| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-20 | |||
| 16:23:53 | bauzas | I've seen good news | |
| 16:24:27 | tkajinam | the remaining sev-snp patches lust landed so sev-snp support was completed | |
| 16:24:33 | tkajinam | \o/ | |
| 16:24:40 | gibi | \o/ | |
| 16:24:44 | tkajinam | I just noticed that https://blueprints.launchpad.net/nova/+spec/amd-sev-snp-libvirt-support is not yet approved. can someone do so ? | |
| 16:24:54 | tkajinam | then I'd update its implementation status | |
| 16:25:24 | gibi | done | |
| 16:25:27 | antia | I suppose the same for https://blueprints.launchpad.net/nova/+spec/intel-tdx-libvirt-support | |
| 16:26:31 | tkajinam | because these changes were merged tdx needs another rebase but I think we are now fully ready to start it. | |
| 16:26:31 | antia | anyway I ended up with PTO last week so not much on TDX side | |
| 16:26:38 | gibi | antia: fixed the bp for that too | |
| 16:26:48 | antia | gibi: thanks! | |
| 16:27:08 | gibi | I will grab a TDX hardware this week (hopefully) | |
| 16:27:22 | antia | started with some catch up with SNP and rebased with master, noticed some changes to the test structure which results in errors for me | |
| 16:27:29 | antia | I suspect it’s because the exists mock that was dropped in https://review.opendev.org/c/openstack/nova/+/994343/18/nova/tests/fixtures/libvirt.py | |
| 16:27:36 | antia | Since this is the error "Exception: This test invokes builtins.open on /sys/module/kvm_intel/parameters/tdx. It is bad, you should mock it." | |
| 16:28:00 | antia | gibi: Cool! Will get you something to test :) | |
| 16:29:17 | antia | In the end the sys fs check is not needed for TDX since Libvirt does it anyway so the easy fix is probably to drop it, but mostly curious if it was solved in some other way for SEV | |
| 16:29:36 | gibi | antia, tkajinam re mock, yeah we should either mock open or have a different way to check the status | |
| 16:29:52 | gibi | tkajinam: did we fully removed the reliance on the kernel module parameter? | |
| 16:30:17 | gibi | if so, and that worked for SNP, I hope we can do the same for TDX as well | |
| 16:30:33 | tkajinam | gibi, no we have to rely on it for snp but we can drop it for tdx | |
| 16:30:49 | gibi | tkajinam: due to the ES/SNP CVE? | |
| 16:31:09 | tkajinam | no. due to libvirt not checking the flags for es and snp | |
| 16:31:19 | tkajinam | we could probably get rid of access to sev flag, though | |
| 16:31:42 | antia | I'll just drop it as part of the rebase and we should be good | |
| 16:31:46 | gibi | tkajinam: antia: so for TDX we could go with the domain capabilities route? | |
| 16:31:51 | tkajinam | I mean it only checks /sys/module/kvm_amd/parameters/sev and does not check /sys/module/kvm_amd/parameters/sev_es or /sys/module/kvm_amd/parameters/sev_snp | |
| 16:32:19 | tkajinam | gibi, yes, libvirt checks the tdx flag when it declares <tdx support='yes'/> | |
| 16:32:33 | antia | gibi: Yes exactly. Right now it does both the sys fs check and domain capabilities which is not needed | |
| 16:32:51 | gibi | cool then you can get rid of the problem by not relying on reading that file :) | |
| 16:33:15 | tkajinam | yeah using only domain capabilities simplifies the logic and tests largely | |
| 16:33:51 | antia | tried it before and tests were quite annoying to fix, but I think that has been fixed already so should be simple enough | |
| 16:34:20 | gibi | cool | |
| 16:35:03 | tkajinam | one question I got during reviewing the tdx series is whether we need to bump object version again for tdx or can reuse the existing version for snp assuming tdx would be merged this cycle | |
| 16:35:21 | tkajinam | I mean for snp we bumped ImageMeta object version due to hw_mem_encryption_model supporting new amd-sev-snp | |
| 16:35:46 | tkajinam | and I'm wondering if we should bump the version again when hw_mem_encryption_model supports new intel-tdx or we can handle it within the same version | |
| 16:36:45 | gibi | bump the version please | |
| 16:36:50 | gibi | object versions are cheap | |
| 16:36:56 | tkajinam | ok | |
| 16:37:01 | antia | either is fine with me | |
| 16:37:05 | antia | will bump it | |
| 16:37:07 | gibi | thanks | |
| 16:37:30 | tkajinam | quick conclusion :-) | |
| 16:37:44 | gibi | :) | |
| 16:37:50 | tkajinam | nothing else from my end. I reviewed tdx sceries and left a few comments there. | |
| 16:38:03 | antia | thanks for the review! | |
| 16:38:04 | tkajinam | antia, in case you need help to follow existing sev thing then feel free to ping me | |
| 16:38:16 | antia | will do :) | |
| 16:38:28 | gibi | I will keep myself in the loop :) | |
| 16:39:59 | gibi | we can move on | |
| 16:40:55 | tkajinam | yup | |
| 16:42:05 | gibi | bauzas: are you still with us? | |
| 16:43:10 | gibi | OK I'm taking over :) | |
| 16:43:15 | bauzas | sorry back | |
| 16:43:22 | bauzas | #topic Bug scrubbing | |
| 16:43:24 | bauzas | #topic Bug scrubbing | |
| 16:43:40 | bauzas | I haven't looked at the numbers tbh | |
| 16:43:45 | bauzas | moving on so ? | |
| 16:43:52 | bauzas | #topic Open discussion | |
| 16:43:58 | bauzas | anything ? | |
| 16:44:18 | gibi | - | |
| 16:44:23 | tkajinam | a quick one | |
| 16:44:55 | tkajinam | while working on sev-snp work I found several potential cleanups in current libvirt driver code (mainly due to remaining checks for old versions which are non longer supported) | |
| 16:45:03 | tkajinam | https://review.opendev.org/q/hashtag:%22libvirt-cleanups%22+(status:open%20OR%20status:merged) | |
| 16:45:19 | tkajinam | I'll capture these in this hash tag so if you have spare time I appreciate your review :-) | |
| 16:45:33 | gibi | good initiative | |
| 16:45:41 | tkajinam | I think we managed to drop number of unnecessary logics as part of snp work :-) | |
| 16:45:59 | gibi | everything that delete codes worth the review time | |
| 16:46:17 | tkajinam | less code, better life | |
| 16:47:15 | tkajinam | there is also removal of vcpu_pin_set which drops large amount of code just fyi (though I find it a bit complicated for review) | |
| 16:47:16 | tkajinam | https://review.opendev.org/c/openstack/nova/+/996016 | |
| 16:47:21 | tkajinam | that's all from me for today ! | |
| 16:47:42 | gibi | :) | |
| 16:48:00 | gibi | (maybe we need a couple of sprints just to fix bugs and land cleanups) | |
| 16:48:00 | gmaan | one review request, enforce_scope releasenotes and one cleanup need 2nd core to check those | |
| 16:48:02 | gmaan | #link https://review.opendev.org/q/hashtag:%22remove-enforce-scope-flag%22+hashtag:%22nova%22status:open | |
| 16:48:27 | gibi | gmaan: I will check it out now | |
| 16:49:01 | gmaan | thanks | |
| 16:49:42 | bauzas | cool, closing now the meeting, thanks all | |
| 16:49:45 | bauzas | #endmeeting | |
| 16:49:45 | opendevmeet | Meeting ended Mon Jul 20 16:49:45 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | |
| 16:49:45 | opendevmeet | Minutes: https://meetings.opendev.org/meetings/nova/2026/nova.2026-07-20-16.00.html | |
| 16:49:45 | opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/nova/2026/nova.2026-07-20-16.00.txt | |
| 16:49:45 | opendevmeet | Log: https://meetings.opendev.org/meetings/nova/2026/nova.2026-07-20-16.00.log.html | |
| 16:49:51 | antia | thanks | |
| 16:49:52 | gibi | bauzas: thanks | |
| 16:50:10 | elodilles | thanks o/ | |
| 16:50:27 | tkajinam | thank you | |
| 16:51:19 | melwitt | has anyone else noticed in devstack nova-compute no longer logs config options setting when it starts up? | |
| 16:52:50 | dansmith | is that an oslo.service change, perhaps related to the eventlet stuff? | |
| 16:53:51 | melwitt | yeah I'm guessing it has something to do with the change to threading, somehow | |
| 16:56:02 | tkajinam | hmm that's wired | |
| 16:56:25 | tkajinam | for threading we use cotyledon and cotyledon has similar debug logs triggered by log_options opt | |
| 16:59:37 | gmaan | only functional change between oslo.service 4.6.0 and 4.7.0(new one in u-c) is this which is just periodic tasks change https://review.opendev.org/c/openstack/oslo.service/+/982418 | |
| 17:09:09 | melwitt | yeah I dunno, picking a tempest-integrated-compute job from one of the enforce_scope patches I see the lack of conf options logging https://zuul.opendev.org/t/openstack/build/f4cc4f17dd414959b5d04cbfddffe410/log/controller/logs/screen-n-cpu.txt | |
| 17:19:14 | tkajinam | it's wired we see the expected debug logs in nova-scheduler on the other hand | |
| 17:19:31 | tkajinam | maybe nova-compute uses a different service launching method (but I don't feel so now) | |
| 17:19:34 | tkajinam | regarding the file access for sev detection it seems although libvirt reads /sys/module/kvm_amd/parameters/sev it does not use that value when it determines sev elements in capabilities .. we have to fix it along with the missing check for sev_es/snp later | |
| 17:20:30 | tkajinam | for now we should be ok as long as we keep the current file accesses for snp | |