TZASC misconfiguration on i.mx8m

[Richard Weinberger]

Hello!

FYI, in arch/arm/mach-imx/imx8m/soc.c enable_tzc380() U-Boot configures
region0 to allow secure and non-secure world access.
This is known to be problematic and allows circumventing the TrustZone due to
memory aliasing[0][1].

It causes also recent OP-TEE to panic at startup:
E/TC:0 0 Panic 'region0 is not secure configured, non-secure memory alias access possible!' at core/arch/arm/plat-imx/tzc380.c:217 <imx_configure_tzasc>

This is not a theoretical issue.
On my i.mx8mm evk Board I was able to exploit this and dump all OP-TEE memory from Linux.

Thanks,
//richard

[0] https://github.com/ARM-software/arm-trusted-firmware/commit/9bf148071aad597e7fe7d1080c00aeb35b67a3dd
[1] https://github.com/OP-TEE/optee_os/commit/443c5817de47f1bd19091b419806898070382a67 

-- 
​​​​​sigma star gmbh | Eduard-Bodem-Gasse 6, 6020 Innsbruck, AUT UID/VAT Nr:
ATU 66964118 | FN: 374287y