| tkajinam | gibi, thanks for the information ! | 00:27 |
|---|---|---|
| opendevreview | Rafael Weingartner proposed openstack/nova master: Add logs for PCI passthrough device selection https://review.opendev.org/c/openstack/nova/+/915361 | 02:08 |
| opendevreview | ChungWon Lee proposed openstack/nova stable/2025.1: Add regression test for bug #2134375 https://review.opendev.org/c/openstack/nova/+/991837 | 05:58 |
| opendevreview | ChungWon Lee proposed openstack/nova stable/2025.1: Fix port remain while error on update port with multi network https://review.opendev.org/c/openstack/nova/+/991838 | 06:00 |
| opendevreview | Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581 | 07:07 |
| opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | 07:17 |
| *** ykarel_ is now known as ykarel | 07:53 | |
| gibi | Jul 02 04:54:32 amd-milan-08.khw.eng.rdu2.dc.redhat.com nova-compute[601561]: INFO nova.virt.libvirt.host [None req-1f3be882-c232-4040-99ad-1d1ed0169b60 None None] AMD SEV-SNP support detected | 08:57 |
| gibi | tkajinam: I was able to boot a SNP guest \o/ | 09:32 |
| gibi | I see the guest kernel reporting that the feature is active but I dont see the /dev/sev_guest dev | 09:32 |
| gibi | details are in root@vm4:~# uname -a | 09:32 |
| gibi | Linux vm4 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux | 09:32 |
| gibi | sorry | 09:32 |
| gibi | I mean details are in https://paste.openstack.org/show/byGj4shLtRQ4PfEhM0oq/ | 09:33 |
| gibi | I also left a comment in the series about a missing error handling in the API I noticed during the testing | 09:33 |
| gibi | If you need me to check out / test specific things on my side with the series and my HW let me know I have the HW still today and tomorrow. (and I can probably get it back later for another run) | 09:34 |
| opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | 09:35 |
| tkajinam | gibi, can you check dev/sev-guest in guest, instead ? | 10:02 |
| tkajinam | I vaguely remember the device path was renamed at some point | 10:02 |
| tkajinam | gibi, and thanks a lot for that testing !!! | 10:03 |
| tkajinam | as you wrote in the note the SEV-SNP flag is detected there so it should be ok | 10:06 |
| tkajinam | I probably have to check where that "<value>sev-snp</value>" line in the log comes from | 10:06 |
| opendevreview | Luca Miccini proposed openstack/nova master: Fix encrypted volume migration/evacuation cross-project failure https://review.opendev.org/c/openstack/nova/+/995792 | 10:09 |
| tkajinam | I guess I found the problem and that's something I copied from a different place | 10:13 |
| tkajinam | I will look into it later | 10:14 |
| opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803 | 11:23 |
| gibi | root@vm4:~# ls -alh /dev | grep -i sev | 11:42 |
| gibi | root@vm4:~# | 11:42 |
| gibi | tkajinam: so no luck | 11:42 |
| tkajinam | hmm | 11:43 |
| tkajinam | you might have to load the module manually by sudo modprobe sev-guest | 11:43 |
| gibi | maybe that ubuntu 24.04 is old | 11:45 |
| gibi | I will get some newer guest images... | 11:45 |
| opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803 | 11:53 |
| opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809 | 11:53 |
| gibi | tkajinam: yepp, ubuntu 26.10 has the device driver | 11:57 |
| gibi | root@vm5:~# dmesg | grep -i sev | 11:57 |
| gibi | [ 2.808527] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP | 11:57 |
| gibi | [ 2.810467] SEV: Status: SEV SEV-ES SEV-SNP | 11:57 |
| gibi | [ 2.930482] SEV: APIC: wakeup_secondary_cpu() replaced with wakeup_cpu_via_vmgexit() | 11:57 |
| gibi | [ 2.997522] SEV: Using SNP CPUID table, 33 entries present. | 11:57 |
| gibi | [ 2.998473] SEV: SNP running at VMPL0. | 11:57 |
| gibi | [ 3.873373] SEV: SNP guest platform devices initialized. | 11:57 |
| gibi | [ 8.143499] systemd[1]: Detected confidential virtualization sev-snp. | 11:57 |
| gibi | [ 9.710699] sev-guest sev-guest: Initialized SEV guest driver (using VMPCK0 communication key) | 11:57 |
| gibi | [ 9.790649] kvm_amd: KVM is unsupported when running as an SEV guest | 11:57 |
| gibi | root@vm5:~# ll /dev/sev-guest | 11:57 |
| gibi | crw------- 1 root root 10, 263 Jul 2 11:54 /dev/sev-guest | 11:57 |
| gibi | root@vm5:~# | 11:57 |
| tkajinam | \o/ | 12:04 |
| tkajinam | you might want to try the snpguest tool in that guest to load attestation report. | 12:08 |
| tkajinam | gibi, if you still have machine time available then could you also try direct kernel boot | 12:10 |
| tkajinam | something like | 12:10 |
| tkajinam | openstack image create kernel --file vmlinuz --disk-format raw | 12:10 |
| tkajinam | openstack image create kernel --file initrd.img --disk-format raw | 12:11 |
| tkajinam | openstack image set <image name> --property kernel_id =<kernel_image_id> --property=<ramdisk_image_id> | 12:11 |
| tkajinam | you may need to grub these files from guest or if you use the same os for both host and guest then you can use the one in host | 12:13 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | 12:38 |
| tkajinam | ^^^ I wonder if there is any good place to implement tests for such behavior. | 12:39 |
| gibi | tkajinam: sure I can try those | 12:47 |
| opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | 12:55 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | 13:02 |
| gibi | tkajinam: I have the snpguest tool but not much I can do with it as far as I see ( I did not get the concepts from the github repo) | 13:05 |
| tkajinam | snpguest report attestation-report.bin random-request-file.bin --random | 13:08 |
| tkajinam | snpguest display report attestation-report.bin | 13:08 |
| gibi | ahh thanks | 13:09 |
| gibi | https://paste.openstack.org/show/bVsgOmG2ePXDOp4R8hpq/ | 13:09 |
| tkajinam | if the command is correct then you see the report data generated by the secure processor within CPU | 13:09 |
| gibi | it works | 13:09 |
| gibi | those things I understand from the report seems valid | 13:10 |
| tkajinam | This is the core mechanism to let guest owner to "attest" (verify integrity of) the guest | 13:10 |
| tkajinam | yeah | 13:10 |
| gibi | cool | 13:10 |
| gibi | I will play with the direct kernel as well.. | 13:10 |
| tkajinam | if you use direct kernel boot then the measurement should be changed. its expected value can be calculated from hashes of ovmf, kernel, ramdisk and kernel command line, but as long as you see the value is changed then you can assume things are working fine. | 13:13 |
| gibi | OK cool | 13:15 |
| gibi | thanks for the guidance | 13:15 |
| tkajinam | gibi, thank you, too, for spending time for these tests :-) | 13:20 |
| gibi | tkajinam: I failed to find the right incantation to boot the same ubuntu 26.10 as separate kernel and initrd then things that nova/glance accepts result is an earl boot failure of the guest. So I will skip this test now | 13:51 |
| tkajinam | gibi, ok. do you see that the domain is launched ? | 14:27 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | 14:28 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | 14:38 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | 14:44 |
| gibi | tkajinam: yeah the domain runs from libvirt perspective just something with the initrd is broken | 14:53 |
| gibi | [ 4.804941] systemd[1]: Started systemd-journald.service - Journal Service. | 14:53 |
| gibi | [ 4.812890] Loading iSCSI transport class v2.0-870. | 14:53 |
| gibi | [ 4.823372] iscsi: registered transport (tcp) | 14:53 |
| gibi | [ 4.840250] iscsi: registered transport (qla4xxx) | 14:53 |
| gibi | [ 4.845336] QLogic iSCSI HBA Driver | 14:53 |
| gibi | Generating "/run/initramfs/rdsosreport.txt" | 14:53 |
| gibi | Entering emergency mode. Exit the shell to continue. | 14:53 |
| gibi | Type "journalctl" to view system logs. | 14:53 |
| gibi | You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot | 14:54 |
| gibi | after mounting them and attach it to a bug report. | 14:54 |
| tkajinam | ok. you might need to add os_command_line property, too, though I think it's ok as long as domain boots because it indicates that ovmf actually supports measured boot using dkb | 14:54 |
| tkajinam | do you see kernelHashes: yes in libvirt domain ,right ? | 14:55 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | 14:55 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | 14:55 |
| gibi | <launchSecurity type='sev-snp' kernelHashes='yes' authorKey='no' vcek='yes'> | 14:56 |
| gibi | yep | 14:56 |
| tkajinam | nice | 14:56 |
| gibi | I really like how attestation made easy via the device added to the guest. As far as I see intel TDX does not have that | 14:57 |
| tkajinam | yeah | 14:57 |
| tkajinam | TDX and SGX complicated it by qgs | 14:58 |
| tkajinam | while in SNP it's fully handled within the hardware | 14:58 |
| tkajinam | the mechanisms to validate integrity of attestation reports is much more complicated in TDX, than SNP | 14:59 |
| tkajinam | that's one of the main reasons SNP is still popular in this area | 15:00 |
| opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | 15:35 |
| opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | 15:35 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | 15:38 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: compute: Validate SEV/SEV-ES support at start up https://review.opendev.org/c/openstack/nova/+/994342 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Detect AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/994764 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | 15:39 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | 15:39 |
| opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809 | 15:48 |
| opendevreview | Lajos Katona proposed openstack/nova master: Add regression test to repoduce bug 1854844 https://review.opendev.org/c/openstack/nova/+/991772 | 15:48 |
| opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Preserve queue_size during live migration https://review.opendev.org/c/openstack/nova/+/995841 | 15:48 |
| opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | 15:59 |
| opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | 15:59 |
| opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | 17:49 |
| dansmith | gmaan: melwitt: This ^ security bug got publicized a bit earlier than intended, so if you could quickly have a look at that fix real quick I'd appreciate it :) | 17:50 |
| gmaan | dansmith: checking | 17:51 |
| gmaan | at least it is not yet on ML, it can be mark private again ? | 17:55 |
| dansmith | gmaan: I guess it could, but the plan was to mark it public and push up a fix, not embargoed | 17:58 |
| dansmith | it got marked public right away and I just had a few minutes to work up a fix is all :) | 17:59 |
| gmaan | dansmith: ack, lgtm, but it need release notes alslo | 18:01 |
| dansmith | gmaan: does it? | 18:02 |
| dansmith | just because of the bug? | 18:02 |
| gmaan | yeah mainly for bug, i mean it is still secure until they have valid console token but in case to make it aware that some potential issue is fixed in this change | 18:03 |
| dansmith | I continue to argue that I don't understand the point of documenting every bug we fix a a reno when we also link the bugs, but serious bugs make sense.. not sure this qualifies just because it's security, but okay :) | 18:03 |
| gmaan | honestly saying I do not see this a direct security as console access is still protected by token validation but still it provide a way to add host | 18:05 |
| dansmith | gmaan: it's poisoning the CORS list and you can exhaust host memory by continuing to expand it, but agree, not super serious which is why I thought direct to public and a fix, no embargo | 18:06 |
| dansmith | provides more opportunity for XSS/phishing attack | 18:06 |
| gmaan | yeah, that is valid point | 18:07 |
| opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | 18:15 |
| opendevreview | Merged openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | 22:47 |
| *** zseguin_ is now known as zseguin | 23:53 | |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!