TEE OS panic when enable kasan

[qazsdcx]

Hi, experts

I try to enable kasan on my borad, op-tee(version is 4.1.0) run with panic.
This is my conf.mk:

CFG_CORE_ASLR = n
CFG_CORE_SANITIZE_KADDRESS = y
CFG_WITH_PAGER = y
CFG_ASAN_SHADOW_OFFSET = 0x703871c0

This is panic log:

The call stack:

I have some questions:

1. in core_mmu.c

	if ((IS_ENABLED(CFG_CORE_SANITIZE_KADDRESS) &&
	    IS_ENABLED(CFG_WITH_PAGER))) {
		/*
		 * Asan ram is part of MEM_AREA_TEE_RAM_RW when pager is
		 * disabled.
		 */
		ADD_PHYS_MEM(MEM_AREA_TEE_ASAN, ASAN_MAP_PA, ASAN_MAP_SZ);
	}

if I want to enbale the kasan, the CFG_CORE_SANITIZE_KADDRESS and CFG_WITH_PAGER must set to y?
2. If I set CFG_WITH_PAGER=y the tee-os run with panic.
If my conf.mk is:

CFG_CORE_ASLR = n
CFG_CORE_SANITIZE_KADDRESS = y
CFG_WITH_PAGER = n
CFG_ASAN_SHADOW_OFFSET = 0x703871c0

and I add following code in core_mmu.c

ADD_PHYS_MEM(MEM_AREA_TEE_ASAN, ASAN_MAP_PA, ASAN_MAP_SZ);

tee-os run ok.
So, the above operation configuration is correct?

Thank you!

[jenswi-linaro]

It depends on where you put the ASAN area. In core_mmu.c it's assumed that MEM_AREA_TEE_RAM_RW will cover that range too. But if it doesn't, you need to add a line like above.

Out of curiosity, do you use CFG_WITH_PAGER=y on an Arm v8-A platform?

[qazsdcx]

Thank you for your reply.

Out of curiosity, do you use CFG_WITH_PAGER=y on an Arm v8-A platform?
-- I run op-tee os on Arm v8-A platform(A78-AE).

As mentioned above, If I want to enbale kasan, CFG_WITH_PAGER must set to n, otherwise the optee os run with panic.
I can run pass with the conf.mk

CFG_CORE_ASLR = n
CFG_CORE_SANITIZE_KADDRESS = y
CFG_WITH_PAGER = n
CFG_ASAN_SHADOW_OFFSET = 0x703871c0

and add the modification:

-if ((IS_ENABLED(CFG_CORE_SANITIZE_KADDRESS) &&
-	  IS_ENABLED(CFG_WITH_PAGER))) {
+if ((IS_ENABLED(CFG_CORE_SANITIZE_KADDRESS)) {
/*
	* Asan ram is part of MEM_AREA_TEE_RAM_RW when pager is
	* disabled.
	*/
ADD_PHYS_MEM(MEM_AREA_TEE_ASAN, ASAN_MAP_PA, ASAN_MAP_SZ);
}

[qazsdcx]

Hi, experts

I have another question about kasan.
op-tee start with panic. op-tee vesion is 4.1.0 and it run on ARM-A78 platform.

[ 3.797683][INFO] BL31: Initializing runtime services
[ 3.803229][INFO] BL31: bl31 init last 45ms
[ 3.807806][INFO] BL31: Initializing BL32
[ 3.878730][I/TC]
[ 3.880944][E/TC] 00 0 Panic at core/kernel/asan.c:190 <check_access>
[ 3.888007][E/TC] 00 0 TEE load address @ 0x80200000
[ 3.893453][E/TC] 00 0 Call stack:
[ 3.897179][E/TC] 00 0 0x80208da8
[ 3.900905][E/TC] 00 0 0x802233b8
[ 3.904631][E/TC] 00 0 0x8021f03c
[ 3.908358][E/TC] 00 0 0x80228e9c
[ 3.912084][E/TC] 00 0 0x8020477c
[ 3.915810][E/TC] 00 0 0x80208c08

the tee.dmp info:

the code:

So is the canaries codes causing the panic?

[jenswi-linaro]

The memory is for some reason not writable according to kasan. I guess you need to debug and fix this problem on your platform port.