[PATCH 0/8] generic command line v4

[PATCH 0/8] generic command line v4

[Daniel Walker]

v4 release changes

* Updated insert-sys-cert tool to change command line symbols after
  compilation.

	This tool is used to release binary kernels internally to companies
	and then later insert certificates for each product by consumers of
	the binary kernel. Cisco uses this tool for this purpose.

	Cisco has a similar need for the command line to be modified on a
	binary released kernels similar to how certificates are setup.

* Added global symbols to hold append and prepend values.

	These changes follow the system certificate code to allow the
	insert-sys-cert tool to be used.

* Added a test case to confirm functionality.

	Seemed sensible to add this to make sure everything is working.

* Dropped powerpc changes

	Christophe Leroy has reservations about the features for powerpc. I
	don't think his reservations are founded, and these changes should
	fully work on powerpc. However, I dropped these changes so Christophe
	can have more time to get comfortable with the changes.


Enjoy!


Daniel Walker (8):
  CMDLINE: add generic builtin command line
  scripts: insert-sys-cert: add command line insert capability
  scripts: insert-sys-cert: change name to insert-symbol
  CMDLINE: mips: convert to generic builtin command line
  drivers: firmware: efi: libstub: enable generic commandline
  CMDLINE: x86: convert to generic builtin command line
  of: allow sending a NULL value to early_init_dt_scan_chosen
  CMDLINE: arm64: convert to generic builtin command line

 arch/arm64/Kconfig                            |  33 +--
 arch/arm64/include/asm/setup.h                |   2 +
 arch/arm64/kernel/idreg-override.c            |   9 +-
 arch/mips/Kconfig                             |   4 +-
 arch/mips/Kconfig.debug                       |  44 ----
 arch/mips/configs/ar7_defconfig               |   9 +-
 arch/mips/configs/bcm47xx_defconfig           |   8 +-
 arch/mips/configs/bcm63xx_defconfig           |  15 +-
 arch/mips/configs/bmips_be_defconfig          |  11 +-
 arch/mips/configs/bmips_stb_defconfig         |  11 +-
 arch/mips/configs/capcella_defconfig          |  11 +-
 arch/mips/configs/ci20_defconfig              |  10 +-
 arch/mips/configs/cu1000-neo_defconfig        |  10 +-
 arch/mips/configs/cu1830-neo_defconfig        |  10 +-
 arch/mips/configs/e55_defconfig               |   4 +-
 arch/mips/configs/generic_defconfig           |   6 +-
 arch/mips/configs/gpr_defconfig               |  18 +-
 arch/mips/configs/loongson3_defconfig         |  13 +-
 arch/mips/configs/mpc30x_defconfig            |   7 +-
 arch/mips/configs/tb0219_defconfig            |   7 +-
 arch/mips/configs/tb0226_defconfig            |   7 +-
 arch/mips/configs/tb0287_defconfig            |   7 +-
 arch/mips/configs/workpad_defconfig           |  11 +-
 arch/mips/include/asm/setup.h                 |   2 +
 arch/mips/kernel/relocate.c                   |  17 +-
 arch/mips/kernel/setup.c                      |  36 +--
 arch/mips/pic32/pic32mzda/early_console.c     |   2 +-
 arch/mips/pic32/pic32mzda/init.c              |   3 +-
 arch/x86/Kconfig                              |  44 +---
 arch/x86/kernel/setup.c                       |  18 +-
 .../firmware/efi/libstub/efi-stub-helper.c    |  29 +++
 drivers/firmware/efi/libstub/efi-stub.c       |   9 +
 drivers/firmware/efi/libstub/efistub.h        |   1 +
 drivers/firmware/efi/libstub/x86-stub.c       |  13 +-
 drivers/of/fdt.c                              |  44 ++--
 include/linux/cmdline.h                       | 103 ++++++++
 init/Kconfig                                  |  78 ++++++
 lib/Kconfig                                   |   4 +
 lib/Makefile                                  |   3 +
 lib/generic_cmdline.S                         |  53 ++++
 lib/test_cmdline1.c                           | 139 ++++++++++
 scripts/Makefile                              |   2 +-
 .../{insert-sys-cert.c => insert-symbol.c}    | 243 ++++++++++++------
 43 files changed, 716 insertions(+), 394 deletions(-)
 create mode 100644 include/linux/cmdline.h
 create mode 100644 lib/generic_cmdline.S
 create mode 100644 lib/test_cmdline1.c
 rename scripts/{insert-sys-cert.c => insert-symbol.c} (72%)

-- 
2.25.1

[PATCH 5/8] drivers: firmware: efi: libstub: enable generic commandline

[Daniel Walker]

This adds code to handle the generic command line changes.
The efi code appears that it doesn't benefit as much from this design
as it could.

For example, if you had a prepend command line with "nokaslr" then
you might be helpful to re-enable it in the boot loader or dts,
but there appears to be no way to re-enable kaslr or some of the
other options.

The efi command line handling is incorrect. x86 and arm have an append
system however the efi code prepends the command line.

For example, you could have a non-upgradable bios which sends

efi=disable_early_pci_dma

This hypothetically could have been set because early pci dma caused
issues on early versions of the product.

Then later the early pci dma was made to work and the company desired
to start using it. To override the bios you could set the CONFIG_CMDLINE
to,

efi=no_disable_early_pci_dma

then parsing would normally start with the bios command line, then move
to the CONFIG_CMDLINE and you would end up with early pci dma turned on.

however, current efi code keeps early pci dma off because the bios
arguments always override the built in.

Per my reading this is different from the main body of x86, arm, and
arm64.

The generic command line provides both append and prepend, so it
alleviates this issue if it's used. However not all architectures use
it.

It would be desirable to allow the efi stub to have it's builtin command
line to be modified after compile, but I don't see a feasible way to do
that currently.

Cc: xe-linux-external@cisco.com
Signed-off-by: Daniel Walker <danielwa@cisco.com>
---
 .../firmware/efi/libstub/efi-stub-helper.c    | 29 +++++++++++++++++++
 drivers/firmware/efi/libstub/efi-stub.c       |  9 ++++++
 drivers/firmware/efi/libstub/efistub.h        |  1 +
 drivers/firmware/efi/libstub/x86-stub.c       | 13 +++++++--
 4 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index aa8da0a49829..16318f55f187 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -13,6 +13,7 @@
 #include <linux/efi.h>
 #include <linux/kernel.h>
 #include <linux/printk.h> /* For CONSOLE_LOGLEVEL_* */
+#include <linux/cmdline.h>
 #include <asm/efi.h>
 #include <asm/setup.h>
 
@@ -172,6 +173,34 @@ int efi_printk(const char *fmt, ...)
 	return printed;
 }
 
+/**
+ * efi_handle_cmdline() - handle adding in building parts of the command line
+ * @cmdline:	kernel command line
+ *
+ * Add in the generic parts of the commandline and start the parsing of the
+ * command line.
+ *
+ * Return:	status code
+ */
+efi_status_t efi_handle_cmdline(char const *cmdline)
+{
+	efi_status_t status = EFI_SUCCESS;
+
+	if (sizeof(CMDLINE_STATIC_PREPEND) > 1)
+		status |= efi_parse_options(CMDLINE_STATIC_PREPEND);
+
+	if (!IS_ENABLED(CONFIG_CMDLINE_OVERRIDE))
+		status |= efi_parse_options(cmdline);
+
+	if (sizeof(CMDLINE_STATIC_APPEND) > 1)
+		status |= efi_parse_options(CMDLINE_STATIC_APPEND);
+
+	if (status != EFI_SUCCESS)
+		efi_err("Failed to parse options\n");
+
+	return status;
+}
+
 /**
  * efi_parse_options() - Parse EFI command line options
  * @cmdline:	kernel command line
diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
index 26e69788f27a..baa69b24cfdd 100644
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -172,6 +172,14 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
 		goto fail;
 	}
 
+#ifdef CONFIG_GENERIC_CMDLINE
+	status = efi_handle_cmdline(cmdline_ptr);
+	if (status != EFI_SUCCESS) {
+		goto fail_free_cmdline;
+	}
+#endif
+
+#ifdef CONFIG_CMDLINE
 	if (IS_ENABLED(CONFIG_CMDLINE_EXTEND) ||
 	    IS_ENABLED(CONFIG_CMDLINE_FORCE) ||
 	    cmdline_size == 0) {
@@ -189,6 +197,7 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
 			goto fail_free_cmdline;
 		}
 	}
+#endif
 
 	efi_info("Booting Linux Kernel...\n");
 
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index cde0a2ef507d..07c7f9fdfffc 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -800,6 +800,7 @@ efi_status_t efi_relocate_kernel(unsigned long *image_addr,
 				 unsigned long alignment,
 				 unsigned long min_addr);
 
+efi_status_t efi_handle_cmdline(char const *cmdline);
 efi_status_t efi_parse_options(char const *cmdline);
 
 void efi_parse_option_graphics(char *option);
diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
index f14c4ff5839f..30ad8fb7122d 100644
--- a/drivers/firmware/efi/libstub/x86-stub.c
+++ b/drivers/firmware/efi/libstub/x86-stub.c
@@ -673,6 +673,8 @@ unsigned long efi_main(efi_handle_t handle,
 	unsigned long bzimage_addr = (unsigned long)startup_32;
 	unsigned long buffer_start, buffer_end;
 	struct setup_header *hdr = &boot_params->hdr;
+	unsigned long cmdline_paddr = ((u64)hdr->cmd_line_ptr |
+				       ((u64)boot_params->ext_cmd_line_ptr << 32));
 	efi_status_t status;
 
 	efi_system_table = sys_table_arg;
@@ -735,6 +737,14 @@ unsigned long efi_main(efi_handle_t handle,
 		image_offset = 0;
 	}
 
+#ifdef CONFIG_GENERIC_CMDLINE
+	status = efi_handle_cmdline((char *)cmdline_paddr);
+	if (status != EFI_SUCCESS) {
+		efi_err("Failed to parse options\n");
+		goto fail;
+	}
+#else /* CONFIG_GENERIC_CMDLINE */
+
 #ifdef CONFIG_CMDLINE_BOOL
 	status = efi_parse_options(CONFIG_CMDLINE);
 	if (status != EFI_SUCCESS) {
@@ -743,8 +753,6 @@ unsigned long efi_main(efi_handle_t handle,
 	}
 #endif
 	if (!IS_ENABLED(CONFIG_CMDLINE_OVERRIDE)) {
-		unsigned long cmdline_paddr = ((u64)hdr->cmd_line_ptr |
-					       ((u64)boot_params->ext_cmd_line_ptr << 32));
 		status = efi_parse_options((char *)cmdline_paddr);
 		if (status != EFI_SUCCESS) {
 			efi_err("Failed to parse options\n");
@@ -752,6 +760,7 @@ unsigned long efi_main(efi_handle_t handle,
 		}
 	}
 
+#endif
 	/*
 	 * At this point, an initrd may already have been loaded by the
 	 * bootloader and passed via bootparams. We permit an initrd loaded
-- 
2.25.1

Re: [PATCH 0/8] generic command line v4

[Sean Anderson]

On 4/16/21 12:09 AM, Daniel Walker wrote:
> 
> v4 release changes
> 
> * Updated insert-sys-cert tool to change command line symbols after
>   compilation.
> 
> 	This tool is used to release binary kernels internally to companies
> 	and then later insert certificates for each product by consumers of
> 	the binary kernel. Cisco uses this tool for this purpose.
> 
> 	Cisco has a similar need for the command line to be modified on a
> 	binary released kernels similar to how certificates are setup.
> 
> * Added global symbols to hold append and prepend values.
> 
> 	These changes follow the system certificate code to allow the
> 	insert-sys-cert tool to be used.
> 
> * Added a test case to confirm functionality.
> 
> 	Seemed sensible to add this to make sure everything is working.
> 
> * Dropped powerpc changes
> 
> 	Christophe Leroy has reservations about the features for powerpc. I
> 	don't think his reservations are founded, and these changes should
> 	fully work on powerpc. However, I dropped these changes so Christophe
> 	can have more time to get comfortable with the changes.
> 
> 
> Enjoy!
> 
> 
> Daniel Walker (8):
>   CMDLINE: add generic builtin command line
>   scripts: insert-sys-cert: add command line insert capability
>   scripts: insert-sys-cert: change name to insert-symbol
>   CMDLINE: mips: convert to generic builtin command line
>   drivers: firmware: efi: libstub: enable generic commandline
>   CMDLINE: x86: convert to generic builtin command line
>   of: allow sending a NULL value to early_init_dt_scan_chosen
>   CMDLINE: arm64: convert to generic builtin command line
> 
>  arch/arm64/Kconfig                            |  33 +--
>  arch/arm64/include/asm/setup.h                |   2 +
>  arch/arm64/kernel/idreg-override.c            |   9 +-
>  arch/mips/Kconfig                             |   4 +-
>  arch/mips/Kconfig.debug                       |  44 ----
>  arch/mips/configs/ar7_defconfig               |   9 +-
>  arch/mips/configs/bcm47xx_defconfig           |   8 +-
>  arch/mips/configs/bcm63xx_defconfig           |  15 +-
>  arch/mips/configs/bmips_be_defconfig          |  11 +-
>  arch/mips/configs/bmips_stb_defconfig         |  11 +-
>  arch/mips/configs/capcella_defconfig          |  11 +-
>  arch/mips/configs/ci20_defconfig              |  10 +-
>  arch/mips/configs/cu1000-neo_defconfig        |  10 +-
>  arch/mips/configs/cu1830-neo_defconfig        |  10 +-
>  arch/mips/configs/e55_defconfig               |   4 +-
>  arch/mips/configs/generic_defconfig           |   6 +-
>  arch/mips/configs/gpr_defconfig               |  18 +-
>  arch/mips/configs/loongson3_defconfig         |  13 +-
>  arch/mips/configs/mpc30x_defconfig            |   7 +-
>  arch/mips/configs/tb0219_defconfig            |   7 +-
>  arch/mips/configs/tb0226_defconfig            |   7 +-
>  arch/mips/configs/tb0287_defconfig            |   7 +-
>  arch/mips/configs/workpad_defconfig           |  11 +-
>  arch/mips/include/asm/setup.h                 |   2 +
>  arch/mips/kernel/relocate.c                   |  17 +-
>  arch/mips/kernel/setup.c                      |  36 +--
>  arch/mips/pic32/pic32mzda/early_console.c     |   2 +-
>  arch/mips/pic32/pic32mzda/init.c              |   3 +-
>  arch/x86/Kconfig                              |  44 +---
>  arch/x86/kernel/setup.c                       |  18 +-
>  .../firmware/efi/libstub/efi-stub-helper.c    |  29 +++
>  drivers/firmware/efi/libstub/efi-stub.c       |   9 +
>  drivers/firmware/efi/libstub/efistub.h        |   1 +
>  drivers/firmware/efi/libstub/x86-stub.c       |  13 +-
>  drivers/of/fdt.c                              |  44 ++--
>  include/linux/cmdline.h                       | 103 ++++++++
>  init/Kconfig                                  |  78 ++++++
>  lib/Kconfig                                   |   4 +
>  lib/Makefile                                  |   3 +
>  lib/generic_cmdline.S                         |  53 ++++
>  lib/test_cmdline1.c                           | 139 ++++++++++
>  scripts/Makefile                              |   2 +-
>  .../{insert-sys-cert.c => insert-symbol.c}    | 243 ++++++++++++------
>  43 files changed, 716 insertions(+), 394 deletions(-)
>  create mode 100644 include/linux/cmdline.h
>  create mode 100644 lib/generic_cmdline.S
>  create mode 100644 lib/test_cmdline1.c
>  rename scripts/{insert-sys-cert.c => insert-symbol.c} (72%)
> 

For an arm64 platform (after rebasing):

Tested-by: Sean Anderson <sean.anderson@seco.com>

Re: [PATCH 0/8] generic command line v4

[Daniel Walker]

On Thu, Sep 22, 2022 at 04:45:01PM -0400, Sean Anderson wrote:
> 
> 
> 
> For an arm64 platform (after rebasing):
> 
> Tested-by: Sean Anderson <sean.anderson@seco.com>

Maybe I'll re-submit it.

Daniel

Re: [PATCH 0/8] generic command line v4

[Sean Anderson]

On 9/22/22 4:53 PM, Daniel Walker wrote:
> On Thu, Sep 22, 2022 at 04:45:01PM -0400, Sean Anderson wrote:
>> 
>> 
>> 
>> For an arm64 platform (after rebasing):
>> 
>> Tested-by: Sean Anderson <sean.anderson@seco.com>
> 
> Maybe I'll re-submit it.
> 
> Daniel
> 

There's still no way to extend the command line on ARM64, since the
existing method was removed in anticipation that your series would be
added. 

As recently as last month, someone's patch to add such support was
rejected for this reason [1].

--Sean

[1] https://lore.kernel.org/linux-arm-kernel/20220812084613.GA3107@willie-the-truck/

Re: [PATCH 0/8] generic command line v4

[Daniel Walker]

On Thu, Sep 22, 2022 at 05:03:46PM -0400, Sean Anderson wrote:
> 
> 
> 
> On 9/22/22 4:53 PM, Daniel Walker wrote:
> > On Thu, Sep 22, 2022 at 04:45:01PM -0400, Sean Anderson wrote:
> >> 
> >> 
> >> 
> >> For an arm64 platform (after rebasing):
> >> 
> >> Tested-by: Sean Anderson <sean.anderson@seco.com>
> > 
> > Maybe I'll re-submit it.
> > 
> > Daniel
> > 
> 
> There's still no way to extend the command line on ARM64, since the
> existing method was removed in anticipation that your series would be
> added. 
> 
> As recently as last month, someone's patch to add such support was
> rejected for this reason [1].
> 
> --Sean
> 
> [1] https://lore.kernel.org/linux-arm-kernel/20220812084613.GA3107@willie-the-truck/


I had no idea.. Thanks for pointing that out. I guess I will re-submit in that
case.

Daniel

Re: [PATCH 0/8] generic command line v4

[Daniel Gimpelevich]

On Thu, 2022-09-22 at 14:10 -0700, Daniel Walker wrote:
> On Thu, Sep 22, 2022 at 05:03:46PM -0400, Sean Anderson wrote:
[snip]
> > As recently as last month, someone's patch to add such support was
> > rejected for this reason [1].
> > 
> > --Sean
> > 
> > [1] https://lore.kernel.org/linux-arm-kernel/20220812084613.GA3107@willie-the-truck/
> 
> 
> I had no idea.. Thanks for pointing that out. I guess I will re-submit in that
> case.
> 
> Daniel

This has been happening repeatedly since circa 2014, on multiple
architectures. It's quite frustrating, really.

Re: [PATCH 0/8] generic command line v4

[Rob Herring]

On Thu, Sep 22, 2022 at 4:15 PM Daniel Gimpelevich
<daniel@gimpelevich.san-francisco.ca.us> wrote:
>
> On Thu, 2022-09-22 at 14:10 -0700, Daniel Walker wrote:
> > On Thu, Sep 22, 2022 at 05:03:46PM -0400, Sean Anderson wrote:
> [snip]
> > > As recently as last month, someone's patch to add such support was
> > > rejected for this reason [1].
> > >
> > > --Sean
> > >
> > > [1] https://lore.kernel.org/linux-arm-kernel/20220812084613.GA3107@willie-the-truck/
> >
> >
> > I had no idea.. Thanks for pointing that out. I guess I will re-submit in that
> > case.
> >
> > Daniel
>
> This has been happening repeatedly since circa 2014, on multiple
> architectures. It's quite frustrating, really.

It must not be that important. From the last time, IMO Christophe's
version was much closer to being merged than this series. This is not
how you get things upstream:

> * Dropped powerpc changes
>   Christophe Leroy has reservations about the features for powerpc. I
>   don't think his reservations are founded, and these changes should
>   fully work on powerpc. However, I dropped these changes so Christophe
>   can have more time to get comfortable with the changes.

Rob

Re: [PATCH 0/8] generic command line v4

[Daniel Walker]

On Thu, Sep 22, 2022 at 02:15:44PM -0700, Daniel Gimpelevich wrote:
> On Thu, 2022-09-22 at 14:10 -0700, Daniel Walker wrote:
> > On Thu, Sep 22, 2022 at 05:03:46PM -0400, Sean Anderson wrote:
> [snip]
> > > As recently as last month, someone's patch to add such support was
> > > rejected for this reason [1].
> > > 
> > > --Sean
> > > 
> > > [1] https://lore.kernel.org/linux-arm-kernel/20220812084613.GA3107@willie-the-truck/
> > 
> > 
> > I had no idea.. Thanks for pointing that out. I guess I will re-submit in that
> > case.
> > 
> > Daniel
> 
> This has been happening repeatedly since circa 2014, on multiple
> architectures. It's quite frustrating, really.
 
 I'm not sure I'm following your comments. What's frustrating exactly ?

Daniel

Re: [PATCH 0/8] generic command line v4

[Daniel Walker]

On Mon, Sep 26, 2022 at 05:52:18PM -0500, Rob Herring wrote:
> On Thu, Sep 22, 2022 at 4:15 PM Daniel Gimpelevich
> <daniel@gimpelevich.san-francisco.ca.us> wrote:
> >
> > On Thu, 2022-09-22 at 14:10 -0700, Daniel Walker wrote:
> > > On Thu, Sep 22, 2022 at 05:03:46PM -0400, Sean Anderson wrote:
> > [snip]
> > > > As recently as last month, someone's patch to add such support was
> > > > rejected for this reason [1].
> > > >
> > > > --Sean
> > > >
> > > > [1] https://lore.kernel.org/linux-arm-kernel/20220812084613.GA3107@willie-the-truck/
> > >
> > >
> > > I had no idea.. Thanks for pointing that out. I guess I will re-submit in that
> > > case.
> > >
> > > Daniel
> >
> > This has been happening repeatedly since circa 2014, on multiple
> > architectures. It's quite frustrating, really.
> 
> It must not be that important. From the last time, IMO Christophe's
> version was much closer to being merged than this series. This is not
> how you get things upstream:
> 
> > * Dropped powerpc changes
> >   Christophe Leroy has reservations about the features for powerpc. I
> >   don't think his reservations are founded, and these changes should
> >   fully work on powerpc. However, I dropped these changes so Christophe
> >   can have more time to get comfortable with the changes.
> 
> Rob

I don't submit often enough, that's true. However, I figured maintainers don't
want the changes. This is a common occurrence in industry, people may submit
once or twice, no traction and they give up. I suppose it's a combination of
problems.

Christophe's don't have the same features, so they are really totally different
but conflicting.

Daniel