blob: 24f9a2bb7571444b2420ef998cc011ffe31cb455 [file] [log] [blame]
Alexander Graf67ee7052016-03-04 01:10:07 +01001config EFI_LOADER
Heinrich Schuchardt96b236a2019-05-11 10:27:58 +02002 bool "Support running UEFI applications"
Heinrich Schuchardt79cea672019-11-17 10:44:16 +01003 depends on OF_LIBFDT && ( \
Heinrich Schuchardt30c3a5f2019-11-19 04:19:09 +01004 ARM && (SYS_CPU = arm1136 || \
5 SYS_CPU = arm1176 || \
6 SYS_CPU = armv7 || \
7 SYS_CPU = armv8) || \
Heinrich Schuchardt79cea672019-11-17 10:44:16 +01008 X86 || RISCV || SANDBOX)
Alexander Graf5e247172018-01-24 14:54:21 +01009 # We need EFI_STUB_64BIT to be set on x86_64 with EFI_STUB
10 depends on !EFI_STUB || !X86_64 || EFI_STUB_64BIT
11 # We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB
12 depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT
Heinrich Schuchardt302a9cc2021-09-07 08:56:47 +020013 depends on BLK
Simon Glass222f3cb2021-09-24 18:30:17 -060014 depends on DM_ETH || !NET
Simon Glass49a643b2021-11-03 21:09:07 -060015 depends on !EFI_APP
Heinrich Schuchardtac212dc2019-11-20 18:48:02 +010016 default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8
Adam Ford70c8f052018-02-06 12:14:28 -060017 select LIB_UUID
Alfonso Sánchez-Beatof007a372021-07-15 15:31:42 +020018 select PARTITION_UUIDS
Adam Fordb10ba902018-02-06 12:43:56 -060019 select HAVE_BLOCK_DEVICE
Heinrich Schuchardt9e18bfa2019-01-22 21:35:23 +010020 select REGEX
Heinrich Schuchardt35550cc2018-04-29 23:37:12 +020021 imply CFB_CONSOLE_ANSI
Heinrich Schuchardt6c46aaa2020-03-21 20:45:50 +010022 imply FAT
23 imply FAT_WRITE
Heinrich Schuchardt29db4c52019-12-04 22:58:58 +010024 imply USB_KEYBOARD_FN_KEYS
Heinrich Schuchardt8a7514a2020-01-15 00:49:35 +010025 imply VIDEO_ANSI
Alexander Graf67ee7052016-03-04 01:10:07 +010026 help
Heinrich Schuchardt96b236a2019-05-11 10:27:58 +020027 Select this option if you want to run UEFI applications (like GNU
28 GRUB or iPXE) on top of U-Boot. If this option is enabled, U-Boot
29 will expose the UEFI API to a loaded application, enabling it to
30 reuse U-Boot's device drivers.
Alexander Graf7c00a3c2016-05-11 18:25:48 +020031
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +020032if EFI_LOADER
33
Heinrich Schuchardtb2625e82021-01-15 19:02:50 +010034config CMD_BOOTEFI_BOOTMGR
35 bool "UEFI Boot Manager"
36 default y
37 help
38 Select this option if you want to select the UEFI binary to be booted
39 via UEFI variables Boot####, BootOrder, and BootNext. This enables the
40 'bootefi bootmgr' command.
41
AKASHI Takahiro87942ac2020-10-29 13:47:45 +090042config EFI_SETUP_EARLY
43 bool
AKASHI Takahiro87942ac2020-10-29 13:47:45 +090044
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020045choice
46 prompt "Store for non-volatile UEFI variables"
47 default EFI_VARIABLE_FILE_STORE
48 help
49 Select where non-volatile UEFI variables shall be stored.
50
Heinrich Schuchardt09a8d502020-03-19 18:21:58 +000051config EFI_VARIABLE_FILE_STORE
52 bool "Store non-volatile UEFI variables as file"
53 depends on FAT_WRITE
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020054 help
55 Select this option if you want non-volatile UEFI variables to be
56 stored as file /ubootefi.var on the EFI system partition.
