xref: /optee_os/core/arch/arm/kernel/thread.c (revision e789ada3f9c0e021452d6d933b284388a1e0f88f)
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2016, Linaro Limited
4  * Copyright (c) 2014, STMicroelectronics International N.V.
5  */
6 
7 #include <platform_config.h>
8 
9 #include <arm.h>
10 #include <assert.h>
11 #include <keep.h>
12 #include <kernel/asan.h>
13 #include <kernel/lockdep.h>
14 #include <kernel/misc.h>
15 #include <kernel/msg_param.h>
16 #include <kernel/panic.h>
17 #include <kernel/spinlock.h>
18 #include <kernel/tee_ta_manager.h>
19 #include <kernel/thread_defs.h>
20 #include <kernel/thread.h>
21 #include <mm/core_memprot.h>
22 #include <mm/mobj.h>
23 #include <mm/tee_mm.h>
24 #include <mm/tee_mmu.h>
25 #include <mm/tee_pager.h>
26 #include <optee_msg.h>
27 #include <smccc.h>
28 #include <sm/optee_smc.h>
29 #include <sm/sm.h>
30 #include <tee/tee_cryp_utl.h>
31 #include <tee/tee_fs_rpc.h>
32 #include <trace.h>
33 #include <util.h>
34 
35 #include "thread_private.h"
36 
37 #ifdef CFG_WITH_ARM_TRUSTED_FW
38 #define STACK_TMP_OFFS		0
39 #else
40 #define STACK_TMP_OFFS		SM_STACK_TMP_RESERVE_SIZE
41 #endif
42 
43 
44 #ifdef ARM32
45 #ifdef CFG_CORE_SANITIZE_KADDRESS
46 #define STACK_TMP_SIZE		(3072 + STACK_TMP_OFFS)
47 #else
48 #define STACK_TMP_SIZE		(1536 + STACK_TMP_OFFS)
49 #endif
50 #define STACK_THREAD_SIZE	8192
51 
52 #ifdef CFG_CORE_SANITIZE_KADDRESS
53 #define STACK_ABT_SIZE		3072
54 #else
55 #define STACK_ABT_SIZE		2048
56 #endif
57 
58 #endif /*ARM32*/
59 
60 #ifdef ARM64
61 #define STACK_TMP_SIZE		(2048 + STACK_TMP_OFFS)
62 #define STACK_THREAD_SIZE	8192
63 
64 #if TRACE_LEVEL > 0
65 #define STACK_ABT_SIZE		3072
66 #else
67 #define STACK_ABT_SIZE		1024
68 #endif
69 #endif /*ARM64*/
70 
71 struct thread_ctx threads[CFG_NUM_THREADS];
72 
73 struct thread_core_local thread_core_local[CFG_TEE_CORE_NB_CORE];
74 
75 #ifdef CFG_WITH_STACK_CANARIES
76 #ifdef ARM32
77 #define STACK_CANARY_SIZE	(4 * sizeof(uint32_t))
78 #endif
79 #ifdef ARM64
80 #define STACK_CANARY_SIZE	(8 * sizeof(uint32_t))
81 #endif
82 #define START_CANARY_VALUE	0xdededede
83 #define END_CANARY_VALUE	0xabababab
84 #define GET_START_CANARY(name, stack_num) name[stack_num][0]
85 #define GET_END_CANARY(name, stack_num) \
86 	name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
87 #else
88 #define STACK_CANARY_SIZE	0
89 #endif
90 
91 #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
92 linkage uint32_t name[num_stacks] \
93 		[ROUNDUP(stack_size + STACK_CANARY_SIZE, STACK_ALIGNMENT) / \
94 		sizeof(uint32_t)] \
95 		__attribute__((section(".nozi_stack." # name), \
96 			       aligned(STACK_ALIGNMENT)))
97 
98 #define STACK_SIZE(stack) (sizeof(stack) - STACK_CANARY_SIZE / 2)
99 
100 #define GET_STACK(stack) \
101 	((vaddr_t)(stack) + STACK_SIZE(stack))
102 
103 DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE, static);
104 DECLARE_STACK(stack_abt, CFG_TEE_CORE_NB_CORE, STACK_ABT_SIZE, static);
105 #ifndef CFG_WITH_PAGER
106 DECLARE_STACK(stack_thread, CFG_NUM_THREADS, STACK_THREAD_SIZE, static);
107 #endif
108 
109 const void *stack_tmp_export = (uint8_t *)stack_tmp + sizeof(stack_tmp[0]) -
110 			       (STACK_TMP_OFFS + STACK_CANARY_SIZE / 2);
111 const uint32_t stack_tmp_stride = sizeof(stack_tmp[0]);
112 
113 /*
114  * These stack setup info are required by secondary boot cores before they
115  * each locally enable the pager (the mmu). Hence kept in pager sections.
116  */
117 KEEP_PAGER(stack_tmp_export);
118 KEEP_PAGER(stack_tmp_stride);
119 
120 thread_smc_handler_t thread_std_smc_handler_ptr;
121 static thread_smc_handler_t thread_fast_smc_handler_ptr;
122 thread_nintr_handler_t thread_nintr_handler_ptr;
123 thread_pm_handler_t thread_cpu_on_handler_ptr;
124 thread_pm_handler_t thread_cpu_off_handler_ptr;
125 thread_pm_handler_t thread_cpu_suspend_handler_ptr;
126 thread_pm_handler_t thread_cpu_resume_handler_ptr;
127 thread_pm_handler_t thread_system_off_handler_ptr;
128 thread_pm_handler_t thread_system_reset_handler_ptr;
129 
130 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
131 static vaddr_t thread_user_kcode_va;
132 long thread_user_kcode_offset;
133 static size_t thread_user_kcode_size;
134 #endif
135 
136 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
137 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
138 long thread_user_kdata_sp_offset;
139 static uint8_t thread_user_kdata_page[
140 	ROUNDUP(sizeof(thread_core_local), SMALL_PAGE_SIZE)]
141 	__aligned(SMALL_PAGE_SIZE) __section(".nozi.kdata_page");
142 #endif
143 
144 static unsigned int thread_global_lock = SPINLOCK_UNLOCK;
145 static bool thread_prealloc_rpc_cache;
146 
147 static unsigned int thread_rpc_pnum;
148 
149 static void init_canaries(void)
150 {
151 #ifdef CFG_WITH_STACK_CANARIES
152 	size_t n;
153 #define INIT_CANARY(name)						\
154 	for (n = 0; n < ARRAY_SIZE(name); n++) {			\
155 		uint32_t *start_canary = &GET_START_CANARY(name, n);	\
156 		uint32_t *end_canary = &GET_END_CANARY(name, n);	\
157 									\
158 		*start_canary = START_CANARY_VALUE;			\
159 		*end_canary = END_CANARY_VALUE;				\
160 		DMSG("#Stack canaries for %s[%zu] with top at %p\n",	\
161 			#name, n, (void *)(end_canary - 1));		\
162 		DMSG("watch *%p\n", (void *)end_canary);		\
163 	}
164 
165 	INIT_CANARY(stack_tmp);
166 	INIT_CANARY(stack_abt);
167 #ifndef CFG_WITH_PAGER
168 	INIT_CANARY(stack_thread);
169 #endif
170 #endif/*CFG_WITH_STACK_CANARIES*/
171 }
172 
173 #define CANARY_DIED(stack, loc, n) \
174 	do { \
175 		EMSG_RAW("Dead canary at %s of '%s[%zu]'", #loc, #stack, n); \
176 		panic(); \
177 	} while (0)
178 
179 void thread_check_canaries(void)
180 {
181 #ifdef CFG_WITH_STACK_CANARIES
