build: Add "confidential" kernel

We're using a Kernel based on v6.7, which should include all te
patches needed for SEV / SNP / TDX.

By doing this, later on, we'll be able to stop building the specific
kernel for each one of the targets we have for the TEEs.

Let's note that we've introduced the "confidential" target for the
kernel builder script, while the TEE specific builds are being kept as
they're -- at least for now.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio
2024-01-08 13:11:42 -03:00
parent 379e2f3da2
commit 8b2f43a2c2
10 changed files with 37 additions and 8 deletions

View File

@@ -110,7 +110,7 @@ Options:
-t <hypervisor> : Hypervisor_target.
-u <url> : Kernel URL to be used to download the kernel tarball.
-v <version> : Kernel version to use if kernel path not provided.
-x <type> : Confidential guest protection type, such as sev, snp and tdx
-x <type> : Confidential guest protection type, such as sev, snp, tdx, or "confidential" (for all of those).
EOF
exit "$exit_code"
}
@@ -457,7 +457,7 @@ build_kernel() {
arch_target=$(arch_to_kernel "${arch_target}")
pushd "${kernel_path}" >>/dev/null
make -j $(nproc ${CI:+--ignore 1}) ARCH="${arch_target}" ${CROSS_BUILD_ARG}
if [ "${conf_guest}" == "sev" ]; then
if [ "${conf_guest}" == "sev" ] || [ "${conf_guest}" == "confidential" ]; then
make -j $(nproc ${CI:+--ignore 1}) INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=${kernel_path} modules_install
fi
[ "$arch_target" != "powerpc" ] && ([ -e "arch/${arch_target}/boot/bzImage" ] || [ -e "arch/${arch_target}/boot/Image.gz" ])
@@ -603,7 +603,7 @@ main() {
x)
conf_guest="${OPTARG}"
case "$conf_guest" in
sev|snp|tdx) ;;
confidential|sev|snp|tdx) ;;
*) die "Confidential guest type '$conf_guest' not supported" ;;
esac
;;