In addition to per-set module images (kata-modules-mlx5.img,
kata-modules-ntfs.img), build a combined image containing all
module sets. This reduces the number of virtio-blk devices and
dm-mod.create kernel command line entries needed when a user
wants all available modules.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Add kernel config fragment for the NTFS3 filesystem driver as a
loadable module and register it in the orchestrator script so that
a kata-modules-ntfs.img disk image is produced alongside the MLNX
image in the same CI build.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Add config fragment, build script, and CI integration for building
Mellanox MLX5/InfiniBand kernel modules as a standalone disk image.
The orchestrator script (build-kernel-modules-images.sh) builds the
kernel with extra module config fragments, runs modules_install,
filters modules by subsystem into per-set staging trees, and
packages each into its own disk image using build-modules-volume.sh.
Since these modules are built within the Kata CI using the same
KBUILD_SIGN_PIN, they are signed and loadable on the official
released Kata kernel.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Allow deploying kernel modules images via the Helm chart. Users
specify a list of images with paths and optional verity params
in values.yaml. These are rendered as a ConfigMap, mounted into
the kata-deploy pod, and used to generate a TOML drop-in with
[[hypervisor.<name>.kernel_modules_images]] array of tables.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Add build-modules-volume.sh to package signed kernel modules
into a standalone ext4 disk image that can be attached to a
kata guest VM as a secondary block device.
This allows loading out-of-tree modules without modifying the
dm-verity measured rootfs. The rootfs image and its root hash
remain unchanged.
The script optionally supports dm-verity on the modules volume
itself (-V flag), providing defense-in-depth alongside kernel
module signing.
Security risks documented in the script header:
- Without dm-verity, the volume relies solely on kernel module
signing (CONFIG_MODULE_SIG_FORCE) for integrity.
- With dm-verity, the hash must be verified during attestation
to provide actual security benefit.
- Host-side file permissions on the volume image must prevent
unauthorized modification.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Remove CONFIG_MODULES, CONFIG_MODULE_UNLOAD, and CONFIG_MODULE_SIG
from the NVIDIA GPU config fragments (nvidia.x86_64.conf.in and
nvidia.arm64.conf.in) since these are now provided by the shared
common/modules/modules.conf and common/signing/module_signing.conf
fragments, which are always included for confidential builds.
NVIDIA GPU builds always use -x (confidential), so these options
were redundant. CONFIG_FW_LOADER is kept as it is specific to
GPU firmware loading needs.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
For confidential builds (-x), always include modules/modules.conf
(CONFIG_MODULES=y, CONFIG_MODULE_UNLOAD=y) and
signing/module_signing.conf (CONFIG_MODULE_SIG_FORCE=y, etc.).
This enables two important capabilities for confidential guests:
1. Loadable module support: allows out-of-tree kernel modules
to be loaded from separate modules volume images without
modifying the dm-verity measured rootfs.
2. Module signature enforcement: the kernel rejects any unsigned
or wrongly-signed module, maintaining the trust chain from
the attested kernel to loaded modules.
Previously, module signing was only included when KBUILD_SIGN_PIN
was set. For non-confidential builds, that behavior is preserved.
For confidential builds, module signing is now always enabled
since it is essential for the security model.
Security notes:
- CONFIG_MODULE_SIG_FORCE=y ensures the kernel rejects unsigned
modules, preventing arbitrary code execution in the guest.
- The signing key is generated during kernel build. Users need
this key (protected by KBUILD_SIGN_PIN) to sign out-of-tree
modules.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Add a new conditional kernel config fragment in a subdirectory
(following the pattern of signing/ and confidential_containers/)
so it is not auto-included by the common/*.conf wildcard:
- common/modules/modules.conf: Enables CONFIG_MODULES and
CONFIG_MODULE_UNLOAD for out-of-tree kernel module support.
This is required for loading user-compiled modules delivered
via separate modules volume images.
This fragment will be explicitly included by build-kernel.sh
for confidential builds.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
cleanup_and_fail() prints nothing to stdout and returns 1. The
callers used `return "$(cleanup_and_fail ...)"` which expands to
`return ""`, causing bash to error with "numeric argument required".
Replace the command substitution with a compound command that calls
the cleanup function and propagates its exit code via `$?`.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Add the nvidia driver version to the artefact cache keys so that
a driver bump triggers image and initrd rebuilds.
Also rename the helper functions to follow a consistent
get_latest_nvidia_* naming convention.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
Address shellcheck warnings including proper variable quoting,
use of [[ ]] over [ ], declaring and assigning variables separately,
and adding appropriate shellcheck disable directives where needed.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor
