grub: embed per-SoC cmdline in efi.bin, keep rootfs generic

bootloader/build-efi-esp.sh

@@ -62,6 +62,11 @@ ESP_LABEL="system-boot"
 NO_INSTALL=0
 SEED_VOLATILE_VARS=0
 SEED_VOLATILE_VARS_CONFIG=""
+# Extra kernel cmdline parameters to embed in BOOTAA64.EFI bootstrap config.
+# Exposed as the GRUB variable ${soc_extra_cmdline} which grub.cfg appends to
+# the linux line.  Empty string = generic board (no extra params).
+# Example: "arm64.nopauth" for RB4 boards.
+EXTRA_CMDLINE=""
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
@@ -86,12 +91,17 @@ print_usage() {
 Usage:
   $0 [--sector-size <bytes>] [--esp-size-mb <mb>] [--root-label <label>]
      [--esp-label <label>] [--out <efi.bin>] [--no-install]
+     [--extra-cmdline <params>]
      [--seed-volatile-vars] [--seed-volatile-vars-config <json>] [-h|--help]
 
 Notes:
   - Produces a FAT32 filesystem image (no GPT inside the file).
   - Installs a standalone ARM64 GRUB as /EFI/BOOT/BOOTAA64.EFI using grub-mkstandalone.
   - At boot, GRUB searches for rootfs by LABEL and loads its /boot/grub/grub.cfg.
+  - --extra-cmdline embeds SoC-specific kernel parameters inside BOOTAA64.EFI as the
+    GRUB variable ${soc_extra_cmdline}.  grub.cfg appends it to the linux line so the
+    rootfs image stays generic while each board's efi.bin carries its own cmdline.
+    Example: --extra-cmdline "arm64.nopauth"  (RB4 boards only).
   - --seed-volatile-vars pre-seeds /VolatileVars.bin with default UEFI variables
     (see gen-volatile-vars.py), e.g. VendorDtbOverlays, so overlay/DTBO
     loading works from first boot without waiting on firmware-side
@@ -119,6 +129,8 @@ while [[ $# -gt 0 ]]; do
             OUT_IMG="${2-}"; shift 2 ;;
         --no-install)
             NO_INSTALL=1; shift ;;
+        --extra-cmdline)
+            EXTRA_CMDLINE="${2-}"; shift 2 ;;
         --seed-volatile-vars)
             SEED_VOLATILE_VARS=1; shift ;;
         --seed-volatile-vars-config)
@@ -184,6 +196,7 @@ echo "[INFO] ESP size: ${ESP_SIZE_MB} MB"
 echo "[INFO] FAT sector size: ${SECTOR_SIZE}"
 echo "[INFO] Rootfs label: ${ROOT_LABEL}"
 echo "[INFO] ESP label: ${ESP_LABEL}"
+echo "[INFO] Extra cmdline: ${EXTRA_CMDLINE:-(none)}"
 
 # ==============================================================================
 # Step 4  Ensure required host tools exist (optionally install)
@@ -244,8 +257,13 @@ echo "[INFO] GRUB platform dir: ${GRUB_PLATFORM_DIR}"
 BOOTSTRAP_CFG="$(mktemp -p "${WORKDIR}" efiesp.bootstrap.XXXXXX.cfg)"
 cat > "${BOOTSTRAP_CFG}" <<EOF
 # Embedded bootstrap grub.cfg (inside BOOTAA64.EFI)
+# This config is baked into the EFI binary at build time.
+# soc_extra_cmdline carries board-specific kernel parameters (may be empty).
+# grub.cfg on the rootfs appends it to the linux line so the rootfs image
+# stays fully generic while each board's efi.bin carries its own cmdline.
 set default=0
 set timeout=0
+set soc_extra_cmdline="${EXTRA_CMDLINE}"
 
 # Prefer label-based discovery for portability
 search --no-floppy --label ${ROOT_LABEL} --set=root
@@ -323,6 +341,9 @@ LOOP_DEV=""
 
 echo "[SUCCESS] EFI System Partition image created: ${OUT_IMG}"
 echo "[INFO] Contains: /EFI/BOOT/BOOTAA64.EFI (standalone GRUB + embedded bootstrap)."
+if [[ -n "${EXTRA_CMDLINE}" ]]; then
+    echo "[INFO] Embedded soc_extra_cmdline: '${EXTRA_CMDLINE}'"
+fi
 if [[ "${SEED_VOLATILE_VARS}" -eq 1 ]]; then
     echo "[INFO] Contains: /VolatileVars.bin (pre-seeded UEFI variables)."
 fi

flash/gen-flash-dirs.sh

@@ -160,6 +160,10 @@ for i in $(seq 0 $((BOARD_COUNT - 1))); do
     CDT_FILENAME=$(echo "$BOARDS_JSON"   | jq -r ".[$i].cdt_filename // empty")
     SEED_VOLATILE_VARS=$(echo "$BOARDS_JSON" | jq -r ".[$i].seed_volatile_vars // false")
     SEED_VOLATILE_VARS_CONFIG=$(echo "$BOARDS_JSON" | jq -r ".[$i].seed_volatile_vars_config // empty")
+    # Board-specific kernel parameters embedded in BOOTAA64.EFI as soc_extra_cmdline.
+    # grub.cfg appends this variable to the linux line at GRUB runtime.
+    # Empty string = generic board (no extra params).  Example: "arm64.nopauth" for RB4.
+    EXTRA_CMDLINE=$(echo "$BOARDS_JSON" | jq -r ".[$i].extra_cmdline // empty")
     if [[ -n "$SEED_VOLATILE_VARS_CONFIG" ]]; then
         # Paths in targets.json are relative to the qcom-distro-images repo
         # root, i.e. two levels above boot_bins/ (see contents_xml_in below).
@@ -343,6 +347,21 @@ for i in $(seq 0 $((BOARD_COUNT - 1))); do
                     exit 1
                 fi
 
+                # If this board has board-specific kernel parameters, rebuild
+                # BOOTAA64.EFI with --extra-cmdline so soc_extra_cmdline is
+                # embedded in the EFI binary.  The rootfs grub.cfg stays generic.
+                if [[ -n "${EXTRA_CMDLINE}" ]]; then
+                    echo "[INFO] Rebuilding efi.bin for ${BOARD_NAME} with extra-cmdline: '${EXTRA_CMDLINE}'"
+                    BOARD_EFI_TMP="$(mktemp -p "${OUTPUT_DIR}" efi_board.XXXXXX.bin)"
+                    "${SCRIPT_DIR}/../bootloader/build-efi-esp.sh" \
+                        --sector-size "${SECTOR_SIZE}" \
+                        --out "${BOARD_EFI_TMP}" \
+                        --extra-cmdline "${EXTRA_CMDLINE}" \
+                        --no-install
+                    mv -f "${BOARD_EFI_TMP}" "${STORAGE_DIR}/efi.bin"
+                    echo "[INFO] Board-specific efi.bin written to ${STORAGE_DIR}/efi.bin"
+                fi
+
                 if [[ "$SEED_VOLATILE_VARS" == "true" ]]; then
                     PATCH_VOLATILE_VARS_ARGS=(--efi "${STORAGE_DIR}/efi.bin")
                     if [[ -n "$SEED_VOLATILE_VARS_CONFIG" ]]; then

rootfs/scripts/build-rootfs.sh

@@ -170,6 +170,7 @@ for _deb in "${LOCAL_DEBS[@]}"; do
     fi
 done
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WORKDIR=$(pwd)
 MNT_DIR="$WORKDIR/mnt"
 ROOTFS_DIR="$WORKDIR/rootfs_work"
@@ -543,7 +544,11 @@ echo "[INFO] Configuring /etc/default/grub..."
 mkdir -p "$ROOTFS_DIR/boot/grub"
 mkdir -p "$ROOTFS_DIR/etc/default"
 
-# Write GRUB defaults using quoted heredoc to prevent host-side expansion
+# Write GRUB defaults using quoted heredoc to prevent host-side expansion.
+# GRUB_DEFAULT=0: single generic menuentry.  Board-specific kernel parameters
+# are carried by each board's BOOTAA64.EFI as the GRUB variable soc_extra_cmdline
+# (set by build-efi-esp.sh --extra-cmdline).  grub.cfg appends it to the linux
+# line at runtime, so no per-board grub.cfg or multi-entry menu is needed.
 cat <<'EOF' > "$ROOTFS_DIR/etc/default/grub"
 GRUB_DEFAULT=0
 GRUB_TIMEOUT=5
@@ -555,8 +560,8 @@ GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
 GRUB_TERMINAL="serial console"
 GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"
 
-# Kernel parameters applied to BOTH Normal and Recovery boot modes
-# (Critical hardware settings: console, rootfs, clocks, EFI)
+# Kernel parameters for Generic (non-RB4) boards.
+# The RB4 menu entry appends "arm64.nopauth" on top of these at build time.
 GRUB_CMDLINE_LINUX="earlycon console=ttyMSM0,115200n8 root=LABEL=system cma=128M net.ifnames=0 rw clk_ignore_unused pd_ignore_unused rootwait ignore_loglevel"
 
 # Kernel parameters applied ONLY to Normal boot mode
@@ -726,6 +731,42 @@ umount -l "$ROOTFS_DIR/dev"
 umount -l "$ROOTFS_DIR/sys"
 umount -l "$ROOTFS_DIR/proc"
 
+# ==============================================================================
+# Step 9.4: Append ${soc_extra_cmdline} variable reference to grub.cfg linux line
+#
+# The rootfs carries a single generic grub.cfg menuentry.  Board-specific kernel
+# parameters (e.g. arm64.nopauth for RB4) are NOT baked into the rootfs.
+# Instead, build-efi-esp.sh embeds them as the GRUB variable soc_extra_cmdline
+# inside each board's BOOTAA64.EFI bootstrap config.  That variable survives
+# the configfile jump into /boot/grub/grub.cfg and is appended here to the
+# linux line at GRUB runtime.
+#
+# Flow:
+#   BOOTAA64.EFI bootstrap  →  set soc_extra_cmdline="arm64.nopauth"  (RB4)
+#                               set soc_extra_cmdline=""               (generic)
+#   configfile /boot/grub/grub.cfg
+#   linux /boot/vmlinuz-... <base_cmdline> ${soc_extra_cmdline}
+#
+# This keeps the rootfs image fully board-agnostic.
+# ==============================================================================
+echo "[INFO] Patching grub.cfg: appending \${soc_extra_cmdline} to linux line..."
+
+GRUB_CFG="$ROOTFS_DIR/boot/grub/grub.cfg"
+
+if [[ ! -f "$GRUB_CFG" ]]; then
+    echo "[ERROR] grub.cfg not found at $GRUB_CFG — update-grub may have failed." >&2
+    exit 1
+fi
+
+# Append ${soc_extra_cmdline} to every "linux " kernel line inside grub.cfg.
+# The variable is set by the bootstrap config embedded in BOOTAA64.EFI; it is
+# empty for generic boards and contains board-specific params for others.
+# sed matches lines starting with optional whitespace + "linux " + a path token.
+sed -i 's|^\(\s*linux\s\+/[^ ]\+.*\)$|\1 ${soc_extra_cmdline}|' "$GRUB_CFG"
+
+echo "[INFO] grub.cfg linux lines patched."
+echo "[INFO] grub.cfg contains $(grep -c '^\s*linux\s' "$GRUB_CFG") kernel line(s)."
+
 # ==============================================================================
 # Step 9.5: Remove build-only apt sources and caches from final image
 #   - build-only sources declared in the overlay manifest ("build-only": true)
@@ -769,7 +810,6 @@ rm -f  "$ROOTFS_DIR/var/cache/apt/archives/"*.deb
 #   extracts everything as root, --no-overwrite-dir leaves existing directory
 #   metadata untouched.
 # ==============================================================================
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 RUNTIME_DIR="${SCRIPT_DIR}/../runtime"
 
 if [[ ! -d "$RUNTIME_DIR" ]]; then