| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-02 | |||
| 13:05:24 | gibi | tkajinam: I have the snpguest tool but not much I can do with it as far as I see ( I did not get the concepts from the github repo) | |
| 13:08:17 | tkajinam | snpguest report attestation-report.bin random-request-file.bin --random | |
| 13:08:27 | tkajinam | snpguest display report attestation-report.bin | |
| 13:09:05 | gibi | ahh thanks | |
| 13:09:32 | gibi | https://paste.openstack.org/show/bVsgOmG2ePXDOp4R8hpq/ | |
| 13:09:33 | tkajinam | if the command is correct then you see the report data generated by the secure processor within CPU | |
| 13:09:34 | gibi | it works | |
| 13:10:06 | gibi | those things I understand from the report seems valid | |
| 13:10:14 | tkajinam | This is the core mechanism to let guest owner to "attest" (verify integrity of) the guest | |
| 13:10:17 | tkajinam | yeah | |
| 13:10:20 | gibi | cool | |
| 13:10:36 | gibi | I will play with the direct kernel as well.. | |
| 13:13:19 | tkajinam | if you use direct kernel boot then the measurement should be changed. its expected value can be calculated from hashes of ovmf, kernel, ramdisk and kernel command line, but as long as you see the value is changed then you can assume things are working fine. | |
| 13:15:39 | gibi | OK cool | |
| 13:15:44 | gibi | thanks for the guidance | |
| 13:20:04 | tkajinam | gibi, thank you, too, for spending time for these tests :-) | |
| 13:51:57 | gibi | tkajinam: I failed to find the right incantation to boot the same ubuntu 26.10 as separate kernel and initrd then things that nova/glance accepts result is an earl boot failure of the guest. So I will skip this test now | |
| 14:27:38 | tkajinam | gibi, ok. do you see that the domain is launched ? | |
| 14:28:46 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:38:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:44:42 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:53:26 | gibi | tkajinam: yeah the domain runs from libvirt perspective just something with the initrd is broken | |
| 14:53:39 | gibi | [ 4.804941] systemd[1]: Started systemd-journald.service - Journal Service. | |
| 14:53:42 | gibi | [ 4.812890] Loading iSCSI transport class v2.0-870. | |
| 14:53:45 | gibi | [ 4.823372] iscsi: registered transport (tcp) | |
| 14:53:47 | gibi | [ 4.840250] iscsi: registered transport (qla4xxx) | |
| 14:53:50 | gibi | [ 4.845336] QLogic iSCSI HBA Driver | |
| 14:53:52 | gibi | Generating "/run/initramfs/rdsosreport.txt" | |
| 14:53:55 | gibi | Entering emergency mode. Exit the shell to continue. | |
| 14:53:57 | gibi | Type "journalctl" to view system logs. | |
| 14:54:00 | gibi | You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot | |
| 14:54:03 | gibi | after mounting them and attach it to a bug report. | |
| 14:54:59 | tkajinam | ok. you might need to add os_command_line property, too, though I think it's ok as long as domain boots because it indicates that ovmf actually supports measured boot using dkb | |
| 14:55:07 | tkajinam | do you see kernelHashes: yes in libvirt domain ,right ? | |
| 14:55:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | |
| 14:55:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:56:13 | gibi | <launchSecurity type='sev-snp' kernelHashes='yes' authorKey='no' vcek='yes'> | |
| 14:56:16 | gibi | yep | |
| 14:56:23 | tkajinam | nice | |
| 14:57:40 | gibi | I really like how attestation made easy via the device added to the guest. As far as I see intel TDX does not have that | |
| 14:57:57 | tkajinam | yeah | |
| 14:58:04 | tkajinam | TDX and SGX complicated it by qgs | |
| 14:58:15 | tkajinam | while in SNP it's fully handled within the hardware | |
| 14:59:48 | tkajinam | the mechanisms to validate integrity of attestation reports is much more complicated in TDX, than SNP | |
| 15:00:51 | tkajinam | that's one of the main reasons SNP is still popular in this area | |
| 15:35:27 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 15:35:27 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 15:38:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | |
| 15:39:24 | opendevreview | Takashi Kajinami proposed openstack/nova master: compute: Validate SEV/SEV-ES support at start up https://review.opendev.org/c/openstack/nova/+/994342 | |
| 15:39:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Detect AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/994764 | |
| 15:39:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | |
| 15:39:26 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | |
| 15:39:26 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | |
| 15:39:27 | opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | |
| 15:39:27 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | |
| 15:39:28 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | |
| 15:39:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 15:39:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | |
| 15:48:07 | opendevreview | Lajos Katona proposed openstack/nova master: Add regression test to repoduce bug 1854844 https://review.opendev.org/c/openstack/nova/+/991772 | |
| 15:48:07 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809 | |
| 15:48:08 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Preserve queue_size during live migration https://review.opendev.org/c/openstack/nova/+/995841 | |
| 15:59:08 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 15:59:09 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 17:49:52 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 17:50:41 | dansmith | gmaan: melwitt: This ^ security bug got publicized a bit earlier than intended, so if you could quickly have a look at that fix real quick I'd appreciate it :) | |
| 17:51:20 | gmaan | dansmith: checking | |
| 17:55:25 | gmaan | at least it is not yet on ML, it can be mark private again ? | |
| 17:58:37 | dansmith | gmaan: I guess it could, but the plan was to mark it public and push up a fix, not embargoed | |
| 17:59:00 | dansmith | it got marked public right away and I just had a few minutes to work up a fix is all :) | |
| 18:01:35 | gmaan | dansmith: ack, lgtm, but it need release notes alslo | |
| 18:02:22 | dansmith | gmaan: does it? | |
| 18:02:29 | dansmith | just because of the bug? | |
| 18:03:25 | gmaan | yeah mainly for bug, i mean it is still secure until they have valid console token but in case to make it aware that some potential issue is fixed in this change | |
| 18:03:31 | dansmith | I continue to argue that I don't understand the point of documenting every bug we fix a a reno when we also link the bugs, but serious bugs make sense.. not sure this qualifies just because it's security, but okay :) | |
| 18:05:31 | gmaan | honestly saying I do not see this a direct security as console access is still protected by token validation but still it provide a way to add host | |
| 18:06:18 | dansmith | gmaan: it's poisoning the CORS list and you can exhaust host memory by continuing to expand it, but agree, not super serious which is why I thought direct to public and a fix, no embargo | |
| 18:06:44 | dansmith | provides more opportunity for XSS/phishing attack | |
| 18:07:10 | gmaan | yeah, that is valid point | |
| 18:15:04 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 22:47:15 | opendevreview | Merged openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| #openstack-nova - 2026-07-03 | |||
| 07:21:34 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 09:56:20 | gibi | tkajinam: do I understand correctly that if you use stateless firmware (like in SNP) then you cannot reboot the VM from inside the guest? At least I see that the VM stops normally, printing that it will be rebooted but it never starts up. I assume it is connected to the statelessness of things but I can be mistaken | |
| 09:56:49 | gibi | this is the last thing visible in the guest | |
| 09:56:51 | gibi | [ 33.971858] reboot: Restarting system | |
| 10:00:13 | gibi | hm, qemu logs | |
| 10:00:14 | gibi | 2026-07-03T09:53:41.222388Z qemu-kvm: cpus are not resettable, terminating | |
| 10:07:04 | gibi | hm it is not the firmware it is SEV-ES / SNP that has this limitation | |
| 10:07:13 | gibi | I'm filing a bug to document it | |
| 10:13:23 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 10:13:36 | gibi | so it is just a qemu limitation that is being fixed | |
| 10:21:09 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 10:27:18 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:34:00 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:42:09 | ralonsoh | sean-k-mooney, hi! just if you didn't see the conversation in the neutron channel | |
| 10:42:21 | ralonsoh | I created https://bugs.launchpad.net/os-vif/+bug/2159024 | |
| 10:42:29 | ralonsoh | and pushed this: https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 11:21:55 | tkajinam | gibi, oh, thanks for that. I'll check that later | |
| 11:22:10 | sean-k-mooney | ralonsoh: i have not read it back yet but my clinet is there ill reply in the neutorn channel | |
| 11:22:11 | tkajinam | we likely need to block the operation properly at api layer instead of putting the instance in that hung state ... | |
| 11:28:42 | gibi | tkajinam: it does not hung, it stops cleanly. and can be started via the API | |