# config.conf
# Configuration file for the RefindPlus boot manager

##--------------------------------------------------------------##
##                        Section 1 of 3                        ##
##               ADDITIONAL CONFIGURATION ITEMS                 ##
##          New Functionality Provided by RefindPlus            ##
##--------------------------------------------------------------##
#
#
# Proceed automatically when on-screen notices
# are shown. When this option is active, RefindPlus
# will pause for nine (9) seconds when on-screen notices
# are shown, and then proceed as if a key has been pressed.
#
# Inactive when commented out (Does not proceed automatically)
#
#continue_on_warning

# Allow actively enabling/disabling the System Integrity Protection (SIP) and
# Sealed System Volume (SSV) settings defined under the "csr_values" option.
# When active, RefindPlus will actively set the CSR Policy as defined. This
# is done when RefindPlus is loaded but users can manually toggle the set
# values "ON" or "OFF" by using the "Rotate CSR" tool on the main menu.
# The following options are available:
#   1    - Always Enable SIP (and SSV on macOS 11.x or later)
#   0    - Take no Action
#  -1    - Always Disable SIP (and SSV on macOS 11.x or later when configured in "csr_values")
#
# Inactive when commented out (Takes no action on SIP and/or SSV)
#
#csr_dynamic 1

# As of macOS v11.x (Big Sur), the previous default SIP/SSV settings, which had all included
# the CSR_ALLOW_APPLE_INTERNAL bit, may leave Macs not able to receive "Over The Air" (OTA)
# updates from Apple. macOS v11.x (and later) remove this bit on boot if detected but the
# attempted removal may fail when booting into macOS via non-standard approaches such as
# RefindPlus. It is also possible that Apple will remove this remediation feature once
# Mac models supporting macOS v10.15 (Catalina) are deemed to be obsolete by Apple.
# When this token is set, RefindPlus will remove this bit from the saved CSR bits
# when booting into macOS, similar to the process done by macOS v11.x and later.
#
# Inactive when commented out (Takes no action on SIP/SSV settings)
#
#csr_normalise

# The "HelpIcon" feature prefers loading default/generic loader icons over custom
# ones and searches for custom loader icons only executed if a generic loader icon
# is not found. This can result in significantly faster loading speeds on some units
# and make no difference at worst. The default/generic loader icons loaded will be
# those for the current active theme. That is, the current theme's default icons.
# ".VolumeIcons" and "VolumeBadges" are disabled when this setting is active.
# When active, generic "linux" icons are used for most linux flavours.
#
# The "HelpIcon" feature is enabled when commented out
#
#decline_help_icon

# Help with "hidden_tags" setup. RefindPlus always makes the "hidden_tags" tool available
# by default (even when the tool is not specified in the "showtools" list). This is done
# to ensure that items hidden (always possible) can also be unhidden (only possible if
# the "hidden_tags" tool is available). When this option is enabled, this "help" with
# setup will be deactivated, and the ability to unhide items will be solely based on
# whether "hidden_tags" has been explicitly defined in the "showtools" list or not.
#
# The "hidden_tags" tool is always made available when commented out
#
#decline_help_tags

# The "HelpText" feature uses complementary colours (of the title banner) for text
# to improve legibility. With custom banners however, the base colour is based on the
# colour of first pixel in the pixel array (top left pixel). This may not always embody
# all pixels in banners with multiple colours. Thus, the selected complementary colour
# for the text may not be suitable for all portions of the title banner in such cases.
# In such cases, users may wish to disable the "HelpText" feature by activating this
# token, which will make the text either white or black, based on the brightness of
# colour of the first pixel in the pixel array instead. NB: Only applies to custom
# title banners and complementary colours are always used for text when using the
# default RefindPlus title banner, as this always has a single solid colour.
#
# The "HelpText" feature is enabled when commented out
#
#decline_help_text

# The "HelpScan" feature always adds program defaults to 'dont_scan-xyz' lists.
# This deviates from the upstream implementation where such program defaults are
# overwritten unless a "+" item is added as the first item of user defined entries.
# These program defaults ensure that certain items are not shown as first row icons.
# Users that wish to disable the default "HelpScan" feature can activate this option.
#
# The "HelpScan" feature is enabled when commented out
#
#decline_help_scan

# RefindPlus defaults to mapping both 'F10' and '\' (forward slash) to
# the inbuilt screenshot feature. When this option is active, the F10
# key is unlinked whilst the '\' key stays linked to screenshots. It
# allows using third-party alternatives which may also map the key.
# As installed as drivers, such tools typically allow screenshots
# from external screens that the inbuilt feature does not cover.
#
# Inactive when commented out (Does not decouple the F10 key)
#
#decouple_key_f10

# Disable Apple Mobile File Integrity (AMFI) checks when booting macOS. When
# this token is active, RefindPlus will add a "amfi_get_out_of_my_way=1" boot
# argument which along with System Integrity Protection (SIP), restricts
# application access to OS entitlements. Note that this setting will
# create a macOS boot argument the first time it is triggered
# and that this boot argument will remain active until
# it is explicitly cleared, even if this setting
# is subsequently deactivated.
#
# Inactive when commented out (Does not stop AMFI checks)
#
#disable_amfi

# Offer APFS filesystem capability. By default, RefindPlus is set up to jump start
# macOS APFS filesystem drivers, apfs.efi, which are available in system folders of
# macOS 10.13 (High Sierra) and later. The drivers are loaded to match each specific
# macOS version which ensures that any changes made to APFS drivers for each specific
# macOS version are accommodated, compared to using one driver no matter what specific
# macOS version is being loaded. This default is deactivated whenever this token is set.
# NB: This functionality is only available on TianoCore builds.
#
# APFS filesystem capability is provided (if required) via "SupplyAPFS" when commented out
#
#disable_apfs_load

# Suppress verbose APFS loading text output. By default, RefindPlus is configured to always
# suppress verbose text output from APFS drivers loaded via its "SupplyAPFS" functionality.
# This feature only acts on apfs drivers loaded via the default "SupplyAPFS" functionality.
# This feature may impact other text output however, and should be disabled by activating
# this option if such negative effects are observed. This setting only applies to macOS.
# NB: This functionality is only available on TianoCore builds.
#
# Verbose APFS text is suppressed (if generated) when commented out
#
#disable_apfs_mute

# Apple has partially enforced the use of the "PreBoot" Loader stored in the "PreBoot" partition
# of APFS volumes by requiring this to run the Mac Boot Loader, starting with macOS v11.0, when
# SIP is enabled. Attempts to run such macOS Boot Loaders directly when SIP is enabled result
# in kernel panics. The default setting in RefindPlus is to always map APFS volumes to their
# respective "PreBoot" partitions, which will be used to boot such macOS instances and the
# associated "PreBoot" partitions will be hidden from view. This arrangement also permits
# booting into FileVault encrypted APFS volumes with their volume labels (not PreBoot).
# When this option is enabled however, the RefindPlus "SyncAPFS" feature is disabled.
#
# NB: Maintain the default naming pattern for APFS data volumes, "VolName - Data",
# to improve the reliability of "SyncAPFS" distinguishing between APFS volumes.
# Also, avoid the use of special characters in macOS volume names and limit
# names to alphanumeric characters. Dashes, underscores and/or spaces can
# be used in combination with alphanumeric characters without issue.
#
# APFS partition synchronisation is provided (if required) when commented out
#
#disable_apfs_sync

# Disable version compatibility checks when booting macOS. Macs check whether
# the current macOS version is supported on the machine when booting, and halt
# if not. When this option is active, RefindPlus will add "-no_compat_check" to
# the boot arguments to disable this check, which allows macOS boot on otherwise
# unsupported Macs. Note that this setting will create a macOS boot argument the
# first time it is triggered and that this boot argument will remain active until
# it is explicitly cleared, even if this setting is subsequently deactivated.
#
# Inactive when commented out (Does not stop macOS compatibility checks)
#
#disable_compat_check

# Disable kernel panic logging to the NVRAM. macOS may save kernel panic logs in
# the NVRAM under certain conditions which can increase wear and tear on legacy
# Mac NVRAM. When this token is active, RefindPlus adds "nvram_paniclog=0" to
# the boot arguments which disables panic log writes to the NVRAM for writes
# to the filesystem instead. Note that this token will create a macOS boot
# argument the first time it is triggered which will remain active until
# explicitly cleared, even if this setting is subsequently deactivated.
#
# Inactive when commented out (Does not stop macOS paniclog writes to NVRAM)
#
#disable_nvram_paniclog

# Allow/Prevent saving various potentially harmful variables to the NVRAM on Macs.
# By default, RefindPlus will prevent writes of certain items by processes such as
# UEFI Windows Secure Boot (certificates) to the NVRAM on Legacy Macs as these may
# result in an overrun that will damage the BootROM (also stored on the NVRAM) and
# results in an inability to boot. This token is only activated on Apple firmware.
# NB: This feature is always disabled when RefindPlus is loaded via OpenCore.
#
# The "NvramProtect" feature is enabled when commented out
#
#disable_nvram_protect

# Replace the Apple FramebufferInfo protocol with a builtin version. By default,
# RefindPlus is configured to always install the Apple FramebufferInfo protocol
# when missing on Macs. This feature can be disabled by activating this token.
# It is only active when the UGA protocol is available and is inactive when
# running a GPU with the GOP protocol.
# NB: This functionality is only available on TianoCore builds.
#
# Apple FramebufferInfo protocol is provided (if required) when commented out
#
#disable_provide_fb

# When GOP drivers, which are UEFI 2.x drivers, are implemented in compliance with
# UEFI 2.x requirements, they do not work on legacy devices as the specifications
# mandate that on installation, compliant GOP drivers should confirm devices are
# UEFI 2.x compliant and to fail if they are not. Hence, compliant GOP drivers
# do not activate on classic MacPros for instance, as these are not actually
# UEFI 2.x but EFI 1.x devices to which Apple has added a chunk of, but not
# all of, the UEFI 2.x capabilities. RefindPlus is configured by default to
# amend a device's EFI Revision to v2.x, and then try to reinstall a copy
# of the GPU's Option ROM whenever it detects that GOP is not available.
# This permits running modern GPUs on some legacy units when they would
# otherwise fail to work. The change is reverted automatically once it
# is longer required to allow GPU activation except when the related
# "supply_uefi" setting is activate, as this overrides this revert.
#
# GPU Option ROMs are reinstalled (if required) when commented out
#
#disable_reload_gop

# Disable dispatching revealed DXE drivers during handle connection.
# The Controller/Handle connection exercise may sometimes reveal new
# DXE drivers on some firmware. RefindPlus versions before v0.13.2.AP
# automatically went into a loop to install such revealed DXE drivers
# until all such were installed. This installation loop *MAY* end with
# unwanted DXE drivers being installed, and also reduces loading speed
# while not being required on some types of firmware. Hence, an option
# to skip the process *MAY* be desirable on affected types of firmware.
#
# Inactive when commented out (Does not stop rescans for DXE drivers)
#
#disable_rescan_dxe

# Allow scans of multiple ESPs. When this option is active, RefindPlus
# will make other ESPs, separate from that containing RefindPlus,
# available to be scanned for kernels and loaders.
#
# Scans of other ESPs are prevented when commented out
#
#enable_esp_filter

# Force "TRIM" on non-Apple SSDs. TRIM, which may improve SSD health,
# is inactive by default for non-Apple SSDs in macOS. When this option
# is active however, RefindPlus will enforce macOS "TRIM" for all types
# of SSDs, including non-Apple SSDs. This setting only applies to macOS.
#
# Note that the setting will create a macOS NVRAM entry the first time it
# is triggered and that it will stay active until explicitly cleared even
# if the setting is subsequently disabled. Also, note that forcing TRIM
# on may significantly increase boot times and that enabling TRIM on
# non-Apple SSDs may affect the integrity of data on such SSDs.
#
# Inactive when commented out (Does not forcefully set TRIM)
#
#force_trim

# RefindPlus defaults to only scanning for ".VolumeIcon" icons on "internal"
# volumes. However, when this token is active (and the "hidden_icons_ignore"
# token is not) RefindPlus will also scan "external" volumes for these icons.
#
#hidden_icons_external

# RefindPlus defaults to scanning volumes for .VolumeIcon image icons and if
# found, these may be used as display icons for some volumes. However, most
# RefindPlus setups do not include these files and most of those that may
# do, typically Apple Macs, do not require the files as their icons in
# Refindplus. Hence, scanning for the files typically just slows the
# RefindPlus boot process down. When active, this speeds booting
# RefindPlus up by skipping scanning volumes for these files.
#
# NOTES:
# 1. This token overrides the "hidden_icons_external" and
#    the "hidden_icons_prefer" tokens when it is active.
# 2. This token is overridden by "decline_help_icon"
#
# Scans for ".VolumeIcon" icons when commented out
#
#hidden_icons_ignore

# RefindPlus always defaults to scanning volumes for .VolumeIcon image icons but
# any such files found are only used as last ditch display icons when all other
# display icon options fail. When this option is set, RefindPlus will instead
# first try to display ".VolumeIcon" image files before attempting to load
# other image icon files. This permits flexibility in theming loaders by
# positioning such files for loading by RefindPlus. Note however, that
# the "hidden_icons_ignore" option takes priority over this setting.
#
# NB: ".VolumeIcon" icon files can be in any supported format ...
# ICNS (*.icns), BMP (*.bmp), PNG (*.png), or JPG (*.jpg/jpeg).
#
# Does not prioritise ".VolumeIcon" images when commented out
#
# NOTE:
# 1. This token is overridden by "decline_help_icon"
#
#hidden_icons_prefer

# Offset the OS icon row position on the main screen vertically from the default.
# This token accepts positive/negative indicative flags that indicate the offset
# position of OS icons on the main RefindPlus screen. Such offsets may be useful
# when the default position of the icon row clashes with parts of custom banners.
# The indicative flags are:
#   1    - Move icon rows to the upper third of the screen
#   0    - Maintain default icon row position (mid screen)
#  -1    - Move icon rows to the lower third of the screen
#
# Defaults to zero when commented out (Does not move the icon rows)
#
#icon_row_move -1

# Finetune the OS icon row position set by the 'icon_row_move' setting. This
# token accepts positive/negative pixel values which are used to adjust the
# position of icon rows on the main RefindPlus screen. This adjustment may
# be needed to finetune the 'icon_row_move' outcome upwards or downwards.
#
# Defaults to zero when commented out (Does not adjust the icon rows)
#
#icon_row_tune 5

# When this option is activate, RefindPlus will prevent attempts to run loaders
# that are detected below a time interval after loading the screen to counteract
# spontaneous booting apparently resulting from keystroke buffers that appear to
# have been primed before RefindPlus is loaded. This appears to primarily affect
# UEFI-PC when RefindPlus is loaded done after first accessing the BIOS via keys
# such as "F12". The issue appears to be worse when external drives are present.
# A level of intervention is always active but this is typically not noticeable.
# The base threshold is increased on RefindPlus DBG build files as well as when
# external drives, including USB sticks, are detected on starting RefindPlus up.
# This token increases this derived base time threshold to a new time threshold
# below which attempts to run loaders will not be permitted in order to avoid
# RefindPlus spontaneously starting up default selections when it is loaded.
# NB: This feature does not operate on Apple firmware even when set here.
#
# Inactive when commented out (Does not increase base threshold interval)
#
#mitigate_primed_buffer

