| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-06 | |||
| 16:07:44 | fwiesel | I haven't gotten quite hold of the root cause yet | |
| 16:08:20 | fwiesel | Bear with me, i hope I'll get it fixed tomorrow | |
| 16:08:34 | fwiesel | That's from my side | |
| 16:08:37 | Uggla | fwiesel 👍 | |
| 16:09:04 | Uggla | thx | |
| 16:09:05 | sean-k-mooney | o/ | |
| 16:09:16 | Uggla | #topic Kamil's news about eventlet removal | |
| 16:10:13 | sambork | So today we almost landed changes that add a config option to run with eventlet/threading mode. As a segue from that, we should have data from the performance run with logs in the next few days. The first run indicates a probable degradation in the rally tests. Other than that, Ashish made progress with the unit testing patches (https://review.opendev.org/c/openstack/nova/+/992862, https://review.opendev.org/c/openstack/nova/+/992581, | |
| 16:10:13 | sambork | https://review.opendev.org/c/openstack/nova/+/988583, https://review.opendev.org/c/openstack/placement/+/993106) | |
| 16:11:23 | sambork | I think thats i,t we didn't progress with anything else, and I give mic back (or maybe gibi have something to add) | |
| 16:11:35 | gibi | I started looking at the functional test series from Ashish again today but I will need more time to have comments there | |
| 16:11:42 | gibi | nothing else | |
| 16:12:26 | Uggla | thanks sambork and gibi | |
| 16:12:41 | Uggla | skipping Layos topic | |
| 16:12:49 | Uggla | #topic Ironic review priorities | |
| 16:13:03 | Uggla | cardoe do you have something ot share with us ? | |
| 16:13:23 | cardoe | We've rebased the startup-time series at https://review.opendev.org/q/topic:%22startup-time%22 | |
| 16:14:02 | cardoe | The spec for trunk ports in the metadata is still ready to go as well as are the patches. | |
| 16:14:07 | cardoe | But that's all I've got. | |
| 16:14:24 | Uggla | thanks cardoe | |
| 16:14:51 | Uggla | #topic Confidential computing, status of SNP and TDX features | |
| 16:15:35 | Uggla | and gibi | |
| 16:15:57 | antia | Resuming development this week, was on PTO last week | |
| 16:16:14 | gibi | antia: welcome back :) | |
| 16:16:38 | tkajinam | The implementations for SEV-SNP are still up for review. gibi already provided review many feedbacks and also completed the end to end testing (thanks a lot !!) | |
| 16:17:11 | Uggla | 👍 | |
| 16:17:14 | gibi | yeah for me that series looks good | |
| 16:18:06 | tkajinam | gibi, just fyi. there is a problem pointed by sean in one of the base changes. I fixed it but I have to rebase the other changes later. | |
| 16:18:25 | bauzas | yeah I started to look at the series | |
| 16:18:37 | tkajinam | there are a few more feedbacks by sean-k-mooney I still have to check. I'm afraid it might be quite tricky to address these cleanly soon, and might need some more discussions to find out a good balance. | |
| 16:18:39 | bauzas | thanks tkajinam I'll continue to review then | |
| 16:18:47 | tkajinam | bauzas, thanks ! | |
| 16:19:13 | sean-k-mooney | tkajinam: libvirt has the snp cpaablity in domain caps | |
| 16:19:21 | sean-k-mooney | ill post an xml dump of that shortly | |
| 16:19:21 | gibi | tkajinam: ack, I can do a quick re-test tomorrow. But then I have to give the HW back | |
| 16:19:31 | tkajinam | sean-k-mooney, no it does not reflect actual cpu feature. | |
| 16:19:40 | tkajinam | sean-k-mooney, it only shows whether libvirt supports it. | |
| 16:19:53 | sean-k-mooney | ok but chekcing kernel option or proc is not ok | |
| 16:19:59 | tkajinam | we should detect snp is enabled in bios, then appears in cpu flag | |
| 16:20:02 | sean-k-mooney | so if we cant trust libvirt when it reports it | |
| 16:20:11 | sean-k-mooney | then 1 that is a bug that shoudl be fixed in libvirt | |
| 16:20:16 | sean-k-mooney | and 2 we woudl need a config option in nova | |
| 16:20:31 | sean-k-mooney | it repots | |
| 16:20:33 | sean-k-mooney | <launchSecurity supported='yes'> | |
| 16:20:35 | sean-k-mooney | <enum name='sectype'> | |
| 16:20:37 | sean-k-mooney | <value>sev</value> | |
| 16:20:39 | sean-k-mooney | <value>sev-snp</value> | |
| 16:20:41 | sean-k-mooney | </enum> | |
| 16:20:43 | sean-k-mooney | </launchSecurity> | |
| 16:20:50 | sean-k-mooney | <value>sev-snp</value> should not be there if the host is not configure for snp | |
