Re: [PATCH 1/2] ARM: i.MX: tqma6ulx: fix barebox chainloading with OP-TEE enabled

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi Marco,

On 6/27/25 00:36, Marco Felsch wrote:
> On 25-06-26, Ahmad Fatoum wrote:
>> I think this is problematic:
>>
>>   - robustness-wise: We have no guarantee that there isn't some lesser
>>     used BootROM code path that happens to leave a suitable DRAM
>>     look-alike address that would trick us here.
>>
>>   - security wise, even if we check for FDT header if r2 points into
>>     DRAM, a compromised OS could spray RAM with FDT magic,
>>     trigger a warm reset that has the BootROM produce a DRAM lookalike
>>     pointer in r2 and then OP-TEE loading is skipped and the kernel
>>     starts in the highest privilege level.
> 
> These are good points and should be addressed, but I think the patch is
> still good because obvious broken code gets repaired.

The old code was broken in an unnoticed way. I am way of the new code
being broken in a noticeable one, even if it's more correct.

>> To address this, we need some way to set a sticky bit that's cleared
>> only on reset. One way, would be to set up an IVT and try to access the
>> L2 cache controller while data_abort_mask() is active, like
>> imx6_cannot_write_l2x0 is doing.
> 
> Nice trick!
> 
> One could also argue that skip the OP-TEE loading (to chainload barebox)
> is a dev-feature which should be disabled once the INSECURE=n.

Good idea. If we check DRAM pointers for FDT magic and skip OP-TEE
loading only on INSECURE, this is fine by me.

Cheers,
Ahmad

> 
> Regards,
>   Marco
> 
>> Cheers,
>> Ahmad
>>
>>> +
>>>  		get_builtin_firmware(mba6ul_optee_bin, &tee, &tee_size);
>>>  
>>>  		memset((void *)OPTEE_OVERLAY_LOCATION, 0, 0x1000);
>>> @@ -112,5 +111,5 @@ ENTRY_FUNCTION(start_imx6ul_mba6ulx, r0, r1, r2)
>>>  	setup_c();
>>>  	barrier();
>>>  
>>> -	start_mba6ulx(r0);
>>> +	start_mba6ulx(r2);
>>>  }
>>
>> -- 
>> Pengutronix e.K.                  |                             |
>> Steuerwalder Str. 21              | http://www.pengutronix.de/  |
>> 31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
>> Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |
>>
>>
>>
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |