From: Ahmad Fatoum <a.fatoum@pengutronix.de>
To: "linux-stm32@st-md-mailman.stormreply.com"
<linux-stm32@st-md-mailman.stormreply.com>,
Alexandre Torgue <alexandre.torgue@st.com>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>,
Oleksij Rempel <ore@pengutronix.de>,
"barebox@lists.infradead.org" <barebox@lists.infradead.org>
Subject: AXI ID 0x5c8 on STM32MP13
Date: Thu, 5 Dec 2024 14:40:32 +0100 [thread overview]
Message-ID: <e81f5b48-02e9-423c-984e-b7dfa7753f27@pengutronix.de> (raw)
Hello,
After a kernel update to v6.13-rc1, we have been increasingly seeing
following occasional OP-TEE (v4.2.0) panic:
E/TC:0 dump_fail_filter:425 Violation @0xce01b000, non-secure privileged read, AXI ID 5c8
E/TC:0 Panic at core/arch/arm/plat-stm32mp1/plat_tzc400.c:30 <tzc_it_handler>
E/TC:0 TEE load address @ 0xce000000
This happens at kernel boot time, when loaded by barebox. The probability that
this happens, seems to be inversely proportional to how long the system
was powered off prior to Power-on reset...
The kernel /reserved-memory entry has a no-map entry for OP-TEE, so this
looks correct.
barebox maps the OP-TEE range as uncached and with eXecute Never set.
Indeed, if we jump to the OP-TEE memory directly, we get a prefetch error
from within barebox without hitting the firewall as expected.
If the barebox MMU is disabled and we try to execute from 0xce000000, we
get an expected panic from OP-TEE:
E/TC:0 tzc_it_handler:26 TZC permission failure
E/TC:0 dump_fail_filter:420 Permission violation on filter 0
E/TC:0 dump_fail_filter:425 Violation @0xce000000, non-secure privileged read, AXI ID 4c0
E/TC:0 Panic at core/arch/arm/plat-stm32mp1/plat_tzc400.c:30 <tzc_it_handler>
E/TC:0 TEE load address @ 0xce000000
Note that this is a different AXI ID (0x4c0) than the one we see related
to the spurious read (0x5c8).
In order to further debug this, it would be useful to know which AXI master
has ID 0x5c8. The reference manual (RM0475) has Table 20. "NSAID and AXI_ID
mapping" in RM0475 but it contains no 0x5c8. 0x4c0 is expectedly the CA7
itself.
Can someone from ST please chime in with the information what AXI master
ID 0x5c8 maps to?
Thanks,
Ahmad
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
next reply other threads:[~2024-12-05 13:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-05 13:40 Ahmad Fatoum [this message]
2024-12-06 10:41 ` [Linux-stm32] " Yann Gautier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e81f5b48-02e9-423c-984e-b7dfa7753f27@pengutronix.de \
--to=a.fatoum@pengutronix.de \
--cc=alexandre.torgue@st.com \
--cc=barebox@lists.infradead.org \
--cc=kernel@pengutronix.de \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=ore@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox