sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix missing online hook

Browse Source
This commit is contained in:
Audiobuzz
2026-06-14 13:11:10 +00:00
parent 9841455072
commit a508dce5cf
4 changed files with 48 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
+27 -10
View File
@@ -43,24 +43,41 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
if [ "$(getarg rd.dot1x=)" = "0" ]; then
warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
# Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
# dracut's network module brings the NIC up, gets a DHCP lease, writes
# resolv.conf, and — crucially — emits the "online" event that dracut's
# nvmf module's initqueue/online hook waits on to run `nvme connect-all`.
# Do NOT `ifup`/`ip link set up` the NIC here: it races dracut's own
# bring-up ("Error: ipv4: Address already assigned") and, because it isn't
# dracut's network path, never fires the nvmf online hook — so the NVMe
# namespace never connects and the boot spins on the root device forever.
# (The secure path below is different: there the hook owns macsec0, which
# dracut knows nothing about, so it must address it itself.)
# dracut's network module brings the NIC up, gets a lease and writes
# resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second
# configuration races dracut's own ("Error: ipv4: Address already
# assigned"). (The secure path below is different: there the hook owns
# macsec0, which dracut knows nothing about, so it must address it itself.)
#
# Static test NVMe identity (the secure path derives this from the TPM
# cert). Match these on the nvmet target if it filters by host NQN.
# cert). SPDK serves "allow any host", so this is cosmetic here, but keep it
# so the target can host-filter if desired.
if [ ! -s /etc/nvme/hostnqn ]; then
mkdir -p /etc/nvme
echo "nqn.2026-06.org.example.fleet:test-host" > /etc/nvme/hostnqn
echo "11111111-1111-1111-1111-111111111111" > /etc/nvme/hostid
info "dot1x-macsec: test hostnqn $(cat /etc/nvme/hostnqn)"
fi
# Drive the NVMe-oF connect ourselves. This distro's dracut `nvmf` module
# parses rd.nvmf.discover into /etc/nvme/discovery.conf but registers NO
# initqueue/online autoconnect hook (that hook dir is empty), so
# `nvme connect-all` is never run, the root namespace never appears, and the
# boot spins on /dev/mapper/root forever. Queue connect-all on the main
# initqueue so it retries each loop until the namespace shows up (the link
# is already up via ip=dhcp; connect-all is idempotent once connected).
_disc=$(getarg rd.nvmf.discover=) # e.g. tcp,192.168.50.10,4420
if [ -n "$_disc" ]; then
_trtype=${_disc%%,*} # tcp
_rest=${_disc#*,} # 192.168.50.10,4420
_traddr=${_rest%%,*} # 192.168.50.10
_trsvcid=${_rest##*,} # 4420
info "dot1x-macsec: queueing nvme connect-all ${_trtype}/${_traddr}/${_trsvcid}"
/sbin/initqueue --unique --name nvmf-connect-all \
nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid"
else
warn "dot1x-macsec: rd.nvmf.discover not set — cannot connect NVMe root"
fi
: > "$STAMP"
exit 0
fi
files/dracut/95dot1x-macsec/module-setup.sh
+5 -1
View File
@@ -25,8 +25,12 @@ install() {
# wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
# RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
# present by default, so list everything the hook uses.
# nvme: the rd.dot1x=0 test path drives `nvme connect-all` itself (this
# distro's dracut nvmf module populates discovery.conf but never registers
# an initqueue/online autoconnect hook). The nvmf module installs nvme too,
# but list it here so the hook's dependency is explicit and load-order-safe.
inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid \
grep sed cut tr sha256sum sleep mkdir
grep sed cut tr sha256sum sleep mkdir nvme
# TSS libraries that tpm2_nvread dlopens
inst_libdir_file "libtss2-*"