57
58config EFI_MM_COMM_TEE
59 bool "UEFI variables storage service via OP-TEE"
60 depends on OPTEE
Heinrich Schuchardt09a8d502020-03-19 18:21:58 +000061 help
Heinrich Schuchardt41bc6012020-07-14 19:18:33 +020062 If OP-TEE is present and running StandAloneMM, dispatch all UEFI
63 variable related operations to that. The application will verify,
64 authenticate and store the variables on an RPMB.
65
66endchoice
Heinrich Schuchardt09a8d502020-03-19 18:21:58 +000067
Heinrich Schuchardt4b7d5c12020-07-14 21:25:28 +020068config EFI_VARIABLES_PRESEED
69 bool "Initial values for UEFI variables"
70 depends on EFI_VARIABLE_FILE_STORE
71 help
72 Include a file with the initial values for non-volatile UEFI variables
73 into the U-Boot binary. If this configuration option is set, changes
74 to authentication related variables (PK, KEK, db, dbx) are not
75 allowed.
76
77if EFI_VARIABLES_PRESEED
78
79config EFI_VAR_SEED_FILE
80 string "File with initial values of non-volatile UEFI variables"
81 default ubootefi.var
82 help
83 File with initial values of non-volatile UEFI variables. The file must
84 be in the same format as the storage in the EFI system partition. The
85 easiest way to create it is by setting the non-volatile variables in
86 U-Boot. If a relative file path is used, it is relative to the source
87 directory.
88
89endif
90
Heinrich Schuchardt12f18612020-12-20 11:05:38 +010091config EFI_VAR_BUF_SIZE
92 int "Memory size of the UEFI variable store"
93 default 16384
94 range 4096 2147483647
95 help
96 This defines the size in bytes of the memory area reserved for keeping
97 UEFI variables.
98
99 When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) this value should
100 match the value of PcdFlashNvStorageVariableSize used to compile the
101 StandAloneMM module.
102
103 Minimum 4096, default 16384.
104
Heinrich Schuchardtf2856ad2019-05-31 22:56:02 +0200105config EFI_GET_TIME
106 bool "GetTime() runtime service"
107 depends on DM_RTC
108 default y
109 help
110 Provide the GetTime() runtime service at boottime. This service
111 can be used by an EFI application to read the real time clock.
112
113config EFI_SET_TIME
114 bool "SetTime() runtime service"
115 depends on EFI_GET_TIME
Heinrich Schuchardt8da46252020-11-21 20:52:18 +0100116 default y if ARCH_QEMU || SANDBOX
Heinrich Schuchardtf2856ad2019-05-31 22:56:02 +0200117 help
118 Provide the SetTime() runtime service at boottime. This service
119 can be used by an EFI application to adjust the real time clock.
120
AKASHI Takahiro473d9b32020-11-17 09:27:55 +0900121config EFI_HAVE_CAPSULE_SUPPORT
122 bool
123
124config EFI_RUNTIME_UPDATE_CAPSULE
125 bool "UpdateCapsule() runtime service"
AKASHI Takahiro473d9b32020-11-17 09:27:55 +0900126 select EFI_HAVE_CAPSULE_SUPPORT
127 help
128 Select this option if you want to use UpdateCapsule and
129 QueryCapsuleCapabilities API's.
130
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900131config EFI_CAPSULE_ON_DISK
132 bool "Enable capsule-on-disk support"
133 select EFI_HAVE_CAPSULE_SUPPORT
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900134 help
135 Select this option if you want to use capsule-on-disk feature,
136 that is, capsules can be fetched and executed from files
137 under a specific directory on UEFI system partition instead of
138 via UpdateCapsule API.
139
Ilias Apalodimasa38d0cb2021-06-29 07:55:51 +0300140config EFI_IGNORE_OSINDICATIONS
141 bool "Ignore OsIndications for CapsuleUpdate on-disk"
142 depends on EFI_CAPSULE_ON_DISK
Ilias Apalodimasa38d0cb2021-06-29 07:55:51 +0300143 help
144 There are boards where U-Boot does not support SetVariable at runtime.
145 Select this option if you want to use the capsule-on-disk feature
146 without setting the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
147 flag in variable OsIndications.
148
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900149config EFI_CAPSULE_ON_DISK_EARLY
150 bool "Initiate capsule-on-disk at U-Boot boottime"
151 depends on EFI_CAPSULE_ON_DISK
AKASHI Takahiro45b819542020-11-17 09:27:56 +0900152 select EFI_SETUP_EARLY
153 help
154 Normally, without this option enabled, capsules will be
155 executed only at the first time of invoking one of efi command.
156 If this option is enabled, capsules will be enforced to be
157 executed as part of U-Boot initialisation so that they will
158 surely take place whatever is set to distro_bootcmd.
159
AKASHI Takahiro7ff3f3c2020-11-17 09:28:00 +0900160config EFI_CAPSULE_FIRMWARE
161 bool
AKASHI Takahiro7ff3f3c2020-11-17 09:28:00 +0900162
AKASHI Takahiro0d963782020-11-30 18:12:11 +0900163config EFI_CAPSULE_FIRMWARE_MANAGEMENT
164 bool "Capsule: Firmware Management Protocol"
165 depends on EFI_HAVE_CAPSULE_SUPPORT
166 default y
167 help
168 Select this option if you want to enable capsule-based
169 firmware update using Firmware Management Protocol.
170
Ilias Apalodimas967334d2021-06-22 17:38:52 +0300171config EFI_CAPSULE_FIRMWARE_FIT
172 bool "FMP driver for FIT images"
173 depends on FIT
174 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
175 select UPDATE_FIT
176 select DFU
177 select EFI_CAPSULE_FIRMWARE
178 help
179 Select this option if you want to enable firmware management protocol
180 driver for FIT image
181
182config EFI_CAPSULE_FIRMWARE_RAW
183 bool "FMP driver for raw images"
184 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
185 depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT)
186 select DFU_WRITE_ALT
187 select DFU
188 select EFI_CAPSULE_FIRMWARE
189 help
190 Select this option if you want to enable firmware management protocol
191 driver for raw image
192
Sughosh Ganu586bb982020-12-30 19:27:09 +0530193config EFI_CAPSULE_AUTHENTICATE
194 bool "Update Capsule authentication"
195 depends on EFI_CAPSULE_FIRMWARE
196 depends on EFI_CAPSULE_ON_DISK
197 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
Alexandru Gagniuc1a69f4d2021-05-24 14:28:57 -0500198 select HASH
Sughosh Ganu586bb982020-12-30 19:27:09 +0530199 select SHA256
200 select RSA
201 select RSA_VERIFY
202 select RSA_VERIFY_WITH_PKEY
203 select X509_CERTIFICATE_PARSER
204 select PKCS7_MESSAGE_PARSER
205 select PKCS7_VERIFY
Sughosh Ganu3f5318f2021-04-07 17:23:31 +0530206 select IMAGE_SIGN_INFO
Masahisa Kojima915e4272021-05-14 09:53:36 +0900207 select EFI_SIGNATURE_SUPPORT
Sughosh Ganu586bb982020-12-30 19:27:09 +0530208 help
209 Select this option if you want to enable capsule
210 authentication
211
Heinrich Schuchardt3db35912019-05-11 09:53:33 +0200212config EFI_DEVICE_PATH_TO_TEXT
213 bool "Device path to text protocol"
214 default y
215 help
216 The device path to text protocol converts device nodes and paths to
217 human readable strings.
218
Heinrich Schuchardt1cb1a9d2021-01-16 09:44:25 +0100219config EFI_DEVICE_PATH_UTIL
220 bool "Device path utilities protocol"
221 default y
222 help
223 The device path utilities protocol creates and manipulates device
224 paths and device nodes. It is required to run the EFI Shell.
225
Heinrich Schuchardt0404b282021-01-16 09:33:24 +0100226config EFI_DT_FIXUP
227 bool "Device tree fixup protocol"
228 depends on !GENERATE_ACPI_TABLE
229 default y
230 help
231 The EFI device-tree fix-up protocol provides a function to let the
232 firmware apply fix-ups. This may be used by boot loaders.
233
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200234config EFI_LOADER_HII
235 bool "HII protocols"
236 default y
237 help
238 The Human Interface Infrastructure is a complicated framework that
239 allows UEFI applications to draw fancy menus and hook strings using
240 a translation framework.
241
242 U-Boot implements enough of its features to be able to run the UEFI
243 Shell, but not more than that.
244
Heinrich Schuchardtb3258842019-05-16 07:52:58 +0200245config EFI_UNICODE_COLLATION_PROTOCOL2
Heinrich Schuchardt532fec72019-05-08 23:24:26 +0200246 bool "Unicode collation protocol"
247 default y
248 help
249 The Unicode collation protocol is used for lexical comparisons. It is
250 required to run the UEFI shell.
251
Heinrich Schuchardtb3258842019-05-16 07:52:58 +0200252if EFI_UNICODE_COLLATION_PROTOCOL2
Heinrich Schuchardt532fec72019-05-08 23:24:26 +0200253
Heinrich Schuchardt58ddcd32018-09-04 19:34:56 +0200254config EFI_UNICODE_CAPITALIZATION
255 bool "Support Unicode capitalization"
Heinrich Schuchardt58ddcd32018-09-04 19:34:56 +0200256 default y
257 help
258 Select this option to enable correct handling of the capitalization of
259 Unicode codepoints in the range 0x0000-0xffff. If this option is not
260 set, only the the correct handling of the letters of the codepage
261 used by the FAT file system is ensured.
262
Heinrich Schuchardt532fec72019-05-08 23:24:26 +0200263endif
264
Alexander Graf7c00a3c2016-05-11 18:25:48 +0200265config EFI_LOADER_BOUNCE_BUFFER
266 bool "EFI Applications use bounce buffers for DMA operations"
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200267 depends on ARM64
Alexander Graf7c00a3c2016-05-11 18:25:48 +0200268 help
269 Some hardware does not support DMA to full 64bit addresses. For this
270 hardware we can create a bounce buffer so that payloads don't have to
271 worry about platform details.
Alexander Graf44be5da2019-02-11 15:24:00 +0100272
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200273config EFI_PLATFORM_LANG_CODES
274 string "Language codes supported by firmware"
275 default "en-US"
Alexander Graf44be5da2019-02-11 15:24:00 +0100276 help
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200277 This value is used to initialize the PlatformLangCodes variable. Its
278 value is a semicolon (;) separated list of language codes in native
279 RFC 4646 format, e.g. "en-US;de-DE". The first language code is used
280 to initialize the PlatformLang variable.
Alexander Graf44be5da2019-02-11 15:24:00 +0100281
Heinrich Schuchardt05874fb2019-07-05 18:12:16 +0200282config EFI_HAVE_RUNTIME_RESET
283 # bool "Reset runtime service is available"
284 bool
285 default y
Heinrich Schuchardt43eb8722020-12-02 16:22:11 +0100286 depends on ARCH_BCM283X || FSL_LAYERSCAPE || PSCI_RESET || \
287 SANDBOX || SYSRESET_X86
Heinrich Schuchardt05874fb2019-07-05 18:12:16 +0200288
Heinrich Schuchardt149d5d42019-07-22 22:04:36 +0200289config EFI_GRUB_ARM32_WORKAROUND
290 bool "Workaround for GRUB on 32bit ARM"
Heinrich Schuchardt79979602021-03-03 14:05:05 +0100291 default n if ARCH_BCM283X || ARCH_SUNXI || ARCH_QEMU
Heinrich Schuchardt149d5d42019-07-22 22:04:36 +0200292 default y
293 depends on ARM && !ARM64
294 help
295 GRUB prior to version 2.04 requires U-Boot to disable caches. This
296 workaround currently is also needed on systems with caches that
297 cannot be managed via CP15.
Sughosh Ganu7064a5d2019-12-29 00:01:05 +0530298
299config EFI_RNG_PROTOCOL
300 bool "EFI_RNG_PROTOCOL support"
301 depends on DM_RNG
Peter Robinsonfa497522020-04-01 11:15:01 +0100302 default y
Sughosh Ganu7064a5d2019-12-29 00:01:05 +0530303 help
Heinrich Schuchardt7bcc7fc2020-02-14 23:28:58 +0100304 Provide a EFI_RNG_PROTOCOL implementation using the hardware random
305 number generator of the platform.
Sughosh Ganu7064a5d2019-12-29 00:01:05 +0530306
Ilias Apalodimas590fef62020-11-11 11:18:11 +0200307config EFI_TCG2_PROTOCOL
308 bool "EFI_TCG2_PROTOCOL support"
Ilias Apalodimascc29c9b2021-05-11 14:40:58 +0300309 default y
Ilias Apalodimas590fef62020-11-11 11:18:11 +0200310 depends on TPM_V2
Masahisa Kojima0fd43792021-12-07 14:15:31 +0900311 # Sandbox TPM currently fails on GetCapabilities needed for TCG2
312 depends on !SANDBOX
Ilias Apalodimascc29c9b2021-05-11 14:40:58 +0300313 select SHA1
314 select SHA256
Ilias Apalodimascc29c9b2021-05-11 14:40:58 +0300315 select SHA384
316 select SHA512
Masahisa Kojima70be5a62021-05-26 12:09:58 +0900317 select HASH
Masahisa Kojimacd1fe7d2021-10-26 17:27:24 +0900318 select SMBIOS_PARSER
Ilias Apalodimas590fef62020-11-11 11:18:11 +0200319 help
320 Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware
321 of the platform.
322
Ilias Apalodimas967650d2020-11-30 11:47:40 +0200323config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE
324 int "EFI_TCG2_PROTOCOL EventLog size"
325 depends on EFI_TCG2_PROTOCOL
Masahisa Kojima8db8a962021-07-14 22:00:01 +0900326 default 65536
Ilias Apalodimas967650d2020-11-30 11:47:40 +0200327 help
328 Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that
329 this is going to be allocated twice. One for the eventlog it self
330 and one for the configuration table that is required from the spec
331
Ilias Apalodimas3510ba72020-02-21 09:55:45 +0200332config EFI_LOAD_FILE2_INITRD
333 bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk"
Ilias Apalodimasb307e3d2021-03-17 21:55:00 +0200334 default y
Ilias Apalodimas3510ba72020-02-21 09:55:45 +0200335 help
Ilias Apalodimasb307e3d2021-03-17 21:55:00 +0200336 Linux v5.7 and later can make use of this option. If the boot option
337 selected by the UEFI boot manager specifies an existing file to be used
338 as initial RAM disk, a Linux specific Load File2 protocol will be
339 installed and Linux 5.7+ will ignore any initrd=<ramdisk> command line
340 argument.
Ilias Apalodimas3510ba72020-02-21 09:55:45 +0200341
AKASHI Takahiro1900a3b2020-04-14 11:51:38 +0900342config EFI_SECURE_BOOT
343 bool "Enable EFI secure boot support"
Simon Glassd898dcb2021-09-25 19:43:29 -0600344 depends on EFI_LOADER && FIT_SIGNATURE
Alexandru Gagniuc1a69f4d2021-05-24 14:28:57 -0500345 select HASH
AKASHI Takahiro1900a3b2020-04-14 11:51:38 +0900346 select SHA256
347 select RSA
348 select RSA_VERIFY_WITH_PKEY
349 select IMAGE_SIGN_INFO
350 select ASYMMETRIC_KEY_TYPE
351 select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
352 select X509_CERTIFICATE_PARSER
353 select PKCS7_MESSAGE_PARSER
AKASHI Takahiro14afd062020-07-21 19:35:22 +0900354 select PKCS7_VERIFY
Masahisa Kojima915e4272021-05-14 09:53:36 +0900355 select EFI_SIGNATURE_SUPPORT
AKASHI Takahiro1900a3b2020-04-14 11:51:38 +0900356 help
357 Select this option to enable EFI secure boot support.
358 Once SecureBoot mode is enforced, any EFI binary can run only if
359 it is signed with a trusted key. To do that, you need to install,
360 at least, PK, KEK and db.
361
Masahisa Kojima915e4272021-05-14 09:53:36 +0900362config EFI_SIGNATURE_SUPPORT
363 bool
364
Jose Marinhoebb61ee2021-03-02 17:26:38 +0000365config EFI_ESRT
366 bool "Enable the UEFI ESRT generation"
367 depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
368 default y
369 help
370 Enabling this option creates the ESRT UEFI system table.
371
Heinrich Schuchardt0cbab582019-05-08 23:17:38 +0200372endif