prabhakalad has quit [Quit: Konversation terminated!]
bjoto has joined #u-boot
prabhakalad has joined #u-boot
zibolo has quit [Ping timeout: 260 seconds]
frieder has quit [Ping timeout: 260 seconds]
sszy has joined #u-boot
frieder has joined #u-boot
warpme has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
mckoan|away has quit [Quit: Quitting irssi IRC Client, bye.]
mckoan has joined #u-boot
ajg_linaro has joined #u-boot
Poltawer has joined #u-boot
apritzel has joined #u-boot
ikarso has quit [Quit: Connection closed for inactivity]
rvalue has quit [Read error: Connection reset by peer]
rvalue has joined #u-boot
haritz has joined #u-boot
haritz has quit [Changing host]
haritz has joined #u-boot
mckoan is now known as mckoan|away
ikarso has joined #u-boot
teknix has joined #u-boot
ungeskriptet has quit [Ping timeout: 265 seconds]
gsz has quit [Ping timeout: 260 seconds]
ungeskriptet has joined #u-boot
<Jones42>
what's the canonical branch for kirkstone meta-secure-imx? ch or hs?
clamor has quit [Ping timeout: 252 seconds]
clamor has joined #u-boot
gsz has joined #u-boot
Poltawer has quit [Quit: WeeChat 4.7.0]
gsz has quit [Ping timeout: 252 seconds]
slobodan has joined #u-boot
mmu_man has quit [Ping timeout: 255 seconds]
goliath has quit [Quit: SIGSEGV]
jdautheribes has joined #u-boot
naoki has quit [Quit: naoki]
frieder has quit [Remote host closed the connection]
<jdautheribes>
Hi all, I work on secureboot for the imx93 platform and when I enable the 'AHAB_BOOT', I got a synchronous abort in the SPL.
<jdautheribes>
I'm using u-boot v2025.07 but I can reproduce it with earlier versions too.
<jdautheribes>
It happens in the following simplified code path: read_auth_image() --> ahab_verify_cntr_image() --> ele_verify_image() -> imx8ulp_mu_call() --> imx8ulp_mu_write() --> mu_hal_sendmsg() --> readl()
<jdautheribes>
Any ideas pls? Thanks!
gsz has joined #u-boot
gsz has quit [Ping timeout: 252 seconds]
<marex>
jdautheribes: if it happens in readl, then you are either accessing something which has clock disabled, or which is blocked from NS world by secure MMU tables
<jdautheribes>
I'm using the default imx93 evk dtb and defconfig, why would you recommend to debug further pls?
<jdautheribes>
what*
<marex>
it doesnt work, what else could you do, toss the board into the trash and give up I guess
<marex>
oh ... what ... which address does trigger the fault (printf the readl parameter) and then check MX93 RM for what address this is
goliath has joined #u-boot
<marex>
you probably need to make sure the ELE container is up to date and not corrupted
<marex>
or AHAB container, that is
<jdautheribes>
Yeah I already dumped the address, which is 0xb900004132140021 and seems a bit high, doesn't it? I also traced where it's set and it happens in rom_api_download_image()-->g_rom_api->download_image() which is, if I understand correctly, directly provided the internal ROM so I can;t debug further.
<jdautheribes>
I'm uisng the latest AHAB contaienr, but I will double check, thanks.
<marex>
can you point the exact line of code ?
<marex>
the address you listed is bogus, for one thing, it is unaligned which will trigger a fault, and for other, it is too larger
<marex>
print it using %08x , with (u32)(uintptr_t) cast ... that should give you a valid result
<marex>
and if it is still unaligned, then there's something corrupted there
<jdautheribes>
And yes it does work when I disable "AHAB_BOOT"
slobodan has quit [Ping timeout: 255 seconds]
slobodan has joined #u-boot
mmu_man has joined #u-boot
K900 has quit [Remote host closed the connection]
K900 has joined #u-boot
<marex>
jdautheribes: and in that case, is mu_type aligned ?
<jdautheribes>
It's not aligned but we don't go through the readl() call when AHAB_BOOT is not selected.
<jdautheribes>
e.g. i got the same 0x32140021 address
<marex>
which readl() is that ?
<marex>
oh
<marex>
jdautheribes: in drivers/misc/imx_ele/ele_mu.c , add #define DEBUG right at the beginning of the file , that should ungate debug prints in imx8ulp_mu_probe()
<marex>
you should be able to see the base extracted from DT in
<marex>
218 debug("mu base 0x%lx\n", (ulong)priv->base);
<marex>
it seems the base is somehow corrupted in mu_hal_sendmsg()
<marex>
print the download_image dest, offset, size params, and print also address of struct imx8ulp_mu *priv , could it be the download writes somewhere into SRAM and corrupts U-Boot internal state ?
ajg_linaro has quit [Ping timeout: 255 seconds]
<jdautheribes>
imx8ulp_mu *priv stays consistent (0x204e6758), it's only the mu_type which seems to be corrupted.
<jdautheribes>
I'm adding the logs you requested, thanks for you help!