)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"9a2d9428ea69a87691160ffae42f7c3b8b420757","unresolved":false,"context_lines":[{"line_number":11,"context_line":"SEV (Secure Encrypted Virtualization) technology:"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"    https://developer.amd.com/sev/"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: Id7581365941ad40762a4732c33d359cfa75089fa"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"3f79a3b5_6830a053","line":14,"updated":"2018-12-14 20:21:33.000000000","message":"You should have the blueprint linked in here, for example:\n\n Spec for blueprint amd-sev-libvirt-support","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":11,"context_line":"SEV (Secure Encrypted Virtualization) technology:"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"    https://developer.amd.com/sev/"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: Id7581365941ad40762a4732c33d359cfa75089fa"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"3f79a3b5_d7a94cdb","line":14,"in_reply_to":"3f79a3b5_6830a053","updated":"2018-12-15 01:16:49.000000000","message":"Done","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"}],"specs/stein/approved/amd-sev-libvirt-support.rst":[{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"ea67aaa9efb00b6fc97959798f4b210d0f37511b","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Use Cases"},{"line_number":40,"context_line":"---------"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"#. Booting an instance with a flavor containing an SEV-specific"},{"line_number":43,"context_line":"   `required trait extra spec"},{"line_number":44,"context_line":"   \u003chttps://docs.openstack.org/nova/latest/user/flavors.html#extra-specs-required-traits\u003e`_"},{"line_number":45,"context_line":"   will cause that instance to be defined and booted on a compute host"},{"line_number":46,"context_line":"   which provides that trait.  Additionally the instance must be"},{"line_number":47,"context_line":"   created with additional XML in the libvirt domain definition which"},{"line_number":48,"context_line":"   causes QEMU to boot the instance with SEV enabled."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed change"},{"line_number":51,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_c047011e","line":48,"range":{"start_line":42,"start_character":0,"end_line":48,"end_character":53},"updated":"2018-10-11 19:13:58.000000000","message":"Should probably be rephrased into the usual use case wording of \"as a X, I want Y because Z.\" Something like, \"as a cloud user, I would like to not have to trust my cloud operator with my secrets.\" What you wrote sounds more like the proposed change.","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"0eacc87ad45924ee8e840dc380ce40e083669d8f","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Use Cases"},{"line_number":40,"context_line":"---------"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"#. Booting an instance with a flavor containing an SEV-specific"},{"line_number":43,"context_line":"   `required trait extra spec"},{"line_number":44,"context_line":"   \u003chttps://docs.openstack.org/nova/latest/user/flavors.html#extra-specs-required-traits\u003e`_"},{"line_number":45,"context_line":"   will cause that instance to be defined and booted on a compute host"},{"line_number":46,"context_line":"   which provides that trait.  Additionally the instance must be"},{"line_number":47,"context_line":"   created with additional XML in the libvirt domain definition which"},{"line_number":48,"context_line":"   causes QEMU to boot the instance with SEV enabled."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed change"},{"line_number":51,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_8717db9d","line":48,"range":{"start_line":42,"start_character":0,"end_line":48,"end_character":53},"in_reply_to":"3f79a3b5_c047011e","updated":"2018-10-11 23:40:16.000000000","message":"Done","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"ea67aaa9efb00b6fc97959798f4b210d0f37511b","unresolved":false,"context_lines":[{"line_number":94,"context_line":"``nova.virt.libvirt.LibvirtConfigGuestFeatureSEV`` class."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"This work could also mean that images with the property"},{"line_number":97,"context_line":"``trait:HW_CPU_x86_SEV\u003drequired`` would similarly affect the process"},{"line_number":98,"context_line":"of launching instances."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Immediate follow-up work"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_60070dcb","line":97,"range":{"start_line":97,"start_character":15,"end_line":97,"end_character":18},"updated":"2018-10-11 19:13:58.000000000","message":"This is AMD-specific, right? Should the trait be renamed to reflect that?","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"0eacc87ad45924ee8e840dc380ce40e083669d8f","unresolved":false,"context_lines":[{"line_number":94,"context_line":"``nova.virt.libvirt.LibvirtConfigGuestFeatureSEV`` class."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"This work could also mean that images with the property"},{"line_number":97,"context_line":"``trait:HW_CPU_x86_SEV\u003drequired`` would similarly affect the process"},{"line_number":98,"context_line":"of launching instances."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Immediate follow-up work"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_2776070e","line":97,"range":{"start_line":97,"start_character":15,"end_line":97,"end_character":18},"in_reply_to":"3f79a3b5_60070dcb","updated":"2018-10-11 23:40:16.000000000","message":"Done","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"ea67aaa9efb00b6fc97959798f4b210d0f37511b","unresolved":false,"context_lines":[{"line_number":104,"context_line":"following subsequent work.  This work is out of scope for this spec"},{"line_number":105,"context_line":"but nevertheless sketched out here for transparency:"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"- Support a built-in trait which would be automatically detected per"},{"line_number":108,"context_line":"  compute host by nova\u0027s libvirt driver.  This would most likely be"},{"line_number":109,"context_line":"  called ``HW_CPU_x86_SEV`` or similar, as an extension of `the"},{"line_number":110,"context_line":"  existing CPU traits mapping"},{"line_number":111,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  Additional logic would be required to check that the various layers"},{"line_number":114,"context_line":"  of the hardware and software hypervisor stack are *all* SEV-capable:"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"  - The presence of the following XML in the response from a libvirt"},{"line_number":117,"context_line":"    `virConnectGetDomainCapabilities()"},{"line_number":118,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":119,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"},{"line_number":120,"context_line":"    (AMD-SP) support SEV functionality"},{"line_number":121,"context_line":"    \u003chttps://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c\u003e`_::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        \u003cdomainCapabilities\u003e"},{"line_number":124,"context_line":"          ..."},{"line_number":125,"context_line":"          \u003cfeatures\u003e"},{"line_number":126,"context_line":"            ..."},{"line_number":127,"context_line":"            \u003csev supported\u003d\u0027yes\u0027/\u003e"},{"line_number":128,"context_line":"              ..."},{"line_number":129,"context_line":"            \u003c/sev\u003e"},{"line_number":130,"context_line":"          \u003c/features\u003e"},{"line_number":131,"context_line":"        \u003c/domainCapabilities\u003e"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev`` should have the value ``1``"},{"line_number":134,"context_line":"    to indicate that the kernel has SEV capabilities enabled."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- Since `migration of instances between unencrypted and SEV-encrypted"},{"line_number":137,"context_line":"  states is not supported in either direction"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_e0779d3a","line":134,"range":{"start_line":107,"start_character":0,"end_line":134,"end_character":61},"updated":"2018-10-11 19:13:58.000000000","message":"So this doesn\u0027t actually seem like that much work. Why not do it from the start?","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"0eacc87ad45924ee8e840dc380ce40e083669d8f","unresolved":false,"context_lines":[{"line_number":104,"context_line":"following subsequent work.  This work is out of scope for this spec"},{"line_number":105,"context_line":"but nevertheless sketched out here for transparency:"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"- Support a built-in trait which would be automatically detected per"},{"line_number":108,"context_line":"  compute host by nova\u0027s libvirt driver.  This would most likely be"},{"line_number":109,"context_line":"  called ``HW_CPU_x86_SEV`` or similar, as an extension of `the"},{"line_number":110,"context_line":"  existing CPU traits mapping"},{"line_number":111,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  Additional logic would be required to check that the various layers"},{"line_number":114,"context_line":"  of the hardware and software hypervisor stack are *all* SEV-capable:"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"  - The presence of the following XML in the response from a libvirt"},{"line_number":117,"context_line":"    `virConnectGetDomainCapabilities()"},{"line_number":118,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":119,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"},{"line_number":120,"context_line":"    (AMD-SP) support SEV functionality"},{"line_number":121,"context_line":"    \u003chttps://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c\u003e`_::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        \u003cdomainCapabilities\u003e"},{"line_number":124,"context_line":"          ..."