github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-17 01:30:44 +00:00
Code Issues Projects Releases Wiki Activity

build: wire qemu-nvidia-cpu verity params and component manifest

Browse Source 
Teach the shim-v2 build to feed the "nvidia" base root hash into the Go
runtime's KERNELVERITYPARAMS_NV_BASE - its KERNELVERITYPARAMS_NV is the
monolithic nvidia-gpu hash - so qemu-nvidia-cpu boots the base image
verity-backed just like qemu-nvidia-cpu-runtime-rs already does.

List the new qemu-nvidia-cpu / qemu-nvidia-cpu-runtime-rs classes in
shim-components.json so the build ships them: both boot the nvidia base
image with the nvidia kernel and no GPU extension, dropping OVMF on x86_64
and keeping it on aarch64 (which boots via UEFI).

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Fabiano Fidêncio
2026-07-11 11:03:45 +02:00
parent 7cb4a189c1
commit 64dedaf926
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tools/packaging/kata-deploy/shim-components.json
View File

@@ -39,6 +39,14 @@
"qemu-nvidia-gpu-runtime-rs": {
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"]
},
"qemu-nvidia-cpu": {
"x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia"],
"aarch64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "ovmf"]
},
"qemu-nvidia-cpu-runtime-rs": {
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia"],
"aarch64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "ovmf"]
},
"qemu-nvidia-gpu-snp": {
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
},

4
tools/packaging/static-build/shim-v2/build.sh
View File

@@ -98,6 +98,10 @@ RUST_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-extension" "NVIDIAGPUEXTENSION
GO_EXTRA_OPTS="$(read_verity_param "confidential" "KERNELVERITYPARAMS")"
GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu" "KERNELVERITYPARAMS_NV")"
GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-confidential" "KERNELVERITYPARAMS_CONFIDENTIAL_NV")"
# qemu-nvidia-cpu (Go) boots the driver-agnostic nvidia base image verity-backed;
# it needs the "nvidia" base hash in its own var since KERNELVERITYPARAMS_NV
# above is the monolithic nvidia-gpu hash.
GO_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV_BASE")"
# shellcheck disable=SC2154,SC2086
docker pull "${container_image}" || \