Skip to content

Commit 865f801

Browse files
de-nordiccarlescufi
de-nordic
authored and
carlescufi
committed
kconfig: Separate MCUboot options to Kconfig.mcuboot
Move Kconfig options related to MCUboot to Kconfig.mcuboot Signed-off-by: Dominik Ermel <[email protected]>
1 parent 87efe30 commit 865f801

File tree

2 files changed

+132
-123
lines changed

2 files changed

+132
-123
lines changed

‎Kconfig.mcuboot

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# General configuration options
2+
3+
# Copyright (c) 2014-2015 Wind River Systems, Inc.
4+
# Copyright (c) 2016 Intel Corporation
5+
# Copyright (c) 2023 Nordic Semiconductor ASA
6+
# SPDX-License-Identifier: Apache-2.0
7+
8+
config MCUBOOT
9+
bool
10+
help
11+
Hidden option used to indicate that the current image is MCUBoot
12+
13+
config BOOTLOADER_MCUBOOT
14+
bool "MCUboot bootloader support"
15+
select USE_DT_CODE_PARTITION
16+
imply INIT_ARCH_HW_AT_BOOT if ARCH_SUPPORTS_ARCH_HW_INIT
17+
depends on !MCUBOOT
18+
help
19+
This option signifies that the target uses MCUboot as a bootloader,
20+
or in other words that the image is to be chain-loaded by MCUboot.
21+
This sets several required build system and Device Tree options in
22+
order for the image generated to be bootable using the MCUboot open
23+
source bootloader. Currently this includes:
24+
25+
* Setting ROM_START_OFFSET to a default value that allows space
26+
for the MCUboot image header
27+
* Activating SW_VECTOR_RELAY_CLIENT on Cortex-M0
28+
(or Armv8-M baseline) targets with no built-in vector relocation
29+
mechanisms
30+
31+
By default, this option instructs Zephyr to initialize the core
32+
architecture HW registers during boot, when this is supported by
33+
the application. This removes the need by MCUboot to reset
34+
the core registers' state itself.
35+
36+
if BOOTLOADER_MCUBOOT
37+
38+
config MCUBOOT_CMAKE_WEST_SIGN_PARAMS
39+
string "Extra parameters to west sign"
40+
default "--quiet"
41+
help
42+
Parameters that are passed by cmake to west sign, just after
43+
the command, before all other parameters needed for image
44+
signing.
45+
By default this is set to "--quiet" to prevent extra, non-error,
46+
diagnostic messages from west sign. This does not affect signing
47+
tool for which extra parameters are passed with
48+
MCUBOOT_EXTRA_IMGTOOL_ARGS.
49+
50+
config MCUBOOT_SIGNATURE_KEY_FILE
51+
string "Path to the mcuboot signing key file"
52+
default ""
53+
depends on !MCUBOOT_GENERATE_UNSIGNED_IMAGE
54+
help
55+
The file contains a key pair whose public half is verified
56+
by your target's MCUboot image. The file is in PEM format.
57+
58+
If set to a non-empty value, the build system tries to
59+
sign the final binaries using a 'west sign -t imgtool' command.
60+
The signed binaries are placed in the build directory
61+
at zephyr/zephyr.signed.bin and zephyr/zephyr.signed.hex.
62+
63+
The file names can be customized with CONFIG_KERNEL_BIN_NAME.
