Call xbc_prepend_embedded_cmdline() in setup_arch() right after the CONFIG_CMDLINE merge and before strscpy(command_line, ...) so the build-time-rendered embedded bootconfig "kernel" subtree is part of boot_command_line by the time parse_early_param() runs. early_param() handlers (mem=, earlycon=, loglevel=, ...) now see values supplied via CONFIG_BOOT_CONFIG_EMBED_FILE without parsing bootconfig at runtime. Gate the prepend on the bootconfig opt-in: only fold in the embedded kernel.* keys when "bootconfig" is present on the command line, or CONFIG_BOOT_CONFIG_FORCE is set. Applying the embedded cmdline unconditionally would (a) diverge from how embedded init.* keys are treated and (b) break fail-safe recovery: a malformed embedded console=/mem= could panic the boot with no way for the admin to disable it by dropping "bootconfig" from the bootloader cmdline. cmdline_find_option_bool() runs before parse_early_param(), so the gate is cheap and correctly ordered. Select ARCH_SUPPORTS_CMDLINE_FROM_BOOTCONFIG so the user-visible CONFIG_BOOT_CONFIG_EMBED_CMDLINE option becomes selectable on x86. With this select in place, setup_boot_config() in init/main.c would otherwise render the embedded "kernel" subtree a second time via xbc_make_cmdline("kernel") into extra_command_line, duplicating every embedded kernel.* key in saved_command_line and making accumulating handlers (console=, earlycon=, ...) register the same value twice. Skip that render only when xbc_prepend_embedded_cmdline() actually prepended the keys, reported by xbc_embedded_cmdline_applied(). Keying the skip on the prepend itself, rather than re-deriving the opt-in, keeps the two paths consistent even when setup_arch() and the runtime parser detect "bootconfig" differently (e.g. "bootconfig=1"): the keys are then rendered at runtime instead of being dropped. Signed-off-by: Breno Leitao --- arch/x86/Kconfig | 1 + arch/x86/kernel/setup.c | 16 ++++++++++++++++ init/main.c | 18 +++++++++++++++--- 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f24810015234..f839795692b4 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -126,6 +126,7 @@ config X86 select ARCH_SUPPORTS_NUMA_BALANCING if X86_64 select ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP if NR_CPUS <= 4096 select ARCH_SUPPORTS_CFI if X86_64 + select ARCH_SUPPORTS_CMDLINE_FROM_BOOTCONFIG select ARCH_USES_CFI_TRAPS if X86_64 && CFI select ARCH_SUPPORTS_LTO_CLANG select ARCH_SUPPORTS_LTO_CLANG_THIN diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index 46882ce79c3a..26a82a41f44c 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -6,6 +6,7 @@ * parts of early kernel initialization. */ #include +#include #include #include #include @@ -36,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -924,6 +926,20 @@ void __init setup_arch(char **cmdline_p) builtin_cmdline_added = true; #endif + /* + * Honor the same opt-in as the runtime bootconfig parser: only fold + * the embedded kernel.* keys into the cmdline when "bootconfig" is + * present on the command line (or CONFIG_BOOT_CONFIG_FORCE is set). + * This keeps fail-safe recovery working -- dropping "bootconfig" from + * the bootloader cmdline disables the embedded keys -- so a malformed + * embedded console=/mem= cannot brick a boot with no way out. It also + * matches setup_boot_config(), which bails out under the same + * condition before parsing the embedded bootconfig at runtime. + */ + if (IS_ENABLED(CONFIG_BOOT_CONFIG_FORCE) || + cmdline_find_option_bool(boot_command_line, "bootconfig")) + xbc_prepend_embedded_cmdline(boot_command_line, COMMAND_LINE_SIZE); + strscpy(command_line, boot_command_line, COMMAND_LINE_SIZE); *cmdline_p = command_line; diff --git a/init/main.c b/init/main.c index e363232b428b..567f641a5731 100644 --- a/init/main.c +++ b/init/main.c @@ -378,12 +378,15 @@ static void __init setup_boot_config(void) int pos, ret; size_t size; char *err; + bool from_embedded = false; /* Cut out the bootconfig data even if we have no bootconfig option */ data = get_boot_config_from_initrd(&size); /* If there is no bootconfig in initrd, try embedded one. */ - if (!data) + if (!data) { data = xbc_get_embedded_bootconfig(&size); + from_embedded = true; + } strscpy(tmp_cmdline, boot_command_line, COMMAND_LINE_SIZE); err = parse_args("bootconfig", tmp_cmdline, NULL, 0, 0, 0, NULL, @@ -421,8 +424,17 @@ static void __init setup_boot_config(void) } else { xbc_get_info(&ret, NULL); pr_info("Load bootconfig: %ld bytes %d nodes\n", (long)size, ret); - /* keys starting with "kernel." are passed via cmdline */ - extra_command_line = xbc_make_cmdline("kernel"); + /* + * keys starting with "kernel." are passed via cmdline. When + * this bootconfig came from the embedded source and + * setup_arch() already prepended the rendered "kernel" subtree + * to boot_command_line, rendering again here would duplicate + * the keys in saved_command_line and make accumulating handlers + * (console=, earlycon=, ...) re-register the same value. Skip + * only when the prepend really happened. + */ + if (!from_embedded || !xbc_embedded_cmdline_applied()) + extra_command_line = xbc_make_cmdline("kernel"); /* Also, "init." keys are init arguments */ extra_init_args = xbc_make_cmdline("init"); } -- 2.53.0-Meta