Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2026-07-01
18:51:27 gibi tkajinam: I think sev is broken on master (not related to your change, not applied yet). I think we changed something recently that forces two image_meta.properties check during spawn and the second one does not work on the real image_meta and therefore does not see the uefi hw_firmware_type
18:51:32 gibi I will file a bug
18:58:23 gibi https://bugs.launchpad.net/nova/+bug/2158927
19:02:13 gibi hm maybe this is an edge case on using cpu_models=custom
19:05:29 gibi yepp it is with host-passthrough I can move forward but still it is a bug
19:17:55 gibi OK I was able to boot a SEV VM, and I was able to reproduce that SEV-ES fails if SEV-SNP is enabled in the BIOS, qemu rejects it with
19:17:58 gibi 2026-07-01T19:04:41.224661Z qemu-kvm: -accel kvm: sev_launch_start: LAUNCH_START ret=1 fw_error=21 'Feature not supported'
19:18:01 gibi 2026-07-01T19:04:41.224703Z qemu-kvm: -accel kvm: sev_common_kvm_init: failed to create encryption context
19:18:04 gibi 2026-07-01T19:04:41.252619Z qemu-kvm: -accel kvm: failed to initialize kvm: Operation not permitted
19:18:07 gibi 2026-07-01 19:04:41.323+0000: shutting down, reason=failed
19:18:42 gibi I will apply you patches tomorrow..
#openstack-nova - 2026-07-02
00:27:02 tkajinam gibi, thanks for the information !
02:08:58 opendevreview Rafael Weingartner proposed openstack/nova master: Add logs for PCI passthrough device selection https://review.opendev.org/c/openstack/nova/+/915361
05:58:58 opendevreview ChungWon Lee proposed openstack/nova stable/2025.1: Add regression test for bug #2134375 https://review.opendev.org/c/openstack/nova/+/991837
06:00:54 opendevreview ChungWon Lee proposed openstack/nova stable/2025.1: Fix port remain while error on update port with multi network https://review.opendev.org/c/openstack/nova/+/991838
07:07:36 opendevreview Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581
07:17:24 opendevreview Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106
08:57:56 gibi Jul 02 04:54:32 amd-milan-08.khw.eng.rdu2.dc.redhat.com nova-compute[601561]: INFO nova.virt.libvirt.host [None req-1f3be882-c232-4040-99ad-1d1ed0169b60 None None] AMD SEV-SNP support detected
09:32:09 gibi tkajinam: I was able to boot a SNP guest \o/
09:32:33 gibi I see the guest kernel reporting that the feature is active but I dont see the /dev/sev_guest dev
09:32:38 gibi details are in root@vm4:~# uname -a
09:32:38 gibi Linux vm4 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
09:32:43 gibi sorry
09:33:03 gibi I mean details are in https://paste.openstack.org/show/byGj4shLtRQ4PfEhM0oq/
09:33:23 gibi I also left a comment in the series about a missing error handling in the API I noticed during the testing
09:34:17 gibi If you need me to check out / test specific things on my side with the series and my HW let me know I have the HW still today and tomorrow. (and I can probably get it back later for another run)
09:35:49 opendevreview Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760
10:02:26 tkajinam gibi, can you check dev/sev-guest in guest, instead ?
10:02:52 tkajinam I vaguely remember the device path was renamed at some point
10:03:05 tkajinam gibi, and thanks a lot for that testing !!!
10:06:03 tkajinam as you wrote in the note the SEV-SNP flag is detected there so it should be ok
10:06:58 tkajinam I probably have to check where that "<value>sev-snp</value>" line in the log comes from
10:09:26 opendevreview Luca Miccini proposed openstack/nova master: Fix encrypted volume migration/evacuation cross-project failure https://review.opendev.org/c/openstack/nova/+/995792
10:13:12 tkajinam I guess I found the problem and that's something I copied from a different place
10:14:01 tkajinam I will look into it later
11:23:11 opendevreview Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803
11:42:04 gibi root@vm4:~# ls -alh /dev | grep -i sev
11:42:04 gibi root@vm4:~#
11:42:08 gibi tkajinam: so no luck
11:43:48 tkajinam hmm
11:43:55 tkajinam you might have to load the module manually by sudo modprobe sev-guest
11:45:30 gibi maybe that ubuntu 24.04 is old
11:45:42 gibi I will get some newer guest images...
11:53:35 opendevreview Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803
11:53:35 opendevreview Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809
11:57:13 gibi tkajinam: yepp, ubuntu 26.10 has the device driver
11:57:18 gibi root@vm5:~# dmesg | grep -i sev
11:57:18 gibi [ 2.808527] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP
11:57:18 gibi [ 2.810467] SEV: Status: SEV SEV-ES SEV-SNP
11:57:18 gibi [ 2.930482] SEV: APIC: wakeup_secondary_cpu() replaced with wakeup_cpu_via_vmgexit()
11:57:21 gibi [ 2.997522] SEV: Using SNP CPUID table, 33 entries present.
11:57:24 gibi [ 2.998473] SEV: SNP running at VMPL0.
11:57:26 gibi [ 3.873373] SEV: SNP guest platform devices initialized.
11:57:29 gibi [ 8.143499] systemd[1]: Detected confidential virtualization sev-snp.
11:57:31 gibi [ 9.710699] sev-guest sev-guest: Initialized SEV guest driver (using VMPCK0 communication key)
11:57:34 gibi [ 9.790649] kvm_amd: KVM is unsupported when running as an SEV guest
11:57:37 gibi root@vm5:~# ll /dev/sev-guest
11:57:39 gibi crw------- 1 root root 10, 263 Jul 2 11:54 /dev/sev-guest
11:57:42 gibi root@vm5:~#
12:04:23 tkajinam \o/
12:08:06 tkajinam you might want to try the snpguest tool in that guest to load attestation report.
12:10:32 tkajinam gibi, if you still have machine time available then could you also try direct kernel boot
12:10:35 tkajinam something like
12:10:58 tkajinam openstack image create kernel --file vmlinuz --disk-format raw
12:11:07 tkajinam openstack image create kernel --file initrd.img --disk-format raw
12:11:29 tkajinam openstack image set <image name> --property kernel_id =<kernel_image_id> --property=<ramdisk_image_id>
12:13:00 tkajinam you may need to grub these files from guest or if you use the same os for both host and guest then you can use the one in host
12:38:48 opendevreview Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813
12:39:07 tkajinam ^^^ I wonder if there is any good place to implement tests for such behavior.
12:47:38 gibi tkajinam: sure I can try those
12:55:20 opendevreview Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760
13:02:25 opendevreview Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813
13:05:24 gibi tkajinam: I have the snpguest tool but not much I can do with it as far as I see ( I did not get the concepts from the github repo)
13:08:17 tkajinam snpguest report attestation-report.bin random-request-file.bin --random
13:08:27 tkajinam snpguest display report attestation-report.bin
13:09:05 gibi ahh thanks
13:09:32 gibi https://paste.openstack.org/show/bVsgOmG2ePXDOp4R8hpq/
13:09:33 tkajinam if the command is correct then you see the report data generated by the secure processor within CPU
13:09:34 gibi it works
13:10:06 gibi those things I understand from the report seems valid
13:10:14 tkajinam This is the core mechanism to let guest owner to "attest" (verify integrity of) the guest
13:10:17 tkajinam yeah
13:10:20 gibi cool
13:10:36 gibi I will play with the direct kernel as well..
13:13:19 tkajinam if you use direct kernel boot then the measurement should be changed. its expected value can be calculated from hashes of ovmf, kernel, ramdisk and kernel command line, but as long as you see the value is changed then you can assume things are working fine.
13:15:39 gibi OK cool
13:15:44 gibi thanks for the guidance
13:20:04 tkajinam gibi, thank you, too, for spending time for these tests :-)
13:51:57 gibi tkajinam: I failed to find the right incantation to boot the same ubuntu 26.10 as separate kernel and initrd then things that nova/glance accepts result is an earl boot failure of the guest. So I will skip this test now
14:27:38 tkajinam gibi, ok. do you see that the domain is launched ?
14:28:46 opendevreview Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813
14:38:11 opendevreview Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813
14:44:42 opendevreview Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813
14:53:26 gibi tkajinam: yeah the domain runs from libvirt perspective just something with the initrd is broken
14:53:39 gibi [ 4.804941] systemd[1]: Started systemd-journald.service - Journal Service.
14:53:42 gibi [ 4.812890] Loading iSCSI transport class v2.0-870.
14:53:45 gibi [ 4.823372] iscsi: registered transport (tcp)
14:53:47 gibi [ 4.840250] iscsi: registered transport (qla4xxx)
14:53:50 gibi [ 4.845336] QLogic iSCSI HBA Driver
14:53:52 gibi Generating "/run/initramfs/rdsosreport.txt"

Earlier   Later