xref: /optee_os/core/arch/arm/kernel/thread.c (revision c2f5808039471d8cb9ac43385b63fb8dc6aa8ac4)
1 /*
2  * Copyright (c) 2016, Linaro Limited
3  * Copyright (c) 2014, STMicroelectronics International N.V.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright notice,
10  * this list of conditions and the following disclaimer.
11  *
12  * 2. Redistributions in binary form must reproduce the above copyright notice,
13  * this list of conditions and the following disclaimer in the documentation
14  * and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 #include <platform_config.h>
29 #include <kernel/panic.h>
30 #include <kernel/thread.h>
31 #include <kernel/thread_defs.h>
32 #include "thread_private.h"
33 #include <sm/sm_defs.h>
34 #include <sm/sm.h>
35 #include <optee_msg.h>
36 #include <sm/optee_smc.h>
37 #include <arm.h>
38 #include <kernel/tz_proc_def.h>
39 #include <kernel/tz_proc.h>
40 #include <kernel/misc.h>
41 #include <mm/tee_mmu.h>
42 #include <mm/core_memprot.h>
43 #include <mm/tee_mmu_defs.h>
44 #include <mm/tee_mm.h>
45 #include <mm/tee_pager.h>
46 #include <kernel/tee_ta_manager.h>
47 #include <util.h>
48 #include <trace.h>
49 #include <assert.h>
50 
51 #ifdef ARM32
52 #define STACK_TMP_SIZE		1024
53 #define STACK_THREAD_SIZE	8192
54 
55 #if TRACE_LEVEL > 0
56 #define STACK_ABT_SIZE		2048
57 #else
58 #define STACK_ABT_SIZE		1024
59 #endif
60 
61 #endif /*ARM32*/
62 
63 #ifdef ARM64
64 #define STACK_TMP_SIZE		2048
65 #define STACK_THREAD_SIZE	8192
66 
67 #if TRACE_LEVEL > 0
68 #define STACK_ABT_SIZE		3072
69 #else
70 #define STACK_ABT_SIZE		1024
71 #endif
72 #endif /*ARM64*/
73 
74 #define RPC_MAX_NUM_PARAMS	2
75 
76 struct thread_ctx threads[CFG_NUM_THREADS];
77 
78 static struct thread_core_local thread_core_local[CFG_TEE_CORE_NB_CORE];
79 
80 #ifdef CFG_WITH_STACK_CANARIES
81 #ifdef ARM32
82 #define STACK_CANARY_SIZE	(4 * sizeof(uint32_t))
83 #endif
84 #ifdef ARM64
85 #define STACK_CANARY_SIZE	(8 * sizeof(uint32_t))
86 #endif
87 #define START_CANARY_VALUE	0xdededede
88 #define END_CANARY_VALUE	0xabababab
89 #define GET_START_CANARY(name, stack_num) name[stack_num][0]
90 #define GET_END_CANARY(name, stack_num) \
91 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
92 #else
93 #define STACK_CANARY_SIZE	0
94 #endif
95 
96 #define DECLARE_STACK(name, num_stacks, stack_size) \
97 	static uint32_t name[num_stacks][ \
98 		ROUNDUP(stack_size + STACK_CANARY_SIZE, STACK_ALIGNMENT) / \
99 		sizeof(uint32_t)] \
100 		__attribute__((section(".nozi.stack"), \
101 			       aligned(STACK_ALIGNMENT)))
102 
103 #define GET_STACK(stack) \
104 	((vaddr_t)(stack) + sizeof(stack) - STACK_CANARY_SIZE / 2)
105 
106 DECLARE_STACK(stack_tmp,	CFG_TEE_CORE_NB_CORE,	STACK_TMP_SIZE);
107 DECLARE_STACK(stack_abt,	CFG_TEE_CORE_NB_CORE,	STACK_ABT_SIZE);
108 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
109 DECLARE_STACK(stack_sm,		CFG_TEE_CORE_NB_CORE,	SM_STACK_SIZE);
110 #endif
111 #ifndef CFG_WITH_PAGER
112 DECLARE_STACK(stack_thread,	CFG_NUM_THREADS,	STACK_THREAD_SIZE);
113 #endif
114 
115 const vaddr_t stack_tmp_top[CFG_TEE_CORE_NB_CORE] = {
116 	GET_STACK(stack_tmp[0]),
117 #if CFG_TEE_CORE_NB_CORE > 1
118 	GET_STACK(stack_tmp[1]),
119 #endif
120 #if CFG_TEE_CORE_NB_CORE > 2
121 	GET_STACK(stack_tmp[2]),
122 #endif
123 #if CFG_TEE_CORE_NB_CORE > 3
124 	GET_STACK(stack_tmp[3]),
125 #endif
126 #if CFG_TEE_CORE_NB_CORE > 4
127 	GET_STACK(stack_tmp[4]),
128 #endif
129 #if CFG_TEE_CORE_NB_CORE > 5
130 	GET_STACK(stack_tmp[5]),
131 #endif
132 #if CFG_TEE_CORE_NB_CORE > 6
133 	GET_STACK(stack_tmp[6]),
134 #endif
135 #if CFG_TEE_CORE_NB_CORE > 7
136 	GET_STACK(stack_tmp[7]),
137 #endif
138 #if CFG_TEE_CORE_NB_CORE > 8
139 #error "Top of tmp stacks aren't defined for more than 8 CPUS"
140 #endif
141 };
142 
143 thread_smc_handler_t thread_std_smc_handler_ptr;
144 static thread_smc_handler_t thread_fast_smc_handler_ptr;
145 thread_fiq_handler_t thread_fiq_handler_ptr;
146 thread_pm_handler_t thread_cpu_on_handler_ptr;
147 thread_pm_handler_t thread_cpu_off_handler_ptr;
148 thread_pm_handler_t thread_cpu_suspend_handler_ptr;
149 thread_pm_handler_t thread_cpu_resume_handler_ptr;
150 thread_pm_handler_t thread_system_off_handler_ptr;
151 thread_pm_handler_t thread_system_reset_handler_ptr;
152 
153 
154 static unsigned int thread_global_lock = SPINLOCK_UNLOCK;
155 static bool thread_prealloc_rpc_cache;
156 
157 static void init_canaries(void)
158 {
159 #ifdef CFG_WITH_STACK_CANARIES
160 	size_t n;
161 #define INIT_CANARY(name)						\
162 	for (n = 0; n < ARRAY_SIZE(name); n++) {			\
163 		uint32_t *start_canary = &GET_START_CANARY(name, n);	\
164 		uint32_t *end_canary = &GET_END_CANARY(name, n);	\
165 									\
166 		*start_canary = START_CANARY_VALUE;			\
167 		*end_canary = END_CANARY_VALUE;				\
168 		DMSG("#Stack canaries for %s[%zu] with top at %p\n",	\
169 			#name, n, (void *)(end_canary - 1));		\
170 		DMSG("watch *%p\n", (void *)end_canary);		\
171 	}
172 
173 	INIT_CANARY(stack_tmp);
174 	INIT_CANARY(stack_abt);
175 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
176 	INIT_CANARY(stack_sm);
177 #endif
178 #ifndef CFG_WITH_PAGER
179 	INIT_CANARY(stack_thread);
180 #endif
181 #endif/*CFG_WITH_STACK_CANARIES*/
182 }
183 
184 void thread_check_canaries(void)
185 {
186 #ifdef CFG_WITH_STACK_CANARIES
187 	size_t n;
188 
189 	for (n = 0; n < ARRAY_SIZE(stack_tmp); n++) {
190 		assert(GET_START_CANARY(stack_tmp, n) == START_CANARY_VALUE);
191 		assert(GET_END_CANARY(stack_tmp, n) == END_CANARY_VALUE);
192 	}
193 
194 	for (n = 0; n < ARRAY_SIZE(stack_abt); n++) {
195 		assert(GET_START_CANARY(stack_abt, n) == START_CANARY_VALUE);
196 		assert(GET_END_CANARY(stack_abt, n) == END_CANARY_VALUE);
197 	}
198 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
199 	for (n = 0; n < ARRAY_SIZE(stack_sm); n++) {
200 		assert(GET_START_CANARY(stack_sm, n) == START_CANARY_VALUE);
201 		assert(GET_END_CANARY(stack_sm, n) == END_CANARY_VALUE);
202 	}
203 #endif
204 #ifndef CFG_WITH_PAGER
205 	for (n = 0; n < ARRAY_SIZE(stack_thread); n++) {
206 		assert(GET_START_CANARY(stack_thread, n) == START_CANARY_VALUE);
207 		assert(GET_END_CANARY(stack_thread, n) == END_CANARY_VALUE);
208 	}
209 #endif
210 #endif/*CFG_WITH_STACK_CANARIES*/
211 }
212 
213 static void lock_global(void)
214 {
215 	cpu_spin_lock(&thread_global_lock);
216 }
217 
218 static void unlock_global(void)
219 {
220 	cpu_spin_unlock(&thread_global_lock);
221 }
222 
223 #ifdef ARM32
224 uint32_t thread_get_exceptions(void)
225 {
226 	uint32_t cpsr = read_cpsr();
227 
228 	return (cpsr >> CPSR_F_SHIFT) & THREAD_EXCP_ALL;
229 }
230 
231 void thread_set_exceptions(uint32_t exceptions)
232 {
233 	uint32_t cpsr = read_cpsr();
234 
235 	cpsr &= ~(THREAD_EXCP_ALL << CPSR_F_SHIFT);
236 	cpsr |= ((exceptions & THREAD_EXCP_ALL) << CPSR_F_SHIFT);
237 	write_cpsr(cpsr);
238 }
239 #endif /*ARM32*/
240 
241 #ifdef ARM64
242 uint32_t thread_get_exceptions(void)
243 {
244 	uint32_t daif = read_daif();
245 
246 	return (daif >> DAIF_F_SHIFT) & THREAD_EXCP_ALL;
247 }
248 
249 void thread_set_exceptions(uint32_t exceptions)
250 {
251 	uint32_t daif = read_daif();
252 
253 	daif &= ~(THREAD_EXCP_ALL << DAIF_F_SHIFT);
254 	daif |= ((exceptions & THREAD_EXCP_ALL) << DAIF_F_SHIFT);
255 	write_daif(daif);
256 }
257 #endif /*ARM64*/
258 
259 uint32_t thread_mask_exceptions(uint32_t exceptions)
260 {
261 	uint32_t state = thread_get_exceptions();
262 
263 	thread_set_exceptions(state | (exceptions & THREAD_EXCP_ALL));
264 	return state;
265 }
266 
267 void thread_unmask_exceptions(uint32_t state)
268 {
269 	thread_set_exceptions(state & THREAD_EXCP_ALL);
270 }
271 
272 
273 struct thread_core_local *thread_get_core_local(void)
274 {
275 	uint32_t cpu_id = get_core_pos();
276 
277 	/*
278 	 * IRQs must be disabled before playing with core_local since
279 	 * we otherwise may be rescheduled to a different core in the
280 	 * middle of this function.
