_thread;
824 
825 	thread_unmask_exceptions(exceptions);
826 	return ct;
827 }
828 
829 int thread_get_id(void)
830 {
831 	int ct = thread_get_id_may_fail();
832 
833 	assert(ct >= 0 && ct < CFG_NUM_THREADS);
834 	return ct;
835 }
836 
837 static void init_handlers(const struct thread_handlers *handlers)
838 {
839 	thread_std_smc_handler_ptr = handlers->std_smc;
840 	thread_fast_smc_handler_ptr = handlers->fast_smc;
841 	thread_nintr_handler_ptr = handlers->nintr;
842 	thread_cpu_on_handler_ptr = handlers->cpu_on;
843 	thread_cpu_off_handler_ptr = handlers->cpu_off;
844 	thread_cpu_suspend_handler_ptr = handlers->cpu_suspend;
845 	thread_cpu_resume_handler_ptr = handlers->cpu_resume;
846 	thread_system_off_handler_ptr = handlers->system_off;
847 	thread_system_reset_handler_ptr = handlers->system_reset;
848 }
849 
850 #ifdef CFG_WITH_PAGER
851 static void init_thread_stacks(void)
852 {
853 	size_t n;
854 
855 	/*
856 	 * Allocate virtual memory for thread stacks.
857 	 */
858 	for (n = 0; n < CFG_NUM_THREADS; n++) {
859 		tee_mm_entry_t *mm;
860 		vaddr_t sp;
861 
862 		/* Find vmem for thread stack and its protection gap */
863 		mm = tee_mm_alloc(&tee_mm_vcore,
864 				  SMALL_PAGE_SIZE + STACK_THREAD_SIZE);
865 		assert(mm);
866 
867 		/* Claim eventual physical page */
868 		tee_pager_add_pages(tee_mm_get_smem(mm), tee_mm_get_size(mm),
869 				    true);
870 
871 		/* Add the area to the pager */
872 		tee_pager_add_core_area(tee_mm_get_smem(mm) + SMALL_PAGE_SIZE,
873 					tee_mm_get_bytes(mm) - SMALL_PAGE_SIZE,
874 					TEE_MATTR_PRW | TEE_MATTR_LOCKED,
875 					NULL, NULL);
876 
877 		/* init effective stack */
878 		sp = tee_mm_get_smem(mm) + tee_mm_get_bytes(mm);
879 		asan_tag_access((void *)tee_mm_get_smem(mm), (void *)sp);
880 		if (!thread_init_stack(n, sp))
881 			panic("init stack failed");
882 	}
883 }
884 #else
885 static void init_thread_stacks(void)
886 {
887 	size_t n;
888 
889 	/* Assign the thread stacks */
890 	for (n = 0; n < CFG_NUM_THREADS; n++) {
891 		if (!thread_init_stack(n, GET_STACK(stack_thread[n])))
892 			panic("thread_init_stack failed");
893 	}
894 }
895 #endif /*CFG_WITH_PAGER*/
896 
897 static void init_user_kcode(void)
898 {
899 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
900 	vaddr_t v = (vaddr_t)thread_excp_vect;
901 	vaddr_t ve = (vaddr_t)thread_excp_vect_end;
902 
903 	thread_user_kcode_va = ROUNDDOWN(v, CORE_MMU_USER_CODE_SIZE);
904 	ve = ROUNDUP(ve, CORE_MMU_USER_CODE_SIZE);
905 	thread_user_kcode_size = ve - thread_user_kcode_va;
906 
907 	core_mmu_get_user_va_range(&v, NULL);
908 	thread_user_kcode_offset = thread_user_kcode_va - v;
909 
910 #if defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
911 	/*
912 	 * When transitioning to EL0 subtract SP with this much to point to
913 	 * this special kdata page instead. SP is restored by add this much
914 	 * while transitioning back to EL1.
