Deliver penguin env off the kernel cmdline + per-arch length guard - #874
Merged
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Lintly has detected code quality issues in this pull request.
lacraig2
force-pushed
the
workspace/env-off-cmdline
branch
from
June 29, 2026 22:34
02bcab3 to
e3efb38
Compare
There was a problem hiding this comment.
Lintly has detected code quality issues in this pull request.
lacraig2
force-pushed
the
workspace/env-off-cmdline
branch
from
June 29, 2026 22:47
e3efb38 to
6b2ae75
Compare
The kernel cmdline has an arch-dependent COMMAND_LINE_SIZE cap (256B on MIPS) and silently truncates anything longer, quietly dropping the env knobs penguin smuggles onto -append. This adds a guard and moves penguin's internal env off the cmdline entirely. - arch_registry: per-arch command_line_size (MIPS 256, others 4096). - penguin_run.check_cmdline_size: warn near the cap, raise on exceed (never silently truncate). - boot_env: partition conf["env"] into firmware-expected (stays on the cmdline) vs penguin-internal (igloo_/IGLOO_ prefix + ROOT_SHELL, SHARED_DIR, WWW, CID, STRACE, PROJ_NAME, LD_LIBRARY_PATH, TERM). - LiveImage serves the internal knobs as an on-demand igloo_env.sh blob over the existing portal file channel; preinit.sh sources it after insmod so it lands in PID1's env and propagates like cmdline env did. - core.kernel_cmdline_append: explicit verbatim kernel-cmdline tokens, never diverted to the blob (regenerated schema_doc.md). - init.sh scrubs the internal env before exec'ing the firmware init, driven by the blob (so it tracks new IGLOO_* knobs) minus a keep-list for IGLOO_LTRACE*/PROJ_NAME which guest tooling reads inside the firmware tree, so tooling-only env no longer leaks into the firmware. Adds unit tests (test_cmdline_size.py, test_boot_env.py).
The 256B MIPS cap wasn't the kernel's COMMAND_LINE_SIZE (that's 4096 on the MIPS kernels we ship, upstream since v3.7) -- it was QEMU's malta board passing the cmdline through a single 256B prom env slot, which truncated it before the kernel saw it. With hw/mips/malta.c's ENVP_ENTRY_SIZE bumped to 0xfdc0 in rehosting/qemu, MIPS now matches every other arch at 4096, so the length guard no longer fires on a normal MIPS boot. Update the anti-drift and oversize tests accordingly. Note: the 4096 is only fully deliverable once a rehosting/qemu release carrying the malta bump is pinned by the Dockerfile's QEMU_VERSION; until then the running qemu still truncates at 256, which is benign now that boot-critical env rides the igloo_env.sh blob rather than the cmdline.
lacraig2
force-pushed
the
workspace/env-off-cmdline
branch
2 times, most recently
from
June 30, 2026 03:05
fd8472b to
12fe783
Compare
rehosting/qemu v0.0.14 is the malta ENVP_ENTRY_SIZE fix (256 -> 0xfdc0, PR #15) cherry-picked onto the pre-Nixify v0.0.10 base and built via the old Docker package path, so it is ABI-compatible with this ubuntu:22.04 image (CFFI env modules are cpython-310, not the cpython-313 of the Nixified v0.0.11-v0.0.13 releases, which do not run here). With malta in the running qemu, MIPS guests now receive the full COMMAND_LINE_SIZE=4096 cmdline instead of being truncated at 256 by the prom env slot, making the arch_registry 4096 cap real at runtime. (Nixified qemu releases stay deferred to the penguin nixify rollout; see the QEMU_VERSION provenance and arch_registry command_line_size note.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every penguin runtime knob is smuggled to the guest as
key=valuetokens on the kernel command line. The cmdline has a hard, arch-dependent cap (COMMAND_LINE_SIZE) — 256 bytes on MIPS vs 4096 elsewhere — and the kernel silently truncates anything longer, quietly dropping knobs (this bit us before, e.g.IGLOO_OWN_IFACESvanishing on MIPS). Anchors: #751, #706.What this does
Slice 0 — the guard (safety net, no behavior change)
arch_registry: per-archcommand_line_size(MIPS 256, others 4096).penguin_run.check_cmdline_size: warns near the cap and raises on exceed — never silently truncates.Slice 1 — move penguin's knobs off the cmdline
penguin.boot_envpartitionsconf["env"]:env:entries a vendor init may read from/proc/cmdline;igloo_/IGLOO_prefix +ROOT_SHELL,SHARED_DIR,WWW,CID,STRACE,PROJ_NAME,LD_LIBRARY_PATH,TERM).LiveImageserves the internal knobs as an on-demandigloo_env.shblob over the existing portal file channel (same mechanism asgen_live_image.sh);preinit.shsources it right afterinsmod igloo.ko, so it lands in PID1's environment and propagates to the whole guest tree exactly as cmdline env did.-append; MIPS's 256B cap no longer gates how manyIGLOO_*knobs we add.Explicit cmdline control
core.kernel_cmdline_append: verbatim tokens appended to-append, never diverted to the blob, still counted by the length guard (regeneratedschema_doc.md).Leak fix
init.shscrubs penguin-internal env beforeexec-ing the firmware init, driven by the blob file (so it tracks newIGLOO_*knobs automatically), minus a keep-list forIGLOO_LTRACE/IGLOO_LTRACE_EXCLUDED/PROJ_NAME— guest tooling reads those inside the firmware process tree (ltrace via/etc/ld.so.preloadconstructor). Plugs a pre-existingigloo_initleak into the firmware environment.Safety / why this is sound
All penguin knobs are consumed by guest userspace (
source.d/*,init.sh,getenvin guest C) afterinsmod, never by the kernel/module — confirmed by a consumer audit.igloo_initis required for any boot to succeed, so the comprehensive suite (which boots real guests) is itself a strong end-to-end check of the new transport. User/firmwareenv:entries stay on the cmdline, so the existingenv_cmp/env_unsettests remain valid.Tests
New
tests/unit_tests/test_cmdline_size.pyandtest_boot_env.py(partition rule, blob rendering incl. shell-quoting/None-skip, internal knobs off the cmdline,kernel_cmdline_appendverbatim + counted by the guard). Pre-existing host-only asset-resolution failures intest_config.pyare unrelated and unchanged.