182 	size_t n;
183 
184 	for (n = 0; n < ARRAY_SIZE(stack_tmp); n++) {
185 		if (GET_START_CANARY(stack_tmp, n) != START_CANARY_VALUE)
186 			CANARY_DIED(stack_tmp, start, n);
187 		if (GET_END_CANARY(stack_tmp, n) != END_CANARY_VALUE)
188 			CANARY_DIED(stack_tmp, end, n);
189 	}
190 
191 	for (n = 0; n < ARRAY_SIZE(stack_abt); n++) {
192 		if (GET_START_CANARY(stack_abt, n) != START_CANARY_VALUE)
193 			CANARY_DIED(stack_abt, start, n);
194 		if (GET_END_CANARY(stack_abt, n) != END_CANARY_VALUE)
195 			CANARY_DIED(stack_abt, end, n);
196 
197 	}
198 #ifndef CFG_WITH_PAGER
199 	for (n = 0; n < ARRAY_SIZE(stack_thread); n++) {
200 		if (GET_START_CANARY(stack_thread, n) != START_CANARY_VALUE)
201 			CANARY_DIED(stack_thread, start, n);
202 		if (GET_END_CANARY(stack_thread, n) != END_CANARY_VALUE)
203 			CANARY_DIED(stack_thread, end, n);
204 	}
205 #endif
206 #endif/*CFG_WITH_STACK_CANARIES*/
207 }
208 
209 static void lock_global(void)
210 {
211 	cpu_spin_lock(&thread_global_lock);
212 }
213 
214 static void unlock_global(void)
215 {
216 	cpu_spin_unlock(&thread_global_lock);
217 }
218 
219 #ifdef ARM32
220 uint32_t thread_get_exceptions(void)
221 {
222 	uint32_t cpsr = read_cpsr();
223 
224 	return (cpsr >> CPSR_F_SHIFT) & THREAD_EXCP_ALL;
225 }
226 
227 void thread_set_exceptions(uint32_t exceptions)
228 {
229 	uint32_t cpsr = read_cpsr();
230 
231 	/* Foreign interrupts must not be unmasked while holding a spinlock */
232 	if (!(exceptions & THREAD_EXCP_FOREIGN_INTR))
233 		assert_have_no_spinlock();
234 
235 	cpsr &= ~(THREAD_EXCP_ALL << CPSR_F_SHIFT);
236 	cpsr |= ((exceptions & THREAD_EXCP_ALL) << CPSR_F_SHIFT);
237 	write_cpsr(cpsr);
238 }
239 #endif /*ARM32*/
240 
241 #ifdef ARM64
242 uint32_t thread_get_exceptions(void)
243 {
244 	uint32_t daif = read_daif();
245 
246 	return (daif >> DAIF_F_SHIFT) & THREAD_EXCP_ALL;
247 }
248 
249 void thread_set_exceptions(uint32_t exceptions)
250 {
251 	uint32_t daif = read_daif();
252 
253 	/* Foreign interrupts must not be unmasked while holding a spinlock */
254 	if (!(exceptions & THREAD_EXCP_FOREIGN_INTR))
255 		assert_have_no_spinlock();
256 
257 	daif &= ~(THREAD_EXCP_ALL << DAIF_F_SHIFT);
258 	daif |= ((exceptions & THREAD_EXCP_ALL) << DAIF_F_SHIFT);
259 	write_daif(daif);
260 }
261 #endif /*ARM64*/
262 
263 uint32_t thread_mask_exceptions(uint32_t exceptions)
264 {
265 	uint32_t state = thread_get_exceptions();
266 
267 	thread_set_exceptions(state | (exceptions & THREAD_EXCP_ALL));
268 	return state;
269 }
270 
271 void thread_unmask_exceptions(uint32_t state)
272 {
273 	thread_set_exceptions(state & THREAD_EXCP_ALL);
274 }
275 
276 
277 struct thread_core_local *thread_get_core_local(void)
278 {
279 	uint32_t cpu_id = get_core_pos();
280 
281 	/*
282 	 * Foreign interrupts must be disabled before playing with core_local
283 	 * since we otherwise may be rescheduled to a different core in the
284 	 * middle of this function.
285 	 */
286 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
287 
288 	assert(cpu_id < CFG_TEE_CORE_NB_CORE);
289 	return &thread_core_local[cpu_id];
290 }
291 
292 static void thread_lazy_save_ns_vfp(void)
293 {
294 #ifdef CFG_WITH_VFP
295 	struct thread_ctx *thr = threads + thread_get_id();
296 
297 	thr->vfp_state.ns_saved = false;
298 #if defined(CFG_WITH_ARM_TRUSTED_FW)
299 	/*
300 	 * ARM TF saves and restores CPACR_EL1, so we must assume NS world
301 	 * uses VFP and always preserve the register file when secure world
302 	 * is about to use it
303 	 */
304 	thr->vfp_state.ns_force_save = true;
305 #endif
306 	vfp_lazy_save_state_init(&thr->vfp_state.ns);
307 #endif /*CFG_WITH_VFP*/
308 }
309 
310 static void thread_lazy_restore_ns_vfp(void)
311 {
312 #ifdef CFG_WITH_VFP
313 	struct thread_ctx *thr = threads + thread_get_id();
314 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
315 
316 	assert(!thr->vfp_state.sec_lazy_saved && !thr->vfp_state.sec_saved);
317 
318 	if (tuv && tuv->lazy_saved && !tuv->saved) {
319 		vfp_lazy_save_state_final(&tuv->vfp, false /*!force_save*/);
320 		tuv->saved = true;
321 	}
322 
323 	vfp_lazy_restore_state(&thr->vfp_state.ns, thr->vfp_state.ns_saved);
324 	thr->vfp_state.ns_saved = false;
325 #endif /*CFG_WITH_VFP*/
326 }
327 
328 #ifdef ARM32
329 static void init_regs(struct thread_ctx *thread,
330 		struct thread_smc_args *args)
331 {
332 	thread->regs.pc = (uint32_t)thread_std_smc_entry;
333 
334 	/*
335 	 * Stdcalls starts in SVC mode with masked foreign interrupts, masked
336 	 * Asynchronous abort and unmasked native interrupts.
337 	 */
338 	thread->regs.cpsr = read_cpsr() & ARM32_CPSR_E;
339 	thread->regs.cpsr |= CPSR_MODE_SVC | CPSR_A |
340 			(THREAD_EXCP_FOREIGN_INTR << ARM32_CPSR_F_SHIFT);
341 	/* Enable thumb mode if it's a thumb instruction */
342 	if (thread->regs.pc & 1)
343 		thread->regs.cpsr |= CPSR_T;
344 	/* Reinitialize stack pointer */
345 	thread->regs.svc_sp = thread->stack_va_end;
346 
347 	/*
348 	 * Copy arguments into context. This will make the
349 	 * arguments appear in r0-r7 when thread is started.
350 	 */
351 	thread->regs.r0 = args->a0;
352 	thread->regs.r1 = args->a1;
353 	thread->regs.r2 = args->a2;
354 	thread->regs.r3 = args->a3;
355 	thread->regs.r4 = args->a4;
356 	thread->regs.r5 = args->a5;
357 	thread->regs.r6 = args->a6;
358 	thread->regs.r7 = args->a7;
359 }
360 #endif /*ARM32*/
361 
362 #ifdef ARM64
363 static void init_regs(struct thread_ctx *thread,
364 		struct thread_smc_args *args)
365 {
366 	thread->regs.pc = (uint64_t)thread_std_smc_entry;
367 
368 	/*
369 	 * Stdcalls starts in SVC mode with masked foreign interrupts, masked
370 	 * Asynchronous abort and unmasked native interrupts.
371 	 */
372 	thread->regs.cpsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0,
373 				THREAD_EXCP_FOREIGN_INTR | DAIFBIT_ABT);
374 	/* Reinitialize stack pointer */
375 	thread->regs.sp = thread->stack_va_end;
376 
377 	/*
378 	 * Copy arguments into context. This will make the
379 	 * arguments appear in x0-x7 when thread is started.
380 	 */
381 	thread->regs.x[0] = args->a0;
382 	thread->regs.x[1] = args->a1;
383 	thread->regs.x[2] = args->a2;
384 	thread->regs.x[3] = args->a3;
385 	thread->regs.x[4] = args->a4;
386 	thread->regs.x[5] = args->a5;
387 	thread->regs.x[6] = args->a6;
388 	thread->regs.x[7] = args->a7;
389 
390 	/* Set up frame pointer as per the Aarch64 AAPCS */
391 	thread->regs.x[29] = 0;
392 }
393 #endif /*ARM64*/
394 
395 void thread_init_boot_thread(void)
396 {
397 	struct thread_core_local *l = thread_get_core_local();
398 	size_t n;
399 
400 	mutex_lockdep_init();
401 
402 	for (n = 0; n < CFG_NUM_THREADS; n++) {
403 		TAILQ_INIT(&threads[n].tsd.sess_stack);
404 		SLIST_INIT(&threads[n].tsd.pgt_cache);
405 	}
406 
407 	for (n = 0; n < CFG_TEE_CORE_NB_CORE; n++)
408 		thread_core_local[n].curr_thread = -1;
409 
410 	l->curr_thread = 0;
411 	threads[0].state = THREAD_STATE_ACTIVE;
412 }
413 
414 void thread_clr_boot_thread(void)
415 {
416 	struct thread_core_local *l = thread_get_core_local();
417 
418 	assert(l->curr_thread >= 0 && l->curr_thread < CFG_NUM_THREADS);
419 	assert(threads[l->curr_thread].state == THREAD_STATE_ACTIVE);
420 	threads[l->curr_thread].state = THREAD_STATE_FREE;
421 	l->curr_thread = -1;
422 }
423 
424 static void thread_alloc_and_run(struct thread_smc_args *args)
425 {
426 	size_t n;
427 	struct thread_core_local *l = thread_get_core_local();
428 	bool found_thread = false;
429 
430 	assert(l->curr_thread == -1);
431 
432 	lock_global();
433 
434 	for (n = 0; n < CFG_NUM_THREADS; n++) {
435 		if (threads[n].state == THREAD_STATE_FREE) {
436 			threads[n].state = THREAD_STATE_ACTIVE;
437 			found_thread = true;
438 			break;
439 		}
440 	}
441 
442 	unlock_global();
443 
444 	if (!found_thread) {
445 		args->a0 = OPTEE_SMC_RETURN_ETHREAD_LIMIT;
446 		return;
447 	}
448 
449 	l->curr_thread = n;
450 
451 	threads[n].flags = 0;
452 	init_regs(threads + n, args);
453 
454 	/* Save Hypervisor Client ID */
455 	threads[n].hyp_clnt_id = args->a7;
456 
457 	thread_lazy_save_ns_vfp();
458 	thread_resume(&threads[n].regs);
459 }
460 
461 #ifdef ARM32
462 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
463 		struct thread_smc_args *args)
464 {
465 	/*
466 	 * Update returned values from RPC, values will appear in
467 	 * r0-r3 when thread is resumed.
468 	 */
469 	regs->r0 = args->a0;
470 	regs->r1 = args->a1;
471 	regs->r2 = args->a2;
472 	regs->r3 = args->a3;
473 	regs->r4 = args->a4;
474 	regs->r5 = args->a5;
475 }
476 #endif /*ARM32*/
477 
478 #ifdef ARM64
479 static void copy_a0_to_a5(struct thread_ctx_regs *regs,
480 		struct thread_smc_args *args)
481 {
482 	/*
483 	 * Update returned values from RPC, values will appear in
484 	 * x0-x3 when thread is resumed.
485 	 */
486 	regs->x[0] = args->a0;
487 	regs->x[1] = args->a1;
488 	regs->x[2] = args->a2;
489 	regs->x[3] = args->a3;
490 	regs->x[4] = args->a4;
491 	regs->x[5] = args->a5;
492 }
493 #endif /*ARM64*/
494 
495 #ifdef ARM32
496 static bool is_from_user(uint32_t cpsr)
497 {
498 	return (cpsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR;
499 }
500 #endif
501 
502 #ifdef ARM64
503 static bool is_from_user(uint32_t cpsr)
504 {
505 	if (cpsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT))
506 		return true;
507 	if (((cpsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) ==
508 	     SPSR_64_MODE_EL0)
509 		return true;
510 	return false;
511 }
512 #endif
513 
514 static bool is_user_mode(struct thread_ctx_regs *regs)
515 {
516 	return is_from_user((uint32_t)regs->cpsr);
517 }
518 
519 static void thread_resume_from_rpc(struct thread_smc_args *args)
520 {
521 	size_t n = args->a3; /* thread id */
522 	struct thread_core_local *l = thread_get_core_local();
523 	uint32_t rv = 0;
524 
525 	assert(l->curr_thread == -1);
526 
527 	lock_global();
528 
529 	if (n < CFG_NUM_THREADS &&
530 	    threads[n].state == THREAD_STATE_SUSPENDED &&
531 	    args->a7 == threads[n].hyp_clnt_id)
532 		threads[n].state = THREAD_STATE_ACTIVE;
533 	else
534 		rv = OPTEE_SMC_RETURN_ERESUME;
535 
536 	unlock_global();
537 
538 	if (rv) {
539 		args->a0 = rv;
540 		return;
541 	}
542 
543 	l->curr_thread = n;
544 
545 	if (is_user_mode(&threads[n].regs))
546 		tee_ta_update_session_utime_resume();
547 
548 	if (threads[n].have_user_map)
549 		core_mmu_set_user_map(&threads[n].user_map);
550 
551 	/*
552 	 * Return from RPC to request service of a foreign interrupt must not
553 	 * get parameters from non-secure world.
554 	 */
555 	if (threads[n].flags & THREAD_FLAGS_COPY_ARGS_ON_RETURN) {
556 		copy_a0_to_a5(&threads[n].regs, args);
557 		threads[n].flags &= ~THREAD_FLAGS_COPY_ARGS_ON_RETURN;
558 	}
559 
560 	thread_lazy_save_ns_vfp();
561 	thread_resume(&threads[n].regs);
562 }
563 
564 void thread_handle_fast_smc(struct thread_smc_args *args)
565 {
566 	thread_check_canaries();
567 	thread_fast_smc_handler_ptr(args);
568 	/* Fast handlers must not unmask any exceptions */
569 	assert(thread_get_exceptions() == THREAD_EXCP_ALL);
570 }
571 
572 void thread_handle_std_smc(struct thread_smc_args *args)
573 {
574 	thread_check_canaries();
575 
576 	if (args->a0 == OPTEE_SMC_CALL_RETURN_FROM_RPC)
577 		thread_resume_from_rpc(args);
578 	else
579 		thread_alloc_and_run(args);
580 }
581 
582 /**
583  * Free physical memory previously allocated with thread_rpc_alloc_arg()
584  *
585  * @cookie:	cookie received when allocating the buffer
586  */
587 static void thread_rpc_free_arg(uint64_t cookie)
588 {
589 	if (cookie) {
590 		uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
591 			OPTEE_SMC_RETURN_RPC_FREE
592 		};
593 
594 		reg_pair_from_64(cookie, rpc_args + 1, rpc_args + 2);
595 		thread_rpc(rpc_args);
596 	}
597 }
598 
599 /*
600  * Helper routine for the assembly function thread_std_smc_entry()
601  *
602  * Note: this function is weak just to make it possible to exclude it from
603  * the unpaged area.
604  */
605 void __weak __thread_std_smc_entry(struct thread_smc_args *args)
606 {
607 	thread_std_smc_handler_ptr(args);
608 
609 	if (args->a0 == OPTEE_SMC_RETURN_OK) {
610 		struct thread_ctx *thr = threads + thread_get_id();
611 
612 		tee_fs_rpc_cache_clear(&thr->tsd);
613 		if (!thread_prealloc_rpc_cache) {
614 			thread_rpc_free_arg(mobj_get_cookie(thr->rpc_mobj));
615 			mobj_free(thr->rpc_mobj);
616 			thr->rpc_arg = 0;
617 			thr->rpc_mobj = NULL;
618 		}
619 	}
620 }
621 
622 void *thread_get_tmp_sp(void)
623 {
624 	struct thread_core_local *l = thread_get_core_local();
625 
626 	return (void *)l->tmp_stack_va_end;
627 }
628 
629 #ifdef ARM64
630 vaddr_t thread_get_saved_thread_sp(void)
631 {
632 	struct thread_core_local *l = thread_get_core_local();
633 	int ct = l->curr_thread;
634 
635 	assert(ct != -1);
636 	return threads[ct].kern_sp;
637 }
638 #endif /*ARM64*/
639 
640 vaddr_t thread_stack_start(void)
641 {
642 	struct thread_ctx *thr;
643 	int ct = thread_get_id_may_fail();
644 
645 	if (ct == -1)
646 		return 0;
647 
648 	thr = threads + ct;
649 	return thr->stack_va_end - STACK_THREAD_SIZE;
650 }
651 
652 size_t thread_stack_size(void)
653 {
654 	return STACK_THREAD_SIZE;
655 }
656 
657 bool thread_is_from_abort_mode(void)
658 {
659 	struct thread_core_local *l = thread_get_core_local();
660 
661 	return (l->flags >> THREAD_CLF_SAVED_SHIFT) & THREAD_CLF_ABORT;
662 }
663 
664 #ifdef ARM32
665 bool thread_is_in_normal_mode(void)
666 {
667 	return (read_cpsr() & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_SVC;
668 }
669 #endif
670 
671 #ifdef ARM64
672 bool thread_is_in_normal_mode(void)
673 {
674 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
675 	struct thread_core_local *l = thread_get_core_local();
676 	bool ret;
677 
678 	/* If any bit in l->flags is set we're handling some exception. */
679 	ret = !l->flags;
680 	thread_unmask_exceptions(exceptions);
681 
682 	return ret;
683 }
684 #endif
685 
686 void thread_state_free(void)
687 {
688 	struct thread_core_local *l = thread_get_core_local();
689 	int ct = l->curr_thread;
690 
691 	assert(ct != -1);
692 
693 	thread_lazy_restore_ns_vfp();
694 	tee_pager_release_phys(
695 		(void *)(threads[ct].stack_va_end - STACK_THREAD_SIZE),
696 		STACK_THREAD_SIZE);
697 
698 	lock_global();
699 
700 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
701 	threads[ct].state = THREAD_STATE_FREE;
702 	threads[ct].flags = 0;
703 	l->curr_thread = -1;
704 
705 	unlock_global();
706 }
707 
708 #ifdef CFG_WITH_PAGER
709 static void release_unused_kernel_stack(struct thread_ctx *thr,
710 					uint32_t cpsr __maybe_unused)
711 {
712 #ifdef ARM64
713 	/*
714 	 * If we're from user mode then thr->regs.sp is the saved user
715 	 * stack pointer and thr->kern_sp holds the last kernel stack
716 	 * pointer. But if we're from kernel mode then thr->kern_sp isn't
717 	 * up to date so we need to read from thr->regs.sp instead.
718 	 */
719 	vaddr_t sp = is_from_user(cpsr) ?  thr->kern_sp : thr->regs.sp;
720 #else
721 	vaddr_t sp = thr->regs.svc_sp;
722 #endif
723 	vaddr_t base = thr->stack_va_end - STACK_THREAD_SIZE;
724 	size_t len = sp - base;
725 
726 	tee_pager_release_phys((void *)base, len);
727 }
728 #else
729 static void release_unused_kernel_stack(struct thread_ctx *thr __unused,
730 					uint32_t cpsr __unused)
731 {
732 }
733 #endif
734 
735 int thread_state_suspend(uint32_t flags, uint32_t cpsr, vaddr_t pc)
736 {
737 	struct thread_core_local *l = thread_get_core_local();
738 	int ct = l->curr_thread;
739 
740 	assert(ct != -1);
741 
742 	thread_check_canaries();
743 
744 	release_unused_kernel_stack(threads + ct, cpsr);
745 
746 	if (is_from_user(cpsr)) {
747 		thread_user_save_vfp();
748 		tee_ta_update_session_utime_suspend();
749 		tee_ta_gprof_sample_pc(pc);
750 	}
751 	thread_lazy_restore_ns_vfp();
752 
753 	lock_global();
754 
755 	assert(threads[ct].state == THREAD_STATE_ACTIVE);
756 	threads[ct].flags |= flags;
757 	threads[ct].regs.cpsr = cpsr;
758 	threads[ct].regs.pc = pc;
759 	threads[ct].state = THREAD_STATE_SUSPENDED;
760 
761 	threads[ct].have_user_map = core_mmu_user_mapping_is_active();
762 	if (threads[ct].have_user_map) {
763 		core_mmu_get_user_map(&threads[ct].user_map);
764 		core_mmu_set_user_map(NULL);
765 	}
766 
767 	l->curr_thread = -1;
768 
769 	unlock_global();
770 
771 	return ct;
772 }
773 
774 #ifdef ARM32
775 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
776 {
777 	l->tmp_stack_va_end = sp;
778 	thread_set_irq_sp(sp);
779 	thread_set_fiq_sp(sp);
780 }
781 
782 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
783 {
784 	l->abt_stack_va_end = sp;
785 	thread_set_abt_sp((vaddr_t)l);
786 	thread_set_und_sp((vaddr_t)l);
787 }
788 #endif /*ARM32*/
789 
790 #ifdef ARM64
791 static void set_tmp_stack(struct thread_core_local *l, vaddr_t sp)
792 {
793 	/*
794 	 * We're already using the tmp stack when this function is called
795 	 * so there's no need to assign it to any stack pointer. However,
796 	 * we'll need to restore it at different times so store it here.
