Hi Mattijs, On Thu, Oct 15, 2026 at 3:55 PM Mattijs Korpershoek <[email protected]> wrote: > > flush_cache() expects a U-Boot physical address, but avb_verify's > mmc_read_and_flush() passes a raw pointer cast to ulong. > On sandbox, host heap pointers (e.g. 0x1a27ee70) can be outside the > emulated SDRAM region (0x0 to gd->ram_size), causing map_sysmem() > inside flush_cache() to crash: > > phys_to_virt: Cannot map sandbox address 1a27ee70 > (SDRAM from 0 to 10000000) > > Fix the crash by using map_to_sysmem() to convert the buffer > pointer to a proper U-Boot address. > > Signed-off-by: Mattijs Korpershoek <[email protected]> > --- > common/avb_verify.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/common/avb_verify.c b/common/avb_verify.c > index 09f1534c3cc5..d157adc4af07 100644 > --- a/common/avb_verify.c > +++ b/common/avb_verify.c > @@ -7,6 +7,7 @@ > #include <blk.h> > #include <cpu_func.h> > #include <image.h> > +#include <mapmem.h> > #include <malloc.h> > #include <part.h> > #include <tee.h> > @@ -346,7 +347,7 @@ static unsigned long mmc_read_and_flush(struct mmc_part > *part, > blks = blk_dread(part->mmc_blk, > start, sectors, tmp_buf); > /* flush cache after read */ > - flush_cache((ulong)tmp_buf, sectors * part->info.blksz); > + flush_cache(map_to_sysmem(tmp_buf), sectors * part->info.blksz); > > if (unaligned) > memcpy(buffer, tmp_buf, sectors * part->info.blksz); > > -- > 2.56.0 >
Reviewed-by: Igor Opaniuk <[email protected]>
