| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-07 | |||
| 08:55:41 | sean-k-mooney | bauzas: yes ^ | |
| 08:56:01 | sean-k-mooney | bauzas: if /sys/module/kvm_amd/parameters/sev_snp is Y we know we cant use ES | |
| 08:56:16 | bauzas | confirmed ? | |
| 08:56:28 | gibi | by looking at the /sys/module/kvm_amd/parameters/sev_snp if that is N, and sev_es is Y, then I can boot SEV ES VMs on the machine | |
| 08:56:45 | gibi | if both is yes then on SEV SNP can be booted | |
| 08:56:55 | gibi | *both is Y | |
| 08:57:00 | gibi | *both are Y | |
| 08:57:15 | sean-k-mooney | *then only | |
| 08:57:17 | bauzas | OK, and when SNP BIOS option is disabled, then /sys/module/kvm_amd/parameters/sev_snp is N ? | |
| 08:57:44 | bauzas | (with new firmware of course) | |
| 08:57:47 | gibi | /sys/module/kvm_amd/parameters/sev Y /sys/module/kvm_amd/parameters/sev_es Y /sys/module/kvm_amd/parameters/sev_snp N | |
| 08:57:59 | bauzas | perfect then | |
| 08:58:15 | gibi | all given with the kernel verson I run (6.12) | |
| 08:58:18 | bauzas | tkajinam: looks like we have an alternative | |
| 08:58:32 | bauzas | gibi: yeah, of course | |
| 08:58:35 | gibi | this is the firmware version microcode_ctl-20260210-1.el10.noarch | |
| 08:59:07 | sean-k-mooney | bauzas: well its not jsut an alternitive the curent patch that looks at /proc/cpuinfo is incorrect | |
| 08:59:40 | sean-k-mooney | bauzas: looking at the data that gibi collected sev_snp is alwasy in /proc/cpuinfo regardless fo the bios option | |
| 09:00:21 | sean-k-mooney | so we can check if the host could supprot snp by checking lauchsecuity for <value>sev-snp</value> | |
| 09:00:29 | sean-k-mooney | and we can check if its congiured ot use it | |
| 09:00:36 | sean-k-mooney | by checkign /sys/module/kvm_amd/parameters/sev_snp | |
| 09:01:24 | sean-k-mooney | so we would report snp support if an only if /sys/module/kvm_amd/parameters/sev_snp Y and launchsecuirt <value>sev-snp</value> | |
| 09:01:53 | sean-k-mooney | if /sys/module/kvm_amd/parameters/sev_snp Y we will not report es supprot | |
| 09:02:51 | bauzas | hah | |
| 09:03:20 | bauzas | I was thinking /proc/cpuinfo was correct, but if that's not, then yeah indeed this is even not an alternative | |
| 09:04:23 | sean-k-mooney | i think /proc/cpuinfo is basiclly checkign the cpuid bits and decoding them, indepently of the fireware state | |
| 09:05:09 | sean-k-mooney | so its baiclly sayign "this cpu implents this feature" not that you can use it at least in this kernle version | |
| 09:05:14 | gibi | (to be correct I haev | |
| 09:05:23 | gibi | (to be correct I have amd-ucode-firmware-20260624-24.el10.noarch | |
| 09:05:29 | gibi | that has the firmware | |
| 09:05:41 | gibi | SEV > than 1.37.23 has the fix | |
| 09:05:55 | gibi | and I'm running 1.58.1 based on dmestg | |
| 09:06:58 | gibi | > 10:39 < sean-k-mooney> gibi: is there a reason you downgraded back to 11.10? | I wanted to see if libvirt reporting changed between these versions | |
| 09:07:26 | sean-k-mooney | ack i just didn see a no snp 12.x data | |
| 09:07:30 | sean-k-mooney | i assume it didnt change | |
| 09:07:53 | sean-k-mooney | gibi: are you happy to summerise your finding and this conversation on the review? | |
| 09:08:54 | gibi | yepp I'm adding it | |
| 09:10:41 | bauzas | thanks | |
| 09:28:41 | gibi | summarized to https://review.opendev.org/c/openstack/nova/+/994343/12#message-58d4e2f443634207d5a35a5cefce1fbd31ede5b8 | |
| 09:54:53 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 12:20:56 | gibi | I'm returning the HW | |
| 12:38:16 | tkajinam | gibi sean-k-mooney bauzas , sorry I was out during the way and am catching up. I read the test result posted by gibi and I agree cpuinfo does not really working as expected (I picked it up from my old test logs but I might have misread it after a while). | |
| 12:38:36 | tkajinam | I'll update the implementation and also spec to reflect the change soon. | |
| 12:39:14 | sean-k-mooney | ack | |
| 12:40:03 | sean-k-mooney | i think form the data that gibi capatured we have all the info we need to proeprly simulate this in unit/fuctional tests | |
| 12:45:21 | gibi | tkajinam: thanks | |
| 12:45:47 | bauzas | tkajinam: thanks ! | |
| 12:52:55 | tkajinam | sean-k-mooney, yes | |
| 12:53:28 | tkajinam | sean-k-mooney, one question. do you want me to rebase the whole sev series on top of your change to push all startup checks into the libvirt driver ? | |
| 12:53:55 | tkajinam | sean-k-mooney, the question might be equivalent to whether you'll backport your fix to stable branches. | |
| 12:54:21 | tkajinam | the whole sev-snp series, I mean | |
| 12:55:45 | sean-k-mooney | am either that or put your new check in init_host in the driver and i can fix it in mine | |
| 12:55:58 | sean-k-mooney | but im hoping to backport my fixes so both oders wil work | |
| 12:56:56 | sean-k-mooney | tkajinam: so this function call in driver.init_host in the libvirt driver https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L924-L926 | |
| 12:57:15 | sean-k-mooney | is pulling all the instnaces form the db and backfilling the default for the image properties | |
| 12:57:44 | sean-k-mooney | so you could make https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L980-L997 return the list of instances | |
| 12:57:50 | sean-k-mooney | and hten use that ot do your check | |
| 12:57:59 | sean-k-mooney | but it woudl be cleaner ot rebase i think | |
| 12:58:30 | tkajinam | yeah I read your change and I think I now understand how the check should be implemented after that fix. | |
| 12:58:31 | sean-k-mooney | driver.init_host is called before we do the hostname validation and it really shoudl not have been loading the instance form the db like that | |
| 12:59:30 | tkajinam | I agree | |
| 13:03:36 | sean-k-mooney | i guess gibi or bauzas may have a prefernce but without https://github.com/openstack/nova/commit/2714c71d05e8501ddb3a8fc0c36f3406ef974072 those checks in the compute manager for self._validate_pinning_configuration(instances) and self._validate_vtpm_configuration(instances) were lazy loading the image propereis and flavor on every instance for every driver | |
| 13:04:07 | sean-k-mooney | so we need to backprot that at a mimim if we were to backport the sev check | |
| 13:04:32 | sean-k-mooney | but i woudl not like to backprot the sev check until we make it driver specirifc hostetly | |
| 13:04:54 | sean-k-mooney | we shoudl not be imposing that pelenty on the ironic driver ectra when it does not apply | |
| 13:05:41 | sean-k-mooney | that the whole premise behind https://review.opendev.org/c/openstack/nova/+/990552 | |
| 13:11:57 | bauzas | I don't honestly have a preference :) | |
| 14:43:41 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 14:43:41 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 14:47:55 | opendevreview | Joan Gilabert proposed openstack/nova master: Rename cyborg-tempest to cyborg-tempest-py3 https://review.opendev.org/c/openstack/nova/+/996297 | |
| 14:55:15 | opendevreview | Ghanshyam Maan proposed openstack/nova master: Task tracking mechanism for graceful shutdown https://review.opendev.org/c/openstack/nova/+/996299 | |
| 15:46:18 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | |
| 16:02:45 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Detect AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/994764 | |
| 16:02:50 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | |
| 16:03:00 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | |
| 16:03:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | |
| 16:03:23 | opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | |
| 16:11:34 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | |
| 16:11:41 | opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | |
| 16:16:49 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 16:31:25 | melwitt | gmaan: dunno if you have seen this but it seems like unit test test_cold_migration_dest_compute_graceful_shutdown has been failing intermittently https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_dc2/openstack/dc227da7383b4f62ab0731d251d86e2f/testr_results.html | |
| 16:32:07 | melwitt | https://opensearch.logs.openstack.org/_dashboards/app/data-explorer/discover?security_tenant=global#?_a=(discover:(columns:!(build_status,message,build_change,build_name),isDirty:!f,sort:!()),metadata:(indexPattern:'94869730-aea8-11ec-9e6a-83741af3fdcd',view:discover))&_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-30d,to:now))&_q=(filters:!(),query:(language:kuery,query:'message:%22in%20test_cold_migration_dest_compute | |
| 16:32:08 | melwitt | _graceful_shutdown%22')) | |
| 16:32:22 | melwitt | bah, sorry. link looked less long in my text box | |
| 16:43:45 | opendevreview | Takashi Kajinami proposed openstack/nova master: WIP: Use domain capabilities to detect SEV-SNP support by libvirt/QEMU https://review.opendev.org/c/openstack/nova/+/996316 | |
| 16:45:05 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | |
| 16:45:22 | opendevreview | Takashi Kajinami proposed openstack/nova master: compute: Validate SEV/SEV-ES support at start up https://review.opendev.org/c/openstack/nova/+/994342 | |
| 16:45:22 | opendevreview | Takashi Kajinami proposed openstack/nova master: Accept hw_firmware_stateless=True for BIOS firmware type https://review.opendev.org/c/openstack/nova/+/995835 | |
| 16:45:23 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Detect AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/994764 | |
| 16:45:23 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | |
| 16:45:42 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | |
| 16:45:56 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | |
| 16:46:04 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | |
| 16:46:24 | opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | |
| 16:46:33 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | |
| 16:46:44 | opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | |
| 16:46:53 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 16:47:02 | opendevreview | Takashi Kajinami proposed openstack/nova master: WIP: Use domain capabilities to detect SEV-SNP support by libvirt/QEMU https://review.opendev.org/c/openstack/nova/+/996316 | |
| 17:16:17 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 17:19:54 | opendevreview | Takashi Kajinami proposed openstack/nova master: ci: Remove GLANCE_STANDALONE https://review.opendev.org/c/openstack/nova/+/996322 | |