blob: 38e64af25310ced885cd47634ae3cc55000721ac [file] [log] [blame]
Alexander Graf67ee7052016-03-04 01:10:07 +01001config EFI_LOADER
Heinrich Schuchardt96b236a2019-05-11 10:27:58 +02002 bool "Support running UEFI applications"
Heinrich Schuchardt79cea672019-11-17 10:44:16 +01003 depends on OF_LIBFDT && ( \
Heinrich Schuchardt30c3a5f2019-11-19 04:19:09 +01004 ARM && (SYS_CPU = arm1136 || \
5 SYS_CPU = arm1176 || \
6 SYS_CPU = armv7 || \
7 SYS_CPU = armv8) || \
Heinrich Schuchardt79cea672019-11-17 10:44:16 +01008 X86 || RISCV || SANDBOX)
Alexander Graf5e247172018-01-24 14:54:21 +01009 # We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB
10 depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT
11 # We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB
12 depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT
Simon Glass49a643b2021-11-03 21:09:07 -060013 depends on !EFI_APP
Heinrich Schuchardtac212dc2019-11-20 18:48:02 +010014 default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8
Tom Rinicec15482024-06-04 19:37:40 -060015 select BLK
Heinrich Schuchardt013aabb2022-05-02 06:27:00 +020016 select CHARSET
Tom Rini7d3684a2023-01-16 15:46:49 -050017 # We need to send DM events, dynamically, in the EFI block driver
AKASHI Takahiro2381f2e2022-04-19 10:05:12 +090018 select DM_EVENT
19 select EVENT_DYNAMIC
Adam Ford70c8f052018-02-06 12:14:28 -060020 select LIB_UUID
AKASHI Takahiroae18a672022-04-19 10:01:56 +090021 imply PARTITION_UUIDS
Heinrich Schuchardt9e18bfa2019-01-22 21:35:23 +010022 select REGEX
Heinrich Schuchardt6c46aaa2020-03-21 20:45:50 +010023 imply FAT
24 imply FAT_WRITE
Heinrich Schuchardt29db4c52019-12-04 22:58:58 +010025 imply USB_KEYBOARD_FN_KEYS
Heinrich Schuchardt8a7514a2020-01-15 00:49:35 +010026 imply VIDEO_ANSI
Alexander Graf67ee7052016-03-04 01:10:07 +010027 help
Heinrich Schuchardt96b236a2019-05-11 10:27:58 +020028 Select this option if you want to run UEFI applications (like GNU
29 GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot
30 will expose the UEFI API to a loaded application, enabling it to
31 reuse U-Boot's device drivers.
Alexander Graf7c00a3c2016-05-11 18:25:48 +020032
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +020033if EFI_LOADER
34
AKASHI Takahiro9b08b9a2024-01-17 13:39:41 +090035config EFI_BINARY_EXEC
36 bool "Execute UEFI binary"
37 default y
38 help
39 Select this option if you want to execute the UEFI binary after
40 loading it with U-Boot load commands or other methods.
41 You may enable CMD_BOOTEFI_BINARY so that you can use bootefi
42 command to do that.
43
AKASHI Takahiroe3e542d2024-01-17 13:39:42 +090044config EFI_BOOTMGR
Heinrich Schuchardtb2625e82021-01-15 19:02:50 +010045 bool "UEFI Boot Manager"
46 default y
47 help
48 Select this option if you want to select the UEFI binary to be booted
Simon Glassd1e46f02023-10-26 14:31:20 -040049 via UEFI variables Boot####, BootOrder, and BootNext. You should also
50 normally enable CMD_BOOTEFI_BOOTMGR so that the command is available.
Heinrich Schuchardtb2625e82021-01-15 19:02:50 +010051
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020052choice
53 prompt "Store for non-volatile UEFI variables"
54 default EFI_VARIABLE_FILE_STORE
55 help
56 Select where non-volatile UEFI variables shall be stored.
57
Heinrich Schuchardt09a8d502020-03-19 18:21:58 +000058config EFI_VARIABLE_FILE_STORE
59 bool "Store non-volatile UEFI variables as file"
60 depends on FAT_WRITE
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020061 help
62 Select this option if you want non-volatile UEFI variables to be
63 stored as file /ubootefi.var on the EFI system partition.
64
Ilias Apalodimas86ba8692024-04-18 15:54:50 +030065config EFI_RT_VOLATILE_STORE
66 bool "Allow variable runtime services in volatile storage (e.g RAM)"
67 depends on EFI_VARIABLE_FILE_STORE
68 help
69 When EFI variables are stored on file we don't allow SetVariableRT,
Michal Simek0ac27982024-07-16 15:56:51 +020070 since the OS doesn't know how to write that file. At the same time
Ilias Apalodimas86ba8692024-04-18 15:54:50 +030071 we copy runtime variables in DRAM and support GetVariableRT
72
73 Enable this option to allow SetVariableRT on the RAM backend of
74 the EFI variable storage. The OS will be responsible for syncing
75 the RAM contents to the file, otherwise any changes made during
76 runtime won't persist reboots.
77 Authenticated variables are not supported. Note that this will
78 violate the EFI spec since writing auth variables will return
79 EFI_INVALID_PARAMETER
80
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020081config EFI_MM_COMM_TEE
Abdellatif El Khlifi431c7b52023-08-04 14:33:44 +010082 bool "UEFI variables storage service via the trusted world"
Tom Rini74aad482023-07-24 19:51:05 -040083 depends on OPTEE
Heinrich Schuchardt09a8d502020-03-19 18:21:58 +000084 help
Abdellatif El Khlifi431c7b52023-08-04 14:33:44 +010085 Allowing access to the MM SP services (SPs such as StandAlonneMM, smm-gateway).
86 When using the u-boot OP-TEE driver, StandAlonneMM is supported.
87 When using the u-boot FF-A driver any MM SP is supported.
88
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020089 If OP-TEE is present and running StandAloneMM, dispatch all UEFI
90 variable related operations to that. The application will verify,
91 authenticate and store the variables on an RPMB.
92
Abdellatif El Khlifi431c7b52023-08-04 14:33:44 +010093 When ARM_FFA_TRANSPORT is used, dispatch all UEFI variable related
94 operations to the MM SP running in the secure world.
95 A door bell mechanism is used to notify the SP when there is data in the shared
96 MM buffer. The data is copied by u-boot to the shared buffer before issuing
97 the door bell event.
98
99config FFA_SHARED_MM_BUF_SIZE
100 int "Memory size of the shared MM communication buffer"
101 depends on EFI_MM_COMM_TEE && ARM_FFA_TRANSPORT
102 help
103 This defines the size in bytes of the memory area reserved for the shared
104 buffer used for communication between the MM feature in U-Boot and
105 the MM SP in secure world.
106 The size of the memory region must be a multiple of the size of the maximum
107 translation granule size that is specified in the ID_AA64MMFR0_EL1 System register.
108 It is assumed that the MM SP knows the size of the shared MM communication buffer.
109
110config FFA_SHARED_MM_BUF_OFFSET
111 int "Data offset in the shared MM communication buffer"
112 depends on EFI_MM_COMM_TEE && ARM_FFA_TRANSPORT
113 help
114 This defines the offset in bytes of the data read or written to in the shared
115 buffer by the MM SP.
116
117config FFA_SHARED_MM_BUF_ADDR
118 hex "Define the address of the shared MM communication buffer"
119 depends on EFI_MM_COMM_TEE && ARM_FFA_TRANSPORT
120 help
121 This defines the address of the shared MM communication buffer
122 used for communication between the MM feature in U-Boot and
123 the MM SP in secure world.
124 It is assumed that the MM SP knows the address of the shared MM communication buffer.
125
Tom Saeger79696ce2022-03-22 15:21:10 -0600126config EFI_VARIABLE_NO_STORE
127 bool "Don't persist non-volatile UEFI variables"
128 help
129 If you choose this option, non-volatile variables cannot be persisted.
130 You could still provide non-volatile variables via
131 EFI_VARIABLES_PRESEED.
132
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +0200133endchoice
Heinrich Schuchardt09a8d502020-03-19 18:21:58 +0000134
Heinrich Schuchardt4b7d5c12020-07-14 21:25:28 +0200135config EFI_VARIABLES_PRESEED
136 bool "Initial values for UEFI variables"
Tom Saeger79696ce2022-03-22 15:21:10 -0600137 depends on !EFI_MM_COMM_TEE
Heinrich Schuchardt4b7d5c12020-07-14 21:25:28 +0200138 help
139 Include a file with the initial values for non-volatile UEFI variables
140 into the U-Boot binary. If this configuration option is set, changes
141 to authentication related variables (PK, KEK, db, dbx) are not
142 allowed.
