| config EFI_LOADER |
| bool "Support running UEFI applications" |
| depends on OF_LIBFDT && ( \ |
| ARM && (SYS_CPU = arm1136 || \ |
| SYS_CPU = arm1176 || \ |
| SYS_CPU = armv7 || \ |
| SYS_CPU = armv8) || \ |
| X86 || RISCV || SANDBOX) |
| # We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB |
| depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT |
| # We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB |
| depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT |
| default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8 |
| select LIB_UUID |
| select HAVE_BLOCK_DEVICE |
| select REGEX |
| imply CFB_CONSOLE_ANSI |
| imply FAT |
| imply FAT_WRITE |
| imply USB_KEYBOARD_FN_KEYS |
| imply VIDEO_ANSI |
| help |
| Select this option if you want to run UEFI applications (like GNU |
| GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot |
| will expose the UEFI API to a loaded application, enabling it to |
| reuse U-Boot's device drivers. |
| |
| if EFI_LOADER |
| |
| choice |
| prompt "Store for non-volatile UEFI variables" |
| default EFI_VARIABLE_FILE_STORE |
| help |
| Select where non-volatile UEFI variables shall be stored. |
| |
| config EFI_VARIABLE_FILE_STORE |
| bool "Store non-volatile UEFI variables as file" |
| depends on FAT_WRITE |
| help |
| Select this option if you want non-volatile UEFI variables to be |
| stored as file /ubootefi.var on the EFI system partition. |
| |
| config EFI_MM_COMM_TEE |
| bool "UEFI variables storage service via OP-TEE" |
| depends on OPTEE |
| help |
| If OP-TEE is present and running StandAloneMM, dispatch all UEFI |
| variable related operations to that. The application will verify, |
| authenticate and store the variables on an RPMB. |
| |
| endchoice |
| |
| config EFI_VARIABLES_PRESEED |
| bool "Initial values for UEFI variables" |
| depends on EFI_VARIABLE_FILE_STORE |
| help |
| Include a file with the initial values for non-volatile UEFI variables |
| into the U-Boot binary. If this configuration option is set, changes |
| to authentication related variables (PK, KEK, db, dbx) are not |
| allowed. |
| |
| if EFI_VARIABLES_PRESEED |
| |
| config EFI_VAR_SEED_FILE |
| string "File with initial values of non-volatile UEFI variables" |
| default ubootefi.var |
| help |
| File with initial values of non-volatile UEFI variables. The file must |
| be in the same format as the storage in the EFI system partition. The |
| easiest way to create it is by setting the non-volatile variables in |
| U-Boot. If a relative file path is used, it is relative to the source |
| directory. |
| |
| endif |
| |
| config EFI_GET_TIME |
| bool "GetTime() runtime service" |
| depends on DM_RTC |
| default y |
| help |
| Provide the GetTime() runtime service at boottime. This service |
| can be used by an EFI application to read the real time clock. |
| |
| config EFI_SET_TIME |
| bool "SetTime() runtime service" |
| depends on EFI_GET_TIME |
| default n |
| help |
| Provide the SetTime() runtime service at boottime. This service |
| can be used by an EFI application to adjust the real time clock. |
| |
| config EFI_DEVICE_PATH_TO_TEXT |
| bool "Device path to text protocol" |
| default y |
| help |
| The device path to text protocol converts device nodes and paths to |
| human readable strings. |
| |
| config EFI_LOADER_HII |
| bool "HII protocols" |
| default y |
| help |
| The Human Interface Infrastructure is a complicated framework that |
| allows UEFI applications to draw fancy menus and hook strings using |
| a translation framework. |
| |
| U-Boot implements enough of its features to be able to run the UEFI |
| Shell, but not more than that. |
| |
| config EFI_UNICODE_COLLATION_PROTOCOL2 |
| bool "Unicode collation protocol" |
| default y |
| help |
| The Unicode collation protocol is used for lexical comparisons. It is |
| required to run the UEFI shell. |
| |
| if EFI_UNICODE_COLLATION_PROTOCOL2 |
| |
| config EFI_UNICODE_CAPITALIZATION |
| bool "Support Unicode capitalization" |
| default y |
| help |
| Select this option to enable correct handling of the capitalization of |
| Unicode codepoints in the range 0x0000-0xffff. If this option is not |
| set, only the the correct handling of the letters of the codepage |
| used by the FAT file system is ensured. |
| |
| config EFI_UNICODE_COLLATION_PROTOCOL |
| bool "Deprecated version of the Unicode collation protocol" |
| default n |
| help |
| In EFI 1.10 a version of the Unicode collation protocol using ISO |
| 639-2 language codes existed. This protocol is not part of the UEFI |
| specification any longer. Unfortunately it is required to run the |
| UEFI Self Certification Test (SCT) II, version 2.6, 2017. |
| |
| Choose this option for testing only. It is bound to be removed. |
| |
| endif |
| |
| config EFI_LOADER_BOUNCE_BUFFER |
| bool "EFI Applications use bounce buffers for DMA operations" |
| depends on ARM64 |
| default n |
| help |
| Some hardware does not support DMA to full 64bit addresses. For this |
| hardware we can create a bounce buffer so that payloads don't have to |
| worry about platform details. |
| |
| config EFI_PLATFORM_LANG_CODES |
| string "Language codes supported by firmware" |
| default "en-US" |
| help |
| This value is used to initialize the PlatformLangCodes variable. Its |
| value is a semicolon (;) separated list of language codes in native |
| RFC 4646 format, e.g. "en-US;de-DE". The first language code is used |
| to initialize the PlatformLang variable. |
| |
| config EFI_HAVE_RUNTIME_RESET |
| # bool "Reset runtime service is available" |
| bool |
| default y |
| depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || SYSRESET_X86 |
| |
| config EFI_GRUB_ARM32_WORKAROUND |
| bool "Workaround for GRUB on 32bit ARM" |
| default y |
| depends on ARM && !ARM64 |
| help |
| GRUB prior to version 2.04 requires U-Boot to disable caches. This |
| workaround currently is also needed on systems with caches that |
| cannot be managed via CP15. |
| |
| config EFI_RNG_PROTOCOL |
| bool "EFI_RNG_PROTOCOL support" |
| depends on DM_RNG |
| default y |
| help |
| Provide a EFI_RNG_PROTOCOL implementation using the hardware random |
| number generator of the platform. |
| |
| config EFI_LOAD_FILE2_INITRD |
| bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk" |
| default n |
| help |
| Expose a EFI_FILE_LOAD2_PROTOCOL that the Linux UEFI stub can |
| use to load the initial ramdisk. Once this is enabled using |
| initrd=<ramdisk> will stop working. |
| |
| config EFI_INITRD_FILESPEC |
| string "initramfs path" |
| default "host 0:1 initrd" |
| depends on EFI_LOAD_FILE2_INITRD |
| help |
| Full path of the initramfs file, e.g. mmc 0:2 initramfs.cpio.gz. |
| |
| config EFI_SECURE_BOOT |
| bool "Enable EFI secure boot support" |
| depends on EFI_LOADER |
| select SHA256 |
| select RSA |
| select RSA_VERIFY_WITH_PKEY |
| select IMAGE_SIGN_INFO |
| select ASYMMETRIC_KEY_TYPE |
| select ASYMMETRIC_PUBLIC_KEY_SUBTYPE |
| select X509_CERTIFICATE_PARSER |
| select PKCS7_MESSAGE_PARSER |
| select PKCS7_VERIFY |
| default n |
| help |
| Select this option to enable EFI secure boot support. |
| Once SecureBoot mode is enforced, any EFI binary can run only if |
| it is signed with a trusted key. To do that, you need to install, |
| at least, PK, KEK and db. |
| |
| endif |