163 lines
3.8 KiB
Plaintext
163 lines
3.8 KiB
Plaintext
#
|
|
|
|
comment "Security feature depends on loader"
|
|
depends on !RK_LOADER
|
|
|
|
comment "Security feature depends on linux kernel"
|
|
depends on !RK_KERNEL
|
|
|
|
comment "Security feature depends on buildroot rootfs"
|
|
depends on !RK_ROOTFS_SYSTEM_BUILDROOT
|
|
|
|
comment "Security feature would use it's own initrd"
|
|
depends on RK_ROOTFS_INITRD
|
|
|
|
menuconfig RK_SECURITY
|
|
bool "Security feature (secureboot, encryption, verity, etc.)"
|
|
depends on RK_LOADER
|
|
depends on RK_KERNEL
|
|
depends on RK_ROOTFS_SYSTEM_BUILDROOT
|
|
depends on !RK_ROOTFS_INITRD
|
|
|
|
if RK_SECURITY
|
|
|
|
comment "Security check method (system-verity) needs squashfs rootfs type"
|
|
depends on RK_ROOTFS_TYPE != "squashfs"
|
|
|
|
config RK_SECUREBOOT_METHOD
|
|
string
|
|
default "avb" if RK_SECUREBOOT_AVB
|
|
default "fit" if RK_SECUREBOOT_FIT
|
|
|
|
choice
|
|
prompt "Secureboot Method"
|
|
default RK_SECUREBOOT_FIT
|
|
|
|
config RK_SECUREBOOT_FIT
|
|
bool "fit"
|
|
depends on RK_USE_FIT_IMG
|
|
select RK_UBOOT_SPL # Security feature depends on U-Boot SPL loader
|
|
help
|
|
Open Source 'Flattened Image Tree'.
|
|
For RK3568/RK3588/RK3562 etc..
|
|
|
|
config RK_SECUREBOOT_AVB
|
|
bool "avb"
|
|
help
|
|
Features follow Android Verified Boot.
|
|
For RK3308/RK3399/RK3326/PX30 etc..
|
|
|
|
endchoice # Secureboot Method
|
|
|
|
config RK_SECURITY_OPTEE_STORAGE
|
|
string
|
|
default "rpmb" if RK_SECURITY_OPTEE_STORAGE_RPMB
|
|
default "security" if RK_SECURITY_OPTEE_STORAGE_SECURITY
|
|
|
|
choice
|
|
prompt "Optee Storage"
|
|
default RK_SECURITY_OPTEE_STORAGE_RPMB
|
|
|
|
config RK_SECURITY_OPTEE_STORAGE_RPMB
|
|
bool "rpmb"
|
|
help
|
|
HW partitions in eMMC device.
|
|
|
|
config RK_SECURITY_OPTEE_STORAGE_SECURITY
|
|
bool "security"
|
|
help
|
|
Logic partitions can be defined by user in any storage.
|
|
|
|
endchoice # Optee Storage
|
|
|
|
config RK_SECURITY_CHECK_METHOD
|
|
string
|
|
default "base" if RK_SECURITY_CHECK_BASE
|
|
default "system-encryption" if RK_SECURITY_CHECK_SYSTEM_ENCRYPTION
|
|
default "system-verity" if RK_SECURITY_CHECK_SYSTEM_VERITY
|
|
|
|
choice
|
|
prompt "security check method (base|system-encryption|system-verity)"
|
|
default RK_SECURITY_CHECK_SYSTEM_VERITY if RK_CHIP_FAMILY = "rk3566_rk3568"
|
|
|
|
config RK_SECURITY_CHECK_BASE
|
|
bool "base"
|
|
help
|
|
Check firmwares include loader,uboot,boot or recovery.
|
|
|
|
config RK_SECURITY_CHECK_SYSTEM_ENCRYPTION
|
|
bool "system-encryption"
|
|
help
|
|
Check firmwares include loader,uboot,boot or recovery.
|
|
And encrypte system image.
|
|
And system is read-only if RK_ROOTFS_TYPE was ubi type.
|
|
|
|
config RK_SECURITY_CHECK_SYSTEM_VERITY
|
|
bool "system-verity"
|
|
depends on RK_ROOTFS_TYPE = "squashfs" || RK_ROOTFS_TYPE = "ubi"
|
|
help
|
|
Check firmwares include loader,uboot,boot or recovery,system.
|
|
And system must be read-only.
|
|
|
|
endchoice # security check method
|
|
|
|
if !RK_SECURITY_CHECK_BASE
|
|
|
|
menu "Security ramdisk"
|
|
|
|
config RK_SECURITY_INITRD_BASE_CFG
|
|
string "buildroot base cfg (rockchip_<cfg>_ramboot_defconfig)"
|
|
default RK_CHIP_FAMILY
|
|
help
|
|
Base name of buildroot defconfig for security ramdisk.
|
|
|
|
config RK_SECURITY_INITRD_CFG
|
|
string
|
|
default "rockchip_${RK_SECURITY_INITRD_BASE_CFG}_ramboot"
|
|
|
|
config RK_SECURITY_INITRD_TYPE
|
|
string
|
|
default "romfs" if RK_SECURITY_ROMFS
|
|
default "cpio" if RK_SECURITY_CPIO
|
|
default "cpio.gz" if RK_SECURITY_CPIO_GZ
|
|
|
|
choice
|
|
prompt "ramdisk filesystem type"
|
|
default RK_SECURITY_CPIO_GZ
|
|
|
|
config RK_SECURITY_ROMFS
|
|
bool "romfs"
|
|
|
|
config RK_SECURITY_CPIO
|
|
bool "cpio"
|
|
|
|
config RK_SECURITY_CPIO_GZ
|
|
bool "cpio.gz"
|
|
|
|
endchoice # init RD type
|
|
|
|
config RK_SECURITY_FIT_ITS_NAME
|
|
string "its script for FIT ramboot image"
|
|
depends on RK_SECUREBOOT_FIT
|
|
default RK_RECOVERY_FIT_ITS_NAME if RK_RECOVERY_FIT_ITS_NAME != ""
|
|
default "boot4recovery.its"
|
|
|
|
config RK_SECURITY_FIT_ITS
|
|
string
|
|
default "$RK_CHIP_DIR/$RK_SECURITY_FIT_ITS_NAME"
|
|
|
|
endmenu # Security ramdisk
|
|
|
|
endif # !base check
|
|
|
|
comment "Burn security key is dangerous and cannot be reverted!"
|
|
depends on RK_SECURITY_BURN_KEY
|
|
|
|
config RK_SECURITY_BURN_KEY
|
|
bool "burn security key"
|
|
help
|
|
Burn security key's hash to non volatile memory.
|
|
|
|
endif # Security
|
|
endmenuconfig # Security
|