]> git.ipfire.org Git - thirdparty/u-boot.git/blob - Kconfig
lib: rsa: decouple rsa from FIT image verification
[thirdparty/u-boot.git] / Kconfig
1 #
2 # For a description of the syntax of this configuration file,
3 # see the file Documentation/kbuild/kconfig-language.txt in the
4 # Linux kernel source tree.
5 #
6 mainmenu "U-Boot $UBOOTVERSION Configuration"
7
8 config UBOOTVERSION
9 string
10 option env="UBOOTVERSION"
11
12 # Allow defaults in arch-specific code to override any given here
13 source "arch/Kconfig"
14
15 menu "General setup"
16
17 config BROKEN
18 bool
19 help
20 This option cannot be enabled. It is used as dependency
21 for broken and incomplete features.
22
23 config DEPRECATED
24 bool
25 help
26 This option cannot be enabled. It it used as a dependency for
27 code that relies on deprecated features that will be removed and
28 the conversion deadline has passed.
29
30 config LOCALVERSION
31 string "Local version - append to U-Boot release"
32 help
33 Append an extra string to the end of your U-Boot version.
34 This will show up in your boot log, for example.
35 The string you set here will be appended after the contents of
36 any files with a filename matching localversion* in your
37 object and source tree, in that order. Your total string can
38 be a maximum of 64 characters.
39
40 config LOCALVERSION_AUTO
41 bool "Automatically append version information to the version string"
42 default y
43 help
44 This will try to automatically determine if the current tree is a
45 release tree by looking for Git tags that belong to the current
46 top of tree revision.
47
48 A string of the format -gxxxxxxxx will be added to the localversion
49 if a Git-based tree is found. The string generated by this will be
50 appended after any matching localversion* files, and after the value
51 set in CONFIG_LOCALVERSION.
52
53 (The actual string used here is the first eight characters produced
54 by running the command:
55
56 $ git rev-parse --verify HEAD
57
58 which is done within the script "scripts/setlocalversion".)
59
60 config CC_OPTIMIZE_FOR_SIZE
61 bool "Optimize for size"
62 default y
63 help
64 Enabling this option will pass "-Os" instead of "-O2" to gcc
65 resulting in a smaller U-Boot image.
66
67 This option is enabled by default for U-Boot.
68
69 config CC_COVERAGE
70 bool "Enable code coverage analysis"
71 depends on SANDBOX
72 help
73 Enabling this option will pass "--coverage" to gcc to compile
74 and link code instrumented for coverage analysis.
75
76 config DISTRO_DEFAULTS
77 bool "Select defaults suitable for booting general purpose Linux distributions"
78 select AUTO_COMPLETE
79 select CMDLINE_EDITING
80 select CMD_BOOTI if ARM64
81 select CMD_BOOTZ if ARM && !ARM64
82 select CMD_DHCP if CMD_NET
83 select CMD_ENV_EXISTS
84 select CMD_EXT2
85 select CMD_EXT4
86 select CMD_FAT
87 select CMD_FS_GENERIC
88 select CMD_PART if PARTITIONS
89 select CMD_PING if CMD_NET
90 select CMD_PXE if NET
91 select CMD_SYSBOOT
92 select ENV_VARS_UBOOT_CONFIG
93 select HUSH_PARSER
94 select SUPPORT_RAW_INITRD
95 select SYS_LONGHELP
96 imply CMD_MII if NET
97 imply USB_STORAGE
98 imply USE_BOOTCOMMAND
99 help
100 Select this to enable various options and commands which are suitable
101 for building u-boot for booting general purpose Linux distributions.
102
103 config ENV_VARS_UBOOT_CONFIG
104 bool "Add arch, board, vendor and soc variables to default environment"
105 help
106 Define this in order to add variables describing the
107 U-Boot build configuration to the default environment.
108 These will be named arch, cpu, board, vendor, and soc.
109 Enabling this option will cause the following to be defined:
110 - CONFIG_SYS_ARCH
111 - CONFIG_SYS_CPU
112 - CONFIG_SYS_BOARD
113 - CONFIG_SYS_VENDOR
114 - CONFIG_SYS_SOC
115
116 config NR_DRAM_BANKS
117 int "Number of DRAM banks"
118 default 4
119 help
120 This defines the number of DRAM banks.
121
122 config SYS_BOOT_GET_CMDLINE
123 bool "Enable kernel command line setup"
124 help
125 Enables allocating and saving kernel cmdline in space between
126 "bootm_low" and "bootm_low" + BOOTMAPSZ.
