flush_cache() expects a U-Boot physical address, but avb_verify's
mmc_read_and_flush() passes a raw pointer cast to ulong.
On sandbox, host heap pointers (e.g. 0x1a27ee70) can be outside the
emulated SDRAM region (0x0 to gd->ram_size), causing map_sysmem()
inside flush_cache() to crash:

  phys_to_virt: Cannot map sandbox address 1a27ee70
    (SDRAM from 0 to 10000000)

Fix the crash by using map_to_sysmem() to convert the buffer
pointer to a proper U-Boot address.

Signed-off-by: Mattijs Korpershoek <[email protected]>
---
 common/avb_verify.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/common/avb_verify.c b/common/avb_verify.c
index 09f1534c3cc5..d157adc4af07 100644
--- a/common/avb_verify.c
+++ b/common/avb_verify.c
@@ -7,6 +7,7 @@
 #include <blk.h>
 #include <cpu_func.h>
 #include <image.h>
+#include <mapmem.h>
 #include <malloc.h>
 #include <part.h>
 #include <tee.h>
@@ -346,7 +347,7 @@ static unsigned long mmc_read_and_flush(struct mmc_part 
*part,
        blks = blk_dread(part->mmc_blk,
                         start, sectors, tmp_buf);
        /* flush cache after read */
-       flush_cache((ulong)tmp_buf, sectors * part->info.blksz);
+       flush_cache(map_to_sysmem(tmp_buf), sectors * part->info.blksz);
 
        if (unaligned)
                memcpy(buffer, tmp_buf, sectors * part->info.blksz);

-- 
2.56.0

Reply via email to