-
Notifications
You must be signed in to change notification settings - Fork 227
/
Copy pathKconfig
1118 lines (943 loc) · 36 KB
/
Kconfig
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Copyright (c) 2017-2020 Linaro Limited
# Copyright (c) 2020 Arm Limited
# Copyright (c) 2023 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: Apache-2.0
#
mainmenu "MCUboot configuration"
comment "MCUboot-specific configuration options"
source "$(ZEPHYR_NRF_MODULE_DIR)/modules/mcuboot/boot/zephyr/Kconfig"
# Hidden option to mark a project as MCUboot
config MCUBOOT
default y
bool
select MPU_ALLOW_FLASH_WRITE if ARM_MPU
select USE_DT_CODE_PARTITION if HAS_FLASH_LOAD_OFFSET
select MCUBOOT_BOOTUTIL_LIB
select REBOOT if SECURE_BOOT
config BOOT_USE_MBEDTLS
bool
# Hidden option
default n
help
Use mbedTLS for crypto primitives.
config BOOT_USE_PSA_CRYPTO
bool
# Hidden option
help
Hidden option set if using PSA crypt for cryptography functionality
config BOOT_USE_TINYCRYPT
bool
# Hidden option
default n
# When building for ECDSA, we use our own copy of mbedTLS, so the
# Zephyr one must not be enabled or the MBEDTLS_CONFIG_FILE macros
# will collide.
select MBEDTLS_PROMPTLESS if ZEPHYR_MBEDTLS_MODULE
help
Use TinyCrypt for crypto primitives.
config BOOT_USE_CC310
bool
# Hidden option
default n
# When building for ECDSA, we use our own copy of mbedTLS, so the
# Zephyr one must not be enabled or the MBEDTLS_CONFIG_FILE macros
# will collide.
help
Use cc310 for crypto primitives.
config BOOT_USE_NRF_CC310_BL
bool
default n
config NRFXLIB_CRYPTO
bool
default n
config NRF_CC310_BL
bool
default n
if BOOT_USE_MBEDTLS && MBEDTLS_BUILTIN
config BOOT_AES_MBEDTLS_DEPENDENCIES
bool
select MBEDTLS_CIPHER_AES_ENABLED
select MBEDTLS_CIPHER_MODE_CTR_ENABLED
endif
if BOOT_USE_PSA_CRYPTO
config BOOT_PSA_IMG_HASH_ALG_SHA256_DEPENDENCIES
bool
default y if BOOT_IMG_HASH_ALG_SHA256
select PSA_WANT_ALG_SHA_256
help
Dependencies for hashing with SHA256
config BOOT_ED25519_PSA_DEPENDENCIES
bool
select PSA_WANT_ALG_SHA_256
select PSA_WANT_ALG_SHA_512
select PSA_WANT_ALG_PURE_EDDSA
select PSA_WANT_ECC_TWISTED_EDWARDS_255
select PSA_WANT_ECC_MONTGOMERY_255
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
help
Dependencies for ed25519 signature
if BOOT_ENCRYPT_IMAGE
config BOOT_X25519_PSA_DEPENDENCIES
bool
select PSA_WANT_ALG_ECDH
select PSA_WANT_ALG_HMAC
select PSA_WANT_ALG_HKDF
select PSA_WANT_ALG_CTR
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
select PSA_WANT_KEY_TYPE_DERIVE
select PSA_WANT_KEY_TYPE_AES
select PSA_WANT_ECC_MONTGOMERY_255
help
Dependencies for x25519 shared-random key encryption and AES
encryption. The PSA_WANT_ALG_CTR and PSA_WANT_KEY_TYPE_AES
enable Counter based block cipher and AES key, and algorithm support,
to use with it; the others are used for shared key decryption
and derivation.
endif # BOOT_ENCRYPT_IMAGE
if MBEDTLS_ENABLE_HEAP
config MBEDTLS_HEAP_SIZE
default 2048 if BOOT_USE_PSA_CRYPTO
help
The PSA internals need to be able to allocate memory for operation
and it uses mbedTLS heap for that.
endif # MBEDTLS_ENABLE_HEAP
endif # BOOT_USE_PSA_CRYPTO
menu "MCUBoot settings"
config SINGLE_APPLICATION_SLOT
bool "Single slot bootloader"
default n
help
Single image area is used for application which means that
uploading a new application overwrites the one that previously
occupied the area.
config BOOT_IMG_HASH_ALG_SHA256_ALLOW
bool
help
Hidden option set by configurations that allow SHA256
config BOOT_IMG_HASH_ALG_SHA384_ALLOW
bool
help
Hidden option set by configurations that allow SHA384
config BOOT_IMG_HASH_ALG_SHA512_ALLOW
bool
help
Hidden option set by configurations that allow SHA512
config BOOT_IMG_HASH_DIRECTLY_ON_STORAGE
bool "Hash calculation functions access storage through address space"
depends on !BOOT_ENCRYPT_IMAGE
help
When possible to map storage device, at least for read operations,
to address space or RAM area, enabling this option allows hash
calculation functions to directly access the storage through that address
space or using its own DMA. This reduces flash read overhead done
by MCUboot.
Notes:
- not supported when encrypted images are in use, because calculating
SHA requires image to be decrypted first, which is done in RAM.
- currently only supported on internal storage of devices; this
option will not work with devices that use external storage for
either of the image slots.
choice BOOT_IMG_HASH_ALG
prompt "Selected image hash algorithm"
default BOOT_IMG_HASH_ALG_SHA256 if BOOT_IMG_HASH_ALG_SHA256_ALLOW
default BOOT_IMG_HASH_ALG_SHA384 if BOOT_IMG_HASH_ALG_SHA384_ALLOW
default BOOT_IMG_HASH_ALG_SHA512 if BOOT_IMG_HASH_ALG_SHA512_ALLOW
help
Hash algorithm used for image verification. Selection
here may be limited by other configurations, like for
example selected cryptographic signature.
config BOOT_IMG_HASH_ALG_SHA256
bool "SHA256"
depends on BOOT_IMG_HASH_ALG_SHA256_ALLOW
help
SHA256 algorithm
config BOOT_IMG_HASH_ALG_SHA384
bool "SHA384"
depends on BOOT_IMG_HASH_ALG_SHA384_ALLOW
help
SHA384 algorithm
config BOOT_IMG_HASH_ALG_SHA512
bool "SHA512"
depends on BOOT_IMG_HASH_ALG_SHA512_ALLOW
help
SHA512 algorithm
endchoice # BOOT_IMG_HASH_ALG
config BOOT_SIGNATURE_TYPE_PURE_ALLOW
bool
help
Hidden option set by configurations that allow Pure variant,
for example ed25519. The pure variant means that image
signature is calculated over entire image instead of hash
of an image.
choice BOOT_SIGNATURE_TYPE
prompt "Signature type"
default BOOT_SIGNATURE_TYPE_ED25519 if SOC_NRF54L15_CPUAPP
default BOOT_SIGNATURE_TYPE_RSA
config BOOT_SIGNATURE_TYPE_NONE
bool "No signature; use only hash check"
select BOOT_USE_TINYCRYPT
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
config BOOT_SIGNATURE_TYPE_RSA
bool "RSA signatures"
select BOOT_USE_MBEDTLS
select MBEDTLS
select MBEDTLS_ASN1_PARSE_C if MBEDTLS_BUILTIN
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if MBEDTLS_BUILTIN
select BOOT_ENCRYPTION_SUPPORT
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
select BOOT_AES_MBEDTLS_DEPENDENCIES if MBEDTLS_BUILTIN && BOOT_ENCRYPT_IMAGE
if BOOT_SIGNATURE_TYPE_RSA
config BOOT_SIGNATURE_TYPE_RSA_LEN
int "RSA signature length"
range 2048 3072
default 2048
endif
config BOOT_SIGNATURE_TYPE_ECDSA_P256
bool "Elliptic curve digital signatures with curve P-256"
select BOOT_ENCRYPTION_SUPPORT
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
if BOOT_SIGNATURE_TYPE_ECDSA_P256
choice BOOT_ECDSA_IMPLEMENTATION
prompt "Ecdsa implementation"
default BOOT_ECDSA_TINYCRYPT
config BOOT_ECDSA_TINYCRYPT
bool "Use tinycrypt"
select BOOT_USE_TINYCRYPT
config BOOT_ECDSA_CC310
bool "Use CC310"
depends on HAS_HW_NRF_CC310
select BOOT_USE_NRF_CC310_BL
select NRF_CC310_BL
select NRFXLIB_CRYPTO
select BOOT_USE_CC310
endchoice # Ecdsa implementation
endif
config BOOT_SIGNATURE_TYPE_ED25519
bool "Edwards curve digital signatures using ed25519"
select BOOT_ENCRYPTION_SUPPORT if !BOOT_SIGNATURE_TYPE_PURE
select BOOT_IMG_HASH_ALG_SHA256_ALLOW if !BOOT_SIGNATURE_TYPE_PURE
# The SHA is used only for key hashing, not for images.
select BOOT_SIGNATURE_TYPE_PURE_ALLOW
help
This is ed25519 signature calculated over SHA512 of SHA256 of application
image.
To check signature over entire image directly, rather than hash,
select BOOT_SIGNATURE_TYPE_PURE.
if BOOT_SIGNATURE_TYPE_ED25519
config BOOT_SIGNATURE_TYPE_PURE
bool "Use Pure signature of image"
depends on BOOT_SIGNATURE_TYPE_PURE_ALLOW
help
The Pure signature is calculated directly over image rather than
hash of an image, as the BOOT_SIGNATURE_TYPE_ED25519 does by
default.
Image to be verified needs to be accessible through memory address
space that cryptography functions can access via pointers.
choice BOOT_ED25519_IMPLEMENTATION
prompt "Ecdsa implementation"
default BOOT_ED25519_PSA if NRF_SECURITY
default BOOT_ED25519_TINYCRYPT
config BOOT_ED25519_TINYCRYPT
bool "Use tinycrypt"
select BOOT_USE_TINYCRYPT
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
select BOOT_IMG_HASH_ALG_SHA512_ALLOW
config BOOT_ED25519_MBEDTLS
bool "Use mbedTLS"
select BOOT_USE_MBEDTLS
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
select BOOT_IMG_HASH_ALG_SHA512_ALLOW
select MBEDTLS
select MBEDTLS_SHA512
select MBEDTLS_ASN1_PARSE_C if MBEDTLS_BUILTIN && !BOOT_KEY_IMPORT_BYPASS_ASN
select BOOT_AES_MBEDTLS_DEPENDENCIES if MBEDTLS_BUILTIN && BOOT_ENCRYPT_IMAGE
config BOOT_ED25519_PSA
bool "Use PSA crypto"
depends on NRF_SECURITY
select BOOT_USE_PSA_CRYPTO
select PSA_CRYPTO_CLIENT
select PSA_CRYPTO_C
select MBEDTLS_PSA_CRYPTO_C
select MBEDTLS_ASN1_PARSE_C if MBEDTLS_BUILTIN
select MBEDTLS_ENABLE_HEAP
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
select BOOT_IMG_HASH_ALG_SHA512_ALLOW
select BOOT_ED25519_PSA_DEPENDENCIES
select BOOT_X25519_PSA_DEPENDENCIES if BOOT_ENCRYPT_IMAGE
endchoice
config BOOT_KEY_IMPORT_BYPASS_ASN
bool "Directly access key value without ASN.1 parsing"
help
Originally, public keys compiled into MCUboot were
stored in ASN.1 encoded format. Enabling this option
bypasses the ASN.1 decoding and directly accesses the key
in ASN.1 bitstream; this reduces MCUboot code by removing
the ASN.1 processing.
endif
endchoice
config BOOT_SIGNATURE_USING_KMU
bool "Use KMU stored keys for signature verification"
depends on NRF_SECURITY
depends on CRACEN_LIB_KMU
select PSA_WANT_ALG_GCM
select PSA_WANT_KEY_TYPE_AES
select PSA_WANT_AES_KEY_SIZE_256
select PSA_WANT_ALG_SP800_108_COUNTER_CMAC
select PSA_WANT_ALG_CMAC
select PSA_WANT_ALG_ECB_NO_PADDING
help
MCUboot will use keys provisioned to the device key management unit for signature
verification instead of compiling in key data from a file.
if BOOT_SIGNATURE_USING_KMU
config BOOT_SIGNATURE_KMU_SLOTS
int "KMU key slots"
range 1 3
default 1
help
Selects the number of KMU key slots (also known as generations) to use when verifying
an image.
endif
if !BOOT_SIGNATURE_USING_KMU
config BOOT_SIGNATURE_KEY_FILE
string "PEM key file"
default "root-ec-p256.pem" if BOOT_SIGNATURE_TYPE_ECDSA_P256
default "root-ed25519.pem" if BOOT_SIGNATURE_TYPE_ED25519
default "root-rsa-3072.pem" if BOOT_SIGNATURE_TYPE_RSA && BOOT_SIGNATURE_TYPE_RSA_LEN=3072
default "root-rsa-2048.pem" if BOOT_SIGNATURE_TYPE_RSA && BOOT_SIGNATURE_TYPE_RSA_LEN=2048
default ""
help
You can use either absolute or relative path.
In case relative path is used, the build system assumes that it starts
from the directory where the MCUBoot KConfig configuration file is
located. If the key file is not there, the build system uses relative
path that starts from the MCUBoot repository root directory.
The key file will be parsed by imgtool's getpub command and a .c source
with the public key information will be written in a format expected by
MCUboot.
endif
config MCUBOOT_CLEANUP_ARM_CORE
bool "Perform core cleanup before chain-load the application"
depends on CPU_CORTEX_M
default y
help
This option instructs MCUboot to perform a clean-up of a set of
architecture core HW registers before jumping to the application
firmware. The clean-up sets these registers to their warm-reset
values as specified by the architecture.
This option is enabled by default to prevent possible problems when
booting zephyr (or other) applications whereby e.g. a MPU stack guard
may be initialised in RAM which is then used by the application
start-up code which can cause a module fault and potentially make the
module irrecoverable.
config MCUBOOT_CLEANUP_RAM
bool "Perform RAM cleanup"
depends on CPU_CORTEX_M4 || CPU_CORTEX_M33
help
Sets contents of memory to 0 before jumping to application.
# Disable MBEDTLS from being selected if NRF_SECURITY is enabled, and use default NRF_SECURITY
# configuration file for MBEDTLS
config MBEDTLS
depends on !NRF_SECURITY
config NRF_SECURITY
select MBEDTLS_PROMPTLESS
if MBEDTLS || NRF_SECURITY
config MBEDTLS_CFG_FILE
default "config-tls-generic.h" if MBEDTLS_BUILTIN || BOOT_USE_PSA_CRYPTO
default "mcuboot-mbedtls-cfg.h" if BOOT_USE_MBEDTLS && !NRF_SECURITY
endif
config BOOT_HW_KEY
bool "Use HW key for image verification"
default n
help
Use HW key for image verification, otherwise the public key is embedded
in MCUBoot. If enabled the public key is appended to the signed image
and requires the hash of the public key to be provisioned to the device
beforehand.
config BOOT_VALIDATE_SLOT0
bool "Validate image in the primary slot on every boot"
default y
help
If y, the bootloader attempts to validate the signature of the
primary slot every boot. This adds the signature check time to
every boot, but can mitigate against some changes that are
able to modify the flash image itself.
config BOOT_VALIDATE_SLOT0_ONCE
bool "Validate image in the primary slot just once after after upgrade"
depends on !BOOT_VALIDATE_SLOT0 && SINGLE_APPLICATION_SLOT
default n
help
If y, the bootloader attempts to validate the signature of the
primary slot only once after an upgrade of the main slot.
It caches the result in the magic area, which makes it an unsecure
method. This option is usefull for lowering the boot up time for
low end devices with as a compromise lowering the security level.
If unsure, leave at the default value.
config BOOT_PREFER_SWAP_MOVE
bool "Prefer the newer swap move algorithm"
default y if SOC_FAMILY_NORDIC_NRF
default y if !$(dt_nodelabel_enabled,scratch_partition)
help
If y, the BOOT_IMAGE_UPGRADE_MODE will default to using
"move" instead of "scratch". This is a separate bool config
option, because Kconfig doesn't allow defaults to be
overridden in choice options. Most devices should be using
swap move.
if !SINGLE_APPLICATION_SLOT
choice BOOT_IMAGE_UPGRADE_MODE
prompt "Image upgrade modes"
default BOOT_SWAP_USING_MOVE if BOOT_PREFER_SWAP_MOVE
default BOOT_SWAP_USING_SCRATCH
config BOOT_SWAP_USING_SCRATCH
bool "Swap mode that run with the scratch partition"
help
This is the most conservative swap mode but it can work even on
devices with heterogeneous flash page layout.
config BOOT_UPGRADE_ONLY
bool "Overwrite image updates instead of swapping"
help
If y, overwrite the primary slot with the upgrade image instead
of swapping them. This prevents the fallback recovery, but
uses a much simpler code path.
config BOOT_SWAP_USING_MOVE
bool "Swap mode that can run without a scratch partition"
help
If y, the swap upgrade is done in two steps, where first every
sector of the primary slot is moved up one sector, then for
each sector X in the secondary slot, it is moved to index X in
the primary slot, then the sector at X+1 in the primary is
moved to index X in the secondary.
This allows a swap upgrade without using a scratch partition,
but is currently limited to all sectors in both slots being of
the same size.
config BOOT_DIRECT_XIP
bool "Run the latest image directly from its slot"
help
If y, mcuboot selects the newest valid image based on the image version
numbers, thereafter the selected image can run directly from its slot
without having to move/copy it into the primary slot. For this reason the
images must be linked to be executed from the given image slot. Using this
mode results in a simpler code path and smaller code size.
config BOOT_RAM_LOAD
bool "RAM load"
help
If y, mcuboot selects the newest valid image based on the image version
numbers, thereafter the selected image is copied to RAM and executed from
there. For this reason, the image has to be linked to be executed from RAM.
The address that the image is copied to is specified using the load-addr
argument to the imgtool.py script which writes it to the image header.
config BOOT_FIRMWARE_LOADER
bool "Firmware loader"
help
If y, mcuboot will have a single application slot, and the secondary
slot will be for a non-upgradeable firmware loaded image (e.g. for
loading firmware via Bluetooth). The main application will boot by
default unless there is an error with it or the boot mode has been
forced to the firmware loader.
Note: The firmware loader image must be signed with the same signing
key as the primary image.
endchoice
config BOOT_DIRECT_XIP_REVERT
bool "Enable the revert mechanism in direct-xip mode"
depends on BOOT_DIRECT_XIP
default n
help
If y, enables the revert mechanism in direct-xip similar to the one in
swap mode. It requires the trailer magic to be added to the signed image.
When a reboot happens without the image being confirmed at runtime, the
bootloader considers the image faulty and erases it. After this it will
attempt to boot the previous image. The images can also be made permanent
(marked as confirmed in advance) just like in swap mode.
config BOOT_BOOTSTRAP
bool "Bootstrap erased the primary slot from the secondary slot"
default n
help
If y, enables bootstraping support. Bootstrapping allows an erased
primary slot to be initialized from a valid image in the secondary slot.
If unsure, leave at the default value.
config BOOT_SWAP_SAVE_ENCTLV
bool "Save encrypted key TLVs instead of plaintext keys in swap metadata"
default n
depends on BOOT_ENCRYPT_IMAGE
help
If y, instead of saving the encrypted image keys in plaintext in the
swap resume metadata, save the encrypted image TLVs. This should be used
when there is no security mechanism protecting the data in the primary
slot from being dumped. If n is selected (default), the keys are written
after being decrypted from the image TLVs and could be read by an
attacker who has access to the flash contents of the primary slot (eg
JTAG/SWD or primary slot in external flash).
If unsure, leave at the default value.
endif # !SINGLE_APPLICATION_SLOT
config SINGLE_APPLICATION_SLOT_RAM_LOAD
bool "RAM load for single application slot"
help
If y, the image is loaded to RAM and executed from there. For this reason,
the image has to be linked to be executed from RAM. The address that the
image is copied to is specified using the load-addr argument to the
imgtool.py script which writes it to the image header.
# Workaround for not being able to have commas in macro arguments
DT_CHOSEN_Z_SRAM := zephyr,sram
if BOOT_RAM_LOAD || SINGLE_APPLICATION_SLOT_RAM_LOAD
config BOOT_IMAGE_EXECUTABLE_RAM_START
hex "Boot image executable ram start"
default $(dt_chosen_reg_addr_hex,$(DT_CHOSEN_Z_SRAM))
config BOOT_IMAGE_EXECUTABLE_RAM_SIZE
int "Boot image executable base size"
default $(dt_chosen_reg_size_int,$(DT_CHOSEN_Z_SRAM),0)
endif
config BOOT_ENCRYPTION_SUPPORT
bool
help
Hidden option used to check if image encryption is supported.
config BOOT_ENCRYPT_IMAGE
bool "Support for encrypted image updates"
depends on BOOT_ENCRYPTION_SUPPORT
select BOOT_ENCRYPT_RSA if BOOT_SIGNATURE_TYPE_RSA
select BOOT_ENCRYPT_EC256 if BOOT_SIGNATURE_TYPE_ECDSA_P256
select BOOT_ENCRYPT_X25519 if BOOT_SIGNATURE_TYPE_ED25519
depends on !SINGLE_APPLICATION_SLOT || MCUBOOT_SERIAL
help
If y, images in the secondary slot can be encrypted and are decrypted
on the fly when upgrading to the primary slot, as well as encrypted
back when swapping from the primary slot to the secondary slot. The
encryption mechanism must match the same type as the signature type,
supported types include:
- RSA-OAEP (2048 bits).
- ECIES using primitives described under "ECIES-P256 encryption" in
docs/encrypted_images.md.
- ECIES using primitives described under "ECIES-X25519 encryption"
in docs/encrypted_images.md.
Note that for single slot operation, this can still be used to allow
loading encrypted images via serial recovery which are then
decrypted on-the-fly without needing a second slot.
config BOOT_ENCRYPT_RSA
bool
help
Hidden option selecting RSA encryption.
config BOOT_ENCRYPT_EC256
bool
help
Hidden option selecting EC256 encryption.
config BOOT_ENCRYPT_X25519
bool
help
Hidden option selecting x25519 encryption.
config BOOT_ENCRYPTION_KEY_FILE
string "Encryption key file"
depends on BOOT_ENCRYPT_IMAGE
default "enc-rsa2048-priv.pem" if BOOT_ENCRYPT_RSA
default "enc-ec256-priv.pem" if BOOT_ENCRYPT_EC256
default "enc-x25519-priv.pem" if BOOT_ENCRYPT_X25519
default ""
help
You can use either absolute or relative path.
In case relative path is used, the build system assumes that it starts
from the directory where the MCUBoot KConfig configuration file is
located. If the key file is not there, the build system uses relative
path that starts from the MCUBoot repository root directory.
The key file will be parsed by imgtool's getpriv command and a .c source
with the public key information will be written in a format expected by
MCUboot.
config BOOT_MAX_IMG_SECTORS_AUTO
bool "Calculate maximum sectors automatically"
default y if !PARTITION_MANAGER_ENABLED
help
If this option is enabled then the maximum number of supported sectors per image will
be calculated automatically from the flash erase sizes and size of each partition for
the first image.
If this information is not available, or multiple images are used, then this option
should be disabled and BOOT_MAX_IMG_SECTORS should be set instead
config BOOT_MAX_IMG_SECTORS
int "Maximum number of sectors per image slot"
default 128
depends on !BOOT_MAX_IMG_SECTORS_AUTO
help
This option controls the maximum number of sectors that each of
the two image areas can contain. Smaller values reduce MCUboot's
memory usage; larger values allow it to support larger images.
If unsure, leave at the default value.
config BOOT_SHARE_BACKEND_AVAILABLE
bool
default n
help
Hidden open which indicates if there is a sharing backend available.
# Workaround for not being able to have commas in macro arguments
DT_CHOSEN_BOOTLOADER_INFO := zephyr,bootloader-info
config BOOT_SHARE_BACKEND_AVAILABLE
bool
default n
help
Hidden open which indicates if there is a sharing backend available.
choice BOOT_SHARE_BACKEND
prompt "Shared data backend"
default BOOT_SHARE_BACKEND_DISABLED
config BOOT_SHARE_BACKEND_DISABLED
bool "Disabled"
help
No data sharing support.
config BOOT_SHARE_BACKEND_RETENTION
bool "Retention"
depends on RETENTION
depends on $(dt_chosen_enabled,$(DT_CHOSEN_BOOTLOADER_INFO))
select BOOT_SHARE_BACKEND_AVAILABLE
help
Use retention to share data with application. Requires:
- Retained memory area
- Retention partition of retained memory area
- Chosen node "zephyr,bootloader-info" to be set to the retention
partition
config BOOT_SHARE_BACKEND_EXTERNAL
bool "External (user-provided code)"
select BOOT_SHARE_BACKEND_AVAILABLE
help
Use a custom user-specified storage.
endchoice
menuconfig BOOT_SHARE_DATA
bool "Save application specific data"
default n
depends on BOOT_SHARE_BACKEND_AVAILABLE
help
This will allow data to be shared between MCUboot and an application,
it does not include any informatiom by default.
Note: This requires a backend to function, see
BOOT_SHARE_BACKEND_RETENTION for details on using the retention
subsystem as a backend.
config BOOT_SHARE_DATA_BOOTINFO
bool "Save boot information data"
default n
depends on BOOT_SHARE_DATA
help
This will place information about the MCUboot configuration and
running application into a shared memory area.
menuconfig MEASURED_BOOT
bool "Store the boot state/measurements in shared memory area"
default n
depends on BOOT_SHARE_BACKEND_AVAILABLE
help
If enabled, the bootloader will store certain boot measurements such as
the hash of the firmware image in a shared memory area. This data can
be used later by runtime services (e.g. by a device attestation service).
