Re: [PATCH v2 00/14] am625: support secure loading of full barebox

[Sascha Hauer <s.hauer@pengutronix.de>]

On Tue, 11 Mar 2025 13:25:13 +0100, Sascha Hauer wrote:
> On K3 SoCs only a small barebox is loaded by the ROM into SRAM. This
> barebox then loads the full barebox from SD/eMMC or USB DFU. In a secure
> boot environment the full barebox must be authenticated. This series
> implements two ways for accomplishing this.
> 
> First way is to utilize the ROM API to authenticate images. The other
> way is to compile a secure hash into the first stage binary and check
> if the full barebox image matches the hash. Using the ROM API means
> different first stage and second stage images can be combined whereas
> hashing binds specific builds together avoiding mix and match attacks.
> 
> [...]

Applied, thanks!

[01/14] firmware: always generate sha256sum
        https://git.pengutronix.de/cgit/barebox/commit/?id=4fa921792285 (link may not be stable)
[02/14] firmware: add function to verify next image
        https://git.pengutronix.de/cgit/barebox/commit/?id=8c711a697ce5 (link may not be stable)
[03/14] ARM: k3: r5: drop loading of separate binaries
        https://git.pengutronix.de/cgit/barebox/commit/?id=1bc97b7995e1 (link may not be stable)
[04/14] ARM: k3: r5: add proper error handling
        https://git.pengutronix.de/cgit/barebox/commit/?id=f382d0e799bc (link may not be stable)
[05/14] fip: rework fip_image_open()
        https://git.pengutronix.de/cgit/barebox/commit/?id=a7e5e42a2dc5 (link may not be stable)
[06/14] fip: fix wrong function call
        https://git.pengutronix.de/cgit/barebox/commit/?id=14308afd22ac (link may not be stable)
[07/14] fip: add function to calculate a sha256 over FIP image
        https://git.pengutronix.de/cgit/barebox/commit/?id=096dc30fcfd4 (link may not be stable)
[08/14] ARM: am625: support hash verification of full barebox
        https://git.pengutronix.de/cgit/barebox/commit/?id=0e0b9a236be4 (link may not be stable)
[09/14] ARM: k3: add support for authenticating images against the ROM API
        https://git.pengutronix.de/cgit/barebox/commit/?id=c2bde368cf28 (link may not be stable)
[10/14] ARM: k3: r5: delete fip image when it can't be opened
        https://git.pengutronix.de/cgit/barebox/commit/?id=c2a3a4dbc2c5 (link may not be stable)
[11/14] ARM: k3: r5: Allow to authenticate next image by ROM API
        https://git.pengutronix.de/cgit/barebox/commit/?id=eddc4c708d5f (link may not be stable)
[12/14] scripts/k3img: remove temporary files
        https://git.pengutronix.de/cgit/barebox/commit/?id=2665beee87cf (link may not be stable)
[13/14] scripts: add k3sign
        https://git.pengutronix.de/cgit/barebox/commit/?id=f450ef453e88 (link may not be stable)
[14/14] ARM: k3: r5: select HAS_INSECURE_DEFAULTS when necessary
        https://git.pengutronix.de/cgit/barebox/commit/?id=d4444f3cb892 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>