Initial commit

2026-06-12 01:46:29 +00:00
commit d383655875
21 changed files with 1557 additions and 0 deletions
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Configure SPDK nvmf_tgt to serve the diskless root filesystem as a single
+# READ-ONLY NVMe/TCP namespace (design doc §5, §7).
+#
+# rootfs.erofs is the erofs image with the dm-verity hash tree appended in-file;
+# we expose the WHOLE file as one namespace, and the host splits data/hash with
+# systemd.verity_root_options=hash-offset= from the kernel cmdline. Integrity is
+# enforced end-to-end by dm-verity on the host; the target serves it read-only.
+set -euo pipefail
+
+ROOTFS="/artifacts/rootfs.erofs"
+SUBNQN="${SUBNQN:-nqn.2026-06.org.example.fleet:rootfs}"
+TADDR="${TARGET_ADDR:-0.0.0.0}"
+TPORT="${TARGET_PORT:-4420}"
+CPUMASK="${SPDK_CPUMASK:-0x1}"
+
+[ -s "$ROOTFS" ] || { echo "ERROR: $ROOTFS not found/empty — is ARTIFACT_SRC populated?" >&2; exit 1; }
+
+# Binary locations differ across SPDK images; fall back to the common path.
+TGT=$(command -v nvmf_tgt || echo /usr/libexec/spdk/spdk/build/bin/nvmf_tgt)
+RPC=$(command -v rpc.py   || echo /usr/libexec/spdk/scripts/rpc.py)
+
+echo "==> starting nvmf_tgt (cpumask ${CPUMASK})"
+"$TGT" -m "$CPUMASK" &
+TGT_PID=$!
+trap 'kill "$TGT_PID" 2>/dev/null || true' EXIT
+
+# Wait for the RPC socket to come up.
+for _ in $(seq 1 30); do
+    "$RPC" framework_get_config >/dev/null 2>&1 && break
+    sleep 1
+done
+
+echo "==> creating TCP transport"
+"$RPC" nvmf_create_transport -t TCP -u 16384 -m 8 -c 8192
+
+echo "==> exposing $ROOTFS as bdev 'rootfs' (4 KiB blocks)"
+# -r opens the backing file read-only where supported; harmless if ignored.
+"$RPC" bdev_aio_create "$ROOTFS" rootfs 4096 -r \
+    || "$RPC" bdev_aio_create "$ROOTFS" rootfs 4096
+
+echo "==> creating subsystem $SUBNQN (allow any host — lab/no-auth)"
+"$RPC" nvmf_create_subsystem "$SUBNQN" -a -s SPDKLAB0000000001 -d FleetRootfs
+
+echo "==> adding namespace 1 (read-only)"
+# Newer SPDK accepts --read-only on the namespace; fall back if unsupported.
+"$RPC" nvmf_subsystem_add_ns "$SUBNQN" rootfs --read-only \
+    || "$RPC" nvmf_subsystem_add_ns "$SUBNQN" rootfs
+
+echo "==> adding TCP listener ${TADDR}:${TPORT} (also serves discovery)"
+"$RPC" nvmf_subsystem_add_listener "$SUBNQN" -t tcp -a "$TADDR" -s "$TPORT"
+
+echo "==> SPDK serving $SUBNQN over tcp/${TPORT}; rd.nvmf.discover=tcp,${TADDR},${TPORT}"
+wait "$TGT_PID"