| config EFI_LOADER |
| bool "Support running UEFI applications" |
| depends on OF_LIBFDT && ( \ |
| ARM && (SYS_CPU = arm1136 || \ |
| SYS_CPU = arm1176 || \ |
| SYS_CPU = armv7 || \ |
| SYS_CPU = armv8) || \ |
| X86 || RISCV || SANDBOX) |
| # We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB |
| depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT |
| # We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB |
| depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT |
| depends on BLK |
| depends on !EFI_APP |
| default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8 |
| select CHARSET |
| select DM_EVENT |
| select EVENT |
| select EVENT_DYNAMIC |
| select LIB_UUID |
| imply PARTITION_UUIDS |
| select REGEX |
| imply FAT |
| imply FAT_WRITE |
| imply USB_KEYBOARD_FN_KEYS |
| imply VIDEO_ANSI |
| help |
| Select this option if you want to run UEFI applications (like GNU |
| GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot |
| will expose the UEFI API to a loaded application, enabling it to |
| reuse U-Boot's device drivers. |
| |
| if EFI_LOADER |
| |
| config CMD_BOOTEFI_BOOTMGR |
| bool "UEFI Boot Manager" |
| default y |
| select BOOTMETH_GLOBAL if BOOTSTD |
| help |
| Select this option if you want to select the UEFI binary to be booted |
| via UEFI variables Boot####, BootOrder, and BootNext. This enables the |
| 'bootefi bootmgr' command. |
| |
| choice |
| prompt "Store for non-volatile UEFI variables" |
| default EFI_VARIABLE_FILE_STORE |
| help |
| Select where non-volatile UEFI variables shall be stored. |
| |
| config EFI_VARIABLE_FILE_STORE |
| bool "Store non-volatile UEFI variables as file" |
| depends on FAT_WRITE |
| help |
| Select this option if you want non-volatile UEFI variables to be |
| stored as file /ubootefi.var on the EFI system partition. |
| |
| config EFI_MM_COMM_TEE |
| bool "UEFI variables storage service via OP-TEE" |
| depends on OPTEE |
| help |
| If OP-TEE is present and running StandAloneMM, dispatch all UEFI |
| variable related operations to that. The application will verify, |
| authenticate and store the variables on an RPMB. |
| |
| config EFI_VARIABLE_NO_STORE |
| bool "Don't persist non-volatile UEFI variables" |
| help |
| If you choose this option, non-volatile variables cannot be persisted. |
| You could still provide non-volatile variables via |
| EFI_VARIABLES_PRESEED. |
| |
| endchoice |
| |
| config EFI_VARIABLES_PRESEED |
| bool "Initial values for UEFI variables" |
| depends on !EFI_MM_COMM_TEE |
| help |
| Include a file with the initial values for non-volatile UEFI variables |
| into the U-Boot binary. If this configuration option is set, changes |
| to authentication related variables (PK, KEK, db, dbx) are not |
| allowed. |
| |
| if EFI_VARIABLES_PRESEED |
| |
| config EFI_VAR_SEED_FILE |
| string "File with initial values of non-volatile UEFI variables" |
| default ubootefi.var |
| help |
| File with initial values of non-volatile UEFI variables. The file must |
| be in the same format as the storage in the EFI system partition. The |
| easiest way to create it is by setting the non-volatile variables in |
| U-Boot. If a relative file path is used, it is relative to the source |
| directory. |
| |
| endif |
| |
| config EFI_VAR_BUF_SIZE |
| int "Memory size of the UEFI variable store" |
| default 16384 |
| range 4096 2147483647 |
| help |
| This defines the size in bytes of the memory area reserved for keeping |
| UEFI variables. |
| |
| When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) this value should |
| match the value of PcdFlashNvStorageVariableSize used to compile the |
| StandAloneMM module. |
| |
| Minimum 4096, default 16384. |
| |
| config EFI_GET_TIME |
| bool "GetTime() runtime service" |
| depends on DM_RTC |
| default y |
| help |
| Provide the GetTime() runtime service at boottime. This service |
| can be used by an EFI application to read the real time clock. |
| |
| config EFI_SET_TIME |
| bool "SetTime() runtime service" |
| depends on EFI_GET_TIME |
| default y if ARCH_QEMU || SANDBOX |
| help |
| Provide the SetTime() runtime service at boottime. This service |
| can be used by an EFI application to adjust the real time clock. |
| |
| config EFI_HAVE_CAPSULE_SUPPORT |
| bool |
| |
| config EFI_RUNTIME_UPDATE_CAPSULE |
| bool "UpdateCapsule() runtime service" |
| select EFI_HAVE_CAPSULE_SUPPORT |
| help |
| Select this option if you want to use UpdateCapsule and |
| QueryCapsuleCapabilities API's. |
| |
| config EFI_CAPSULE_ON_DISK |
| bool "Enable capsule-on-disk support" |
| depends on SYSRESET |
| select EFI_HAVE_CAPSULE_SUPPORT |
| help |
| Select this option if you want to use capsule-on-disk feature, |
| that is, capsules can be fetched and executed from files |
| under a specific directory on UEFI system partition instead of |
| via UpdateCapsule API. |
| |
| config EFI_IGNORE_OSINDICATIONS |
| bool "Ignore OsIndications for CapsuleUpdate on-disk" |
| depends on EFI_CAPSULE_ON_DISK |
| help |
| There are boards where U-Boot does not support SetVariable at runtime. |
| Select this option if you want to use the capsule-on-disk feature |
| without setting the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED |
| flag in variable OsIndications. |
| |
| config EFI_CAPSULE_ON_DISK_EARLY |
| bool "Initiate capsule-on-disk at U-Boot boottime" |
| depends on EFI_CAPSULE_ON_DISK |
| help |
| Normally, without this option enabled, capsules will be |
| executed only at the first time of invoking one of efi command. |
| If this option is enabled, capsules will be enforced to be |
| executed as part of U-Boot initialisation so that they will |
| surely take place whatever is set to distro_bootcmd. |
| |
| config EFI_CAPSULE_FIRMWARE |
| bool |
| |
| config EFI_CAPSULE_FIRMWARE_MANAGEMENT |
| bool "Capsule: Firmware Management Protocol" |
| depends on EFI_HAVE_CAPSULE_SUPPORT |
| default y |
| help |
| Select this option if you want to enable capsule-based |
| firmware update using Firmware Management Protocol. |
| |
| config EFI_CAPSULE_FIRMWARE_FIT |
| bool "FMP driver for FIT images" |
| depends on FIT |
| depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT |
| select UPDATE_FIT |
| select DFU |
| select SET_DFU_ALT_INFO |
| select EFI_CAPSULE_FIRMWARE |
| help |
| Select this option if you want to enable firmware management protocol |
| driver for FIT image |
| |
| config EFI_CAPSULE_FIRMWARE_RAW |
| bool "FMP driver for raw images" |
| depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT |
| depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT) |
| select DFU_WRITE_ALT |
| select DFU |
| select SET_DFU_ALT_INFO |
| select EFI_CAPSULE_FIRMWARE |
| help |
| Select this option if you want to enable firmware management protocol |
| driver for raw image |
| |
| config EFI_CAPSULE_AUTHENTICATE |
| bool "Update Capsule authentication" |
| depends on EFI_CAPSULE_FIRMWARE |
| depends on EFI_CAPSULE_ON_DISK |
| depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT |
| select HASH |
| select SHA256 |
| select RSA |
| select RSA_VERIFY |
| select RSA_VERIFY_WITH_PKEY |
| select X509_CERTIFICATE_PARSER |
| select PKCS7_MESSAGE_PARSER |
| select PKCS7_VERIFY |
| select IMAGE_SIGN_INFO |
| select EFI_SIGNATURE_SUPPORT |
| help |
| Select this option if you want to enable capsule |
| authentication |
| |
| config EFI_DEVICE_PATH_TO_TEXT |
| bool "Device path to text protocol" |
| default y |
| help |
| The device path to text protocol converts device nodes and paths to |
| human readable strings. |
| |
| config EFI_DEVICE_PATH_UTIL |
| bool "Device path utilities protocol" |
| default y |
| help |
| The device path utilities protocol creates and manipulates device |
| paths and device nodes. It is required to run the EFI Shell. |
| |
| config EFI_DT_FIXUP |
| bool "Device tree fixup protocol" |
| depends on !GENERATE_ACPI_TABLE |
| default y |
| help |
| The EFI device-tree fix-up protocol provides a function to let the |
| firmware apply fix-ups. This may be used by boot loaders. |
| |
| config EFI_LOADER_HII |
| bool "HII protocols" |
| default y |
| help |
| The Human Interface Infrastructure is a complicated framework that |
| allows UEFI applications to draw fancy menus and hook strings using |
| a translation framework. |
| |
| U-Boot implements enough of its features to be able to run the UEFI |
| Shell, but not more than that. |
| |
| config EFI_UNICODE_COLLATION_PROTOCOL2 |
| bool "Unicode collation protocol" |
| default y |
| help |
| The Unicode collation protocol is used for lexical comparisons. It is |
| required to run the UEFI shell. |
| |
| if EFI_UNICODE_COLLATION_PROTOCOL2 |
| |
| config EFI_UNICODE_CAPITALIZATION |
| bool "Support Unicode capitalization" |
| default y |
| help |
| Select this option to enable correct handling of the capitalization of |
| Unicode codepoints in the range 0x0000-0xffff. If this option is not |
| set, only the the correct handling of the letters of the codepage |
| used by the FAT file system is ensured. |
| |
| endif |
| |
| config EFI_LOADER_BOUNCE_BUFFER |
| bool "EFI Applications use bounce buffers for DMA operations" |
| depends on ARM64 |
| help |
| Some hardware does not support DMA to full 64bit addresses. For this |
| hardware we can create a bounce buffer so that payloads don't have to |
| worry about platform details. |
| |
| config EFI_PLATFORM_LANG_CODES |
| string "Language codes supported by firmware" |
| default "en-US" |
| help |
| This value is used to initialize the PlatformLangCodes variable. Its |
| value is a semicolon (;) separated list of language codes in native |
| RFC 4646 format, e.g. "en-US;de-DE". The first language code is used |
| to initialize the PlatformLang variable. |
| |
| config EFI_HAVE_RUNTIME_RESET |
| # bool "Reset runtime service is available" |
| bool |
| default y |
| depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || \ |
| SANDBOX || SYSRESET_X86 |
| |
| config EFI_GRUB_ARM32_WORKAROUND |
| bool "Workaround for GRUB on 32bit ARM" |
| default n if ARCH_BCM283X || ARCH_SUNXI || ARCH_QEMU |
| default y |
| depends on ARM && !ARM64 |
| help |
| GRUB prior to version 2.04 requires U-Boot to disable caches. This |
| workaround currently is also needed on systems with caches that |
| cannot be managed via CP15. |
| |
| config EFI_RNG_PROTOCOL |
| bool "EFI_RNG_PROTOCOL support" |
| depends on DM_RNG |
| default y |
| help |
| Provide a EFI_RNG_PROTOCOL implementation using the hardware random |
| number generator of the platform. |
| |
| config EFI_TCG2_PROTOCOL |
| bool "EFI_TCG2_PROTOCOL support" |
| default y |
| depends on TPM_V2 |
| # Sandbox TPM currently fails on GetCapabilities needed for TCG2 |
| depends on !SANDBOX |
| select SHA1 |
| select SHA256 |
| select SHA384 |
| select SHA512 |
| select HASH |
| select SMBIOS_PARSER |
| help |
| Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware |
| of the platform. |
| |
| config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE |
| int "EFI_TCG2_PROTOCOL EventLog size" |
| depends on EFI_TCG2_PROTOCOL |
| default 65536 |
| help |
| Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that |
| this is going to be allocated twice. One for the eventlog it self |
| and one for the configuration table that is required from the spec |
| |
| config EFI_LOAD_FILE2_INITRD |
| bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk" |
| default y |
| help |
| Linux v5.7 and later can make use of this option. If the boot option |
| selected by the UEFI boot manager specifies an existing file to be used |
| as initial RAM disk, a Linux specific Load File2 protocol will be |
| installed and Linux 5.7+ will ignore any initrd=<ramdisk> command line |
| argument. |
| |
| config EFI_SECURE_BOOT |
| bool "Enable EFI secure boot support" |
| depends on EFI_LOADER && FIT_SIGNATURE |
| select HASH |
| select SHA256 |
| select RSA |
| select RSA_VERIFY_WITH_PKEY |
| select IMAGE_SIGN_INFO |
| select ASYMMETRIC_KEY_TYPE |
| select ASYMMETRIC_PUBLIC_KEY_SUBTYPE |
| select X509_CERTIFICATE_PARSER |
| select PKCS7_MESSAGE_PARSER |
| select PKCS7_VERIFY |
| select MSCODE_PARSER |
| select EFI_SIGNATURE_SUPPORT |
| help |
| Select this option to enable EFI secure boot support. |
| Once SecureBoot mode is enforced, any EFI binary can run only if |
| it is signed with a trusted key. To do that, you need to install, |
| at least, PK, KEK and db. |
| |
| config EFI_SIGNATURE_SUPPORT |
| bool |
| |
| config EFI_ESRT |
| bool "Enable the UEFI ESRT generation" |
| depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT |
| default y |
| help |
| Enabling this option creates the ESRT UEFI system table. |
| |
| config EFI_ECPT |
| bool "Enable the UEFI ECPT generation" |
| default y |
| help |
| Enabling this option created the ECPT UEFI table. |
| |
| config EFI_EBBR_2_0_CONFORMANCE |
| bool "Add the EBBRv2.0 conformance entry to the ECPT table" |
| depends on EFI_ECPT |
| depends on EFI_LOADER_HII |
| depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV |
| depends on EFI_RNG_PROTOCOL || !DM_RNG |
| depends on EFI_UNICODE_COLLATION_PROTOCOL2 |
| default y |
| help |
| Enabling this option adds the EBBRv2.0 conformance entry to the ECPT UEFI table. |
| |
| config EFI_RISCV_BOOT_PROTOCOL |
| bool "RISCV_EFI_BOOT_PROTOCOL support" |
| default y |
| depends on RISCV |
| help |
| The EFI_RISCV_BOOT_PROTOCOL is used to transfer the boot hart ID |
| to the next boot stage. It should be enabled as it is meant to |
| replace the transfer via the device-tree. The latter is not |
| possible on systems using ACPI. |
| |
| endif |