config: use split CoCo image for runtime-rs, keep Go on monolithic

During the transition to composable (base + extension) CoCo images, run the two runtimes on different image layouts so CI exercises both paths via the existing qemu-{snp,tdx,coco-dev} (Go) and -runtime-rs (Rust) shims: - runtime-rs (Rust) CoCo templates use the standard base image plus a CoCo extension extra_image: image = "@IMAGEPATH@" (was @IMAGECONFIDENTIALPATH@) [[hypervisor.qemu.guest_extension_images]] name = "coco" path = "@COCOIMAGEPATH@" verity_params = "@COCOVERITYPARAMS@" COCOIMAGENAME/COCOIMAGEPATH/COCOVERITYPARAMS are added to the runtime-rs Makefile only. - runtime (Go) CoCo templates keep the monolithic confidential image (@IMAGECONFIDENTIALPATH@) and pull rootfs-image-confidential. shim-components.json reflects this: Go CoCo shims depend on rootfs-image-confidential while the runtime-rs CoCo shims depend on rootfs-image + rootfs-image-coco-extension. shim-v2/build.sh feeds each runtime its own dm-verity params: Rust gets the measured base image hash (@KERNELVERITYPARAMS@) plus the extension hash (@COCOVERITYPARAMS@); Go gets the monolithic confidential image hash (@KERNELVERITYPARAMS@). This is wired per make invocation so the same @KERNELVERITYPARAMS@ placeholder resolves correctly for each. Once the split path is validated we can flip the Go templates too and drop the monolithic confidential image. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Assisted-by: Cursor <cursoragent@cursor.com>
2026-07-07 19:06:16 +00:00 · 2026-05-10 19:04:30 +02:00
parent 1906a44413
commit bd93a93990
6 changed files with 67 additions and 25 deletions
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -105,6 +105,9 @@ PKGRUNDIR := $(LOCALSTATEDIR)/run/$(PROJECT_DIR)
 KERNELDIR := $(PKGDATADIR)
 IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME)
 IMAGECONFIDENTIALPATH := $(PKGDATADIR)/$(IMAGECONFIDENTIALNAME)
+COCOIMAGENAME := $(PROJECT_TAG)-coco-extension.img
+COCOIMAGEPATH := $(PKGDATADIR)/$(COCOIMAGENAME)
+COCOVERITYPARAMS :=
 INITRDPATH := $(PKGDATADIR)/$(INITRDNAME)
 INITRDCONFIDENTIALPATH := $(PKGDATADIR)/$(INITRDCONFIDENTIALNAME)

@@ -645,6 +648,9 @@ USER_VARS += IMAGEPATH
 USER_VARS += IMAGEPATH_CLH_AZURE
 USER_VARS += IMAGEPATH_NV
 USER_VARS += IMAGECONFIDENTIALPATH
+USER_VARS += COCOIMAGENAME
+USER_VARS += COCOIMAGEPATH
+USER_VARS += COCOVERITYPARAMS
 USER_VARS += INITRDNAME
 USER_VARS += INITRDCONFIDENTIALNAME
 USER_VARS += INITRDPATH
--- a/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in
@@ -15,7 +15,7 @@
 [hypervisor.qemu]
 path = "@QEMUPATH@"
 kernel = "@KERNELPATH_COCO@"
-image = "@IMAGECONFIDENTIALPATH@"
+image = "@IMAGEPATH@"
 machine_type = "@MACHINETYPE@"

 # rootfs filesystem type:
@@ -733,3 +733,8 @@ enable_pprof = false
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
+
+[[hypervisor.qemu.guest_extension_images]]
+name = "coco"
+path = "@COCOIMAGEPATH@"
+verity_params = "@COCOVERITYPARAMS@"
--- a/src/runtime-rs/config/configuration-qemu-snp-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-snp-runtime-rs.toml.in
@@ -16,7 +16,7 @@
 [hypervisor.qemu]
 path = "@QEMUPATH@"
 kernel = "@KERNELPATH_COCO@"
-image = "@IMAGECONFIDENTIALPATH@"
+image = "@IMAGEPATH@"
 machine_type = "@MACHINETYPE@"

