Hi Ludwig,
On 8/13/2026 8:09 AM, Ludwig Nussel via U-Boot wrote:
> If U-Boot is built with signature verification but no keys are
> included in the device tree, the boot would still continue.
> Introduce FIT_SIGNATURE_REQUIRED to avoid a fail-open setup.
> Defaults to off so existing setups are not affected; boards wanting
> fail-closed behaviour must enable it explicitly.
>
> Consistently use log_err for errors in fit_config_verify_required_keys()
> while at it
>
> Signed-off-by: Ludwig Nussel <[email protected]>
> Reviewed-by: Simon Glass <[email protected]>
>
> Series-Changes: 7
> - mention CONFIG_FIT_REQUIRE_CONFIG_SIGS in documentation
>
> ---
>
> (no changes since v4)
>
> Changes in v4:
> - reword Kconfig help text
> - rename option to FIT_REQUIRE_CONFIG_SIGS
> - introduce SPL_FIT_REQUIRE_CONFIG_SIGS
>
> Changes in v3:
> - clarify error message when no keys were found
> - change printfs to log_err
> - reword Kconfig
> - keep FIT_SIGNATURE_REQUIRED off by default
>
> Changes in v2:
> - introduce FIT_SIGNATURE_REQUIRED
>
> boot/Kconfig | 22 ++++++++++++++++++++++
> boot/image-fit-sig.c | 22 ++++++++++++++--------
> doc/usage/fit/signature.rst | 13 ++++++++++---
> 3 files changed, 46 insertions(+), 11 deletions(-)
>
> diff --git a/boot/Kconfig b/boot/Kconfig
> index ae6f09a6ede..c36a403063e 100644
> --- a/boot/Kconfig
> +++ b/boot/Kconfig
> @@ -124,6 +124,23 @@ config FIT_SIGNATURE
> format support in this case, enable it using
> CONFIG_LEGACY_IMAGE_FORMAT.
>
> +config FIT_REQUIRE_CONFIG_SIGS
> + bool "Require configuration signature verification of FIT uImages"
> + depends on FIT_SIGNATURE
> + help
> + This option requires that FIT uImages have configuration
> + nodes that are signed or boot will fail.
> + That means the U-Boot device tree must contain a
> + "/signature" node and at least one public key with
> + required="conf".
> + All configuration sections of a FIT file must be signed
> + using those keys based on "required-mode" policy.
> + The option is useful to avoid fail-open situations so it
> + is recommended to enable. The option currently defaults to
> + off to avoid breaking existing setups. Keep it off if you
> + need to reuse the same u-boot binary in setups without
> + keys or rely on image node only signatures.
> +
> config FIT_SIGNATURE_MAX_SIZE
> hex "Max size of signed FIT structures"
> depends on FIT_SIGNATURE
> @@ -224,6 +241,11 @@ config SPL_FIT_SIGNATURE_MAX_SIZE
> device memory. Assure this size does not extend past expected storage
> space.
>
> +config SPL_FIT_REQUIRE_CONFIG_SIGS
> + bool "Require signature verification of FIT firmware within SPL"
> + depends on SPL_FIT_SIGNATURE
> + select FIT_REQUIRE_CONFIG_SIGS
> +
> config SPL_LOAD_FIT
> bool "Enable SPL loading U-Boot as a FIT (basic fitImage features)"
> depends on SPL
> diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
> index 433df20281f..dc38a2413b0 100644
> --- a/boot/image-fit-sig.c
> +++ b/boot/image-fit-sig.c
> @@ -632,15 +632,16 @@ static int fit_config_verify_required_keys(const void
> *fit, int conf_noffset,
> * name root but different @ suffix to be equal
> */
> if (strchr(name, '@')) {
> - printf("Configuration node '%s' contains '@'\n", name);
> + log_err("Configuration node '%s' contains '@'\n", name);
> return -EPERM;
> }
>
> /* Work out what we need to verify */
> key_node = fdt_subnode_offset(key_blob, 0, FIT_SIG_NODENAME);
> if (key_node < 0) {
> - debug("%s: No signature node found: %s\n", __func__,
> - fdt_strerror(key_node));
> + log_err("No signature node found: %s\n",
> fdt_strerror(key_node));
This change is causing a verbose error messages on Rockchip where the
FIT_SIGNATURE feature it used to check image integrity during boot. The
config nodes is not expected to contain any signature, only hash(es) of
images.
