| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-02 | |||
| 09:32:38 | gibi | details are in root@vm4:~# uname -a | |
| 09:32:43 | gibi | sorry | |
| 09:33:03 | gibi | I mean details are in https://paste.openstack.org/show/byGj4shLtRQ4PfEhM0oq/ | |
| 09:33:23 | gibi | I also left a comment in the series about a missing error handling in the API I noticed during the testing | |
| 09:34:17 | gibi | If you need me to check out / test specific things on my side with the series and my HW let me know I have the HW still today and tomorrow. (and I can probably get it back later for another run) | |
| 09:35:49 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 10:02:26 | tkajinam | gibi, can you check dev/sev-guest in guest, instead ? | |
| 10:02:52 | tkajinam | I vaguely remember the device path was renamed at some point | |
| 10:03:05 | tkajinam | gibi, and thanks a lot for that testing !!! | |
| 10:06:03 | tkajinam | as you wrote in the note the SEV-SNP flag is detected there so it should be ok | |
| 10:06:58 | tkajinam | I probably have to check where that "<value>sev-snp</value>" line in the log comes from | |
| 10:09:26 | opendevreview | Luca Miccini proposed openstack/nova master: Fix encrypted volume migration/evacuation cross-project failure https://review.opendev.org/c/openstack/nova/+/995792 | |
| 10:13:12 | tkajinam | I guess I found the problem and that's something I copied from a different place | |
| 10:14:01 | tkajinam | I will look into it later | |
| 11:23:11 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803 | |
| 11:42:04 | gibi | root@vm4:~# | |
| 11:42:04 | gibi | root@vm4:~# ls -alh /dev | grep -i sev | |
| 11:42:08 | gibi | tkajinam: so no luck | |
| 11:43:48 | tkajinam | hmm | |
| 11:43:55 | tkajinam | you might have to load the module manually by sudo modprobe sev-guest | |
| 11:45:30 | gibi | maybe that ubuntu 24.04 is old | |
| 11:45:42 | gibi | I will get some newer guest images... | |
| 11:53:35 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809 | |
| 11:53:35 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803 | |
| 11:57:13 | gibi | tkajinam: yepp, ubuntu 26.10 has the device driver | |
| 11:57:18 | gibi | [ 2.930482] SEV: APIC: wakeup_secondary_cpu() replaced with wakeup_cpu_via_vmgexit() | |
| 11:57:18 | gibi | [ 2.810467] SEV: Status: SEV SEV-ES SEV-SNP | |
| 11:57:18 | gibi | [ 2.808527] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP | |
| 11:57:18 | gibi | root@vm5:~# dmesg | grep -i sev | |
| 11:57:21 | gibi | [ 2.997522] SEV: Using SNP CPUID table, 33 entries present. | |
| 11:57:24 | gibi | [ 2.998473] SEV: SNP running at VMPL0. | |
| 11:57:26 | gibi | [ 3.873373] SEV: SNP guest platform devices initialized. | |
| 11:57:29 | gibi | [ 8.143499] systemd[1]: Detected confidential virtualization sev-snp. | |
| 11:57:31 | gibi | [ 9.710699] sev-guest sev-guest: Initialized SEV guest driver (using VMPCK0 communication key) | |
| 11:57:34 | gibi | [ 9.790649] kvm_amd: KVM is unsupported when running as an SEV guest | |
| 11:57:37 | gibi | root@vm5:~# ll /dev/sev-guest | |
| 11:57:39 | gibi | crw------- 1 root root 10, 263 Jul 2 11:54 /dev/sev-guest | |
| 11:57:42 | gibi | root@vm5:~# | |
| 12:04:23 | tkajinam | \o/ | |
| 12:08:06 | tkajinam | you might want to try the snpguest tool in that guest to load attestation report. | |
| 12:10:32 | tkajinam | gibi, if you still have machine time available then could you also try direct kernel boot | |
| 12:10:35 | tkajinam | something like | |
| 12:10:58 | tkajinam | openstack image create kernel --file vmlinuz --disk-format raw | |
| 12:11:07 | tkajinam | openstack image create kernel --file initrd.img --disk-format raw | |
| 12:11:29 | tkajinam | openstack image set <image name> --property kernel_id =<kernel_image_id> --property=<ramdisk_image_id> | |
| 12:13:00 | tkajinam | you may need to grub these files from guest or if you use the same os for both host and guest then you can use the one in host | |
| 12:38:48 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 12:39:07 | tkajinam | ^^^ I wonder if there is any good place to implement tests for such behavior. | |
| 12:47:38 | gibi | tkajinam: sure I can try those | |
| 12:55:20 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 13:02:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 13:05:24 | gibi | tkajinam: I have the snpguest tool but not much I can do with it as far as I see ( I did not get the concepts from the github repo) | |
| 13:08:17 | tkajinam | snpguest report attestation-report.bin random-request-file.bin --random | |
| 13:08:27 | tkajinam | snpguest display report attestation-report.bin | |
| 13:09:05 | gibi | ahh thanks | |
| 13:09:32 | gibi | https://paste.openstack.org/show/bVsgOmG2ePXDOp4R8hpq/ | |
| 13:09:33 | tkajinam | if the command is correct then you see the report data generated by the secure processor within CPU | |
| 13:09:34 | gibi | it works | |
| 13:10:06 | gibi | those things I understand from the report seems valid | |
| 13:10:14 | tkajinam | This is the core mechanism to let guest owner to "attest" (verify integrity of) the guest | |
| 13:10:17 | tkajinam | yeah | |
| 13:10:20 | gibi | cool | |
| 13:10:36 | gibi | I will play with the direct kernel as well.. | |
| 13:13:19 | tkajinam | if you use direct kernel boot then the measurement should be changed. its expected value can be calculated from hashes of ovmf, kernel, ramdisk and kernel command line, but as long as you see the value is changed then you can assume things are working fine. | |
| 13:15:39 | gibi | OK cool | |
| 13:15:44 | gibi | thanks for the guidance | |
| 13:20:04 | tkajinam | gibi, thank you, too, for spending time for these tests :-) | |
| 13:51:57 | gibi | tkajinam: I failed to find the right incantation to boot the same ubuntu 26.10 as separate kernel and initrd then things that nova/glance accepts result is an earl boot failure of the guest. So I will skip this test now | |
| 14:27:38 | tkajinam | gibi, ok. do you see that the domain is launched ? | |
| 14:28:46 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:38:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:44:42 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:53:26 | gibi | tkajinam: yeah the domain runs from libvirt perspective just something with the initrd is broken | |
| 14:53:39 | gibi | [ 4.804941] systemd[1]: Started systemd-journald.service - Journal Service. | |
| 14:53:42 | gibi | [ 4.812890] Loading iSCSI transport class v2.0-870. | |
| 14:53:45 | gibi | [ 4.823372] iscsi: registered transport (tcp) | |
| 14:53:47 | gibi | [ 4.840250] iscsi: registered transport (qla4xxx) | |
| 14:53:50 | gibi | [ 4.845336] QLogic iSCSI HBA Driver | |
| 14:53:52 | gibi | Generating "/run/initramfs/rdsosreport.txt" | |
| 14:53:55 | gibi | Entering emergency mode. Exit the shell to continue. | |
| 14:53:57 | gibi | Type "journalctl" to view system logs. | |
| 14:54:00 | gibi | You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot | |
| 14:54:03 | gibi | after mounting them and attach it to a bug report. | |
| 14:54:59 | tkajinam | ok. you might need to add os_command_line property, too, though I think it's ok as long as domain boots because it indicates that ovmf actually supports measured boot using dkb | |
| 14:55:07 | tkajinam | do you see kernelHashes: yes in libvirt domain ,right ? | |
| 14:55:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | |
| 14:55:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:56:13 | gibi | <launchSecurity type='sev-snp' kernelHashes='yes' authorKey='no' vcek='yes'> | |
| 14:56:16 | gibi | yep | |
| 14:56:23 | tkajinam | nice | |
| 14:57:40 | gibi | I really like how attestation made easy via the device added to the guest. As far as I see intel TDX does not have that | |
| 14:57:57 | tkajinam | yeah | |
| 14:58:04 | tkajinam | TDX and SGX complicated it by qgs | |
| 14:58:15 | tkajinam | while in SNP it's fully handled within the hardware | |
| 14:59:48 | tkajinam | the mechanisms to validate integrity of attestation reports is much more complicated in TDX, than SNP | |
| 15:00:51 | tkajinam | that's one of the main reasons SNP is still popular in this area | |
| 15:35:27 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 15:35:27 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 15:38:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | |
| 15:39:24 | opendevreview | Takashi Kajinami proposed openstack/nova master: compute: Validate SEV/SEV-ES support at start up https://review.opendev.org/c/openstack/nova/+/994342 | |