143
144if EFI_VARIABLES_PRESEED
145
146config EFI_VAR_SEED_FILE
147 string "File with initial values of non-volatile UEFI variables"
Michal Simekc44f36f2024-04-16 08:55:17 +0200148 default "ubootefi.var"
Heinrich Schuchardt4b7d5c12020-07-14 21:25:28 +0200149 help
150 File with initial values of non-volatile UEFI variables. The file must
151 be in the same format as the storage in the EFI system partition. The
152 easiest way to create it is by setting the non-volatile variables in
153 U-Boot. If a relative file path is used, it is relative to the source
154 directory.
155
156endif
157
Heinrich Schuchardt12f18612020-12-20 11:05:38 +0100158config EFI_VAR_BUF_SIZE
159 int "Memory size of the UEFI variable store"
Ilias Apalodimasc1a8e6d2023-11-06 17:47:53 +0200160 default 131072
Heinrich Schuchardt12f18612020-12-20 11:05:38 +0100161 range 4096 2147483647
162 help
163 This defines the size in bytes of the memory area reserved for keeping
164 UEFI variables.
165
Ilias Apalodimasc1a8e6d2023-11-06 17:47:53 +0200166 When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) is used the
167 available size for storing variables is defined in
168 PcdFlashNvStorageVariableSize.
169 That value is probed at runtime from U-Boot. In that case,
170 EFI_VAR_BUF_SIZE represents the memory U-Boot reserves to present
171 runtime variables to the OS.
Heinrich Schuchardt12f18612020-12-20 11:05:38 +0100172
Ilias Apalodimasc1a8e6d2023-11-06 17:47:53 +0200173 Minimum 4096, default 131072
Heinrich Schuchardt12f18612020-12-20 11:05:38 +0100174
Heinrich Schuchardtf2856ad2019-05-31 22:56:02 +0200175config EFI_GET_TIME
176 bool "GetTime() runtime service"
177 depends on DM_RTC
178 default y
179 help
180 Provide the GetTime() runtime service at boottime. This service
181 can be used by an EFI application to read the real time clock.
182
183config EFI_SET_TIME
184 bool "SetTime() runtime service"
185 depends on EFI_GET_TIME
Heinrich Schuchardt8da46252020-11-21 20:52:18 +0100186 default y if ARCH_QEMU || SANDBOX
Heinrich Schuchardtf2856ad2019-05-31 22:56:02 +0200187 help
188 Provide the SetTime() runtime service at boottime. This service
189 can be used by an EFI application to adjust the real time clock.
190
Jan Kiszkad4d0fec2023-01-18 22:24:59 +0100191config EFI_SCROLL_ON_CLEAR_SCREEN
192 bool "Avoid overwriting previous output on clear screen"
193 help
194 Instead of erasing the screen content when the console screen should
195 be cleared, emit blank new lines so that previous output is scrolled
196 out of sight rather than overwritten. On serial consoles this allows
197 to capture complete boot logs (except for interactive menus etc.)
198 and can ease debugging related issues.
199
AKASHI Takahiro473d9b32020-11-17 09:27:55 +0900200config EFI_HAVE_CAPSULE_SUPPORT
201 bool
202
203config EFI_RUNTIME_UPDATE_CAPSULE
204 bool "UpdateCapsule() runtime service"
AKASHI Takahiro473d9b32020-11-17 09:27:55 +0900205 select EFI_HAVE_CAPSULE_SUPPORT
206 help
207 Select this option if you want to use UpdateCapsule and
208 QueryCapsuleCapabilities API's.
209
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900210config EFI_CAPSULE_ON_DISK
211 bool "Enable capsule-on-disk support"
Masami Hiramatsuff744862022-03-21 22:37:56 +0900212 depends on SYSRESET
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900213 select EFI_HAVE_CAPSULE_SUPPORT
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900214 help
215 Select this option if you want to use capsule-on-disk feature,
216 that is, capsules can be fetched and executed from files
217 under a specific directory on UEFI system partition instead of
218 via UpdateCapsule API.
219
Ilias Apalodimasa38d0cb2021-06-29 07:55:51 +0300220config EFI_IGNORE_OSINDICATIONS
221 bool "Ignore OsIndications for CapsuleUpdate on-disk"
222 depends on EFI_CAPSULE_ON_DISK
Ilias Apalodimasa38d0cb2021-06-29 07:55:51 +0300223 help
224 There are boards where U-Boot does not support SetVariable at runtime.
225 Select this option if you want to use the capsule-on-disk feature
226 without setting the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
227 flag in variable OsIndications.
228
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900229config EFI_CAPSULE_ON_DISK_EARLY
230 bool "Initiate capsule-on-disk at U-Boot boottime"
231 depends on EFI_CAPSULE_ON_DISK
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900232 help
233 Normally, without this option enabled, capsules will be
234 executed only at the first time of invoking one of efi command.
235 If this option is enabled, capsules will be enforced to be
236 executed as part of U-Boot initialisation so that they will
237 surely take place whatever is set to distro_bootcmd.
238
AKASHI Takahiro7ff3f3c2020-11-17 09:28:00 +0900239config EFI_CAPSULE_FIRMWARE
240 bool
AKASHI Takahiro7ff3f3c2020-11-17 09:28:00 +0900241
AKASHI Takahiro0d963782020-11-30 18:12:11 +0900242config EFI_CAPSULE_FIRMWARE_MANAGEMENT
243 bool "Capsule: Firmware Management Protocol"
244 depends on EFI_HAVE_CAPSULE_SUPPORT
245 default y
246 help
247 Select this option if you want to enable capsule-based
248 firmware update using Firmware Management Protocol.
249
Ilias Apalodimas967334d2021-06-22 17:38:52 +0300250config EFI_CAPSULE_FIRMWARE_FIT
251 bool "FMP driver for FIT images"
252 depends on FIT
253 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
254 select UPDATE_FIT
255 select DFU
Sughosh Ganua1d9f672022-04-15 11:29:37 +0530256 select SET_DFU_ALT_INFO
Ilias Apalodimas967334d2021-06-22 17:38:52 +0300257 select EFI_CAPSULE_FIRMWARE
258 help
259 Select this option if you want to enable firmware management protocol
260 driver for FIT image
261
262config EFI_CAPSULE_FIRMWARE_RAW
263 bool "FMP driver for raw images"
264 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
265 depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT)
266 select DFU_WRITE_ALT
267 select DFU
Sughosh Ganua1d9f672022-04-15 11:29:37 +0530268 select SET_DFU_ALT_INFO
Ilias Apalodimas967334d2021-06-22 17:38:52 +0300269 select EFI_CAPSULE_FIRMWARE
270 help
271 Select this option if you want to enable firmware management protocol
272 driver for raw image
273
Sughosh Ganu586bb982020-12-30 19:27:09 +0530274config EFI_CAPSULE_AUTHENTICATE
275 bool "Update Capsule authentication"
276 depends on EFI_CAPSULE_FIRMWARE
277 depends on EFI_CAPSULE_ON_DISK
278 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
Alexandru Gagniuc1a69f4d2021-05-24 14:28:57 -0500279 select HASH
Sughosh Ganu586bb982020-12-30 19:27:09 +0530280 select SHA256
281 select RSA
282 select RSA_VERIFY
283 select RSA_VERIFY_WITH_PKEY
284 select X509_CERTIFICATE_PARSER
285 select PKCS7_MESSAGE_PARSER
286 select PKCS7_VERIFY
Sughosh Ganu3f5318f2021-04-07 17:23:31 +0530287 select IMAGE_SIGN_INFO
Masahisa Kojima915e4272021-05-14 09:53:36 +0900288 select EFI_SIGNATURE_SUPPORT
Sughosh Ganu586bb982020-12-30 19:27:09 +0530289 help
290 Select this option if you want to enable capsule
291 authentication
292
Etienne Carriere6326e912023-02-16 18:21:41 +0100293config EFI_CAPSULE_MAX
294 int "Max value for capsule index"
295 default 15
296 range 0 65535
297 help
298 Select the max capsule index value used for capsule report
299 variables. This value is used to create CapsuleMax variable.
300
Jonathan Humphreys0d6f8412024-06-13 15:27:53 -0500301config EFI_CAPSULE_CRT_FILE
302 string "Path to the EFI capsule public key certificate"
Sughosh Ganu3f46bcc2023-08-22 23:10:05 +0530303 depends on EFI_CAPSULE_AUTHENTICATE
304 help
Jonathan Humphreys0d6f8412024-06-13 15:27:53 -0500305 Provides the path to the EFI capsule public key certificate that
306 corresponds to the capsule signing key. This certificate will be used
307 to generate the EFI capsule ESL (signature list file) that gets
308 embedded in the platform's device tree and used for capsule
309 authentication at the time of capsule update.
Sughosh Ganu3f46bcc2023-08-22 23:10:05 +0530310
Heinrich Schuchardt3db35912019-05-11 09:53:33 +0200311config EFI_DEVICE_PATH_TO_TEXT
312 bool "Device path to text protocol"
313 default y
314 help
315 The device path to text protocol converts device nodes and paths to
316 human readable strings.
317
Heinrich Schuchardt1cb1a9d2021-01-16 09:44:25 +0100318config EFI_DEVICE_PATH_UTIL
319 bool "Device path utilities protocol"
320 default y
321 help
322 The device path utilities protocol creates and manipulates device
323 paths and device nodes. It is required to run the EFI Shell.
324
Heinrich Schuchardt0404b282021-01-16 09:33:24 +0100325config EFI_DT_FIXUP
326 bool "Device tree fixup protocol"
327 depends on !GENERATE_ACPI_TABLE
328 default y
329 help
330 The EFI device-tree fix-up protocol provides a function to let the
331 firmware apply fix-ups. This may be used by boot loaders.
332
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200333config EFI_LOADER_HII
334 bool "HII protocols"
335 default y
336 help
337 The Human Interface Infrastructure is a complicated framework that
338 allows UEFI applications to draw fancy menus and hook strings using
339 a translation framework.
340
341 U-Boot implements enough of its features to be able to run the UEFI
342 Shell, but not more than that.
343
Heinrich Schuchardtb3258842019-05-16 07:52:58 +0200344config EFI_UNICODE_COLLATION_PROTOCOL2
Heinrich Schuchardt532fec72019-05-08 23:24:26 +0200345 bool "Unicode collation protocol"
346 default y
347 help
348 The Unicode collation protocol is used for lexical comparisons. It is
349 required to run the UEFI shell.
350
Heinrich Schuchardtb3258842019-05-16 07:52:58 +0200351if EFI_UNICODE_COLLATION_PROTOCOL2
Heinrich Schuchardt532fec72019-05-08 23:24:26 +0200352
Heinrich Schuchardt58ddcd32018-09-04 19:34:56 +0200353config EFI_UNICODE_CAPITALIZATION
354 bool "Support Unicode capitalization"
Heinrich Schuchardt58ddcd32018-09-04 19:34:56 +0200355 default y
356 help
357 Select this option to enable correct handling of the capitalization of
358 Unicode codepoints in the range 0x0000-0xffff. If this option is not
359 set, only the the correct handling of the letters of the codepage
360 used by the FAT file system is ensured.
361
Heinrich Schuchardt532fec72019-05-08 23:24:26 +0200362endif
363
Alexander Graf7c00a3c2016-05-11 18:25:48 +0200364config EFI_LOADER_BOUNCE_BUFFER
365 bool "EFI Applications use bounce buffers for DMA operations"
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200366 depends on ARM64
Alexander Graf7c00a3c2016-05-11 18:25:48 +0200367 help
368 Some hardware does not support DMA to full 64bit addresses. For this
369 hardware we can create a bounce buffer so that payloads don't have to
370 worry about platform details.
Alexander Graf44be5da2019-02-11 15:24:00 +0100371
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200372config EFI_PLATFORM_LANG_CODES
373 string "Language codes supported by firmware"
374 default "en-US"
Alexander Graf44be5da2019-02-11 15:24:00 +0100375 help
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200376 This value is used to initialize the PlatformLangCodes variable. Its
377 value is a semicolon (;) separated list of language codes in native
378 RFC 4646 format, e.g. "en-US;de-DE". The first language code is used
379 to initialize the PlatformLang variable.