915 	 */
916 	v += thread_user_kcode_size;
917 	thread_user_kdata_sp_offset = (vaddr_t)thread_core_local - v;
918 #endif
919 #endif /*CFG_CORE_UNMAP_CORE_AT_EL0*/
920 }
921 
922 void thread_init_primary(const struct thread_handlers *handlers)
923 {
924 	init_handlers(handlers);
925 
926 	/* Initialize canaries around the stacks */
927 	init_canaries();
928 
929 	init_thread_stacks();
930 	pgt_init();
931 
932 	init_user_kcode();
933 }
934 
935 static void init_sec_mon(size_t pos __maybe_unused)
936 {
937 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
938 	/* Initialize secure monitor */
939 	sm_init(GET_STACK(stack_tmp[pos]));
940 #endif
941 }
942 
943 static uint32_t __maybe_unused get_midr_implementer(uint32_t midr)
944 {
945 	return (midr >> MIDR_IMPLEMENTER_SHIFT) & MIDR_IMPLEMENTER_MASK;
946 }
947 
948 static uint32_t __maybe_unused get_midr_primary_part(uint32_t midr)
949 {
950 	return (midr >> MIDR_PRIMARY_PART_NUM_SHIFT) &
951 	       MIDR_PRIMARY_PART_NUM_MASK;
952 }
953 
954 #ifdef ARM64
955 static bool probe_workaround_available(void)
956 {
957 	int32_t r;
958 
959 	r = thread_smc(SMCCC_VERSION, 0, 0, 0);
960 	if (r < 0)
961 		return false;
962 	if (r < 0x10001)	/* compare with version 1.1 */
963 		return false;
964 
965 	/* Version >= 1.1, so SMCCC_ARCH_FEATURES is available */
966 	r = thread_smc(SMCCC_ARCH_FEATURES, SMCCC_ARCH_WORKAROUND_1, 0, 0);
967 	return r >= 0;
968 }
969 
970 static vaddr_t select_vector(vaddr_t a)
971 {
972 	if (probe_workaround_available()) {
973 		DMSG("SMCCC_ARCH_WORKAROUND_1 (%#08" PRIx32 ") available",
974 		     SMCCC_ARCH_WORKAROUND_1);
975 		DMSG("SMC Workaround for CVE-2017-5715 used");
976 		return a;
977 	}
978 
979 	DMSG("SMCCC_ARCH_WORKAROUND_1 (%#08" PRIx32 ") unavailable",
980 	     SMCCC_ARCH_WORKAROUND_1);
981 	DMSG("SMC Workaround for CVE-2017-5715 not needed (if ARM-TF is up to date)");
982 	return (vaddr_t)thread_excp_vect;
983 }
984 #else
985 static vaddr_t select_vector(vaddr_t a)
986 {
987 	return a;
988 }
989 #endif
990 
991 static vaddr_t get_excp_vect(void)
992 {
993 #ifdef CFG_CORE_WORKAROUND_SPECTRE_BP_SEC
994 	uint32_t midr = read_midr();
995 
996 	if (get_midr_implementer(midr) != MIDR_IMPLEMENTER_ARM)
997 		return (vaddr_t)thread_excp_vect;
998 
999 	switch (get_midr_primary_part(midr)) {
1000 #ifdef ARM32
1001 	case CORTEX_A8_PART_NUM:
1002 	case CORTEX_A9_PART_NUM:
1003 	case CORTEX_A17_PART_NUM:
1004 #endif
1005 	case CORTEX_A57_PART_NUM:
1006 	case CORTEX_A72_PART_NUM:
1007 	case CORTEX_A73_PART_NUM:
1008 	case CORTEX_A75_PART_NUM:
1009 		return select_vector((vaddr_t)thread_excp_vect_workaround);
1010 #ifdef ARM32
1011 	case CORTEX_A15_PART_NUM:
1012 		return select_vector((vaddr_t)thread_excp_vect_workaround_a15);
1013 #endif
1014 	default:
1015 		return (vaddr_t)thread_excp_vect;
1016 	}
1017 #endif /*CFG_CORE_WORKAROUND_SPECTRE_BP_SEC*/
1018 
1019 	return (vaddr_t)thread_excp_vect;
1020 }
1021 
1022 void thread_init_per_cpu(void)
1023 {
1024 	size_t pos = get_core_pos();
1025 	struct thread_core_local *l = thread_get_core_local();
1026 
1027 	init_sec_mon(pos);
1028 
1029 	set_tmp_stack(l, GET_STACK(stack_tmp[pos]) - STACK_TMP_OFFS);
1030 	set_abt_stack(l, GET_STACK(stack_abt[pos]));
1031 
1032 	thread_init_vbar(get_excp_vect());
1033 }
1034 
1035 struct thread_specific_data *thread_get_tsd(void)
1036 {
1037 	return &threads[thread_get_id()].tsd;
1038 }
1039 
1040 struct thread_ctx_regs *thread_get_ctx_regs(void)
1041 {
1042 	struct thread_core_local *l = thread_get_core_local();
1043 
1044 	assert(l->curr_thread != -1);
1045 	return &threads[l->curr_thread].regs;
1046 }
1047 
1048 void thread_set_foreign_intr(bool enable)
1049 {
1050 	/* thread_get_core_local() requires foreign interrupts to be disabled */
1051 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1052 	struct thread_core_local *l;
1053 
1054 	l = thread_get_core_local();
1055 
1056 	assert(l->curr_thread != -1);
1057 
1058 	if (enable) {
1059 		threads[l->curr_thread].flags |=
1060 					THREAD_FLAGS_FOREIGN_INTR_ENABLE;
1061 		thread_set_exceptions(exceptions & ~THREAD_EXCP_FOREIGN_INTR);
1062 	} else {
1063 		/*
1064 		 * No need to disable foreign interrupts here since they're
1065 		 * already disabled above.
1066 		 */
1067 		threads[l->curr_thread].flags &=
1068 					~THREAD_FLAGS_FOREIGN_INTR_ENABLE;
1069 	}
1070 }
1071 
1072 void thread_restore_foreign_intr(void)
1073 {
1074 	/* thread_get_core_local() requires foreign interrupts to be disabled */
1075 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1076 	struct thread_core_local *l;
1077 
1078 	l = thread_get_core_local();
1079 
1080 	assert(l->curr_thread != -1);
1081 
1082 	if (threads[l->curr_thread].flags & THREAD_FLAGS_FOREIGN_INTR_ENABLE)
1083 		thread_set_exceptions(exceptions & ~THREAD_EXCP_FOREIGN_INTR);
1084 }
1085 
1086 #ifdef CFG_WITH_VFP
1087 uint32_t thread_kernel_enable_vfp(void)
1088 {
1089 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1090 	struct thread_ctx *thr = threads + thread_get_id();
1091 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1092 
1093 	assert(!vfp_is_enabled());
1094 
1095 	if (!thr->vfp_state.ns_saved) {
1096 		vfp_lazy_save_state_final(&thr->vfp_state.ns,
1097 					  thr->vfp_state.ns_force_save);
1098 		thr->vfp_state.ns_saved = true;
1099 	} else if (thr->vfp_state.sec_lazy_saved &&
1100 		   !thr->vfp_state.sec_saved) {
1101 		/*
1102 		 * This happens when we're handling an abort while the
1103 		 * thread was using the VFP state.
1104 		 */
1105 		vfp_lazy_save_state_final(&thr->vfp_state.sec,
1106 					  false /*!force_save*/);
1107 		thr->vfp_state.sec_saved = true;
1108 	} else if (tuv && tuv->lazy_saved && !tuv->saved) {
1109 		/*
1110 		 * This can happen either during syscall or abort
1111 		 * processing (while processing a syscall).
1112 		 */
1113 		vfp_lazy_save_state_final(&tuv->vfp, false /*!force_save*/);
1114 		tuv->saved = true;
1115 	}
1116 
1117 	vfp_enable();
1118 	return exceptions;
1119 }
1120 
1121 void thread_kernel_disable_vfp(uint32_t state)
1122 {
1123 	uint32_t exceptions;
1124 
1125 	assert(vfp_is_enabled());
1126 
1127 	vfp_disable();
1128 	exceptions = thread_get_exceptions();
1129 	assert(exceptions & THREAD_EXCP_FOREIGN_INTR);
1130 	exceptions &= ~THREAD_EXCP_FOREIGN_INTR;
1131 	exceptions |= state & THREAD_EXCP_FOREIGN_INTR;
1132 	thread_set_exceptions(exceptions);
1133 }
1134 
1135 void thread_kernel_save_vfp(void)
1136 {
1137 	struct thread_ctx *thr = threads + thread_get_id();
1138 
1139 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1140 	if (vfp_is_enabled()) {
1141 		vfp_lazy_save_state_init(&thr->vfp_state.sec);
1142 		thr->vfp_state.sec_lazy_saved = true;
1143 	}
1144 }
1145 
1146 void thread_kernel_restore_vfp(void)
1147 {
1148 	struct thread_ctx *thr = threads + thread_get_id();
1149 
1150 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1151 	assert(!vfp_is_enabled());
1152 	if (thr->vfp_state.sec_lazy_saved) {
1153 		vfp_lazy_restore_state(&thr->vfp_state.sec,
1154 				       thr->vfp_state.sec_saved);
1155 		thr->vfp_state.sec_saved = false;
1156 		thr->vfp_state.sec_lazy_saved = false;
1157 	}
1158 }
1159 
1160 void thread_user_enable_vfp(struct thread_user_vfp_state *uvfp)
