1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 204851772SMatt Flemingmenu "EFI (Extensible Firmware Interface) Support" 304851772SMatt Fleming depends on EFI 404851772SMatt Fleming 53846c158SPeter Jonesconfig EFI_ESRT 63846c158SPeter Jones bool 7cf8e8658SArd Biesheuvel depends on EFI 83846c158SPeter Jones default y 93846c158SPeter Jones 1004851772SMatt Flemingconfig EFI_VARS_PSTORE 1104851772SMatt Fleming tristate "Register efivars backend for pstore" 12232f4eb6SArd Biesheuvel depends on PSTORE 1385974825SArd Biesheuvel select UCS2_STRING 1404851772SMatt Fleming default y 1504851772SMatt Fleming help 1604851772SMatt Fleming Say Y here to enable use efivars as a backend to pstore. This 1704851772SMatt Fleming will allow writing console messages, crash dumps, or anything 1804851772SMatt Fleming else supported by pstore to EFI variables. 1904851772SMatt Fleming 2004851772SMatt Flemingconfig EFI_VARS_PSTORE_DEFAULT_DISABLE 2104851772SMatt Fleming bool "Disable using efivars as a pstore backend by default" 2204851772SMatt Fleming depends on EFI_VARS_PSTORE 2304851772SMatt Fleming default n 2404851772SMatt Fleming help 2504851772SMatt Fleming Saying Y here will disable the use of efivars as a storage 2604851772SMatt Fleming backend for pstore by default. This setting can be overridden 2704851772SMatt Fleming using the efivars module's pstore_disable parameter. 2804851772SMatt Fleming 29b617c526SDan Williamsconfig EFI_SOFT_RESERVE 30b617c526SDan Williams bool "Reserve EFI Specific Purpose Memory" 31b617c526SDan Williams depends on EFI && EFI_STUB && ACPI_HMAT 32b617c526SDan Williams default ACPI_HMAT 33b617c526SDan Williams help 34b617c526SDan Williams On systems that have mixed performance classes of memory EFI 35b617c526SDan Williams may indicate specific purpose memory with an attribute (See 36b617c526SDan Williams EFI_MEMORY_SP in UEFI 2.8). A memory range tagged with this 37b617c526SDan Williams attribute may have unique performance characteristics compared 38b617c526SDan Williams to the system's general purpose "System RAM" pool. On the 39b617c526SDan Williams expectation that such memory has application specific usage, 40b617c526SDan Williams and its base EFI memory type is "conventional" answer Y to 41b617c526SDan Williams arrange for the kernel to reserve it as a "Soft Reserved" 42b617c526SDan Williams resource, and set aside for direct-access (device-dax) by 43b617c526SDan Williams default. The memory range can later be optionally assigned to 44b617c526SDan Williams the page allocator by system administrator policy via the 45b617c526SDan Williams device-dax kmem facility. Say N to have the kernel treat this 46b617c526SDan Williams memory as "System RAM" by default. 47b617c526SDan Williams 48b617c526SDan Williams If unsure, say Y. 49b617c526SDan Williams 5082e0d6d7SBaskov Evgeniyconfig EFI_DXE_MEM_ATTRIBUTES 5182e0d6d7SBaskov Evgeniy bool "Adjust memory attributes in EFISTUB" 5282e0d6d7SBaskov Evgeniy depends on EFI && EFI_STUB && X86 5382e0d6d7SBaskov Evgeniy default y 5482e0d6d7SBaskov Evgeniy help 5582e0d6d7SBaskov Evgeniy UEFI specification does not guarantee all memory to be 5682e0d6d7SBaskov Evgeniy accessible for both write and execute as the kernel expects 5782e0d6d7SBaskov Evgeniy it to be. 5882e0d6d7SBaskov Evgeniy Use DXE services to check and alter memory protection 5982e0d6d7SBaskov Evgeniy attributes during boot via EFISTUB to ensure that memory 6082e0d6d7SBaskov Evgeniy ranges used by the kernel are writable and executable. 6182e0d6d7SBaskov Evgeniy 620302f71cSMark Salterconfig EFI_PARAMS_FROM_FDT 630302f71cSMark Salter bool 640302f71cSMark Salter help 650302f71cSMark Salter Select this config option from the architecture Kconfig if 660302f71cSMark Salter the EFI runtime support gets system table address, memory 670302f71cSMark Salter map address, and other parameters from the device tree. 680302f71cSMark Salter 69022ee6c5SArd Biesheuvelconfig EFI_RUNTIME_WRAPPERS 70022ee6c5SArd Biesheuvel bool 71022ee6c5SArd Biesheuvel 722e0eb483SAtish Patraconfig EFI_GENERIC_STUB 73f4f75ad5SArd Biesheuvel bool 74f4f75ad5SArd Biesheuvel 75a0509109SArd Biesheuvelconfig EFI_ZBOOT 76a0509109SArd Biesheuvel bool "Enable the generic EFI decompressor" 77a0509109SArd Biesheuvel depends on EFI_GENERIC_STUB && !ARM 78a0509109SArd Biesheuvel select HAVE_KERNEL_GZIP 79a0509109SArd Biesheuvel select HAVE_KERNEL_ZSTD 80a0509109SArd Biesheuvel help 81a0509109SArd Biesheuvel Create the bootable image as an EFI application that carries the 82a0509109SArd Biesheuvel actual kernel image in compressed form, and decompresses it into 836fce6e97SArd Biesheuvel memory before executing it. For compatibility with non-EFI loaders, 846fce6e97SArd Biesheuvel the payload can be decompressed and executed by the loader as well, 856fce6e97SArd Biesheuvel provided that the loader implements the decompression algorithm. 866fce6e97SArd Biesheuvel (The compression algorithm used is described in the zboot header) 87a0509109SArd Biesheuvel 883d7ee348SArd Biesheuvelconfig EFI_ARMSTUB_DTB_LOADER 893d7ee348SArd Biesheuvel bool "Enable the DTB loader" 90ead384d9SHuacai Chen depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH 91d3109593SScott Branden default y 923d7ee348SArd Biesheuvel help 933d7ee348SArd Biesheuvel Select this config option to add support for the dtb= command 943d7ee348SArd Biesheuvel line parameter, allowing a device tree blob to be loaded into 953d7ee348SArd Biesheuvel memory from the EFI System Partition by the stub. 963d7ee348SArd Biesheuvel 97d3109593SScott Branden If the device tree is provided by the platform or by 98d3109593SScott Branden the bootloader this option may not be needed. 99d3109593SScott Branden But, for various development reasons and to maintain existing 100d3109593SScott Branden functionality for bootloaders that do not have such support 101d3109593SScott Branden this option is necessary. 1023d7ee348SArd Biesheuvel 10306f7d4a1SCompostella, Jeremyconfig EFI_BOOTLOADER_CONTROL 10406f7d4a1SCompostella, Jeremy tristate "EFI Bootloader Control" 105416581e4SArd Biesheuvel select UCS2_STRING 10606f7d4a1SCompostella, Jeremy default n 107a7f7f624SMasahiro Yamada help 10806f7d4a1SCompostella, Jeremy This module installs a reboot hook, such that if reboot() is 10906f7d4a1SCompostella, Jeremy invoked with a string argument NNN, "NNN" is copied to the 11006f7d4a1SCompostella, Jeremy "LoaderEntryOneShot" EFI variable, to be read by the 11106f7d4a1SCompostella, Jeremy bootloader. If the string matches one of the boot labels 11206f7d4a1SCompostella, Jeremy defined in its configuration, the bootloader will boot once 11306f7d4a1SCompostella, Jeremy to that label. The "LoaderEntryRebootReason" EFI variable is 11406f7d4a1SCompostella, Jeremy set with the reboot reason: "reboot" or "shutdown". The 11506f7d4a1SCompostella, Jeremy bootloader reads this reboot reason and takes particular 11606f7d4a1SCompostella, Jeremy action according to its policy. 