Hi, experts, For dynamic shared memory usage, I am not very clear. So we need to consult you about the related question. I failed to run xtest 1034 when I used Hafnium as SPMC and OPTEE as SP. Here are the debug logs： #./xtest 1034& [2] 10130 Test ID: 1034 Run test suite with level=0 TEE test application started over default TEE instance ###################################################### # # regression # ###################################################### regression_1034 Test loading a large TA WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000000 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f D/TC:055 0 mobj_ffa_get_by_cookie:381 cookie 0 resurrecting D/TC:??? 0 tee_ta_init_pseudo_ta_session:296 Lookup pseudo TA 25497083-a58a-4fc5-8a72-1ad7b69b8562 D/TC:??? 0 ldelf_load_ldelf:96 ldelf load address 0x40008000 D/LD: ldelf:134 Loading TS 25497083-a58a-4fc5-8a72-1ad7b69b8562 F/TC:??? 0 trace_syscall:151 syscall Add constant time memcmp_ct function #3 <https://github.com/OP-TEE/optee_os/pull/3 > (syscall_get_property) F/TC:??? 0 trace_syscall:151 syscall GitHub usage documentation #5 <https://github.com/OP-TEE/optee_os/pull/5 > (syscall_open_ta_session) #D/TC:??? 0 ldelf_syscall_open_bin:143 Lookup user TA ELF 25497083-a58a-4fc5-8a72-1ad7b69b8562 (early TA) D/TC:??? 0 ldelf_syscall_open_bin:146 res=0xffff0008 D/TC:??? 0 ldelf_syscall_open_bin:143 Lookup user TA ELF 25497083-a58a-4fc5-8a72-1ad7b69b8562 (Secure Storage TA) VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(60): 0x84000073 0x50 0x50 0x0 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x84000073 VERBOSE: Marked sending complete. Current share states: SHARE 0x0 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 1 retrieved, sender's original mode: 0x7 SHARE 0x1 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 0 retrieved, sender's original mode: 0x7 WARNING: Atf_Debug(60): 0x84000061 0x0 0x1 0x0 0x0 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f E/TC:055 0 mobj_ffa_get_by_cookie:384 Populating mobj from rx buffer, cookie 0x1 VERBOSE: Hafnium_Debug ffa_handler func:0x84000074 Current share states: SHARE 0x0 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 1 retrieved, sender's original mode: 0x7 SHARE 0x1 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 0 retrieved, sender's original mode: 0x7 Current share states: SHARE 0x0 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 1 retrieved, sender's original mode: 0x7 SHARE 0x1 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 1 retrieved, sender's original mode: 0x7 VERBOSE: Hafnium_Debug ffa_handler func:0x84000065 VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f D/TC:??? 0 ldelf_syscall_open_bin:146 res=0xffff0008 D/TC:??? 0 ldelf_syscall_open_bin:143 Lookup user TA ELF 25497083-a58a-4fc5-8a72-1ad7b69b8562 (REE) VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(55): 0x8400006f 0x8001 0x0 0x80000001 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400006f VERBOSE: Hafnium_Debug ffa_handler func:0x84000070 WARNING: Atf_Debug(55): 0x84000070 0x80010000 0x0 0x0 0x1 0x0 0x0 0x0 WARNING: Atf_Debug(58): 0x84000073 0x1190 0x1000 0x0 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x84000073 Current share states: SHARE 0x0 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 1 retrieved, sender's original mode: 0x7 SHARE 0x1 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): fully sent with 1 fragments, 1 retrieved, sender's original mode: 0x7 SHARE 0x2 (from VM 0x0, attributes 0x2f, flags 0x8, tag 0, to 1 recipients [VM 0x8001: 0x6 (offset 48)]): partially sent with 1 fragments, 0 retrieved, sender's original mode: 0x7 WARNING: Atf_Debug(58): 0x8400007a 0x2 0x0 0x1000 0x0 0x0 0x0 0x0 WARNING: Atf_Debug(58): 0x8400007b 0x2 0x0 0x190 0x0 0x0 0x0 0x0 VERBOSE: Hafnium_Debug ffa_handler func:0x8400007b VERBOSE: Hafnium_Debug fragment_length:0x190 VERBOSE: Hafnium_Debug fragment_copy:00000000ff30e000, from_msg:00000008bdd48000 ERROR: Data abort: pc=0xff21a688, esr=0x96000006, ec=0x25, far=0x9c Panic: EL2 exception the error occured when Hafnium run the code: api_ffa_mem_frag_tx memcpy_s(fragment_copy, MM_PPOOL_ENTRY_SIZE, from_msg, fragment_length); It seems that I did not add the page table at 0x00000000ff30e000 or 0x00000008bdd48000, but I am not quite clear about what fragment_copy and from_msg mean. Can someone help me see what the problem is? Regards, Yuye.