Kconfig

#
# Copyright (c) Siemens AG, 2021-2023
#
# Authors:
#  Jan Kiszka <jan.kiszka@siemens.com>
#  Li Hua Qian <huaqian.li@siemens.com>
#
# This file is subject to the terms and conditions of the MIT License.  See
# COPYING.MIT file in the top-level directory.
#

mainmenu "IOT2050 Image Configuration"

config KAS_BUILD_SYSTEM
	string
	default "isar"

choice
	prompt "Image type"
	default IMAGE_EXAMPLE

config IMAGE_EXAMPLE
	bool "Example image"
	help
	  This is the official example image with several tools as well as
	  Node-RED preinstalled. It comes without a graphical user interface.

config IMAGE_SWUPDATE
	bool "Example image (SWUpdate A/B)"
	help
	  Based on the example image, this adds SWUpdate and changes the
	  partition layout to an A/B rootfs.

config IMAGE_BASE
	bool "Example image (minimal HW enablement)"
	help
	  Lean hardware enablement variant: core BSP and essential services,
	  no demo applications or development tooling. Layer optional
	  fragments (example demos, Node-RED, SM, Hailo, etc.) to grow
	  functionality incrementally.

config IMAGE_BOOT
	bool "Firmware boot images"
	help
	  Build boot firmware bundle for IOT2050 devices.
	  Generates:
	    - iot2050-pg1-image-boot.bin (Product Generation 1)
	    - iot2050-pg2-image-boot.bin (Product Generation 2 incl. M.2 & SM)

	  WARNING: Only flash if you are certain it matches your hardware AND
	  you have external recovery (flash programmer). A mismatch can brick
	  the device.

config IMAGE_FWU_PKG
	bool "Firmware update package"
	help
	  Build the universal firmware update package:
	    IOT2050-FW-Update-PKG-Vx.x.x.tar.xz
	  Includes:
	    - Firmware boot images
	    - Update criteria metadata
	    - Built-in environment settings
	  Applicable to all IOT2050 device variants.

endchoice

config KAS_INCLUDE_MAIN
	string
	default "kas/iot2050.yml" if IMAGE_BASE
	default "kas-iot2050-example.yml" if IMAGE_EXAMPLE
	default "kas-iot2050-swupdate.yml" if IMAGE_SWUPDATE
	default "kas-iot2050-boot.yml" if IMAGE_BOOT
	default "kas-iot2050-fwu-package.yml" if IMAGE_FWU_PKG

if !IMAGE_FWU_PKG
comment "Image features"
endif

if IMAGE_BASE || IMAGE_EXAMPLE || IMAGE_SWUPDATE

config PREEMPT_RT
	bool "Preempt-RT kernel"
	help
	  Build the image with a Preempt-RT kernel, rather than the default
	  non-preemptive one. This can help achieving better real-time
	  latencies with the device.

config KAS_INCLUDE_RT
	string
	default "kas/opt/preempt-rt.yml"
	depends on PREEMPT_RT

# Example demo content (apps / sample configs) selectable only for Base.
config NODE_RED
	bool "Node-RED support" if IMAGE_BASE
	depends on IMAGE_BASE
	default n
	help
	  Enable Node-RED runtime and curated nodes for the minimal hardware
	  enablement variant. The full Example and SWUpdate images already
	  include Node-RED via their main KAS descriptors, so this toggle is
	  only relevant here.

config KAS_INCLUDE_NODE_RED
	string
	default "kas/opt/node-red.yml"
	depends on NODE_RED

config SM
	bool "SM variant support" if IMAGE_BASE
	depends on IMAGE_BASE
	default n
	help
	  Enable SM hardware variant support (extended IO / sensors) for the
	  minimal hardware enablement variant. The full Example and SWUpdate
	  images already integrate this via their main descriptor chains.

config KAS_INCLUDE_SM
	string
	default "kas/opt/sm.yml"
	depends on SM

config EXAMPLE_DEMOS
	bool "Example demo content" if IMAGE_BASE
	depends on IMAGE_BASE
	default n
	help
	  Include example/demo applications and helper configuration that are
	  present by default in the full Example / SWUpdate images. This lets
	  you assemble a custom example-like stack starting from the minimal
	  hardware enablement variant.

config KAS_INCLUDE_EXAMPLE_DEMOS
	string
	default "kas/opt/example.yml"
	depends on EXAMPLE_DEMOS

config DOCKER
	bool "Docker support"
	help
	  Building image with docker support.

config KAS_INCLUDE_DOCKER
	string
	default "kas/opt/docker.yml"
	depends on DOCKER

config LXDE
	bool "LXDE graphical user interface"
	help
	  This adds an LXDE-based graphical user interface.

config KAS_INCLUDE_LXDE
	string
	default "kas/opt/lxde.yml"
	depends on LXDE

if HAILO_SUPPORT
config META_HAILO
	bool "Meta-Hailo AI card support"
	help
	  Enable building of meta-hailo, which includes the hailo driver,
	  firmware and userspace runtime libraries.

config KAS_INCLUDE_META_HAILO
	string
	default "kas/opt/hailo.yml"
	depends on META_HAILO
endif # HAILO_SUPPORT

endif

# Provide two entries so that the help text can be adjusted to the image.
config SECURE_BOOT
	bool "Secure boot & Data encryption"
	depends on IMAGE_SWUPDATE && !IMAGE_QEMU
	help
	  Enable signing of boot artifacts (boot loader, unified kernel image).
	  Furthermore activate dm-verity integrity protection for the read-only
	  root filesystem.

	  This uses the public custMpk.key and certificate by default. Do not
	  use this key in production, it is for demonstration purposes only.

	  The writable persistent /var and /home partitions are encrypted as
	  LUKS2 partitions.

	  The reason of coupling the data encryption with the secure boot is to
	  have a proper integrity chain rooted in hardware (OTP, RPMB, etc.)

config SECURE_BOOT
	bool "Secure boot"
	depends on IMAGE_BOOT || IMAGE_FWU_PKG
	help
	  Enable signing of all customizable firmware artifacts, enforce UEFI
	  Secure Boot mode, protect sensitive U-Boot environment variables and
	  prevent interactive access to U-Boot during boot and also on boot
	  failures.

	  This uses the public custMpk.key and certificate by default. Do not
	  use this key in production, it is for demonstration purposes only.

	  NOTE: Only PG2 and M.2 devices are officially supported regarding
	  secure boot.

config OTP_PROVISIONING
	bool "OTP Provisioning"
	depends on IMAGE_BOOT || IMAGE_FWU_PKG
	help
	  Integrate OTP provisioning data into the firmware artifacts. Various
	  options are avaiable. By default, this will integrate the OTP command
	  data for provision two public key hashes and enable secure boot in
	  OTP. 

	  WARNING: This uses the dummy keys by default. Do not use these keys
	  in production, they are for demonstration purposes only.

config RPMB_SETUP
	bool "OPTEE RPMB setup for OTP key write"
	depends on IMAGE_BOOT && !SECURE_BOOT
	help
	   Enable one-time pairing between processor and secure storage
	   (RPMB on eMMC). Do not sign and distribute this version. Run it
	   only in a secure environment on the target device, then replace it
	   with signed production firmware and enable secure boot.

config IMAGE_QEMU
	bool "QEMU Image"
	depends on IMAGE_BASE || IMAGE_EXAMPLE || IMAGE_SWUPDATE
	help
	  QEMU image to boot image without real hardware. The device emulated
	  by QEMU is not identical to a physical IOT2050. This leads to missing
	  or limited features such as Arduino I/Os, only one ethernet port,
	  virtual debug serial port, qemu version of u-boot, no watchdog, only
	  virtual drives, performance issues etc.

	  WARNING: Please be aware of potential problems when using the image
	  for testing purposes.

config KAS_INCLUDE_QEMU_IMAGE
	string
	default "kas-iot2050-qemu.yml"
	depends on IMAGE_QEMU

config KAS_INCLUDE_SECURE_BOOT
	string
	default "kas/opt/secure-boot.yml"
	depends on SECURE_BOOT

config KAS_INCLUDE_OTP_PROVISIONING
	string
	default "kas/opt/otpcmd/key-provision.yml" if OTP_PROVISIONING_2KEYS_ENABLE
	default "kas/opt/otpcmd/key-provision-keys-only.yml" if OTP_PROVISIONING_2KEYS
	default "kas/opt/otpcmd/key-provision-3keys.yml" if OTP_PROVISIONING_3KEYS_ENABLE
	default "kas/opt/otpcmd/key-provision-enabling-only.yml" if OTP_PROVISIONING_ENABLING_ONLY
	default "kas/opt/otpcmd/key-switch.yml" if OTP_PROVISIONING_KEY_SWITCHING_1TO2
	default "kas/opt/otpcmd/key-switch-2to3.yml" if OTP_PROVISIONING_KEY_SWITCHING_2TO3
	depends on OTP_PROVISIONING

config KAS_INCLUDE_RPMB_SETUP
	string
	default "kas/opt/rpmb-setup.yml"
	depends on RPMB_SETUP

comment "Build options"

config SDK
	bool "Build SDK"
	depends on IMAGE_EXAMPLE || IMAGE_SWUPDATE
	help
	  Generate an SDK consisting of a cross-compiler and library headers
	  needed to build applications for the device.

	  Note: This will not generate the image for the device itself.

config KAS_INCLUDE_SDK
	string
	default "kas/opt/sdk.yml"
	depends on SDK

config PACKAGE_LOCK
	bool "Use Debian packages from release"
	help
	  Use the same Debian packages that were selected for building the
	  released image or firmware version.

config KAS_INCLUDE_PACKAGE_LOCK
	string
	default "kas/opt/package-lock.yml"
	depends on PACKAGE_LOCK

config DEBIAN_MIRROR
	bool "Use specific debian mirror"
	depends on !PACKAGE_LOCK
	help
	  Rather than relying on deb.debian.org to select the best local
	  mirror, specify a specific one.

config DEBIAN_MIRROR_URL
	string "URL of Debian mirror"
	default "http://ftp.de.debian.org"
	depends on DEBIAN_MIRROR

config KAS_INCLUDE_DEBIAN_MIRROR
	string
	default "kas/opt/debian-mirror.yml"
	depends on DEBIAN_MIRROR

config FIRMWARE_SECURE_VER
	string "Use specific firmware secure version"
	default "0"
	depends on SECURE_BOOT && (IMAGE_BOOT || IMAGE_FWU_PKG)
	help
	  Use specific anti-rollback secure version rather than the default 0.
	  Range 0 - 127.

config TRUST_CENTER_REMOTE_SIGNING
	bool "Use trust center remote signing (no priviate key)"
	depends on SECURE_BOOT && (IMAGE_BOOT || IMAGE_FWU_PKG)
	help
	  Use trust center key to sign the firmware artifacts.

config KAS_INCLUDE_TRUST_CENTER
	string
	default "kas/opt/trust-center.yml"
	depends on TRUST_CENTER_REMOTE_SIGNING

choice
	prompt "*** OTP provisioning command type ***"
	depends on OTP_PROVISIONING
	default OTP_PROVISIONING_2KEYS_ENABLE

config OTP_PROVISIONING_2KEYS_ENABLE
	bool "2 keys & enabling secure boot"
	help
	  OTP provisioning command data contains the public key hashes of 
	  below keys and enabling secure boot:
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custMpk.pem
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custSmpk.pem


config OTP_PROVISIONING_2KEYS
	bool "2 keys only"
	help
	  OTP provisioning command data contains the public key hashes of 
	  below keys but without enabling secure boot:
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custMpk.pem
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custSmpk.pem

config OTP_PROVISIONING_3KEYS_ENABLE
	bool "3 keys & enabling secure boot"
	help
	  OTP provisioning command data contains the public key hashes of 
	  below keys and enabling secure boot:
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custMpk.pem
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custSmpk.pem
	  * meta/recipes-bsp/secure-boot-otp-provisioning/files/keys/custBmpk.pem

config OTP_PROVISIONING_ENABLING_ONLY
	bool "Enabling secure boot only"
	help
	  OTP provisioning command data only contains enabling secure boot.

config OTP_PROVISIONING_KEY_SWITCHING_1TO2
	bool "Key switching from key 1 to key 2"
	help
	  OTP provisioning command data contains key switching from key 1
	  to key 2.

config OTP_PROVISIONING_KEY_SWITCHING_2TO3
	bool "Key switching from key 2 to key 3"
	help
	  OTP provisioning command data contains key switching from key 2
	  to key 3.

endchoice