From 388b649e97bac19aec7cb5a7b775dfe0127a1fa3 Mon Sep 17 00:00:00 2001 From: Nianyu Shen Date: Thu, 16 Jul 2026 08:37:15 -0700 Subject: [PATCH 1/2] feat: support installer boot from USB media on Renesas xHCI hardware Bundle the Renesas xHCI (USB 3.0) host controller driver into the initramfs and disable PCI reallocation on the installer boot entries so the Palette Edge installer can boot and install from USB media on hardware using that chipset. - Earthfile: write /etc/dracut.conf.d/99-usb-media.conf in base-image before the distro dracut regeneration so xhci_pci_renesas is included in the generated initramfs (add_drivers + force_drivers). - grub.cfg: add pci=realloc=off to the installer menu entries. --- Earthfile | 6 ++++++ overlay/files-iso/boot/grub2/grub.cfg | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/Earthfile b/Earthfile index 11a0c83c..4907c0b3 100644 --- a/Earthfile +++ b/Earthfile @@ -770,6 +770,12 @@ base-image: COPY cloudconfigs/80_stylus_maas.yaml /system/oem/80_stylus_maas.yaml END + # Ensure the Renesas xHCI (USB 3.0) host controller driver is bundled into the + # initramfs so installation from USB media works on hardware using that chipset. + # Must run before the distro dracut regeneration below so the driver is included. + RUN mkdir -p /etc/dracut.conf.d && \ + printf '%s\n' 'hostonly="no"' 'add_drivers+=" xhci_pci_renesas "' 'force_drivers+=" xhci_pci_renesas "' > /etc/dracut.conf.d/99-usb-media.conf + # OS == Ubuntu IF [ "$OS_DISTRIBUTION" = "ubuntu" ] && [ "$ARCH" = "amd64" ] IF [ ! -z "$UBUNTU_PRO_KEY" ] diff --git a/overlay/files-iso/boot/grub2/grub.cfg b/overlay/files-iso/boot/grub2/grub.cfg index 448421e7..b70116d0 100644 --- a/overlay/files-iso/boot/grub2/grub.cfg +++ b/overlay/files-iso/boot/grub2/grub.cfg @@ -13,21 +13,21 @@ if [ -f ${font} ];then fi menuentry "Palette eXtended Kubernetes Edge Installer" --class os --unrestricted { echo Loading kernel... - $linux ($root)/boot/kernel cdroot root=live:CDLABEL=COS_LIVE rd.live.dir=/ rd.live.squashimg=rootfs.squashfs net.ifnames=1 console=tty1 console=ttyS0 rd.cos.disable vga=795 nomodeset nodepair.enable selinux=0 rd.live.overlay.overlayfs rd.immucore.sysrootwait=600 systemd.unified_cgroup_hierarchy=1 + $linux ($root)/boot/kernel cdroot root=live:CDLABEL=COS_LIVE rd.live.dir=/ rd.live.squashimg=rootfs.squashfs net.ifnames=1 console=tty1 console=ttyS0 rd.cos.disable vga=795 nomodeset nodepair.enable selinux=0 rd.live.overlay.overlayfs rd.immucore.sysrootwait=600 systemd.unified_cgroup_hierarchy=1 pci=realloc=off echo Loading initrd... $initrd ($root)/boot/initrd } menuentry "Palette eXtended Kubernetes Edge Installer (manual)" --class os --unrestricted { echo Loading kernel... - $linux ($root)/boot/kernel cdroot root=live:CDLABEL=COS_LIVE rd.live.dir=/ rd.live.squashimg=rootfs.squashfs net.ifnames=1 console=tty1 console=ttyS0 rd.cos.disable selinux=0 rd.live.overlay.overlayfs rd.immucore.sysrootwait=600 systemd.unified_cgroup_hierarchy=1 + $linux ($root)/boot/kernel cdroot root=live:CDLABEL=COS_LIVE rd.live.dir=/ rd.live.squashimg=rootfs.squashfs net.ifnames=1 console=tty1 console=ttyS0 rd.cos.disable selinux=0 rd.live.overlay.overlayfs rd.immucore.sysrootwait=600 systemd.unified_cgroup_hierarchy=1 pci=realloc=off echo Loading initrd... $initrd ($root)/boot/initrd } menuentry "Palette Edge Interactive Installer" --class os --unrestricted { echo Loading kernel... - $linux ($root)/boot/kernel cdroot root=live:CDLABEL=COS_LIVE rd.live.dir=/ rd.live.squashimg=rootfs.squashfs net.ifnames=1 console=tty1 console=ttyS0 rd.cos.disable vga=795 nomodeset nodepair.enable selinux=0 rd.live.overlay.overlayfs rd.immucore.sysrootwait=600 systemd.unified_cgroup_hierarchy=1 interactive-install + $linux ($root)/boot/kernel cdroot root=live:CDLABEL=COS_LIVE rd.live.dir=/ rd.live.squashimg=rootfs.squashfs net.ifnames=1 console=tty1 console=ttyS0 rd.cos.disable vga=795 nomodeset nodepair.enable selinux=0 rd.live.overlay.overlayfs rd.immucore.sysrootwait=600 systemd.unified_cgroup_hierarchy=1 pci=realloc=off interactive-install echo Loading initrd... $initrd ($root)/boot/initrd } From 48ec5acb7df51a1f7585a81f9f5680e5bd5cfcab Mon Sep 17 00:00:00 2001 From: Nianyu Shen Date: Thu, 16 Jul 2026 08:41:40 -0700 Subject: [PATCH 2/2] feat(fips): bundle Renesas xHCI driver into initramfs for USB media boot The Earthfile skips dracut regeneration for FIPS builds, so the USB media driver config must be added in the ubuntu-fips Dockerfiles where kairos-init regenerates the initramfs (-s init --fips). Add a 99-usb-media.conf (xhci_pci_renesas via add_drivers + force_drivers) to each Ubuntu FIPS version (20.04/22.04/24.04) and COPY it into /etc/dracut.conf.d/ before the kairos-init init step that runs dracut. --- ubuntu-fips/20.04/99-usb-media.conf | 3 +++ ubuntu-fips/20.04/Dockerfile | 5 +++++ ubuntu-fips/22.04/99-usb-media.conf | 3 +++ ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips | 5 +++++ ubuntu-fips/24.04/99-usb-media.conf | 3 +++ ubuntu-fips/24.04/Dockerfile.ubuntu24.04-fips | 5 +++++ 6 files changed, 24 insertions(+) create mode 100644 ubuntu-fips/20.04/99-usb-media.conf create mode 100644 ubuntu-fips/22.04/99-usb-media.conf create mode 100644 ubuntu-fips/24.04/99-usb-media.conf diff --git a/ubuntu-fips/20.04/99-usb-media.conf b/ubuntu-fips/20.04/99-usb-media.conf new file mode 100644 index 00000000..af815ee8 --- /dev/null +++ b/ubuntu-fips/20.04/99-usb-media.conf @@ -0,0 +1,3 @@ +hostonly="no" +add_drivers+=" xhci_pci_renesas " +force_drivers+=" xhci_pci_renesas " diff --git a/ubuntu-fips/20.04/Dockerfile b/ubuntu-fips/20.04/Dockerfile index 2cf14ee2..1c8365ab 100644 --- a/ubuntu-fips/20.04/Dockerfile +++ b/ubuntu-fips/20.04/Dockerfile @@ -112,6 +112,11 @@ RUN cd /usr/lib/dracut/modules.d/95iscsi && patch < /dracut-broken-iscsi-ubuntu- COPY dracut.conf /etc/dracut.conf.d/kairos-fips.conf +# Bundle the Renesas xHCI (USB 3.0) host controller driver into the initramfs so +# installation from USB media works on hardware using that chipset. Consumed by the +# `kairos-init -s init` dracut run below (the Earthfile skips dracut for FIPS builds). +COPY 99-usb-media.conf /etc/dracut.conf.d/99-usb-media.conf + # Copy the custom dracut modules.fips that includes 2 missing modules COPY modules.fips /tmp/modules.fips RUN kernel=$(ls /lib/modules | grep fips | head -n1) && mv /tmp/modules.fips /lib/modules/${kernel}/modules.fips diff --git a/ubuntu-fips/22.04/99-usb-media.conf b/ubuntu-fips/22.04/99-usb-media.conf new file mode 100644 index 00000000..af815ee8 --- /dev/null +++ b/ubuntu-fips/22.04/99-usb-media.conf @@ -0,0 +1,3 @@ +hostonly="no" +add_drivers+=" xhci_pci_renesas " +force_drivers+=" xhci_pci_renesas " diff --git a/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips b/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips index 5d4c06be..282bc8a3 100644 --- a/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips +++ b/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips @@ -32,6 +32,11 @@ RUN --mount=type=secret,id=pro-attach-config \ COPY 22.04/dracut.conf /etc/dracut.conf.d/kairos-fips.conf +# Bundle the Renesas xHCI (USB 3.0) host controller driver into the initramfs so +# installation from USB media works on hardware using that chipset. Consumed by the +# `kairos-init -s init` dracut run below (the Earthfile skips dracut for FIPS builds). +COPY 22.04/99-usb-media.conf /etc/dracut.conf.d/99-usb-media.conf + # Copy the custom dracut modules.fips that includes 2 missing modules COPY 22.04/modules.fips /tmp/modules.fips RUN kernel=$(ls /lib/modules | head -n1) && mv /tmp/modules.fips /lib/modules/${kernel}/modules.fips diff --git a/ubuntu-fips/24.04/99-usb-media.conf b/ubuntu-fips/24.04/99-usb-media.conf new file mode 100644 index 00000000..af815ee8 --- /dev/null +++ b/ubuntu-fips/24.04/99-usb-media.conf @@ -0,0 +1,3 @@ +hostonly="no" +add_drivers+=" xhci_pci_renesas " +force_drivers+=" xhci_pci_renesas " diff --git a/ubuntu-fips/24.04/Dockerfile.ubuntu24.04-fips b/ubuntu-fips/24.04/Dockerfile.ubuntu24.04-fips index a9d1d6de..f8e63381 100644 --- a/ubuntu-fips/24.04/Dockerfile.ubuntu24.04-fips +++ b/ubuntu-fips/24.04/Dockerfile.ubuntu24.04-fips @@ -41,6 +41,11 @@ RUN --mount=type=secret,id=pro-attach-config \ COPY 24.04/modules.fips /tmp/modules.fips RUN kernel=$(ls /lib/modules | head -n1) && mv /tmp/modules.fips /lib/modules/${kernel}/modules.fips +# Bundle the Renesas xHCI (USB 3.0) host controller driver into the initramfs so +# installation from USB media works on hardware using that chipset. Consumed by the +# `kairos-init -s init` dracut run below (the Earthfile skips dracut for FIPS builds). +COPY 24.04/99-usb-media.conf /etc/dracut.conf.d/99-usb-media.conf + COPY 24.04/fix.sh /tmp/fix.sh COPY stig-remediate.sh /tmp/stig-remediate.sh COPY restore-ubuntu-default-banners.sh /tmp/restore-ubuntu-default-banners.sh