Thanks David.

Compiler optimization seems to be a valid case, but it is interesting to note that although we can have W only pages, we cannot do it because of compiler optimizations.

I changed mapping to map output param to RW,  more test cases pass this time :)

However, If I map input param to R only, few test cases still fail.

I do not think multiple parameters can share the same page.

The shared buffer allocated by linux tee-driver is always page aligned: https://github.com/linaro-swg/linux/blob/optee/drivers/tee/tee_shm_pool.c#L126

and linux kernel api will always allocate a different shared buffer for each of the parameter:

https://github.com/OP-TEE/optee_client/blob/master/libteec/src/tee_client_api.c#L144

Also, I checked the failing test cases (ex: 1011) , I do not see anything wrong.

On TEE side, I expected to see an abort and put a break point in abort handler, but it is never hit.