[PATCH] commands: bootm: remove -c and -s options

[PATCH] commands: bootm: remove -c and -s options

[Ahmad Fatoum]

We have inconsistencies about what verification level is used for FIT
images when they are used for both booting and for overlays if
bootm -c/-s is used to raise the verification level.

Properly fixing them would increase the complexity, which could
in turn negatively impact security.

I expect that any users are equally well served with
global.bootm.verity, so drop the extra toggle.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 .../migration-guides/migration-master.rst     | 21 +++++++++++++++++++
 commands/bootm.c                              | 11 +---------
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/Documentation/migration-guides/migration-master.rst b/Documentation/migration-guides/migration-master.rst
index d5601ac838c5..b40ea66827cb 100644
--- a/Documentation/migration-guides/migration-master.rst
+++ b/Documentation/migration-guides/migration-master.rst
@@ -12,3 +12,24 @@ OP-TEE loading is now only supported
 
 For i.MX6 boards, this can be enabled by enabling
 ``CONFIG_FIRMWARE_IMX6_OPTEE``.
+
+Removal of bootm -c/-s options
+------------------------------
+
+The :ref:`command_bootm` options ``-c`` and ``-s`` used to selectively
+enable checksum/hash and signature verification, respectively.
+
+They have been removed in favor of the global toggle
+:ref:`global.bootm.verify <magicvar_global_bootm_verify>`.
+This can be restricted at build-time via setting ``CONFIG_BOOTM_FORCE_SIGNED_IMAGES``
+or loosened :ref:`at runtime <use_security-policies>`
+via setting ``SCONFIG_BOOT_UNSIGNED_IMAGES``.
+
+The removal is motivated by making it easier to reason about what the active
+verification level is, especially as there are now other uses for verified
+images like when :ref:`global.of.overlay.path <magicvar_global_of_overlay_path>`
+points at a FIT.
+
+Existing users, if any, will fail-secure: The command will now exit with a failure::
+
+  bootm: invalid option -- s
diff --git a/commands/bootm.c b/commands/bootm.c
index 9ff4b218fd1f..e71c30460fb7 100644
--- a/commands/bootm.c
+++ b/commands/bootm.c
@@ -28,7 +28,7 @@
 #include <magicvar.h>
 #include <asm-generic/memory_layout.h>
 
-#define BOOTM_OPTS_COMMON "sca:e:vo:fd"
+#define BOOTM_OPTS_COMMON "a:e:vo:fd"
 
 #ifdef CONFIG_BOOTM_INITRD
 #define BOOTM_OPTS BOOTM_OPTS_COMMON "L:r:"
@@ -55,13 +55,6 @@ static int do_bootm(int argc, char *argv[])
 
 	while ((opt = getopt(argc, argv, BOOTM_OPTS)) > 0) {
 		switch(opt) {
-		case 'c':
-			if (data.verify < BOOTM_VERIFY_HASH)
-				data.verify = BOOTM_VERIFY_HASH;
-			break;
-		case 's':
-			data.verify = BOOTM_VERIFY_SIGNATURE;
-			break;
 #ifdef CONFIG_BOOTM_INITRD
 		case 'L':
 			data.initrd_address = simple_strtoul(optarg, NULL, 0);
@@ -113,8 +106,6 @@ static int do_bootm(int argc, char *argv[])
 
 BAREBOX_CMD_HELP_START(bootm)
 BAREBOX_CMD_HELP_TEXT("Options:")
-BAREBOX_CMD_HELP_OPT ("-c\t",  "hash check image integrity")
-BAREBOX_CMD_HELP_OPT ("-s\t",  "check signature of image")
 BAREBOX_CMD_HELP_OPT ("-d\t",  "dry run: check data, but do not run")
 BAREBOX_CMD_HELP_OPT ("-f\t",  "load images even if type is undetectable")
 #ifdef CONFIG_BOOTM_INITRD
-- 
2.47.3

Re: [PATCH] commands: bootm: remove -c and -s options

[Ulrich Ölmann]

Hi Ahmad,

just a small typo.