797 	 */
798 	l->tmp_stack_va_end = sp;
799 }
800 
801 static void set_abt_stack(struct thread_core_local *l, vaddr_t sp)
802 {
803 	l->abt_stack_va_end = sp;
804 }
805 #endif /*ARM64*/
806 
807 bool thread_init_stack(uint32_t thread_id, vaddr_t sp)
808 {
809 	if (thread_id >= CFG_NUM_THREADS)
810 		return false;
811 	threads[thread_id].stack_va_end = sp;
812 	return true;
813 }
814 
815 int thread_get_id_may_fail(void)
816 {
817 	/*
818 	 * thread_get_core_local() requires foreign interrupts to be disabled
819 	 */
820 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
821 	struct thread_core_local *l = thread_get_core_local();
822 	int ct = l->curr_thread;
823 
824 	thread_unmask_exceptions(exceptions);
825 	return ct;
826 }
827 
828 int thread_get_id(void)
829 {
830 	int ct = thread_get_id_may_fail();
831 
832 	assert(ct >= 0 && ct < CFG_NUM_THREADS);
833 	return ct;
834 }
835 
836 static void init_handlers(const struct thread_handlers *handlers)
837 {
838 	thread_std_smc_handler_ptr = handlers->std_smc;
839 	thread_fast_smc_handler_ptr = handlers->fast_smc;
840 	thread_nintr_handler_ptr = handlers->nintr;
841 	thread_cpu_on_handler_ptr = handlers->cpu_on;
842 	thread_cpu_off_handler_ptr = handlers->cpu_off;
843 	thread_cpu_suspend_handler_ptr = handlers->cpu_suspend;
844 	thread_cpu_resume_handler_ptr = handlers->cpu_resume;
845 	thread_system_off_handler_ptr = handlers->system_off;
846 	thread_system_reset_handler_ptr = handlers->system_reset;
847 }
848 
849 #ifdef CFG_WITH_PAGER
850 static void init_thread_stacks(void)
851 {
852 	size_t n;
853 
854 	/*
855 	 * Allocate virtual memory for thread stacks.
856 	 */
857 	for (n = 0; n < CFG_NUM_THREADS; n++) {
858 		tee_mm_entry_t *mm;
859 		vaddr_t sp;
860 
861 		/* Find vmem for thread stack and its protection gap */
862 		mm = tee_mm_alloc(&tee_mm_vcore,
863 				  SMALL_PAGE_SIZE + STACK_THREAD_SIZE);
864 		assert(mm);
865 
866 		/* Claim eventual physical page */
867 		tee_pager_add_pages(tee_mm_get_smem(mm), tee_mm_get_size(mm),
868 				    true);
869 
870 		/* Add the area to the pager */
871 		tee_pager_add_core_area(tee_mm_get_smem(mm) + SMALL_PAGE_SIZE,
872 					tee_mm_get_bytes(mm) - SMALL_PAGE_SIZE,
873 					TEE_MATTR_PRW | TEE_MATTR_LOCKED,
874 					NULL, NULL);
875 
876 		/* init effective stack */
877 		sp = tee_mm_get_smem(mm) + tee_mm_get_bytes(mm);
878 		asan_tag_access((void *)tee_mm_get_smem(mm), (void *)sp);
879 		if (!thread_init_stack(n, sp))
880 			panic("init stack failed");
881 	}
882 }
883 #else
884 static void init_thread_stacks(void)
885 {
886 	size_t n;
887 
888 	/* Assign the thread stacks */
889 	for (n = 0; n < CFG_NUM_THREADS; n++) {
890 		if (!thread_init_stack(n, GET_STACK(stack_thread[n])))
891 			panic("thread_init_stack failed");
892 	}
893 }
894 #endif /*CFG_WITH_PAGER*/
895 
896 static void init_user_kcode(void)
897 {
898 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
899 	vaddr_t v = (vaddr_t)thread_excp_vect;
900 	vaddr_t ve = (vaddr_t)thread_excp_vect_end;
901 
902 	thread_user_kcode_va = ROUNDDOWN(v, CORE_MMU_USER_CODE_SIZE);
903 	ve = ROUNDUP(ve, CORE_MMU_USER_CODE_SIZE);
904 	thread_user_kcode_size = ve - thread_user_kcode_va;
905 
906 	core_mmu_get_user_va_range(&v, NULL);
907 	thread_user_kcode_offset = thread_user_kcode_va - v;
908 
909 #if defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
910 	/*
911 	 * When transitioning to EL0 subtract SP with this much to point to
912 	 * this special kdata page instead. SP is restored by add this much
913 	 * while transitioning back to EL1.
914 	 */
915 	v += thread_user_kcode_size;
916 	thread_user_kdata_sp_offset = (vaddr_t)thread_core_local - v;
917 #endif
918 #endif /*CFG_CORE_UNMAP_CORE_AT_EL0*/
919 }
920 
921 void thread_init_primary(const struct thread_handlers *handlers)
922 {
923 	init_handlers(handlers);
924 
925 	/* Initialize canaries around the stacks */
926 	init_canaries();
927 
928 	init_thread_stacks();
929 	pgt_init();
930 
931 	init_user_kcode();
932 }
933 
934 static void init_sec_mon(size_t pos __maybe_unused)
935 {
936 #if !defined(CFG_WITH_ARM_TRUSTED_FW)
937 	/* Initialize secure monitor */
938 	sm_init(GET_STACK(stack_tmp[pos]));
939 #endif
940 }
941 
942 static uint32_t __maybe_unused get_midr_implementer(uint32_t midr)
943 {
944 	return (midr >> MIDR_IMPLEMENTER_SHIFT) & MIDR_IMPLEMENTER_MASK;
945 }
946 
947 static uint32_t __maybe_unused get_midr_primary_part(uint32_t midr)
948 {
949 	return (midr >> MIDR_PRIMARY_PART_NUM_SHIFT) &
950 	       MIDR_PRIMARY_PART_NUM_MASK;
951 }
952 
953 #ifdef ARM64
954 static bool probe_workaround_available(void)
955 {
956 	int32_t r;
957 
958 	r = thread_smc(SMCCC_VERSION, 0, 0, 0);
959 	if (r < 0)
960 		return false;
961 	if (r < 0x10001)	/* compare with version 1.1 */
962 		return false;
963 
964 	/* Version >= 1.1, so SMCCC_ARCH_FEATURES is available */
965 	r = thread_smc(SMCCC_ARCH_FEATURES, SMCCC_ARCH_WORKAROUND_1, 0, 0);
966 	return r >= 0;
967 }
968 
969 static vaddr_t __maybe_unused select_vector(vaddr_t a)
970 {
971 	if (probe_workaround_available()) {
972 		DMSG("SMCCC_ARCH_WORKAROUND_1 (%#08" PRIx32 ") available",
973 		     SMCCC_ARCH_WORKAROUND_1);
974 		DMSG("SMC Workaround for CVE-2017-5715 used");
975 		return a;
976 	}
977 
978 	DMSG("SMCCC_ARCH_WORKAROUND_1 (%#08" PRIx32 ") unavailable",
979 	     SMCCC_ARCH_WORKAROUND_1);