11706f7d4a1SCompostella, Jeremy 11865117f1aSKweh, Hock Leongconfig EFI_CAPSULE_LOADER 11965117f1aSKweh, Hock Leong tristate "EFI capsule loader" 120cf8e8658SArd Biesheuvel depends on EFI 12165117f1aSKweh, Hock Leong help 12265117f1aSKweh, Hock Leong This option exposes a loader interface "/dev/efi_capsule_loader" for 12365117f1aSKweh, Hock Leong users to load EFI capsules. This driver requires working runtime 12465117f1aSKweh, Hock Leong capsule support in the firmware, which many OEMs do not provide. 12565117f1aSKweh, Hock Leong 12665117f1aSKweh, Hock Leong Most users should say N. 12765117f1aSKweh, Hock Leong 1282959c95dSJan Kiszkaconfig EFI_CAPSULE_QUIRK_QUARK_CSH 1291ae83c5cSMasahiro Yamada bool "Add support for Quark capsules with non-standard headers" 1302959c95dSJan Kiszka depends on X86 && !64BIT 1312959c95dSJan Kiszka select EFI_CAPSULE_LOADER 1322959c95dSJan Kiszka default y 1332959c95dSJan Kiszka help 1342959c95dSJan Kiszka Add support for processing Quark X1000 EFI capsules, whose header 1352959c95dSJan Kiszka layout deviates from the layout mandated by the UEFI specification. 1362959c95dSJan Kiszka 137ff6301daSIvan Huconfig EFI_TEST 138ff6301daSIvan Hu tristate "EFI Runtime Service Tests Support" 139ff6301daSIvan Hu depends on EFI 140ff6301daSIvan Hu default n 141ff6301daSIvan Hu help 142ff6301daSIvan Hu This driver uses the efi.<service> function pointers directly instead 143ff6301daSIvan Hu of going through the efivar API, because it is not trying to test the 144ff6301daSIvan Hu kernel subsystem, just for testing the UEFI runtime service 145ff6301daSIvan Hu interfaces which are provided by the firmware. This driver is used 146ff6301daSIvan Hu by the Firmware Test Suite (FWTS) for testing the UEFI runtime 147ff6301daSIvan Hu interfaces readiness of the firmware. 148ff6301daSIvan Hu Details for FWTS are available from: 149ff6301daSIvan Hu <https://wiki.ubuntu.com/FirmwareTestSuite> 150ff6301daSIvan Hu 151ff6301daSIvan Hu Say Y here to enable the runtime services support via /dev/efi_test. 152ff6301daSIvan Hu If unsure, say N. 153ff6301daSIvan Hu 15475ed63d9SArd Biesheuvelconfig EFI_DEV_PATH_PARSER 15575ed63d9SArd Biesheuvel bool 15675ed63d9SArd Biesheuvel 15758c5475aSLukas Wunnerconfig APPLE_PROPERTIES 15858c5475aSLukas Wunner bool "Apple Device Properties" 15958c5475aSLukas Wunner depends on EFI_STUB && X86 16058c5475aSLukas Wunner select EFI_DEV_PATH_PARSER 16158c5475aSLukas Wunner select UCS2_STRING 16258c5475aSLukas Wunner help 16358c5475aSLukas Wunner Retrieve properties from EFI on Apple Macs and assign them to 16458c5475aSLukas Wunner devices, allowing for improved support of Apple hardware. 16558c5475aSLukas Wunner Properties that would otherwise be missing include the 16658c5475aSLukas Wunner Thunderbolt Device ROM and GPU configuration data. 16758c5475aSLukas Wunner 16858c5475aSLukas Wunner If unsure, say Y if you have a Mac. Otherwise N. 16958c5475aSLukas Wunner 170ccc829baSMatthew Garrettconfig RESET_ATTACK_MITIGATION 171ccc829baSMatthew Garrett bool "Reset memory attack mitigation" 172ccc829baSMatthew Garrett depends on EFI_STUB 173ccc829baSMatthew Garrett help 174ccc829baSMatthew Garrett Request that the firmware clear the contents of RAM after a reboot 175ccc829baSMatthew Garrett using the