Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-07-29
08:32:12 brinzhang }
08:32:44 kashyap alex_xu: Thank you for ACKing, much appreciated.
08:33:40 tssurya brinzhang: no the server supports 2.75, we are trying to make the client support it as well
08:33:59 kashyap stephenfin: Hi, when you're about, can you please have a gander at this: https://review.opendev.org/#/c/670189/ (libvirt: harden Host.get_domain_capabilities())
08:34:22 kashyap stephenfin: Already has +2 from Alex. And it's useful for two features, one for SEV, the other for the Secure Boot thing
08:44:45 alex_xu kashyap: np
08:50:31 brinzhang tssurya: about https://review.opendev.org/#/c/645611/, replyed with comment.
09:44:35 aspiers kashyap: here
09:44:59 kashyap aspiers: Hi, go straight to my update in the Gerrit change.
09:45:07 kashyap aspiers: (Saves you time from reading IRC scrollback)
09:45:12 aspiers OK
09:46:46 aspiers kashyap: not sure if there's a question for me? looks like it's all clarified?
09:48:14 kashyap aspiers: Yeah, no more question. Was more of an FYI
09:48:28 aspiers kashyap: OK thanks. BTW I need your review on https://review.opendev.org/#/c/673151/ more than anyone else's :)
09:48:47 aspiers That ties to the scrollback I wrote on Sat
09:48:55 kashyap aspiers: Will do. First trying to write some code to parse getDomainCapabilities() for 'efi' bits :D
09:49:03 openstack bugzilla.redhat.com bug 1733940 in libvirt "getDomainCapabilities() does not report all available OVMF firmware binaries" [Unspecified,New] - Assigned to libvirt-maint
09:49:27 kashyap aspiers: What scrollback from Sat? I missed
09:49:48 aspiers http://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2019-07-27.log.html#t2019-07-27T18:15:17
09:50:40 kashyap aspiers: BTW, funnily enough, I have a "vested interest" to review that patch. Why?
09:51:10 kashyap aspiers: ... I too have a need for domain capabilities for 'q35' for Secure Boot
09:51:24 kashyap (Secure Boot for KVM/QEMU _mandates_ 'q35')
09:51:40 kashyap aspiers: I will get to this interesting patch today.
09:52:12 aspiers kashyap: Yeah, this is not a huge coincidence, since SEV mandates UEFI via OVMF
09:52:33 aspiers lack of UEFI is probably why my SEV guests are currently unresponsive
09:53:43 kashyap Ah, I see
09:53:58 kashyap aspiers: Aside, if you don't mind holding your nose: https://kashyapc.fedorapeople.org/Create-a-SecureBoot-enabled-VM.bash
09:54:07 aspiers although it does not require secure boot AFAIK
09:54:23 kashyap Right
09:54:32 aspiers are there docs for UEFI boot in nova?
09:54:41 kashyap Afraid, not much I guess
09:54:51 openstackgerrit Dongcan Ye proposed openstack/nova master: Fix wrong huge pages in doc https://review.opendev.org/673252
09:55:22 kashyap aspiers: Do you have a few more minutes to chat on a related topic?
09:55:32 aspiers yes
09:58:19 kashyap aspiers: So I need to parse that 'efi' bit on line-3: http://paste.openstack.org/show/755057/
09:59:08 kashyap aspiers: I'm searching through the SEV series, to 'Depend On' a patch that parses surrounding bits from getDomainCapabilities()
10:01:15 kashyap aspiers: Probably somewhere surrounding here? https://review.opendev.org/#/c/640483/3/nova/virt/libvirt/config.py
10:02:41 kashyap (After I add the config class LibvirtConfigDomainCapsFirmwareEFI() or something like that)
10:03:03 openstackgerrit Lee Yarwood proposed openstack/nova master: Use os-brick locking for volume attach and detach https://review.opendev.org/614190
10:03:50 aspiers kashyap: I don't think there is any unmerged patch you need to depend on
10:04:17 aspiers kashyap: that patch you linked was merged ages ago
10:04:17 kashyap aspiers: Yep, just realized
10:05:53 aspiers kashyap: well, maybe https://review.opendev.org/#/c/673151/3
10:06:01 aspiers which is the one I'm asking you to look at anyway :)
10:06:56 kashyap aspiers: Yeah, I have it open, and have half read the commit message, while I got 3 pings :D
10:07:04 aspiers hacking on nova feels a bit like wandering around a vast desert, and the experience of randomly bumping into someone else in the same vicinity is equally surprising
10:07:08 kashyap aspiers: Will spend time on it tooday, definitely
10:07:42 aspiers kashyap: just realised that maybe the subject of that commit is misleading
10:08:02 aspiers it's enhancing the parsing of *capabilities* not domain caps
10:08:34 aspiers the change regarding domain caps is that getDomCaps API gets called more often as a result (for the canonical machine types in addition to the default machine type for the arch)
10:09:34 kashyap aspiers: Hehe, mind you, we're in a mini desert in the "Cosmos of Nova" -- we're in HDD (Hypervisor Driver Desert)
10:09:37 aspiers If I change (only) a commit message and rebase the stuff on top, will Gerrit/Zuul re-run all the CI on an identical git tree?
