# ZephCore crypto benchmark — minimal config.
#
# Mirrors the crypto block of boards/common/zephcore_common.conf EXACTLY, so
# what is timed is the same PSA backend selection the node builds. Any
# divergence here (a different PSA_WANT set, a different mbedTLS config) would
# change which implementation mbedTLS picks and silently invalidate the whole
# measurement.

# ========== Crypto (PSA) — copied verbatim from zephcore_common.conf ==========
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_WANT_ALG_SHA_256=y
CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=y
CONFIG_PSA_WANT_KEY_TYPE_AES=y
CONFIG_PSA_WANT_ALG_HMAC=y
CONFIG_PSA_WANT_KEY_TYPE_HMAC=y

# Portable CPU cycle counter — the measurement instrument. Same symbol the
# node enables, so enabling it here does not perturb anything relative to the
# node's own timing.
CONFIG_TIMING_FUNCTIONS=y

# sys_reboot() — Utils::cryptoPanicReboot() calls it. Kept live rather than
# stubbed: if a benchmarked primitive ever panics, the tool should reboot the
# way the node would, not quietly print a number that means nothing.
CONFIG_REBOOT=y

# C++ — Utils, Identity and Packet are C++
CONFIG_CPP=y
CONFIG_STD_CPP17=y
CONFIG_REQUIRES_FULL_LIBC=y

# Console only, no log subsystem. All output is printk, which is synchronous —
# important here, because an asynchronous log backend would do work between
# timed regions and inflate the mean.
CONFIG_SERIAL=y
CONFIG_CONSOLE=y
CONFIG_UART_CONSOLE=y
CONFIG_PRINTK=y
CONFIG_LOG=n

# No floating-point printf: every figure this tool prints is integer math on
# purpose (see print_result / airtime_us). Leaving FP support off keeps the
# image small and rules out an FP-emulation call inside a timed region.
CONFIG_CBPRINTF_FP_SUPPORT=n

# CONFIG_ASSERT stays off: on ESP32 the Espressif blob trips false kswap.h
# assertions, and this tool has no reason to differ from the node.
CONFIG_ASSERT=n

# Main stack: Ed25519 verify through Monocypher plus the static test vectors
# and the ~200-byte scratch buffers in Utils::encrypt. 4096 is generous; the
# node runs 8192.
CONFIG_MAIN_STACK_SIZE=4096

# NOTE: no CONFIG_BUILD_OUTPUT_UF2 here — it is nRF52-with-bootloader
# specific and fails outright on ESP32. It lives in boards/rak4631/board.conf.

# USB CDC ACM console — nRF52840 boards (RAK4631) route console over USB
# because the UART pins are not reachable on a plain base board. Harmless on
# ESP32, which uses its own console and ignores these.
CONFIG_USB_DEVICE_STACK_NEXT=y
CONFIG_UART_LINE_CTRL=y
CONFIG_CDC_ACM_SERIAL_INITIALIZE_AT_BOOT=y
CONFIG_CDC_ACM_SERIAL_ENABLE_AT_BOOT=y

# Explicitly off — this tool must not touch the radio, storage or BLE. In
# particular it must never mount /lfs: it does not read or write any stored
# identity, so a device under test keeps whatever it already had.
#
# Turning BT off matters for a second reason on nRF: CONFIG_CRYPTO_NRF_ECB
# depends on !HAS_BT_CTLR. If anyone later extends this tool to compare a
# hardware AES backend, that comparison is only valid against a build with the
# same BT setting the target role actually uses — see
# HANDOVER_crypto_hw_accel.md, "Traps and constraints".
CONFIG_BT=n
CONFIG_FLASH=n
CONFIG_FILE_SYSTEM=n
CONFIG_SPI=n
CONFIG_I2C=n
CONFIG_SENSOR=n
CONFIG_GNSS=n