Alexander Graf44be5da2019-02-11 15:24:00 +0100380
Heinrich Schuchardt05874fb2019-07-05 18:12:16 +0200381config EFI_HAVE_RUNTIME_RESET
382 # bool "Reset runtime service is available"
383 bool
384 default y
Heinrich Schuchardt43eb8722020-12-02 16:22:11 +0100385 depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || \
Heinrich Schuchardt309c7752024-02-12 17:18:37 +0100386 SANDBOX || SYSRESET_SBI || SYSRESET_X86
Heinrich Schuchardt05874fb2019-07-05 18:12:16 +0200387
Heinrich Schuchardt149d5d42019-07-22 22:04:36 +0200388config EFI_GRUB_ARM32_WORKAROUND
389 bool "Workaround for GRUB on 32bit ARM"
Heinrich Schuchardt79979602021-03-03 14:05:05 +0100390 default n if ARCH_BCM283X || ARCH_SUNXI || ARCH_QEMU
Heinrich Schuchardt149d5d42019-07-22 22:04:36 +0200391 default y
392 depends on ARM && !ARM64
393 help
394 GRUB prior to version 2.04 requires U-Boot to disable caches. This
395 workaround currently is also needed on systems with caches that
396 cannot be managed via CP15.
Sughosh Ganu7064a5d2019-12-29 00:01:05 +0530397
398config EFI_RNG_PROTOCOL
399 bool "EFI_RNG_PROTOCOL support"
400 depends on DM_RNG
Peter Robinsonfa497522020-04-01 11:15:01 +0100401 default y
Sughosh Ganu7064a5d2019-12-29 00:01:05 +0530402 help
Heinrich Schuchardt7bcc7fc2020-02-14 23:28:58 +0100403 Provide a EFI_RNG_PROTOCOL implementation using the hardware random
404 number generator of the platform.
Sughosh Ganu7064a5d2019-12-29 00:01:05 +0530405
Ilias Apalodimas590fef62020-11-11 11:18:11 +0200406config EFI_TCG2_PROTOCOL
407 bool "EFI_TCG2_PROTOCOL support"
Ilias Apalodimascc29c9b2021-05-11 14:40:58 +0300408 default y
Ilias Apalodimas590fef62020-11-11 11:18:11 +0200409 depends on TPM_V2
Ilias Apalodimascc29c9b2021-05-11 14:40:58 +0300410 select SHA1
411 select SHA256
Ilias Apalodimascc29c9b2021-05-11 14:40:58 +0300412 select SHA384
413 select SHA512
Masahisa Kojima70be5a62021-05-26 12:09:58 +0900414 select HASH
Masahisa Kojimacd1fe7d2021-10-26 17:27:24 +0900415 select SMBIOS_PARSER
Ilias Apalodimas590fef62020-11-11 11:18:11 +0200416 help
417 Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware
418 of the platform.
419
Ilias Apalodimas967650d2020-11-30 11:47:40 +0200420config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE
421 int "EFI_TCG2_PROTOCOL EventLog size"
422 depends on EFI_TCG2_PROTOCOL
Masahisa Kojima8db8a962021-07-14 22:00:01 +0900423 default 65536
Ilias Apalodimas967650d2020-11-30 11:47:40 +0200424 help
425 Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that
426 this is going to be allocated twice. One for the eventlog it self
427 and one for the configuration table that is required from the spec
428
Etienne Carriereb9064352023-02-16 17:29:48 +0100429config EFI_TCG2_PROTOCOL_MEASURE_DTB
430 bool "Measure DTB with EFI_TCG2_PROTOCOL"
431 depends on EFI_TCG2_PROTOCOL
432 help
433 When enabled, the DTB image passed to the booted EFI image is
434 measured using the EFI TCG2 protocol. Do not enable this feature if
435 the passed DTB contains data that change across platform reboots
436 and cannot be used has a predictable measurement. Otherwise
437 this feature allows better measurement of the system boot
438 sequence.