# When this option is activate, the RefindPlus "NvramProtect" feature will be
# extended, if set, to cover booting into macOS and "unknown" UEFI files.
# NB: This setting is only active, if set, on Apple firmware.
#     This feature is always disabled when RefindPlus is loaded via OpenCore.
#
# Inactive when commented out (Does not extend NvramProtect)
#
#nvram_protect_ex

# Allow/Prevent saving NVRAM variables based on an allowable variable size limit.
# NVRAM variables larger than the specified limit will be discard. This setting
# should only be used on Legacy Apple Macs where the built in feature for this
# may not be operational and should be set to match the specific allowed size
# for such units. Given the dificulty involved in finding this allowed size,
# this setting should not be set by most users. Note that this setting is
# only active on Apple firmware, requires the "NvramProtect" feature and
# that it is disabled when it is set to a value lower than 1024 bytes.
# Additionally, this option is only activated on direct macOS boots.
#
# Inactive when commented out (Does not filter NVRAM writes by size)
#
#nvram_variable_limit 2048

# Adds a UGA Protocol to GOP, when absent, to allow RefindPlus graphics
# display when using modern GPUs on units with only EFIBoot capability.
# NB: This functionality is only available on TianoCore builds.
#
# Inactive when commented out (Does not add UGA to GOP)
#
#pass_uga_through

# RefindPlus defaults to using the Graphic Output Protocol (GOP) for graphics
# output if available and only falls backs on the Universal Graphics Adapter
# (UGA) when this is available and GOP is not. When this setting is active,
# it will instead always use UGA when available and will not consider GOP.
# This may also improve RefindPlus loading speed on legacy UGA-Only GPUs.
#
# Inactive when commented out (Does not prefer UGA over GOP for graphics)
#
#prefer_uga

# Some computers, such as some classic MacPros, may have multiple GOP instances:
#     - One installed on the Console Out handle
#     - Others installed on GPU handles.
# GOP on the Console Out Handle is what everything uses and is provided by
# the system firmware and others by GPU Option ROMs. The system firmware
# should typically forward calls from the Console Out Handle GOP to the
# others transparently. On such models, it only works in this way with
# GPUs with system firmware support. This option replaces GOP on the
# Console Out Handle with one from a GPU Handle on such models when
# running capable GPUs that are not supported by system firmware.
# NB: This functionality is only available on TianoCore builds.
#
# Inactive when commented out (Does not provide GOP from GPU)
#
#provide_console_gop

# Some types of firmware, typically supplied by HP, may effectively lock partitions
# as their "DiskIo" protocols are opened "BY_DRIVER", or a "partition driver", but
# no filesystem is generated from the DiskIo. This stops other filesystem drivers
# from connecting to the handles to actually generate filesystems when attempts
# are made to install alternative drivers, making such partitions inaccessible
# or hang in RefindPlus (as firmware supplied drivers may not be compatible).
# When this token is active, RefindPlus disconnects such firmware supplied
# drivers to accommodate otherwise disabled user supplied alternatives.
# NB: This token is always disabled when Apple firmware is detected.
#     This functionality is only available on TianoCore builds.
#
# Inactive when commented out (Does not handle such partitions)
#
#ransom_drives

# Use a built-in GOP renderer which may provide enhanced performance
# and fix rendering issues on certain specific GPU models including
# the Radeon VII and some versions of the Radeon 5700 XT. However,
# this should only be used when there is an obvious benefit as it
# may result in glitches in the pre-boot configuration screen or
# slow scrolling response on booting into the operating system.
# NB: This functionality is only available on TianoCore builds.
#
# Inactive when commented out (Does not use the built-in GOP)
#
#renderer_direct_gop

# The SimpleText protocol on the ConsoleOut handle is usually used for
# text output. On Macs and some other firmware, this is complicated by
# the ConsoleControl protocol which determines whether to output text,
# graphics, or both, and this often results in an inability to display
# text, or use tools needing text output (such as EFI Shell). A custom
# text renderer is added on top of GOP by this option as a workaround.
# Note that this option is forced on whenever text output is required,
# such as when running EFI Shell or, whenever RefindPlus is changed to
# text mode as part of its operations (mainly to show error messages).
# NB: This functionality is only available on TianoCore builds.
#
# Inactive when commented out (Does not use a custom text renderer)
#
#renderer_text

# RefindPlus will automatically scale icons and text when HiDPI or LoRez screens
# are detected. The detection is basic and based on detecting a minimum 1601px
# resolution on the longest edge for HiDPI. Screens are considered to be LoRez
# based on detecting a resolution lower than 1025px on the longest edge.
# This setting allows overriding the detection as follows:
#  99    - Never scale UI elements
#   1    - Always scale UI elements up
#   0    - Scale UI elements, or not, based on screen resolution
#  -1    - Always scale UI elements down
#
# Scales UI elements based on screen resolution when commented out
#
#scale_ui 1

# Set the screen's background colour. RefindPlus defaults to using the
# RGB value of the first pixel (top left pixel) in the pixel array of
# the title banner image as set with the "banner" token in this file
# or an Apple LightGrey colour when that token is not set. This can
# be overridden by providing three (3) values, between 0 and 255,
# representing the desired RGB value for the background colour.
#
# Uses the default colour selection process when commented out
#
#screen_rgb 250 150 50

# Set arbitrary boot arguments on macOS boot. When this option is active,
# RefindPlus will change the macOS boot arguments to the specified string.
# This setting only applies to macOS and it accounts for arguments injected
# by the "disable_amfi" and "disable_compat_check" settings. Note that this
# will create a macOS boot argument the first time it is triggered and
# that the boot argument will remain active until it is explicitly
# cleared, even if this setting is subsequently deactivated.
#
# Inactive when commented out (Does not change boot arguments)
#
#set_boot_args "-v"

# Supply NVME driver. When this token is set, RefindPlus will
# use its 'SupplyNVME' feature to load a built in NvmExpressDxe
# driver to supply support when this is possible but unavailable.
# NB: This functionality is only available on TianoCore builds.
#
# Inactive when commented out (Does not supply NVMe support)
#
#supply_nvme

# Emulate UEFI 2.x support. The RefindPlus "SupplyUEFI" feature can
# emulate the "CreateEventEx" feature, introduced in UEFI 2.0, when not
# available. It additionally modifies the EFI Revision value to UEFI 2.3.
# This may allow running UEFI 2.x tools and drivers on EFI 1.x units such
# as Legacy Macs as several such tools only require CreateEventEx to work.
# NB: This functionality is only available on TianoCore builds.
#
# UEFI 2.x emulation is not provided when commented out
#
#supply_uefi

# RefindPlus defaults to storing the name of the last booted loader in
# the "PreviousBoot" variable in the NVRAM under the RefindPlus GUID. This
# provides a default option to be selected on the main screen when RefindPlus
# is loaded. This can however increase wear and tear on the NVRAM and disabling
# the "use_nvram" token writes variables to the filesystem instead, limiting this.
# On some setups however, such as when the "default_selection" token is set, such
# writes are not required to start with. When the "transient_boot" setting is
# active, RefindPlus will not store the "PreviousBoot" variable anywhere.
#
# Always saves the "PreviousBoot" variable when commented out
#
#transient_boot

# RefindPlus previously simply picked and used the first Unicode Collation
# Protocol instance it finds. This resulted in a lottery where such instances
# sometimes worked and sometimes did not. The proper implementation process
# however is to first locate every instance and select one that supports
# the English language. This has now been implemented.
# NB: This functionality is only fully available on TianoCore builds.
#
# Does not look for Unicode English support when commented out.
#
#unicode_collation


##--------------------------------------------------------------##
##                        Section 2 of 3                        ##
##                 AMENDED CONFIGURATION ITEMS                  ##
##           Existing Features Modified in RefindPlus           ##
##--------------------------------------------------------------##
#
#
# Set the CSR values for Apple's System Integrity Protection (SIP) and
# Sealed System Volume (SSV) features that define access levels on macOS.
# Values are hexadecimal numbers that define which specific security features
# are enabled. Below are the codes for what the values mean. Add them up (in hex)
# to set new values. Apple's "csrutil enable" and "csrutil disable" commands usually
# set values of 10 (ON) and 77 (OFF) respectively. Note that 77 is just a default OFF
# setting and that users can go beyond this, to values such as 87F, 97F - up to FFF.
# The "csrutil authenticated-root enable" and "csrutil authenticated-root disable"
# commands, added in macOS v11.x (Big Sur), set values of 10 (ON) and 87F (OFF)
# respectively, when run along with the "csrutil enable / disable" commands.
#
# As of macOS v11.x (Big Sur), the previous default setting of "10" (ON)
# may leave Macs not able to receive "Over The Air" (OTA) updates from
# Apple with the reliable setting being enabling SIP/SSV by clearing
# the stored CSR value in the NVRAM. RefindPlus will clear the CSR
# setting when "0" is used in place of "10" for the "OFF" value.
# This setting is also valid on earlier versions of macOS. It
# is recommended however, to keep the default "OFF" setting
# of "10" in place, and to use the "csr_normalise" token
# instead to better achieve the same end (both values).
#      CSR_ALLOW_UNTRUSTED_KEXTS                 0x0001
#      CSR_ALLOW_UNRESTRICTED_FS                 0x0002
#      CSR_ALLOW_TASK_FOR_PID                    0x0004
#      CSR_ALLOW_KERNEL_DEBUGGER                 0x0008
#      CSR_ALLOW_APPLE_INTERNAL                  0x0010
#      CSR_ALLOW_UNRESTRICTED_DTRACE             0x0020
#      CSR_ALLOW_UNRESTRICTED_NVRAM              0x0040
#      CSR_ALLOW_DEVICE_CONFIGURATION            0x0080
#      CSR_ALLOW_ANY_RECOVERY_OS                 0x0100
#      CSR_ALLOW_UNAPPROVED_KEXTS                0x0200
#      CSR_ALLOW_EXECUTABLE_POLICY_OVERRIDE      0x0400
#      CSR_ALLOW_UNAUTHENTICATED_ROOT            0x0800
# The "CSR Rotate" tool actually rotates defined values
# and does not just implement a binary toggle of two (2)
# values. Hence, three (3) or more values can be defined
# which will be rotated in turn in a loop by CSR Rotate.
#
# Inactive when commented out (CSR values for SIP/SSV cannot be set)
#
#csr_values 10,77

# Set the logging level. When set to "0", a log file in the native RefindPlus format
# is produced in the RefindPlus home directory on the ESP, logging information about
# what RefindPlus is doing. When set to "1" or above, the logging is in the upstream
# format instead (a variant of). The maximum log level is Level 2, but this level is
# only available when exposed at compilation time for forensic debugging. This means
# that Levels 0 and 1 are the available log levels for typical users. This option is
# only active when running DEBUG builds and the logging process, particularly higher
# levels, can noticeably slow RefindPlus operation and time must be given as needed.
#
# The native format is used when commented out (DEBUG builds only)
#
#log_level 1

# Set the screen's display resolution. Pass this option either:
#         * One Value (corresponding to one UEFI GOP video mode)
#         * Two Values (corresponding to the X and Y resolutions)
# Note that not all resolutions are supported. On UEFI 2.x systems,
# passing an incorrect value results in a message being shown on the
# screen to that effect, along with a list of supported modes. With
# EFI 1.x systems, such as legacy Macs, setting an incorrect mode
# silently fails. On both types of systems, setting an invalid
# resolution results in the default resolution being used.
#
# Uses the maximum screen resolution when commented out
#
#resolution 1024 768
#resolution 1440 900
#resolution 3
#resolution max

# Blank screen and show different solid colours after the specified
# number of seconds without input. Screen is restored on keypresses
# (Excluding keys such as "Shift", "Control", "Alt", and "Option").
# "-1" causes RefindPlus to start up with the screensaver active.
#
# The screensaver is disabled when commented out
#
#screensaver 300

# Non-bootloader tools to show on the "tools" line
# of the main menu and their display order:
#  shell            - UEFI/EFI Shell.
#                     NB: Requires external program
#                         See documentation for details
#  memtest          - Memory Testing Utility.
#                     NB: Requires external memtest program
#  gptsync          - The (Dangerous) 'GPTsync' Utility.
#                     NB: Requires external program
#                         See documentation for details
#  gdisk            - Disk Partitioning Utility.
#                     NB: Requires external program
#                         See documentation for details
#  clean_nvram      - Enables NVRAM Reset from RefindPlus.
#                     NB: Needs External program.
#  apple_recovery   - Loads Apple Mac Recovery partitions, if present
#  windows_recovery - Boots an OEM Windows recovery tool, if present.
#                     NB: Also refer to the "windows_recovery_files" option
#  mok_tool         - Enables the Machine Owner Key (MOK) maintenance tool,
#                     MokManager.efi, used on Secure Boot systems
#  csr_rotate       - Adjusts Apple's System Integrity Protection (SIP) policy.
#                     NB: Requires "csr_values" to be set.
#  install          - Enables option to install RefindPlus from the current
#                     location to another ESP
#  bootorder        - Adjust firmware boot order variables
#  about            - An "About This Program" option
#  hidden_tags      - Manage hidden tags
#  exit             - A tag to exit RefindPlus
#  shutdown         - Shuts the computer down.
#                     NB: A bug causes this to reboot many UEFI systems
#  reboot           - A tag to reboot the computer normally
#  firmware         - A tag to reboot the computer into the firmware's user interface.
#                     NB: Ignored on older computers.
#  fwupdate         - A tag to update the firmware; launches the fwupx64.efi (or similar) program
#  netboot          - Launch the ipxe.efi tool for network (PXE) booting
#
# The default setting is shell, memtest, gdisk, apple_recovery, windows_recovery, mok_tool, about, hidden_tags, shutdown, reboot, firmware, fwupdate
#
# Setting "showtools" alone, with no options, completely disables scanning for tools.
# Scans for default tools when commented out
#
#showtools shell,bootorder,gdisk,memtest,mok_tool,apple_recovery,windows_recovery,about,hidden_tags,reboot,exit

# Stub support for gzipped loaders. Linux kernels are self-decompressing on x86
# and on x86-64 platforms while on ARM64, Linux kernel files, including the EFI
# stub loader are typically compressed with gzip. This prevents them from being
# loaded by tools such as RefindPlus unless the tool uncompresses them itself.
# This option was added upstream to do this but as it cannot be fully compiled
# into RefindPlus and is unnecessary on x86 and on x86-64 systems, only a stub
# implementation that logs the situation is currently provided by RefindPlus.
#
# Inactive when commented out (The "GZippedLoaders" Feature is not active)
#
#support_gzipped_loaders

# Timeout in seconds for the main menu screen. Setting the timeout to "0"
# disables automatic booting (i.e., no timeout). Setting "-1" results in
# an immediate boot to the default OS (DirectBoot Feature) unless there
# is a keypress already present in the buffer. In this case, the value
# is interpreted as a shortcut key. When the "ESC" or SpaceBar key is
# pressed instead, the DirectBoot Feature is overridden and the main
# menu screen is displayed as normal. If the shortcut key cannot be
# matched to a valid shortcut, the main menu is displayed instead.
#
# The timeout is disabled when commented out
#
#timeout 20

# Launch specified loader in graphics mode. RefindPlus defaults to
# text mode and displays basic pre-launch information when launching
# operating systems (apart from macOS). Using graphics mode can provide
# a more seamless transition, but may not display any information, which
# can make it difficult to debug problems. However, using graphics mode
# may prevent crashes in some instances. Note that specifying an empty
# list will set RefindPlus up to boot all loader types in text mode.
#
# Valid options:
#   osx         - macOS loader
#   windows     - Windows loader
#   linux       - Linux stub loader
#   grub        - The GRUB boot loader
#   elilo       - The ELILO boot loader
#   clover      - The Clover boot loader
#   opencore    - The OpenCore boot loader
#
# Defaults to 'osx' when commented out (Launches macOS in graphics mode)
#
#use_graphics_for osx,linux

# While using the NVRAM works with most computers, this can increase wear
# and tear on the motherboard's NVRAM. Under conditions where the NVRAM is
# old and/or worn out, it may then fail and result in an inability to boot.
# Storing variables on disk is a viable alternative and RefindPlus can save
# its variables to a folder on the filesystem instead. This will however not
# work if RefindPlus is on a filesystem that is read-only to the EFI, such as
# HFS+ volumes. In such cases, an attempt to write to the first ESP RefindPlus
# can identify will be made. If the attempt is not successful, the variable will
# not be saved and this fact will be logged if running the debug version. NB: This
# option only applies to RefindPlus variables such as the PreviousBoot, HiddenTags,
# HiddenTools, and HiddenLegacy variables and does not apply to any variables from
# other processes/libraries (These are always written to the motherboard's NVRAM).
#
# Stores RefindPlus-Specific variables on the filesystem when commented out
#
#use_nvram


##--------------------------------------------------------------##
##                        Section 3 of 3                        ##
##                STANDARD CONFIGURATION ITEMS                  ##
##                  Unchanged  Functionality                    ##
##--------------------------------------------------------------##
#
#
# When scanning volumes for EFI bootloaders, RefindPlus always looks for
# the macOS and Microsoft Windows bootloaders in their normal locations
# and scans the root directory as well as sub folders under the "EFI"
# folder for more bootloaders (Does not recurse into sub folders).
#
# The "also_scan_dirs" option adds more directories to the scan list and
# directories are specified relative to the volume's root directory. This
# option applies to ALL the volumes that RefindPlus scans UNLESS a volume
# name and a colon are included before the directory name (myvol:/somedir)
# to scan the "somedir" directory only on the filesystem named "myvol". If
# a specified directory does not exist, it is ignored (no error message).
#
# Scans "boot" and "@/boot" when commented out
#
#also_scan_dirs ESP2:EFI/linux/kernels
#also_scan_dirs @/kernels,@/root/boot

# Use a custom title banner and not the default (embedded) banner. The
# file path is relative to the directory where the RefindPlus binary is
# located. The colour of the top left corner of the image is used for the
# background colour for the menu screens. Currently, uncompressed BMP files
# with colour depths of 24, 8, 4 or 1 bits are supported, as well as PNG and
# JPEG files. ICNS files can also be used but have limitations that make them
# poor choices for this purpose. Some PNG and JPEG features are not supported
# and some file formats, such as "progressive" JPEG files, are not supported.
#
# Uses the default title banner when commented out
#
#banner hostname.bmp
#banner mybanner.jpg
#banner icons/snowy/banner-snowy.png

# How to handle banners that are not the same size as the screen size:
#     noscale     - Crop if too big or show with border if too small
#     fillscreen  - Fill the screen
#
# Uses "noscale" when commented out
#
#banner_scale fillscreen

# Set the default menu selection. The available arguments match the keyboard
# accelerators available within RefindPlus. Select the default loader using:
#  - A digit between 1 and 9, in which case the Nth loader in the menu
#    will be the default.
#  - A "+" symbol at the start of the string, which refers to the most
#    recently booted loader (Unless overriden by 'transient_boot').
#  - Any substring that corresponds to a portion of the loader's title
#    (usually the OS's name, boot loader's path, or a volume or
#    filesystem title).
# Multiple selectors may be specified by separating them with commas
# and enclosing the list in quotes (The "+" option is only meaningful
# in this context). If the selector(s) has two times in 24-hour format,
# the default will apply only between those times. The times are in the
# motherboard's time standard, whether that is UTC or local time, so if
# on UTC, adjust this from local time manually. Times may span midnight
# as in "23:30 00:30", which applies to 11:30 PM to 12:30 AM. Multiple
# "default_selection" lines can be specified, in which case the last
# match takes precedence. Thus, a main option without a time can be
# set followed by one or more that include times to set different
# defaults for different times of day.
#
# Defaults to "+" when commented out (Selects the last run loader)
#
#default_selection 1
#default_selection Microsoft
#default_selection "bzImage,vmlinuz"
#default_selection Maintenance 23:30 2:00
#default_selection "Maintenance,macOS" 1:00 2:30

# Directories that should *NOT* be scanned for boot loaders. This option can be
# used to keep EFI/boot/bootx64.efi out of the menu if that is a duplicate of
# another boot loader, to exclude directories holding drivers or to exclude
# directories with non-bootloader utilities from a hardware manufacturer.
#
# This token takes precedence if a directory is listed both here and in
# "also_scan_dirs". Note that this applies to ALL the filesystems that
# RefindPlus scans, and not just the ESP, unless the directory name
# is preceded by a filesystem name or partition unique GUID, such
# as "myvol:EFI/somedir", to exclude EFI/somedir from the scan
# on the "myvol" volume but not on other volumes.
#
# The default setting is L"EFI/tools_{arch},EFI\tools,
# EFI\tools_{arch}\memtest86,EFI\tools_{arch}\memtest,EFI\tools_{arch}\memtest86p,
# EFI\tools\memtest86,EFI\tools\memtest,EFI\tools\memtest86p,
# EFI\BOOT\tools_{arch}\memtest86,EFI\BOOT\tools_{arch}\memtest,
# EFI\BOOT\tools_{arch}\memtest86p,EFI\BOOT\tools\memtest86,EFI\BOOT\tools\memtest,
# EFI\BOOT\tools\memtest86p,EFI\BOOT\memtest86,EFI\BOOT\memtest,EFI\BOOT\memtest86p,
# EFI\memtest86,EFI\memtest,EFI\memtest86p" ("{arch}" is the architecture, such as "x64").
#
# Uses default setting when commented out
#
#dont_scan_dirs ESP:/EFI/boot,EFI/Dell,EFI/memtest86

# Files that should NOT be included as EFI boot loaders (on the
# first line of the display). To be used with boot loaders that
# rely on support programs or drivers that are installed along
# with the main binary or to block certain loaders by name and
# not by location. Note however, that this setting does *NOT*
# prevent certain binaries from showing up in the second-row
# set of tools. Notably, some Secure Boot and recovery tools
# are present in this list but may appear as second-row items.
# Files may be specified as a bare name (e.g., "notme.efi"), as
# a full pathname (e.g., "/EFI/somedir/notme.efi"), or as a full
# pathname with volume, such as "SOMEDISK:/EFI/somedir/notme.efi"
# or 2C17D5ED-850D-4F76-BA31-47A561740082:/EFI/somedir/notme.efi".
# OS tags hidden via the "Delete" or "-" key in the RefindPlus menu
# are added to this list, but stored in NVRAM (Hardware or Emulated).
#
# The default setting is L"shim-fedora.efi,shim-centos.efi,PreLoader.efi,
# TextMode.efi,ebounce.efi,GraphicsConsole.efi,bootmgr.efi,shim.efi,fb.efi,
# shim{arch}.efi,fb{arch}.efi" ("{arch}" is the architecture, such as "x64").
#
# Uses default setting when commented out
#
#dont_scan_files shim.efi,MokManager.efi

# "Boot####" variables that should NOT be offered as loaders
# when "firmware" is an option to "scanfor". The comma-separated
# list presented here contains strings that are matched against the
# description field. If a value here is a case-insensitive substring
# of the boot option description, it will be excluded from the boot
# list. Strings that includes spaces must be enclosed in quotes.
# Specifying "shell" will override the automatic inclusion of
# built-in EFI shells.
#
# Has an empty list (nothing is excluded) when commented out
#
#dont_scan_firmware HARDDISK,shell,"Removable Device"

# Tool binaries to be excluded from the tools line, even when the
# general class is specified in showtools. This enables trimming an
# overabundance of tools, such as when there are multiple mok_tool
# entries after installing multiple Linux distributions. A single
# filename, a full pathname, or a volume identifier (filesystem
# label, partition name, or partition GUID) along with a full
# pathname can be specified.
#
# Has an empty list (nothing is excluded) when commented out
#
#dont_scan_tools ESP2:/EFI/ubuntu/mmx64.efi,gptsync_x64.efi

# Partitions (or whole disks, for legacy-mode boots) to omit from scans.
# For "EFI-mode" scans, volumes are typically specified by their labels,
# which can be obtained in an EFI shell with "vol" from Linux by typing
# "blkid /dev/{devicename}", or by examining the disk label in various
# operating system file browsers. Partitions can also be identified by
# the unique GUIDs ("PARTUUID" in Linux parlance). (Note that this is
# not the partition TYPE CODE GUID). The identifier can be obtained
# by using the "diskutil info {partition-id}" command in macOS or
# the "blkid" command in Linux. Any sub-string of the bootloader
# description (displayed when the option is highlighted) can be
# used for legacy-mode scans.
#
# The default setting is "LRS_ESP"
#
# Uses default setting when commented out
#
#dont_scan_volumes "Boot OS X"

# Enable VMX bit and lock the CPU MSR if unlocked. On some
# Intel Apple computers, the firmware does not lock the MSR 0x3A.
# The symptom on Windows is "Hyper-V" not working even if the CPU
# meets the minimum requirements (HW assisted virtualisation and SLAT)
#
# !!!*** ONLY SET ON INTEL CPUS WITH VMX SUPPORT ***!!!
# Refer to the link below for more on this subject:
# http://www.thomas-krenn.com/en/wiki/Activating_the_Intel_VT_Virtualization_Feature
#
# Inactive when commented out (Does not try to enable and lock the MSR)
#
#enable_and_lock_vmx

# Enable mouse support. If active, this option enables the use
# of the computer's mouse. Note however, that not all computers
# provide the necessary underlying support, so this feature may
# not always work. If it does work, an OS or tool can be launched
# by clicking it with the computer's mouse. Note that this feature
# is mutually exclusive with the "enable_touch" feature and if both
# settings are active, the "enable_touch" token will take precedence.
#
# Inactive when commented out (Does not enable mouse support)
#
#enable_mouse

# Enable touch screen support. If active, this option enables the use
# of touch screen controls (as on tablets). Note however, that not all
# tablet EFIs provide the necessary underlying support, so this feature
# may not always work. If it does work, an OS or tool can be launched by
# touching it. In a submenu, touching anywhere launches the current item
# selected. There is currently no way to select a specific submenu item.
# This option is mutually exclusive with the "enable_mouse" feature and
# the "enable_touch" option will take precedence when both are active.
#
# Inactive when commented out (Does not enable touch screen support)
#
#enable_touch

# Comma-delimited list of strings to treat as if they were numbers for the
# purpose of kernel version number detection. These strings are matched on a
# first-found basis; that is, to treat both "linux-lts" and "linux" as version
# strings, they MUST be specified as "linux-lts,linux", since if specified the
# other way, both vmlinuz-linux and vmlinuz-linux-lts will return with "linux"
# as the version string, which is not desirable. Whenever the kernel or initrd
# file include both a specified string and digits, the version string includes
# both. For example, "vmlinuz-linux-4.8" outputs a "linux-4.8" version string.
# This option is intended for Arch and other distributions that do not include
# version numbers in their kernel filenames, but may provide other uniquely
# identifying strings for multiple kernels. If this feature causes problems
# (say, the kernel filename includes "linux" but the initrd filename does
# not), set the option to an empty string (or comment out) to disable.
#
# Inactive when commented out (No extra version strings are used)
#
#extra_kernel_version_strings linux-lts,linux

# Combine all Linux kernels in a given directory into a single entry.
# When active, the kernel with the most recent timestamp will be loaded
# by default, and its filename will appear in the entry's description.
# To launch other kernels, the user must press "F2" or "Insert",
# after which alternate kernels will appear as submenu items.
#
# Settings are:
#       0    - Combine Linux kernel entries: OFF
#       1    - Combine Linux kernel entries: ON
#
# Active when commented out (Combines Linux kernel entries)
#
#fold_linux_kernels 0

# When this option is activated, RefindPlus will process symlinked loaders.
# Symlinks are ignored by default as they may result in undesirable outcomes.
# This token may however be useful on Linux setups that use symlinked loaders.
#
# Inactive when commented out (Does not process symlinked loaders)
#
#follow_symlinks

# Set the font to be used for all textual displays in graphics mode.
# For the best results, fonts used should be in PNG format with alpha
# channel transparency. It must contain ASCII characters 32-126 (space
# through tilde), inclusive, as well as a glyph to be displayed in place
# of characters outside this range (96 glyphs in total). Only monospaced
# fonts are supported. Fonts may be of any size, although large fonts can
# produce display irregularities.
#
# Uses the built-in font, Luxi Mono Regular 12 point, when commented out
#
#font myfont.png

# Hide user interface elements for personal preference or for security:
#  banner      - the RefindPlus title banner (built-in or loaded via "banner")
#  label       - boot option text label in the menu
#  singleuser  - remove the submenu options to boot macOS in single-user
#                or verbose modes (macOS only)
#  safemode    - remove the submenu option to boot macOS in "safe mode"
#  hwtest      - the submenu option to run Apple's hardware test
#  arrows      - scroll arrows on the OS selection tag line
#  hints       - brief command summary in the menu
#  editor      - the options editor (+, F2, or Insert on boot options menu)
#  badges      - device-type badges for boot options
#  all         - all of the above
#
# All elements are active when commented out
#
#hideui singleuser
#hideui all

# Set the name of a subdirectory in which icons are stored. All icons must
# have the same names as in the standard directory. The subdirectory name
# is specified relative to the directory with the RefindPlus efi binary.
# If an icon cannot be found in the specified directory, an attempt is
# made to load it from the default directory. Therefore, icons can be
# replaced in a directory and the default relied on for others. Icon
# files may be in any supported format ICNS (*.icns), BMP (*.bmp),
# PNG (*.png), or JPEG (*.jpg or *.jpeg). However, RefindPlus'
# BMP and JPEG  implementations do not support transparency,
# which is highly desirable in icons.
#
# Loads icons from the "icons" folder when commented out
#
#icons_dir myicons
#icons_dir icons/snowy

# Filename prefixes that indicate a file is a Linux kernel. Files that
# begin with any of these strings are treated as Linux kernels, if they
# are also EFI boot loaders. Default is "vmlinuz,bzImage,kernel",
# except on ARM64, where it is "vmlinuz,Image,kernel".
#
#linux_prefixes zImage

# Set the maximum number of tags that can be displayed on the screen at
# any time. If more loaders are discovered than this value, RefindPlus shows
# a subset in a scrolling list. If this value is set too high for the screen
# to handle, it is reduced to the value that the screen can manage. If this
# value is set to "0", it is adjusted to a number the screen can handle.
#
# Adjusts displayed boot loaders to screen width when commented out
#
#max_tags 0

# Size of the mouse pointer,
# in pixels, per side.
#
# Uses a mouse size of 16 when commented out
#
#mouse_size 18

# Speed of mouse tracking. Higher numbers equate to faster
# mouse movement. This option requires "enable_mouse" to
# be uncommented. Valid values are 1 to 32 (inclusive).
#
# Uses a mouse speed of 4 when commented out
#
#mouse_speed 6

# Set the EFI text mode to be used for textual displays. This option
# takes a single digit that refers to a mode number. Mode "0" is usually
# 80x25, "1" is sometimes 80x50, and higher numbers are system-specific
# modes. Mode "1024" is a special code that sets RefindPlus not to use
# text mode specifically but to instead use whatever mode was in use
# when it was launched. If an invalid mode is specified, RefindPlus
# will pause booting to display information on valid modes instead.
#
# CAUTION: On VirtualBox, and perhaps on some real computers, specifying
# a text mode and uncommenting the "textonly" option without specifying
# a resolution may result in an unusable operating system display.
#
# Uses Mode 1024 when commented out
#
#textmode 2

# Use text screen mode. When enabled, this option sets the RefindPlus
# screen mode to text mode. Graphics screen mode is used otherwise.
#
# Uses graphics screen mode when commented out
#
#textonly

# Which types of boot loaders to search, and in what order to display them:
#  internal      - internal EFI disk-based boot loaders
#  external      - external EFI disk-based boot loaders
#  optical       - EFI optical discs (CD, DVD, etc.)
#  netboot       - EFI network (PXE) boot options
#  hdbios        - BIOS disk-based boot loaders
#  biosexternal  - BIOS external boot loaders (USB, eSATA, etc.)
#  cd            - BIOS optical-disc boot loaders
#  manual        - use stanzas later in this configuration file
#  firmware      - boot EFI programs set in the firmware's NVRAM
# Note that the legacy BIOS options require firmware support, which is
# not present on all computers.
# The netboot option is experimental and relies on the ipxe.efi and
# ipxe_discover.efi program files.
#
# On UEFI PC, the default setting is internal,external,optical,manual
# On Mac, the default is internal,hdbios,external,biosexternal,optical,cd,manual
#
#scanfor internal,external,optical,manual

# Scan for Linux kernels that lack a ".efi" filename extension. This
# is useful for better integration with Linux distributions that provide
# kernels with EFI stub loaders but that do not give those kernels filenames
# that end in ".efi", particularly if the kernels are stored on a filesystem
# that the EFI can read. When active, this option makes all files in scanned
# directories with names that begin with "vmlinuz", "bzImage", or "kernel"
# be included as loaders (even if they do not have ".efi" extensions).
#
# Inactive when commented out (Only scans for kernels with ".efi" extensions)
#
#scan_all_linux_kernels

# Delay for the specified number of seconds before scanning disks.
# This may help when disks are not detected until "ESC" is pressed.
#
# Inactive when commented out (Does not wait before scanning disks)
#
#scan_delay 2

# Directories in which to search for UEFI drivers. These drivers
# provide filesystem support, give access to hard disks on plug-in
# controllers, etc. When such drivers are present and RefindPlus is
# required to automatically load them, paths to the driver locations
# should be specified here. RefindPlus always scans the "drivers" and
# and "drivers_{arch}" subdirectories of its installation directory
# (NOTE: {arch} = architecture code). This option specifies other
# *ADDITIONAL* directories to scan along with these defaults.
#
# Inactive when commented out (Does not scan additional directories)
#
#scan_driver_dirs EFI/tools/drivers,drivers

# Custom background image for selected item. There is a big one (144 x 144)
# for the OS icons, and a small one (64 x 64) for the function icons in the
# second row. When images other than optimally sized ones are specified, they
# may be scaled in an "ugly" way. When a specified image is not available, the
# built-in default will be used instead. This replacement with a default image
# applies to both the specified "small" and "big" selection images separately.
#
# As with the "banner" setting below, these options take filenames of
# uncompressed BMP, JPEG, PNG or ICNS image files with a colour depth
# of 24, 8, 4, or 1 bits. PNG or ICNS image files are required for
# transparency support. As with the "banner" setting below, paths
# are relative to the directory containing the RefindPlus efi.
#
# NB: The file used for 'selection_small' must be no more
# than 256px on the longest side while that used as the
# 'selection_big' image must be no larger than 512px.
# Custom selection images larger these thresholds
# will be replaced with default embedded images.
#
# Uses default selection images when commented out
#
#selection_big icons/selection-big.png
#selection_small icons/selection-small.png

# RefindPlus defaults to booting the item indicated by "default_selection"
# after the timeout period has passed. When this option is activated,
# RefindPlus will instead attempt to shut down the computer.
#
# !!!*** MANY COMPUTERS WILL HANG OR REBOOT INSTEAD ***!!!
# Macs and recent UEFI-PCs are most likely to work with this feature.
#
# Boots the default selection on timeout when commented out
#
#shutdown_after_timeout

# Icon sizes. All icons are square, so just one value is specified. The
# big icons are used for OS selectors in the first row and the small icons
# are used for tools on the second row. Drive-type badges are 1/4 the size
# of the big icons. Legal values are 32 and above. If the icon files do not
# hold icons of the proper size, the icons are scaled to the specified size.
#
# Uses 48 and 128 for small and big icons respectively when commented out
#
#small_icon_size 96
#big_icon_size 256

# Tell a Mac's EFI that macOS is about to be launched, even when it is not.
# This option causes some Macs to initialise their hardware in a different
# way to how it is normally initialised when a third-party OS is launched.
# In some cases, particularly on Macs running multiple video cards, this
# option can cause hardware to work when they would not otherwise work.
# On the other hand however, the use of this option when not required
# can make some hardware, typically keyboards and mice, inaccessible.
# Hence, this option should only be used when experiencing problems
# with some hardware devices on non-Apple operating systems. When
# needed, a value of "10.9" usually works, but other values may
# also work. This option has no effect on non-Apple computers.
#
# Inactive when commented out (No macOS version spoofing)
#
#spoof_osx_version 10.9

# By default, RefindPlus relies on the UEFI firmware to detect BIOS-mode boot
# devices. However, this does not always detect all available devices and
# in such cases, this option triggers a forced scan and modification of
# NVRAM variables on each boot. This option has no effect on Macs or
# when no BIOS-mode options have been set via the "scanfor" option.
#
# Inactive when commented out (Does not result in a forced scan)
#
#uefi_deep_legacy_scan

# Boot loaders that can launch a Windows restore or emergency system.
# These tend to be OEM-specific.
#
# The default setting is LRS_ESP:/EFI/Microsoft/Boot/LrsBootmgr.efi
#
#windows_recovery_files LRS_ESP:/EFI/Microsoft/Boot/LrsBootmgr.efi

# Write to systemd UEFI variables (currently only LoaderDevicePartUUID)
# when launching Linux via an EFI stub loader, ELILO, or GRUB. This
# variable, when present, causes systemd to mount the ESP at /boot
# *IF* that directory is empty and nothing else is mounted there.
#
# Inactive when commented out (No systemd mount attempt)
#
#write_systemd_vars

# Include a secondary configuration file within this one. This secondary
# file is loaded as if its tokens appeared at the point of the "include"
# option. So, to override a setting in the main file, the secondary file
# must be referenced AFTER the setting to be overridden. NB: A secondary
# configuration file CANNOT "include" tertiary configuration files.
#
# Manual configuration stanzas (see next item) may also be specified within
# separate files and loaded as if their tokens appeared at the point of the
# "include" option. Multiple such manual configuration stanza files can be
# defined in addition to, or instead of, secondary configuration files as
# described above. NB: Included manual configuration stanza files cannot
# "include" tertiary, or other manual configuration stanza, files.
#
# Inactive when commented out (secondary file is not loaded)
#
#include manual.conf
#include stanza-01.conf
#include stanza-02.conf

# Manual configuration stanzas. Each one begins with a "menuentry"
# keyword followed by a name that will appear in the menu screen
# (use quotes if the name has spaces) and an open curly brace,
# ("{"). Each stanza ends with a close curly brace, ("}").
#
# Common keywords in manual stanzas are:
#  disabled    - use alone or set to "yes" to disable this entry.
#  ostype      - OS type code to determine boot options available by
#                pressing Insert. Valid values are "MacOS", "Linux",
#                "Windows", and "XOM". Case-sensitive.
#  graphics    - set to "on" to enable graphics-mode boot (useful
#                mainly for MacOS) or "off" for text-mode boot.
#                The default setting is auto-detected from the
#                loader filename.
#  volume      - identifies the filesystem from which subsequent files
#                are loaded. The volume can be specified by filesystem
#                label, by partition label, or by partition GUID number
#                (but *NOT* yet by filesystem UUID number).
#  icon        - specifies a custom boot loader icon
#  loader      - identifies the boot loader file
#  initrd      - Specifies an initial RAM disk file
#  options     - sets options to be passed to the boot loader; use
#                quotes if more than one option should be passed or
#                if any options use characters that might be changed
#                by RefindPlus' parsing procedures (=, /, #, or tab).
#  add_options - As "options" above but only applicable when under a
#                "submenuentry" keyword. It adds the options to those
#                set for the main "menuentry" keyword.
#
# Note that you can use either DOS/Windows/EFI-style backslashes (\)
# or Unix-style forward slashes (/) as directory separators. Either
# way, all file references are on the ESP from which RefindPlus was
# launched. The order of tokens above optimises loading RefindPlus.
# Use of quotes around parameters causes them to be interpreted as
# one keyword, and for parsing of special characters (spaces, =, /,
# and #) to be disabled. This is useful mainly with the "options"
# keyword. Use of quotes around parameters that specify filenames is
# permissible, but you must then use backslashes instead of slashes,
# except when you must pass a forward slash to the loader, as when
# passing a root= option to a Linux kernel. RefindPlus will load
# faster if the "icon" line appears before the "loader" line.
# Similarly, the "disabled" line, when used, should be
# immediately after the "menuentry" line.

# Below are several sample boot stanzas (Disabled by default).
# Find one similar to what is required, copy it, remove the
# "disabled" line, and adjust the other entries to suit.

# A sample entry for a Linux 3.13 kernel with EFI boot stub support
# on a partition with a GUID of 904404F8-B481-440C-A1E3-11A5A954E601.
# This entry includes Linux-specific boot options and specification
# of an initial RAM disk. Note uses of Linux-style forward slashes.
# Also note that a leading slash is optional in file specifications.
#
menuentry Linux {
    disabled
    volume 904404F8-B481-440C-A1E3-11A5A954E601
    icon EFI/refindplus/icons/os_linux.png
    loader bzImage-3.3.0-rc7
    initrd initrd-3.3.0.img
    options "ro root=UUID=5f96cafa-e0a7-4057-b18f-fa709db5b837"
}

# Below is a more complex example for Linux, specifically for Arch Linux.
# This example MUST be modified for each specific installation. If nothing
# else, the PARTUUID code must be changed to match the disk in use. As Arch
# Linux does not include version numbers in its kernel and initrd filenames,
# manual boot stanzas may be required when using fallback initrds or multiple
# kernels with Arch Linux. This example is modified from one in the Arch wiki
# page on rEFInd (https://wiki.archlinux.org/index.php/rEFInd).
#
menuentry "Arch Linux" {
    disabled
    volume   "Arch Linux"
    icon     /EFI/refindplus/icons/os_arch.png
    loader   /boot/vmlinuz-linux
    initrd   /boot/initramfs-linux.img
    options  "root=PARTUUID=5028fa50-0079-4c40-b240-abfaf28693ea rw add_efi_memmap"
    submenuentry "Boot using fallback initramfs" {
        initrd /boot/initramfs-linux-fallback.img
    }
    submenuentry "Boot to terminal" {
        add_options "systemd.unit=multi-user.target"
    }
}

# A sample entry for loading Ubuntu using its standard name for
# its GRUB 2 bootloader. Note use of Linux-style forward slashes
#
menuentry Ubuntu {
    disabled
    icon   /EFI/refindplus/icons/os_linux.png
    loader /EFI/ubuntu/grubx64.efi
}

# A minimal ELILO entry. Offers nothing
# that auto-detection cannot accomplish.
#
menuentry "ELILO" {
    disabled
    loader \EFI\elilo\elilo.efi
}

# This, like the ELILO entry, offers nothing additional to auto-detection
# but may help with disabling auto-detection while still booting Windows
#
menuentry "Windows 7" {
    disabled
    loader \EFI\Microsoft\Boot\bootmgfw.efi
}

# EFI shells are programs just like boot loaders, and can be
# launched in the same way. A shell can be passed the name of
# a script that it is to run on the "options" line. The script
# could initialise hardware and then launch an OS, or it could
# do something entirely different.
#
menuentry "Windows via shell script" {
    disabled
    icon \EFI\refindplus\icons\os_win.png
    loader \EFI\tools\shell.efi
    options "fs0:\EFI\tools\launch_windows.nsh"
}

# MacOS is normally detected and run automatically; however,
# a manual boot stanza may permit customisation. This example
# does nothing very unusual, but may serve as a start point.
# Note that the "volume" line in the example will almost
# certainly need modification for it to actually work.
#
menuentry "My MacOS" {
    disabled
    volume "MacOS boot"
    icon \EFI\refindplus\icons\os_mac.png
    loader \System\Library\CoreServices\boot.efi
}

# The "firmware_bootnum" token takes a HEXADECIMAL value and
# sets that value using the EFI's "BootNext" variable and then
# reboots the computer. This triggers a one-time boot using this
# boot option. This can be used for various purposes but one that
# may be of interest is that some Macs may produce lower-resolution
# displays with HiDPI monitors when booted via RefindPlus compared to
# when booted via the Apple boot manager. Booting with RefindPlus using
# this option may output a higher resolution in such cases. Note that the
# "loader" manual stanza option is not used with this type of configuration.
#
menuentry "MacOS via BootNext" {
    disabled
    icon /EFI/refindplus/icons/os_mac.png
    firmware_bootnum 80
}