On Thu, Sep 10 2026 at 11:53 +0200, Ahmad Fatoum <a.fatoum@pengutronix.de> wrote:
> We have inconsistencies about what verification level is used for FIT
> images when they are used for both booting and for overlays if
> bootm -c/-s is used to raise the verification level.
>
> Properly fixing them would increase the complexity, which could
> in turn negatively impact security.
>
> I expect that any users are equally well served with
> global.bootm.verity, so drop the extra toggle.

s/global.bootm.verity/global.bootm.verify/

Best regards,
Ulrich


> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  .../migration-guides/migration-master.rst     | 21 +++++++++++++++++++
>  commands/bootm.c                              | 11 +---------
>  2 files changed, 22 insertions(+), 10 deletions(-)
>
> diff --git a/Documentation/migration-guides/migration-master.rst b/Documentation/migration-guides/migration-master.rst
> index d5601ac838c5..b40ea66827cb 100644
> --- a/Documentation/migration-guides/migration-master.rst
> +++ b/Documentation/migration-guides/migration-master.rst
> @@ -12,3 +12,24 @@ OP-TEE loading is now only supported
>  
>  For i.MX6 boards, this can be enabled by enabling
>  ``CONFIG_FIRMWARE_IMX6_OPTEE``.
> +
> +Removal of bootm -c/-s options
> +------------------------------
> +
> +The :ref:`command_bootm` options ``-c`` and ``-s`` used to selectively
> +enable checksum/hash and signature verification, respectively.
> +
> +They have been removed in favor of the global toggle
> +:ref:`global.bootm.verify <magicvar_global_bootm_verify>`.
> +This can be restricted at build-time via setting ``CONFIG_BOOTM_FORCE_SIGNED_IMAGES``
> +or loosened :ref:`at runtime <use_security-policies>`
> +via setting ``SCONFIG_BOOT_UNSIGNED_IMAGES``.
> +
> +The removal is motivated by making it easier to reason about what the active
> +verification level is, especially as there are now other uses for verified
> +images like when :ref:`global.of.overlay.path <magicvar_global_of_overlay_path>`
> +points at a FIT.
> +
> +Existing users, if any, will fail-secure: The command will now exit with a failure::
> +
> +  bootm: invalid option -- s
> diff --git a/commands/bootm.c b/commands/bootm.c
> index 9ff4b218fd1f..e71c30460fb7 100644
> --- a/commands/bootm.c
> +++ b/commands/bootm.c
> @@ -28,7 +28,7 @@
>  #include <magicvar.h>
>  #include <asm-generic/memory_layout.h>
>  
> -#define BOOTM_OPTS_COMMON "sca:e:vo:fd"
> +#define BOOTM_OPTS_COMMON "a:e:vo:fd"
>  
>  #ifdef CONFIG_BOOTM_INITRD
>  #define BOOTM_OPTS BOOTM_OPTS_COMMON "L:r:"
> @@ -55,13 +55,6 @@ static int do_bootm(int argc, char *argv[])
>  
>  	while ((opt = getopt(argc, argv, BOOTM_OPTS)) > 0) {
>  		switch(opt) {
> -		case 'c':
> -			if (data.verify < BOOTM_VERIFY_HASH)
> -				data.verify = BOOTM_VERIFY_HASH;
> -			break;
> -		case 's':
> -			data.verify = BOOTM_VERIFY_SIGNATURE;
> -			break;
>  #ifdef CONFIG_BOOTM_INITRD
>  		case 'L':
>  			data.initrd_address = simple_strtoul(optarg, NULL, 0);
> @@ -113,8 +106,6 @@ static int do_bootm(int argc, char *argv[])
>  
>  BAREBOX_CMD_HELP_START(bootm)
>  BAREBOX_CMD_HELP_TEXT("Options:")
> -BAREBOX_CMD_HELP_OPT ("-c\t",  "hash check image integrity")
> -BAREBOX_CMD_HELP_OPT ("-s\t",  "check signature of image")
>  BAREBOX_CMD_HELP_OPT ("-d\t",  "dry run: check data, but do not run")
>  BAREBOX_CMD_HELP_OPT ("-f\t",  "load images even if type is undetectable")
>  #ifdef CONFIG_BOOTM_INITRD
-- 
Pengutronix e.K.                           | Ulrich Ölmann               |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |