Makefile: support to build components for all platforms and amd

Makefile

@@ -4,6 +4,9 @@ ARCH ?= $(shell uname -m)
 DESTDIR ?= /usr/local/bin
 
 LIBC ?= musl
+
+# TODO: delete `KBC` parameter once KBC related functionalities are
+# all deprecated in code.
 KBC ?=
 
 NO_RESOURCE_PROVIDER ?=
@@ -34,6 +37,22 @@ else ifeq ($(TEE_PLATFORM), snp)
   KBC = cc_kbc_snp
 else ifeq ($(TEE_PLATFORM), az-snp-vtpm)
   KBC = cc_kbc_az_snp_vtpm
+else ifeq ($(TEE_PLATFORM), all)
+  LIBC = gnu
+  KBC = cc_kbc_all_attesters
+  ifeq ($(NO_RESOURCE_PROVIDER), true)
+    RESOURCE_PROVIDER :=
+  else
+    RESOURCE_PROVIDER = sev,kbs
+  endif
+else ifeq ($(TEE_PLATFORM), amd)
+  LIBC = gnu
+  KBC = cc_kbc_snp,online_sev_kbc
+  ifeq ($(NO_RESOURCE_PROVIDER), true)
+    RESOURCE_PROVIDER :=
+  else
+    RESOURCE_PROVIDER = sev,kbs
+  endif
 endif
 # TODO: Add support for CCA and CSV
 

README.md

@@ -32,11 +32,13 @@ make install DESTDIR=/usr/local/bin
 
 The `TEE_PLATFORM` parameter can be
 - `none`: for tests with non-confidential guests
+- `all`: for all following platforms
 - `fs`: for platforms with encrypted root filesystems (i.e. s390x)
 - `tdx`: for Intel TDX
 - `az-tdx-vtpm`: for Intel TDX with Azure vTPM
 - `sev`: for AMD SEV(-ES)
 - `snp`: for AMD SEV-SNP
+- `amd`: for both AMD SEV(-ES) and AMD SEV-SNP
 - `az-snp-vtpm`: for AMD SEV-SNP with Azure vTPM
 
 by default, `kbs`/`sev` as a resource provider will be built in Confidential Data Hub. If you do not want enable any

confidential-data-hub/hub/Cargo.toml

@@ -13,6 +13,7 @@ required-features = ["bin"]
 [dependencies]
 anyhow = { workspace = true, optional = true }
 async-trait.workspace = true
+attestation_agent = { path = "../../attestation-agent/lib", default-features = false, optional = true }
 base64.workspace = true
 clap = { workspace = true, features = [ "derive" ], optional = true }
 env_logger = { workspace = true, optional = true }
@@ -43,7 +44,7 @@ aliyun = ["image/aliyun", "secret/aliyun"]
 kbs = ["image/kbs", "kms/kbs", "secret/kbs"]
 
 # support sev to provide confidential resources
-sev = ["image/sev", "kms/sev", "dep:sev", "secret/sev"]
+sev = ["attestation_agent", "image/sev", "kms/sev", "dep:sev", "secret/sev"]
 
 # support eHSM stacks (KMS, ...)
 ehsm = ["image/ehsm", "secret/ehsm"]

confidential-data-hub/hub/src/auth/mod.rs

@@ -15,7 +15,16 @@ impl Hub {
     pub(crate) async fn init(&mut self) -> Result<()> {
         #[cfg(feature = "sev")]
         {
-            Self::init_sev().await?;
+            use log::{info, warn};
+            match attestation_agent::aa_kbc_params::get_params().await {
+                Ok(aa_kbc_params) => {
+                    if aa_kbc_params.kbc() == "online_sev_kbc" {
+                        info!("online_sev_kbc used. Start to initialize sev.");
+                        Self::init_sev().await?;
+                    }
+                }
+                Err(e) => warn!("Get `aa_kbc_params` failed. Skip initialize sev. {e:?}"),
+            };
         }
 
         #[cfg(feature = "kbs")]