TEE_ResetPersistentObjectEnumerator() crashed TA

[invhchan]

Hi,

With linaro version 16.06, TA is crashed when TEE_ResetPersistentObjectEnumerator() is called, is it a known issue?

Thanks,
Humane

[jforissier]

Hi @invhchan,

No it's not. Can you try with the latest optee_os? Otherwise please give us some more details, and if possible, a test case to reproduce the issue.

[invhchan]

Hi,

Using the hello world example:
https://github.com/linaro-swg/hello_world

Calling get_enumerator() at the entry point of TA would cause the crash:
TEE_Result TA_EXPORT TA_OpenSessionEntryPoint(uint32_t paramTypes,
TEE_Param params[4],
void **sessionContext)
{
TEE_ObjectEnumHandle enumerator;
UNUSED_PARAMETER(paramTypes);
UNUSED_PARAMETER(params);

enumerator = get_enumerator();
return TEE_SUCCESS;

}

#define DEFAULT_STORAGE_ID TEE_STORAGE_PRIVATE
static TEE_ObjectEnumHandle get_enumerator(void){

TEE_Result ret;
TEE_ObjectEnumHandle enumerator;

ret = TEE_AllocatePersistentObjectEnumerator(&enumerator);

if(ret != TEE_SUCCESS){
    DBG_PRINTF( "PB_TA TS TEE_AllocatePersistentObjectEnumerator failed %s\n",
                r2s(ret));
    return NULL;
}
TEE_ResetPersistentObjectEnumerator(enumerator);

ret = TEE_StartPersistentObjectEnumerator(enumerator, DEFAULT_STORAGE_ID);

if (ret != TEE_SUCCESS){
    DBG_PRINTF( "PB_TA TS TEE_StartPersistentObjectEnumerator failed %s\n",
                r2s(ret));
    TEE_FreePersistentObjectEnumerator(enumerator);
    return NULL;
}

return enumerator;

}

Error log:
MERROR: TEE-CORE: ERROR: USER-TA: TA Entry get_enumerator
^MFLOW: [0x0] TEE-CORE:trace_syscall:143: syscall #45 (syscall_storage_alloc_enum)
^MFLOW: [0x0] TEE-CORE:trace_syscall:143: syscall #47 (syscall_storage_reset_enum)
^MERROR: TEE-CORE:
^MERROR: TEE-CORE: core data-abort at address 0x50 (translation fault)
^MERROR: TEE-CORE: esr 0x96000005 ttbr0 0x10000ff092c20 ttbr1 0x00000000 cidr 0x0
^MERROR: TEE-CORE: cpu #5 cpsr 0x60000004
^MERROR: TEE-CORE: x0 0000000000000000 x1 00000000ff07b660
^MERROR: TEE-CORE: x2 000000004001464a x3 000000000007b660
^MERROR: TEE-CORE: x4 00000000ff03b198 x5 00000000400a7940
^MERROR: TEE-CORE: x6 0000000000000000 x7 0000000000000020
^MERROR: TEE-CORE: x8 000000004028fa44 x9 00000000ff090700
^MERROR: TEE-CORE: x10 00000000ff07b7e0 x11 00000000ff07b6e0
^MERROR: TEE-CORE: x12 00000000ffff9eec x13 0000000040014718
^MERROR: TEE-CORE: x14 0000000040085231 x15 0000000000000000
^MERROR: TEE-CORE: x16 00000000ff016488 x17 0000000000000000
^MERROR: TEE-CORE: x18 0000000000000000 x19 00000000ff07b660
^MERROR: TEE-CORE: x20 000000000007b660 x21 0000000000000000
^MERROR: TEE-CORE: x22 00000000000005d0 x23 00000000ff090934
^MERROR: TEE-CORE: x24 0000000000000000 x25 0000000000000000
^MERROR: TEE-CORE: x26 0000000000000000 x27 00000000ff07bb50
^MERROR: TEE-CORE: x28 00000000ff090938 x29 00000000ff090680
^MERROR: TEE-CORE: x30 00000000ff0164b0 elr 00000000ff0164d0
^MERROR: TEE-CORE: sp_el0 00000000ff090680
^MERROR: TEE-CORE: Unexpected page fault! Trap CPU
^MERROR: TEE-CORE: PANIC: tee_pager_handle_fault core/arch/arm/include/mm/tee_pager.h:133

[jforissier]

Hi @invhchan,

Thanks for providing some test code, I can reproduce the crash. I'll look into it.