Merge remote-tracking branch 'origin/main' into fapolicyd-tmpfs

files/dracut/95dot1x-macsec/dot1x-macsec-up.sh

@@ -5,8 +5,9 @@
 #   2. start wpa_supplicant (argv[0]=@wpa_supplicant => survives switch-root)
 #   3. wait for EAP success + macsec0
 #   4. DHCP on macsec0 (the pre-auth lease, if any, is invalid post-auth/VLAN)
-#   5. derive hostnqn/hostid from the cert so dracut's nvmf module can
-#      connect the NVMe/TCP root namespace over macsec0
+#   5. derive hostnqn/hostid from the cert
+#   6. TARGETED NVMe/TCP connect over macsec0 (rd.nvmf.nqn -> this version's
+#      subsystem only, not a discovery connect-all of every served version)
 # Idempotent: guarded by a stamp file because initqueue may re-run hooks.
 
 type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
@@ -159,5 +160,44 @@ if [ ! -s /etc/nvme/hostnqn ]; then
     info "dot1x-macsec: hostnqn $(cat /etc/nvme/hostnqn)"
 fi
 
+# --- 6. connect the NVMe/TCP root over macsec0 (TARGETED to this version) ----
+# Explicit targeted connect. This hook used to only set /etc/nvme/hostnqn and
+# leave the connect to the dracut nvmf module's discovery mechanism — a
+# `connect-all` that attaches EVERY served version's subsystem to this host,
+# inflating target controllers to O(hosts x versions) and keeping old versions
+# pinned above zero connections so the per-version drain/reap gate never fires
+# (see TODO #6). rd.nvmf.nqn pins THIS build's subsystem (baked per-version into
+# the signed cmdline by extract-artifacts.sh, matching verity.json .subnqn on the
+# target); nvme uses the hostnqn/hostid written in step 5. Load-bearing order
+# (invariant #2): this runs AFTER macsec0 is addressed — never connect NVMe
+# before macsec0 has an IP. Keep-alive tuning matches the test path (-k 30 long
+# KATO, -l -1 retry forever, -c 10) so the root link survives kiosk CPU pressure
+# and blips. BENCH-VERIFY: the secure path is not yet confirmed end-to-end.
+_disc=$(getarg rd.nvmf.discover=)
+_nqn=$(getarg rd.nvmf.nqn=)
+if [ -n "$_disc" ] && [ -n "$_nqn" ] && [ ! -e /run/dot1x/.nvmf-connected ]; then
+    _trtype=${_disc%%,*}; _rest=${_disc#*,}
+    _traddr=${_rest%%,*}; _trsvcid=${_rest##*,}
+    modprobe nvme_tcp 2>/dev/null
+    ply nvme-active
+    i=0
+    while [ "$i" -lt "$TIMEOUT" ]; do
+        nvme connect -t "$_trtype" -a "$_traddr" -s "$_trsvcid" -n "$_nqn" \
+            -k 30 -l -1 -c 10 2>/dev/null
+        for _ns in /dev/nvme[0-9]*n[0-9]*; do
+            if [ -b "$_ns" ]; then
+                : > /run/dot1x/.nvmf-connected
+                ply nvme-done
+                info "dot1x-macsec: NVMe root connected over macsec0 ($_ns)"
+                break 2
+            fi
+        done
+        sleep 1; i=$((i + 1))
+    done
+    [ -e /run/dot1x/.nvmf-connected ] || warn "dot1x-macsec: NVMe/TCP connect to $_nqn timed out after ${TIMEOUT}s"
+elif [ -z "$_nqn" ]; then
+    warn "dot1x-macsec: rd.nvmf.nqn not set (legacy UKI) — leaving NVMe connect to the dracut nvmf module (connect-all)"
+fi
+
 : > "$STAMP"
 exit 0

files/dracut/95dot1x-macsec/nvmf-connect.sh

@@ -26,6 +26,15 @@ _rest=${_disc#*,}
 _traddr=${_rest%%,*}
 _trsvcid=${_rest##*,}
 
+# Targeted connect: rd.nvmf.nqn pins THIS build's subsystem (baked per-version
+# into the signed cmdline by extract-artifacts.sh, matching verity.json .subnqn
+# on the target). This replaces a discovery `connect-all`, which attached EVERY
+# served version's subsystem to every host — inflating target controllers and
+# keeping old versions pinned above zero connections so they never drained/reaped
+# (see TODO #6). If rd.nvmf.nqn is absent (a legacy UKI), fall back to connect-all
+# so the host still boots — with a warning.
+_nqn=$(getarg rd.nvmf.nqn=)
+
 # nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists.
 modprobe nvme_tcp 2>/dev/null
 
@@ -50,11 +59,19 @@ _ctrl_loss_tmo=-1
 _reconnect_delay=10
 
 # Networking (ip=dhcp) is brought up in parallel, so poll-and-connect until a
-# fabrics namespace appears or we time out. connect-all is idempotent.
+# fabrics namespace appears or we time out. Both connect forms are idempotent
+# (re-connecting an already-attached subsystem just errors, harmlessly).
+[ -n "$_nqn" ] || echo "nvmf-connect: rd.nvmf.nqn not set — falling back to connect-all (legacy UKI; attaches every served version)" >&2
 _i=0
 while [ "$_i" -lt 60 ]; do
-    nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" \
-        -k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
+    if [ -n "$_nqn" ]; then
+        # TARGETED: attach only this build's subsystem (its data + hash namespaces).
+        nvme connect -t "$_trtype" -a "$_traddr" -s "$_trsvcid" -n "$_nqn" \
+            -k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
+    else
+        nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" \
+            -k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
+    fi
     for _ns in /dev/nvme[0-9]*n[0-9]*; do
         if [ -b "$_ns" ]; then
             mkdir -p /run/dot1x

files/etc/dracut.conf.d/90-diskless.conf

@@ -25,5 +25,13 @@ add_dracutmodules+=" dot1x-macsec network-manager nvmf systemd-veritysetup "
 add_dracutmodules+=" plymouth "
 filesystems+=" erofs overlay "
 add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ "
+# Omit the discrete-GPU DRM drivers plymouth's `drm` dep would otherwise instmod
+# in --no-hostonly mode. This fleet is Intel i915 ONLY (the build VM uses
+# virtio-gpu/bochs), so amdgpu/radeon/nouveau are dead weight — amdgpu.ko alone is
+# the single biggest module in the initramfs. i915 + virtio-gpu/bochs stay for the
+# splash. (Their FIRMWARE is already stripped pre-dracut in diskless.pkr.hcl; this
+# drops the MODULES too.) If a future host has a non-Intel GPU, remove it here.
+# See docs/TODO #18.
+omit_drivers+=" amdgpu radeon nouveau "
 install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf "
 compress="zstd"