On Tue, 11 Mar 2025 13:25:13 +0100, Sascha Hauer wrote: > On K3 SoCs only a small barebox is loaded by the ROM into SRAM. This > barebox then loads the full barebox from SD/eMMC or USB DFU. In a secure > boot environment the full barebox must be authenticated. This series > implements two ways for accomplishing this. > > First way is to utilize the ROM API to authenticate images. The other > way is to compile a secure hash into the first stage binary and check > if the full barebox image matches the hash. Using the ROM API means > different first stage and second stage images can be combined whereas > hashing binds specific builds together avoiding mix and match attacks. > > [...] Applied, thanks! [01/14] firmware: always generate sha256sum https://git.pengutronix.de/cgit/barebox/commit/?id=4fa921792285 (link may not be stable) [02/14] firmware: add function to verify next image https://git.pengutronix.de/cgit/barebox/commit/?id=8c711a697ce5 (link may not be stable) [03/14] ARM: k3: r5: drop loading of separate binaries https://git.pengutronix.de/cgit/barebox/commit/?id=1bc97b7995e1 (link may not be stable) [04/14] ARM: k3: r5: add proper error handling https://git.pengutronix.de/cgit/barebox/commit/?id=f382d0e799bc (link may not be stable) [05/14] fip: rework fip_image_open() https://git.pengutronix.de/cgit/barebox/commit/?id=a7e5e42a2dc5 (link may not be stable) [06/14] fip: fix wrong function call https://git.pengutronix.de/cgit/barebox/commit/?id=14308afd22ac (link may not be stable) [07/14] fip: add function to calculate a sha256 over FIP image https://git.pengutronix.de/cgit/barebox/commit/?id=096dc30fcfd4 (link may not be stable) [08/14] ARM: am625: support hash verification of full barebox https://git.pengutronix.de/cgit/barebox/commit/?id=0e0b9a236be4 (link may not be stable) [09/14] ARM: k3: add support for authenticating images against the ROM API https://git.pengutronix.de/cgit/barebox/commit/?id=c2bde368cf28 (link may not be stable) [10/14] ARM: k3: r5: delete fip image when it can't be opened https://git.pengutronix.de/cgit/barebox/commit/?id=c2a3a4dbc2c5 (link may not be stable) [11/14] ARM: k3: r5: Allow to authenticate next image by ROM API https://git.pengutronix.de/cgit/barebox/commit/?id=eddc4c708d5f (link may not be stable) [12/14] scripts/k3img: remove temporary files https://git.pengutronix.de/cgit/barebox/commit/?id=2665beee87cf (link may not be stable) [13/14] scripts: add k3sign https://git.pengutronix.de/cgit/barebox/commit/?id=f450ef453e88 (link may not be stable) [14/14] ARM: k3: r5: select HAS_INSECURE_DEFAULTS when necessary https://git.pengutronix.de/cgit/barebox/commit/?id=d4444f3cb892 (link may not be stable) Best regards, -- Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>