281 	 */
282 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
283 
284 	assert(cpu_id < CFG_TEE_CORE_NB_CORE);
285 	return &thread_core_local[cpu_id];
286 }
287 
288 static void thread_lazy_save_ns_vfp(void)
289 {
290 #ifdef CFG_WITH_VFP
291 	struct thread_ctx *thr = threads + thread_get_id();
292 
293 	thr->vfp_state.ns_saved = false;
294 #if defined(ARM64) && defined(CFG_WITH_ARM_TRUSTED_FW)
295 	/*
296 	 * ARM TF saves and restores CPACR_EL1, so we must assume NS world
297 	 * uses VFP and always preserve the register file when secure world
298 	 * is about to use it
299 	 */
300 	thr->vfp_state.ns.force_save = true;
301 #endif
302 	vfp_lazy_save_state_init(&thr->vfp_state.ns);
303 #endif /*CFG_WITH_VFP*/
304 }
305 
306 static void thread_lazy_restore_ns_vfp(void)
307 {
308 #ifdef CFG_WITH_VFP
309 	struct thread_ctx *thr = threads + thread_get_id();
310 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
311 
312 	assert(!thr->vfp_state.sec_lazy_saved && !thr->vfp_state.sec_saved);
313 
314 	if (tuv && tuv->lazy_saved && !tuv->saved) {
315 		vfp_lazy_save_state_final(&tuv->vfp);
316 		tuv->saved = true;
317 	}
318 
319 	vfp_lazy_restore_state(&thr->vfp_state.ns, thr->vfp_state.ns_saved);
320 	thr->vfp_state.ns_saved = false;
321 #endif /*CFG_WITH_VFP*/
322 }
323 
324 #ifdef ARM32
325 static void init_regs(struct thread_ctx *thread,
326 		struct thread_smc_args *args)
327 {
328 	thread->regs.pc = (uint32_t)thread_std_smc_entry;
329 
330 	/*
331 	 * Stdcalls starts in SVC mode with masked IRQ, masked Asynchronous
332 	 * abort and unmasked FIQ.
333 	  */
334 	thread->regs.cpsr = read_cpsr() & ARM32_CPSR_E;
335 	thread->regs.cpsr |= CPSR_MODE_SVC | CPSR_I | CPSR_A;
336 	/* Enable thumb mode if it's a thumb instruction */
337 	if (thread->regs.pc & 1)
338 		thread->regs.cpsr |= CPSR_T;
339 	/* Reinitialize stack pointer */
340 	thread->regs.svc_sp = thread->stack_va_end;
341 
342 	/*
343 	 * Copy arguments into context. This will make the
344 	 * arguments appear in r0-r7 when thread is started.
345 	 */
346 	thread->regs.r0 = args->a0;
347 	thread->regs.r1 = args->a1;
348 	thread->regs.r2 = args->a2;
349 	thread->regs.r3 = args->a3;
350 	thread->regs.r4 = args->a4;
351 	thread->regs.r5 = args->a5;
352 	thread->regs.r6 = args->a6;
353 	thread->regs.r7 = args->a7;
354 }
355 #endif /*ARM32*/
356 
357 #ifdef ARM64
358 static void init_regs(struct thread_ctx *thread,
359 		struct thread_smc_args *args)
360 {
361 	thread->regs.pc = (uint64_t)thread_std_smc_entry;
362 
363 	/*
364 	 * Stdcalls starts in SVC mode with masked IRQ, masked Asynchronous
365 	 * abort and unmasked FIQ.
366 	  */
367 	thread->regs.cpsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0,
368 				    DAIFBIT_IRQ | DAIFBIT_ABT);
369 	/* Reinitialize stack pointer */
370 	thread->regs.sp = thread->stack_va_end;
371 
372 	/*
373 	 * Copy arguments into context. This will make the
374 	 * arguments appear in x0-x7 when thread is started.
375 	 */
376 	thread->regs.x[0] = args->a0;
377 	thread->regs.x[1] = args->a1;
378 	thread->regs.x[2] = args->a2;
379 	thread->regs.x[3] = args->a3;
380 	thread->regs.x[4] = args->a4;
381 	thread->regs.x[5] = args->a5;
382 	thread->regs.x[6] = args->a6;
383 	thread->regs.x[7] = args->a7;
384 }
385 #endif /*ARM64*/
386 
387 void thread_init_boot_thread(void)
388 {
389 	struct thread_core_local *l = thread_get_core_local();
390 	size_t n;
391 
392 	for (n = 0; n < CFG_NUM_THREADS; n++) {
393 		TAILQ_INIT(&threads[n].mutexes);
394 		TAILQ_INIT(&threads[n].tsd.sess_stack);
395 #ifdef CFG_SMALL_PAGE_USER_TA
396 		SLIST_INIT(&threads[n].tsd.pgt_cache);
397 #endif
398 	}
399 
400 	for (n = 0; n < CFG_TEE_CORE_NB_CORE; n++)
401 		thread_core_local[n].curr_thread = -1;
402 
403 	l->curr_thread = 0;
404 	threads[0].state = THREAD_STATE_ACTIVE;
405 }
406 
407 void thread_clr_boot_thread(void)
408 {
409 	struct thread_core_local *l = thread_get_core_local();
410 
411 	assert(l->curr_thread >= 0 && l->curr_thread < CFG_NUM_THREADS);
412 	assert(threads[l->curr_thread].state == THREAD_STATE_ACTIVE);
413 	assert(TAILQ_EMPTY(&threads[l->curr_thread].mutexes));
414 	threads[l->curr_thread].state = THREAD_STATE_FREE;
415 	l->curr_thread = -1;
416 }
417 
418 static void thread_alloc_and_run(struct thread_smc_args *args)
419 {
420 	size_t n;
421 	struct thread_core_local *l = thread_get_core_local();
422 	bool found_thread = false;
423 
424 	assert(l->curr_thread == -1);
425 
426 	lock_global();
427 
428 	for (n = 0; n < CFG_NUM_THREADS; n++) {
429 		if (threads[n].state == THREAD_STATE_FREE) {
430 			threads[n].state = THREAD_STATE_ACTIVE;
431 			found_thread = true;
432 			break;
433 		}
434 	}
435 
436 	unlock_global();
437 
438 	if (!found_thread) {
439 		args->a0 = OPTEE_SMC_RETURN_ETHREAD_LIMIT;
440 		return;
441 	}
442 
443 	l->curr_thread = n;
444 
445 	threads[n].flags = 0;
446 	init_regs(threads + n, args);
447 
448 	/* Save Hypervisor Client ID */
449 	threads[n].hyp_clnt_id = args->a7;
450 
451 	thread_lazy_save_ns_vfp();
452 	thread_resume(&threads[n].regs);
453 }
454 
455 #ifdef ARM32
456 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
457 		struct thread_smc_args *args)
458 {
459 	/*
460 	 * Update returned values from RPC, values will appear in
461 	 * r0-r3 when thread is resumed.
