Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2026-07-01
12:47:06 gibi tkajinam: not yet. Does that need extra kernel args? I only added kvm_amd.sev=1 yet
12:48:27 gibi I'm running kernel 6.12, libvirt 12.4 qemu 10.1
12:48:38 tkajinam you also need to explicitly enable sev-es and sev-snp too
12:48:45 tkajinam in the kvm_amd module
12:48:47 gibi OK
12:48:50 gibi thanks
12:50:32 gibi hm I checked wrongly I do see all three enabled
12:50:36 gibi [root@amd-milan-08 ~]# for f in /sys/module/kvm_amd/parameters/sev* ; do echo $f ; cat $f ; done
12:50:40 gibi /sys/module/kvm_amd/parameters/sev
12:50:42 gibi Y
12:50:45 gibi /sys/module/kvm_amd/parameters/sev_es
12:50:47 gibi Y
12:50:50 gibi /sys/module/kvm_amd/parameters/sev_snp
12:50:52 gibi Y
12:51:22 tkajinam ok so firmware and host os are both configured properly :-)
12:52:45 gibi now running devstack with a 128 core CPU is not fun as we default a lot of worker counts to the cpu count and having 128 keyston-api, nova-conductor etc does not make mysql happy :)
12:53:01 gibi but I will get there :)
13:03:22 opendevreview Takashi Kajinami proposed openstack/nova master: Remove unused method for image v1 API https://review.opendev.org/c/openstack/nova/+/995532
13:04:36 Uggla elodilles, I have reviewed the "release" patches. I think I have done all, let me know if I miss one.
13:10:13 elodilles Uggla: yepp, you've reviewed all the nova related release patches as far as i see. thanks for that :)
13:10:31 Uggla elodilles 👍
13:11:01 elodilles let me review the last one (nova stable releases with CVE fix)
13:39:44 opendevreview Bence Romsics proposed openstack/nova master: Suppress error in cleanup of pre live migration https://review.opendev.org/c/openstack/nova/+/982085
13:39:44 opendevreview Bence Romsics proposed openstack/nova master: Functional reproducer for #2051685 https://review.opendev.org/c/openstack/nova/+/977331
14:47:34 opendevreview Merged openstack/nova master: Rename vtpm job and add mtty support for vgpu test https://review.opendev.org/c/openstack/nova/+/922140
14:59:09 opendevreview ribaudr proposed openstack/nova master: Set instance to ERROR on unshelve NoValidHost failure https://review.opendev.org/c/openstack/nova/+/995701
14:59:09 opendevreview ribaudr proposed openstack/nova master: Add reproducer for bug #2071376: unshelve NoValidHost silent failure https://review.opendev.org/c/openstack/nova/+/995700
15:08:10 Uggla Reminder: upstream triage in ~20mn
15:09:22 Uggla Link: https://meet.google.com/zjr-rxus-hzj
17:20:23 opendevreview Takashi Kajinami proposed openstack/nova master: Remove unused UpdateGlanceImage https://review.opendev.org/c/openstack/nova/+/995726
18:51:27 gibi tkajinam: I think sev is broken on master (not related to your change, not applied yet). I think we changed something recently that forces two image_meta.properties check during spawn and the second one does not work on the real image_meta and therefore does not see the uefi hw_firmware_type
18:51:32 gibi I will file a bug
18:58:23 gibi https://bugs.launchpad.net/nova/+bug/2158927
19:02:13 gibi hm maybe this is an edge case on using cpu_models=custom
19:05:29 gibi yepp it is with host-passthrough I can move forward but still it is a bug
19:17:55 gibi OK I was able to boot a SEV VM, and I was able to reproduce that SEV-ES fails if SEV-SNP is enabled in the BIOS, qemu rejects it with
19:17:58 gibi 2026-07-01T19:04:41.224661Z qemu-kvm: -accel kvm: sev_launch_start: LAUNCH_START ret=1 fw_error=21 'Feature not supported'
19:18:01 gibi 2026-07-01T19:04:41.224703Z qemu-kvm: -accel kvm: sev_common_kvm_init: failed to create encryption context
19:18:04 gibi 2026-07-01T19:04:41.252619Z qemu-kvm: -accel kvm: failed to initialize kvm: Operation not permitted
19:18:07 gibi 2026-07-01 19:04:41.323+0000: shutting down, reason=failed
19:18:42 gibi I will apply you patches tomorrow..
#openstack-nova - 2026-07-02
00:27:02 tkajinam gibi, thanks for the information !
02:08:58 opendevreview Rafael Weingartner proposed openstack/nova master: Add logs for PCI passthrough device selection https://review.opendev.org/c/openstack/nova/+/915361
05:58:58 opendevreview ChungWon Lee proposed openstack/nova stable/2025.1: Add regression test for bug #2134375 https://review.opendev.org/c/openstack/nova/+/991837
06:00:54 opendevreview ChungWon Lee proposed openstack/nova stable/2025.1: Fix port remain while error on update port with multi network https://review.opendev.org/c/openstack/nova/+/991838
07:07:36 opendevreview Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581
07:17:24 opendevreview Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106
08:57:56 gibi Jul 02 04:54:32 amd-milan-08.khw.eng.rdu2.dc.redhat.com nova-compute[601561]: INFO nova.virt.libvirt.host [None req-1f3be882-c232-4040-99ad-1d1ed0169b60 None None] AMD SEV-SNP support detected
09:32:09 gibi tkajinam: I was able to boot a SNP guest \o/
09:32:33 gibi I see the guest kernel reporting that the feature is active but I dont see the /dev/sev_guest dev
09:32:38 gibi Linux vm4 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
09:32:38 gibi details are in root@vm4:~# uname -a
09:32:43 gibi sorry
09:33:03 gibi I mean details are in https://paste.openstack.org/show/byGj4shLtRQ4PfEhM0oq/
09:33:23 gibi I also left a comment in the series about a missing error handling in the API I noticed during the testing
09:34:17 gibi If you need me to check out / test specific things on my side with the series and my HW let me know I have the HW still today and tomorrow. (and I can probably get it back later for another run)
09:35:49 opendevreview Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760
10:02:26 tkajinam gibi, can you check dev/sev-guest in guest, instead ?
10:02:52 tkajinam I vaguely remember the device path was renamed at some point
10:03:05 tkajinam gibi, and thanks a lot for that testing !!!
10:06:03 tkajinam as you wrote in the note the SEV-SNP flag is detected there so it should be ok
10:06:58 tkajinam I probably have to check where that "<value>sev-snp</value>" line in the log comes from
10:09:26 opendevreview Luca Miccini proposed openstack/nova master: Fix encrypted volume migration/evacuation cross-project failure https://review.opendev.org/c/openstack/nova/+/995792
10:13:12 tkajinam I guess I found the problem and that's something I copied from a different place
10:14:01 tkajinam I will look into it later
11:23:11 opendevreview Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803
11:42:04 gibi root@vm4:~#
11:42:04 gibi root@vm4:~# ls -alh /dev | grep -i sev
11:42:08 gibi tkajinam: so no luck
11:43:48 tkajinam hmm
11:43:55 tkajinam you might have to load the module manually by sudo modprobe sev-guest
11:45:30 gibi maybe that ubuntu 24.04 is old
11:45:42 gibi I will get some newer guest images...
11:53:35 opendevreview Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809
11:53:35 opendevreview Lajos Katona proposed openstack/nova master: libvirt: Add test for MTU overwrite during live migration https://review.opendev.org/c/openstack/nova/+/995803
11:57:13 gibi tkajinam: yepp, ubuntu 26.10 has the device driver
11:57:18 gibi [ 2.930482] SEV: APIC: wakeup_secondary_cpu() replaced with wakeup_cpu_via_vmgexit()
11:57:18 gibi [ 2.810467] SEV: Status: SEV SEV-ES SEV-SNP
11:57:18 gibi [ 2.808527] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP
11:57:18 gibi root@vm5:~# dmesg | grep -i sev
11:57:21 gibi [ 2.997522] SEV: Using SNP CPUID table, 33 entries present.
11:57:24 gibi [ 2.998473] SEV: SNP running at VMPL0.
11:57:26 gibi [ 3.873373] SEV: SNP guest platform devices initialized.
11:57:29 gibi [ 8.143499] systemd[1]: Detected confidential virtualization sev-snp.
11:57:31 gibi [ 9.710699] sev-guest sev-guest: Initialized SEV guest driver (using VMPCK0 communication key)
11:57:34 gibi [ 9.790649] kvm_amd: KVM is unsupported when running as an SEV guest
11:57:37 gibi root@vm5:~# ll /dev/sev-guest
11:57:39 gibi crw------- 1 root root 10, 263 Jul 2 11:54 /dev/sev-guest
11:57:42 gibi root@vm5:~#
12:04:23 tkajinam \o/
12:08:06 tkajinam you might want to try the snpguest tool in that guest to load attestation report.
12:10:32 tkajinam gibi, if you still have machine time available then could you also try direct kernel boot
12:10:35 tkajinam something like
12:10:58 tkajinam openstack image create kernel --file vmlinuz --disk-format raw
12:11:07 tkajinam openstack image create kernel --file initrd.img --disk-format raw
12:11:29 tkajinam openstack image set <image name> --property kernel_id =<kernel_image_id> --property=<ramdisk_image_id>
12:13:00 tkajinam you may need to grub these files from guest or if you use the same os for both host and guest then you can use the one in host
12:38:48 opendevreview Takashi Kajinami proposed openstack/nova master: Return 400 for incomplete image properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813
12:39:07 tkajinam ^^^ I wonder if there is any good place to implement tests for such behavior.
12:47:38 gibi tkajinam: sure I can try those

Earlier   Later