1# SPDX-License-Identifier: GPL-2.0-only
2menu "EFI (Extensible Firmware Interface) Support"
3	depends on EFI
4
5config EFI_ESRT
6	bool
7	depends on EFI && !IA64
8	default y
9
10config EFI_VARS_PSTORE
11	tristate "Register efivars backend for pstore"
12	depends on PSTORE
13	select UCS2_STRING
14	default y
15	help
16	  Say Y here to enable use efivars as a backend to pstore. This
17	  will allow writing console messages, crash dumps, or anything
18	  else supported by pstore to EFI variables.
19
20config EFI_VARS_PSTORE_DEFAULT_DISABLE
21	bool "Disable using efivars as a pstore backend by default"
22	depends on EFI_VARS_PSTORE
23	default n
24	help
25	  Saying Y here will disable the use of efivars as a storage
26	  backend for pstore by default. This setting can be overridden
27	  using the efivars module's pstore_disable parameter.
28
29config EFI_RUNTIME_MAP
30	bool "Export efi runtime maps to sysfs"
31	depends on X86 && EFI && KEXEC_CORE
32	default y
33	help
34	  Export efi runtime memory maps to /sys/firmware/efi/runtime-map.
35	  That memory map is used for example by kexec to set up efi virtual
36	  mapping the 2nd kernel, but can also be used for debugging purposes.
37
38	  See also Documentation/ABI/testing/sysfs-firmware-efi-runtime-map.
39
40config EFI_FAKE_MEMMAP
41	bool "Enable EFI fake memory map"
42	depends on EFI && X86
43	default n
44	help
45	  Saying Y here will enable "efi_fake_mem" boot option.
46	  By specifying this parameter, you can add arbitrary attribute
47	  to specific memory range by updating original (firmware provided)
48	  EFI memmap.
49	  This is useful for debugging of EFI memmap related feature.
50	  e.g. Address Range Mirroring feature.
51
52config EFI_MAX_FAKE_MEM
53	int "maximum allowable number of ranges in efi_fake_mem boot option"
54	depends on EFI_FAKE_MEMMAP
55	range 1 128
56	default 8
57	help
58	  Maximum allowable number of ranges in efi_fake_mem boot option.
59	  Ranges can be set up to this value using comma-separated list.
60	  The default value is 8.
61
62config EFI_SOFT_RESERVE
63	bool "Reserve EFI Specific Purpose Memory"
64	depends on EFI && EFI_STUB && ACPI_HMAT
65	default ACPI_HMAT
66	help
67	  On systems that have mixed performance classes of memory EFI
68	  may indicate specific purpose memory with an attribute (See
69	  EFI_MEMORY_SP in UEFI 2.8). A memory range tagged with this
70	  attribute may have unique performance characteristics compared
71	  to the system's general purpose "System RAM" pool. On the
72	  expectation that such memory has application specific usage,
73	  and its base EFI memory type is "conventional" answer Y to
74	  arrange for the kernel to reserve it as a "Soft Reserved"
75	  resource, and set aside for direct-access (device-dax) by
76	  default. The memory range can later be optionally assigned to
77	  the page allocator by system administrator policy via the
78	  device-dax kmem facility. Say N to have the kernel treat this
79	  memory as "System RAM" by default.
80
81	  If unsure, say Y.
82
83config EFI_DXE_MEM_ATTRIBUTES
84	bool "Adjust memory attributes in EFISTUB"
85	depends on EFI && EFI_STUB && X86
86	default y
87	help
88	  UEFI specification does not guarantee all memory to be
89	  accessible for both write and execute as the kernel expects
90	  it to be.
91	  Use DXE services to check and alter memory protection
92	  attributes during boot via EFISTUB to ensure that memory
93	  ranges used by the kernel are writable and executable.
94
95config EFI_PARAMS_FROM_FDT
96	bool
97	help
98	  Select this config option from the architecture Kconfig if
99	  the EFI runtime support gets system table address, memory
100          map address, and other parameters from the device tree.
101
102config EFI_RUNTIME_WRAPPERS
103	bool
104
105config EFI_GENERIC_STUB
106	bool
107
108config EFI_ZBOOT
109	bool "Enable the generic EFI decompressor"
110	depends on EFI_GENERIC_STUB && !ARM
111	select HAVE_KERNEL_GZIP
112	select HAVE_KERNEL_LZ4
113	select HAVE_KERNEL_LZMA
114	select HAVE_KERNEL_LZO
115	select HAVE_KERNEL_XZ
116	select HAVE_KERNEL_ZSTD
117	help
118	  Create the bootable image as an EFI application that carries the
119	  actual kernel image in compressed form, and decompresses it into
120	  memory before executing it via LoadImage/StartImage EFI boot service
121	  calls. For compatibility with non-EFI loaders, the payload can be
122	  decompressed and executed by the loader as well, provided that the
123	  loader implements the decompression algorithm and that non-EFI boot
124	  is supported by the encapsulated image. (The compression algorithm
125	  used is described in the zboot image header)
126
127config EFI_ARMSTUB_DTB_LOADER
128	bool "Enable the DTB loader"
129	depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH
130	default y
131	help
132	  Select this config option to add support for the dtb= command
133	  line parameter, allowing a device tree blob to be loaded into
134	  memory from the EFI System Partition by the stub.
135
136	  If the device tree is provided by the platform or by
137	  the bootloader this option may not be needed.
138	  But, for various development reasons and to maintain existing
139	  functionality for bootloaders that do not have such support
140	  this option is necessary.
141
142config EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER
143	bool "Enable the command line initrd loader" if !X86
144	depends on EFI_STUB && (EFI_GENERIC_STUB || X86)
145	default y if X86
146	depends on !RISCV && !LOONGARCH
147	help
148	  Select this config option to add support for the initrd= command
149	  line parameter, allowing an initrd that resides on the same volume
150	  as the kernel image to be loaded into memory.
151
152	  This method is deprecated.
153
154config EFI_BOOTLOADER_CONTROL
155	tristate "EFI Bootloader Control"
156	select UCS2_STRING
157	default n
158	help
159	  This module installs a reboot hook, such that if reboot() is
160	  invoked with a string argument NNN, "NNN" is copied to the
161	  "LoaderEntryOneShot" EFI variable, to be read by the
162	  bootloader. If the string matches one of the boot labels
163	  defined in its configuration, the bootloader will boot once
164	  to that label. The "LoaderEntryRebootReason" EFI variable is
165	  set with the reboot reason: "reboot" or "shutdown". The
166	  bootloader reads this reboot reason and takes particular
167	  action according to its policy.
168
169config EFI_CAPSULE_LOADER
170	tristate "EFI capsule loader"
171	depends on EFI && !IA64
172	help
173	  This option exposes a loader interface "/dev/efi_capsule_loader" for
174	  users to load EFI capsules. This driver requires working runtime
175	  capsule support in the firmware, which many OEMs do not provide.
176
177	  Most users should say N.
178
179config EFI_CAPSULE_QUIRK_QUARK_CSH
180	bool "Add support for Quark capsules with non-standard headers"
181	depends on X86 && !64BIT
182	select EFI_CAPSULE_LOADER
183	default y
184	help
185	  Add support for processing Quark X1000 EFI capsules, whose header
186	  layout deviates from the layout mandated by the UEFI specification.
187
188config EFI_TEST
189	tristate "EFI Runtime Service Tests Support"
190	depends on EFI
191	default n
192	help
193	  This driver uses the efi.<service> function pointers directly instead
194	  of going through the efivar API, because it is not trying to test the
195	  kernel subsystem, just for testing the UEFI runtime service
196	  interfaces which are provided by the firmware. This driver is used
197	  by the Firmware Test Suite (FWTS) for testing the UEFI runtime
198	  interfaces readiness of the firmware.
199	  Details for FWTS are available from:
200	  <https://wiki.ubuntu.com/FirmwareTestSuite>
201
202	  Say Y here to enable the runtime services support via /dev/efi_test.
203	  If unsure, say N.
204
205config EFI_DEV_PATH_PARSER
206	bool
207
208config APPLE_PROPERTIES
209	bool "Apple Device Properties"
210	depends on EFI_STUB && X86
211	select EFI_DEV_PATH_PARSER
212	select UCS2_STRING
213	help
214	  Retrieve properties from EFI on Apple Macs and assign them to
215	  devices, allowing for improved support of Apple hardware.
216	  Properties that would otherwise be missing include the
217	  Thunderbolt Device ROM and GPU configuration data.
218
219	  If unsure, say Y if you have a Mac.  Otherwise N.
220
221config RESET_ATTACK_MITIGATION
222	bool "Reset memory attack mitigation"
223	depends on EFI_STUB
224	help
225	  Request that the firmware clear the contents of RAM after a reboot
226	  using the TCG Platform Reset Attack Mitigation specification. This
227	  protects against an attacker forcibly rebooting the system while it
228	  still contains secrets in RAM, booting another OS and extracting the
229	  secrets. This should only be enabled when userland is configured to
230	  clear the MemoryOverwriteRequest flag on clean shutdown after secrets
231	  have been evicted, since otherwise it will trigger even on clean
232	  reboots.
233
234config EFI_RCI2_TABLE
235	bool "EFI Runtime Configuration Interface Table Version 2 Support"
236	depends on X86 || COMPILE_TEST
237	help
238	  Displays the content of the Runtime Configuration Interface
239	  Table version 2 on Dell EMC PowerEdge systems as a binary
240	  attribute 'rci2' under /sys/firmware/efi/tables directory.
241
242	  RCI2 table contains BIOS HII in XML format and is used to populate
243	  BIOS setup page in Dell EMC OpenManage Server Administrator tool.
244	  The BIOS setup page contains BIOS tokens which can be configured.
245
246	  Say Y here for Dell EMC PowerEdge systems.
247
248config EFI_DISABLE_PCI_DMA
249       bool "Clear Busmaster bit on PCI bridges during ExitBootServices()"
250       help
251	  Disable the busmaster bit in the control register on all PCI bridges
252	  while calling ExitBootServices() and passing control to the runtime
253	  kernel. System firmware may configure the IOMMU to prevent malicious
254	  PCI devices from being able to attack the OS via DMA. However, since
255	  firmware can't guarantee that the OS is IOMMU-aware, it will tear
256	  down IOMMU configuration when ExitBootServices() is called. This
257	  leaves a window between where a hostile device could still cause
258	  damage before Linux configures the IOMMU again.
259
260	  If you say Y here, the EFI stub will clear the busmaster bit on all
261	  PCI bridges before ExitBootServices() is called. This will prevent
262	  any malicious PCI devices from being able to perform DMA until the
263	  kernel reenables busmastering after configuring the IOMMU.
264
265	  This option will cause failures with some poorly behaved hardware
266	  and should not be enabled without testing. The kernel commandline
267	  options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma"
268	  may be used to override this option.
269
270config EFI_EARLYCON
271	def_bool y
272	depends on SERIAL_EARLYCON && !ARM && !IA64
273	select FONT_SUPPORT
274	select ARCH_USE_MEMREMAP_PROT
275
276config EFI_CUSTOM_SSDT_OVERLAYS
277	bool "Load custom ACPI SSDT overlay from an EFI variable"
278	depends on ACPI
279	default ACPI_TABLE_UPGRADE
280	help
281	  Allow loading of an ACPI SSDT overlay from an EFI variable specified
282	  by a kernel command line option.
283
284	  See Documentation/admin-guide/acpi/ssdt-overlays.rst for more
285	  information.
286
287config EFI_DISABLE_RUNTIME
288	bool "Disable EFI runtime services support by default"
289	default y if PREEMPT_RT
290	help
291	  Allow to disable the EFI runtime services support by default. This can
292	  already be achieved by using the efi=noruntime option, but it could be
293	  useful to have this default without any kernel command line parameter.
294
295	  The EFI runtime services are disabled by default when PREEMPT_RT is
296	  enabled, because measurements have shown that some EFI functions calls
297	  might take too much time to complete, causing large latencies which is
298	  an issue for Real-Time kernels.
299
300	  This default can be overridden by using the efi=runtime option.
301
302config EFI_COCO_SECRET
303	bool "EFI Confidential Computing Secret Area Support"
304	help
305	  Confidential Computing platforms (such as AMD SEV) allow the
306	  Guest Owner to securely inject secrets during guest VM launch.
307	  The secrets are placed in a designated EFI reserved memory area.
308
309	  In order to use the secrets in the kernel, the location of the secret
310	  area (as published in the EFI config table) must be kept.
311
312	  If you say Y here, the address of the EFI secret area will be kept
313	  for usage inside the kernel.  This will allow the
314	  virt/coco/efi_secret module to access the secrets, which in turn
315	  allows userspace programs to access the injected secrets.
316
317config EFI_EMBEDDED_FIRMWARE
318	bool
319	select CRYPTO_LIB_SHA256
320
321endmenu
322
323config UEFI_CPER
324	bool
325
326config UEFI_CPER_ARM
327	bool
328	depends on UEFI_CPER && ( ARM || ARM64 )
329	default y
330
331config UEFI_CPER_X86
332	bool
333	depends on UEFI_CPER && X86
334	default y
335