mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Sascha Hauer <>
To: Ahmad Fatoum <>
Subject: Re: [PATCH 3/3] firmware: add external firmware PBL support
Date: Tue, 16 Aug 2022 10:42:18 +0200	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Mon, Aug 15, 2022 at 03:09:55PM +0200, Ahmad Fatoum wrote:
> Normally, barebox embds firmware into the binary referencing it, which
> means that device tree blobs, RAM training code and e.g. TF-A for i.MX8M
> end up in the prebootloader, while, e.g. Freescale FMan microcode ends
> up in barebox proper. The only exception so far was barebox proper:
> When only the PBL fits in on-chip SRAM, barebox proper is chainloaded
> from the boot medium. To avoid TOCTOU attack, it's read fully into DRAM
> after setup and then a SHA256 is calculated and compared against the
> hash embedded in barebox PBL, which in a secure boot system would be
> trusted by virtue of the PBL as a whole being verified beforehand by
> the BootROM.
> Reuse this mechanism to support arbitrary firmware, which is now termed
> external firmware. Such firmware is placed beyond the piggydata (barebox
> proper) and only offset and hash are included in the prebootloader
> image. The new get_builtin_firmware_ext() is used to retrieve this
> external firmware after integrity verification with SHA256.

Does it make sense to use this mechanism for barebox proper as well?

>  #define get_builtin_firmware(name, start, size) \
>  	{							\
>  		extern char _fw_##name##_start[];		\
> @@ -65,4 +78,22 @@ void firmwaremgr_list_handlers(void);
>  		*size = _fw_##name##_end - _fw_##name##_start;	\
>  	}
> +#define get_builtin_firmware_ext(name, base, start, size)		\

base is unused.

It would be nice if users could use the same macro for both internal and
external firmware, but I have no idea how and if this could be


Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       |  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

  parent reply	other threads:[~2022-08-16  8:44 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-15 13:09 [PATCH 1/3] kbuild: make sha256sum command available generally Ahmad Fatoum
2022-08-15 13:09 ` [PATCH 2/3] pbl: export pbl_barebox_verify Ahmad Fatoum
2022-08-15 13:09 ` [PATCH 3/3] firmware: add external firmware PBL support Ahmad Fatoum
2022-08-15 13:41   ` [PATCH 3/4] pbl: replace __piggydata_end with __image_end Ahmad Fatoum
2022-08-16  8:42   ` Sascha Hauer [this message]
2022-08-17 12:08     ` [PATCH 3/3] firmware: add external firmware PBL support Ahmad Fatoum

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox