From 64dedaf926664ee685bc40ed00a8a34f5904ced2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Sat, 11 Jul 2026 11:03:45 +0200 Subject: [PATCH] build: wire qemu-nvidia-cpu verity params and component manifest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Teach the shim-v2 build to feed the "nvidia" base root hash into the Go runtime's KERNELVERITYPARAMS_NV_BASE - its KERNELVERITYPARAMS_NV is the monolithic nvidia-gpu hash - so qemu-nvidia-cpu boots the base image verity-backed just like qemu-nvidia-cpu-runtime-rs already does. List the new qemu-nvidia-cpu / qemu-nvidia-cpu-runtime-rs classes in shim-components.json so the build ships them: both boot the nvidia base image with the nvidia kernel and no GPU extension, dropping OVMF on x86_64 and keeping it on aarch64 (which boots via UEFI). Signed-off-by: Fabiano Fidêncio Assisted-by: Cursor --- tools/packaging/kata-deploy/shim-components.json | 8 ++++++++ tools/packaging/static-build/shim-v2/build.sh | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/tools/packaging/kata-deploy/shim-components.json b/tools/packaging/kata-deploy/shim-components.json index 83a254c0f0..35db3dbec3 100644 --- a/tools/packaging/kata-deploy/shim-components.json +++ b/tools/packaging/kata-deploy/shim-components.json @@ -39,6 +39,14 @@ "qemu-nvidia-gpu-runtime-rs": { "x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"] }, + "qemu-nvidia-cpu": { + "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia"], + "aarch64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "ovmf"] + }, + "qemu-nvidia-cpu-runtime-rs": { + "x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia"], + "aarch64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "ovmf"] + }, "qemu-nvidia-gpu-snp": { "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"] }, diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh index 1eb949ceea..a7eec5c51b 100755 --- a/tools/packaging/static-build/shim-v2/build.sh +++ b/tools/packaging/static-build/shim-v2/build.sh @@ -98,6 +98,10 @@ RUST_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-extension" "NVIDIAGPUEXTENSION GO_EXTRA_OPTS="$(read_verity_param "confidential" "KERNELVERITYPARAMS")" GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu" "KERNELVERITYPARAMS_NV")" GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-confidential" "KERNELVERITYPARAMS_CONFIDENTIAL_NV")" +# qemu-nvidia-cpu (Go) boots the driver-agnostic nvidia base image verity-backed; +# it needs the "nvidia" base hash in its own var since KERNELVERITYPARAMS_NV +# above is the monolithic nvidia-gpu hash. +GO_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV_BASE")" # shellcheck disable=SC2154,SC2086 docker pull "${container_image}" || \