svc: /mnt/fw/ether0 needs an mntgen of its own

The service file said -m /mnt/fw/ether0 and nothing made that name.
mntgen invents names one level deep, so the one over /mnt gives /mnt/fw
and stops there:

	one mntgen over /mnt makes /mnt/fw                        yes
	but not /mnt/fw/ether0, which is where fw is told to mount no
	a second one over /mnt/fw does                            yes

So a second mntgen over /mnt/fw, as its own service, and every fw needs
it.  It is a file server like the rest -- posts its name, lets the
process that started it exit -- so ready=srv:mntfw, the same shape fw
uses.

fwstart already does this imperatively, which is why the boot path
worked and the supervised path would not have.  Four checks now pin the
premise both rest on, ending with fw actually mounting its control
files under the second mntgen.

The finding and the service file are Calvin's; the checks are mine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

3 files changed, 54 insertions, 1 deletions

diff --git a/fw/lib/svc/fw.ether0 b/fw/lib/svc/fw.ether0
index 627b1d3..33f2a2d 100644
--- a/fw/lib/svc/fw.ether0
+++ b/fw/lib/svc/fw.ether0
@@ -37,6 +37,7 @@ svc=fw.ether0
 	args=10.0.2.2
 	args=/lib/fw/host.ndb
 	needs=ipconfig
+	needs=mntfw
 	ready=srv:fw.ether0
 	restart=always
 	enable=no
diff --git a/fw/lib/svc/mntfw b/fw/lib/svc/mntfw
new file mode 100644
index 0000000..62eb2e5
--- /dev/null
+++ b/fw/lib/svc/mntfw
@@ -0,0 +1,19 @@
+#
+# The control directories fw mounts on.
+#
+# mount(2) needs its mount point to exist, and the mntgen serving /mnt
+# only makes names one level deep -- /mnt/fw appears by itself, but
+# /mnt/fw/ether0 does not, and that is what fw is told to mount on.  So
+# a second mntgen, over /mnt/fw, and every fw needs it.
+#
+# It is a file server: it posts its name and the process that started it
+# exits, so what is watched is the /srv name.
+#
+svc=mntfw
+	exec=/bin/mntgen
+	args=-s
+	args=mntfw
+	args=/mnt/fw
+	ready=srv:mntfw
+	restart=always
+	enable=yes
diff --git a/fw/test/fwtest.rc b/fw/test/fwtest.rc
index dbd7754..904a055 100755
--- a/fw/test/fwtest.rc
+++ b/fw/test/fwtest.rc
@@ -51,7 +51,7 @@ mkdir -p $mtpt
 # The stacks the packet checks build for themselves.  Fixed numbers are
 # fine because they are unbound again at the end of each block, and the
 # last check proves it.
-stacks=(20 21 22 23 24 25 26 27 28)
+stacks=(20 21 22 23 24 25 26 27 28 29 30)
 
 # A port of our own.  Conversations outlive the run that made them - a
 # devip Conv is never freed - so a fixed port makes one run's leftovers
@@ -669,6 +669,39 @@ echo '== supervision'
 	check 'and the interface it made goes with it' maxtu $"r
 }
 
+echo '== where the control files are mounted'
+# mntgen makes names one level deep, so a single one over /mnt gives
+# /mnt/fw and never /mnt/fw/ether0 - which is what fw is told to mount
+# on, one directory per card.  Both the boot script and the service
+# file put a second mntgen over /mnt/fw for that reason, and this is
+# the fact they rest on.
+@{
+	rfork n
+	mkdir -p $tmp/mnt2
+	bind -c $tmp/mnt2 /mnt
+	mntgen /mnt </dev/null >/dev/null >[2]/dev/null
+	sleep 1
+	r=`{if(test -d /mnt/fw) echo yes; if not echo no}
+	check 'one mntgen over /mnt makes /mnt/fw' yes $"r
+	r=`{if(test -d /mnt/fw/ether0) echo yes; if not echo no}
+	check 'but not /mnt/fw/ether0, which is where fw is told to mount' no $"r
+
+	mntgen /mnt/fw </dev/null >/dev/null >[2]/dev/null
+	sleep 1
+	r=`{if(test -d /mnt/fw/ether0) echo yes; if not echo no}
+	check 'a second one over /mnt/fw does' yes $"r
+
+	bind -a '#I29' $nA
+	bind -a '#I30' $nB
+	$fw -m /mnt/fw/ether0 $tmp/empty.ndb \
+		$nA^'!'^10.9.9.1^'!'^/24 $nB^'!'^10.9.9.2^'!'^/24 \
+		</dev/null >/dev/null >[2]/dev/null
+	sleep 3
+	r=`{ls /mnt/fw/ether0 | wc -l}
+	check 'and fw mounts its control files there' 4 $"r
+	stopfw $nA $nB
+}
+
 echo '== fwstart'
 if(test -f $lib/fwstart)
 @{