1161 {
1162 	struct thread_ctx *thr = threads + thread_get_id();
1163 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1164 
1165 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1166 	assert(!vfp_is_enabled());
1167 
1168 	if (!thr->vfp_state.ns_saved) {
1169 		vfp_lazy_save_state_final(&thr->vfp_state.ns,
1170 					  thr->vfp_state.ns_force_save);
1171 		thr->vfp_state.ns_saved = true;
1172 	} else if (tuv && uvfp != tuv) {
1173 		if (tuv->lazy_saved && !tuv->saved) {
1174 			vfp_lazy_save_state_final(&tuv->vfp,
1175 						  false /*!force_save*/);
1176 			tuv->saved = true;
1177 		}
1178 	}
1179 
1180 	if (uvfp->lazy_saved)
1181 		vfp_lazy_restore_state(&uvfp->vfp, uvfp->saved);
1182 	uvfp->lazy_saved = false;
1183 	uvfp->saved = false;
1184 
1185 	thr->vfp_state.uvfp = uvfp;
1186 	vfp_enable();
1187 }
1188 
1189 void thread_user_save_vfp(void)
1190 {
1191 	struct thread_ctx *thr = threads + thread_get_id();
1192 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1193 
1194 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1195 	if (!vfp_is_enabled())
1196 		return;
1197 
1198 	assert(tuv && !tuv->lazy_saved && !tuv->saved);
1199 	vfp_lazy_save_state_init(&tuv->vfp);
1200 	tuv->lazy_saved = true;
1201 }
1202 
1203 void thread_user_clear_vfp(struct thread_user_vfp_state *uvfp)
1204 {
1205 	struct thread_ctx *thr = threads + thread_get_id();
1206 
1207 	if (uvfp == thr->vfp_state.uvfp)
1208 		thr->vfp_state.uvfp = NULL;
1209 	uvfp->lazy_saved = false;
1210 	uvfp->saved = false;
1211 }
1212 #endif /*CFG_WITH_VFP*/
1213 
1214 #ifdef ARM32
1215 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1216 {
1217 	uint32_t s;
1218 
1219 	if (!is_32bit)
1220 		return false;
1221 
1222 	s = read_spsr();
1223 	s &= ~(CPSR_MODE_MASK | CPSR_T | CPSR_IT_MASK1 | CPSR_IT_MASK2);
1224 	s |= CPSR_MODE_USR;
1225 	if (entry_func & 1)
1226 		s |= CPSR_T;
1227 	*spsr = s;
1228 	return true;
1229 }
1230 #endif
1231 
1232 #ifdef ARM64
1233 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1234 {
1235 	uint32_t s;
1236 
1237 	if (is_32bit) {
1238 		s = read_daif() & (SPSR_32_AIF_MASK << SPSR_32_AIF_SHIFT);
1239 		s |= SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT;
1240 		s |= (entry_func & SPSR_32_T_MASK) << SPSR_32_T_SHIFT;
1241 	} else {
1242 		s = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
1243 	}
1244 
1245 	*spsr = s;
1246 	return true;
1247 }
1248 #endif
1249 
1250 uint32_t thread_enter_user_mode(unsigned long a0, unsigned long a1,
1251 		unsigned long a2, unsigned long a3, unsigned long user_sp,
1252 		unsigned long entry_func, bool is_32bit,
1253 		uint32_t *exit_status0, uint32_t *exit_status1)
1254 {
1255 	uint32_t spsr;
1256 
1257 	tee_ta_update_session_utime_resume();
1258 
1259 	if (!get_spsr(is_32bit, entry_func, &spsr)) {
1260 		*exit_status0 = 1; /* panic */
1261 		*exit_status1 = 0xbadbadba;
1262 		return 0;
1263 	}
1264 	return __thread_enter_user_mode(a0, a1, a2, a3, user_sp, entry_func,
1265 					spsr, exit_status0, exit_status1);