980 	DMSG("SMC Workaround for CVE-2017-5715 not needed (if ARM-TF is up to date)");
981 	return (vaddr_t)thread_excp_vect;
982 }
983 #else
984 static vaddr_t __maybe_unused select_vector(vaddr_t a)
985 {
986 	return a;
987 }
988 #endif
989 
990 static vaddr_t get_excp_vect(void)
991 {
992 #ifdef CFG_CORE_WORKAROUND_SPECTRE_BP_SEC
993 	uint32_t midr = read_midr();
994 
995 	if (get_midr_implementer(midr) != MIDR_IMPLEMENTER_ARM)
996 		return (vaddr_t)thread_excp_vect;
997 
998 	switch (get_midr_primary_part(midr)) {
999 #ifdef ARM32
1000 	case CORTEX_A8_PART_NUM:
1001 	case CORTEX_A9_PART_NUM:
1002 	case CORTEX_A17_PART_NUM:
1003 #endif
1004 	case CORTEX_A57_PART_NUM:
1005 	case CORTEX_A72_PART_NUM:
1006 	case CORTEX_A73_PART_NUM:
1007 	case CORTEX_A75_PART_NUM:
1008 		return select_vector((vaddr_t)thread_excp_vect_workaround);
1009 #ifdef ARM32
1010 	case CORTEX_A15_PART_NUM:
1011 		return select_vector((vaddr_t)thread_excp_vect_workaround_a15);
1012 #endif
1013 	default:
1014 		return (vaddr_t)thread_excp_vect;
1015 	}
1016 #endif /*CFG_CORE_WORKAROUND_SPECTRE_BP_SEC*/
1017 
1018 	return (vaddr_t)thread_excp_vect;
1019 }
1020 
1021 void thread_init_per_cpu(void)
1022 {
1023 	size_t pos = get_core_pos();
1024 	struct thread_core_local *l = thread_get_core_local();
1025 
1026 	init_sec_mon(pos);
1027 
1028 	set_tmp_stack(l, GET_STACK(stack_tmp[pos]) - STACK_TMP_OFFS);
1029 	set_abt_stack(l, GET_STACK(stack_abt[pos]));
1030 
1031 	thread_init_vbar(get_excp_vect());
1032 }
1033 
1034 struct thread_specific_data *thread_get_tsd(void)
1035 {
1036 	return &threads[thread_get_id()].tsd;
1037 }
1038 
1039 struct thread_ctx_regs *thread_get_ctx_regs(void)
1040 {
1041 	struct thread_core_local *l = thread_get_core_local();
1042 
1043 	assert(l->curr_thread != -1);
1044 	return &threads[l->curr_thread].regs;
1045 }
1046 
1047 void thread_set_foreign_intr(bool enable)
1048 {
1049 	/* thread_get_core_local() requires foreign interrupts to be disabled */
1050 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1051 	struct thread_core_local *l;
1052 
1053 	l = thread_get_core_local();
1054 
1055 	assert(l->curr_thread != -1);
1056 
1057 	if (enable) {
1058 		threads[l->curr_thread].flags |=
1059 					THREAD_FLAGS_FOREIGN_INTR_ENABLE;
1060 		thread_set_exceptions(exceptions & ~THREAD_EXCP_FOREIGN_INTR);
1061 	} else {
1062 		/*
1063 		 * No need to disable foreign interrupts here since they're
1064 		 * already disabled above.
1065 		 */
1066 		threads[l->curr_thread].flags &=
1067 					~THREAD_FLAGS_FOREIGN_INTR_ENABLE;
1068 	}
1069 }
1070 
1071 void thread_restore_foreign_intr(void)
1072 {
1073 	/* thread_get_core_local() requires foreign interrupts to be disabled */
1074 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1075 	struct thread_core_local *l;
1076 
1077 	l = thread_get_core_local();
1078 
1079 	assert(l->curr_thread != -1);
1080 
1081 	if (threads[l->curr_thread].flags & THREAD_FLAGS_FOREIGN_INTR_ENABLE)
1082 		thread_set_exceptions(exceptions & ~THREAD_EXCP_FOREIGN_INTR);
1083 }
1084 
1085 #ifdef CFG_WITH_VFP
1086 uint32_t thread_kernel_enable_vfp(void)
1087 {
1088 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1089 	struct thread_ctx *thr = threads + thread_get_id();
1090 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1091 
1092 	assert(!vfp_is_enabled());
1093 
1094 	if (!thr->vfp_state.ns_saved) {
1095 		vfp_lazy_save_state_final(&thr->vfp_state.ns,
1096 					  thr->vfp_state.ns_force_save);
1097 		thr->vfp_state.ns_saved = true;
1098 	} else if (thr->vfp_state.sec_lazy_saved &&
1099 		   !thr->vfp_state.sec_saved) {
1100 		/*
1101 		 * This happens when we're handling an abort while the
1102 		 * thread was using the VFP state.
1103 		 */
1104 		vfp_lazy_save_state_final(&thr->vfp_state.sec,
1105 					  false /*!force_save*/);
1106 		thr->vfp_state.sec_saved = true;
1107 	} else if (tuv && tuv->lazy_saved && !tuv->saved) {
1108 		/*
1109 		 * This can happen either during syscall or abort
1110 		 * processing (while processing a syscall).
1111 		 */
1112 		vfp_lazy_save_state_final(&tuv->vfp, false /*!force_save*/);
1113 		tuv->saved = true;
1114 	}
1115 
1116 	vfp_enable();
1117 	return exceptions;
1118 }
1119 
1120 void thread_kernel_disable_vfp(uint32_t state)
1121 {
1122 	uint32_t exceptions;
1123 
1124 	assert(vfp_is_enabled());
1125 
1126 	vfp_disable();
1127 	exceptions = thread_get_exceptions();
1128 	assert(exceptions & THREAD_EXCP_FOREIGN_INTR);
1129 	exceptions &= ~THREAD_EXCP_FOREIGN_INTR;
1130 	exceptions |= state & THREAD_EXCP_FOREIGN_INTR;
1131 	thread_set_exceptions(exceptions);
1132 }
1133 
1134 void thread_kernel_save_vfp(void)
1135 {
1136 	struct thread_ctx *thr = threads + thread_get_id();
1137 
1138 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1139 	if (vfp_is_enabled()) {
1140 		vfp_lazy_save_state_init(&thr->vfp_state.sec);
1141 		thr->vfp_state.sec_lazy_saved = true;
1142 	}
1143 }
1144 
1145 void thread_kernel_restore_vfp(void)
1146 {
1147 	struct thread_ctx *thr = threads + thread_get_id();
1148 
1149 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1150 	assert(!vfp_is_enabled());
1151 	if (thr->vfp_state.sec_lazy_saved) {
1152 		vfp_lazy_restore_state(&thr->vfp_state.sec,
1153 				       thr->vfp_state.sec_saved);
1154 		thr->vfp_state.sec_saved = false;
1155 		thr->vfp_state.sec_lazy_saved = false;
1156 	}
1157 }
1158 
1159 void thread_user_enable_vfp(struct thread_user_vfp_state *uvfp)
1160 {
1161 	struct thread_ctx *thr = threads + thread_get_id();
1162 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1163 
1164 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1165 	assert(!vfp_is_enabled());
1166 
1167 	if (!thr->vfp_state.ns_saved) {
1168 		vfp_lazy_save_state_final(&thr->vfp_state.ns,
1169 					  thr->vfp_state.ns_force_save);
1170 		thr->vfp_state.ns_saved = true;
1171 	} else if (tuv && uvfp != tuv) {
1172 		if (tuv->lazy_saved && !tuv->saved) {
1173 			vfp_lazy_save_state_final(&tuv->vfp,
1174 						  false /*!force_save*/);
1175 			tuv->saved = true;
1176 		}
1177 	}
1178 
1179 	if (uvfp->lazy_saved)
1180 		vfp_lazy_restore_state(&uvfp->vfp, uvfp->saved);
1181 	uvfp->lazy_saved = false;
1182 	uvfp->saved = false;
1183 
1184 	thr->vfp_state.uvfp = uvfp;
1185 	vfp_enable();
1186 }
1187 
1188 void thread_user_save_vfp(void)
1189 {
1190 	struct thread_ctx *thr = threads + thread_get_id();
1191 	struct thread_user_vfp_state *tuv = thr->vfp_state.uvfp;
1192 
1193 	assert(thread_get_exceptions() & THREAD_EXCP_FOREIGN_INTR);
1194 	if (!vfp_is_enabled())
1195 		return;
1196 
1197 	assert(tuv && !tuv->lazy_saved && !tuv->saved);
1198 	vfp_lazy_save_state_init(&tuv->vfp);
1199 	tuv->lazy_saved = true;
1200 }
1201 
1202 void thread_user_clear_vfp(struct thread_user_vfp_state *uvfp)
1203 {
1204 	struct thread_ctx *thr = threads + thread_get_id();
1205 
1206 	if (uvfp == thr->vfp_state.uvfp)
1207 		thr->vfp_state.uvfp = NULL;
1208 	uvfp->lazy_saved = false;
1209 	uvfp->saved = false;
1210 }
1211 #endif /*CFG_WITH_VFP*/
1212 
1213 #ifdef ARM32
1214 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1215 {
1216 	uint32_t s;
1217 
1218 	if (!is_32bit)
1219 		return false;
1220 
1221 	s = read_spsr();
1222 	s &= ~(CPSR_MODE_MASK | CPSR_T | CPSR_IT_MASK1 | CPSR_IT_MASK2);
1223 	s |= CPSR_MODE_USR;
1224 	if (entry_func & 1)
1225 		s |= CPSR_T;
1226 	*spsr = s;
1227 	return true;
1228 }
1229 #endif
1230 
1231 #ifdef ARM64
1232 static bool get_spsr(bool is_32bit, unsigned long entry_func, uint32_t *spsr)
1233 {
1234 	uint32_t s;
1235 
1236 	if (is_32bit) {
1237 		s = read_daif() & (SPSR_32_AIF_MASK << SPSR_32_AIF_SHIFT);
1238 		s |= SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT;
1239 		s |= (entry_func & SPSR_32_T_MASK) << SPSR_32_T_SHIFT;
1240 	} else {
1241 		s = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
1242 	}
1243 
1244 	*spsr = s;
1245 	return true;
1246 }
1247 #endif
1248 
1249 uint32_t thread_enter_user_mode(unsigned long a0, unsigned long a1,
1250 		unsigned long a2, unsigned long a3, unsigned long user_sp,
1251 		unsigned long entry_func, bool is_32bit,
1252 		uint32_t *exit_status0, uint32_t *exit_status1)
1253 {
1254 	uint32_t spsr;
1255 
1256 	tee_ta_update_session_utime_resume();
1257 
1258 	if (!get_spsr(is_32bit, entry_func, &spsr)) {
1259 		*exit_status0 = 1; /* panic */
1260 		*exit_status1 = 0xbadbadba;
1261 		return 0;
1262 	}
1263 	return __thread_enter_user_mode(a0, a1, a2, a3, user_sp, entry_func,
1264 					spsr, exit_status0, exit_status1);
1265 }
1266 
1267 #ifdef CFG_CORE_UNMAP_CORE_AT_EL0
1268 void thread_get_user_kcode(struct mobj **mobj, size_t *offset,
1269 			   vaddr_t *va, size_t *sz)
1270 {
1271 	core_mmu_get_user_va_range(va, NULL);
1272 	*mobj = mobj_tee_ram;
1273 	*offset = thread_user_kcode_va - TEE_RAM_START;
1274 	*sz = thread_user_kcode_size;
1275 }
1276 #endif
1277 
1278 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
1279 	defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
1280 void thread_get_user_kdata(struct mobj **mobj, size_t *offset,
1281 			   vaddr_t *va, size_t *sz)
1282 {
1283 	vaddr_t v;
1284 
1285 	core_mmu_get_user_va_range(&v, NULL);
1286 	*va = v + thread_user_kcode_size;
1287 	*mobj = mobj_tee_ram;
1288 	*offset = (vaddr_t)thread_user_kdata_page - TEE_RAM_START;
1289 	*sz = sizeof(thread_user_kdata_page);
1290 }
1291 #endif
1292 
1293 bool thread_disable_prealloc_rpc_cache(uint64_t *cookie)
1294 {
1295 	bool rv;
1296 	size_t n;
1297 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1298 
1299 	lock_global();
1300 
1301 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1302 		if (threads[n].state != THREAD_STATE_FREE) {
1303 			rv = false;
1304 			goto out;
1305 		}
1306 	}
1307 
1308 	rv = true;
1309 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1310 		if (threads[n].rpc_arg) {
1311 			*cookie = mobj_get_cookie(threads[n].rpc_mobj);
1312 			mobj_free(threads[n].rpc_mobj);
1313 			threads[n].rpc_arg = NULL;
1314 			goto out;
1315 		}
1316 	}
1317 
1318 	*cookie = 0;
1319 	thread_prealloc_rpc_cache = false;
1320 out:
1321 	unlock_global();
1322 	thread_unmask_exceptions(exceptions);
1323 	return rv;
1324 }
1325 
1326 bool thread_enable_prealloc_rpc_cache(void)
1327 {
1328 	bool rv;
1329 	size_t n;
1330 	uint32_t exceptions = thread_mask_exceptions(THREAD_EXCP_FOREIGN_INTR);
1331 
1332 	lock_global();
1333 
1334 	for (n = 0; n < CFG_NUM_THREADS; n++) {
1335 		if (threads[n].state != THREAD_STATE_FREE) {
1336 			rv = false;
1337 			goto out;
1338 		}
1339 	}
1340 
1341 	rv = true;
1342 	thread_prealloc_rpc_cache = true;
1343 out:
1344 	unlock_global();
1345 	thread_unmask_exceptions(exceptions);
1346 	return rv;
1347 }
1348 
1349 /**
1350  * Allocates data for struct optee_msg_arg.
1351  *
1352  * @size:	size in bytes of struct optee_msg_arg
1353  *
1354  * @returns	mobj that describes allocated buffer or NULL on error
1355  */
1356 static struct mobj *thread_rpc_alloc_arg(size_t size)
1357 {
1358 	paddr_t pa;
1359 	uint64_t co;
1360 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = {
1361 		OPTEE_SMC_RETURN_RPC_ALLOC, size
1362 	};
1363 	struct mobj *mobj = NULL;
1364 
1365 	thread_rpc(rpc_args);
1366 
1367 	pa = reg_pair_to_64(rpc_args[1], rpc_args[2]);
1368 	co = reg_pair_to_64(rpc_args[4], rpc_args[5]);
1369 
1370 	if (!ALIGNMENT_IS_OK(pa, struct optee_msg_arg))
1371 		goto err;
1372 
1373 	/* Check if this region is in static shared space */
1374 	if (core_pbuf_is(CORE_MEM_NSEC_SHM, pa, size))
1375 		mobj = mobj_shm_alloc(pa, size, co);
1376 	else if ((!(pa & SMALL_PAGE_MASK)) && size <= SMALL_PAGE_SIZE)
1377 		mobj = mobj_mapped_shm_alloc(&pa, 1, 0, co);
1378 
1379 	if (!mobj)
1380 		goto err;
1381 
1382 	return mobj;
1383 err:
1384 	thread_rpc_free_arg(co);
1385 	mobj_free(mobj);
1386 	return NULL;
1387 }
1388 
1389 static bool get_rpc_arg(uint32_t cmd, size_t num_params,
1390 			struct optee_msg_arg **arg_ret, uint64_t *carg_ret)
1391 {
1392 	struct thread_ctx *thr = threads + thread_get_id();
1393 	struct optee_msg_arg *arg = thr->rpc_arg;
1394 	struct mobj *mobj;
1395 	size_t sz = OPTEE_MSG_GET_ARG_SIZE(THREAD_RPC_MAX_NUM_PARAMS);
1396 
1397 	if (num_params > THREAD_RPC_MAX_NUM_PARAMS)
1398 		return false;
1399 
1400 	if (!arg) {
1401 		mobj = thread_rpc_alloc_arg(sz);
1402 		if (!mobj)
1403 			return false;
1404 
1405 		arg = mobj_get_va(mobj, 0);
1406 		if (!arg) {
1407 			thread_rpc_free_arg(mobj_get_cookie(mobj));
1408 			return false;
1409 		}
1410 
1411 		thr->rpc_arg = arg;
1412 		thr->rpc_mobj = mobj;
1413 	}
1414 
1415 	memset(arg, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
1416 	arg->cmd = cmd;
1417 	arg->num_params = num_params;
1418 	arg->ret = TEE_ERROR_GENERIC; /* in case value isn't updated */
1419 
1420 	*arg_ret = arg;
1421 	*carg_ret = mobj_get_cookie(thr->rpc_mobj);
1422 	return true;
1423 }
1424 
1425 uint32_t thread_rpc_cmd(uint32_t cmd, size_t num_params,
1426 			struct optee_msg_param *params)
1427 {
1428 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1429 	struct optee_msg_arg *arg;
1430 	uint64_t carg;
1431 	size_t n;
1432 
1433 	/* The source CRYPTO_RNG_SRC_JITTER_RPC is safe to use here */
1434 	plat_prng_add_jitter_entropy(CRYPTO_RNG_SRC_JITTER_RPC,
1435 				     &thread_rpc_pnum);
1436 
1437 	if (!get_rpc_arg(cmd, num_params, &arg, &carg))
1438 		return TEE_ERROR_OUT_OF_MEMORY;
1439 
1440 	memcpy(arg->params, params, sizeof(*params) * num_params);
1441 
1442 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1443 	thread_rpc(rpc_args);
1444 	for (n = 0; n < num_params; n++) {
1445 		switch (params[n].attr & OPTEE_MSG_ATTR_TYPE_MASK) {
1446 		case OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT:
1447 		case OPTEE_MSG_ATTR_TYPE_VALUE_INOUT:
1448 		case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT:
1449 		case OPTEE_MSG_ATTR_TYPE_RMEM_INOUT:
1450 		case OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT:
1451 		case OPTEE_MSG_ATTR_TYPE_TMEM_INOUT:
1452 			params[n] = arg->params[n];
1453 			break;
1454 		default:
1455 			break;
1456 		}
1457 	}
1458 	return arg->ret;
1459 }
1460 
1461 /**
1462  * Free physical memory previously allocated with thread_rpc_alloc()
1463  *
1464  * @cookie:	cookie received when allocating the buffer
1465  * @bt:		must be the same as supplied when allocating
1466  * @mobj:	mobj that describes allocated buffer
1467  *
1468  * This function also frees corresponding mobj.
1469  */
1470 static void thread_rpc_free(unsigned int bt, uint64_t cookie, struct mobj *mobj)
1471 {
1472 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1473 	struct optee_msg_arg *arg;
1474 	uint64_t carg;
1475 
1476 	if (!get_rpc_arg(OPTEE_MSG_RPC_CMD_SHM_FREE, 1, &arg, &carg))
1477 		return;
1478 
1479 	arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1480 	arg->params[0].u.value.a = bt;
1481 	arg->params[0].u.value.b = cookie;
1482 	arg->params[0].u.value.c = 0;
1483 
1484 	mobj_free(mobj);
1485 
1486 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1487 	thread_rpc(rpc_args);
1488 }
1489 
1490 /**
1491  * Allocates shared memory buffer via RPC
1492  *
1493  * @size:	size in bytes of shared memory buffer
1494  * @align:	required alignment of buffer
1495  * @bt:		buffer type OPTEE_MSG_RPC_SHM_TYPE_*
1496  * @payload:	returned physical pointer to buffer, 0 if allocation
1497  *		failed.
1498  * @cookie:	returned cookie used when freeing the buffer
1499  */
1500 static struct mobj *thread_rpc_alloc(size_t size, size_t align, unsigned int bt)
1501 {
1502 	uint32_t rpc_args[THREAD_RPC_NUM_ARGS] = { OPTEE_SMC_RETURN_RPC_CMD };
1503 	struct optee_msg_arg *arg;
1504 	uint64_t carg;
1505 	struct mobj *mobj = NULL;
1506 	uint64_t cookie;
1507 
1508 	if (!get_rpc_arg(OPTEE_MSG_RPC_CMD_SHM_ALLOC, 1, &arg, &carg))
1509 		return NULL;
1510 
1511 	arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
1512 	arg->params[0].u.value.a = bt;
1513 	arg->params[0].u.value.b = size;
1514 	arg->params[0].u.value.c = align;
1515 
1516 	reg_pair_from_64(carg, rpc_args + 1, rpc_args + 2);
1517 	thread_rpc(rpc_args);
1518 
1519 	if (arg->ret != TEE_SUCCESS)
1520 		return NULL;
1521 
1522 	if (arg->num_params != 1)
1523 		return NULL;
1524 
1525 	if (arg->params[0].attr == OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT) {
1526 		cookie = arg->params[0].u.tmem.shm_ref;
1527 		mobj = mobj_shm_alloc(arg->params[0].u.tmem.buf_ptr,
1528 				      arg->params[0].u.tmem.size,
1529 				      cookie);
1530 	} else if (arg->params[0].attr == (OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT |
1531 					   OPTEE_MSG_ATTR_NONCONTIG)) {
1532 		cookie = arg->params[0].u.tmem.shm_ref;
1533 		mobj = msg_param_mobj_from_noncontig(
1534 			arg->params[0].u.tmem.buf_ptr,
1535 			arg->params[0].u.tmem.size,
1536 			cookie,
1537 			true);
1538 	} else {
1539 		return NULL;
1540 	}
1541 
1542 	if (!mobj) {
1543 		thread_rpc_free(bt, cookie, mobj);
1544 		return NULL;
1545 	}
1546 
1547 	assert(mobj_is_nonsec(mobj));
1548 
1549 	return mobj;
1550 }
1551 
1552 struct mobj *thread_rpc_alloc_payload(size_t size)
1553 {
1554 	return thread_rpc_alloc(size, 8, OPTEE_MSG_RPC_SHM_TYPE_APPL);
1555 }
1556 
1557 void thread_rpc_free_payload(struct mobj *mobj)
1558 {
1559 	thread_rpc_free(OPTEE_MSG_RPC_SHM_TYPE_APPL, mobj_get_cookie(mobj),
1560 			mobj);
1561 }
1562 
1563 struct mobj *thread_rpc_alloc_global_payload(size_t size)
1564 {
1565 	return thread_rpc_alloc(size, 8, OPTEE_MSG_RPC_SHM_TYPE_GLOBAL);
1566 }
1567 
1568 void thread_rpc_free_global_payload(struct mobj *mobj)
1569 {
1570 	thread_rpc_free(OPTEE_MSG_RPC_SHM_TYPE_GLOBAL, mobj_get_cookie(mobj),
1571 			mobj);
1572 }
1573