Kconfig 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382
  1. config EFI_LOADER
  2. bool "Support running UEFI applications"
  3. depends on OF_LIBFDT && ( \
  4. ARM && (SYS_CPU = arm1136 || \
  5. SYS_CPU = arm1176 || \
  6. SYS_CPU = armv7 || \
  7. SYS_CPU = armv8) || \
  8. X86 || RISCV || SANDBOX)
  9. # We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB
  10. depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT
  11. # We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB
  12. depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT
  13. depends on BLK
  14. #depends on DM_ETH || !NET
  15. depends on !EFI_APP
  16. default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8
  17. select LIB_UUID
  18. select PARTITION_UUIDS
  19. select HAVE_BLOCK_DEVICE
  20. select REGEX
  21. imply CFB_CONSOLE_ANSI
  22. imply FAT
  23. imply FAT_WRITE
  24. imply USB_KEYBOARD_FN_KEYS
  25. imply VIDEO_ANSI
  26. help
  27. Select this option if you want to run UEFI applications (like GNU
  28. GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot
  29. will expose the UEFI API to a loaded application, enabling it to
  30. reuse U-Boot's device drivers.
  31. if EFI_LOADER
  32. config CMD_BOOTEFI_BOOTMGR
  33. bool "UEFI Boot Manager"
  34. default y
  35. help
  36. Select this option if you want to select the UEFI binary to be booted
  37. via UEFI variables Boot####, BootOrder, and BootNext. This enables the
  38. 'bootefi bootmgr' command.
  39. config EFI_SETUP_EARLY
  40. bool
  41. choice
  42. prompt "Store for non-volatile UEFI variables"
  43. default EFI_VARIABLE_FILE_STORE
  44. help
  45. Select where non-volatile UEFI variables shall be stored.
  46. config EFI_VARIABLE_FILE_STORE
  47. bool "Store non-volatile UEFI variables as file"
  48. depends on FAT_WRITE
  49. help
  50. Select this option if you want non-volatile UEFI variables to be
  51. stored as file /ubootefi.var on the EFI system partition.
  52. config EFI_MM_COMM_TEE
  53. bool "UEFI variables storage service via OP-TEE"
  54. depends on OPTEE
  55. help
  56. If OP-TEE is present and running StandAloneMM, dispatch all UEFI
  57. variable related operations to that. The application will verify,
  58. authenticate and store the variables on an RPMB.
  59. endchoice
  60. config EFI_VARIABLES_PRESEED
  61. bool "Initial values for UEFI variables"
  62. depends on EFI_VARIABLE_FILE_STORE
  63. help
  64. Include a file with the initial values for non-volatile UEFI variables
  65. into the U-Boot binary. If this configuration option is set, changes
  66. to authentication related variables (PK, KEK, db, dbx) are not
  67. allowed.
  68. if EFI_VARIABLES_PRESEED
  69. config EFI_VAR_SEED_FILE
  70. string "File with initial values of non-volatile UEFI variables"
  71. default ubootefi.var
  72. help
  73. File with initial values of non-volatile UEFI variables. The file must
  74. be in the same format as the storage in the EFI system partition. The
  75. easiest way to create it is by setting the non-volatile variables in
  76. U-Boot. If a relative file path is used, it is relative to the source
  77. directory.
  78. endif
  79. config EFI_VAR_BUF_SIZE
  80. int "Memory size of the UEFI variable store"
  81. default 16384
  82. range 4096 2147483647
  83. help
  84. This defines the size in bytes of the memory area reserved for keeping
  85. UEFI variables.
  86. When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) this value should
  87. match the value of PcdFlashNvStorageVariableSize used to compile the
  88. StandAloneMM module.
  89. Minimum 4096, default 16384.
  90. config EFI_GET_TIME
  91. bool "GetTime() runtime service"
  92. depends on DM_RTC
  93. default y
  94. help
  95. Provide the GetTime() runtime service at boottime. This service
  96. can be used by an EFI application to read the real time clock.
  97. config EFI_SET_TIME
  98. bool "SetTime() runtime service"
  99. depends on EFI_GET_TIME
  100. default y if ARCH_QEMU || SANDBOX
  101. help
  102. Provide the SetTime() runtime service at boottime. This service
  103. can be used by an EFI application to adjust the real time clock.
  104. config EFI_HAVE_CAPSULE_SUPPORT
  105. bool
  106. config EFI_RUNTIME_UPDATE_CAPSULE
  107. bool "UpdateCapsule() runtime service"
  108. select EFI_HAVE_CAPSULE_SUPPORT
  109. help
  110. Select this option if you want to use UpdateCapsule and
  111. QueryCapsuleCapabilities API's.
  112. config EFI_CAPSULE_ON_DISK
  113. bool "Enable capsule-on-disk support"
  114. select EFI_HAVE_CAPSULE_SUPPORT
  115. help
  116. Select this option if you want to use capsule-on-disk feature,
  117. that is, capsules can be fetched and executed from files
  118. under a specific directory on UEFI system partition instead of
  119. via UpdateCapsule API.
  120. config EFI_IGNORE_OSINDICATIONS
  121. bool "Ignore OsIndications for CapsuleUpdate on-disk"
  122. depends on EFI_CAPSULE_ON_DISK
  123. help
  124. There are boards where U-Boot does not support SetVariable at runtime.
  125. Select this option if you want to use the capsule-on-disk feature
  126. without setting the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
  127. flag in variable OsIndications.
  128. config EFI_CAPSULE_ON_DISK_EARLY
  129. bool "Initiate capsule-on-disk at U-Boot boottime"
  130. depends on EFI_CAPSULE_ON_DISK
  131. select EFI_SETUP_EARLY
  132. help
  133. Normally, without this option enabled, capsules will be
  134. executed only at the first time of invoking one of efi command.
  135. If this option is enabled, capsules will be enforced to be
  136. executed as part of U-Boot initialisation so that they will
  137. surely take place whatever is set to distro_bootcmd.
  138. config EFI_CAPSULE_FIRMWARE
  139. bool
  140. config EFI_CAPSULE_FIRMWARE_MANAGEMENT
  141. bool "Capsule: Firmware Management Protocol"
  142. depends on EFI_HAVE_CAPSULE_SUPPORT
  143. default y
  144. help
  145. Select this option if you want to enable capsule-based
  146. firmware update using Firmware Management Protocol.
  147. config EFI_CAPSULE_FIRMWARE_FIT
  148. bool "FMP driver for FIT images"
  149. depends on FIT
  150. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  151. select UPDATE_FIT
  152. select DFU
  153. select EFI_CAPSULE_FIRMWARE
  154. help
  155. Select this option if you want to enable firmware management protocol
  156. driver for FIT image
  157. config EFI_CAPSULE_FIRMWARE_RAW
  158. bool "FMP driver for raw images"
  159. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  160. depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT)
  161. select DFU_WRITE_ALT
  162. select DFU
  163. select EFI_CAPSULE_FIRMWARE
  164. help
  165. Select this option if you want to enable firmware management protocol
  166. driver for raw image
  167. config EFI_CAPSULE_AUTHENTICATE
  168. bool "Update Capsule authentication"
  169. depends on EFI_CAPSULE_FIRMWARE
  170. depends on EFI_CAPSULE_ON_DISK
  171. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  172. select HASH
  173. select SHA256
  174. select RSA
  175. select RSA_VERIFY
  176. select RSA_VERIFY_WITH_PKEY
  177. select X509_CERTIFICATE_PARSER
  178. select PKCS7_MESSAGE_PARSER
  179. select PKCS7_VERIFY
  180. select IMAGE_SIGN_INFO
  181. select EFI_SIGNATURE_SUPPORT
  182. help
  183. Select this option if you want to enable capsule
  184. authentication
  185. config EFI_DEVICE_PATH_TO_TEXT
  186. bool "Device path to text protocol"
  187. default y
  188. help
  189. The device path to text protocol converts device nodes and paths to
  190. human readable strings.
  191. config EFI_DEVICE_PATH_UTIL
  192. bool "Device path utilities protocol"
  193. default y
  194. help
  195. The device path utilities protocol creates and manipulates device
  196. paths and device nodes. It is required to run the EFI Shell.
  197. config EFI_DT_FIXUP
  198. bool "Device tree fixup protocol"
  199. depends on !GENERATE_ACPI_TABLE
  200. default y
  201. help
  202. The EFI device-tree fix-up protocol provides a function to let the
  203. firmware apply fix-ups. This may be used by boot loaders.
  204. config EFI_LOADER_HII
  205. bool "HII protocols"
  206. default y
  207. help
  208. The Human Interface Infrastructure is a complicated framework that
  209. allows UEFI applications to draw fancy menus and hook strings using
  210. a translation framework.
  211. U-Boot implements enough of its features to be able to run the UEFI
  212. Shell, but not more than that.
  213. config EFI_UNICODE_COLLATION_PROTOCOL2
  214. bool "Unicode collation protocol"
  215. default y
  216. help
  217. The Unicode collation protocol is used for lexical comparisons. It is
  218. required to run the UEFI shell.
