misc/60956: ramdisk-cgdroot.fs seems to check for /libdata/firmware/ in the ram disk rather than the mounted cgdroot

["el%horse64.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60956
>Category:       misc
>Synopsis:       ramdisk-cgdroot.fs seems to check for /libdata/firmware/ in the ram disk rather than the mounted cgdroot
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    misc-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Nov 02 18:40:00 +0000 2026
>Originator:     Ellie
>Release:        11.0
>Organization:
I'm just a chaotic free software tinkerer :)
>Environment:
NetBSD ruby-b-s-delly 11.0_STABLE NetBSD 11.0_STABLE (GENERIC) #0: Fri Oct 30 19:02:53 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
The ramdisk-cgdroot.fs seems to check for /libdata/firmware/ in the ram disk rather than the mounted cgdroot.

This means if you boot via the normal multi user way, it will start up your system with / being your actual physical unlocked partition inside the cgd container, however, it will apparently retain the RAM fs it used to show the password prompt (from before the unlock being completed) as a hidden / and check there for /libdata/firmware/ when loading firmware.

Since the RAM fs is a minimal rescue shell, it has no firmware. Therefore, e.g. my wifi stick will cause this error to show up:

urtwn0: autoconfiguration error: failed load firmware of file rtl8192eefw.bin (error 2)

And then it will not work.

This can be worked around by:

1. setting rc_configured=NO in /etc/rc.conf to prevent the multi user boot from completing,

2. in the RAM disk, first set up /libdata/firmware as a sym link to the actual physical disk in /altroot and then set up /altroot as a proper chroot https://codeberg.org/ell1e/ellieputercrap/src/commit/1e3b91c3af8691a80e06ef6c2555f16aca9d40ea/NetBSD/ellies_cursed_altroot_chroot.sh (This script does all that),

3. then you have to of course start the "network" and "wpa_supplicant" and all other services yourself since normal multi user boot didn't run. But after that, your wifi will work:
>How-To-Repeat:
1. Set up an encrypted cgd with an FFS 2ea / partition inside. /etc/cgd and /efi should be separate unencrypted partitions each.

2. Install a NetBSD as usual, and make sure that /efi/EFI/BOOT/ contains the necessary boot loader and that /etc/cgd/cgd.cfg contains the cgdroot unlock config. Do a terminal install without any display managers. Make sure to copy the kernel to /efi/netbsd and the ramdisk to /efi/ramdisk-cgdroot.fs.

3. Make sure and double check that your partitions are labelled correctly with LABEL=efi for efi, LABEL=cgdroot for the cgd, and LABEL=cgd.conf for the /etc/cgd partition.

4. Set up your boot.cfg such that you invoke fs /ramdisk-cgdroot.fs and then invoke boot hd0a:/netbsd to get to the password prompt (Don't ask me why exactly the hd0a addition is needed, I got this form chat).

5. You should now be able to boot up and reach multi user stage.

6. After booting into multi user you should be greeted with a TTY. Login and e.g. try to use an rt8192 wifi stick that needs a firmware upload.

(Sorry if I forgot a step, I tried to be as exhaustive as possible. There might be some minor things required in the /efi partition that I forgot about.)
>Fix:
Well in theory the /libdata/firmware inside the ramdisk just needs to point somehow to the real /libdata/firmware on the actual physical disk via a symlink. I'm not sure how one would best do that.