U-Boot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Richard Weinberger <richard@sigma-star.at>
To: u-boot@lists.denx.de
Cc: alice.guo@nxp.com, peng.fan@nxp.com, upstream+uboot@sigma-star.at
Subject: TZASC misconfiguration on i.mx8m
Date: Thu, 04 Jun 2026 19:24:35 +0200	[thread overview]
Message-ID: <3208216.Ym5mLc6kNg@nailgun> (raw)

Hello!

FYI, in arch/arm/mach-imx/imx8m/soc.c enable_tzc380() U-Boot configures
region0 to allow secure and non-secure world access.
This is known to be problematic and allows circumventing the TrustZone due to
memory aliasing[0][1].

It causes also recent OP-TEE to panic at startup:
E/TC:0 0 Panic 'region0 is not secure configured, non-secure memory alias access possible!' at core/arch/arm/plat-imx/tzc380.c:217 <imx_configure_tzasc>

This is not a theoretical issue.
On my i.mx8mm evk Board I was able to exploit this and dump all OP-TEE memory from Linux.

Thanks,
//richard

[0] https://github.com/ARM-software/arm-trusted-firmware/commit/9bf148071aad597e7fe7d1080c00aeb35b67a3dd
[1] https://github.com/OP-TEE/optee_os/commit/443c5817de47f1bd19091b419806898070382a67 

-- 
​​​​​sigma star gmbh | Eduard-Bodem-Gasse 6, 6020 Innsbruck, AUT UID/VAT Nr:
ATU 66964118 | FN: 374287y



             reply	other threads:[~2026-06-04 17:24 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-04 17:24 Richard Weinberger [this message]
2026-06-05 14:52 ` TZASC misconfiguration on i.mx8m Richard Weinberger
2026-06-08  1:42   ` Ye Li
2026-06-08  3:07     ` Richard Weinberger
2026-06-09  1:44       ` Ye Li
2026-06-09  6:53         ` Richard Weinberger
2026-06-09  9:56           ` Ye Li
2026-06-09  9:58             ` Richard Weinberger
2026-06-09 10:12               ` Ye Li
2026-06-09 10:15                 ` Richard Weinberger
2026-06-10  7:21                   ` [EXT] " Sahil Malhotra
2026-06-11 14:53     ` Fabio Estevam
2026-06-12  9:59       ` Ye Li

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3208216.Ym5mLc6kNg@nailgun \
    --to=richard@sigma-star.at \
    --cc=alice.guo@nxp.com \
    --cc=peng.fan@nxp.com \
    --cc=u-boot@lists.denx.de \
    --cc=upstream+uboot@sigma-star.at \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox