Kconfig 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368
  1. config EFI_LOADER
  2. bool "Support running UEFI applications"
  3. depends on OF_LIBFDT && ( \
  4. ARM && (SYS_CPU = arm1136 || \
  5. SYS_CPU = arm1176 || \
  6. SYS_CPU = armv7 || \
  7. SYS_CPU = armv8) || \
  8. X86 || RISCV || SANDBOX)
  9. # We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB
  10. depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT
  11. # We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB
  12. depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT
  13. depends on BLK
  14. # depends on DM_ETH || !NET
  15. default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8
  16. select LIB_UUID
  17. select PARTITION_UUIDS
  18. select HAVE_BLOCK_DEVICE
  19. select REGEX
  20. imply CFB_CONSOLE_ANSI
  21. imply FAT
  22. imply FAT_WRITE
  23. imply USB_KEYBOARD_FN_KEYS
  24. imply VIDEO_ANSI
  25. help
  26. Select this option if you want to run UEFI applications (like GNU
  27. GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot
  28. will expose the UEFI API to a loaded application, enabling it to
  29. reuse U-Boot's device drivers.
  30. if EFI_LOADER
  31. config CMD_BOOTEFI_BOOTMGR
  32. bool "UEFI Boot Manager"
  33. default y
  34. help
  35. Select this option if you want to select the UEFI binary to be booted
  36. via UEFI variables Boot####, BootOrder, and BootNext. This enables the
  37. 'bootefi bootmgr' command.
  38. config EFI_SETUP_EARLY
  39. bool
  40. choice
  41. prompt "Store for non-volatile UEFI variables"
  42. default EFI_VARIABLE_FILE_STORE
  43. help
  44. Select where non-volatile UEFI variables shall be stored.
  45. config EFI_VARIABLE_FILE_STORE
  46. bool "Store non-volatile UEFI variables as file"
  47. depends on FAT_WRITE
  48. help
  49. Select this option if you want non-volatile UEFI variables to be
  50. stored as file /ubootefi.var on the EFI system partition.
  51. config EFI_MM_COMM_TEE
  52. bool "UEFI variables storage service via OP-TEE"
  53. depends on OPTEE
  54. help
  55. If OP-TEE is present and running StandAloneMM, dispatch all UEFI
  56. variable related operations to that. The application will verify,
  57. authenticate and store the variables on an RPMB.
  58. endchoice
  59. config EFI_VARIABLES_PRESEED
  60. bool "Initial values for UEFI variables"
  61. depends on EFI_VARIABLE_FILE_STORE
  62. help
  63. Include a file with the initial values for non-volatile UEFI variables
  64. into the U-Boot binary. If this configuration option is set, changes
  65. to authentication related variables (PK, KEK, db, dbx) are not
  66. allowed.
  67. if EFI_VARIABLES_PRESEED
  68. config EFI_VAR_SEED_FILE
  69. string "File with initial values of non-volatile UEFI variables"
  70. default ubootefi.var
  71. help
  72. File with initial values of non-volatile UEFI variables. The file must
  73. be in the same format as the storage in the EFI system partition. The
  74. easiest way to create it is by setting the non-volatile variables in
  75. U-Boot. If a relative file path is used, it is relative to the source
  76. directory.
  77. endif
  78. config EFI_VAR_BUF_SIZE
  79. int "Memory size of the UEFI variable store"
  80. default 16384
  81. range 4096 2147483647
  82. help
  83. This defines the size in bytes of the memory area reserved for keeping
  84. UEFI variables.
  85. When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) this value should
  86. match the value of PcdFlashNvStorageVariableSize used to compile the
  87. StandAloneMM module.
  88. Minimum 4096, default 16384.
  89. config EFI_GET_TIME
  90. bool "GetTime() runtime service"
  91. depends on DM_RTC
  92. default y
  93. help
  94. Provide the GetTime() runtime service at boottime. This service
  95. can be used by an EFI application to read the real time clock.
  96. config EFI_SET_TIME
  97. bool "SetTime() runtime service"
  98. depends on EFI_GET_TIME
  99. default y if ARCH_QEMU || SANDBOX
  100. help
  101. Provide the SetTime() runtime service at boottime. This service
  102. can be used by an EFI application to adjust the real time clock.
  103. config EFI_HAVE_CAPSULE_SUPPORT
  104. bool
  105. config EFI_RUNTIME_UPDATE_CAPSULE
  106. bool "UpdateCapsule() runtime service"
  107. select EFI_HAVE_CAPSULE_SUPPORT
  108. help
  109. Select this option if you want to use UpdateCapsule and
  110. QueryCapsuleCapabilities API's.
  111. config EFI_CAPSULE_ON_DISK
  112. bool "Enable capsule-on-disk support"
  113. select EFI_HAVE_CAPSULE_SUPPORT
  114. help
  115. Select this option if you want to use capsule-on-disk feature,
  116. that is, capsules can be fetched and executed from files
  117. under a specific directory on UEFI system partition instead of
  118. via UpdateCapsule API.
  119. config EFI_IGNORE_OSINDICATIONS
  120. bool "Ignore OsIndications for CapsuleUpdate on-disk"
  121. depends on EFI_CAPSULE_ON_DISK
  122. help
  123. There are boards where U-Boot does not support SetVariable at runtime.
  124. Select this option if you want to use the capsule-on-disk feature
  125. without setting the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
  126. flag in variable OsIndications.
  127. config EFI_CAPSULE_ON_DISK_EARLY
  128. bool "Initiate capsule-on-disk at U-Boot boottime"
  129. depends on EFI_CAPSULE_ON_DISK
  130. select EFI_SETUP_EARLY
  131. help
  132. Normally, without this option enabled, capsules will be
  133. executed only at the first time of invoking one of efi command.
  134. If this option is enabled, capsules will be enforced to be
  135. executed as part of U-Boot initialisation so that they will
  136. surely take place whatever is set to distro_bootcmd.
  137. config EFI_CAPSULE_FIRMWARE
  138. bool
  139. config EFI_CAPSULE_FIRMWARE_MANAGEMENT
  140. bool "Capsule: Firmware Management Protocol"
  141. depends on EFI_HAVE_CAPSULE_SUPPORT
  142. default y
  143. help
  144. Select this option if you want to enable capsule-based
  145. firmware update using Firmware Management Protocol.
  146. config EFI_CAPSULE_FIRMWARE_FIT
  147. bool "FMP driver for FIT images"
  148. depends on FIT
  149. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  150. select UPDATE_FIT
  151. select DFU
  152. select EFI_CAPSULE_FIRMWARE
  153. help
  154. Select this option if you want to enable firmware management protocol
  155. driver for FIT image
  156. config EFI_CAPSULE_FIRMWARE_RAW
  157. bool "FMP driver for raw images"
  158. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  159. depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT)
  160. select DFU_WRITE_ALT
  161. select DFU
  162. select EFI_CAPSULE_FIRMWARE
  163. help
  164. Select this option if you want to enable firmware management protocol
  165. driver for raw image
  166. config EFI_CAPSULE_AUTHENTICATE
  167. bool "Update Capsule authentication"
  168. depends on EFI_CAPSULE_FIRMWARE
  169. depends on EFI_CAPSULE_ON_DISK
  170. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  171. select HASH
  172. select SHA256
  173. select RSA
  174. select RSA_VERIFY
  175. select RSA_VERIFY_WITH_PKEY
  176. select X509_CERTIFICATE_PARSER
  177. select PKCS7_MESSAGE_PARSER
  178. select PKCS7_VERIFY
  179. select IMAGE_SIGN_INFO
  180. select EFI_SIGNATURE_SUPPORT
  181. help
  182. Select this option if you want to enable capsule
  183. authentication
  184. config EFI_DEVICE_PATH_TO_TEXT
  185. bool "Device path to text protocol"
  186. default y
  187. help
  188. The device path to text protocol converts device nodes and paths to
  189. human readable strings.
  190. config EFI_DEVICE_PATH_UTIL
  191. bool "Device path utilities protocol"
  192. default y
  193. help
  194. The device path utilities protocol creates and manipulates device
  195. paths and device nodes. It is required to run the EFI Shell.
  196. config EFI_DT_FIXUP
  197. bool "Device tree fixup protocol"
  198. depends on !GENERATE_ACPI_TABLE
  199. default y
  200. help
  201. The EFI device-tree fix-up protocol provides a function to let the
  202. firmware apply fix-ups. This may be used by boot loaders.
  203. config EFI_LOADER_HII
  204. bool "HII protocols"
  205. default y
  206. help
  207. The Human Interface Infrastructure is a complicated framework that
  208. allows UEFI applications to draw fancy menus and hook strings using
  209. a translation framework.
  210. U-Boot implements enough of its features to be able to run the UEFI
  211. Shell, but not more than that.
  212. config EFI_UNICODE_COLLATION_PROTOCOL2
  213. bool "Unicode collation protocol"
  214. default y
  215. help
  216. The Unicode collation protocol is used for lexical comparisons. It is
  217. required to run the UEFI shell.
  218. if EFI_UNICODE_COLLATION_PROTOCOL2
  219. config EFI_UNICODE_CAPITALIZATION
  220. bool "Support Unicode capitalization"
  221. default y
  222. help
  223. Select this option to enable correct handling of the capitalization of
  224. Unicode codepoints in the range 0x0000-0xffff. If this option is not
  225. set, only the the correct handling of the letters of the codepage
  226. used by the FAT file system is ensured.
  227. endif
  228. config EFI_LOADER_BOUNCE_BUFFER
  229. bool "EFI Applications use bounce buffers for DMA operations"
  230. depends on ARM64
  231. help
  232. Some hardware does not support DMA to full 64bit addresses. For this
  233. hardware we can create a bounce buffer so that payloads don't have to
  234. worry about platform details.
  235. config EFI_PLATFORM_LANG_CODES
  236. string "Language codes supported by firmware"
  237. default "en-US"
  238. help
  239. This value is used to initialize the PlatformLangCodes variable. Its
  240. value is a semicolon (;) separated list of language codes in native
  241. RFC 4646 format, e.g. "en-US;de-DE". The first language code is used
  242. to initialize the PlatformLang variable.
  243. config EFI_HAVE_RUNTIME_RESET
  244. # bool "Reset runtime service is available"
  245. bool
  246. default y
  247. depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || \
  248. SANDBOX || SYSRESET_X86
  249. config EFI_GRUB_ARM32_WORKAROUND
  250. bool "Workaround for GRUB on 32bit ARM"
  251. default n if ARCH_BCM283X || ARCH_SUNXI || ARCH_QEMU
  252. default y
  253. depends on ARM && !ARM64
  254. help
  255. GRUB prior to version 2.04 requires U-Boot to disable caches. This
  256. workaround currently is also needed on systems with caches that
  257. cannot be managed via CP15.
  258. config EFI_RNG_PROTOCOL
  259. bool "EFI_RNG_PROTOCOL support"
  260. depends on DM_RNG
  261. default y
  262. help
  263. Provide a EFI_RNG_PROTOCOL implementation using the hardware random
  264. number generator of the platform.
  265. config EFI_TCG2_PROTOCOL
  266. bool "EFI_TCG2_PROTOCOL support"
  267. default y
  268. depends on TPM_V2
  269. select SHA1
  270. select SHA256
  271. select SHA384
  272. select SHA512
  273. select HASH
  274. help
  275. Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware
  276. of the platform.
  277. config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE
  278. int "EFI_TCG2_PROTOCOL EventLog size"
  279. depends on EFI_TCG2_PROTOCOL
  280. default 65536
  281. help
  282. Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that
  283. this is going to be allocated twice. One for the eventlog it self
  284. and one for the configuration table that is required from the spec
  285. config EFI_LOAD_FILE2_INITRD
  286. bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk"
  287. default y
  288. help
  289. Linux v5.7 and later can make use of this option. If the boot option
  290. selected by the UEFI boot manager specifies an existing file to be used
  291. as initial RAM disk, a Linux specific Load File2 protocol will be
  292. installed and Linux 5.7+ will ignore any initrd=<ramdisk> command line
  293. argument.
  294. config EFI_SECURE_BOOT
  295. bool "Enable EFI secure boot support"
  296. depends on EFI_LOADER && FIT_SIGNATURE
  297. select HASH
  298. select SHA256
  299. select RSA
  300. select RSA_VERIFY_WITH_PKEY
  301. select IMAGE_SIGN_INFO
  302. select ASYMMETRIC_KEY_TYPE
  303. select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
  304. select X509_CERTIFICATE_PARSER
  305. select PKCS7_MESSAGE_PARSER
  306. select PKCS7_VERIFY
  307. select EFI_SIGNATURE_SUPPORT
  308. help
  309. Select this option to enable EFI secure boot support.
  310. Once SecureBoot mode is enforced, any EFI binary can run only if
  311. it is signed with a trusted key. To do that, you need to install,
  312. at least, PK, KEK and db.
  313. config EFI_SIGNATURE_SUPPORT
  314. bool
  315. config EFI_ESRT
  316. bool "Enable the UEFI ESRT generation"
  317. depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
  318. default y
  319. help
  320. Enabling this option creates the ESRT UEFI system table.
  321. endif