462 	 */
463 	regs->r0 = args->a0;
464 	regs->r1 = args->a1;
465 	regs->r2 = args->a2;
466 	regs->r3 = args->a3;
467 	regs->r4 = args->a4;
468 	regs->r5 = args->a5;
469 }
470 #endif /*ARM32*/
471 
472 #ifdef ARM64
473 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
474 		struct thread_smc_args *args)
475 {
476 	/*
477 	 * Update returned values from RPC, values will appear in
478 	 * x0-x3 when thread is resumed.
479 	 */
480 	regs->x[0] = args->a0;
481 	regs->x[1] = args->a1;
482 	regs->x[2] = args->a2;
483 	regs->x[3] = args->a3;
484 	regs->x[4] = args->a4;
485 	regs->x[5] = args->a5;
486 }
487 #endif /*ARM64*/
488 
489 static void thread_resume_from_rpc(struct thread_smc_args *args)
490 {
491 	size_t n = args->a3; /* thread id */
492 	struct thread_core_local *l = thread_get_core_local();
493 	uint32_t rv = 0;
494 
495 	assert(l->curr_thread == -1);
496 
497 	lock_global();
498 
499 	if (n < CFG_NUM_THREADS &&
500 	    threads[n].state == THREAD_STATE_SUSPENDED &&
501 	    args->a7 == threads[n].hyp_clnt_id)
502 		threads[n].state = THREAD_STATE_ACTIVE;
503 	else
504 		rv = OPTEE_SMC_RETURN_ERESUME;
505 
506 	unlock_global();
507 
508 	if (rv) {
509 		args->a0 = rv;
510 		return;
511 	}
512 
513 	l->curr_thread = n;
514 
515 	if (threads[n].have_user_map)
516 		core_mmu_set_user_map(&threads[n].user_map);
517 
518 	/*
519 	 * Return from RPC to request service of an IRQ must not
520 	 * get parameters from non-secure world.
521 	 */
522 	if (threads[n].flags & THREAD_FLAGS_COPY_ARGS_ON_RETURN) {
523 		copy_a0_to_a5(&threads[n].regs, args);
524 		threads[n].flags &= ~THREAD_FLAGS_COPY_ARGS_ON_RETURN;
525 	}
526 
527 	thread_lazy_save_ns_vfp();
528 	thread_resume(&threads[n].regs);
529 }
530 
531 void thread_handle_fast_smc(struct thread_smc_args *args)
532 {
533 	thread_check_canaries();
534 	thread_fast_smc_handler_ptr(args);
535 	/* Fast handlers must not unmask any exceptions */
536 	assert(thread_get_exceptions() == THREAD_EXCP_ALL);
537 }
538 
539 void thread_handle_std_smc(struct thread_smc_args *args)
540 {
541 	thread_check_canaries();
542 
543 	if (args->a0 == OPTEE_SMC_CALL_RETURN_FROM_RPC)
544 		thread_resume_from_rpc(args);
545 	else
546 		thread_alloc_and_run(args);
547 }
548 
549 /* Helper routine for the assembly function thread_std_smc_entry() */
550 void __thread_std_smc_entry(struct thread_smc_args *args)
551 {
552 	struct thread_ctx *thr = threads + thread_get_id();
553 
554 	if (!thr->rpc_arg) {
555 		paddr_t parg;
556 		uint64_t carg;
557 		void *arg;
558 
559 		thread_rpc_alloc_arg(
560 			OPTEE_MSG_GET_ARG_SIZE(RPC_MAX_NUM_PARAMS),
561 			&parg, &carg);
562 		if (!parg || !ALIGNMENT_IS_OK(parg, struct optee_msg_arg) ||
563 		    !(arg = phys_to_virt(parg, CORE_MEM_NSEC_SHM))) {
564 			thread_rpc_free_arg(carg);
565 			args->a0 = OPTEE_SMC_RETURN_ENOMEM;
566 			return;
567 		}
568 
569 		thr->rpc_arg = arg;
570 		thr->rpc_carg = carg;
571 	}
572 
573 	thread_std_smc_handler_ptr(args);
574 
575 	if (!thread_prealloc_rpc_cache) {
576 		thread_rpc_free_arg(thr->rpc_carg);
577 		thr->rpc_carg = 0;
578 		thr->rpc_arg = 0;
579 	}
580 }
581 
582 void *thread_get_tmp_sp(void)
583 {
584 	struct thread_core_local *l = thread_get_core_local();
585 
586 	return (void *)l->tmp_stack_va_end;
587 }
588 
589 #ifdef ARM64
590 vaddr_t thread_get_saved_thread_sp(void)
591 {
592 	struct thread_core_local *l = thread_get_core_local();
593 	int ct = l->curr_thread;
594 
595 	assert(ct != -1);
596 	return threads[ct].kern_sp;
597 }
598 #endif /*ARM64*/
599 
600 bool thread_addr_is_in_stack(vaddr_t va)
601 {
602 	struct thread_ctx *thr = threads + thread_get_id();
603 
604 	return va < thr->stack_va_end &&
605 	       va >= (thr->stack_va_end - STACK_THREAD_SIZE);
606 }
607 
608 void thread_state_free(void)
609 {
610 	struct thread_core_local *l = thread_get_core_local();
611 	int ct = l->curr_thread;
612 
613 	assert(ct != -1);
614 	assert(TAILQ_EMPTY(&threads[ct].mutexes));
615 
616 	thread_lazy_restore_ns_vfp();
617 
618 	lock_global();
619 
620 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
621 	threads[ct].state = THREAD_STATE_FREE;
622 	threads[ct].flags = 0;
623 	l->curr_thread = -1;
624 
625 	unlock_global();
626 }
627 
628 #ifdef ARM32
629 static bool is_from_user(uint32_t cpsr)
630 {
631 	return (cpsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR;
632 }
633 #endif
634 
635 #ifdef ARM64
636 static bool is_from_user(uint32_t cpsr)
637 {
638 	if (cpsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT))
639 		return true;
640 	if (((cpsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) ==
641 	     SPSR_64_MODE_EL0)
642 		return true;
643 	return false;
644 }
645 #endif
646 
647 int thread_state_suspend(uint32_t flags, uint32_t cpsr, vaddr_t pc)
648 {
649 	struct thread_core_local *l = thread_get_core_local();
650 	int ct = l->curr_thread;
651 
652 	assert(ct != -1);
653 
654 	thread_check_canaries();
655 
656 	if (is_from_user(cpsr))
657 		thread_user_save_vfp();
658 	thread_lazy_restore_ns_vfp();
659 
660 	lock_global();
661 
662 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
663 	threads[ct].flags |= flags;
664 	threads[ct].regs.cpsr = cpsr;
665 	threads[ct].regs.pc = pc;
666 	threads[ct].state = THREAD_STATE_SUSPENDED;
667 
668 	threads[ct].have_user_map = core_mmu_user_mapping_is_active();
669 	if (threads[ct].have_user_map) {
670 		core_mmu_get_user_map(&threads[ct].user_map);
671 		core_mmu_set_user_map(NULL);
672 	}
673 
674 
675 	l->curr_thread = -1;
676 
677 	unlock_global();
678 
679 	return ct;
680 }
681 
682 #ifdef ARM32
683 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
684 {
685 	l->tmp_stack_va_end = sp;
686 	thread_set_irq_sp(sp);
687 	thread_set_fiq_sp(sp);
688 }
689 
690 static void set_abt_stack(struct thread_core_local *l __unused, vaddr_t sp)
691 {
692 	thread_set_abt_sp(sp);
693 }
694 #endif /*ARM32*/
695 
696 #ifdef ARM64
697 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
698 {
699 	/*
700 	 * We're already using the tmp stack when this function is called
701 	 * so there's no need to assign it to any stack pointer. However,
702 	 * we'll need to restore it at different times so store it here.
703 	 */
704 	l->tmp_stack_va_end = sp;
705 }
706 
707 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
708 {
709 	l->abt_stack_va_end = sp;
710 }
711 #endif /*ARM64*/
712 
713 bool thread_init_stack(uint32_t thread_id, vaddr_t sp)
714 {
715 	if (thread_id >= CFG_NUM_THREADS)
716 		return false;
717 	threads[thread_id].stack_va_end = sp;
718 	return true;
719 }
720 
721 int thread_get_id_may_fail(void)
722 {
723 	/* thread_get_core_local() requires IRQs to be disabled */
724 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
725 	struct thread_core_local *l = thread_get_core_local();
726 	int ct = l->curr_thread;
727 
728 	thread_unmask_exceptions(exceptions);
729 	return ct;
730 }
731 
732 int thread_get_id(void)
733 {
734 	int ct = thread_get_id_may_fail();
735 
736 	assert((ct >= 0) && (ct < CFG_NUM_THREADS));
737 	return ct;
738 }
739 
740 static void init_handlers(const struct thread_handlers *handlers)
741 {
742 	thread_std_smc_handler_ptr = handlers->std_smc;
743 	thread_fast_smc_handler_ptr = handlers->fast_smc;
744 	thread_fiq_handler_ptr = handlers->fiq;
745 	thread_cpu_on_handler_ptr = handlers->cpu_on;
746 	thread_cpu_off_handler_ptr = handlers->cpu_off;
747 	thread_cpu_suspend_handler_ptr = handlers->cpu_suspend;
748 	thread_cpu_resume_handler_ptr = handlers->cpu_resume;
749 	thread_system_off_handler_ptr = handlers->system_off;
750 	thread_system_reset_handler_ptr = handlers->system_reset;
751 }
752 
753 
754 #ifdef CFG_WITH_PAGER
755 static void init_thread_stacks(void)
756 {
757 	size_t n;
758 
759 	/*
760 	 * Allocate virtual memory for thread stacks.
761 	 */
762 	for (n = 0; n < CFG_NUM_THREADS; n++) {
763 		tee_mm_entry_t *mm;
764 		vaddr_t sp;
765 
766 		/* Find vmem for thread stack and its protection gap */
767 		mm = tee_mm_alloc(&tee_mm_vcore,
768 				  SMALL_PAGE_SIZE + STACK_THREAD_SIZE);
769 		TEE_ASSERT(mm);
770 
771 		/* Claim eventual physical page */
772 		tee_pager_add_pages(tee_mm_get_smem(mm), tee_mm_get_size(mm),
773 				    true);
774 
775 		/* Realloc both protection vmem and stack vmem separately */
776 		sp = tee_mm_get_smem(mm);
777 		tee_mm_free(mm);
778 		mm = tee_mm_alloc2(&tee_mm_vcore, sp, SMALL_PAGE_SIZE);
779 		TEE_ASSERT(mm);
780 		mm = tee_mm_alloc2(&tee_mm_vcore, sp + SMALL_PAGE_SIZE,
781 						  STACK_THREAD_SIZE);
782 		TEE_ASSERT(mm);
783 
784 		/* init effective stack */
785 		sp = tee_mm_get_smem(mm) + tee_mm_get_bytes(mm);
786 		if (!thread_init_stack(n, sp))
787 			panic();
788 
789 		/* Add the area to the pager */
790 		tee_pager_add_area(mm, TEE_PAGER_AREA_RW, NULL, NULL);
791 	}
792 }
793 #else
794 static void init_thread_stacks(void)
795 {
796 	size_t n;
797 
798 	/* Assign the thread stacks */
799 	for (n = 0; n < CFG_NUM_THREADS; n++) {
800 		if (!thread_init_stack(n, GET_STACK(stack_thread[n])))
801 			panic();
802 	}
803 }
804 #endif /*CFG_WITH_PAGER*/
805 
806 void thread_init_primary(const struct thread_handlers *handlers)
807 {
808 	init_handlers(handlers);
809 
810 	/* Initialize canaries around the stacks */
811 	init_canaries();
812 
813 	init_thread_stacks();
814 	pgt_init();
815 }
816 
817 static void init_sec_mon(size_t pos __maybe_unused)
818 {
819 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
820 	/* Initialize secure monitor */
821 	sm_init(GET_STACK(stack_sm[pos]));
822 	sm_set_entry_vector(thread_vector_table);
823 #endif
824 }
825 
826 void thread_init_per_cpu(void)
827 {
828 	size_t pos = get_core_pos();
829 	struct thread_core_local *l = thread_get_core_local();
830 
831 	init_sec_mon(pos);
832 
833 	set_tmp_stack(l, GET_STACK(stack_tmp[pos]));
834 	set_abt_stack(l, GET_STACK(stack_abt[pos]));
835 
836 	thread_init_vbar();
837 }
838 
839 struct thread_specific_data *thread_get_tsd(void)
840 {
841 	return &threads[thread_get_id()].tsd;
842 }
843 
844 struct thread_ctx_regs *thread_get_ctx_regs(void)
845 {
846 	struct thread_core_local *l = thread_get_core_local();
847 
848 	assert(l->curr_thread != -1);
849 	return &threads[l->curr_thread].regs;
850 }
851 
852 void thread_set_irq(bool enable)
853 {
854 	/* thread_get_core_local() requires IRQs to be disabled */
855 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
856 	struct thread_core_local *l;
857 
858 	l = thread_get_core_local();
859 
860 	assert(l->curr_thread != -1);
861 
862 	if (enable) {
863 		threads[l->curr_thread].flags |= THREAD_FLAGS_IRQ_ENABLE;
864 		thread_set_exceptions(exceptions & ~THREAD_EXCP_IRQ);
865 	} else {
866 		/*
867 		 * No need to disable IRQ here since it's already disabled
868 		 * above.
869 		 */
870 		threads[l->curr_thread].flags &= ~THREAD_FLAGS_IRQ_ENABLE;
871 	}
872 }
873 
874 void thread_restore_irq(void)
875 {
876 	/* thread_get_core_local() requires IRQs to be disabled */
877 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
878 	struct thread_core_local *l;
879 
880 	l = thread_get_core_local();
881 
882 	assert(l->curr_thread != -1);
883 
884 	if (threads[l->curr_thread].flags & THREAD_FLAGS_IRQ_ENABLE)
885 		thread_set_exceptions(exceptions & ~THREAD_EXCP_IRQ);
886 }
887 
888 #ifdef CFG_WITH_VFP
889 uint32_t thread_kernel_enable_vfp(void)
890 {
891 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
892 	struct thread_ctx *thr = threads + thread_get_id();
893 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
894 
895 	assert(!vfp_is_enabled());
896 
897 	if (!thr->vfp_state.ns_saved) {
898 		vfp_lazy_save_state_final(&thr->vfp_state.ns);
899 		thr->vfp_state.ns_saved = true;
900 	} else if (thr->vfp_state.sec_lazy_saved &&
901 		   !thr->vfp_state.sec_saved) {
902 		/*
903 		 * This happens when we're handling an abort while the
904 		 * thread was using the VFP state.
905 		 */
906 		vfp_lazy_save_state_final(&thr->vfp_state.sec);
907 		thr->vfp_state.sec_saved = true;
908 	} else if (tuv && tuv->lazy_saved && !tuv->saved) {
909 		/*
910 		 * This can happen either during syscall or abort
911 		 * processing (while processing a syscall).
912 		 */
913 		vfp_lazy_save_state_final(&tuv->vfp);
914 		tuv->saved = true;
915 	}
916 
917 	vfp_enable();
918 	return exceptions;
919 }
920 
921 void thread_kernel_disable_vfp(uint32_t state)
922 {
923 	uint32_t exceptions;
924 
925 	assert(vfp_is_enabled());
926 
927 	vfp_disable();
928 	exceptions = thread_get_exceptions();
929 	assert(exceptions & THREAD_EXCP_IRQ);
930 	exceptions &= ~THREAD_EXCP_IRQ;
931 	exceptions |= state & THREAD_EXCP_IRQ;
932 	thread_set_exceptions(exceptions);
933 }
934 
935 void thread_kernel_save_vfp(void)
936 {
937 	struct thread_ctx *thr = threads + thread_get_id();
938 
939 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
940 	if (vfp_is_enabled()) {
941 		vfp_lazy_save_state_init(&thr->vfp_state.sec);
942 		thr->vfp_state.sec_lazy_saved = true;
943 	}
944 }
945 
946 void thread_kernel_restore_vfp(void)
947 {
948 	struct thread_ctx *thr = threads + thread_get_id();
949 
