| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-06 | |||
| 16:47:45 | sean-k-mooney | sev, sev-es and sev-snp | |
| 16:47:56 | sean-k-mooney | in the lauch security section it only has sev and sev-snp | |
| 16:48:00 | sean-k-mooney | not sev-es | |
| 16:48:13 | sean-k-mooney | so i think libvirt is correctly reporting that sev-es cant be used | |
| 16:48:31 | tkajinam | that's basically because they use same enum (sev) for sev and sev-es | |
| 16:48:41 | tkajinam | sev-snp is there because they introduced a different enum (for different scheme) | |
| 16:49:26 | sean-k-mooney | i see | |
| 16:49:34 | tkajinam | I agree it's not quite ideal and doesn't show full items we want to know | |
| 16:49:37 | sean-k-mooney | can we defer this and come back to it | |
| 16:49:44 | sean-k-mooney | i.e. next week | |
| 16:49:51 | sean-k-mooney | i really dont like this | |
| 16:50:00 | tkajinam | I at least add large TODO there and consider how we can improve libvirt to get rid of that hack | |
| 16:50:19 | sean-k-mooney | to be clear this hack is enouch to punt the feature until libvirt is fixed in my view | |
| 16:50:28 | sean-k-mooney | im trying to come aroudn to a diffent approch | |
| 16:50:36 | tkajinam | but if people can spend some time reviewing it and give some more feedback about this topic that would be appreciated | |
| 16:50:46 | sean-k-mooney | but i have been toold by nova cores to go fix libvirt for similar issue multipel times | |
| 16:51:07 | gibi | sean-k-mooney: I'm totally not OK punting a working feature just because we need self contained workaround for a libvirt / amd complication | |
| 16:51:17 | gibi | I'm OK to wait a week and reasses | |
| 16:51:29 | bauzas | tkajinam: as said I'll definitely review your series | |
| 16:51:44 | tkajinam | bauzas, thanks | |
| 16:52:14 | bauzas | and yeah we can revisit that next week | |
| 16:52:19 | Uggla | guys I think that's the conclusion for today. | |
| 16:52:31 | tkajinam | we also might need some discussion about how we implement the startup check but that would be less prioritized. the discussion can be found in the series so I appreciate any thoughts about it, too. | |
| 16:52:32 | bauzas | (at least personnally I'll appreciate it to have more context :D ) | |
| 16:52:35 | tkajinam | yup | |
| 16:53:37 | Uggla | thanks tkajinam, antia and gibi | |
| 16:53:59 | sean-k-mooney | tkajinam: i htink we need my change to add the new driver fuction or you need to do it in the libvirt drivers init host but sure we can disucss in gerrit | |
| 16:54:16 | Uggla | #topic Bug scrubbing | |
| 16:54:22 | Uggla | #info up to 91 (-3) | |
| 16:54:27 | Uggla | #link https://etherpad.opendev.org/p/nova-bug-triage-roster | |
| 16:54:33 | Uggla | #link https://truc.uggla.fr/ to follow the trend. | |
| 16:54:37 | tkajinam | sean-k-mooney, thanks. yeah I just opened your change and will check it soon. | |
| 16:54:44 | Uggla | Next meeting (this week): [public] Upstream bug triage. Wednesday, July 8th · 15:30 – 16:00 UTC. Video call link: meet.google.com/zjr-rxus-hzj | |
| 16:54:52 | Uggla | #topic Open discussion | |
| 16:55:01 | Uggla | Uggla: PTO next 3 weeks. gibi will host the meeting next week then bauzas will host the next 2 ones. | |
| 16:55:17 | gibi | yepp | |
| 16:55:20 | Uggla | something you'd like to quickly share in the lastest 5 mn | |
| 16:56:19 | gibi | - | |
| 16:56:41 | Uggla | if not I guess we are done for today. | |
| 16:56:48 | Uggla | Thanks for joining this meeting. Have a nice day/evening. | |
| 16:56:55 | Uggla | #endmeeting | |
| 16:56:55 | opendevmeet | Meeting ended Mon Jul 6 16:56:55 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | |
| 16:56:55 | opendevmeet | Minutes: https://meetings.opendev.org/meetings/nova/2026/nova.2026-07-06-16.00.html | |
| 16:56:55 | opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/nova/2026/nova.2026-07-06-16.00.txt | |
| 16:56:55 | opendevmeet | Log: https://meetings.opendev.org/meetings/nova/2026/nova.2026-07-06-16.00.log.html | |
| 16:56:55 | gibi | thanks folks | |
| 16:57:00 | tkajinam | thanks ! | |
| 16:57:05 | antia | thanks :) | |
| 17:06:48 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Detect AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/994764 | |
| 17:06:57 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | |
| 17:07:07 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | |
| 17:07:18 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | |
| 17:07:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | |
| 17:09:32 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | |
| 17:09:37 | opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | |
| 17:09:45 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 17:17:40 | opendevreview | Merged openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 18:30:43 | opendevreview | Takashi Kajinami proposed openstack/nova master: Fix wrong comment in test https://review.opendev.org/c/openstack/nova/+/996070 | |
| #openstack-nova - 2026-07-07 | |||
| 07:29:04 | gibi | tkajinam: I will try to collect as much printouts as possible form my HW today from both SNP enabled and SNP disabled in BIOS mode to see if we can settle the yesterdays debate somehwo | |
| 07:30:08 | bauzas | gibi: thanks that will help | |
| 07:30:48 | gibi | then I will have to give the HW back | |
| 07:30:58 | gibi | probably I can ask for it again later if needed | |
| 07:31:14 | bauzas | the issue is with the SNP support detection that said, as tkajinam said, atm we only be able to look at the /proc/cpuinfo file | |
| 07:31:15 | gibi | but I don't want to overstretch the kindness of the kernel folks :) | |
| 07:35:37 | bauzas | heh sure | |
| 07:36:01 | bauzas | gibi: I mean, if you can see how we can detect by libvirt whether we support SNP, it would be nice | |
| 07:36:51 | gibi | I think there is an extra complication about libvirt version which I cannot really test. I will have data from one specific libvirt version 12.5 | |
| 07:39:52 | gibi | I can try to get back to libvirt 11.10 but I cannot go back to 10.5 | |
| 07:47:36 | bauzas | ack thanks | |
| 08:00:06 | opendevreview | Kamil Sambor proposed openstack/nova master: Correct release name in concurrency_backend https://review.opendev.org/c/openstack/nova/+/996219 | |
| 08:32:19 | gibi | tkajinam, sean-k-mooney: here are data collected from my HW with SNP enabled and disabled in BIOS. https://drive.google.com/drive/folders/1U_wK6DRiPxKm98LJx3_BGH3VTEsPtFSU?usp=drive_link | |
| 08:33:30 | sean-k-mooney | i cannot downlowd those files | |
| 08:33:33 | gibi | the most useful thing seems to be /sys/module/kvm_amd/parameters/sev_snp as that switches to N when I disable the feature in BIOS | |
| 08:33:50 | sean-k-mooney | oh i might need to sign in | |
| 08:34:25 | gibi | I can open them in incognito | |
| 08:35:33 | sean-k-mooney | i had to down load the full set | |
| 08:35:38 | sean-k-mooney | but then i coudl open the zip | |
| 08:35:49 | sean-k-mooney | so <launchSecurity supported='yes'> | |
| 08:35:51 | sean-k-mooney | <enum name='sectype'> | |
| 08:35:53 | sean-k-mooney | <value>sev</value> | |
| 08:35:55 | sean-k-mooney | <value>sev-snp</value> | |
| 08:35:57 | sean-k-mooney | </enum> | |
| 08:35:59 | sean-k-mooney | </launchSecurity> | |
| 08:36:02 | sean-k-mooney | is till advertised in the non snp libvirt folder | |
| 08:36:14 | sean-k-mooney | so that with snp disabled in the bios? | |
| 08:36:55 | bauzas | that's the problem tkajinam mentioned yesterday | |
| 08:37:17 | bauzas | libvirt says "sure, do SNP" even if the BIOS option is disabled | |
| 08:37:38 | sean-k-mooney | right but that isnt something nova should be checking | |
| 08:37:44 | bauzas | maybe this is fixed in a later libvirt release tho | |
| 08:37:48 | sean-k-mooney | that shoudl be either a config option or soemthing libvirt tells us | |
| 08:38:24 | bauzas | would you be OK with a nova conf asking the operator to set it once the BIOS option is set ? | |
| 08:38:35 | sean-k-mooney | yes | |
| 08:38:54 | bauzas | and by default, saying no | |
| 08:39:08 | gibi | the non_snp folder is the one where I disable the snp in bios, yes | |
| 08:39:10 | sean-k-mooney | i woudl also be ok with it beign a comma seperate list of sev modes | |
| 08:39:25 | sean-k-mooney | sev_mdoes=sev,sev-snp | |
| 08:39:50 | sean-k-mooney | gibi: is there a reason you downgraded back to 11.10? | |
| 08:42:32 | sean-k-mooney | bauzas: the minimal change i woudl be ok with is not parsing and extracting all the cpu flags and then check if sev-snp is in it and instead jsut check for that one value. i.e. i dont like that we are adding self._cpu_flag and now have a thrid set of cpu flag in the libvirt driver | |
| 08:42:55 | sean-k-mooney | we are already mixing the cpu flags form virsh capablities and domcapablites which are not the saem | |
| 08:43:20 | sean-k-mooney | and parsing and storage all the raw cpu flags woudl add a third set that disagree with the other two | |