1# SPDX-License-Identifier: GPL-2.0-only
  2menu "EFI (Extensible Firmware Interface) Support"
  3	depends on EFI
  4
  5config EFI_ESRT
  6	bool
  7	depends on EFI && !IA64
  8	default y
  9
 10config EFI_VARS_PSTORE
 11	tristate "Register efivars backend for pstore"
 12	depends on PSTORE
 13	select UCS2_STRING
 14	default y
 15	help
 16	  Say Y here to enable use efivars as a backend to pstore. This
 17	  will allow writing console messages, crash dumps, or anything
 18	  else supported by pstore to EFI variables.
 19
 20config EFI_VARS_PSTORE_DEFAULT_DISABLE
 21	bool "Disable using efivars as a pstore backend by default"
 22	depends on EFI_VARS_PSTORE
 23	default n
 24	help
 25	  Saying Y here will disable the use of efivars as a storage
 26	  backend for pstore by default. This setting can be overridden
 27	  using the efivars module's pstore_disable parameter.
 28
 29config EFI_SOFT_RESERVE
 30	bool "Reserve EFI Specific Purpose Memory"
 31	depends on EFI && EFI_STUB && ACPI_HMAT
 32	default ACPI_HMAT
 33	help
 34	  On systems that have mixed performance classes of memory EFI
 35	  may indicate specific purpose memory with an attribute (See
 36	  EFI_MEMORY_SP in UEFI 2.8). A memory range tagged with this
 37	  attribute may have unique performance characteristics compared
 38	  to the system's general purpose "System RAM" pool. On the
 39	  expectation that such memory has application specific usage,
 40	  and its base EFI memory type is "conventional" answer Y to
 41	  arrange for the kernel to reserve it as a "Soft Reserved"
 42	  resource, and set aside for direct-access (device-dax) by
 43	  default. The memory range can later be optionally assigned to
 44	  the page allocator by system administrator policy via the
 45	  device-dax kmem facility. Say N to have the kernel treat this
 46	  memory as "System RAM" by default.
 47
 48	  If unsure, say Y.
 49
 50config EFI_DXE_MEM_ATTRIBUTES
 51	bool "Adjust memory attributes in EFISTUB"
 52	depends on EFI && EFI_STUB && X86
 53	default y
 54	help
 55	  UEFI specification does not guarantee all memory to be
 56	  accessible for both write and execute as the kernel expects
 57	  it to be.
 58	  Use DXE services to check and alter memory protection
 59	  attributes during boot via EFISTUB to ensure that memory
 60	  ranges used by the kernel are writable and executable.
 61
 62config EFI_PARAMS_FROM_FDT
 63	bool
 64	help
 65	  Select this config option from the architecture Kconfig if
 66	  the EFI runtime support gets system table address, memory
 67          map address, and other parameters from the device tree.
 68
 69config EFI_RUNTIME_WRAPPERS
 70	bool
 71
 72config EFI_GENERIC_STUB
 73	bool
 74
 75config EFI_ZBOOT
 76	bool "Enable the generic EFI decompressor"
 77	depends on EFI_GENERIC_STUB && !ARM
 78	select HAVE_KERNEL_GZIP
 79	select HAVE_KERNEL_LZ4
 80	select HAVE_KERNEL_LZMA
 81	select HAVE_KERNEL_LZO
 82	select HAVE_KERNEL_XZ
 83	select HAVE_KERNEL_ZSTD
 84	help
 85	  Create the bootable image as an EFI application that carries the
 86	  actual kernel image in compressed form, and decompresses it into
 87	  memory before executing it via LoadImage/StartImage EFI boot service
 88	  calls. For compatibility with non-EFI loaders, the payload can be
 89	  decompressed and executed by the loader as well, provided that the
 90	  loader implements the decompression algorithm and that non-EFI boot
 91	  is supported by the encapsulated image. (The compression algorithm
 92	  used is described in the zboot image header)
 93
 94config EFI_ARMSTUB_DTB_LOADER
 95	bool "Enable the DTB loader"
 96	depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH
 97	default y
 98	help
 99	  Select this config option to add support for the dtb= command
100	  line parameter, allowing a device tree blob to be loaded into
101	  memory from the EFI System Partition by the stub.
102
103	  If the device tree is provided by the platform or by
104	  the bootloader this option may not be needed.
105	  But, for various development reasons and to maintain existing
106	  functionality for bootloaders that do not have such support
107	  this option is necessary.
108
109config EFI_BOOTLOADER_CONTROL
110	tristate "EFI Bootloader Control"
111	select UCS2_STRING
112	default n
113	help
114	  This module installs a reboot hook, such that if reboot() is
115	  invoked with a string argument NNN, "NNN" is copied to the
116	  "LoaderEntryOneShot" EFI variable, to be read by the
117	  bootloader. If the string matches one of the boot labels
118	  defined in its configuration, the bootloader will boot once
119	  to that label. The "LoaderEntryRebootReason" EFI variable is
120	  set with the reboot reason: "reboot" or "shutdown". The
121	  bootloader reads this reboot reason and takes particular
122	  action according to its policy.
123
124config EFI_CAPSULE_LOADER
125	tristate "EFI capsule loader"
126	depends on EFI && !IA64
127	help
128	  This option exposes a loader interface "/dev/efi_capsule_loader" for
129	  users to load EFI capsules. This driver requires working runtime
130	  capsule support in the firmware, which many OEMs do not provide.
131
132	  Most users should say N.
133
134config EFI_CAPSULE_QUIRK_QUARK_CSH
135	bool "Add support for Quark capsules with non-standard headers"
136	depends on X86 && !64BIT
137	select EFI_CAPSULE_LOADER
138	default y
139	help
140	  Add support for processing Quark X1000 EFI capsules, whose header
141	  layout deviates from the layout mandated by the UEFI specification.
142
143config EFI_TEST
144	tristate "EFI Runtime Service Tests Support"
145	depends on EFI
146	default n
147	help
148	  This driver uses the efi.<service> function pointers directly instead
149	  of going through the efivar API, because it is not trying to test the
150	  kernel subsystem, just for testing the UEFI runtime service
151	  interfaces which are provided by the firmware. This driver is used
152	  by the Firmware Test Suite (FWTS) for testing the UEFI runtime
153	  interfaces readiness of the firmware.
154	  Details for FWTS are available from:
155	  <https://wiki.ubuntu.com/FirmwareTestSuite>
156
157	  Say Y here to enable the runtime services support via /dev/efi_test.
158	  If unsure, say N.
159
160config EFI_DEV_PATH_PARSER
161	bool
162
163config APPLE_PROPERTIES
164	bool "Apple Device Properties"
165	depends on EFI_STUB && X86
166	select EFI_DEV_PATH_PARSER
167	select UCS2_STRING
168	help
169	  Retrieve properties from EFI on Apple Macs and assign them to
170	  devices, allowing for improved support of Apple hardware.
171	  Properties that would otherwise be missing include the
172	  Thunderbolt Device ROM and GPU configuration data.
173
174	  If unsure, say Y if you have a Mac.  Otherwise N.
175
176config RESET_ATTACK_MITIGATION
177	bool "Reset memory attack mitigation"
178	depends on EFI_STUB
179	help
180	  Request that the firmware clear the contents of RAM after a reboot
181	  using the TCG Platform Reset Attack Mitigation specification. This
182	  protects against an attacker forcibly rebooting the system while it
183	  still contains secrets in RAM, booting another OS and extracting the
184	  secrets. This should only be enabled when userland is configured to
185	  clear the MemoryOverwriteRequest flag on clean shutdown after secrets
186	  have been evicted, since otherwise it will trigger even on clean
187	  reboots.
188
189config EFI_RCI2_TABLE
190	bool "EFI Runtime Configuration Interface Table Version 2 Support"
191	depends on X86 || COMPILE_TEST
192	help
193	  Displays the content of the Runtime Configuration Interface
194	  Table version 2 on Dell EMC PowerEdge systems as a binary
195	  attribute 'rci2' under /sys/firmware/efi/tables directory.
196
197	  RCI2 table contains BIOS HII in XML format and is used to populate
198	  BIOS setup page in Dell EMC OpenManage Server Administrator tool.
199	  The BIOS setup page contains BIOS tokens which can be configured.
200
201	  Say Y here for Dell EMC PowerEdge systems.
202
203config EFI_DISABLE_PCI_DMA
204       bool "Clear Busmaster bit on PCI bridges during ExitBootServices()"
205       help
206	  Disable the busmaster bit in the control register on all PCI bridges
207	  while calling ExitBootServices() and passing control to the runtime
208	  kernel. System firmware may configure the IOMMU to prevent malicious
209	  PCI devices from being able to attack the OS via DMA. However, since
210	  firmware can't guarantee that the OS is IOMMU-aware, it will tear
211	  down IOMMU configuration when ExitBootServices() is called. This
212	  leaves a window between where a hostile device could still cause
213	  damage before Linux configures the IOMMU again.
214
215	  If you say Y here, the EFI stub will clear the busmaster bit on all
216	  PCI bridges before ExitBootServices() is called. This will prevent
217	  any malicious PCI devices from being able to perform DMA until the
218	  kernel reenables busmastering after configuring the IOMMU.
219
220	  This option will cause failures with some poorly behaved hardware
221	  and should not be enabled without testing. The kernel commandline
222	  options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma"
223	  may be used to override this option.
224
225config EFI_EARLYCON
226	def_bool y
227	depends on SERIAL_EARLYCON && !ARM && !IA64
228	select FONT_SUPPORT
229	select ARCH_USE_MEMREMAP_PROT
230
231config EFI_CUSTOM_SSDT_OVERLAYS
232	bool "Load custom ACPI SSDT overlay from an EFI variable"
233	depends on ACPI
234	default ACPI_TABLE_UPGRADE
235	help
236	  Allow loading of an ACPI SSDT overlay from an EFI variable specified
237	  by a kernel command line option.
238
239	  See Documentation/admin-guide/acpi/ssdt-overlays.rst for more
240	  information.
241
242config EFI_DISABLE_RUNTIME
243	bool "Disable EFI runtime services support by default"
244	default y if PREEMPT_RT
245	help
246	  Allow to disable the EFI runtime services support by default. This can
247	  already be achieved by using the efi=noruntime option, but it could be
248	  useful to have this default without any kernel command line parameter.
249
250	  The EFI runtime services are disabled by default when PREEMPT_RT is
251	  enabled, because measurements have shown that some EFI functions calls
252	  might take too much time to complete, causing large latencies which is
253	  an issue for Real-Time kernels.
254
255	  This default can be overridden by using the efi=runtime option.
256
257config EFI_COCO_SECRET
258	bool "EFI Confidential Computing Secret Area Support"
259	help
260	  Confidential Computing platforms (such as AMD SEV) allow the
261	  Guest Owner to securely inject secrets during guest VM launch.
262	  The secrets are placed in a designated EFI reserved memory area.
263
264	  In order to use the secrets in the kernel, the location of the secret
265	  area (as published in the EFI config table) must be kept.
266
267	  If you say Y here, the address of the EFI secret area will be kept
268	  for usage inside the kernel.  This will allow the
269	  virt/coco/efi_secret module to access the secrets, which in turn
270	  allows userspace programs to access the injected secrets.
271
272config EFI_EMBEDDED_FIRMWARE
273	bool
274	select CRYPTO_LIB_SHA256
275
276endmenu
277
278config UEFI_CPER
279	bool
280
281config UEFI_CPER_ARM
282	bool
283	depends on UEFI_CPER && ( ARM || ARM64 )
284	default y
285
286config UEFI_CPER_X86
287	bool
288	depends on UEFI_CPER && X86
289	default y