},{"line_number":125,"context_line":"          \u003cfeatures\u003e"},{"line_number":126,"context_line":"            ..."},{"line_number":127,"context_line":"            \u003csev supported\u003d\u0027yes\u0027/\u003e"},{"line_number":128,"context_line":"              ..."},{"line_number":129,"context_line":"            \u003c/sev\u003e"},{"line_number":130,"context_line":"          \u003c/features\u003e"},{"line_number":131,"context_line":"        \u003c/domainCapabilities\u003e"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev`` should have the value ``1``"},{"line_number":134,"context_line":"    to indicate that the kernel has SEV capabilities enabled."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- Since `migration of instances between unencrypted and SEV-encrypted"},{"line_number":137,"context_line":"  states is not supported in either direction"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_a7d777c0","line":134,"range":{"start_line":107,"start_character":0,"end_line":134,"end_character":61},"in_reply_to":"3f79a3b5_e0779d3a","updated":"2018-10-11 23:40:16.000000000","message":"It\u0027s a fair question.  I guess I was trying to find the absolute quickest path to being able to boot an SEV instance, but maybe this is trying to rush things too much.  I\u0027m perfectly OK with doing this work first (in one commit) and then the SEV instance launch code second (in a subsequent commit), as mentioned below.","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"ea67aaa9efb00b6fc97959798f4b210d0f37511b","unresolved":false,"context_lines":[{"line_number":136,"context_line":"- Since `migration of instances between unencrypted and SEV-encrypted"},{"line_number":137,"context_line":"  states is not supported in either direction"},{"line_number":138,"context_line":"  \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":139,"context_line":"  prevent nova from resizing an instance from a non-SEV-enabled flavor"},{"line_number":140,"context_line":"  to an SEV-enabled one, or vice-versa.  Alternatively, nova could"},{"line_number":141,"context_line":"  catch the error raised by QEMU, which would be propagated via"},{"line_number":142,"context_line":"  libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_a0944542","line":139,"range":{"start_line":139,"start_character":20,"end_line":139,"end_character":28},"updated":"2018-10-11 19:13:58.000000000","message":"I think resize would be fine because you\u0027re essentially rebuilding the instance. The only thing we can\u0027t do it live migrate, but that can just be a quick-fail in the API.","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"0eacc87ad45924ee8e840dc380ce40e083669d8f","unresolved":false,"context_lines":[{"line_number":136,"context_line":"- Since `migration of instances between unencrypted and SEV-encrypted"},{"line_number":137,"context_line":"  states is not supported in either direction"},{"line_number":138,"context_line":"  \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":139,"context_line":"  prevent nova from resizing an instance from a non-SEV-enabled flavor"},{"line_number":140,"context_line":"  to an SEV-enabled one, or vice-versa.  Alternatively, nova could"},{"line_number":141,"context_line":"  catch the error raised by QEMU, which would be propagated via"},{"line_number":142,"context_line":"  libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_477b03f3","line":139,"range":{"start_line":139,"start_character":20,"end_line":139,"end_character":28},"in_reply_to":"3f79a3b5_a0944542","updated":"2018-10-11 23:40:16.000000000","message":"Done","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"ea67aaa9efb00b6fc97959798f4b210d0f37511b","unresolved":false,"context_lines":[{"line_number":147,"context_line":"Alternatives"},{"line_number":148,"context_line":"------------"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"#. The idea of initially using a custom trait could be skipped in"},{"line_number":151,"context_line":"   favour of immediately implementing the built-in trait"},{"line_number":152,"context_line":"   (``HW_CPU_x86_SEV`` or similar).  This would increase the amount of"},{"line_number":153,"context_line":"   effort required in order to reach a functional prototype, but"},{"line_number":154,"context_line":"   conversely has the advantage of not requiring the merging of"},{"line_number":155,"context_line":"   hardcoded references to a custom trait into nova\u0027s ``master``"},{"line_number":156,"context_line":"   branch."