1266 }
1267 
1268 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
1269 void thread_get_user_kcode(struct mobj **mobj, size_t *offset,
1270 			   vaddr_t *va, size_t *sz)
1271 {
1272 	core_mmu_get_user_va_range(va, NULL);
1273 	*mobj = mobj_tee_ram;
1274 	*offset = thread_user_kcode_va - TEE_RAM_START;
1275 	*sz = thread_user_kcode_size;
1276 }
1277 #endif
1278 
1279 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
1280 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
1281 void thread_get_user_kdata(struct mobj **mobj, size_t *offset,
1282 			   vaddr_t *va, size_t *sz)
1283 {
1284 	vaddr_t v;
1285 
1286 	core_mmu_get_user_va_range(&v, NULL);
1287 	*va = v + thread_user_kcode_size;
1288 	*mobj = mobj_tee_ram;
1289 	*offset = (vaddr_t)thread_user_kdata_page - TEE_RAM_START;
1290 	*sz = sizeof(thread_user_kdata_page);
1291 }
1292 #endif
1293 
1294 void thread_add_mutex(struct mutex *m)
1295 {
1296 	struct thread_core_local *l = thread_get_core_local();
1297 	int ct = l->curr_thread;
1298 
1299 	assert(ct != -1 && threads[ct].state == THREAD_STATE_ACTIVE);
1300 	assert(m->owner_id == MUTEX_OWNER_ID_NONE);
1301 	m->owner_id = ct;
1302 	TAILQ_INSERT_TAIL(&threads[ct].mutexes, m, link);
1303 }
1304 
1305 void thread_rem_mutex(struct mutex *m)
1306 {
1307 	struct thread_core_local *l = thread_get_core_local();
1308 	int ct = l->curr_thread;
1309 
1310 	assert(ct != -1 && threads[ct].state == THREAD_STATE_ACTIVE);
1311 	assert(m->owner_id == ct);
1312 	m->owner_id = MUTEX_OWNER_ID_NONE;
1313 	TAILQ_REMOVE(&threads[ct].mutexes, m, link);
1314 }
1315 
1316 bool thread_disable_prealloc_rpc_cache(uint64_t *cookie)
1317 {
1318 	bool rv;
1319 	size_t n;
1320 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1321 
1322 	lock_global();
1323 
1324 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1325 		if (threads[n].state != THREAD_STATE_FREE) {
1326 			rv = false;
1327 			goto out;
1328 		}
1329 	}
1330 
1331 	rv = true;
1332 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1333 		if (threads[n].rpc_arg) {
1334 			mobj_free(threads[n].rpc_mobj);
1335 			*cookie = threads[n].rpc_carg;
1336 			threads[n].rpc_carg = 0;
1337 			threads[n].rpc_arg = NULL;
1338 			goto out;
1339 		}
1340 	}
1341 
1342 	*cookie = 0;
1343 	thread_prealloc_rpc_cache = false;
1344 out:
1345 	unlock_global();
1346 	thread_unmask_exceptions(exceptions);
1347 	return rv;
1348 }
1349 
1350 bool thread_enable_prealloc_rpc_cache(void)
1351 {
1352 	bool rv;
1353 	size_t n;
1354 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1355 
1356 	lock_global();
1357 
1358 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1359 		if (threads[n].state != THREAD_STATE_FREE) {
1360 			rv = false;
1361 			goto out;
1362 		}
1363 	}
1364 
1365 	rv = true;
1366 	thread_prealloc_rpc_cache = true;
1367 out:
1368 	unlock_global();
1369 	thread_unmask_exceptions(exceptions);
1370 	return rv;
1371 }
1372 
1373 /**
1374  * Allocates data for struct optee_msg_arg.