127
128 config SYS_BOOT_GET_KBD
129 bool "Enable kernel board information setup"
130 help
131 Enables allocating and saving a kernel copy of the bd_info in
132 space between "bootm_low" and "bootm_low" + BOOTMAPSZ.
133
134 config SYS_MALLOC_F
135 bool "Enable malloc() pool before relocation"
136 default y if DM
137
138 help
139 Before relocation, memory is very limited on many platforms. Still,
140 we can provide a small malloc() pool if needed. Driver model in
141 particular needs this to operate, so that it can allocate the
142 initial serial device and any others that are needed.
143
144 config SYS_MALLOC_F_LEN
145 hex "Size of malloc() pool before relocation"
146 depends on SYS_MALLOC_F
147 default 0x1000 if AM33XX
148 default 0x2800 if SANDBOX
149 default 0x2000 if (ARCH_IMX8 || ARCH_IMX8M || ARCH_MX7 || \
150 ARCH_MX7ULP || ARCH_MX6 || ARCH_MX5 || \
151 ARCH_LS1012A || ARCH_LS1021A || ARCH_LS1043A || \
152 ARCH_LS1046A)
153 default 0x400
154 help
155 Before relocation, memory is very limited on many platforms. Still,
156 we can provide a small malloc() pool if needed. Driver model in
157 particular needs this to operate, so that it can allocate the
158 initial serial device and any others that are needed.
159
160 config SYS_MALLOC_LEN
161 hex "Define memory for Dynamic allocation"
162 depends on ARCH_ZYNQ || ARCH_VERSAL || ARCH_STM32MP || ARCH_ROCKCHIP
163 default 0x2000000 if ARCH_ROCKCHIP
164 help
165 This defines memory to be allocated for Dynamic allocation
166 TODO: Use for other architectures
167
168 config SPL_SYS_MALLOC_F_LEN
169 hex "Size of malloc() pool in SPL before relocation"
170 depends on SYS_MALLOC_F && SPL
171 default 0x2800 if RCAR_GEN3
172 default SYS_MALLOC_F_LEN
173 help
174 Before relocation, memory is very limited on many platforms. Still,
175 we can provide a small malloc() pool if needed. Driver model in
176 particular needs this to operate, so that it can allocate the
177 initial serial device and any others that are needed.
178
179 config TPL_SYS_MALLOC_F_LEN
180 hex "Size of malloc() pool in TPL before relocation"
181 depends on SYS_MALLOC_F && TPL
182 default SYS_MALLOC_F_LEN
183 help
184 Before relocation, memory is very limited on many platforms. Still,
185 we can provide a small malloc() pool if needed. Driver model in
186 particular needs this to operate, so that it can allocate the
187 initial serial device and any others that are needed.
188
189 menuconfig EXPERT
190 bool "Configure standard U-Boot features (expert users)"
191 default y
192 help
193 This option allows certain base U-Boot options and settings
194 to be disabled or tweaked. This is for specialized
195 environments which can tolerate a "non-standard" U-Boot.
196 Use this only if you really know what you are doing.
197
198 if EXPERT
199 config SYS_MALLOC_CLEAR_ON_INIT
200 bool "Init with zeros the memory reserved for malloc (slow)"
201 default y
202 help
203 This setting is enabled by default. The reserved malloc
204 memory is initialized with zeros, so first malloc calls
205 will return the pointer to the zeroed memory. But this
206 slows the boot time.
207
208 It is recommended to disable it, when CONFIG_SYS_MALLOC_LEN
209 value, has more than few MiB, e.g. when uses bzip2 or bmp logo.
210 Then the boot time can be significantly reduced.
211 Warning:
212 When disabling this, please check if malloc calls, maybe
213 should be replaced by calloc - if one expects zeroed memory.
214
215 config TOOLS_DEBUG
216 bool "Enable debug information for tools"
217 help
218 Enable generation of debug information for tools such as mkimage.
219 This can be used for debugging purposes. With debug information
220 it is possible to set breakpoints on particular lines, single-step
221 debug through the source code, etc.
222
223 endif # EXPERT
224
225 config PHYS_64BIT
226 bool "64bit physical address support"
227 help
228 Say Y here to support 64bit physical memory address.
229 This can be used not only for 64bit SoCs, but also for
230 large physical address extension on 32bit SoCs.
231
232 config BUILD_ROM
233 bool "Build U-Boot as BIOS replacement"
234 depends on X86
235 help
236 This option allows to build a ROM version of U-Boot.
237 The build process generally requires several binary blobs
238 which are not shipped in the U-Boot source tree.
239 Please, see doc/README.x86 for details.
240
241 config SPL_IMAGE
242 string "SPL image used in the combined SPL+U-Boot image"
243 default "spl/boot.bin" if ARCH_AT91 && SPL_NAND_SUPPORT
244 default "spl/u-boot-spl.bin"
245 depends on SPL
246 help
247 Select the SPL build target that shall be generated by the SPL
248 build process (default spl/u-boot-spl.bin). This image will be
249 used to generate a combined image with SPL and main U-Boot
250 proper as one single image.
251
252 config BUILD_TARGET
253 string "Build target special images"
254 default "u-boot-with-spl.sfp" if TARGET_SOCFPGA_ARRIA10
255 default "u-boot-with-spl.sfp" if TARGET_SOCFPGA_GEN5
256 default "u-boot-spl.kwb" if ARCH_MVEBU && SPL
257 default "u-boot-elf.srec" if RCAR_GEN3
258 default "u-boot.itb" if SPL_LOAD_FIT && (ARCH_ROCKCHIP || \
259 ARCH_SUNXI || RISCV || ARCH_ZYNQMP)
260 default "u-boot.kwb" if KIRKWOOD
261 default "u-boot-with-spl.bin" if ARCH_AT91 && SPL_NAND_SUPPORT
262 default "u-boot-with-spl.imx" if ARCH_MX6 && SPL
263 help
264 Some SoCs need special image types (e.g. U-Boot binary
265 with a special header) as build targets. By defining
266 CONFIG_BUILD_TARGET in the SoC / board header, this
267 special image will be automatically built upon calling
268 make / buildman.
269
270 config SYS_CUSTOM_LDSCRIPT
271 bool "Use a custom location for the U-Boot linker script"
272 help
273 Normally when linking U-Boot we will look in the board directory,
274 the CPU directory and finally the "cpu" directory of the architecture
275 for the ile "u-boot.lds" and use that as our linker. However, in
276 some cases we need to provide a different linker script. To do so,
277 enable this option and then provide the location under
278 CONFIG_SYS_LDSCRIPT.
279
280 config SYS_LDSCRIPT
281 depends on SYS_CUSTOM_LDSCRIPT
282 string "Custom ldscript location"
283 help
284 Path within the source tree to the linker script to use for the
285 main U-Boot binary.
286
287 config ERR_PTR_OFFSET
288 hex
289 default 0x0
290 help
291 Some U-Boot pointers have redundant information, so we can use a
292 scheme where we can return either an error code or a pointer with the
293 same return value. The default implementation just casts the pointer
294 to a number, however, this may fail on platforms where the end of the
295 address range is used for valid pointers (e.g. 0xffffff00 is a valid
296 heap pointer in socfpga SPL).
297 For such platforms, this value provides an upper range of those error
298 pointer values - up to 'MAX_ERRNO' bytes below this value must be
299 unused/invalid addresses.
300
301 endmenu # General setup
302
303 menu "Boot images"
304
305 config ANDROID_BOOT_IMAGE
306 bool "Enable support for Android Boot Images"
307 default y if FASTBOOT
308 help
309 This enables support for booting images which use the Android
310 image format header.
311
312 config FIT
313 bool "Support Flattened Image Tree"
314 select MD5
315 select SHA1
316 help
317 This option allows you to boot the new uImage structure,
318 Flattened Image Tree. FIT is formally a FDT, which can include
319 images of various types (kernel, FDT blob, ramdisk, etc.)
320 in a single blob. To boot this new uImage structure,
321 pass the address of the blob to the "bootm" command.
322 FIT is very flexible, supporting compression, multiple images,
323 multiple configurations, verification through hashing and also
324 verified boot (secure boot using RSA).
325
326 if FIT
327
328 config FIT_EXTERNAL_OFFSET
329 hex "FIT external data offset"
330 default 0x0
331 help
332 This specifies a data offset in fit image.
333 The offset is from data payload offset to the beginning of
334 fit image header. When specifies a offset, specific data
335 could be put in the hole between data payload and fit image
336 header, such as CSF data on i.MX platform.
337
338 config FIT_ENABLE_SHA256_SUPPORT
339 bool "Support SHA256 checksum of FIT image contents"
340 default y
341 select SHA256
342 help
343 Enable this to support SHA256 checksum of FIT image contents. A
344 SHA256 checksum is a 256-bit (32-byte) hash value used to check that
345 the image contents have not been corrupted. SHA256 is recommended
346 for use in secure applications since (as at 2016) there is no known
347 feasible attack that could produce a 'collision' with differing
348 input data. Use this for the highest security. Note that only the
349 SHA256 variant is supported: SHA512 and others are not currently
350 supported in U-Boot.
351
352 config FIT_SIGNATURE
353 bool "Enable signature verification of FIT uImages"
354 depends on DM
355 select HASH
356 select RSA
357 select RSA_VERIFY
358 select IMAGE_SIGN_INFO
359 help
360 This option enables signature verification of FIT uImages,
361 using a hash signed and verified using RSA. If
362 CONFIG_SHA_PROG_HW_ACCEL is defined, i.e support for progressive
363 hashing is available using hardware, then the RSA library will use
364 it. See doc/uImage.FIT/signature.txt for more details.
365
366 WARNING: When relying on signed FIT images with a required signature
367 check the legacy image format is disabled by default, so that
368 unsigned images cannot be loaded. If a board needs the legacy image
369 format support in this case, enable it using
370 CONFIG_LEGACY_IMAGE_FORMAT.
371
372 config FIT_SIGNATURE_MAX_SIZE
373 hex "Max size of signed FIT structures"
374 depends on FIT_SIGNATURE
375 default 0x10000000
376 help
377 This option sets a max size in bytes for verified FIT uImages.
378 A sane value of 256MB protects corrupted DTB structures from overlapping
379 device memory. Assure this size does not extend past expected storage
380 space.
381
382 config FIT_ENABLE_RSASSA_PSS_SUPPORT
383 bool "Support rsassa-pss signature scheme of FIT image contents"
384 depends on FIT_SIGNATURE
385 default n
386 help
387 Enable this to support the pss padding algorithm as described
388 in the rfc8017 (https://tools.ietf.org/html/rfc8017).
389
390 config FIT_CIPHER
391 bool "Enable ciphering data in a FIT uImages"
392 depends on DM
393 select AES
394 help
395 Enable the feature of data ciphering/unciphering in the tool mkimage
396 and in the u-boot support of the FIT image.
397
398 config FIT_VERBOSE
399 bool "Show verbose messages when FIT images fail"
400 help
401 Generally a system will have valid FIT images so debug messages
402 are a waste of code space. If you are debugging your images then
403 you can enable this option to get more verbose information about
404 failures.
405
406 config FIT_BEST_MATCH
407 bool "Select the best match for the kernel device tree"
408 help
409 When no configuration is explicitly selected, default to the
410 one whose fdt's compatibility field best matches that of
411 U-Boot itself. A match is considered "best" if it matches the
412 most specific compatibility entry of U-Boot's fdt's root node.
413 The order of entries in the configuration's fdt is ignored.
414
415 config FIT_IMAGE_POST_PROCESS
416 bool "Enable post-processing of FIT artifacts after loading by U-Boot"
417 depends on TI_SECURE_DEVICE
418 help
419 Allows doing any sort of manipulation to blobs after they got extracted
420 from FIT images like stripping off headers or modifying the size of the
421 blob, verification, authentication, decryption etc. in a platform or
422 board specific way. In order to use this feature a platform or board-
423 specific implementation of board_fit_image_post_process() must be
424 provided. Also, anything done during this post-processing step would
425 need to be comprehended in how the images were prepared before being
426 injected into the FIT creation (i.e. the blobs would have been pre-
427 processed before being added to the FIT image).
428
429 if SPL
430
431 config SPL_FIT
432 bool "Support Flattened Image Tree within SPL"
433 depends on SPL
434 select SPL_OF_LIBFDT
435
436 config SPL_FIT_PRINT
437 bool "Support FIT printing within SPL"
438 depends on SPL_FIT
439 help
440 Support printing the content of the fitImage in a verbose manner in SPL.
441
442 config SPL_FIT_SIGNATURE
443 bool "Enable signature verification of FIT firmware within SPL"
444 depends on SPL_DM
445 select SPL_FIT
446 select SPL_RSA
447 select SPL_RSA_VERIFY
448 select IMAGE_SIGN_INFO
449
450 config SPL_LOAD_FIT
451 bool "Enable SPL loading U-Boot as a FIT (basic fitImage features)"
452 select SPL_FIT
453 help
454 Normally with the SPL framework a legacy image is generated as part
455 of the build. This contains U-Boot along with information as to
456 where it should be loaded. This option instead enables generation
457 of a FIT (Flat Image Tree) which provides more flexibility. In
458 particular it can handle selecting from multiple device tree
459 and passing the correct one to U-Boot.
460
461 config SPL_LOAD_FIT_APPLY_OVERLAY
462 bool "Enable SPL applying DT overlays from FIT"
463 depends on SPL_LOAD_FIT
464 select OF_LIBFDT_OVERLAY
465 help
466 The device tree is loaded from the FIT image. Allow the SPL is to
467 also load device-tree overlays from the FIT image an apply them
468 over the device tree.
469
470 config SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ
471 depends on SPL_LOAD_FIT_APPLY_OVERLAY
472 default 0x10000
473 hex "size of temporary buffer used to load the overlays"
474 help
475 The size of the area where the overlays will be loaded and
476 uncompress. Must be at least as large as biggest overlay
477 (uncompressed)
478
479 config SPL_LOAD_FIT_FULL
480 bool "Enable SPL loading U-Boot as a FIT (full fitImage features)"
481 select SPL_FIT
482 help
483 Normally with the SPL framework a legacy image is generated as part
484 of the build. This contains U-Boot along with information as to
485 where it should be loaded. This option instead enables generation
486 of a FIT (Flat Image Tree) which provides more flexibility. In
487 particular it can handle selecting from multiple device tree
488 and passing the correct one to U-Boot.
489
490 config SPL_FIT_IMAGE_POST_PROCESS
491 bool "Enable post-processing of FIT artifacts after loading by the SPL"
492 depends on SPL_LOAD_FIT
493 help
494 Allows doing any sort of manipulation to blobs after they got extracted
495 from the U-Boot FIT image like stripping off headers or modifying the
496 size of the blob, verification, authentication, decryption etc. in a
497 platform or board specific way. In order to use this feature a platform
498 or board-specific implementation of board_fit_image_post_process() must
499 be provided. Also, anything done during this post-processing step would
500 need to be comprehended in how the images were prepared before being
501 injected into the FIT creation (i.e. the blobs would have been pre-
502 processed before being added to the FIT image).
503
504 config SPL_FIT_SOURCE
505 string ".its source file for U-Boot FIT image"
506 depends on SPL_FIT
507 help
508 Specifies a (platform specific) FIT source file to generate the
509 U-Boot FIT image. This could specify further image to load and/or
510 execute.
511
512 config SPL_FIT_GENERATOR
513 string ".its file generator script for U-Boot FIT image"
514 depends on SPL_FIT
515 default "board/sunxi/mksunxi_fit_atf.sh" if SPL_LOAD_FIT && ARCH_SUNXI
516 default "arch/arm/mach-rockchip/make_fit_atf.py" if SPL_LOAD_FIT && ARCH_ROCKCHIP
517 default "arch/arm/mach-zynqmp/mkimage_fit_atf.sh" if SPL_LOAD_FIT && ARCH_ZYNQMP
518 default "arch/riscv/lib/mkimage_fit_opensbi.sh" if SPL_LOAD_FIT && RISCV
519 help
520 Specifies a (platform specific) script file to generate the FIT
521 source file used to build the U-Boot FIT image file. This gets
522 passed a list of supported device tree file stub names to
523 include in the generated image.
524
525 endif # SPL
526
527 endif # FIT
528
529 config LEGACY_IMAGE_FORMAT
530 bool "Enable support for the legacy image format"
531 default y if !FIT_SIGNATURE
532 help
533 This option enables the legacy image format. It is enabled by
534 default for backward compatibility, unless FIT_SIGNATURE is
535 set where it is disabled so that unsigned images cannot be
536 loaded. If a board needs the legacy image format support in this
537 case, enable it here.
538
539 config OF_BOARD_SETUP
540 bool "Set up board-specific details in device tree before boot"
541 depends on OF_LIBFDT
542 help
543 This causes U-Boot to call ft_board_setup() before booting into
544 the Operating System. This function can set up various
545 board-specific information in the device tree for use by the OS.
546 The device tree is then passed to the OS.
547
548 config OF_SYSTEM_SETUP
549 bool "Set up system-specific details in device tree before boot"
550 depends on OF_LIBFDT
551 help
552 This causes U-Boot to call ft_system_setup() before booting into
553 the Operating System. This function can set up various
554 system-specific information in the device tree for use by the OS.
555 The device tree is then passed to the OS.
556
557 config OF_STDOUT_VIA_ALIAS
558 bool "Update the device-tree stdout alias from U-Boot"
559 depends on OF_LIBFDT
560 help
561 This uses U-Boot's serial alias from the aliases node to update
562 the device tree passed to the OS. The "linux,stdout-path" property
563 in the chosen node is set to point to the correct serial node.
564 This option currently references CONFIG_CONS_INDEX, which is
565 incorrect when used with device tree as this option does not
566 exist / should not be used.
567
568 config SYS_EXTRA_OPTIONS
569 string "Extra Options (DEPRECATED)"
570 help
571 The old configuration infrastructure (= mkconfig + boards.cfg)
572 provided the extra options field. If you have something like
573 "HAS_BAR,BAZ=64", the optional options
574 #define CONFIG_HAS
575 #define CONFIG_BAZ 64
576 will be defined in include/config.h.
577 This option was prepared for the smooth migration from the old
578 configuration to Kconfig. Since this option will be removed sometime,
579 new boards should not use this option.
580
581 config HAVE_SYS_TEXT_BASE
582 bool
583 depends on !NIOS2 && !XTENSA
584 depends on !EFI_APP
585 default y
586
587 config SYS_TEXT_BASE
588 depends on HAVE_SYS_TEXT_BASE
589 default 0x80800000 if ARCH_OMAP2PLUS || ARCH_K3
590 default 0x4a000000 if ARCH_SUNXI && !MACH_SUN9I && !MACH_SUN8I_V3S
591 default 0x2a000000 if ARCH_SUNXI && MACH_SUN9I
592 default 0x42e00000 if ARCH_SUNXI && MACH_SUN8I_V3S
593 hex "Text Base"
594 help
595 The address in memory that U-Boot will be running from, initially.
596
597 config SYS_CLK_FREQ
598 depends on ARC || ARCH_SUNXI || MPC83xx
599 int "CPU clock frequency"
600 help
601 TODO: Move CONFIG_SYS_CLK_FREQ for all the architecture
602
603 config ARCH_FIXUP_FDT_MEMORY
604 bool "Enable arch_fixup_memory_banks() call"
605 default y
606 help
607 Enable FDT memory map syncup before OS boot. This feature can be
608 used for booting OS with different memory setup where the part of
609 the memory location should be used for different purpose.
610
611 endmenu # Boot images
612
613 source "api/Kconfig"
614
615 source "common/Kconfig"
616
617 source "cmd/Kconfig"
618
619 source "disk/Kconfig"
620
621 source "dts/Kconfig"
622
623 source "env/Kconfig"
624
625 source "net/Kconfig"
626
627 source "drivers/Kconfig"
628
629 source "fs/Kconfig"
630
631 source "lib/Kconfig"
632
633 source "test/Kconfig"