| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220929023301.3344694-6-danielwa@cisco.com>
Date: Wed, 28 Sep 2022 19:32:51 -0700
From: Daniel Walker <danielwa@...co.com>
To: Will Deacon <will@...nel.org>,
Christophe Leroy <christophe.leroy@...roup.eu>,
Rob Herring <robh@...nel.org>,
Daniel Gimpelevich <daniel@...pelevich.san-francisco.ca.us>,
Andrew Morton <akpm@...ux-foundation.org>,
Sean Anderson <sean.anderson@...o.com>
Cc: xe-linux-external@...co.com, Ard Biesheuvel <ardb@...nel.org>,
linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 5/8] drivers: firmware: efi: libstub: enable generic commandline
This adds code to handle the generic command line changes.
The efi code appears that it doesn't benefit as much from this design
as it could.
For example, if you had a prepend command line with "nokaslr" then
you might be helpful to re-enable it in the boot loader or dts,
but there appears to be no way to re-enable kaslr or some of the
other options.
The efi command line handling is incorrect. x86 and arm have an append
system however the efi code prepends the command line.
For example, you could have a non-upgradable bios which sends
efi=disable_early_pci_dma
This hypothetically could have been set because early pci dma caused
issues on early versions of the product.
Then later the early pci dma was made to work and the company desired
to start using it. To override the bios you could set the CONFIG_CMDLINE
to,
efi=no_disable_early_pci_dma
then parsing would normally start with the bios command line, then move
to the CONFIG_CMDLINE and you would end up with early pci dma turned on.
however, current efi code keeps early pci dma off because the bios
arguments always override the built in.
Per my reading this is different from the main body of x86, arm, and
arm64.
The generic command line provides both append and prepend, so it
alleviates this issue if it's used. However not all architectures use
it.
It would be desirable to allow the efi stub to have it's builtin command
line to be modified after compile, but I don't see a feasible way to do
that currently.
Cc: xe-linux-external@...co.com
Signed-off-by: Daniel Walker <danielwa@...co.com>
---
.../firmware/efi/libstub/efi-stub-helper.c | 29 +++++++++++++++++++
drivers/firmware/efi/libstub/efi-stub.c | 9 ++++++
drivers/firmware/efi/libstub/efistub.h | 1 +
drivers/firmware/efi/libstub/x86-stub.c | 13 +++++++--
4 files changed, 50 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 3d972061c1b0..372f06ec8c49 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -13,6 +13,7 @@
#include <linux/efi.h>
#include <linux/kernel.h>
#include <linux/printk.h> /* For CONSOLE_LOGLEVEL_* */
+#include <linux/cmdline.h>
#include <asm/efi.h>
#include <asm/setup.h>
@@ -172,6 +173,34 @@ int efi_printk(const char *fmt, ...)
return printed;
}
+/**
+ * efi_handle_cmdline() - handle adding in building parts of the command line
+ * @cmdline: kernel command line
+ *
+ * Add in the generic parts of the commandline and start the parsing of the
+ * command line.
+ *
+ * Return: status code
+ */
+efi_status_t efi_handle_cmdline(char const *cmdline)
+{
+ efi_status_t status = EFI_SUCCESS;
+
+ if (sizeof(CMDLINE_STATIC_PREPEND) > 1)
+ status |= efi_parse_options(CMDLINE_STATIC_PREPEND);
+
+ if (!IS_ENABLED(CONFIG_CMDLINE_OVERRIDE))
+ status |= efi_parse_options(cmdline);
+
+ if (sizeof(CMDLINE_STATIC_APPEND) > 1)
+ status |= efi_parse_options(CMDLINE_STATIC_APPEND);
+
+ if (status != EFI_SUCCESS)
+ efi_err("Failed to parse options\n");
+
+ return status;
+}
+
/**
* efi_parse_options() - Parse EFI command line options
* @cmdline: kernel command line
diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
index f515394cce6e..ea52ebd99ea6 100644
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -173,6 +173,14 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
goto fail;
}
+#ifdef CONFIG_GENERIC_CMDLINE
+ status = efi_handle_cmdline(cmdline_ptr);
+ if (status != EFI_SUCCESS) {
+ goto fail_free_cmdline;
+ }
+#endif
+
+#ifdef CONFIG_CMDLINE
if (IS_ENABLED(CONFIG_CMDLINE_EXTEND) ||
IS_ENABLED(CONFIG_CMDLINE_FORCE) ||
cmdline_size == 0) {
@@ -190,6 +198,7 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
goto fail_free_cmdline;
}
}
+#endif
efi_info("Booting Linux Kernel...\n");
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index b0ae0a454404..44c2e1194378 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -907,6 +907,7 @@ efi_status_t efi_relocate_kernel(unsigned long *image_addr,
unsigned long alignment,
unsigned long min_addr);
+efi_status_t efi_handle_cmdline(char const *cmdline);
efi_status_t efi_parse_options(char const *cmdline);
void efi_parse_option_graphics(char *option);
diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
index 7a7abc8959d2..87196bb9c3bb 100644
--- a/drivers/firmware/efi/libstub/x86-stub.c
+++ b/drivers/firmware/efi/libstub/x86-stub.c
@@ -783,6 +783,8 @@ unsigned long efi_main(efi_handle_t handle,
unsigned long buffer_start, buffer_end;
struct setup_header *hdr = &boot_params->hdr;
unsigned long addr, size;
+ unsigned long cmdline_paddr = ((u64)hdr->cmd_line_ptr |
+ ((u64)boot_params->ext_cmd_line_ptr << 32));
efi_status_t status;
efi_system_table = sys_table_arg;
@@ -851,6 +853,14 @@ unsigned long efi_main(efi_handle_t handle,
image_offset = 0;
}
+#ifdef CONFIG_GENERIC_CMDLINE
+ status = efi_handle_cmdline((char *)cmdline_paddr);
+ if (status != EFI_SUCCESS) {
+ efi_err("Failed to parse options\n");
+ goto fail;
+ }
+#else /* CONFIG_GENERIC_CMDLINE */
+
#ifdef CONFIG_CMDLINE_BOOL
status = efi_parse_options(CONFIG_CMDLINE);
if (status != EFI_SUCCESS) {
@@ -859,8 +869,6 @@ unsigned long efi_main(efi_handle_t handle,
}
#endif
if (!IS_ENABLED(CONFIG_CMDLINE_OVERRIDE)) {
- unsigned long cmdline_paddr = ((u64)hdr->cmd_line_ptr |
- ((u64)boot_params->ext_cmd_line_ptr << 32));
status = efi_parse_options((char *)cmdline_paddr);
if (status != EFI_SUCCESS) {
efi_err("Failed to parse options\n");
@@ -868,6 +876,7 @@ unsigned long efi_main(efi_handle_t handle,
}
}
+#endif
/*
* At this point, an initrd may already have been loaded by the
* bootloader and passed via bootparams. We permit an initrd loaded
--
2.25.1
Powered by blists - more mailing lists