Note: This requires a backend to function, see
BOOT_SHARE_BACKEND_RETENTION for details on using the retention
subsystem as a backend.
config MEASURED_BOOT_MAX_CBOR_SIZE
int "Maximum CBOR size of boot state/measurements"
default 64
range 0 256
depends on MEASURED_BOOT
help
The maximum size of the CBOR message which stores boot
state/measurements.
choice BOOT_FAULT_INJECTION_HARDENING_PROFILE
prompt "Fault injection hardening profile"
default BOOT_FIH_PROFILE_HIGH if BOOT_FIH_PROFILE_DEFAULT_HIGH
default BOOT_FIH_PROFILE_MEDIUM if BOOT_FIH_PROFILE_DEFAULT_MEDIUM
default BOOT_FIH_PROFILE_LOW if BOOT_FIH_PROFILE_DEFAULT_LOW
default BOOT_FIH_PROFILE_OFF
config BOOT_FIH_PROFILE_OFF
bool "No hardening against hardware level fault injection"
help
No hardening in SW against hardware level fault injection: power or
clock glitching, etc.
config BOOT_FIH_PROFILE_LOW
bool "Moderate level hardening against hardware level fault injection"
help
Moderate level hardening: Long global fail loop to avoid break out,
control flow integrity check to discover discrepancy in expected code
flow.
config BOOT_FIH_PROFILE_MEDIUM
bool "Medium level hardening against hardware level fault injection"
help
Medium level hardening: Long global fail loop to avoid break out,
control flow integrity check to discover discrepancy in expected code
flow, double variables to discover register or memory corruption.
config BOOT_FIH_PROFILE_HIGH
bool "Maximum level hardening against hardware level fault injection"
select MBEDTLS
help
Maximum level hardening: Long global fail loop to avoid break out,
control flow integrity check to discover discrepancy in expected code
flow, double variables to discover register or memory corruption, random
delays to make code execution less predictable. Random delays requires an
entropy source.
endchoice
choice BOOT_USB_DFU
prompt "USB DFU"
default BOOT_USB_DFU_NO
config BOOT_USB_DFU_NO
prompt "Disabled"
config BOOT_USB_DFU_WAIT
bool "Wait for a prescribed duration to see if USB DFU is invoked"
select USB_DEVICE_STACK
select USB_DFU_CLASS
select IMG_MANAGER
select STREAM_FLASH
select MULTITHREADING
help
If y, MCUboot waits for a prescribed duration of time to allow
for USB DFU to be invoked. Please note DFU always updates the
slot1 image.
config BOOT_USB_DFU_GPIO
bool "Use GPIO to detect whether to trigger DFU mode"
select USB_DEVICE_STACK
select USB_DFU_CLASS
select IMG_MANAGER
select STREAM_FLASH
select MULTITHREADING
help
If y, MCUboot uses GPIO to detect whether to invoke USB DFU.
endchoice
config BOOT_USB_DFU_WAIT_DELAY_MS
int "USB DFU wait duration"
depends on BOOT_USB_DFU_WAIT
default 12000
help
Milliseconds to wait for USB DFU to be invoked.
if BOOT_USB_DFU_GPIO
config BOOT_USB_DFU_DETECT_DELAY
int "Serial detect pin detection delay time [ms]"
default 0
help
Used to prevent the bootloader from loading on button press.
Useful for powering on when using the same button as
the one used to place the device in bootloader mode.
endif # BOOT_USB_DFU_GPIO
config BOOT_USB_DFU_NO_APPLICATION
bool "Stay in bootloader if no application"
help
Allows for entering USB DFU recovery mode if there is no bootable
application that the bootloader can jump to.
config BOOT_USE_BENCH
bool "Enable benchmark code"
default n
help
If y, adds support for simple benchmarking that can record
time intervals between two calls. The time printed depends
on the particular Zephyr target, and is generally ticks of a
specific board-specific timer.
module = MCUBOOT
module-str = MCUBoot bootloader
source "subsys/logging/Kconfig.template.log_config"
config MCUBOOT_LOG_THREAD_STACK_SIZE
int "Stack size for the MCUBoot log processing thread"
depends on LOG && !LOG_IMMEDIATE
default 2048 if COVERAGE_GCOV
default 1024 if NO_OPTIMIZATIONS
default 1024 if XTENSA
default 4096 if (X86 && X86_64)
default 4096 if ARM64
default 768
help
Set the internal stack size for MCUBoot log processing thread.
config MCUBOOT_INDICATION_LED
bool "Turns on LED indication when device is in DFU"
select GPIO
help
Device device activates the LED while in bootloader mode.
mcuboot-led0 alias must be set in the device's .dts
definitions for this to work.
rsource "Kconfig.serial_recovery"
rsource "Kconfig.firmware_loader"
config BOOT_INTR_VEC_RELOC
bool "Relocate the interrupt vector to the application"
default n
depends on SW_VECTOR_RELAY || CPU_CORTEX_M_HAS_VTOR
help
Relocate the interrupt vector to the application before it is started.
Select this option if application requires vector relocation,
but it doesn't relocate vector in its reset handler.
config UPDATEABLE_IMAGE_NUMBER
int "Number of updateable images"
default 1
range 1 1 if SINGLE_APPLICATION_SLOT || SINGLE_APPLICATION_SLOT_RAM_LOAD
help
Enables support of multi image update.
config BOOT_VERSION_CMP_USE_BUILD_NUMBER
bool "Use build number while comparing image version"
depends on (UPDATEABLE_IMAGE_NUMBER > 1) || BOOT_DIRECT_XIP || \
BOOT_RAM_LOAD || MCUBOOT_DOWNGRADE_PREVENTION
help
By default, the image version comparison relies only on version major,
minor and revision. Enable this option to take into account the build
number as well.
choice BOOT_DOWNGRADE_PREVENTION_CHOICE
prompt "Downgrade prevention"
optional
config MCUBOOT_DOWNGRADE_PREVENTION
bool "SW based downgrade prevention"
depends on !BOOT_DIRECT_XIP
help
Prevent downgrades by enforcing incrementing version numbers.
When this option is set, any upgrade must have greater major version
or greater minor version with equal major version. This mechanism
only protects against some attacks against version downgrades (for
example, a JTAG could be used to write an older version).
config MCUBOOT_DOWNGRADE_PREVENTION_SECURITY_COUNTER
bool "Use image security counter instead of version number"
depends on MCUBOOT_DOWNGRADE_PREVENTION
depends on (BOOT_SWAP_USING_MOVE || BOOT_SWAP_USING_SCRATCH)
help
Security counter is used for version eligibility check instead of pure
version. When this option is set, any upgrade must have greater or
equal security counter value.
Because of the acceptance of equal values it allows for software
downgrades to some extent.
config MCUBOOT_HW_DOWNGRADE_PREVENTION
bool "HW based downgrade prevention"
help
Prevent undesirable/malicious software downgrades. When this option is
set, any upgrade must have greater or equal security counter value.
Because of the acceptance of equal values it allows for software
downgrade to some extent.
endchoice
config BOOT_WATCHDOG_FEED
bool "Feed the watchdog while doing swap"
default y if WATCHDOG
default y if SOC_FAMILY_NORDIC_NRF
imply BOOT_WATCHDOG_FEED_NRFX_WDT if SOC_FAMILY_NORDIC_NRF
help
Enables implementation of MCUBOOT_WATCHDOG_FEED() macro which is
used to feed watchdog while doing time consuming operations.
config BOOT_WATCHDOG_FEED_NRFX_WDT
bool "Feed the watchdog using NRFX WDT directly"
depends on SOC_FAMILY_NORDIC_NRF
# for nRF nrfx based implementation is available
imply NRFX_WDT
imply NRFX_WDT0
imply NRFX_WDT1
imply NRFX_WDT30
imply NRFX_WDT31
config BOOT_IMAGE_ACCESS_HOOKS
bool "Enable hooks for overriding MCUboot's native routines"
help
Allow to provide procedures for override or extend native
MCUboot's routines required for access the image data and the image
update. It is up to the project customization to add required source
files to the build.
config MCUBOOT_ACTION_HOOKS
bool "Enable hooks for responding to MCUboot status changes"
help
This will call a handler when the MCUboot status changes which allows
for some level of user feedback, for instance to change LED status to
indicate a failure, using the callback:
'void mcuboot_status_change(mcuboot_status_type_t status)' where
'mcuboot_status_type_t' is listed in
boot/bootutil/include/bootutil/mcuboot_status.h
config BOOT_DISABLE_CACHES
bool "Disable I/D caches before chain-loading application"
depends on CPU_HAS_ICACHE || CPU_HAS_DCACHE
default y
help
Will flush and disable the instruction and data caches on the CPU prior to
booting an application, this is required on some ARM Cortex devices and
increases protection against data leakage from MCUboot to applications via
these caches.
config MCUBOOT_BOOT_BANNER
bool "Use MCUboot boot banner"
depends on BOOT_BANNER
depends on !NCS_BOOT_BANNER
depends on "$(APP_VERSION_EXTENDED_STRING)" != ""
default y
help
Uses a MCUboot boot banner instead of the default zephyr one, which will output the
MCUboot name and version, followed by the zephyr name and version.
For example:
*** Booting MCUboot v2.0.0-72-g8c0e36c88663 ***
*** Using Zephyr OS build v3.6.0-2607-gd0be2010c31f ***