319 lines · plain
1# SPDX-License-Identifier: GPL-2.0-only2menu "EFI (Extensible Firmware Interface) Support"3 depends on EFI4 5config EFI_ESRT6 bool7 depends on EFI8 default y9 10config EFI_VARS_PSTORE11 tristate "Register efivars backend for pstore"12 depends on PSTORE13 select UCS2_STRING14 default y15 help16 Say Y here to enable use efivars as a backend to pstore. This17 will allow writing console messages, crash dumps, or anything18 else supported by pstore to EFI variables.19 20config EFI_VARS_PSTORE_DEFAULT_DISABLE21 bool "Disable using efivars as a pstore backend by default"22 depends on EFI_VARS_PSTORE23 default n24 help25 Saying Y here will disable the use of efivars as a storage26 backend for pstore by default. This setting can be overridden27 using the efivars module's pstore_disable parameter.28 29config EFI_SOFT_RESERVE30 bool "Reserve EFI Specific Purpose Memory"31 depends on EFI && EFI_STUB && ACPI_HMAT32 default ACPI_HMAT33 help34 On systems that have mixed performance classes of memory EFI35 may indicate specific purpose memory with an attribute (See36 EFI_MEMORY_SP in UEFI 2.8). A memory range tagged with this37 attribute may have unique performance characteristics compared38 to the system's general purpose "System RAM" pool. On the39 expectation that such memory has application specific usage,40 and its base EFI memory type is "conventional" answer Y to41 arrange for the kernel to reserve it as a "Soft Reserved"42 resource, and set aside for direct-access (device-dax) by43 default. The memory range can later be optionally assigned to44 the page allocator by system administrator policy via the45 device-dax kmem facility. Say N to have the kernel treat this46 memory as "System RAM" by default.47 48 If unsure, say Y.49 50config EFI_DXE_MEM_ATTRIBUTES51 bool "Adjust memory attributes in EFISTUB"52 depends on EFI && EFI_STUB && X8653 default y54 help55 UEFI specification does not guarantee all memory to be56 accessible for both write and execute as the kernel expects57 it to be.58 Use DXE services to check and alter memory protection59 attributes during boot via EFISTUB to ensure that memory60 ranges used by the kernel are writable and executable.61 62config EFI_PARAMS_FROM_FDT63 bool64 help65 Select this config option from the architecture Kconfig if66 the EFI runtime support gets system table address, memory67 map address, and other parameters from the device tree.68 69config EFI_RUNTIME_WRAPPERS70 bool71 72config EFI_GENERIC_STUB73 bool74 75config EFI_ZBOOT76 bool "Enable the generic EFI decompressor"77 depends on EFI_GENERIC_STUB && !ARM78 select HAVE_KERNEL_GZIP79 select HAVE_KERNEL_LZ480 select HAVE_KERNEL_LZMA81 select HAVE_KERNEL_LZO82 select HAVE_KERNEL_XZ83 select HAVE_KERNEL_ZSTD84 help85 Create the bootable image as an EFI application that carries the86 actual kernel image in compressed form, and decompresses it into87 memory before executing it via LoadImage/StartImage EFI boot service88 calls. For compatibility with non-EFI loaders, the payload can be89 decompressed and executed by the loader as well, provided that the90 loader implements the decompression algorithm and that non-EFI boot91 is supported by the encapsulated image. (The compression algorithm92 used is described in the zboot image header)93 94config EFI_ARMSTUB_DTB_LOADER95 bool "Enable the DTB loader"96 depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH97 default y98 help99 Select this config option to add support for the dtb= command100 line parameter, allowing a device tree blob to be loaded into101 memory from the EFI System Partition by the stub.102 103 If the device tree is provided by the platform or by104 the bootloader this option may not be needed.105 But, for various development reasons and to maintain existing106 functionality for bootloaders that do not have such support107 this option is necessary.108 109config EFI_BOOTLOADER_CONTROL110 tristate "EFI Bootloader Control"111 select UCS2_STRING112 default n113 help114 This module installs a reboot hook, such that if reboot() is115 invoked with a string argument NNN, "NNN" is copied to the116 "LoaderEntryOneShot" EFI variable, to be read by the117 bootloader. If the string matches one of the boot labels118 defined in its configuration, the bootloader will boot once119 to that label. The "LoaderEntryRebootReason" EFI variable is120 set with the reboot reason: "reboot" or "shutdown". The121 bootloader reads this reboot reason and takes particular122 action according to its policy.123 124config EFI_CAPSULE_LOADER125 tristate "EFI capsule loader"126 depends on EFI127 help128 This option exposes a loader interface "/dev/efi_capsule_loader" for129 users to load EFI capsules. This driver requires working runtime130 capsule support in the firmware, which many OEMs do not provide.131 132 Most users should say N.133 134config EFI_CAPSULE_QUIRK_QUARK_CSH135 bool "Add support for Quark capsules with non-standard headers"136 depends on X86 && !64BIT137 select EFI_CAPSULE_LOADER138 default y139 help140 Add support for processing Quark X1000 EFI capsules, whose header141 layout deviates from the layout mandated by the UEFI specification.142 143config EFI_TEST144 tristate "EFI Runtime Service Tests Support"145 depends on EFI146 default n147 help148 This driver uses the efi.<service> function pointers directly instead149 of going through the efivar API, because it is not trying to test the150 kernel subsystem, just for testing the UEFI runtime service151 interfaces which are provided by the firmware. This driver is used152 by the Firmware Test Suite (FWTS) for testing the UEFI runtime153 interfaces readiness of the firmware.154 Details for FWTS are available from:155 <https://wiki.ubuntu.com/FirmwareTestSuite>156 157 Say Y here to enable the runtime services support via /dev/efi_test.158 If unsure, say N.159 160config EFI_DEV_PATH_PARSER161 bool162 163config APPLE_PROPERTIES164 bool "Apple Device Properties"165 depends on EFI_STUB && X86166 select EFI_DEV_PATH_PARSER167 select UCS2_STRING168 help169 Retrieve properties from EFI on Apple Macs and assign them to170 devices, allowing for improved support of Apple hardware.171 Properties that would otherwise be missing include the172 Thunderbolt Device ROM and GPU configuration data.173 174 If unsure, say Y if you have a Mac. Otherwise N.175 176config RESET_ATTACK_MITIGATION177 bool "Reset memory attack mitigation"178 depends on EFI_STUB179 help180 Request that the firmware clear the contents of RAM after a reboot181 using the TCG Platform Reset Attack Mitigation specification. This182 protects against an attacker forcibly rebooting the system while it183 still contains secrets in RAM, booting another OS and extracting the184 secrets. This should only be enabled when userland is configured to185 clear the MemoryOverwriteRequest flag on clean shutdown after secrets186 have been evicted, since otherwise it will trigger even on clean187 reboots.188 189config EFI_RCI2_TABLE190 bool "EFI Runtime Configuration Interface Table Version 2 Support"191 depends on X86 || COMPILE_TEST192 help193 Displays the content of the Runtime Configuration Interface194 Table version 2 on Dell EMC PowerEdge systems as a binary195 attribute 'rci2' under /sys/firmware/efi/tables directory.196 197 RCI2 table contains BIOS HII in XML format and is used to populate198 BIOS setup page in Dell EMC OpenManage Server Administrator tool.199 The BIOS setup page contains BIOS tokens which can be configured.200 201 Say Y here for Dell EMC PowerEdge systems.202 203config EFI_DISABLE_PCI_DMA204 bool "Clear Busmaster bit on PCI bridges during ExitBootServices()"205 help206 Disable the busmaster bit in the control register on all PCI bridges207 while calling ExitBootServices() and passing control to the runtime208 kernel. System firmware may configure the IOMMU to prevent malicious209 PCI devices from being able to attack the OS via DMA. However, since210 firmware can't guarantee that the OS is IOMMU-aware, it will tear211 down IOMMU configuration when ExitBootServices() is called. This212 leaves a window between where a hostile device could still cause213 damage before Linux configures the IOMMU again.214 215 If you say Y here, the EFI stub will clear the busmaster bit on all216 PCI bridges before ExitBootServices() is called. This will prevent217 any malicious PCI devices from being able to perform DMA until the218 kernel reenables busmastering after configuring the IOMMU.219 220 This option will cause failures with some poorly behaved hardware221 and should not be enabled without testing. The kernel commandline222 options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma"223 may be used to override this option.224 225config EFI_EARLYCON226 def_bool y227 depends on SERIAL_EARLYCON && !ARM228 select FONT_SUPPORT229 select ARCH_USE_MEMREMAP_PROT230 231config EFI_CUSTOM_SSDT_OVERLAYS232 bool "Load custom ACPI SSDT overlay from an EFI variable"233 depends on ACPI234 default ACPI_TABLE_UPGRADE235 help236 Allow loading of an ACPI SSDT overlay from an EFI variable specified237 by a kernel command line option.238 239 See Documentation/admin-guide/acpi/ssdt-overlays.rst for more240 information.241 242config EFI_DISABLE_RUNTIME243 bool "Disable EFI runtime services support by default"244 default y if PREEMPT_RT245 help246 Allow to disable the EFI runtime services support by default. This can247 already be achieved by using the efi=noruntime option, but it could be248 useful to have this default without any kernel command line parameter.249 250 The EFI runtime services are disabled by default when PREEMPT_RT is251 enabled, because measurements have shown that some EFI functions calls252 might take too much time to complete, causing large latencies which is253 an issue for Real-Time kernels.254 255 This default can be overridden by using the efi=runtime option.256 257config EFI_COCO_SECRET258 bool "EFI Confidential Computing Secret Area Support"259 help260 Confidential Computing platforms (such as AMD SEV) allow the261 Guest Owner to securely inject secrets during guest VM launch.262 The secrets are placed in a designated EFI reserved memory area.263 264 In order to use the secrets in the kernel, the location of the secret265 area (as published in the EFI config table) must be kept.266 267 If you say Y here, the address of the EFI secret area will be kept268 for usage inside the kernel. This will allow the269 virt/coco/efi_secret module to access the secrets, which in turn270 allows userspace programs to access the injected secrets.271 272config UNACCEPTED_MEMORY273 bool274 depends on EFI_STUB275 help276 Some Virtual Machine platforms, such as Intel TDX, require277 some memory to be "accepted" by the guest before it can be used.278 This mechanism helps prevent malicious hosts from making changes279 to guest memory.280 281 UEFI specification v2.9 introduced EFI_UNACCEPTED_MEMORY memory type.282 283 This option adds support for unaccepted memory and makes such memory284 usable by the kernel.285 286config EFI_EMBEDDED_FIRMWARE287 bool288 select CRYPTO_LIB_SHA256289 290endmenu291 292config UEFI_CPER293 bool294 295config UEFI_CPER_ARM296 bool297 depends on UEFI_CPER && ( ARM || ARM64 )298 default y299 300config UEFI_CPER_X86301 bool302 depends on UEFI_CPER && X86303 default y304 305config TEE_STMM_EFI306 tristate "TEE-based EFI runtime variable service driver"307 depends on EFI && OPTEE308 help309 Select this config option if TEE is compiled to include StandAloneMM310 as a separate secure partition. It has the ability to check and store311 EFI variables on an RPMB or any other non-volatile medium used by312 StandAloneMM.313 314 Enabling this will change the EFI runtime services from the firmware315 provided functions to TEE calls.316 317 To compile this driver as a module, choose M here: the module318 will be called tee_stmm_efi.319