github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-09-03 09:54:33 +00:00
Code Issues Projects Releases Wiki Activity

build: Add "confidential" kernel

Browse Source 
We're using a Kernel based on v6.7, which should include all te
patches needed for SEV / SNP / TDX.

By doing this, later on, we'll be able to stop building the specific
kernel for each one of the targets we have for the TEEs.

Let's note that we've introduced the "confidential" target for the
kernel builder script, while the TEE specific builds are being kept as
they're -- at least for now.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio
2024-01-08 13:11:42 -03:00
parent 379e2f3da2
commit 8b2f43a2c2
10 changed files with 37 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tools/packaging/kata-deploy/local-build/Makefile
View File

@@ -20,6 +20,7 @@ endif
ifeq ($(ARCH), x86_64)
BASE_TARBALLS = serial-targets \
firecracker-tarball \
kernel-confidential-tarball \
kernel-dragonball-experimental-tarball \
kernel-nvidia-gpu-tarball \
kernel-nvidia-gpu-snp-tarball \
@@ -110,6 +111,9 @@ kernel-nvidia-gpu-tdx-experimental-tarball:
kernel-tarball:
${MAKE} $@-build
kernel-confidential-tarball:
${MAKE} $@-build
kernel-tdx-experimental-tarball:
${MAKE} $@-build

25
tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
View File

@@ -92,6 +92,7 @@ options:
firecracker
kata-ctl
kernel
kernel-confidential
kernel-dragonball-experimental
kernel-experimental
kernel-nvidia-gpu
@@ -280,7 +281,7 @@ install_cached_kernel_tarball_component() {
"${final_tarball_path}" \
|| return 1
if [[ "${kernel_name}" != "kernel-sev" ]]; then
if [[ "${kernel_name}" != "kernel-sev" ]] && [[ "${kernel_name}" != "kernel-confidential" ]]; then
return 0
fi
@@ -289,13 +290,13 @@ install_cached_kernel_tarball_component() {
"${kernel_name}" \
"${latest_artefact}" \
"${latest_builder_image}" \
"kata-static-kernel-sev-modules.tar.xz" \
"${workdir}/kata-static-kernel-sev-modules.tar.xz" \
"kata-static-${kernel_name}-modules.tar.xz" \
"${workdir}/kata-static-${kernel_name}-modules.tar.xz" \
|| return 1
if [[ -n "${module_dir}" ]]; then
mkdir -p "${module_dir}"
tar xvf "${workdir}/kata-static-kernel-sev-modules.tar.xz" -C "${module_dir}" && return 0
tar xvf "${workdir}/kata-static-${kernel_name}-modules.tar.xz" -C "${module_dir}" && return 0
fi
return 1
@@ -315,6 +316,10 @@ install_kernel_helper() {
kernel_version="$(get_from_kata_deps assets.kernel.sev.version)"
default_patches_dir="${repo_root_dir}/tools/packaging/kernel/patches"
module_dir="${repo_root_dir}/tools/packaging/kata-deploy/local-build/build/kernel-sev/builddir/kata-linux-${kernel_version#v}-${kernel_kata_config_version}/lib/modules/${kernel_version#v}"
elif [[ "${kernel_name}" == "kernel-confidential" ]]; then
kernel_version="$(get_from_kata_deps assets.kernel.confidential.version)"
default_patches_dir="${repo_root_dir}/tools/packaging/kernel/patches"
module_dir="${repo_root_dir}/tools/packaging/kata-deploy/local-build/build/kernel-confidential/builddir/kata-linux-${kernel_version#v}-${kernel_kata_config_version}/lib/modules/${kernel_version#v}"
fi
install_cached_kernel_tarball_component ${kernel_name} ${module_dir} && return 0
@@ -332,6 +337,15 @@ install_kernel() {
"-f"
}
install_kernel_confidential() {
local kernel_url="$(get_from_kata_deps assets.kernel.confidential.url)"
install_kernel_helper \
"assets.kernel.confidential.version" \
"kernel" \
"-x confidential -u ${kernel_url}"
}
install_kernel_dragonball_experimental() {
install_kernel_helper \
"assets.kernel-dragonball-experimental.version" \
@@ -741,6 +755,7 @@ handle_build() {
install_initrd_sev
install_kata_ctl
install_kernel
install_kernel_confidential
install_kernel_dragonball_experimental
install_kernel_tdx_experimental
install_log_parser_rs
@@ -776,6 +791,8 @@ handle_build() {
kernel) install_kernel ;;
kernel-confidential) install_kernel_confidential ;;
kernel-dragonball-experimental) install_kernel_dragonball_experimental ;;
kernel-nvidia-gpu) install_kernel_nvidia_gpu ;;