Hi, Am Dienstag, dem 15.09.2026 um 14:52 +0200 schrieb Ludwig Nussel: > If U-Boot is built with signature verification but no keys are > included in the device tree, the boot would still continue. > Introduce FIT_SIGNATURE_REQUIRED to avoid a fail-open setup. you are still using the old name of the new option here.
Regards, Leonard > Defaults to off so existing setups are not affected; boards wanting > fail-closed behaviour must enable it explicitly. > > Consistently use log_err for errors in > fit_config_verify_required_keys() > while at it > > Signed-off-by: Ludwig Nussel <[email protected]> > Reviewed-by: Simon Glass <[email protected]> > --- > > Changes in v9: > - restore debug message instead of errro > > Changes in v7: > - mention CONFIG_FIT_REQUIRE_CONFIG_SIGS in documentation > > Changes in v4: > - reword Kconfig help text > - rename option to FIT_REQUIRE_CONFIG_SIGS > - introduce SPL_FIT_REQUIRE_CONFIG_SIGS > > Changes in v3: > - clarify error message when no keys were found > - change printfs to log_err > - reword Kconfig > - keep FIT_SIGNATURE_REQUIRED off by default > > Changes in v2: > - introduce FIT_SIGNATURE_REQUIRED > > boot/Kconfig | 22 ++++++++++++++++++++++ > boot/image-fit-sig.c | 19 +++++++++++++------ > doc/usage/fit/signature.rst | 13 ++++++++++--- > 3 files changed, 45 insertions(+), 9 deletions(-) > > diff --git a/boot/Kconfig b/boot/Kconfig > index ae6f09a6ede..c36a403063e 100644 > --- a/boot/Kconfig > +++ b/boot/Kconfig > @@ -124,6 +124,23 @@ config FIT_SIGNATURE > format support in this case, enable it using > CONFIG_LEGACY_IMAGE_FORMAT. > > +config FIT_REQUIRE_CONFIG_SIGS > + bool "Require configuration signature verification of FIT > uImages" > + depends on FIT_SIGNATURE > + help > + This option requires that FIT uImages have configuration > + nodes that are signed or boot will fail. > + That means the U-Boot device tree must contain a > + "/signature" node and at least one public key with > + required="conf". > + All configuration sections of a FIT file must be signed > + using those keys based on "required-mode" policy. > + The option is useful to avoid fail-open situations so it > + is recommended to enable. The option currently defaults to > + off to avoid breaking existing setups. Keep it off if you > + need to reuse the same u-boot binary in setups without > + keys or rely on image node only signatures. > + > config FIT_SIGNATURE_MAX_SIZE > hex "Max size of signed FIT structures" > depends on FIT_SIGNATURE > @@ -224,6 +241,11 @@ config SPL_FIT_SIGNATURE_MAX_SIZE > device memory. Assure this size does not extend past > expected storage > space. > > +config SPL_FIT_REQUIRE_CONFIG_SIGS > + bool "Require signature verification of FIT firmware within > SPL" > + depends on SPL_FIT_SIGNATURE > + select FIT_REQUIRE_CONFIG_SIGS > + > config SPL_LOAD_FIT > bool "Enable SPL loading U-Boot as a FIT (basic fitImage > features)" > depends on SPL > diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c > index 433df20281f..0e04089fde0 100644 > --- a/boot/image-fit-sig.c > +++ b/boot/image-fit-sig.c > @@ -632,7 +632,7 @@ static int fit_config_verify_required_keys(const > void *fit, int conf_noffset, > * name root but different @ suffix to be equal > */ > if (strchr(name, '@')) { > - printf("Configuration node '%s' contains '@'\n", > name); > + log_err("Configuration node '%s' contains '@'\n", > name); > return -EPERM; > } > > @@ -641,6 +641,8 @@ static int fit_config_verify_required_keys(const > void *fit, int conf_noffset, > if (key_node < 0) { > debug("%s: No signature node found: %s\n", __func__, > fdt_strerror(key_node)); > + if (CONFIG_IS_ENABLED(FIT_REQUIRE_CONFIG_SIGS)) > + return -EPERM; > return 0; > } > > @@ -674,8 +676,8 @@ static int fit_config_verify_required_keys(const > void *fit, int conf_noffset, > noffset); > if (ret) { > if (reqd_policy_all) { > - printf("Failed to verify required > signature '%s'\n", > - fit_get_name(key_blob, > noffset, NULL)); > + log_err("Failed to verify required > signature '%s'\n", > + fit_get_name(key_blob, > noffset, NULL)); > return ret; > } > } else { > @@ -685,9 +687,14 @@ static int fit_config_verify_required_keys(const > void *fit, int conf_noffset, > } > } > > - if (reqd_sigs && !verified) { > - printf("Failed to verify 'any' of the required > signature(s)\n"); > - return -EPERM; > + if (!verified) { > + if (reqd_sigs) { > + log_err("Failed to verify 'any' of the > required signature(s)\n"); > + return -EPERM; > + } else if > (CONFIG_IS_ENABLED(FIT_REQUIRE_CONFIG_SIGS)) { > + log_err("No suitable keys found for > configuration verification\n"); > + return -EPERM; > + } > } > > return 0; > diff --git a/doc/usage/fit/signature.rst > b/doc/usage/fit/signature.rst > index da08cc75c3a..73153c97367 100644 > --- a/doc/usage/fit/signature.rst > +++ b/doc/usage/fit/signature.rst > @@ -420,11 +420,14 @@ below examples:: > > Enabling FIT Verification > ------------------------- > -In addition to the options to enable FIT itself, the following > CONFIGs must > -be enabled: > +In addition to the options to enable FIT itself, the following > +settings configure signature verification support: > > CONFIG_FIT_SIGNATURE > - enable signing and verification in FITs > + required to enable signing and verification in FITs > + > +CONFIG_FIT_REQUIRE_CONFIG_SIGS > + make signature verification mandatory > > CONFIG_RSA > enable RSA algorithm for signing > @@ -436,6 +439,10 @@ WARNING: When relying on signed FIT images with > required signature check > the legacy image format is default disabled by not defining > CONFIG_LEGACY_IMAGE_FORMAT > > +WARNING: CONFIG_FIT_REQUIRE_CONFIG_SIGS is not set by default for > +backwards compatibility. It is recommended to be turned on whenever > +configuration signatures are used to avoid fail-open behavior > + > > Testing > -------
