tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2menu "EFI (Extensible Firmware Interface) Support"
3 depends on EFI
4
5config EFI_ESRT
6 bool
7 depends on EFI && !IA64
8 default y
9
10config EFI_VARS_PSTORE
11 tristate "Register efivars backend for pstore"
12 depends on PSTORE
13 select UCS2_STRING
14 default y
15 help
16 Say Y here to enable use efivars as a backend to pstore. This
17 will allow writing console messages, crash dumps, or anything
18 else supported by pstore to EFI variables.
19
20config EFI_VARS_PSTORE_DEFAULT_DISABLE
21 bool "Disable using efivars as a pstore backend by default"
22 depends on EFI_VARS_PSTORE
23 default n
24 help
25 Saying Y here will disable the use of efivars as a storage
26 backend for pstore by default. This setting can be overridden
27 using the efivars module's pstore_disable parameter.
28
29config EFI_RUNTIME_MAP
30 bool "Export efi runtime maps to sysfs"
31 depends on X86 && EFI && KEXEC_CORE
32 default y
33 help
34 Export efi runtime memory maps to /sys/firmware/efi/runtime-map.
35 That memory map is used for example by kexec to set up efi virtual
36 mapping the 2nd kernel, but can also be used for debugging purposes.
37
38 See also Documentation/ABI/testing/sysfs-firmware-efi-runtime-map.
39
40config EFI_FAKE_MEMMAP
41 bool "Enable EFI fake memory map"
42 depends on EFI && X86
43 default n
44 help
45 Saying Y here will enable "efi_fake_mem" boot option.
46 By specifying this parameter, you can add arbitrary attribute
47 to specific memory range by updating original (firmware provided)
48 EFI memmap.
49 This is useful for debugging of EFI memmap related feature.
50 e.g. Address Range Mirroring feature.
51
52config EFI_MAX_FAKE_MEM
53 int "maximum allowable number of ranges in efi_fake_mem boot option"
54 depends on EFI_FAKE_MEMMAP
55 range 1 128
56 default 8
57 help
58 Maximum allowable number of ranges in efi_fake_mem boot option.
59 Ranges can be set up to this value using comma-separated list.
60 The default value is 8.
61
62config EFI_SOFT_RESERVE
63 bool "Reserve EFI Specific Purpose Memory"
64 depends on EFI && EFI_STUB && ACPI_HMAT
65 default ACPI_HMAT
66 help
67 On systems that have mixed performance classes of memory EFI
68 may indicate specific purpose memory with an attribute (See
69 EFI_MEMORY_SP in UEFI 2.8). A memory range tagged with this
70 attribute may have unique performance characteristics compared
71 to the system's general purpose "System RAM" pool. On the
72 expectation that such memory has application specific usage,
73 and its base EFI memory type is "conventional" answer Y to
74 arrange for the kernel to reserve it as a "Soft Reserved"
75 resource, and set aside for direct-access (device-dax) by
76 default. The memory range can later be optionally assigned to
77 the page allocator by system administrator policy via the
78 device-dax kmem facility. Say N to have the kernel treat this
79 memory as "System RAM" by default.
80
81 If unsure, say Y.
82
83config EFI_DXE_MEM_ATTRIBUTES
84 bool "Adjust memory attributes in EFISTUB"
85 depends on EFI && EFI_STUB && X86
86 default y
87 help
88 UEFI specification does not guarantee all memory to be
89 accessible for both write and execute as the kernel expects
90 it to be.
91 Use DXE services to check and alter memory protection
92 attributes during boot via EFISTUB to ensure that memory
93 ranges used by the kernel are writable and executable.
94
95config EFI_PARAMS_FROM_FDT
96 bool
97 help
98 Select this config option from the architecture Kconfig if
99 the EFI runtime support gets system table address, memory
100 map address, and other parameters from the device tree.