10:09:48 aspiers true X-D
10:10:08 kashyap lyarwood: --^
10:10:31 kashyap aspiers: I _think_ rebase will re-run the entire world's CI :-( But I have a faint voice in the head saying: "that has changed"
10:11:01 aspiers I fear you might be right
10:11:34 aspiers kashyap: so are there *any* docs on how to do UEFI boot in nova?
10:11:51 aspiers kashyap: surely there must be another way to find out than reading merged gerrit patches
10:11:57 aspiers even the release note is useless
10:12:26 kashyap aspiers: Not that I know of. I don't think not even in the config help text I guess.
10:12:34 kashyap aspiers: Does this count? -- https://opendev.org/openstack/nova-specs/src/branch/master/specs/train/approved/allow-secure-boot-for-qemu-kvm-guests.rst
10:12:37 kashyap :D
10:12:57 kashyap The part in the "Problem description" can account for _some_ documentation. /me ducks
10:14:12 aspiers hah
10:14:38 aspiers for SEV, I felt that if I didn't include insanely comprehensive docs with the patches, I would have no chance of getting it accepted
10:14:51 aspiers maybe that was a misperception
10:14:57 aspiers but I don't regret writing them, of course
10:15:34 aspiers kashyap: BTW http://specs.openstack.org/openstack/nova-specs/specs/train/approved/allow-secure-boot-for-qemu-kvm-guests.html is a nicer rendering of the same
10:16:27 kashyap Ah, thank you
10:17:45 kashyap aspiers: On docs, don't worry -- if you've improved the 'void' (i.e. non-existent docs), then it definitely is worth accepting.
10:18:00 kashyap I don't guess anyone would have the gall to "not accept" those.
10:18:16 kashyap (Without a damn good reason)
10:18:22 openstackgerrit Brin Zhang proposed openstack/nova master: Add delete_on_termination to volume-attach API https://review.opendev.org/673133
10:19:12 aspiers kashyap: hah, I know you weren't doing this, but given the effort I spent on them, if anyone described the docs I've submitted as "they improved the void", that would feel like a slap in the face X-D
10:19:20 aspiers kashyap: check out https://review.opendev.org/#/c/666616/22/doc/source/admin/configuration/hypervisor-kvm.rst
10:19:42 aspiers and then press ']' twice for the other docs
10:19:59 kashyap aspiers: Yeah, sorry, as you guessed - I didn't target that at you at all. Was saying more in general
10:20:21 kashyap If anyone provides any docs that _improves_ the status quo, accept it, no ifs and buts.
10:20:45 kashyap aspiers: Oh, the ']' trick, I didn't know; thanks!
10:20:49 aspiers Well yeah, but if a new feature is submitted with sub-par docs, I'd argue that's *worsening* the docs
10:20:58 aspiers kashyap: press '?' for all shortcuts
10:21:19 aspiers they're almost all worth memorising
10:21:25 kashyap aspiers: Yeah, fugreed. BTW, excellent docs there, as usual: https://review.opendev.org/#/c/666616/22/doc/source/admin/configuration/hypervisor-kvm.rst
10:21:39 kashyap aspiers: I say not many developers have the discipline to write solid docs.
10:22:01 aspiers It's a shame. It's not the most fun thing to do, but damn is it satisfying once they're done
10:22:21 aspiers especially when all the subsequent questions you get can be answered with RTFM ;-)
10:22:47 kashyap Yes. Many many developers forget to realize that their "beautiful code" is not worth a damn if they don't spend a decent chunk of time describing the feature
10:23:12 kashyap Not a curt, crappy document. But a good one, that makes you feel "pain" when you write. And after some rounds of editing.
10:24:27 kashyap aspiers: BTW, I'll of course be writing a document for Sec Boot, collecting artefacts here: https://kashyapc.fedorapeople.org/Secure-Boot-for-KVM-QEMU-guests/
10:24:52 aspiers great
10:25:16 openstackgerrit Huachang Wang proposed openstack/nova-specs master: Use PCPU and VCPU in one instance https://review.opendev.org/668656
10:25:17 aspiers so, in the absence of TFM, please can you tell me how to configure UEFI boot?
10:25:44 aspiers even your SB spec problem description doesn't really cover it AFAICS
10:26:04 aspiers https://specs.openstack.org/openstack/nova-specs/specs/mitaka/implemented/boot-from-uefi.html sort of does
10:26:12 aspiers is hw_firmware_type=uefi enough?
10:26:59 aspiers oh I found it! https://docs.openstack.org/glance/pike/admin/troubleshooting.html#launch-instances-with-uefi
10:27:38 aspiers kashyap: unfortunately I am now being bitten by your decision not to +1 https://review.opendev.org/#/c/348394/, since I need this working on SLES 12 ...
10:29:22 aspiers I think it could have been a reasonable stop-gap solution
10:30:02 kashyap aspiers: Oh, speaking of which!
10:30:20 aspiers TBH I think it would still make sense to merge that, even at this late stage

Earlier   Later