 # Enable confidential guest support.
@@ -755,3 +755,8 @@ enable_pprof = false
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
+
+[[hypervisor.qemu.guest_extension_images]]
+name = "coco"
+path = "@COCOIMAGEPATH@"
+verity_params = "@COCOVERITYPARAMS@"
--- a/src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in
@@ -15,7 +15,7 @@
 [hypervisor.qemu]
 path = "@QEMUPATH@"
 kernel = "@KERNELPATH_COCO@"
-image = "@IMAGECONFIDENTIALPATH@"
+image = "@IMAGEPATH@"
 # initrd = "@INITRDPATH@"
 machine_type = "@MACHINETYPE@"
 # Set to 0 to use Unix Domain Socket (/var/run/tdx-qgs/qgs.socket) instead of vsock.
@@ -733,3 +733,8 @@ enable_pprof = false
 # to the hypervisor.
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
+
+[[hypervisor.qemu.guest_extension_images]]
+name = "coco"
+path = "@COCOIMAGEPATH@"
+verity_params = "@COCOVERITYPARAMS@"
--- a/tools/packaging/kata-deploy/shim-components.json
+++ b/tools/packaging/kata-deploy/shim-components.json
@@ -19,13 +19,13 @@
      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"]
    },
    "qemu-snp-runtime-rs": {
-      "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"]
+      "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-sev"]
    },
    "qemu-tdx": {
      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image-confidential", "ovmf-tdx"]
    },
    "qemu-tdx-runtime-rs": {
-      "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image-confidential", "ovmf-tdx"]
+      "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-tdx"]
    },
    "qemu-se": {
      "s390x": ["shim-v2-go", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"]
@@ -56,9 +56,9 @@
      "s390x":  ["shim-v2-go", "qemu", "kernel", "rootfs-image-confidential"]
    },
    "qemu-coco-dev-runtime-rs": {
-      "x86_64":  ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"],
-      "aarch64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential", "ovmf"],
-      "s390x":   ["shim-v2-rust", "qemu", "kernel", "rootfs-image-confidential"]
+      "x86_64":  ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension"],
+      "aarch64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension", "ovmf"],
+      "s390x":   ["shim-v2-rust", "qemu", "kernel", "rootfs-image", "rootfs-image-coco-extension"]
    },
    "clh": {
      "x86_64":  ["shim-v2-go", "cloud-hypervisor", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
--- a/tools/packaging/static-build/shim-v2/build.sh
+++ b/tools/packaging/static-build/shim-v2/build.sh
@@ -42,30 +42,51 @@ esac
 [[ "${CROSS_BUILD}" == "true" ]] && container_image_bk="${container_image}" && container_image="${container_image}-cross-build"

 # Variants (targets) that build a measured rootfs as of now are:
-# - rootfs-image-confidential
+# - rootfs-image (the base image, measured; root hash labelled "base")
+# - rootfs-image-confidential (monolithic CoCo image, root hash "confidential")
+# - rootfs-image-coco-extension
 # - rootfs-image-nvidia-gpu
 # - rootfs-image-nvidia-gpu-confidential
 #
+# The CoCo configs come in two flavours during the transition to split images:
+# - runtime-rs (Rust) uses the split layout: the measured base image
+#   (@KERNELVERITYPARAMS@) plus the CoCo extension (@COCOVERITYPARAMS@).
+# - runtime (Go) still uses the monolithic confidential image, whose dm-verity
+#   hash is carried by @KERNELVERITYPARAMS@.
+# Because the two runtimes are built in separate `make` invocations, each gets
+# its own @KERNELVERITYPARAMS@ value (base hash for Rust, confidential hash for
+# Go).  The NVIDIA GPU verity params are shared by both runtimes.
+#
 # shellcheck disable=SC2154
 root_hash_dir="${repo_root_dir}/tools/packaging/kata-deploy/local-build/build"
-verity_variants=(
-	"confidential:KERNELVERITYPARAMS"
-	"nvidia-gpu:KERNELVERITYPARAMS_NV"
-	"nvidia-gpu-confidential:KERNELVERITYPARAMS_CONFIDENTIAL_NV"
-)
-for entry in "${verity_variants[@]}"; do
-	variant="${entry%%:*}"
-	param_var="${entry#*:}"
-	root_hash_file="${root_hash_dir}/root_hash_${variant}.txt"
-	[[ -f "${root_hash_file}" ]] || continue
+
+# read_verity_param <variant-label> <make-var-name>
+# Emits " VAR=value" if the matching root_hash_<variant>.txt exists, else nothing.
+read_verity_param() {
+	local variant="$1"
+	local param_var="$2"
+	local root_hash_file="${root_hash_dir}/root_hash_${variant}.txt"
+	[[ -f "${root_hash_file}" ]] || return 0

