{"action":"closed","issue":{"url":"https://api.github.com/repos/OP-TEE/optee_os/issues/1872","repository_url":"https://api.github.com/repos/OP-TEE/optee_os","labels_url":"https://api.github.com/repos/OP-TEE/optee_os/issues/1872/labels{/name}","comments_url":"https://api.github.com/repos/OP-TEE/optee_os/issues/1872/comments","events_url":"https://api.github.com/repos/OP-TEE/optee_os/issues/1872/events","html_url":"https://github.com/OP-TEE/optee_os/issues/1872","id":264361696,"number":1872,"title":"TA from older version crashes stack unwind layer in OP-TEE (WAS Stack unwind causes data abort on Rcar M3 board)","user":{"login":"lorc","id":240174,"avatar_url":"https://avatars2.githubusercontent.com/u/240174?v=4","gravatar_id":"","url":"https://api.github.com/users/lorc","html_url":"https://github.com/lorc","followers_url":"https://api.github.com/users/lorc/followers","following_url":"https://api.github.com/users/lorc/following{/other_user}","gists_url":"https://api.github.com/users/lorc/gists{/gist_id}","starred_url":"https://api.github.com/users/lorc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lorc/subscriptions","organizations_url":"https://api.github.com/users/lorc/orgs","repos_url":"https://api.github.com/users/lorc/repos","events_url":"https://api.github.com/users/lorc/events{/privacy}","received_events_url":"https://api.github.com/users/lorc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2017-10-10T20:16:36Z","updated_at":"2017-10-11T14:27:31Z","closed_at":"2017-10-11T14:27:31Z","author_association":"CONTRIBUTOR","body":"During testing of #1631 on my RCAR M3 board I have encountered next fault:\r\n\r\n> * regression_1007 Test Panic\r\n> ta_entry_panic: enterERROR:   [0x0] TEE-CORE: \r\n> ERROR:   [0x0] TEE-CORE: TA panicked with code 0xbeef\r\n> ERROR:   [0x0] TEE-CORE: regs = 0x44179f30\r\n> ERROR:   [0x0] TEE-CORE: regs->x1 = 0x15\r\n> ERROR:   [0x0] TEE-CORE: \r\n> ERROR:   [0x0] TEE-CORE: Core data-abort at address 0x15 (alignment fault)\r\n> ERROR:   [0x0] TEE-CORE:  esr 0x96000021  ttbr0 0x1000044173020   ttbr1 0x00000000   cidr 0x0\r\n> ERROR:   [0x0] TEE-CORE:  cpu #1          cpsr 0x60000004\r\n> ERROR:   [0x0] TEE-CORE:  x0  0000000044179da8 x1  0000000000000000\r\n> ERROR:   [0x0] TEE-CORE:  x2  0000000000000110 x3  0000000000000110\r\n> ERROR:   [0x0] TEE-CORE:  x4  0000000044179b33 x5  00000000fffffffc\r\n> ERROR:   [0x0] TEE-CORE:  x6  0000000000000004 x7  0000000000000020\r\n> ERROR:   [0x0] TEE-CORE:  x8  0000000000000002 x9  0000000000000078\r\n> ERROR:   [0x0] TEE-CORE:  x10 0000000044179d78 x11 0000000044179d98\r\n> ERROR:   [0x0] TEE-CORE:  x12 00000000df4b59f7 x13 0000000080002780\r\n> ERROR:   [0x0] TEE-CORE:  x14 000000004413d6c0 x15 00000000df4b59f7\r\n> ERROR:   [0x0] TEE-CORE:  x16 000000004410e228 x17 0000000000000000\r\n> ERROR:   [0x0] TEE-CORE:  x18 0000000000000000 x19 0000000044179da8\r\n> ERROR:   [0x0] TEE-CORE:  x20 0000000000000015 x21 0000000044145000\r\n> ERROR:   [0x0] TEE-CORE:  x22 00000000ffff3024 x23 0000000080002780\r\n> ERROR:   [0x0] TEE-CORE:  x24 0000000000000006 x25 000000004417a190\r\n> ERROR:   [0x0] TEE-CORE:  x26 0000000000000002 x27 0000000000000006\r\n> ERROR:   [0x0] TEE-CORE:  x28 0000000044165e00 x29 0000000044179d50\r\n> ERROR:   [0x0] TEE-CORE:  x30 000000004410e3a8 elr 000000004410e3a8\r\n> ERROR:   [0x0] TEE-CORE:  sp_el0 0000000044179d50\r\n> ERROR:   [0x0] TEE-CORE: Call stack:\r\n> ERROR:   [0x0] TEE-CORE:  0x000000004410e3a8\r\n> ERROR:   [0x0] TEE-CORE:  0x000000004410e4ec\r\n> ERROR:   [0x0] TEE-CORE:  0x000000004410e204\r\n> ERROR:   [0x0] TEE-CORE:  0x00000000441017ec\r\n> ERROR:   [0x0] TEE-CORE: Panic '[abort] alignement fault!  (trap CPU)' at core/arch/arm/kernel/abort.c:623 <get_fault_type>\r\n> ERROR:   [0x0] TEE-CORE: Call stack:\r\n> ERROR:   [0x0] TEE-CORE:  0x000000004410956c\r\n> \r\n\r\n\r\n`regs = 0x44179f30` and `regs->x1 = 0x15` are my debug messages using this patch:\r\n\r\n```\r\ndiff --git a/core/arch/arm/tee/arch_svc.c b/core/arch/arm/tee/arch_svc.c\r\nindex 32e17a8..bc0b5e8 100644\r\n--- a/core/arch/arm/tee/arch_svc.c\r\n+++ b/core/arch/arm/tee/arch_svc.c\r\n@@ -357,6 +357,7 @@ static void print_panic_stack(struct thread_svc_regs *regs)\r\n        if (tee_ta_get_current_session(&s) != TEE_SUCCESS)\r\n                panic();\r\n        utc = to_user_ta_ctx(s->ctx);\r\n+       TAMSG_RAW(\"regs->x1 = %p\", (void*)regs->x1);\r\n        if (utc->is_32bit)\r\n                get_panic_regs_a32_ta((uint32_t *)regs->x1, &ai);\r\n        else\r\n@@ -376,6 +377,7 @@ uint32_t tee_svc_sys_return_helper(uint32_t ret, bool panic,\r\n        if (panic) {\r\n                TAMSG_RAW(\"\");\r\n                TAMSG_RAW(\"TA panicked with code 0x%\" PRIx32, panic_code);\r\n+               TAMSG_RAW(\"regs = %p\", (void*)regs);\r\n                print_panic_stack(regs);\r\n        }\r\n\r\n```\r\n\r\nLooks like `tee_svc_sys_return_helper` receives invalid pointer in `regs->x1'"}}
{"actor":{"display_login":"lorc"}}