64+
The existence of bin and hex files depends on CONFIG_BUILD_OUTPUT_BIN
65+
and CONFIG_BUILD_OUTPUT_HEX.
66+
67+
This option should contain a path to the same file as the
68+
BOOT_SIGNATURE_KEY_FILE option in your MCUboot .config. The path
69+
may be absolute or relative to the west workspace topdir. (The MCUboot
70+
config option is used for the MCUboot bootloader image; this option is
71+
for your application which is to be loaded by MCUboot. The MCUboot
72+
config option can be a relative path from the MCUboot repository
73+
root.)
74+
75+
If left empty, you must sign the Zephyr binaries manually.
76+
77+
config MCUBOOT_ENCRYPTION_KEY_FILE
78+
string "Path to the mcuboot encryption key file"
79+
default ""
80+
depends on MCUBOOT_SIGNATURE_KEY_FILE != ""
81+
help
82+
The file contains the public key that is used to encrypt the
83+
ephemeral key that encrypts the image. The corresponding
84+
private key is hard coded in the MCUboot source code and is
85+
used to decrypt the ephemeral key that is embedded in the
86+
image. The file is in PEM format.
87+
88+
If set to a non-empty value, the build system tries to
89+
sign and encrypt the final binaries using a 'west sign -t imgtool'
90+
command. The binaries are placed in the build directory at
91+
zephyr/zephyr.signed.encrypted.bin and
92+
zephyr/zephyr.signed.encrypted.hex.
93+
94+
The file names can be customized with CONFIG_KERNEL_BIN_NAME.
95+
The existence of bin and hex files depends on CONFIG_BUILD_OUTPUT_BIN
96+
and CONFIG_BUILD_OUTPUT_HEX.
97+
98+
This option should either be an absolute path or a path relative to
99+
the west workspace topdir.
100+
Example: './bootloader/mcuboot/enc-rsa2048-pub.pem'
101+
102+
If left empty, you must encrypt the Zephyr binaries manually.
103+
104+
config MCUBOOT_EXTRA_IMGTOOL_ARGS
105+
string "Extra arguments to pass to imgtool when signing"
106+
default ""
107+
help
108+
When signing (CONFIG_MCUBOOT_SIGNATURE_KEY_FILE is a non-empty
109+
string) you can use this option to pass extra options to
110+
imgtool. For example, you could set this to "--version 1.2".
111+
112+
config MCUBOOT_GENERATE_UNSIGNED_IMAGE
113+
bool "Generate unsigned binary image bootable with MCUboot"
114+
help
115+
Enabling this configuration allows automatic unsigned binary image
116+
generation when MCUboot signing key is not provided,
117+
i.e., MCUBOOT_SIGNATURE_KEY_FILE is left empty.
118+
119+
config MCUBOOT_GENERATE_CONFIRMED_IMAGE
120+
bool "Also generate a padded, confirmed image"
121+
help
122+
The signed, padded, and confirmed binaries are placed in the build
123+
directory at zephyr/zephyr.signed.confirmed.bin and
124+
zephyr/zephyr.signed.confirmed.hex.
125+
126+
The file names can be customized with CONFIG_KERNEL_BIN_NAME.
127+
The existence of bin and hex files depends on CONFIG_BUILD_OUTPUT_BIN
128+
and CONFIG_BUILD_OUTPUT_HEX.
129+
130+
endif # BOOTLOADER_MCUBOOT

‎Kconfig.zephyr

Lines changed: 2 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Copyright (c) 2014-2015 Wind River Systems, Inc.
44
# Copyright (c) 2016 Intel Corporation
5+
# Copyright (c) 2023 Nordic Semiconductor ASA
56
# SPDX-License-Identifier: Apache-2.0
67

78

@@ -793,129 +794,7 @@ config BOOTLOADER_SRAM_SIZE
793794
- Zephyr is a !XIP image, which implicitly assumes existence of a
794795
bootloader that loads the Zephyr !XIP image onto SRAM.
795796

796-
config MCUBOOT
797-
bool
798-
help
799-
Hidden option used to indicate that the current image is MCUBoot
800-
801-
config BOOTLOADER_MCUBOOT
802-
bool "MCUboot bootloader support"
803-
select USE_DT_CODE_PARTITION
804-
imply INIT_ARCH_HW_AT_BOOT if ARCH_SUPPORTS_ARCH_HW_INIT
805-
depends on !MCUBOOT
806-
help
807-
This option signifies that the target uses MCUboot as a bootloader,
808-
or in other words that the image is to be chain-loaded by MCUboot.
809-
This sets several required build system and Device Tree options in
810-
order for the image generated to be bootable using the MCUboot open
811-
source bootloader. Currently this includes:
812-
813-
* Setting ROM_START_OFFSET to a default value that allows space
814-
for the MCUboot image header
815-
* Activating SW_VECTOR_RELAY_CLIENT on Cortex-M0
816-
(or Armv8-M baseline) targets with no built-in vector relocation
817-
mechanisms
818-
819-
By default, this option instructs Zephyr to initialize the core
820-
architecture HW registers during boot, when this is supported by
821-
the application. This removes the need by MCUboot to reset
822-
the core registers' state itself.
823-
824-
if BOOTLOADER_MCUBOOT
825-
826-
config MCUBOOT_CMAKE_WEST_SIGN_PARAMS
827-
string "Extra parameters to west sign"
828-
default "--quiet"
829-
help
830-
Parameters that are passed by cmake to west sign, just after
831-
the command, before all other parameters needed for image
832-
signing.
833-
By default this is set to "--quiet" to prevent extra, non-error,
834-
diagnostic messages from west sign. This does not affect signing
835-
tool for which extra parameters are passed with
836-
MCUBOOT_EXTRA_IMGTOOL_ARGS.
837-
838-
config MCUBOOT_SIGNATURE_KEY_FILE
839-
string "Path to the mcuboot signing key file"
840-
default ""
841-
depends on !MCUBOOT_GENERATE_UNSIGNED_IMAGE
842-
help
843-
The file contains a key pair whose public half is verified
844-
by your target's MCUboot image. The file is in PEM format.
845-
846-
If set to a non-empty value, the build system tries to
847-
sign the final binaries using a 'west sign -t imgtool' command.
848-
The signed binaries are placed in the build directory
849-
at zephyr/zephyr.signed.bin and zephyr/zephyr.signed.hex.
850-
851-
The file names can be customized with CONFIG_KERNEL_BIN_NAME.
852-
The existence of bin and hex files depends on CONFIG_BUILD_OUTPUT_BIN
853-
and CONFIG_BUILD_OUTPUT_HEX.
854-
855-
This option should contain a path to the same file as the
856-
BOOT_SIGNATURE_KEY_FILE option in your MCUboot .config. The path
857-
may be absolute or relative to the west workspace topdir. (The MCUboot
858-
config option is used for the MCUboot bootloader image; this option is
859-
for your application which is to be loaded by MCUboot. The MCUboot
860-
config option can be a relative path from the MCUboot repository
861-
root.)
862-
863-
If left empty, you must sign the Zephyr binaries manually.
864-
865-
config MCUBOOT_ENCRYPTION_KEY_FILE
866-
string "Path to the mcuboot encryption key file"
867-
default ""
868-
depends on MCUBOOT_SIGNATURE_KEY_FILE != ""
869-
help
870-
The file contains the public key that is used to encrypt the
871-
ephemeral key that encrypts the image. The corresponding
872-
private key is hard coded in the MCUboot source code and is
873-
used to decrypt the ephemeral key that is embedded in the
874-
image. The file is in PEM format.
875-
876-
If set to a non-empty value, the build system tries to
877-
sign and encrypt the final binaries using a 'west sign -t imgtool'
878-
command. The binaries are placed in the build directory at
879-
zephyr/zephyr.signed.encrypted.bin and
880-
zephyr/zephyr.signed.encrypted.hex.
881-
882-
The file names can be customized with CONFIG_KERNEL_BIN_NAME.
883-
The existence of bin and hex files depends on CONFIG_BUILD_OUTPUT_BIN
884-
and CONFIG_BUILD_OUTPUT_HEX.
885-
886-
This option should either be an absolute path or a path relative to
887-
the west workspace topdir.
888-
Example: './bootloader/mcuboot/enc-rsa2048-pub.pem'
889-
890-
If left empty, you must encrypt the Zephyr binaries manually.
891-
892-
config MCUBOOT_EXTRA_IMGTOOL_ARGS
893-
string "Extra arguments to pass to imgtool when signing"
894-
default ""
895-
help
896-
When signing (CONFIG_MCUBOOT_SIGNATURE_KEY_FILE is a non-empty
897-
string) you can use this option to pass extra options to
898-
imgtool. For example, you could set this to "--version 1.2".
899-
900-
config MCUBOOT_GENERATE_UNSIGNED_IMAGE
901-
bool "Generate unsigned binary image bootable with MCUboot"
902-
help
903-
Enabling this configuration allows automatic unsigned binary image
904-
generation when MCUboot signing key is not provided,
905-
i.e., MCUBOOT_SIGNATURE_KEY_FILE is left empty.
906-
907-
config MCUBOOT_GENERATE_CONFIRMED_IMAGE
908-
bool "Also generate a padded, confirmed image"
909-
help
910-
The signed, padded, and confirmed binaries are placed in the build
911-
directory at zephyr/zephyr.signed.confirmed.bin and
912-
zephyr/zephyr.signed.confirmed.hex.
913-
914-
The file names can be customized with CONFIG_KERNEL_BIN_NAME.
915-
The existence of bin and hex files depends on CONFIG_BUILD_OUTPUT_BIN
916-
and CONFIG_BUILD_OUTPUT_HEX.
917-
918-
endif # BOOTLOADER_MCUBOOT
797+
source "Kconfig.mcuboot"
919798

920799
config BOOTLOADER_ESP_IDF
921800
bool "ESP-IDF bootloader support"

0 commit comments

Comments
 (0)