TCG Platform Reset Attack Mitigation specification. This 176ccc829baSMatthew Garrett protects against an attacker forcibly rebooting the system while it 177ccc829baSMatthew Garrett still contains secrets in RAM, booting another OS and extracting the 178a5c03c31SMatthew Garrett secrets. This should only be enabled when userland is configured to 179a5c03c31SMatthew Garrett clear the MemoryOverwriteRequest flag on clean shutdown after secrets 180a5c03c31SMatthew Garrett have been evicted, since otherwise it will trigger even on clean 181a5c03c31SMatthew Garrett reboots. 182ccc829baSMatthew Garrett 1831c5fecb6SNarendra Kconfig EFI_RCI2_TABLE 1841c5fecb6SNarendra K bool "EFI Runtime Configuration Interface Table Version 2 Support" 1850b6b30c6SNarendra K depends on X86 || COMPILE_TEST 1861c5fecb6SNarendra K help 1871c5fecb6SNarendra K Displays the content of the Runtime Configuration Interface 1881c5fecb6SNarendra K Table version 2 on Dell EMC PowerEdge systems as a binary 1891c5fecb6SNarendra K attribute 'rci2' under /sys/firmware/efi/tables directory. 1901c5fecb6SNarendra K 1911c5fecb6SNarendra K RCI2 table contains BIOS HII in XML format and is used to populate 1921c5fecb6SNarendra K BIOS setup page in Dell EMC OpenManage Server Administrator tool. 1931c5fecb6SNarendra K The BIOS setup page contains BIOS tokens which can be configured. 1941c5fecb6SNarendra K 1951c5fecb6SNarendra K Say Y here for Dell EMC PowerEdge systems. 1961c5fecb6SNarendra K 1974444f854SMatthew Garrettconfig EFI_DISABLE_PCI_DMA 1984444f854SMatthew Garrett bool "Clear Busmaster bit on PCI bridges during ExitBootServices()" 1994444f854SMatthew Garrett help 2004444f854SMatthew Garrett Disable the busmaster bit in the control register on all PCI bridges 2014444f854SMatthew Garrett while calling ExitBootServices() and passing control to the runtime 2024444f854SMatthew Garrett kernel. System firmware may configure the IOMMU to prevent malicious 2034444f854SMatthew Garrett PCI devices from being able to attack the OS via DMA. However, since 2044444f854SMatthew Garrett firmware can't guarantee that the OS is IOMMU-aware, it will tear 2054444f854SMatthew Garrett down IOMMU configuration when ExitBootServices() is called. This 2064444f854SMatthew Garrett leaves a window between where a hostile device could still cause 2074444f854SMatthew Garrett damage before Linux configures the IOMMU again. 2084444f854SMatthew Garrett 2094444f854SMatthew Garrett If you say Y here, the EFI stub will clear the busmaster bit on all 2104444f854SMatthew Garrett PCI bridges before ExitBootServices() is called. This will prevent 2114444f854SMatthew Garrett any malicious PCI devices from being able to perform DMA until the 2124444f854SMatthew Garrett kernel reenables busmastering after configuring the IOMMU. 2134444f854SMatthew Garrett 2144444f854SMatthew Garrett This option will cause failures with some poorly behaved hardware 2154444f854SMatthew Garrett and should not be enabled without testing. The kernel commandline 2164444f854SMatthew Garrett options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma" 2174444f854SMatthew Garrett may be used to override this option. 2184444f854SMatthew Garrett 21969c1f396SArd Biesheuvelconfig EFI_EARLYCON 22069c1f396SArd Biesheuvel def_bool y 221cf8e8658SArd Biesheuvel depends on SERIAL_EARLYCON && !ARM 22269c1f396SArd Biesheuvel select FONT_SUPPORT 22369c1f396SArd Biesheuvel select ARCH_USE_MEMREMAP_PROT 224435d1a47SPeter Jones 225435d1a47SPeter Jonesconfig EFI_CUSTOM_SSDT_OVERLAYS 226435d1a47SPeter Jones bool "Load custom ACPI SSDT overlay from an EFI variable" 22775ed63d9SArd Biesheuvel depends on ACPI 228435d1a47SPeter Jones default ACPI_TABLE_UPGRADE 229435d1a47SPeter Jones help 230435d1a47SPeter Jones Allow loading of an ACPI SSDT overlay from an EFI variable specified 231435d1a47SPeter Jones by a kernel command line option. 232435d1a47SPeter Jones 233435d1a47SPeter Jones See Documentation/admin-guide/acpi/ssdt-overlays.rst for more 234435d1a47SPeter Jones information. 235a031651fSJavier Martinez Canillas 236a031651fSJavier Martinez Canillasconfig EFI_DISABLE_RUNTIME 237a031651fSJavier Martinez Canillas bool "Disable EFI runtime services support by default" 238a031651fSJavier Martinez Canillas default y if PREEMPT_RT 239a031651fSJavier Martinez Canillas help 240a031651fSJavier Martinez Canillas Allow to disable the EFI runtime services support by default. This can 241a031651fSJavier Martinez Canillas already be achieved by using the efi=noruntime option, but it could be 242a031651fSJavier Martinez Canillas useful to have this default without any kernel command line parameter. 243a031651fSJavier Martinez Canillas 244a031651fSJavier Martinez Canillas The EFI runtime services are disabled by default when PREEMPT_RT is 245a031651fSJavier Martinez Canillas enabled, because measurements have shown that some EFI functions calls 246a031651fSJavier Martinez Canillas might take too much time to complete, causing large latencies which is 247a031651fSJavier Martinez Canillas an issue for Real-Time kernels. 248a031651fSJavier Martinez Canillas 249a031651fSJavier Martinez Canillas This default can be overridden by using the efi=runtime option. 25012274189SDov Murik 25112274189SDov Murikconfig EFI_COCO_SECRET 25212274189SDov Murik bool "EFI Confidential Computing Secret Area Support" 25312274189SDov Murik help 25412274189SDov Murik Confidential Computing platforms (such as AMD SEV) allow the 25512274189SDov Murik Guest Owner to securely inject secrets during guest VM launch. 25612274189SDov Murik The secrets are placed in a designated EFI reserved memory area. 25712274189SDov Murik 25812274189SDov Murik In order to use the secrets in the kernel, the location of the secret 25912274189SDov Murik area (as published in the EFI config table) must be kept. 26012274189SDov Murik 26112274189SDov Murik If you say Y here, the address of the EFI secret area will be kept 26212274189SDov Murik for usage inside the kernel. This will allow the 26312274189SDov Murik virt/coco/efi_secret module to access the secrets, which in turn 26412274189SDov Murik allows userspace programs to access the injected secrets. 26575ed63d9SArd Biesheuvel 266745e3ed8SKirill A. Shutemovconfig UNACCEPTED_MEMORY 267745e3ed8SKirill A. Shutemov bool 268745e3ed8SKirill A. Shutemov depends on EFI_STUB 269745e3ed8SKirill A. Shutemov help 270745e3ed8SKirill A. Shutemov Some Virtual Machine platforms, such as Intel TDX, require 271745e3ed8SKirill A. Shutemov some memory to be "accepted" by the guest before it can be used. 272745e3ed8SKirill A. Shutemov This mechanism helps prevent malicious hosts from making changes 273745e3ed8SKirill A. Shutemov to guest memory. 274745e3ed8SKirill A. Shutemov 275745e3ed8SKirill A. Shutemov UEFI specification v2.9 introduced EFI_UNACCEPTED_MEMORY memory type. 276745e3ed8SKirill A. Shutemov 277745e3ed8SKirill A. Shutemov This option adds support for unaccepted memory and makes such memory 278745e3ed8SKirill A. Shutemov usable by the kernel. 279745e3ed8SKirill A. Shutemov 28075ed63d9SArd Biesheuvelconfig EFI_EMBEDDED_FIRMWARE 28175ed63d9SArd Biesheuvel bool 28275ed63d9SArd Biesheuvel select CRYPTO_LIB_SHA256 28375ed63d9SArd Biesheuvel 284*0f9a1739SVitaly Kuznetsovconfig EFI_SBAT 285*0f9a1739SVitaly Kuznetsov def_bool y if EFI_SBAT_FILE!="" 286*0f9a1739SVitaly Kuznetsov 287*0f9a1739SVitaly Kuznetsovconfig EFI_SBAT_FILE 288*0f9a1739SVitaly Kuznetsov string "Embedded SBAT section file path" 289*0f9a1739SVitaly Kuznetsov depends on EFI_ZBOOT 290*0f9a1739SVitaly Kuznetsov help 291*0f9a1739SVitaly Kuznetsov SBAT section provides a way to improve SecureBoot revocations of UEFI 292*0f9a1739SVitaly Kuznetsov binaries by introducing a generation-based mechanism. With SBAT, older 293*0f9a1739SVitaly Kuznetsov UEFI binaries can be prevented from booting by bumping the minimal 294*0f9a1739SVitaly Kuznetsov required generation for the specific component in the bootloader. 295*0f9a1739SVitaly Kuznetsov 296*0f9a1739SVitaly Kuznetsov Note: SBAT information is distribution specific, i.e. the owner of the 297*0f9a1739SVitaly Kuznetsov signing SecureBoot certificate must define the SBAT policy. Linux 298*0f9a1739SVitaly Kuznetsov kernel upstream does not define SBAT components and their generations. 299*0f9a1739SVitaly Kuznetsov 300*0f9a1739SVitaly Kuznetsov See https://github.com/rhboot/shim/blob/main/SBAT.md for the additional 301*0f9a1739SVitaly Kuznetsov details. 302*0f9a1739SVitaly Kuznetsov 303*0f9a1739SVitaly Kuznetsov Specify a file with SBAT data which is going to be embedded as '.sbat' 304*0f9a1739SVitaly Kuznetsov section into the kernel. 305*0f9a1739SVitaly Kuznetsov 306*0f9a1739SVitaly Kuznetsov If unsure, leave blank. 307*0f9a1739SVitaly Kuznetsov 30875ed63d9SArd Biesheuvelendmenu 30975ed63d9SArd Biesheuvel 31075ed63d9SArd Biesheuvelconfig UEFI_CPER 31175ed63d9SArd Biesheuvel bool 31275ed63d9SArd Biesheuvel 31375ed63d9SArd Biesheuvelconfig UEFI_CPER_ARM 31475ed63d9SArd Biesheuvel bool 31575ed63d9SArd Biesheuvel depends on UEFI_CPER && ( ARM || ARM64 ) 31675ed63d9SArd Biesheuvel default y 31775ed63d9SArd Biesheuvel 31875ed63d9SArd Biesheuvelconfig UEFI_CPER_X86 31975ed63d9SArd Biesheuvel bool 32075ed63d9SArd Biesheuvel depends on UEFI_CPER && X86 32175ed63d9SArd Biesheuvel default y 322c44b6be6SMasahisa Kojima 323c44b6be6SMasahisa Kojimaconfig TEE_STMM_EFI 324c44b6be6SMasahisa Kojima tristate "TEE-based EFI runtime variable service driver" 325c44b6be6SMasahisa Kojima depends on EFI && OPTEE 326c44b6be6SMasahisa Kojima help 327c44b6be6SMasahisa Kojima Select this config option if TEE is compiled to include StandAloneMM 328c44b6be6SMasahisa Kojima as a separate secure partition. It has the ability to check and store 329c44b6be6SMasahisa Kojima EFI variables on an RPMB or any other non-volatile medium used by 330c44b6be6SMasahisa Kojima StandAloneMM. 331c44b6be6SMasahisa Kojima 332c44b6be6SMasahisa Kojima Enabling this will change the EFI runtime services from the firmware 333c44b6be6SMasahisa Kojima provided functions to TEE calls. 334c44b6be6SMasahisa Kojima 335c44b6be6SMasahisa Kojima To compile this driver as a module, choose M here: the module 336c44b6be6SMasahisa Kojima will be called tee_stmm_efi. 337