Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2menu "EFI (Extensible Firmware Interface) Support"
3 depends on EFI
4
5config EFI_ESRT
6 bool
7 depends on EFI
8 default y
9
10config EFI_VARS_PSTORE
11 tristate "Register efivars backend for pstore"
12 depends on PSTORE
13 select UCS2_STRING
14 default y
15 help
16 Say Y here to enable use efivars as a backend to pstore. This
17 will allow writing console messages, crash dumps, or anything
18 else supported by pstore to EFI variables.
19
20config EFI_VARS_PSTORE_DEFAULT_DISABLE
21 bool "Disable using efivars as a pstore backend by default"
22 depends on EFI_VARS_PSTORE
23 default n
24 help
25 Saying Y here will disable the use of efivars as a storage
26 backend for pstore by default. This setting can be overridden
27 using the efivars module's pstore_disable parameter.
28
29config EFI_SOFT_RESERVE
30 bool "Reserve EFI Specific Purpose Memory"
31 depends on EFI && EFI_STUB && ACPI_HMAT
32 default ACPI_HMAT
33 help
34 On systems that have mixed performance classes of memory EFI
35 may indicate specific purpose memory with an attribute (See
36 EFI_MEMORY_SP in UEFI 2.8). A memory range tagged with this
37 attribute may have unique performance characteristics compared
38 to the system's general purpose "System RAM" pool. On the
39 expectation that such memory has application specific usage,
40 and its base EFI memory type is "conventional" answer Y to
41 arrange for the kernel to reserve it as a "Soft Reserved"
42 resource, and set aside for direct-access (device-dax) by
43 default. The memory range can later be optionally assigned to
44 the page allocator by system administrator policy via the
45 device-dax kmem facility. Say N to have the kernel treat this
46 memory as "System RAM" by default.
47
48 If unsure, say Y.
49
50config EFI_DXE_MEM_ATTRIBUTES
51 bool "Adjust memory attributes in EFISTUB"
52 depends on EFI && EFI_STUB && X86
53 default y
54 help
55 UEFI specification does not guarantee all memory to be
56 accessible for both write and execute as the kernel expects
57 it to be.
58 Use DXE services to check and alter memory protection
59 attributes during boot via EFISTUB to ensure that memory
60 ranges used by the kernel are writable and executable.
61
62config EFI_PARAMS_FROM_FDT
63 bool
64 help
65 Select this config option from the architecture Kconfig if
66 the EFI runtime support gets system table address, memory
67 map address, and other parameters from the device tree.
68
69config EFI_RUNTIME_WRAPPERS
70 bool
71
72config EFI_GENERIC_STUB
73 bool
74
75config EFI_ZBOOT
76 bool "Enable the generic EFI decompressor"
77 depends on EFI_GENERIC_STUB && !ARM
78 select HAVE_KERNEL_GZIP
79 select HAVE_KERNEL_ZSTD
80 help
81 Create the bootable image as an EFI application that carries the
82 actual kernel image in compressed form, and decompresses it into
83 memory before executing it. For compatibility with non-EFI loaders,
84 the payload can be decompressed and executed by the loader as well,
85 provided that the loader implements the decompression algorithm.
86 (The compression algorithm used is described in the zboot header)
87
88config EFI_ARMSTUB_DTB_LOADER
89 bool "Enable the DTB loader"
90 depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH
91 default y
92 help
93 Select this config option to add support for the dtb= command
94 line parameter, allowing a device tree blob to be loaded into
95 memory from the EFI System Partition by the stub.
96
97 If the device tree is provided by the platform or by
98 the bootloader this option may not be needed.
99 But, for various development reasons and to maintain existing
100 functionality for bootloaders that do not have such support
101 this option is necessary.
102
103config EFI_BOOTLOADER_CONTROL
104 tristate "EFI Bootloader Control"
105 select UCS2_STRING
106 default n
107 help
108 This module installs a reboot hook, such that if reboot() is
109 invoked with a string argument NNN, "NNN" is copied to the
110 "LoaderEntryOneShot" EFI variable, to be read by the
111 bootloader. If the string matches one of the boot labels
112 defined in its configuration, the bootloader will boot once
113 to that label. The "LoaderEntryRebootReason" EFI variable is
114 set with the reboot reason: "reboot" or "shutdown". The
115 bootloader reads this reboot reason and takes particular
116 action according to its policy.
117
118config EFI_CAPSULE_LOADER
119 tristate "EFI capsule loader"
120 depends on EFI
121 help
122 This option exposes a loader interface "/dev/efi_capsule_loader" for
123 users to load EFI capsules. This driver requires working runtime
124 capsule support in the firmware, which many OEMs do not provide.
125
126 Most users should say N.
127
128config EFI_CAPSULE_QUIRK_QUARK_CSH
129 bool "Add support for Quark capsules with non-standard headers"
130 depends on X86 && !64BIT
131 select EFI_CAPSULE_LOADER
132 default y
133 help
134 Add support for processing Quark X1000 EFI capsules, whose header
135 layout deviates from the layout mandated by the UEFI specification.
136
137config EFI_TEST
138 tristate "EFI Runtime Service Tests Support"
139 depends on EFI
140 default n
141 help
142 This driver uses the efi.<service> function pointers directly instead
143 of going through the efivar API, because it is not trying to test the
144 kernel subsystem, just for testing the UEFI runtime service
145 interfaces which are provided by the firmware. This driver is used
146 by the Firmware Test Suite (FWTS) for testing the UEFI runtime
147 interfaces readiness of the firmware.
148 Details for FWTS are available from:
149 <https://wiki.ubuntu.com/FirmwareTestSuite>
150
151 Say Y here to enable the runtime services support via /dev/efi_test.
152 If unsure, say N.
153
154config EFI_DEV_PATH_PARSER
155 bool
156
157config APPLE_PROPERTIES
158 bool "Apple Device Properties"
159 depends on EFI_STUB && X86
160 select EFI_DEV_PATH_PARSER
161 select UCS2_STRING
162 help
163 Retrieve properties from EFI on Apple Macs and assign them to
164 devices, allowing for improved support of Apple hardware.
165 Properties that would otherwise be missing include the
166 Thunderbolt Device ROM and GPU configuration data.
167
168 If unsure, say Y if you have a Mac. Otherwise N.
169
170config RESET_ATTACK_MITIGATION
171 bool "Reset memory attack mitigation"
172 depends on EFI_STUB
173 help
174 Request that the firmware clear the contents of RAM after a reboot
175 using the TCG Platform Reset Attack Mitigation specification. This
176 protects against an attacker forcibly rebooting the system while it
177 still contains secrets in RAM, booting another OS and extracting the
178 secrets. This should only be enabled when userland is configured to
179 clear the MemoryOverwriteRequest flag on clean shutdown after secrets
180 have been evicted, since otherwise it will trigger even on clean
181 reboots.
182
183config EFI_RCI2_TABLE
184 bool "EFI Runtime Configuration Interface Table Version 2 Support"
185 depends on X86 || COMPILE_TEST
186 help
187 Displays the content of the Runtime Configuration Interface
188 Table version 2 on Dell EMC PowerEdge systems as a binary
189 attribute 'rci2' under /sys/firmware/efi/tables directory.
190
191 RCI2 table contains BIOS HII in XML format and is used to populate
192 BIOS setup page in Dell EMC OpenManage Server Administrator tool.
193 The BIOS setup page contains BIOS tokens which can be configured.
194
195 Say Y here for Dell EMC PowerEdge systems.
196
197config EFI_DISABLE_PCI_DMA
198 bool "Clear Busmaster bit on PCI bridges during ExitBootServices()"
199 help
200 Disable the busmaster bit in the control register on all PCI bridges
201 while calling ExitBootServices() and passing control to the runtime
202 kernel. System firmware may configure the IOMMU to prevent malicious
203 PCI devices from being able to attack the OS via DMA. However, since
204 firmware can't guarantee that the OS is IOMMU-aware, it will tear
205 down IOMMU configuration when ExitBootServices() is called. This
206 leaves a window between where a hostile device could still cause
207 damage before Linux configures the IOMMU again.
208
209 If you say Y here, the EFI stub will clear the busmaster bit on all
210 PCI bridges before ExitBootServices() is called. This will prevent
211 any malicious PCI devices from being able to perform DMA until the
212 kernel reenables busmastering after configuring the IOMMU.
213
214 This option will cause failures with some poorly behaved hardware
215 and should not be enabled without testing. The kernel commandline
216 options "efi=disable_early_pci_dma" or "efi=no_disable_early_pci_dma"
217 may be used to override this option.