| 16:21:24 | tkajinam | the tricky point is that we should catch the case that sev-snp is enabled in firmware, but is not in kernel/qemu/libvirt | |
| 16:21:38 | sean-k-mooney | not in nova | |
| 16:21:43 | tkajinam | because enabling sev-snp in firmware immediately prohibits sev-es | |
| 16:21:51 | sean-k-mooney | that is what libvirt is ment to be doing with that api | |
| 16:21:54 | tkajinam | but kernel still reports sev_es is available which is annoying | |
| 16:21:54 | gibi | (I like the CVE :) | |
| 16:22:10 | sean-k-mooney | sure but libvirt does not | |
| 16:22:20 | bauzas | fwiw we discussed that in the spec | |
| 16:22:26 | sean-k-mooney | well it reqport generic sev which i guess we might be proxiting | |
| 16:22:41 | sean-k-mooney | bauzas: we have rejected parsinc /proc before | |
| 16:22:46 | sean-k-mooney | so i dont knwo why we woudl allow it now | |
| 16:23:02 | bauzas | we said that the BIOS option is the difference between whether we support SNP or ES | |
| 16:23:26 | bauzas | so, if the operator modified the bios option, then the system supports SNP and that's it | |
| 16:23:49 | sean-k-mooney | ok so then nova does not need to check for this right | |
| 16:23:52 | bauzas | correct | |
| 16:24:03 | bauzas | that's what we agreed on the spec at least | |
| 16:24:28 | sean-k-mooney | so if livbirt has sev-snp in the lauch capabliteis | |
| 16:24:34 | sean-k-mooney | we should just report the trait | |
| 16:24:39 | bauzas | we don't need to look at the firmware, because even if the firmware can support SNP, the host won't use this until the BIOS is modified | |
| 16:24:45 | sean-k-mooney | and if the operator has not enabeld snp but did create snp flavors | |
| 16:24:52 | sean-k-mooney | then we expect the vm boot to fail | |
| 16:25:13 | gibi | it is about the fact the ES support disappears after that specific firmware upgrade and you can still have ES VMs on thehost | |
| 16:25:19 | bauzas | libvirt provides SNP capabilities only once the BIOS option is modified | |
| 16:25:35 | gibi | the complication is not about SNP, but the disappearence of ES | |
| 16:25:50 | sean-k-mooney | bauzas: ack in that case then we jsut need to look at the libvirt output | |
| 16:25:53 | bauzas | gibi: AFAICU, the ES support continues until the BIOS option is modified, that's my point | |
| 16:26:10 | bauzas | tkajinam: am I right? | |
| 16:26:16 | gibi | if you had a host with both ES and SNP enabled, and then update the firmware, ES disappears without BIOS changes | |
| 16:26:31 | gibi | * BIOS config changes | |
| 16:26:33 | bauzas | because you enabled SNP | |
| 16:26:34 | tkajinam | bauzas, the problem is that /proc/cpuinfo is only the feasible way I could find to detect "the BIOS option is modified" | |
| 16:26:42 | sean-k-mooney | well the sev section has | |
| 16:26:44 | sean-k-mooney | <sev supported='yes'> | |
| 16:26:46 | sean-k-mooney | <cbitpos>51</cbitpos> | |
| 16:26:47 | gibi | bauzas: because you updated the firmware to fix a CVE | |
| 16:26:48 | sean-k-mooney | <reducedPhysBits>1</reducedPhysBits> | |
| 16:26:50 | sean-k-mooney | <maxGuests>500</maxGuests> | |
| 16:26:52 | sean-k-mooney | <maxESGuests>9</maxESGuests> | |
| 16:26:54 | sean-k-mooney | <cpu0Id>LlF/9YPV8hnqsGNCBpLJeRUbm9y/yr5uNhgTaW96/ZVoYXjZRRuIfEwSMFWWd9882pcNDLW6LW3E3tytpU7/2g==</cpu0Id> | |
| 16:26:56 | sean-k-mooney | </sev> | |
| 16:26:59 | sean-k-mooney | the max es gust is still reproted in snp mode | |
| 16:27:17 | sean-k-mooney | but i think we need to look at the combidntion fo the lauchsecurit section and the sev section | |
| 16:27:18 | gibi | beacuse the same set of ASIDs are used for ES and SNP | |
| 16:27:33 | gibi | but a different set used for pure SEV | |
| 16:28:07 | gibi | btw that CVE fix is actually good for us as we don't have to share resources between ES and SNP | |
| 16:28:07 | bauzas | gibi: well, that's another concern, if the operator enabled SNP in the BIOS and then upgraded the firmware due to the CVE, they should know that ES is then disabled automatically | |
| 16:28:20 | gibi | bauzas: | |
| 16:28:37 | bauzas | that's unrelated to nova, right? | |
| 16:28:45 | gibi | but nova has ES VMs on the host :): | |
| 16:28:50 | gibi | so we cannot ignore it | |