950 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
951 	assert(!vfp_is_enabled());
952 	if (thr->vfp_state.sec_lazy_saved) {
953 		vfp_lazy_restore_state(&thr->vfp_state.sec,
954 				       thr->vfp_state.sec_saved);
955 		thr->vfp_state.sec_saved = false;
956 		thr->vfp_state.sec_lazy_saved = false;
957 	}
958 }
959 
960 void thread_user_enable_vfp(struct thread_user_vfp_state *uvfp)
961 {
962 	struct thread_ctx *thr = threads + thread_get_id();
963 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
964 
965 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
966 	assert(!vfp_is_enabled());
967 
968 	if (!thr->vfp_state.ns_saved) {
969 		vfp_lazy_save_state_final(&thr->vfp_state.ns);
970 		thr->vfp_state.ns_saved = true;
971 	} else if (tuv && uvfp != tuv) {
972 		if (tuv->lazy_saved && !tuv->saved) {
973 			vfp_lazy_save_state_final(&tuv->vfp);
974 			tuv->saved = true;
975 		}
976 	}
977 
978 	if (uvfp->lazy_saved)
979 		vfp_lazy_restore_state(&uvfp->vfp, uvfp->saved);
980 	uvfp->lazy_saved = false;
981 	uvfp->saved = false;
982 
983 	thr->vfp_state.uvfp = uvfp;
984 	vfp_enable();
985 }
986 
987 void thread_user_save_vfp(void)
988 {
989 	struct thread_ctx *thr = threads + thread_get_id();
990 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
991 
992 	assert(thread_get_exceptions() & THREAD_EXCP_IRQ);
993 	if (!vfp_is_enabled())
994 		return;
995 
996 	assert(tuv && !tuv->lazy_saved && !tuv->saved);
997 	vfp_lazy_save_state_init(&tuv->vfp);
998 	tuv->lazy_saved = true;
999 }
1000 
1001 void thread_user_clear_vfp(struct thread_user_vfp_state *uvfp)
1002 {
1003 	struct thread_ctx *thr = threads + thread_get_id();
1004 
1005 	if (uvfp == thr->vfp_state.uvfp)
1006 		thr->vfp_state.uvfp = NULL;
1007 	uvfp->lazy_saved = false;
1008 	uvfp->saved = false;
1009 }
1010 #endif /*CFG_WITH_VFP*/
1011 
1012 #ifdef ARM32
1013 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1014 {
1015 	uint32_t s;
1016 
1017 	if (!is_32bit)
1018 		return false;
1019 
1020 	s = read_spsr();
1021 	s &= ~(CPSR_MODE_MASK | CPSR_T | CPSR_IT_MASK1 | CPSR_IT_MASK2);
1022 	s |= CPSR_MODE_USR;
1023 	if (entry_func & 1)
1024 		s |= CPSR_T;
1025 	*spsr = s;
1026 	return true;
1027 }
1028 #endif
1029 
1030 #ifdef ARM64
1031 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1032 {
1033 	uint32_t s;
1034 
1035 	if (is_32bit) {
1036 		s = read_daif() & (SPSR_32_AIF_MASK << SPSR_32_AIF_SHIFT);
1037 		s |= SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT;
1038 		s |= (entry_func & SPSR_32_T_MASK) << SPSR_32_T_SHIFT;
1039 	} else {
1040 		s = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
1041 	}
1042 
1043 	*spsr = s;
1044 	return true;
1045 }
1046 #endif
1047 
1048 uint32_t thread_enter_user_mode(unsigned long a0, unsigned long a1,
1049 		unsigned long a2, unsigned long a3, unsigned long user_sp,
1050 		unsigned long entry_func, bool is_32bit,
1051 		uint32_t *exit_status0, uint32_t *exit_status1)
1052 {
1053 	uint32_t spsr;
1054 
1055 	if (!get_spsr(is_32bit, entry_func, &spsr)) {
1056 		*exit_status0 = 1; /* panic */
1057 		*exit_status1 = 0xbadbadba;
1058 		return 0;
1059 	}
1060 	return __thread_enter_user_mode(a0, a1, a2, a3, user_sp, entry_func,
1061 					spsr, exit_status0, exit_status1);
1062 }
1063 
1064 void thread_add_mutex(struct mutex *m)
1065 {
1066 	struct thread_core_local *l = thread_get_core_local();
1067 	int ct = l->curr_thread;
1068 
1069 	assert(ct != -1 && threads[ct].state == THREAD_STATE_ACTIVE);
1070 	assert(m->owner_id == -1);
1071 	m->owner_id = ct;
1072 	TAILQ_INSERT_TAIL(&threads[ct].mutexes, m, link);
1073 }
1074 
1075 void thread_rem_mutex(struct mutex *m)
1076 {
1077 	struct thread_core_local *l = thread_get_core_local();
1078 	int ct = l->curr_thread;
1079 
1080 	assert(ct != -1 && threads[ct].state == THREAD_STATE_ACTIVE);
1081 	assert(m->owner_id == ct);
1082 	m->owner_id = -1;
1083 	TAILQ_REMOVE(&threads[ct].mutexes, m, link);
1084 }
1085 
1086 bool thread_disable_prealloc_rpc_cache(uint64_t *cookie)
1087 {
1088 	bool rv;
1089 	size_t n;
1090 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
1091 
1092 	lock_global();
1093 
1094 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1095 		if (threads[n].state != THREAD_STATE_FREE) {
1096 			rv = false;
1097 			goto out;
1098 		}
1099 	}
1100 
1101 	rv = true;
1102 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1103 		if (threads[n].rpc_arg) {
1104 			*cookie = threads[n].rpc_carg;
1105 			threads[n].rpc_carg = 0;
1106 			threads[n].rpc_arg = NULL;
1107 			goto out;
1108 		}
1109 	}
1110 
1111 	*cookie = 0;
1112 	thread_prealloc_rpc_cache = false;
1113 out:
1114 	unlock_global();
1115 	thread_unmask_exceptions(exceptions);
1116 	return rv;
1117 }
1118 
1119 bool thread_enable_prealloc_rpc_cache(void)
1120 {
1121 	bool rv;
1122 	size_t n;
1123 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_IRQ);
1124 
1125 	lock_global();
1126 
1127 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1128 		if (threads[n].state != THREAD_STATE_FREE) {
1129 			rv = false;
1130 			goto out;
1131 		}
1132 	}
1133 
1134 	rv = true;
1135 	thread_prealloc_rpc_cache = true;
1136 out:
1137 	unlock_global();
1138 	thread_unmask_exceptions(exceptions);
1139 	return rv;
1140 }
1141 
