| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-09-10 | |||
| 11:24:47 | sean-k-mooney | but a whitebox style tempest plugin for sev would be fine | |
| 11:24:53 | sean-k-mooney | or add it to whitebox | |
| 11:25:04 | artom | sean-k-mooney, unrelated, but we had some discussion around saving the new NUMA topology in https://review.opendev.org/#/c/634606/75/nova/compute/manager.py@7223 - and in func tests at least, that instance.refresh() isn't necessary (yes, the tests check the InstanceNUMATopology) | |
| 11:25:21 | gmann | aspiers: It will be QA ecosystem. it can be done via tempest plugin or separate testing framework like extreme-testing( which never got progress ). but it will be separate project under QA with separate team. | |
| 11:25:34 | artom | sean-k-mooney, I'll try to get to the office later this morning, to see what's up with my machine, would you have the bandwidth to play around with that in the meantime in your env? | |
| 11:26:16 | sean-k-mooney | artom: since this is aparently our highest priority i can make time | |
| 11:26:23 | sean-k-mooney | what exactly do you want me to test | |
| 11:26:35 | sean-k-mooney | remove the instace.refresh | |
| 11:26:46 | artom | sean-k-mooney, I did that already in the latest patchset | |
| 11:27:02 | artom | Making sure that the new instance NUMA topology is saved in the DB | |
| 11:27:08 | sean-k-mooney | and check both the db and virsh to confrim that the state is updated correctly? | |
| 11:27:13 | sean-k-mooney | ok | |
| 11:27:29 | sean-k-mooney | ya ill do that now | |
| 11:27:41 | artom | Thank you (for the ∞'s time) | |
| 11:27:43 | artom | :) | |
| 11:28:26 | aspiers | sean-k-mooney: BTW lscpu on the guest does not mention sev at all | |
| 11:28:50 | sean-k-mooney | as i said before i have exposed the servers im using for testing via port forwarding so if you continue to have issue then you can ssh into them | |
| 11:29:12 | sean-k-mooney | aspiers: is there anything in dmidecode/dmesg to indicate sev | |
| 11:29:30 | sean-k-mooney | i though the guest had to set bit 48 to 1 to enable the encryption | |
| 11:29:36 | sean-k-mooney | for pointers | |
| 11:30:32 | aspiers | sean-k-mooney: http://paste.openstack.org/show/774681/ | |
| 11:30:36 | aspiers | doesn't even look right | |
| 11:31:45 | artom | sean-k-mooney, IIRC when I tried connecting last time I couldn't - but yeah, what's the connection info again? | |
| 11:32:09 | sean-k-mooney | https://events.linuxfoundation.org/wp-content/uploads/2017/12/Extending-Secure-Encrypted-Virtualization-with-SEV-ES-Thomas-Lendacky-AMD.pdf looking at slide 12 we might be able to check it via the gurest msr | |
| 11:32:58 | sean-k-mooney | artom: i have two routter my isp one and my ubiquity one. my isp router firwall was blocking it so i truned it off and it started working | |
| 11:33:14 | aspiers | sean-k-mooney: I will ask the experts | |
| 11:34:42 | artom | sean-k-mooney, sure, but I still don't have the IP/FQDN in my bash history for some reason | |
| 11:35:06 | sean-k-mooney | artom: ya i know im looking it up in mine/my router config | |
| 11:41:27 | kashyap | aspiers: Randomly chiming in, but there is an MSR for SEV: https://www.kernel.org/doc/html/latest/x86/amd-memory-encryption.html | |
| 11:41:40 | kashyap | aspiers: And it's reported via `cpuid` | |
| 11:41:47 | kashyap | "Support for SME and SEV can be determined through the CPUID instruction. The CPUID function 0x8000001f reports information related to SME:" | |
| 11:41:59 | kashyap | And: | |
| 11:42:05 | kashyap | "If SEV is supported, MSR 0xc0010131 (MSR_AMD64_SEV) can be used to determine if SEV is active: [...]" | |
| 11:42:16 | aspiers | Yeah, I've already used that in the past | |
| 11:42:49 | kashyap | Ah, then disregard me. | |
| 11:42:57 | aspiers | No, the reminder is appreciated | |
| 11:43:39 | kashyap | aspiers: Your goal is to check if the instance (in the upstream CI) booted has indeed with SEV, yeah? | |
| 11:43:44 | aspiers | right | |
| 11:44:02 | aspiers | I guess the JeOS image will need to include cpuid | |
| 11:44:32 | kashyap | Isn't the JeOS (Just Enough OS, I presume) CirrOS in this case? | |
| 11:44:55 | aspiers | It's whatever tempest is configured with | |
| 11:45:07 | kashyap | (Nod) | |
| 11:47:13 | sean-k-mooney | aspiers: has one of the upstream ci provered provided you with a lable that will run on SEV hardware | |
| 11:47:41 | sean-k-mooney | aspiers: because 90% of the upstream ci cloud are proably runing intel x86_64 | |
| 11:47:57 | sean-k-mooney | although rackspace did run power for a while | |
| 11:48:19 | aspiers | sean-k-mooney: SUSE has our own SEV boxes which can run 3rd party CI | |
| 11:48:42 | sean-k-mooney | ah so its for the suse thrid party ci not for upstream | |
| 11:48:55 | aspiers | well if upstream has SEV hardware then great, but I was not expecting that any time soon | |
| 11:49:10 | sean-k-mooney | aspiers: i dont think it currely does | |
| 11:49:17 | sean-k-mooney | or at least not in a way you can target | |
| 11:49:49 | sean-k-mooney | im sure some of the clould proably have at least a small amd eypc inventory if for nothing else but there own internal validation | |
| 11:50:50 | aspiers | yeah | |
| 12:00:03 | donnyd | sean-k-mooney: have the numa jobs been running? | |
| 12:02:57 | donnyd | I saw last night it was having some inbound ssh timeout issues. | |
| 12:04:09 | sean-k-mooney | i have not checked this morning but i think clarkb kicked off a job around 4/5 am so ill see if that passed | |
| 12:04:51 | sean-k-mooney | donnyd: so that one failed at 04:54 | |
| 12:05:01 | sean-k-mooney | donnyd: was that after your l3 agent restart | |
| 12:05:22 | donnyd | i didn't restart till well after you were talking about it on infra last night | |
| 12:06:31 | sean-k-mooney | donnyd: ya looking at the infra scroll back clarkb kicked that off after you did the restart | |
| 12:06:35 | openstackgerrit | Chris Dent proposed openstack/os-resource-classes master: Update api-ref link to canonical location https://review.opendev.org/681235 | |
| 12:06:46 | donnyd | oh yea i see | |
| 12:07:31 | donnyd | It really just makes no sense though | |
| 12:07:42 | donnyd | all the rest of the labels seem to work without issue | |
| 12:07:57 | donnyd | mostly without issue... not anymore than any other provider at least | |
| 12:09:54 | openstackgerrit | Chris Dent proposed openstack/os-traits master: Update README to be a bit more clear https://review.opendev.org/681237 | |
| 12:09:57 | donnyd | So the old label we have setup for numa, does that still work? | |
| 12:10:07 | donnyd | I haven't set it back on my end | |
| 12:12:44 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Shrink the race window in confirm resize func test https://review.opendev.org/681238 | |
| 12:25:02 | kashyap | aspiers: Is there a way to detect from _inside_ the guest that it has indeed booted with SEV? | |
| 12:25:20 | kashyap | aspiers: (From the host, we can use the CPUID bit or other ways) | |
| 12:26:51 | kashyap | aspiers: Meanwhile, I learnt that if SEV isn't provided by the host, an SEV-enabled kernel should fail to boot. | |
| 12:27:38 | openstackgerrit | Alexandra Settle proposed openstack/nova master: Fixing broken links https://review.opendev.org/681206 | |