  219. if EFI_UNICODE_COLLATION_PROTOCOL2
  220. config EFI_UNICODE_CAPITALIZATION
  221. bool "Support Unicode capitalization"
  222. default y
  223. help
  224. Select this option to enable correct handling of the capitalization of
  225. Unicode codepoints in the range 0x0000-0xffff. If this option is not
  226. set, only the the correct handling of the letters of the codepage
  227. used by the FAT file system is ensured.
  228. endif
  229. config EFI_LOADER_BOUNCE_BUFFER
  230. bool "EFI Applications use bounce buffers for DMA operations"
  231. depends on ARM64
  232. help
  233. Some hardware does not support DMA to full 64bit addresses. For this
  234. hardware we can create a bounce buffer so that payloads don't have to
  235. worry about platform details.
  236. config EFI_PLATFORM_LANG_CODES
  237. string "Language codes supported by firmware"
  238. default "en-US"
  239. help
  240. This value is used to initialize the PlatformLangCodes variable. Its
  241. value is a semicolon (;) separated list of language codes in native
  242. RFC 4646 format, e.g. "en-US;de-DE". The first language code is used
  243. to initialize the PlatformLang variable.
  244. config EFI_HAVE_RUNTIME_RESET
  245. # bool "Reset runtime service is available"
  246. bool
  247. default y
  248. depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || \
  249. SANDBOX || SYSRESET_X86
  250. config EFI_GRUB_ARM32_WORKAROUND
  251. bool "Workaround for GRUB on 32bit ARM"
  252. default n if ARCH_BCM283X || ARCH_SUNXI || ARCH_QEMU
  253. default y
  254. depends on ARM && !ARM64
  255. help
  256. GRUB prior to version 2.04 requires U-Boot to disable caches. This
  257. workaround currently is also needed on systems with caches that
  258. cannot be managed via CP15.
  259. config EFI_RNG_PROTOCOL
  260. bool "EFI_RNG_PROTOCOL support"
  261. depends on DM_RNG
  262. default y
  263. help
  264. Provide a EFI_RNG_PROTOCOL implementation using the hardware random
  265. number generator of the platform.
  266. config EFI_TCG2_PROTOCOL
  267. bool "EFI_TCG2_PROTOCOL support"
  268. default y
  269. depends on TPM_V2
  270. # Sandbox TPM currently fails on GetCapabilities needed for TCG2
  271. depends on !SANDBOX
  272. select SHA1
  273. select SHA256
  274. select SHA384
  275. select SHA512
  276. select HASH
  277. select SMBIOS_PARSER
  278. help
  279. Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware
  280. of the platform.
  281. config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE
  282. int "EFI_TCG2_PROTOCOL EventLog size"
  283. depends on EFI_TCG2_PROTOCOL
  284. default 65536
  285. help
  286. Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that
  287. this is going to be allocated twice. One for the eventlog it self
  288. and one for the configuration table that is required from the spec
  289. config EFI_LOAD_FILE2_INITRD
  290. bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk"
  291. default y
  292. help
  293. Linux v5.7 and later can make use of this option. If the boot option
  294. selected by the UEFI boot manager specifies an existing file to be used
  295. as initial RAM disk, a Linux specific Load File2 protocol will be
  296. installed and Linux 5.7+ will ignore any initrd=<ramdisk> command line
  297. argument.
  298. config EFI_SECURE_BOOT
  299. bool "Enable EFI secure boot support"
  300. depends on EFI_LOADER && FIT_SIGNATURE
  301. select HASH
  302. select SHA256
  303. select RSA
  304. select RSA_VERIFY_WITH_PKEY
  305. select IMAGE_SIGN_INFO
  306. select ASYMMETRIC_KEY_TYPE
  307. select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
  308. select X509_CERTIFICATE_PARSER
  309. select PKCS7_MESSAGE_PARSER
  310. select PKCS7_VERIFY
  311. select EFI_SIGNATURE_SUPPORT
  312. help
  313. Select this option to enable EFI secure boot support.
  314. Once SecureBoot mode is enforced, any EFI binary can run only if
  315. it is signed with a trusted key. To do that, you need to install,
  316. at least, PK, KEK and db.
  317. config EFI_SIGNATURE_SUPPORT
  318. bool
  319. config EFI_ESRT
  320. bool "Enable the UEFI ESRT generation"
  321. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  322. default y
  323. help
  324. Enabling this option creates the ESRT UEFI system table.
  325. config EFI_RISCV_BOOT_PROTOCOL
  326. bool "RISCV_EFI_BOOT_PROTOCOL support"
  327. default y
  328. depends on RISCV
  329. help
  330. The EFI_RISCV_BOOT_PROTOCOL is used to transfer the boot hart ID
  331. to the next boot stage. It should be enabled as it is meant to
  332. replace the transfer via the device-tree. The latter is not
  333. possible on systems using ACPI.
  334. endif