Hello, After a kernel update to v6.13-rc1, we have been increasingly seeing following occasional OP-TEE (v4.2.0) panic: E/TC:0 dump_fail_filter:425 Violation @0xce01b000, non-secure privileged read, AXI ID 5c8 E/TC:0 Panic at core/arch/arm/plat-stm32mp1/plat_tzc400.c:30 <tzc_it_handler> E/TC:0 TEE load address @ 0xce000000 This happens at kernel boot time, when loaded by barebox. The probability that this happens, seems to be inversely proportional to how long the system was powered off prior to Power-on reset... The kernel /reserved-memory entry has a no-map entry for OP-TEE, so this looks correct. barebox maps the OP-TEE range as uncached and with eXecute Never set. Indeed, if we jump to the OP-TEE memory directly, we get a prefetch error from within barebox without hitting the firewall as expected. If the barebox MMU is disabled and we try to execute from 0xce000000, we get an expected panic from OP-TEE: E/TC:0 tzc_it_handler:26 TZC permission failure E/TC:0 dump_fail_filter:420 Permission violation on filter 0 E/TC:0 dump_fail_filter:425 Violation @0xce000000, non-secure privileged read, AXI ID 4c0 E/TC:0 Panic at core/arch/arm/plat-stm32mp1/plat_tzc400.c:30 <tzc_it_handler> E/TC:0 TEE load address @ 0xce000000 Note that this is a different AXI ID (0x4c0) than the one we see related to the spurious read (0x5c8). In order to further debug this, it would be useful to know which AXI master has ID 0x5c8. The reference manual (RM0475) has Table 20. "NSAID and AXI_ID mapping" in RM0475 but it contains no 0x5c8. 0x4c0 is expectedly the CA7 itself. Can someone from ST please chime in with the information what AXI master ID 0x5c8 maps to? Thanks, Ahmad -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