With this series I now get following output, with a verbose error
message related to FDT_ERR_NOTFOUND:
U-Boot SPL 2026.10-rc2-00527-g4110a512ca17 (Aug 21 2026 - 22:33:02 +0000)
Trying to boot from RAM
## Checking hash(es) for config config-1 ... No signature node found:
FDT_ERR_NOTFOUND
OK
## Checking hash(es) for Image atf-1 ... sha256+ OK
## Checking hash(es) for Image u-boot ... sha256+ OK
## Checking hash(es) for Image fdt-1 ... sha256+ OK
## Checking hash(es) for Image atf-2 ... sha256+ OK
## Checking hash(es) for Image atf-3 ... sha256+ OK
## Checking hash(es) for Image atf-4 ... sha256+ OK
Prior to this series the output never printed any error message:
Trying to boot from RAM
## Checking hash(es) for config config-1 ... OK
## Checking hash(es) for Image atf-1 ... sha256+ OK
[...]
Regards,
Jonas
> + if (CONFIG_IS_ENABLED(FIT_REQUIRE_CONFIG_SIGS))
> + return -EPERM;
> return 0;
> }
>
> @@ -674,8 +675,8 @@ static int fit_config_verify_required_keys(const void
> *fit, int conf_noffset,
> noffset);
> if (ret) {
> if (reqd_policy_all) {
> - printf("Failed to verify required signature
> '%s'\n",
> - fit_get_name(key_blob, noffset, NULL));
> + log_err("Failed to verify required signature
> '%s'\n",
> + fit_get_name(key_blob, noffset, NULL));
> return ret;
> }
> } else {
> @@ -685,9 +686,14 @@ static int fit_config_verify_required_keys(const void
> *fit, int conf_noffset,
> }
> }
>
> - if (reqd_sigs && !verified) {
> - printf("Failed to verify 'any' of the required signature(s)\n");
> - return -EPERM;
> + if (!verified) {
> + if (reqd_sigs) {
> + log_err("Failed to verify 'any' of the required
> signature(s)\n");
> + return -EPERM;
> + } else if (CONFIG_IS_ENABLED(FIT_REQUIRE_CONFIG_SIGS)) {
> + log_err("No suitable keys found for configuration
> verification\n");
> + return -EPERM;
> + }
> }
>
> return 0;
> diff --git a/doc/usage/fit/signature.rst b/doc/usage/fit/signature.rst
> index da08cc75c3a..73153c97367 100644
> --- a/doc/usage/fit/signature.rst
> +++ b/doc/usage/fit/signature.rst
> @@ -420,11 +420,14 @@ below examples::
>
> Enabling FIT Verification
> -------------------------
> -In addition to the options to enable FIT itself, the following CONFIGs must
> -be enabled:
> +In addition to the options to enable FIT itself, the following
> +settings configure signature verification support:
>
> CONFIG_FIT_SIGNATURE
> - enable signing and verification in FITs
> + required to enable signing and verification in FITs
> +
> +CONFIG_FIT_REQUIRE_CONFIG_SIGS
> + make signature verification mandatory
>
> CONFIG_RSA
> enable RSA algorithm for signing
> @@ -436,6 +439,10 @@ WARNING: When relying on signed FIT images with required
> signature check
> the legacy image format is default disabled by not defining
> CONFIG_LEGACY_IMAGE_FORMAT
>
> +WARNING: CONFIG_FIT_REQUIRE_CONFIG_SIGS is not set by default for
> +backwards compatibility. It is recommended to be turned on whenever
> +configuration signatures are used to avoid fail-open behavior
> +
>
> Testing
> -------
