Hi Ahmad, just a small typo.
On Thu, Sep 10 2026 at 11:53 +0200, Ahmad Fatoum <[email protected]> wrote: > We have inconsistencies about what verification level is used for FIT > images when they are used for both booting and for overlays if > bootm -c/-s is used to raise the verification level. > > Properly fixing them would increase the complexity, which could > in turn negatively impact security. > > I expect that any users are equally well served with > global.bootm.verity, so drop the extra toggle. s/global.bootm.verity/global.bootm.verify/ Best regards, Ulrich > Signed-off-by: Ahmad Fatoum <[email protected]> > --- > .../migration-guides/migration-master.rst | 21 +++++++++++++++++++ > commands/bootm.c | 11 +--------- > 2 files changed, 22 insertions(+), 10 deletions(-) > > diff --git a/Documentation/migration-guides/migration-master.rst > b/Documentation/migration-guides/migration-master.rst > index d5601ac838c5..b40ea66827cb 100644 > --- a/Documentation/migration-guides/migration-master.rst > +++ b/Documentation/migration-guides/migration-master.rst > @@ -12,3 +12,24 @@ OP-TEE loading is now only supported > > For i.MX6 boards, this can be enabled by enabling > ``CONFIG_FIRMWARE_IMX6_OPTEE``. > + > +Removal of bootm -c/-s options > +------------------------------ > + > +The :ref:`command_bootm` options ``-c`` and ``-s`` used to selectively > +enable checksum/hash and signature verification, respectively. > + > +They have been removed in favor of the global toggle > +:ref:`global.bootm.verify <magicvar_global_bootm_verify>`. > +This can be restricted at build-time via setting > ``CONFIG_BOOTM_FORCE_SIGNED_IMAGES`` > +or loosened :ref:`at runtime <use_security-policies>` > +via setting ``SCONFIG_BOOT_UNSIGNED_IMAGES``. > + > +The removal is motivated by making it easier to reason about what the active > +verification level is, especially as there are now other uses for verified > +images like when :ref:`global.of.overlay.path > <magicvar_global_of_overlay_path>` > +points at a FIT. > + > +Existing users, if any, will fail-secure: The command will now exit with a > failure:: > + > + bootm: invalid option -- s > diff --git a/commands/bootm.c b/commands/bootm.c > index 9ff4b218fd1f..e71c30460fb7 100644 > --- a/commands/bootm.c > +++ b/commands/bootm.c > @@ -28,7 +28,7 @@ > #include <magicvar.h> > #include <asm-generic/memory_layout.h> > > -#define BOOTM_OPTS_COMMON "sca:e:vo:fd" > +#define BOOTM_OPTS_COMMON "a:e:vo:fd" > > #ifdef CONFIG_BOOTM_INITRD > #define BOOTM_OPTS BOOTM_OPTS_COMMON "L:r:" > @@ -55,13 +55,6 @@ static int do_bootm(int argc, char *argv[]) > > while ((opt = getopt(argc, argv, BOOTM_OPTS)) > 0) { > switch(opt) { > - case 'c': > - if (data.verify < BOOTM_VERIFY_HASH) > - data.verify = BOOTM_VERIFY_HASH; > - break; > - case 's': > - data.verify = BOOTM_VERIFY_SIGNATURE; > - break; > #ifdef CONFIG_BOOTM_INITRD > case 'L': > data.initrd_address = simple_strtoul(optarg, NULL, 0); > @@ -113,8 +106,6 @@ static int do_bootm(int argc, char *argv[]) > > BAREBOX_CMD_HELP_START(bootm) > BAREBOX_CMD_HELP_TEXT("Options:") > -BAREBOX_CMD_HELP_OPT ("-c\t", "hash check image integrity") > -BAREBOX_CMD_HELP_OPT ("-s\t", "check signature of image") > BAREBOX_CMD_HELP_OPT ("-d\t", "dry run: check data, but do not run") > BAREBOX_CMD_HELP_OPT ("-f\t", "load images even if type is undetectable") > #ifdef CONFIG_BOOTM_INITRD -- Pengutronix e.K. | Ulrich Ölmann | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
