esp-idf/components/nvs_flash/Kconfig

menu "NVS"

    config NVS_ENCRYPTION
        bool "Enable NVS encryption"
        depends on SECURE_FLASH_ENC_ENABLED || SOC_HMAC_SUPPORTED
        default y if SECURE_FLASH_ENC_ENABLED
        help
            This option enables encryption for NVS. When enabled, XTS-AES is used to encrypt
            the complete NVS data, except the page headers. It requires XTS encryption keys
            to be stored in an encrypted partition (enabling flash encryption is mandatory here)
            or to be derived from an HMAC key burnt in eFuse.

    config NVS_COMPATIBLE_PRE_V4_3_ENCRYPTION_FLAG
        bool "NVS partition encrypted flag compatible with ESP-IDF before v4.3"
        depends on SECURE_FLASH_ENC_ENABLED
        help
            Enabling this will ignore "encrypted" flag for NVS partitions. NVS encryption
            scheme is different than hardware flash encryption and hence it is not recommended
            to have "encrypted" flag for NVS partitions. This was not being checked in pre v4.3
            IDF. Hence, if you have any devices where this flag is kept enabled in partition
            table then enabling this config will allow to have same behavior as pre v4.3 IDF.

    config NVS_ASSERT_ERROR_CHECK
        bool "Use assertions for error checking"
        default n
        help
            This option switches error checking type between assertions (y) or return codes (n).

    config NVS_LEGACY_DUP_KEYS_COMPATIBILITY
        bool "Enable legacy nvs_set function behavior when same key is reused with different data types"
        default n
        help
            Enabling this option will switch the nvs_set() family of functions to the legacy mode:
            when called repeatedly with the same key but different data type, the existing value
            in the NVS remains active and the new value is just stored, actually not accessible through
            corresponding nvs_get() call for the key given. Use this option only when your application
            relies on such NVS API behaviour.
endmenu
Fix Kconfig issues discovered by upstream Kconfiglib 2019-09-23 10:10:57 -04:00			`menu "NVS"`
nvs_flash: Add support for nvs encryption 2018-07-02 07:10:43 -04:00
Correct Kconfigs according to the coding style 2019-01-25 11:10:53 -05:00			`config NVS_ENCRYPTION`
			`bool "Enable NVS encryption"`
nvs_flash: Add support for HMAC-based NVS encryption keys protection scheme - This features allows the NVS encryption keys to be derived and protected using the HMAC peripheral. Since the encryption keys are derived at runtime, they are not stored anywhere in the flash and hence this feature does not require a separate `nvs_keys` partition. 2023-04-05 08:33:56 -04:00			`depends on SECURE_FLASH_ENC_ENABLED \|\| SOC_HMAC_SUPPORTED`
			`default y if SECURE_FLASH_ENC_ENABLED`
Correct Kconfigs according to the coding style 2019-01-25 11:10:53 -05:00			`help`
docs: update the algorithm and key name from AES-XTS to XTS-AES 2023-05-14 23:04:22 -04:00			`This option enables encryption for NVS. When enabled, XTS-AES is used to encrypt`
Correct Kconfigs according to the coding style 2019-01-25 11:10:53 -05:00			`the complete NVS data, except the page headers. It requires XTS encryption keys`
nvs_flash: Add support for HMAC-based NVS encryption keys protection scheme - This features allows the NVS encryption keys to be derived and protected using the HMAC peripheral. Since the encryption keys are derived at runtime, they are not stored anywhere in the flash and hence this feature does not require a separate `nvs_keys` partition. 2023-04-05 08:33:56 -04:00			`to be stored in an encrypted partition (enabling flash encryption is mandatory here)`
			`or to be derived from an HMAC key burnt in eFuse.`
nvs: add config to ignore "encrypted" flag of nvs partitions This is to allow having pre IDF v4.3 behavior where "encrypted" flag was not being checked for NVS partitions. It is recommended to enable this new config only if you have production devices where NVS partition was being set with "encrypted" flag by mistake. Please see commit aca9ec28b3d091a73605ee89ab63f8f76a996491 which introduced check to not allow NVS partitions with "encrypted" flag set. More discussion on this at: https://github.com/espressif/esp-idf/issues/5747#issuecomment-956223024 https://github.com/espressif/esp-idf/issues/7839#issuecomment-961477667 Closes https://github.com/espressif/esp-idf/issues/7839 Closes IDFGH-6162 2021-11-11 01:46:24 -05:00
			`config NVS_COMPATIBLE_PRE_V4_3_ENCRYPTION_FLAG`
			`bool "NVS partition encrypted flag compatible with ESP-IDF before v4.3"`
			`depends on SECURE_FLASH_ENC_ENABLED`
			`help`
			`Enabling this will ignore "encrypted" flag for NVS partitions. NVS encryption`
			`scheme is different than hardware flash encryption and hence it is not recommended`
			`to have "encrypted" flag for NVS partitions. This was not being checked in pre v4.3`
			`IDF. Hence, if you have any devices where this flag is kept enabled in partition`
			`table then enabling this config will allow to have same behavior as pre v4.3 IDF.`

add: Kconfig assert or errorcode option add: private include header add: macro encapsulation for assertion or error check add: ESP_FAIL return code documentation in public headers change: replaced all assertions by NVS_ASSERT_OR_RETURN macro change: few internal function return values from void to esp_err_t change: ESP_ERR_NVS_VALUE_TOO_LONG macro comment 2022-04-08 09:06:30 -04:00			`config NVS_ASSERT_ERROR_CHECK`
			`bool "Use assertions for error checking"`
			`default n`
			`help`
			`This option switches error checking type between assertions (y) or return codes (n).`
fix(nvs_flash): nvs_set with same key and different data type Function now always rewrites old value under same key regardless existing data type. Users requiring old API behaviour can enable it by kconfig option CONFIG_NVS_LEGACY_DUP_KEYS_COMPATIBILITY 2023-08-25 11:15:18 -04:00
			`config NVS_LEGACY_DUP_KEYS_COMPATIBILITY`
			`bool "Enable legacy nvs_set function behavior when same key is reused with different data types"`
			`default n`
			`help`
fix(nvs_flash): fixed failing nvs_page test 2023-09-05 09:05:23 -04:00			`Enabling this option will switch the nvs_set() family of functions to the legacy mode:`
			`when called repeatedly with the same key but different data type, the existing value`
			`in the NVS remains active and the new value is just stored, actually not accessible through`
			`corresponding nvs_get() call for the key given. Use this option only when your application`
			`relies on such NVS API behaviour.`
nvs_flash: Add support for nvs encryption 2018-07-02 07:10:43 -04:00			`endmenu`