439
Ilias Apalodimas3510ba72020-02-21 09:55:45 +0200440config EFI_LOAD_FILE2_INITRD
441 bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk"
Ilias Apalodimasb307e3d2021-03-17 21:55:00 +0200442 default y
Ilias Apalodimas3510ba72020-02-21 09:55:45 +0200443 help
Ilias Apalodimasb307e3d2021-03-17 21:55:00 +0200444 Linux v5.7 and later can make use of this option. If the boot option
445 selected by the UEFI boot manager specifies an existing file to be used
446 as initial RAM disk, a Linux specific Load File2 protocol will be
447 installed and Linux 5.7+ will ignore any initrd=<ramdisk> command line
448 argument.
Ilias Apalodimas3510ba72020-02-21 09:55:45 +0200449
AKASHI Takahiro1900a3b2020-04-14 11:51:38 +0900450config EFI_SECURE_BOOT
451 bool "Enable EFI secure boot support"
Simon Glassd898dcb2021-09-25 19:43:29 -0600452 depends on EFI_LOADER && FIT_SIGNATURE
Alexandru Gagniuc1a69f4d2021-05-24 14:28:57 -0500453 select HASH
AKASHI Takahiro1900a3b2020-04-14 11:51:38 +0900454 select SHA256
455 select RSA
456 select RSA_VERIFY_WITH_PKEY
457 select IMAGE_SIGN_INFO
458 select ASYMMETRIC_KEY_TYPE
459 select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
460 select X509_CERTIFICATE_PARSER
461 select PKCS7_MESSAGE_PARSER
AKASHI Takahiro14afd062020-07-21 19:35:22 +0900462 select PKCS7_VERIFY
AKASHI Takahiroe669c2d2022-07-05 14:48:14 +0900463 select MSCODE_PARSER
Masahisa Kojima915e4272021-05-14 09:53:36 +0900464 select EFI_SIGNATURE_SUPPORT
AKASHI Takahiro1900a3b2020-04-14 11:51:38 +0900465 help
466 Select this option to enable EFI secure boot support.
467 Once SecureBoot mode is enforced, any EFI binary can run only if
468 it is signed with a trusted key. To do that, you need to install,
469 at least, PK, KEK and db.
470
Masahisa Kojima915e4272021-05-14 09:53:36 +0900471config EFI_SIGNATURE_SUPPORT
472 bool
473
Jose Marinhoebb61ee2021-03-02 17:26:38 +0000474config EFI_ESRT
475 bool "Enable the UEFI ESRT generation"
476 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
477 default y
478 help
479 Enabling this option creates the ESRT UEFI system table.
480
Jose Marinhoff72cb32021-12-23 14:51:07 +0000481config EFI_ECPT
482 bool "Enable the UEFI ECPT generation"
483 default y
484 help
485 Enabling this option created the ECPT UEFI table.
486
Vincent Stehléc53cec62022-12-16 17:55:04 +0100487config EFI_EBBR_2_1_CONFORMANCE
488 bool "Add the EBBRv2.1 conformance entry to the ECPT table"
Jose Marinhoe3b7c9b2021-12-17 12:55:05 +0000489 depends on EFI_ECPT
490 depends on EFI_LOADER_HII
491 depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
492 depends on EFI_RNG_PROTOCOL || !DM_RNG
493 depends on EFI_UNICODE_COLLATION_PROTOCOL2
494 default y
495 help
Vincent Stehléc53cec62022-12-16 17:55:04 +0100496 Enabling this option adds the EBBRv2.1 conformance entry to the ECPT UEFI table.
Jose Marinhoe3b7c9b2021-12-17 12:55:05 +0000497
Sunil V L279d1c82022-01-28 20:48:44 +0530498config EFI_RISCV_BOOT_PROTOCOL
499 bool "RISCV_EFI_BOOT_PROTOCOL support"
500 default y
501 depends on RISCV
502 help
503 The EFI_RISCV_BOOT_PROTOCOL is used to transfer the boot hart ID
504 to the next boot stage. It should be enabled as it is meant to
505 replace the transfer via the device-tree. The latter is not
506 possible on systems using ACPI.
507
Masahisa Kojima949c4412023-11-10 13:25:40 +0900508config EFI_HTTP_BOOT
509 bool "EFI HTTP Boot support"
510 select CMD_DNS
511 select CMD_WGET
512 select BLKMAP
513 help
514 Enabling this option adds EFI HTTP Boot support. It allows to
515 directly boot from network.
516
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200517endif