1375  *
1376  * @size:	size in bytes of struct optee_msg_arg
1377  * @cookie:	returned cookie used when freeing the buffer
1378  *
1379  * @returns	mobj that describes allocated buffer or NULL on error
1380  */
1381 static struct mobj *thread_rpc_alloc_arg(size_t size, uint64_t *cookie)
1382 {
1383 	paddr_t pa;
1384 	uint64_t co;
1385 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1386 		OPTEE_SMC_RETURN_RPC_ALLOC, size
1387 	};
1388 	struct mobj *mobj = NULL;
1389 
1390 	thread_rpc(rpc_args);
1391 
1392 	pa = reg_pair_to_64(rpc_args[1], rpc_args[2]);
1393 	co = reg_pair_to_64(rpc_args[4], rpc_args[5]);
1394 
1395 	if (!ALIGNMENT_IS_OK(pa, struct optee_msg_arg))
1396 		goto err;
1397 
1398 	/* Check if this region is in static shared space */
1399 	if (core_pbuf_is(CORE_MEM_NSEC_SHM, pa, size))
1400 		mobj = mobj_shm_alloc(pa, size);
1401 	else if ((!(pa & SMALL_PAGE_MASK)) && size <= SMALL_PAGE_SIZE)
1402 		mobj = mobj_mapped_shm_alloc(&pa, 1, 0, co);
1403 
1404 	if (!mobj)
1405 		goto err;
1406 
1407 	*cookie = co;
1408 	return mobj;
1409 err:
1410 	thread_rpc_free_arg(co);
1411 	mobj_free(mobj);
1412 	*cookie = 0;
1413 	return NULL;
1414 }
1415 
1416 static bool get_rpc_arg(uint32_t cmd, size_t num_params,
1417 			struct optee_msg_arg **arg_ret, uint64_t *carg_ret)
1418 {
1419 	struct thread_ctx *thr = threads + thread_get_id();
1420 	struct optee_msg_arg *arg = thr->rpc_arg;
1421 	struct mobj *mobj;
1422 	size_t sz = OPTEE_MSG_GET_ARG_SIZE(THREAD_RPC_MAX_NUM_PARAMS);
1423 	uint64_t c;
1424 
1425 	if (num_params > THREAD_RPC_MAX_NUM_PARAMS)
1426 		return false;
1427 
1428 	if (!arg) {
1429 		mobj = thread_rpc_alloc_arg(sz, &c);
1430 		if (!mobj)
1431 			return false;
1432 
1433 		arg = mobj_get_va(mobj, 0);
1434 		if (!arg)
1435 			goto bad;
1436 
1437 		thr->rpc_arg = arg;
1438 		thr->rpc_carg = c;
1439 		thr->rpc_mobj = mobj;
1440 	}
1441 
1442 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
1443 	arg->cmd = cmd;
1444 	arg->num_params = num_params;
1445 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1446 
1447 	*arg_ret = arg;
1448 	*carg_ret = thr->rpc_carg;
1449 	return true;
1450 
1451 bad:
1452 	thread_rpc_free_arg(c);
1453 	return false;
1454 }
1455 
1456 uint32_t thread_rpc_cmd(uint32_t cmd, size_t num_params,
1457 			struct optee_msg_param *params)
1458 {
1459 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1460 	struct optee_msg_arg *arg;
1461 	uint64_t carg;
1462 	size_t n;
1463 
1464 	/* The source CRYPTO_RNG_SRC_JITTER_RPC is safe to use here */
1465 	plat_prng_add_jitter_entropy(CRYPTO_RNG_SRC_JITTER_RPC,
1466 				     &thread_rpc_pnum);
1467 
1468 	if (!get_rpc_arg(cmd, num_params, &arg, &carg))
1469 		return TEE_ERROR_OUT_OF_MEMORY;
1470 
1471 	memcpy(arg->params, params, sizeof(*params) * num_params);
1472 
1473 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1474 	thread_rpc(rpc_args);
1475 	for (n = 0; n < num_params; n++) {
1476 		switch (params[n].attr & OPTEE_MSG_ATTR_TYPE_MASK) {
1477 		case OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT:
1478 		case OPTEE_MSG_ATTR_TYPE_VALUE_INOUT:
1479 		case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT:
1480 		case OPTEE_MSG_ATTR_TYPE_RMEM_INOUT:
1481 		case OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT:
1482 		case OPTEE_MSG_ATTR_TYPE_TMEM_INOUT:
1483 			params[n] = arg->params[n];
1484 			break;
1485 		default:
1486 			break;
1487 		}
1488 	}
1489 	return arg->ret;
1490 }
1491 
1492 /**
1493  * Free physical memory previously allocated with thread_rpc_alloc()
1494  *
1495  * @cookie:	cookie received when allocating the buffer
1496  * @bt:		must be the same as supplied when allocating
1497  * @mobj:	mobj that describes allocated buffer
1498  *
1499  * This function also frees corresponding mobj.
1500  */
1501 static void thread_rpc_free(unsigned int bt, uint64_t cookie, struct mobj *mobj)
1502 {
1503 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1504 	struct optee_msg_arg *arg;
1505 	uint64_t carg;
1506 
1507 	if (!get_rpc_arg(OPTEE_MSG_RPC_CMD_SHM_FREE, 1, &arg, &carg))
1508 		return;
1509 
1510 	arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1511 	arg->params[0].u.value.a = bt;
1512 	arg->params[0].u.value.b = cookie;
1513 	arg->params[0].u.value.c = 0;
1514 
1515 	mobj_free(mobj);
1516 
1517 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1518 	thread_rpc(rpc_args);
1519 }
1520 
1521 /**
1522  * Allocates shared memory buffer via RPC
1523  *
1524  * @size:	size in bytes of shared memory buffer
1525  * @align:	required alignment of buffer
1526  * @bt:		buffer type OPTEE_MSG_RPC_SHM_TYPE_*
1527  * @payload:	returned physical pointer to buffer, 0 if allocation
1528  *		failed.
1529  * @cookie:	returned cookie used when freeing the buffer
1530  */
1531 static struct mobj *thread_rpc_alloc(size_t size, size_t align, unsigned int bt,
1532 				     uint64_t *cookie)
1533 {
1534 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1535 	struct optee_msg_arg *arg;
1536 	uint64_t carg;
1537 	struct mobj *mobj = NULL;
1538 
1539 	if (!get_rpc_arg(OPTEE_MSG_RPC_CMD_SHM_ALLOC, 1, &arg, &carg))
1540 		goto fail;
1541 
1542 	arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1543 	arg->params[0].u.value.a = bt;
1544 	arg->params[0].u.value.b = size;
1545 	arg->params[0].u.value.c = align;
1546 
1547 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1548 	thread_rpc(rpc_args);
1549 
1550 	if (arg->ret != TEE_SUCCESS)
1551 		goto fail;
1552 
1553 	if (arg->num_params != 1)
1554 		goto fail;
1555 
1556 	if (arg->params[0].attr == OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT) {
1557 		*cookie = arg->params[0].u.tmem.shm_ref;
1558 		mobj = mobj_shm_alloc(arg->params[0].u.tmem.buf_ptr,
1559 				      arg->params[0].u.tmem.size);
1560 	} else if (arg->params[0].attr == (OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT |
1561 					   OPTEE_MSG_ATTR_NONCONTIG)) {
1562 		*cookie = arg->params[0].u.tmem.shm_ref;
1563 		mobj = msg_param_mobj_from_noncontig(
1564 			arg->params[0].u.tmem.buf_ptr,
1565 			arg->params[0].u.tmem.size,
1566 			*cookie,
1567 			true);
1568 	} else
1569 		goto fail;
1570 
1571 	if (!mobj)
1572 		goto free_first;
1573 
1574 	assert(mobj_is_nonsec(mobj));
1575 	return mobj;
1576 
1577 free_first:
1578 	thread_rpc_free(bt, *cookie, mobj);
1579 fail:
1580 	*cookie = 0;
1581 	return NULL;
1582 }
1583 
1584 struct mobj *thread_rpc_alloc_payload(size_t size, uint64_t *cookie)
1585 {
1586 	return thread_rpc_alloc(size, 8, OPTEE_MSG_RPC_SHM_TYPE_APPL, cookie);
1587 }
1588 
1589 void thread_rpc_free_payload(uint64_t cookie, struct mobj *mobj)
1590 {
1591 	thread_rpc_free(OPTEE_MSG_RPC_SHM_TYPE_APPL, cookie, mobj);
1592 }
1593 
1594 struct mobj *thread_rpc_alloc_global_payload(size_t size, uint64_t *cookie)
1595 {
1596 	return thread_rpc_alloc(size, 8, OPTEE_MSG_RPC_SHM_TYPE_GLOBAL, cookie);
1597 }
1598 
1599 void thread_rpc_free_global_payload(uint64_t cookie, struct mobj *mobj)
1600 {
1601 	thread_rpc_free(OPTEE_MSG_RPC_SHM_TYPE_GLOBAL, cookie, mobj);
1602 }
1603