github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-10-21 11:58:41 +00:00
Code Issues Projects Releases Wiki Activity

versions: Track and build TDVF

Browse Source 
TDVF is the firmware used by QEMU to start TDX capable VMs.  Let's start
tracking it as it'll become part of the Confidential Containers sooner
or later.

TDVF lives in the public https://github.com/tianocore/edk2-staging repo
and we're using as its version tags that are consumed internally at
Intel.

Fixes: #4624

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio
2022-07-28 21:15:35 +02:00
parent e6a5a5106d
commit c9b5bde30b
4 changed files with 43 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
tools/packaging/static-build/ovmf/Dockerfile
View File

@@ -17,5 +17,6 @@ RUN apt-get update && \
nasm \
python \
python3 \
python3-distutils \
uuid-dev && \
apt-get clean && rm -rf /var/lib/lists/

32
tools/packaging/static-build/ovmf/build-ovmf.sh
View File

@@ -54,19 +54,41 @@ if [ "${ovmf_build}" == "sev" ]; then
fi
info "Building ovmf"
build -b "${build_target}" -t "${toolchain}" -a "${architecture}" -p "${ovmf_package}"
build_cmd="build -b ${build_target} -t ${toolchain} -a ${architecture} -p ${ovmf_package}"
if [ "${ovmf_build}" == "tdx" ]; then
build_cmd+=" -D DEBUG_ON_SERIAL_PORT=TRUE -D TDX_MEM_PARTIAL_ACCEPT=512 -D TDX_EMULATION_ENABLE=FALSE -D TDX_ACCEPT_PAGE_SIZE=2M"
fi
eval "${build_cmd}"
info "Done Building"
build_path="Build/${package_output_dir}/${build_target}_${toolchain}/FV/OVMF.fd"
stat "${build_path}"
build_path_target_toolchain="Build/${package_output_dir}/${build_target}_${toolchain}"
build_path_fv="${build_path_target_toolchain}/FV"
stat "${build_path_fv}/OVMF.fd"
if [ "${ovmf_build}" == "tdx" ]; then
build_path_arch="${build_path_target_toolchain}/X64"
stat "${build_path_fv}/OVMF_CODE.fd"
stat "${build_path_fv}/OVMF_VARS.fd"
stat "${build_path_arch}/DumpTdxEventLog.efi"
fi
#need to leave tmp dir
popd
info "Install fd to destdir"
mkdir -p "$DESTDIR/$PREFIX/share/ovmf"
cp $build_root/$ovmf_dir/"${build_path}" "$DESTDIR/$PREFIX/share/ovmf"
install_dir="${DESTDIR}/${PREFIX}/share/ovmf"
if [ "${ovmf_build}" == "tdx" ]; then
install_dir="$DESTDIR/$PREFIX/share/tdvf"
fi
mkdir -p "${install_dir}"
install $build_root/$ovmf_dir/"${build_path_fv}"/OVMF.fd "${install_dir}"
if [ "${ovmf_build}" == "tdx" ]; then
install $build_root/$ovmf_dir/"${build_path_fv}"/OVMF_CODE.fd ${install_dir}
install $build_root/$ovmf_dir/"${build_path_fv}"/OVMF_VARS.fd ${install_dir}
install $build_root/$ovmf_dir/"${build_path_arch}"/DumpTdxEventLog.efi ${install_dir}
fi
pushd $DESTDIR
tar -czvf "${ovmf_dir}-${ovmf_build}.tar.gz" "./$PREFIX"

10
tools/packaging/static-build/ovmf/build.sh
View File

@@ -25,7 +25,11 @@ ovmf_package="${ovmf_package:-}"
package_output_dir="${package_output_dir:-}"
if [ -z "$ovmf_repo" ]; then
ovmf_repo=$(get_from_kata_deps "externals.ovmf.url" "${kata_version}")
if [ "${ovmf_build}" == "tdx" ]; then
ovmf_repo=$(get_from_kata_deps "externals.ovmf.tdx.url" "${kata_version}")
else
ovmf_repo=$(get_from_kata_deps "externals.ovmf.url" "${kata_version}")
fi
fi
[ -n "$ovmf_repo" ] || die "failed to get ovmf repo"
@@ -38,6 +42,10 @@ elif [ "${ovmf_build}" == "sev" ]; then
[ -n "$ovmf_version" ] || ovmf_version=$(get_from_kata_deps "externals.ovmf.sev.version" "${kata_version}")
[ -n "$ovmf_package" ] || ovmf_package=$(get_from_kata_deps "externals.ovmf.sev.package" "${kata_version}")
[ -n "$package_output_dir" ] || package_output_dir=$(get_from_kata_deps "externals.ovmf.sev.package_output_dir" "${kata_version}")
elif [ "${ovmf_build}" == "tdx" ]; then
[ -n "$ovmf_version" ] || ovmf_version=$(get_from_kata_deps "externals.ovmf.tdx.version" "${kata_version}")
[ -n "$ovmf_package" ] || ovmf_package=$(get_from_kata_deps "externals.ovmf.tdx.package" "${kata_version}")
[ -n "$package_output_dir" ] || package_output_dir=$(get_from_kata_deps "externals.ovmf.tdx.package_output_dir" "${kata_version}")
fi
[ -n "$ovmf_version" ] || die "failed to get ovmf version or commit"