Files
kata-containers/kernel
Penny Zheng 59dc61df5b kernel: Enable new LTS 5.4.3 on AArch64
Linux has embraced another LTS kernel version v5.4.x.
If we, AArch64, update stable guest kernel version
to v5.4.x, we could get rid of huge chunkes of backport
patches under patches/4.19.x/.
Except following configs are penny-defined turned on/off,
all the other are sort of `built-in` defined or inherited
from v4.19.x.
1. CONFIG_IO_URING = y
This option enables support for the io_uring interface.
2. CONFIG_RODATA_FULL_DEFAULT_ENABLED = n
Apply read-only attributes of VM areas to the linear
alias of the backing pages as well.
3. CONFIG_ARM64_TAGGED_ADDR_ABI = n
When this option is enabled, user applications can opt in to
a relaxed ABI allow virtual tagged addresses to be passed to
system calls as pointer arguments.
4. CONFIG_ARM64_PTR_AUTH = n
Pointer authentication provides instructions for signing and
authenticating pointers against secret keys, which can be used to
mitigate Return Oriented Programming (ROP) and other attacks.

Fixes: #882

Signed-off-by: Penny Zheng <penny.zheng@arm.com>
2019-12-16 17:41:07 +08:00
..
2019-09-13 21:03:12 +05:30

Build Kata Containers Kernel

This document explains the steps to build a kernel recommended for use with Kata Containers. To do this use build-kernel.sh, this script automates the process to build a kernel for Kata Containers.

Requirements

The build-kernel.sh script requires an installed Golang version matching the component build requirements.

Setup kernel source code

$ go get -d -u github.com/kata-containers/packaging
$ cd $GOPATH/src/github.com/kata-containers/packaging/kernel
$ ./build-kernel.sh setup

The script ./build-kernel.sh tries to apply the patches from ${GOPATH}/src/github.com/kata-containers/packaging/kernel/patches/ when it sets up a kernel. If you want to add a source modification, add a patch on this directory.

The script also adds a kernel config file from ${GOPATH}/src/github.com/kata-containers/packaging/kernel/configs/ to .config in the kernel source code. You can modify it as needed.

Build the kernel

After the kernel source code is ready, it is possible to build the kernel.

$ ./build-kernel.sh build

Install the Kernel in the default path for Kata

Kata Containers uses some default path to search a kernel to boot. To install on this path, the following command will install it to the default Kata containers path (/usr/share/kata-containers/).

$ ./build-kernel.sh install

Submit Kernel Changes

Kata Containers packaging repository holds the kernel configs and patches. The config and patches can work for many versions, but we only test the kernel version defined in the runtime versions file.

For further details, see the kernel configuration documentation.

How is it tested

The Kata Containers CI scripts install the kernel from CI cache job or build from sources.

If the kernel defined in the runtime versions file is built and cached with the latest kernel config and patches, it installs. Otherwise, the kernel is built from source.

The Kata kernel version is a mix of the kernel version defined in the runtime versions file and the file kata_config_version. This helps to identify if a kernel build has the latest recommend configuration.

Example:

# From https://github.com/kata-containers/runtime/blob/master/versions.yaml
$ kernel_version_in_versions_file=4.10.1
# From https://github.com/kata-containers/packaging/blob/master/kernel/kata_config_version
$ kata_config_version=25
$ latest_kernel_version=${kernel_version_in_versions_file}-${kata_config_version}

The resulting version is 4.10.1-25, this helps identify whether or not the kernel configs are up-to-date on a CI version.

Contribute

In order to do Kata Kernel changes. There are places to contribute:

  1. Kata runtime versions file: This file points to the recommended versions to be used by Kata. To update the kernel version send a pull request to update that version. The Kata CI will run all the use cases and verify it works.

  2. Kata packaging repository. This repository contains all the kernel configs and patches recommended for Kata Containers kernel:

  • If you want to upload one new configuration (new version or architecture specific) make sure the config file name has the following format:

    # Format:
    $ ${arch}_kata_${hypervisor_target}_${major_kernel_version}.x
    
    # example:
    $ arch=x86_64
    $ hypervisor_target=kvm
    $ major_kernel_version=4.19
    
    # Resulting file
    $ name: x86_64_kata_kvm_4.19.x
    
  • Kernel patches, the CI and packaging scripts will apply all patches in the patches directory.

Note: The kernel version and configuration file live in different locations, which could result in a circular dependency on your (runtime or packaging) PR. In this case, the PR you submit needs to be tested together with a patch from another Kata Containers repository. To do this you have to specify which repository and which pull request it depends on.