From 26fc66709c0de7732a12fd59dbce5a83eb454bae Mon Sep 17 00:00:00 2001 From: Alexandru Gagniuc Date: Tue, 7 Sep 2021 12:07:06 -0500 Subject: [PATCH] lib: optee: Avoid CONFIG_TZDRAM_* in optee_verify_bootm_image() The configs TZDRAM_BASE and TZDRAM_SIZE are expected to describe the memory allocated to the OPTEE region. according to according to commit c5a6e8bd00cc ("optee: Add optee_verify_bootm_image()"). The TZDRAM is with some limitations, described by "/reserved-memory" nodes in the devicetree. Consequently TZDRAM_BASE and TZDRAM_SIZE can point to imaginary regions which have nothing to do with actual DRAM. They are not used to configure the hardware or set up the Trust Zone Controller (TZC) for OP-TEE -- the devicetree values are used instead. When a valid OP-TEE image does not fall within the region described by these configs, u-boot will refuse to load it. In fact, it mostly serves to cause "bootm" to reject perfectly good OP-TEE images. Ironically, someone has to correctly configure the devicetree for TZDRAM, then go back and enter the same information in Kconfig for "bootm". To remedy this, do not use TZDRAM_BASE and TZDRAM_SIZE in the verification of OPTEE images. Signed-off-by: Alexandru Gagniuc --- include/tee/optee.h | 14 -------------- lib/optee/optee.c | 21 ++++++--------------- 2 files changed, 6 insertions(+), 29 deletions(-) diff --git a/include/tee/optee.h b/include/tee/optee.h index 2928597..5412bc7 100644 --- a/include/tee/optee.h +++ b/include/tee/optee.h @@ -44,20 +44,6 @@ optee_image_get_load_addr(const struct image_header *hdr) } #if defined(CONFIG_OPTEE_IMAGE) -int optee_verify_image(struct optee_header *hdr, unsigned long tzdram_start, - unsigned long tzdram_len, unsigned long image_len); -#else -static inline int optee_verify_image(struct optee_header *hdr, - unsigned long tzdram_start, - unsigned long tzdram_len, - unsigned long image_len) -{ - return -EPERM; -} - -#endif - -#if defined(CONFIG_OPTEE_IMAGE) int optee_verify_bootm_image(unsigned long image_addr, unsigned long image_load_addr, unsigned long image_len); diff --git a/lib/optee/optee.c b/lib/optee/optee.c index 5676785..766d0d9 100644 --- a/lib/optee/optee.c +++ b/lib/optee/optee.c @@ -16,15 +16,13 @@ #define optee_hdr_err_msg \ "OPTEE verification error:" \ - "\n\thdr=%p image=0x%08lx magic=0x%08x tzdram 0x%08lx-0x%08lx " \ + "\n\thdr=%p image=0x%08lx magic=0x%08x" \ "\n\theader lo=0x%08x hi=0x%08x size=0x%08lx arch=0x%08x" \ "\n\tuimage params 0x%08lx-0x%08lx\n" #if defined(CONFIG_OPTEE_IMAGE) -int optee_verify_image(struct optee_header *hdr, unsigned long tzdram_start, - unsigned long tzdram_len, unsigned long image_len) +static int optee_verify_image(struct optee_header *hdr, unsigned long image_len) { - unsigned long tzdram_end = tzdram_start + tzdram_len; uint32_t tee_file_size; tee_file_size = hdr->init_size + hdr->paged_size + @@ -32,11 +30,7 @@ int optee_verify_image(struct optee_header *hdr, unsigned long tzdram_start, if (hdr->magic != OPTEE_MAGIC || hdr->version != OPTEE_VERSION || - hdr->init_load_addr_hi > tzdram_end || - hdr->init_load_addr_lo < tzdram_start || - tee_file_size > tzdram_len || - tee_file_size != image_len || - (hdr->init_load_addr_lo + tee_file_size) > tzdram_end) { + tee_file_size != image_len) { return -EINVAL; } @@ -48,12 +42,9 @@ int optee_verify_bootm_image(unsigned long image_addr, unsigned long image_len) { struct optee_header *hdr = (struct optee_header *)image_addr; - unsigned long tzdram_start = CONFIG_OPTEE_TZDRAM_BASE; - unsigned long tzdram_len = CONFIG_OPTEE_TZDRAM_SIZE; - int ret; - ret = optee_verify_image(hdr, tzdram_start, tzdram_len, image_len); + ret = optee_verify_image(hdr, image_len); if (ret) goto error; @@ -64,8 +55,8 @@ int optee_verify_bootm_image(unsigned long image_addr, return ret; error: - printf(optee_hdr_err_msg, hdr, image_addr, hdr->magic, tzdram_start, - tzdram_start + tzdram_len, hdr->init_load_addr_lo, + printf(optee_hdr_err_msg, hdr, image_addr, hdr->magic, + hdr->init_load_addr_lo, hdr->init_load_addr_hi, image_len, hdr->arch, image_load_addr, image_load_addr + image_len); -- 2.7.4