| 12:29:31 | openstackgerrit | Chris Dent proposed openstack/os-traits master: Update README to be a bit more clear https://review.opendev.org/681237 | |
| 12:30:13 | gibi | efried, aspiers: Is there anything I can do regarding the SEV series? | |
| 12:30:15 | stephenfin | aspiers: Random question: why can we not add the iommu attribute for all those device types? | |
| 12:30:30 | stephenfin | gibi: I'm reviewing the last patch now. Think you've already hit it though | |
| 12:30:36 | stephenfin | by which I mean the first one | |
| 12:30:41 | stephenfin | since the other two are +2 | |
| 12:30:49 | stephenfin | +W | |
| 12:30:51 | gibi | stephenfin: cool. Yeah I tried to find somebody how can look at the first | |
| 12:31:05 | gibi | but then it is in good hands now | |
| 12:33:40 | kashyap | aspiers: Also, when you're about, see my response to your comment: https://review.opendev.org/#/c/348394/10 | |
| 12:34:33 | kashyap | aspiers: If you can confirm that /usr/share/qemu/ovmf-x86_64-suse-code.bin is indeed the binary built with Secure Boot, then we can fix it | |
| 12:34:36 | luyao | Hi, everyone, I have a question, when an instance is in rebuild, how many allocations will it have? Both new and old ? | |
| 12:43:00 | brinzhang | efried: Could you please review this patch https://review.opendev.org/#/c/681151/, it changes the novalient version to 15.1.0, needed by https://review.opendev.org/#/c/673725/ | |
| 12:44:12 | stephenfin | aspiers: Is that follow-up for https://review.opendev.org/#/c/666616/ around yet? | |
| 12:47:35 | gibi | stephenfin: I did not find the followup either so I guess it isn't | |
| 12:58:43 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Apply SEV-specific guest config when SEV is required https://review.opendev.org/644565 | |
| 12:58:44 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Reject live migration and suspend on SEV guests https://review.opendev.org/680158 | |
| 12:58:44 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Enable booting of libvirt guests with AMD SEV memory encryption https://review.opendev.org/666616 | |
| 12:58:45 | openstackgerrit | Stephen Finucane proposed openstack/nova master: libvirt: Start reporting PCPU inventory to placement https://review.opendev.org/671793 | |
| 12:58:45 | openstackgerrit | Stephen Finucane proposed openstack/nova master: libvirt: '_get_(v|p)cpu_total' to '_get_(v|p)cpu_available' https://review.opendev.org/672693 | |
| 12:58:46 | openstackgerrit | Stephen Finucane proposed openstack/nova master: objects: Add 'InstanceNUMATopology.cpu_pinning' property https://review.opendev.org/680106 | |
| 12:58:46 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Validate CPU config options against running instances https://review.opendev.org/680107 | |
| 12:58:47 | openstackgerrit | Stephen Finucane proposed openstack/nova master: trivial: Use sane indent https://review.opendev.org/680229 | |
| 12:58:47 | openstackgerrit | Stephen Finucane proposed openstack/nova master: objects: Add 'NUMACell.pcpuset' field https://review.opendev.org/680108 | |
| 12:58:48 | openstackgerrit | Stephen Finucane proposed openstack/nova master: hardware: Differentiate between shared and dedicated CPUs https://review.opendev.org/671800 | |
| 12:58:48 | openstackgerrit | Stephen Finucane proposed openstack/nova master: libvirt: Start reporting 'HW_CPU_HYPERTHREADING' trait https://review.opendev.org/675571 | |
| 12:58:49 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Add support for translating CPU policy extra specs, image meta https://review.opendev.org/671801 | |
| 12:58:49 | openstackgerrit | Stephen Finucane proposed openstack/nova master: fakelibvirt: Make 'Connection.getHostname' unique https://review.opendev.org/681060 | |