101
102config EFI_RUNTIME_WRAPPERS
103 bool
104
105config EFI_GENERIC_STUB
106 bool
107
108config EFI_ARMSTUB_DTB_LOADER
109 bool "Enable the DTB loader"
110 depends on EFI_GENERIC_STUB && !RISCV
111 default y
112 help
113 Select this config option to add support for the dtb= command
114 line parameter, allowing a device tree blob to be loaded into
115 memory from the EFI System Partition by the stub.
116
117 If the device tree is provided by the platform or by
118 the bootloader this option may not be needed.
119 But, for various development reasons and to maintain existing
120 functionality for bootloaders that do not have such support
121 this option is necessary.
122
123config EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER
124 bool "Enable the command line initrd loader" if !X86
125 depends on EFI_STUB && (EFI_GENERIC_STUB || X86)
126 default y if X86
127 depends on !RISCV
128 help
129 Select this config option to add support for the initrd= command
130 line parameter, allowing an initrd that resides on the same volume
131 as the kernel image to be loaded into memory.
132
133 This method is deprecated.
134
135config EFI_BOOTLOADER_CONTROL
136 tristate "EFI Bootloader Control"
137 select UCS2_STRING
138 default n
139 help
140 This module installs a reboot hook, such that if reboot() is
141 invoked with a string argument NNN, "NNN" is copied to the
142 "LoaderEntryOneShot" EFI variable, to be read by the
143 bootloader. If the string matches one of the boot labels
144 defined in its configuration, the bootloader will boot once
145 to that label. The "LoaderEntryRebootReason" EFI variable is
146 set with the reboot reason: "reboot" or "shutdown". The
147 bootloader reads this reboot reason and takes particular
148 action according to its policy.
149
150config EFI_CAPSULE_LOADER
151 tristate "EFI capsule loader"
152 depends on EFI && !IA64
153 help
154 This option exposes a loader interface "/dev/efi_capsule_loader" for
155 users to load EFI capsules. This driver requires working runtime
156 capsule support in the firmware, which many OEMs do not provide.
157
158 Most users should say N.
159
160config EFI_CAPSULE_QUIRK_QUARK_CSH
161 bool "Add support for Quark capsules with non-standard headers"
162 depends on X86 && !64BIT
163 select EFI_CAPSULE_LOADER
164 default y
165 help
166 Add support for processing Quark X1000 EFI capsules, whose header
167 layout deviates from the layout mandated by the UEFI specification.
168
169config EFI_TEST
170 tristate "EFI Runtime Service Tests Support"
171 depends on EFI
172 default n
173 help
174 This driver uses the efi.<service> function pointers directly instead
175 of going through the efivar API, because it is not trying to test the
176 kernel subsystem, just for testing the UEFI runtime service
177 interfaces which are provided by the firmware. This driver is used
178 by the Firmware Test Suite (FWTS) for testing the UEFI runtime
179 interfaces readiness of the firmware.
180 Details for FWTS are available from:
181 <https://wiki.ubuntu.com/FirmwareTestSuite>
182
183 Say Y here to enable the runtime services support via /dev/efi_test.
184 If unsure, say N.
185
186config EFI_DEV_PATH_PARSER
187 bool
188
189config APPLE_PROPERTIES
190 bool "Apple Device Properties"
191 depends on EFI_STUB && X86
192 select EFI_DEV_PATH_PARSER
193 select UCS2_STRING
194 help
195 Retrieve properties from EFI on Apple Macs and assign them to
196 devices, allowing for improved support of Apple hardware.
197 Properties that would otherwise be missing include the
198 Thunderbolt Device ROM and GPU configuration data.
199
200 If unsure, say Y if you have a Mac. Otherwise N.
201
202config RESET_ATTACK_MITIGATION
203 bool "Reset memory attack mitigation"
204 depends on EFI_STUB
205 help
206 Request that the firmware clear the contents of RAM after a reboot
207 using the TCG Platform Reset Attack Mitigation specification. This
208 protects against an attacker forcibly rebooting the system while it
209 still contains secrets in RAM, booting another OS and extracting the
210 secrets. This should only be enabled when userland is configured to
211 clear the MemoryOverwriteRequest flag on clean shutdown after secrets
212 have been evicted, since otherwise it will trigger even on clean
213 reboots.
214
215config EFI_RCI2_TABLE
216 bool "EFI Runtime Configuration Interface Table Version 2 Support"
217 depends on X86 || COMPILE_TEST
218 help
219 Displays the content of the Runtime Configuration Interface
220 Table version 2 on Dell EMC PowerEdge systems as a binary
221 attribute 'rci2' under /sys/firmware/efi/tables directory.
222
223 RCI2 table contains BIOS HII in XML format and is used to populate
224 BIOS setup page in Dell EMC OpenManage Server Administrator tool.
225 The BIOS setup page contains BIOS tokens which can be configured.
226
227 Say Y here for Dell EMC PowerEdge systems.
228
229config EFI_DISABLE_PCI_DMA
230 bool "Clear Busmaster bit on PCI bridges during ExitBootServices()"
231 help
232 Disable the busmaster bit in the control register on all PCI bridges
233 while calling ExitBootServices() and passing control to the runtime
234 kernel. System firmware may configure the IOMMU to prevent malicious
235 PCI devices from being able to attack the OS via DMA. However, since
236 firmware can't guarantee that the OS is IOMMU-aware, it will tear
237 down IOMMU configuration when ExitBootServices() is called. This
238 leaves a window between where a hostile device could still cause
239 damage before Linux configures the IOMMU again.
240
241 If you say Y here, the EFI stub will clear the busmaster bit on all
242 PCI bridges before ExitBootServices() is called. This will prevent
243 any malicious PCI devices from being able to perform DMA until the
244 kernel reenables busmastering after configuring the IOMMU.
245
246 This option will cause failures with some poorly behaved hardware
247 and should not be enabled without testing. The kernel commandline
248 options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma"
249 may be used to override this option.
250
251config EFI_EARLYCON
252 def_bool y
253 depends on SERIAL_EARLYCON && !ARM && !IA64
254 select FONT_SUPPORT
255 select ARCH_USE_MEMREMAP_PROT
256
257config EFI_CUSTOM_SSDT_OVERLAYS
258 bool "Load custom ACPI SSDT overlay from an EFI variable"
259 depends on ACPI
260 default ACPI_TABLE_UPGRADE
261 help
262 Allow loading of an ACPI SSDT overlay from an EFI variable specified
263 by a kernel command line option.
264
265 See Documentation/admin-guide/acpi/ssdt-overlays.rst for more
266 information.
267
268config EFI_DISABLE_RUNTIME
269 bool "Disable EFI runtime services support by default"
270 default y if PREEMPT_RT
271 help
272 Allow to disable the EFI runtime services support by default. This can
273 already be achieved by using the efi=noruntime option, but it could be
274 useful to have this default without any kernel command line parameter.
275
276 The EFI runtime services are disabled by default when PREEMPT_RT is
277 enabled, because measurements have shown that some EFI functions calls
278 might take too much time to complete, causing large latencies which is
279 an issue for Real-Time kernels.
280
281 This default can be overridden by using the efi=runtime option.
282
283config EFI_COCO_SECRET
284 bool "EFI Confidential Computing Secret Area Support"
285 help
286 Confidential Computing platforms (such as AMD SEV) allow the
287 Guest Owner to securely inject secrets during guest VM launch.
288 The secrets are placed in a designated EFI reserved memory area.
289
290 In order to use the secrets in the kernel, the location of the secret
291 area (as published in the EFI config table) must be kept.
292
293 If you say Y here, the address of the EFI secret area will be kept
294 for usage inside the kernel. This will allow the
295 virt/coco/efi_secret module to access the secrets, which in turn
296 allows userspace programs to access the injected secrets.
297
298config EFI_EMBEDDED_FIRMWARE
299 bool
300 select CRYPTO_LIB_SHA256
301
302endmenu
303
304config UEFI_CPER
305 bool
306
307config UEFI_CPER_ARM
308 bool
309 depends on UEFI_CPER && ( ARM || ARM64 )
310 default y
311
312config UEFI_CPER_X86
313 bool
314 depends on UEFI_CPER && X86
315 default y