218
219config EFI_EARLYCON
220 def_bool y
221 depends on SERIAL_EARLYCON && !ARM
222 select FONT_SUPPORT
223 select ARCH_USE_MEMREMAP_PROT
224
225config EFI_CUSTOM_SSDT_OVERLAYS
226 bool "Load custom ACPI SSDT overlay from an EFI variable"
227 depends on ACPI
228 default ACPI_TABLE_UPGRADE
229 help
230 Allow loading of an ACPI SSDT overlay from an EFI variable specified
231 by a kernel command line option.
232
233 See Documentation/admin-guide/acpi/ssdt-overlays.rst for more
234 information.
235
236config EFI_DISABLE_RUNTIME
237 bool "Disable EFI runtime services support by default"
238 default y if PREEMPT_RT
239 help
240 Allow to disable the EFI runtime services support by default. This can
241 already be achieved by using the efi=noruntime option, but it could be
242 useful to have this default without any kernel command line parameter.
243
244 The EFI runtime services are disabled by default when PREEMPT_RT is
245 enabled, because measurements have shown that some EFI functions calls
246 might take too much time to complete, causing large latencies which is
247 an issue for Real-Time kernels.
248
249 This default can be overridden by using the efi=runtime option.
250
251config EFI_COCO_SECRET
252 bool "EFI Confidential Computing Secret Area Support"
253 help
254 Confidential Computing platforms (such as AMD SEV) allow the
255 Guest Owner to securely inject secrets during guest VM launch.
256 The secrets are placed in a designated EFI reserved memory area.
257
258 In order to use the secrets in the kernel, the location of the secret
259 area (as published in the EFI config table) must be kept.
260
261 If you say Y here, the address of the EFI secret area will be kept
262 for usage inside the kernel. This will allow the
263 virt/coco/efi_secret module to access the secrets, which in turn
264 allows userspace programs to access the injected secrets.
265
266config OVMF_DEBUG_LOG
267 bool "Expose OVMF firmware debug log via sysfs"
268 depends on EFI
269 help
270 Recent versions of the Open Virtual Machine Firmware
271 (edk2-stable202508 + newer) can write their debug log to a memory
272 buffer. This driver exposes the log content via sysfs
273 (/sys/firmware/efi/ovmf_debug_log).
274
275config UNACCEPTED_MEMORY
276 bool
277 depends on EFI_STUB
278 help
279 Some Virtual Machine platforms, such as Intel TDX, require
280 some memory to be "accepted" by the guest before it can be used.
281 This mechanism helps prevent malicious hosts from making changes
282 to guest memory.
283
284 UEFI specification v2.9 introduced EFI_UNACCEPTED_MEMORY memory type.
285
286 This option adds support for unaccepted memory and makes such memory
287 usable by the kernel.
288
289config EFI_EMBEDDED_FIRMWARE
290 bool
291 select CRYPTO_LIB_SHA256
292
293config EFI_SBAT
294 def_bool y if EFI_SBAT_FILE!=""
295
296config EFI_SBAT_FILE
297 string "Embedded SBAT section file path"
298 depends on EFI_ZBOOT || (EFI_STUB && X86)
299 help
300 SBAT section provides a way to improve SecureBoot revocations of UEFI
301 binaries by introducing a generation-based mechanism. With SBAT, older
302 UEFI binaries can be prevented from booting by bumping the minimal
303 required generation for the specific component in the bootloader.
304
305 Note: SBAT information is distribution specific, i.e. the owner of the
306 signing SecureBoot certificate must define the SBAT policy. Linux
307 kernel upstream does not define SBAT components and their generations.
308
309 See https://github.com/rhboot/shim/blob/main/SBAT.md for the additional
310 details.
311
312 Specify a file with SBAT data which is going to be embedded as '.sbat'
313 section into the kernel.
314
315 If unsure, leave blank.
316
317endmenu
318
319config UEFI_CPER
320 bool
321
322config UEFI_CPER_ARM
323 bool
324 depends on UEFI_CPER && ( ARM || ARM64 )
325 default y
326
327config UEFI_CPER_X86
328 bool
329 depends on UEFI_CPER && X86
330 default y
331
332config TEE_STMM_EFI
333 tristate "TEE-based EFI runtime variable service driver"
334 depends on EFI && OPTEE
335 help
336 Select this config option if TEE is compiled to include StandAloneMM
337 as a separate secure partition. It has the ability to check and store
338 EFI variables on an RPMB or any other non-volatile medium used by
339 StandAloneMM.
340
341 Enabling this will change the EFI runtime services from the firmware
342 provided functions to TEE calls.
343
344 To compile this driver as a module, choose M here: the module
345 will be called tee_stmm_efi.