Fix missing online hook
This commit is contained in:
Audiobuzz
+14
-2
@@ -136,8 +136,20 @@ boot LAN.
|
||||
didn't fire the nvmf online hook, so the namespace never auto-connected and
|
||||
boot spun on `/dev/mapper/root` forever (manual `connect-all` worked, which
|
||||
is what masked it). **Fixed:** the bypass branch no longer touches the NIC;
|
||||
`ip=dhcp` owns networking and triggers nvmf autoconnect. (The secure path
|
||||
still addresses macsec0 itself — dracut doesn't know about that interface.)
|
||||
`ip=dhcp` owns networking. (The secure path still addresses macsec0 itself —
|
||||
dracut doesn't know about that interface.)
|
||||
- **dracut's `nvmf` module never auto-connects on this distro.** Its cmdline
|
||||
hook (`92-parse-nvmf-boot-connections.sh`) parses `rd.nvmf.discover` into
|
||||
`/etc/nvme/discovery.conf` correctly, but `initqueue/online/` is **empty** —
|
||||
no autoconnect hook is registered, so `nvme connect-all` is never run (no
|
||||
attempt in dmesg) and the namespace never appears. Drivers load and
|
||||
`/dev/nvme-fabrics` exists; only the connect trigger is missing. **Fixed:**
|
||||
`dot1x-macsec-up.sh` (rd.dot1x=0 branch) now parses the discover address and
|
||||
queues `nvme connect-all` on the initqueue itself (retries until the
|
||||
namespace shows up). **⚠ The secure path has the same dependency on the
|
||||
(absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
|
||||
must likewise drive `connect-all` (or the network-manager port #1 must wire
|
||||
a working autoconnect). Currently only the test path is fixed.
|
||||
- The target Rocky 9 kernel's erofs is built **without
|
||||
`CONFIG_EROFS_FS_ZIP`** — mounting a compressed image fails `erofs: lz4
|
||||
algorithm isn't enabled`, which silently blocks the root mount. **Fixed:**
|
||||
|
||||
@@ -43,24 +43,41 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
|
||||
if [ "$(getarg rd.dot1x=)" = "0" ]; then
|
||||
warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
|
||||
# Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
|
||||
# dracut's network module brings the NIC up, gets a DHCP lease, writes
|
||||
# resolv.conf, and — crucially — emits the "online" event that dracut's
|
||||
# nvmf module's initqueue/online hook waits on to run `nvme connect-all`.
|
||||
# Do NOT `ifup`/`ip link set up` the NIC here: it races dracut's own
|
||||
# bring-up ("Error: ipv4: Address already assigned") and, because it isn't
|
||||
# dracut's network path, never fires the nvmf online hook — so the NVMe
|
||||
# namespace never connects and the boot spins on the root device forever.
|
||||
# (The secure path below is different: there the hook owns macsec0, which
|
||||
# dracut knows nothing about, so it must address it itself.)
|
||||
# dracut's network module brings the NIC up, gets a lease and writes
|
||||
# resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second
|
||||
# configuration races dracut's own ("Error: ipv4: Address already
|
||||
# assigned"). (The secure path below is different: there the hook owns
|
||||
# macsec0, which dracut knows nothing about, so it must address it itself.)
|
||||
#
|
||||
# Static test NVMe identity (the secure path derives this from the TPM
|
||||
# cert). Match these on the nvmet target if it filters by host NQN.
|
||||
# cert). SPDK serves "allow any host", so this is cosmetic here, but keep it
|
||||
# so the target can host-filter if desired.
|
||||
if [ ! -s /etc/nvme/hostnqn ]; then
|
||||
mkdir -p /etc/nvme
|
||||
echo "nqn.2026-06.org.example.fleet:test-host" > /etc/nvme/hostnqn
|
||||
echo "11111111-1111-1111-1111-111111111111" > /etc/nvme/hostid
|
||||
info "dot1x-macsec: test hostnqn $(cat /etc/nvme/hostnqn)"
|
||||
fi
|
||||
|
||||
# Drive the NVMe-oF connect ourselves. This distro's dracut `nvmf` module
|
||||
# parses rd.nvmf.discover into /etc/nvme/discovery.conf but registers NO
|
||||
# initqueue/online autoconnect hook (that hook dir is empty), so
|
||||
# `nvme connect-all` is never run, the root namespace never appears, and the
|
||||
# boot spins on /dev/mapper/root forever. Queue connect-all on the main
|
||||
# initqueue so it retries each loop until the namespace shows up (the link
|
||||
# is already up via ip=dhcp; connect-all is idempotent once connected).
|
||||
_disc=$(getarg rd.nvmf.discover=) # e.g. tcp,192.168.50.10,4420
|
||||
if [ -n "$_disc" ]; then
|
||||
_trtype=${_disc%%,*} # tcp
|
||||
_rest=${_disc#*,} # 192.168.50.10,4420
|
||||
_traddr=${_rest%%,*} # 192.168.50.10
|
||||
_trsvcid=${_rest##*,} # 4420
|
||||
info "dot1x-macsec: queueing nvme connect-all ${_trtype}/${_traddr}/${_trsvcid}"
|
||||
/sbin/initqueue --unique --name nvmf-connect-all \
|
||||
nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid"
|
||||
else
|
||||
warn "dot1x-macsec: rd.nvmf.discover not set — cannot connect NVMe root"
|
||||
fi
|
||||
: > "$STAMP"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -25,8 +25,12 @@ install() {
|
||||
# wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
|
||||
# RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
|
||||
# present by default, so list everything the hook uses.
|
||||
# nvme: the rd.dot1x=0 test path drives `nvme connect-all` itself (this
|
||||
# distro's dracut nvmf module populates discovery.conf but never registers
|
||||
# an initqueue/online autoconnect hook). The nvmf module installs nvme too,
|
||||
# but list it here so the hook's dependency is explicit and load-order-safe.
|
||||
inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid \
|
||||
grep sed cut tr sha256sum sleep mkdir
|
||||
grep sed cut tr sha256sum sleep mkdir nvme
|
||||
|
||||
# TSS libraries that tpm2_nvread dlopens
|
||||
inst_libdir_file "libtss2-*"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
|
||||
|
||||
# Release being served. Must match the Packer build (fleet-<version>.efi).
|
||||
IMAGE_VERSION=0.0.0-67802e2
|
||||
IMAGE_VERSION=0.0.0-9841455
|
||||
|
||||
# OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
|
||||
# as a Docker image volume — the default artifact source. Pin by digest in
|
||||
@@ -10,7 +10,7 @@ OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
|
||||
|
||||
# Fallback only (Docker < 28 / offline): local Packer output dir, used by the
|
||||
# commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
|
||||
ARTIFACT_SRC=../artifacts/0.0.0-67802e2
|
||||
ARTIFACT_SRC=../artifacts/0.0.0-9841455
|
||||
|
||||
# SPDK NVMe/TCP target image — prebuilt + pushed by CI
|
||||
# (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.
|
||||
|
||||
Reference in New Issue
Block a user