 	# root_hash_*.txt contains a single kernel_verity_params line.
+	local root_measure_config
 	IFS= read -r root_measure_config < "${root_hash_file}"
 	root_measure_config="${root_measure_config%$'\r'}"
 	[[ -n "${root_measure_config}" ]] || die "Empty kernel verity params in ${root_hash_file}"

-	EXTRA_OPTS+=" ${param_var}=${root_measure_config}"
-done
+	printf ' %s=%s' "${param_var}" "${root_measure_config}"
+}
+
+# Shared by both runtimes (NVIDIA GPU variants).
+EXTRA_OPTS+="$(read_verity_param "nvidia-gpu" "KERNELVERITYPARAMS_NV")"
+EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-confidential" "KERNELVERITYPARAMS_CONFIDENTIAL_NV")"
+
+# runtime-rs (Rust): split image -> base hash + CoCo extension hash.
+RUST_EXTRA_OPTS="$(read_verity_param "base" "KERNELVERITYPARAMS")"
+RUST_EXTRA_OPTS+="$(read_verity_param "coco-extension" "COCOVERITYPARAMS")"
+
+# runtime (Go): monolithic confidential image -> confidential hash.
+GO_EXTRA_OPTS="$(read_verity_param "confidential" "KERNELVERITYPARAMS")"

 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
@@ -95,7 +116,7 @@ case "${RUNTIME_CHOICE}" in
 			-w "${repo_root_dir}/src/runtime-rs" \
 			--user "$(id -u)":"$(id -g)" \
 			"${container_image}" \
-			bash -c "make clean-generated-files && make PREFIX=${PREFIX} QEMUCMD=qemu-system-${arch} ${EXTRA_OPTS}"
+			bash -c "make clean-generated-files && make PREFIX=${PREFIX} QEMUCMD=qemu-system-${arch} ${EXTRA_OPTS}${RUST_EXTRA_OPTS}"

 		docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
 			--env CROSS_BUILD="${CROSS_BUILD}" \
@@ -104,7 +125,7 @@ case "${RUNTIME_CHOICE}" in
 			-w "${repo_root_dir}/src/runtime-rs" \
 			--user "$(id -u)":"$(id -g)" \
 			"${container_image}" \
-			bash -c "make PREFIX='${PREFIX}' DESTDIR='${DESTDIR}' ${EXTRA_OPTS} install"
+			bash -c "make PREFIX='${PREFIX}' DESTDIR='${DESTDIR}' ${EXTRA_OPTS}${RUST_EXTRA_OPTS} install"
 		;;
 esac

@@ -117,14 +138,14 @@ case "${RUNTIME_CHOICE}" in
 			--user "$(id -u)":"$(id -g)" \
 			--env GOMODCACHE=/opt/.cache/gomod \
 			"${container_image}" \
-			bash -c "make clean-generated-files && make PREFIX=${PREFIX} QEMUCMD=qemu-system-${arch} ${EXTRA_OPTS}"
+			bash -c "make clean-generated-files && make PREFIX=${PREFIX} QEMUCMD=qemu-system-${arch} ${EXTRA_OPTS}${GO_EXTRA_OPTS}"

 		docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
 			-w "${repo_root_dir}/src/runtime" \
 			--user "$(id -u)":"$(id -g)" \
 			--env GOMODCACHE=/opt/.cache/gomod \
 			"${container_image}" \
-			bash -c "make PREFIX='${PREFIX}' DESTDIR='${DESTDIR}' ${EXTRA_OPTS} install"
+			bash -c "make PREFIX='${PREFIX}' DESTDIR='${DESTDIR}' ${EXTRA_OPTS}${GO_EXTRA_OPTS} install"
 		;;
 esac