Kconfig 11.3 KB
Newer Older
1
config EFI_LOADER
2
	bool "Support running UEFI applications"
3
	depends on OF_LIBFDT && ( \
4
5
6
7
		ARM && (SYS_CPU = arm1136 || \
			SYS_CPU = arm1176 || \
			SYS_CPU = armv7   || \
			SYS_CPU = armv8)  || \
8
		X86 || RISCV || SANDBOX)
9
10
11
12
	# We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB
	depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT
	# We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB
	depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT
13
	depends on BLK
14
	default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8
Adam Ford's avatar
Adam Ford committed
15
	select LIB_UUID
16
	select PARTITION_UUIDS
17
	select HAVE_BLOCK_DEVICE
18
	select REGEX
19
	imply CFB_CONSOLE_ANSI
20
21
	imply FAT
	imply FAT_WRITE
22
	imply USB_KEYBOARD_FN_KEYS
23
	imply VIDEO_ANSI
24
	help
25
26
27
28
	  Select this option if you want to run UEFI applications (like GNU
	  GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot
	  will expose the UEFI API to a loaded application, enabling it to
	  reuse U-Boot's device drivers.
29

30
31
if EFI_LOADER

32
33
34
35
36
37
38
39
config CMD_BOOTEFI_BOOTMGR
	bool "UEFI Boot Manager"
	default y
	help
	  Select this option if you want to select the UEFI binary to be booted
	  via UEFI variables Boot####, BootOrder, and BootNext. This enables the
	  'bootefi bootmgr' command.

40
41
42
43
config EFI_SETUP_EARLY
	bool
	default n

44
45
46
47
48
49
choice
	prompt "Store for non-volatile UEFI variables"
	default EFI_VARIABLE_FILE_STORE
	help
	  Select where non-volatile UEFI variables shall be stored.

50
51
52
53
config EFI_VARIABLE_FILE_STORE
	bool "Store non-volatile UEFI variables as file"
	depends on FAT_WRITE
	help
54
55
56
57
58
59
60
61
62
63
64
65
	  Select this option if you want non-volatile UEFI variables to be
	  stored as file /ubootefi.var on the EFI system partition.

config EFI_MM_COMM_TEE
	bool "UEFI variables storage service via OP-TEE"
	depends on OPTEE
	help
	  If OP-TEE is present and running StandAloneMM, dispatch all UEFI
	  variable related operations to that. The application will verify,
	  authenticate and store the variables on an RPMB.

endchoice
66

67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
config EFI_VARIABLES_PRESEED
	bool "Initial values for UEFI variables"
	depends on EFI_VARIABLE_FILE_STORE
	help
	  Include a file with the initial values for non-volatile UEFI variables
	  into the U-Boot binary. If this configuration option is set, changes
	  to authentication related variables (PK, KEK, db, dbx) are not
	  allowed.

if EFI_VARIABLES_PRESEED

config EFI_VAR_SEED_FILE
	string "File with initial values of non-volatile UEFI variables"
	default ubootefi.var
	help
	  File with initial values of non-volatile UEFI variables. The file must
	  be in the same format as the storage in the EFI system partition. The
	  easiest way to create it is by setting the non-volatile variables in
	  U-Boot. If a relative file path is used, it is relative to the source
	  directory.

endif

90
91
92
93
94
95
96
97
98
99
100
101
102
103
config EFI_VAR_BUF_SIZE
	int "Memory size of the UEFI variable store"
	default 16384
	range 4096 2147483647
	help
	  This defines the size in bytes of the memory area reserved for keeping
	  UEFI variables.

	  When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) this value should
	  match the value of PcdFlashNvStorageVariableSize used to compile the
	  StandAloneMM module.

	  Minimum 4096, default 16384.

104
105
106
107
108
109
110
111
112
113
114
config EFI_GET_TIME
	bool "GetTime() runtime service"
	depends on DM_RTC
	default y
	help
	  Provide the GetTime() runtime service at boottime. This service
	  can be used by an EFI application to read the real time clock.

config EFI_SET_TIME
	bool "SetTime() runtime service"
	depends on EFI_GET_TIME
115
	default y if ARCH_QEMU || SANDBOX
116
117
118
119
120
	default n
	help
	  Provide the SetTime() runtime service at boottime. This service
	  can be used by an EFI application to adjust the real time clock.

121
122
123
124
125
126
127
128
129
130
131
config EFI_HAVE_CAPSULE_SUPPORT
	bool

config EFI_RUNTIME_UPDATE_CAPSULE
	bool "UpdateCapsule() runtime service"
	default n
	select EFI_HAVE_CAPSULE_SUPPORT
	help
	  Select this option if you want to use UpdateCapsule and
	  QueryCapsuleCapabilities API's.

132
133
134
135
136
137
138
139
140
141
config EFI_CAPSULE_ON_DISK
	bool "Enable capsule-on-disk support"
	select EFI_HAVE_CAPSULE_SUPPORT
	default n
	help
	  Select this option if you want to use capsule-on-disk feature,
	  that is, capsules can be fetched and executed from files
	  under a specific directory on UEFI system partition instead of
	  via UpdateCapsule API.

142
143
144
145
146
147
148
149
150
151
config EFI_IGNORE_OSINDICATIONS
	bool "Ignore OsIndications for CapsuleUpdate on-disk"
	depends on EFI_CAPSULE_ON_DISK
	default n
	help
	  There are boards where U-Boot does not support SetVariable at runtime.
	  Select this option if you want to use the capsule-on-disk feature
	  without setting the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
	  flag in variable OsIndications.

152
153
154
155
156
157
158
159
160
161
162
163
config EFI_CAPSULE_ON_DISK_EARLY
	bool "Initiate capsule-on-disk at U-Boot boottime"
	depends on EFI_CAPSULE_ON_DISK
	default n
	select EFI_SETUP_EARLY
	help
	  Normally, without this option enabled, capsules will be
	  executed only at the first time of invoking one of efi command.
	  If this option is enabled, capsules will be enforced to be
	  executed as part of U-Boot initialisation so that they will
	  surely take place whatever is set to distro_bootcmd.

164
165
166
167
config EFI_CAPSULE_FIRMWARE
	bool
	default n

168
169
170
171
172
173
174
175
config EFI_CAPSULE_FIRMWARE_MANAGEMENT
	bool "Capsule: Firmware Management Protocol"
	depends on EFI_HAVE_CAPSULE_SUPPORT
	default y
	help
	  Select this option if you want to enable capsule-based
	  firmware update using Firmware Management Protocol.

176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
config EFI_CAPSULE_FIRMWARE_FIT
	bool "FMP driver for FIT images"
	depends on FIT
	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
	select UPDATE_FIT
	select DFU
	select EFI_CAPSULE_FIRMWARE
	help
	  Select this option if you want to enable firmware management protocol
	  driver for FIT image

config EFI_CAPSULE_FIRMWARE_RAW
	bool "FMP driver for raw images"
	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
	depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT)
	select DFU_WRITE_ALT
	select DFU
	select EFI_CAPSULE_FIRMWARE
	help
	  Select this option if you want to enable firmware management protocol
	  driver for raw image

198
199
200
201
202
config EFI_CAPSULE_AUTHENTICATE
	bool "Update Capsule authentication"
	depends on EFI_CAPSULE_FIRMWARE
	depends on EFI_CAPSULE_ON_DISK
	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
203
	select HASH
204
205
206
207
208
209
210
	select SHA256
	select RSA
	select RSA_VERIFY
	select RSA_VERIFY_WITH_PKEY
	select X509_CERTIFICATE_PARSER
	select PKCS7_MESSAGE_PARSER
	select PKCS7_VERIFY
211
	select IMAGE_SIGN_INFO
212
	select EFI_SIGNATURE_SUPPORT
213
214
215
216
217
	default n
	help
	  Select this option if you want to enable capsule
	  authentication

218
219
220
221
222
223
224
config EFI_CAPSULE_KEY_PATH
	string "Path to .esl cert for capsule authentication"
	depends on EFI_CAPSULE_AUTHENTICATE
	help
	  Provide the EFI signature list (esl) certificate used for capsule
	  authentication

225
226
227
228
229
230
231
config EFI_DEVICE_PATH_TO_TEXT
	bool "Device path to text protocol"
	default y
	help
	  The device path to text protocol converts device nodes and paths to
	  human readable strings.

232
233
234
235
236
237
238
config EFI_DEVICE_PATH_UTIL
	bool "Device path utilities protocol"
	default y
	help
	  The device path utilities protocol creates and manipulates device
	  paths and device nodes. It is required to run the EFI Shell.

239
240
241
242
243
244
245
246
config EFI_DT_FIXUP
	bool "Device tree fixup protocol"
	depends on !GENERATE_ACPI_TABLE
	default y
	help
	  The EFI device-tree fix-up protocol provides a function to let the
	  firmware apply fix-ups. This may be used by boot loaders.

247
248
249
250
251
252
253
254
255
256
257
config EFI_LOADER_HII
	bool "HII protocols"
	default y
	help
	  The Human Interface Infrastructure is a complicated framework that
	  allows UEFI applications to draw fancy menus and hook strings using
	  a translation framework.

	  U-Boot implements enough of its features to be able to run the UEFI
	  Shell, but not more than that.

258
config EFI_UNICODE_COLLATION_PROTOCOL2
259
260
261
262
263
264
	bool "Unicode collation protocol"
	default y
	help
	  The Unicode collation protocol is used for lexical comparisons. It is
	  required to run the UEFI shell.

265
if EFI_UNICODE_COLLATION_PROTOCOL2
266

267
268
269
270
271
272
273
274
275
config EFI_UNICODE_CAPITALIZATION
	bool "Support Unicode capitalization"
	default y
	help
	  Select this option to enable correct handling of the capitalization of
	  Unicode codepoints in the range 0x0000-0xffff. If this option is not
	  set, only the the correct handling of the letters of the codepage
	  used by the FAT file system is ensured.

276
277
endif

278
279
config EFI_LOADER_BOUNCE_BUFFER
	bool "EFI Applications use bounce buffers for DMA operations"
280
	depends on ARM64
281
282
283
284
285
	default n
	help
	  Some hardware does not support DMA to full 64bit addresses. For this
	  hardware we can create a bounce buffer so that payloads don't have to
	  worry about platform details.
286

287
288
289
config EFI_PLATFORM_LANG_CODES
	string "Language codes supported by firmware"
	default "en-US"
290
	help
291
292
293
294
	  This value is used to initialize the PlatformLangCodes variable. Its
	  value is a semicolon (;) separated list of language codes in native
	  RFC 4646 format, e.g. "en-US;de-DE". The first language code is used
	  to initialize the PlatformLang variable.
295

296
297
298
299
config EFI_HAVE_RUNTIME_RESET
	# bool "Reset runtime service is available"
	bool
	default y
300
301
	depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || \
		   SANDBOX || SYSRESET_X86
302

303
304
config EFI_GRUB_ARM32_WORKAROUND
	bool "Workaround for GRUB on 32bit ARM"
305
	default n if ARCH_BCM283X || ARCH_SUNXI || ARCH_QEMU
306
307
308
309
310
311
	default y
	depends on ARM && !ARM64
	help
	  GRUB prior to version 2.04 requires U-Boot to disable caches. This
	  workaround currently is also needed on systems with caches that
	  cannot be managed via CP15.
312
313
314
315

config EFI_RNG_PROTOCOL
	bool "EFI_RNG_PROTOCOL support"
	depends on DM_RNG
316
	default y
317
	help
318
319
	  Provide a EFI_RNG_PROTOCOL implementation using the hardware random
	  number generator of the platform.
320
321
322

config EFI_TCG2_PROTOCOL
	bool "EFI_TCG2_PROTOCOL support"
323
	default y
324
	depends on TPM_V2
325
326
	select SHA1
	select SHA256
327
	select SHA512
328
329
	select SHA384
	select SHA512
330
	select HASH
331
332
333
	help
	  Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware
	  of the platform.
334

335
336
337
config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE
	int "EFI_TCG2_PROTOCOL EventLog size"
	depends on EFI_TCG2_PROTOCOL
338
	default 65536
339
340
341
342
343
	help
		Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that
		this is going to be allocated twice. One for the eventlog it self
		and one for the configuration table that is required from the spec

344
345
config EFI_LOAD_FILE2_INITRD
	bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk"
346
	default y
347
	help
348
349
350
351
352
	  Linux v5.7 and later can make use of this option. If the boot option
	  selected by the UEFI boot manager specifies an existing file to be used
	  as initial RAM disk, a Linux specific Load File2 protocol will be
	  installed and Linux 5.7+ will ignore any initrd=<ramdisk> command line
	  argument.
353

354
355
356
config EFI_SECURE_BOOT
	bool "Enable EFI secure boot support"
	depends on EFI_LOADER
357
	select HASH
358
359
360
361
362
363
364
365
	select SHA256
	select RSA
	select RSA_VERIFY_WITH_PKEY
	select IMAGE_SIGN_INFO
	select ASYMMETRIC_KEY_TYPE
	select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
	select X509_CERTIFICATE_PARSER
	select PKCS7_MESSAGE_PARSER
366
	select PKCS7_VERIFY
367
	select EFI_SIGNATURE_SUPPORT
368
369
370
371
372
373
374
	default n
	help
	  Select this option to enable EFI secure boot support.
	  Once SecureBoot mode is enforced, any EFI binary can run only if
	  it is signed with a trusted key. To do that, you need to install,
	  at least, PK, KEK and db.

375
376
377
config EFI_SIGNATURE_SUPPORT
	bool

378
379
380
381
382
383
384
config EFI_ESRT
	bool "Enable the UEFI ESRT generation"
	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
	default y
	help
	  Enabling this option creates the ESRT UEFI system table.

385
endif