On Tue, 11 Mar 2025 13:25:13 +0100, Sascha Hauer wrote:
> On K3 SoCs only a small barebox is loaded by the ROM into SRAM. This
> barebox then loads the full barebox from SD/eMMC or USB DFU. In a secure
> boot environment the full barebox must be authenticated. This series
> implements two ways for accomplishing this.
>
> First way is to utilize the ROM API to authenticate images. The other
> way is to compile a secure hash into the first stage binary and check
> if the full barebox image matches the hash. Using the ROM API means
> different first stage and second stage images can be combined whereas
> hashing binds specific builds together avoiding mix and match attacks.
>
> [...]
Applied, thanks!
[01/14] firmware: always generate sha256sum
https://git.pengutronix.de/cgit/barebox/commit/?id=4fa921792285 (link may not be stable)
[02/14] firmware: add function to verify next image
https://git.pengutronix.de/cgit/barebox/commit/?id=8c711a697ce5 (link may not be stable)
[03/14] ARM: k3: r5: drop loading of separate binaries
https://git.pengutronix.de/cgit/barebox/commit/?id=1bc97b7995e1 (link may not be stable)
[04/14] ARM: k3: r5: add proper error handling
https://git.pengutronix.de/cgit/barebox/commit/?id=f382d0e799bc (link may not be stable)
[05/14] fip: rework fip_image_open()
https://git.pengutronix.de/cgit/barebox/commit/?id=a7e5e42a2dc5 (link may not be stable)
[06/14] fip: fix wrong function call
https://git.pengutronix.de/cgit/barebox/commit/?id=14308afd22ac (link may not be stable)
[07/14] fip: add function to calculate a sha256 over FIP image
https://git.pengutronix.de/cgit/barebox/commit/?id=096dc30fcfd4 (link may not be stable)
[08/14] ARM: am625: support hash verification of full barebox
https://git.pengutronix.de/cgit/barebox/commit/?id=0e0b9a236be4 (link may not be stable)
[09/14] ARM: k3: add support for authenticating images against the ROM API
https://git.pengutronix.de/cgit/barebox/commit/?id=c2bde368cf28 (link may not be stable)
[10/14] ARM: k3: r5: delete fip image when it can't be opened
https://git.pengutronix.de/cgit/barebox/commit/?id=c2a3a4dbc2c5 (link may not be stable)
[11/14] ARM: k3: r5: Allow to authenticate next image by ROM API
https://git.pengutronix.de/cgit/barebox/commit/?id=eddc4c708d5f (link may not be stable)
[12/14] scripts/k3img: remove temporary files
https://git.pengutronix.de/cgit/barebox/commit/?id=2665beee87cf (link may not be stable)
[13/14] scripts: add k3sign
https://git.pengutronix.de/cgit/barebox/commit/?id=f450ef453e88 (link may not be stable)
[14/14] ARM: k3: r5: select HAS_INSECURE_DEFAULTS when necessary
https://git.pengutronix.de/cgit/barebox/commit/?id=d4444f3cb892 (link may not be stable)
Best regards,
--
Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