1142 static uint32_t rpc_cmd_nolock(uint32_t cmd, size_t num_params,
1143 		struct optee_msg_param *params)
1144 {
1145 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1146 	struct thread_ctx *thr = threads + thread_get_id();
1147 	struct optee_msg_arg *arg = thr->rpc_arg;
1148 	uint64_t carg = thr->rpc_carg;
1149 	const size_t params_size = sizeof(struct optee_msg_param) * num_params;
1150 	size_t n;
1151 
1152 	TEE_ASSERT(arg && carg && num_params <= RPC_MAX_NUM_PARAMS);
1153 
1154 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(RPC_MAX_NUM_PARAMS));
1155 	arg->cmd = cmd;
1156 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1157 	arg->num_params = num_params;
1158 	memcpy(OPTEE_MSG_GET_PARAMS(arg), params, params_size);
1159 
1160 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1161 	thread_rpc(rpc_args);
1162 	for (n = 0; n < num_params; n++) {
1163 		switch (params[n].attr & OPTEE_MSG_ATTR_TYPE_MASK) {
1164 		case OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT:
1165 		case OPTEE_MSG_ATTR_TYPE_VALUE_INOUT:
1166 		case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT:
1167 		case OPTEE_MSG_ATTR_TYPE_RMEM_INOUT:
1168 		case OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT:
1169 		case OPTEE_MSG_ATTR_TYPE_TMEM_INOUT:
1170 			memcpy(params + n, OPTEE_MSG_GET_PARAMS(arg) + n,
1171 			       sizeof(struct optee_msg_param));
1172 			break;
1173 		default:
1174 			break;
1175 		}
1176 	}
1177 	return arg->ret;
1178 }
1179 
1180 uint32_t thread_rpc_cmd(uint32_t cmd, size_t num_params,
1181 		struct optee_msg_param *params)
1182 {
1183 	uint32_t ret;
1184 
1185 	ret = rpc_cmd_nolock(cmd, num_params, params);
1186 
1187 	return ret;
1188 }
1189 
1190 void thread_rpc_alloc_arg(size_t size, paddr_t *arg, uint64_t *cookie)
1191 {
1192 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1193 		OPTEE_SMC_RETURN_RPC_ALLOC, size};
1194 
1195 	thread_rpc(rpc_args);
1196 	*arg = reg_pair_to_64(rpc_args[1], rpc_args[2]);
1197 	*cookie = reg_pair_to_64(rpc_args[4], rpc_args[5]);
1198 }
1199 
1200 /**
1201  * Allocates shared memory buffer via RPC
1202  *
1203  * @size:	size in bytes of shared memory buffer
1204  * @align:	required alignment of buffer
1205  * @bt:		buffer type OPTEE_MSG_RPC_SHM_TYPE_*
1206  * @payload:	returned physical pointer to buffer, 0 if allocation
1207  *		failed.
1208  * @cookie:	returned cookie used when freeing the buffer
1209  */
1210 static void thread_rpc_alloc(size_t size, size_t align, unsigned bt,
1211 			paddr_t *payload, uint64_t *cookie)
1212 {
1213 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1214 	struct thread_ctx *thr = threads + thread_get_id();
1215 	struct optee_msg_arg *arg = thr->rpc_arg;
1216 	uint64_t carg = thr->rpc_carg;
1217 	struct optee_msg_param *params = OPTEE_MSG_GET_PARAMS(arg);
1218 
1219 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(1));
1220 	arg->cmd = OPTEE_MSG_RPC_CMD_SHM_ALLOC;
1221 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1222 	arg->num_params = 1;
1223 
1224 	params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1225 	params[0].u.value.a = bt;
1226 	params[0].u.value.b = size;
1227 	params[0].u.value.c = align;
1228 
1229 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1230 	thread_rpc(rpc_args);
1231 	if (arg->ret != TEE_SUCCESS)
1232 		goto fail;
1233 
1234 	if (arg->num_params != 1)
1235 		goto fail;
1236 
1237 	if (params[0].attr != OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT)
1238 		goto fail;
1239 
1240 	*payload = params[0].u.tmem.buf_ptr;
1241 	*cookie = params[0].u.tmem.shm_ref;
1242 	return;
1243 fail:
1244 	*payload = 0;
1245 	*cookie = 0;
1246 }
1247 
1248 /**
1249  * Free physical memory previously allocated with thread_rpc_alloc()
1250  *
1251  * @cookie:	cookie received when allocating the buffer
1252  * @bt:		 must be the same as supplied when allocating
1253  */
1254 static void thread_rpc_free(unsigned bt, uint64_t cookie)
1255 {
1256 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1257 	struct thread_ctx *thr = threads + thread_get_id();
1258 	struct optee_msg_arg *arg = thr->rpc_arg;
1259 	uint64_t carg = thr->rpc_carg;
1260 	struct optee_msg_param *params = OPTEE_MSG_GET_PARAMS(arg);
1261 
1262 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(1));
1263 	arg->cmd = OPTEE_MSG_RPC_CMD_SHM_FREE;
1264 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1265 	arg->num_params = 1;
1266 
1267 	params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1268 	params[0].u.value.a = bt;
1269 	params[0].u.value.b = cookie;
1270 	params[0].u.value.c = 0;
1271 
1272 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1273 	thread_rpc(rpc_args);
1274 }
1275 
1276 
1277 void thread_rpc_free_arg(uint64_t cookie)
1278 {
1279 	if (cookie) {
1280 		uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1281 			OPTEE_SMC_RETURN_RPC_FREE};
1282 
1283 		reg_pair_from_64(cookie, rpc_args + 1, rpc_args + 2);
1284 		thread_rpc(rpc_args);
1285 	}
1286 }
1287 
1288 void thread_rpc_alloc_payload(size_t size, paddr_t *payload, uint64_t *cookie)
1289 {
1290 	thread_rpc_alloc(size, 8, OPTEE_MSG_RPC_SHM_TYPE_APPL, payload, cookie);
1291 }
1292 
1293 void thread_rpc_free_payload(uint64_t cookie)
1294 {
1295 	thread_rpc_free(OPTEE_MSG_RPC_SHM_TYPE_APPL, cookie);
1296 }
1297