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"#. Rather than using a single trait to both facilitate the matching of"},{"line_number":159,"context_line":"   instances requiring SEV with SEV-capable compute hosts *and*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_80702943","line":156,"range":{"start_line":150,"start_character":0,"end_line":156,"end_character":10},"updated":"2018-10-11 19:13:58.000000000","message":"I think I prefer this? A while ago there was a conversation about traits which are operator-defined vs those that are owned by the virt driver. SEV definitely falls in the latter category. How would we handle upgrades if we start SEV as the former (operator-set) and then make it the latter (virt driver owned)?","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"0eacc87ad45924ee8e840dc380ce40e083669d8f","unresolved":false,"context_lines":[{"line_number":147,"context_line":"Alternatives"},{"line_number":148,"context_line":"------------"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"#. The idea of initially using a custom trait could be skipped in"},{"line_number":151,"context_line":"   favour of immediately implementing the built-in trait"},{"line_number":152,"context_line":"   (``HW_CPU_x86_SEV`` or similar).  This would increase the amount of"},{"line_number":153,"context_line":"   effort required in order to reach a functional prototype, but"},{"line_number":154,"context_line":"   conversely has the advantage of not requiring the merging of"},{"line_number":155,"context_line":"   hardcoded references to a custom trait into nova\u0027s ``master``"},{"line_number":156,"context_line":"   branch."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"#. Rather than using a single trait to both facilitate the matching of"},{"line_number":159,"context_line":"   instances requiring SEV with SEV-capable compute hosts *and*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_47c9c322","line":156,"range":{"start_line":150,"start_character":0,"end_line":156,"end_character":10},"in_reply_to":"3f79a3b5_80702943","updated":"2018-10-11 23:40:16.000000000","message":"Yeah it\u0027s a valid point - I worried about that too.  My thought was that rather than mashing a whole load of work together into a single commit, we could break it down into smaller chunks which would be easier to review.  The first would implement basic SEV via a custom trait (during which time only developers experimenting with this would actually use it), and the second would come soon after and convert usage from a custom trait to a driver-owned trait.  They would both land in the same release, therefore no need for upgrades.\n\nHowever it just occurred to me that we could do the work to provide the driver-owned trait *first*, and then the VM-launching work could land on top of that.  That approach seems to have the best of both worlds.  What do you think?","commit_id":"456f4486469faa8f344f4c5c157c8559ae9b2a2e"},{"author":{"_account_id":6593,"name":"Dirk Mueller","email":"dirk@dmllr.de","username":"dmllr"},"change_message_id":"98834414bb2a364b8eeb23733b8fd370b8751223","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"To achieve the simplest prototype implementation which can possibly"},{"line_number":64,"context_line":"work, it is proposed that initially during development and testing,"},{"line_number":65,"context_line":"the placement API would be used to:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_9dce392a","line":63,"updated":"2018-10-12 16:50:59.000000000","message":"For Stein the goal is to implement ... (leave out \"simplest\" and \"prototype\" )","commit_id":"942637e8a9ef9694bf9e238ad1cfa05ae8eda400"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"9727ca0b426faa6a77232b95eda2d8bdd617e947","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"To achieve the simplest prototype implementation which can possibly"},{"line_number":64,"context_line":"work, it is proposed that initially during development and testing,"},{"line_number":65,"context_line":"the placement API would be used to:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_bd95188a","line":63,"in_reply_to":"3f79a3b5_9dce392a","updated":"2018-10-15 15:02:09.000000000","message":"Done","commit_id":"942637e8a9ef9694bf9e238ad1cfa05ae8eda400"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"15142cc66f9310e885ce254b391e0ad8a5a981d5","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"While data is typically encrypted today when stored on disk, it is"},{"line_number":23,"context_line":"stored in DRAM in the clear.  This can leave the data vulnerable to"},{"line_number":24,"context_line":"snooping by unauthorized administrators or software or by hardware"},{"line_number":25,"context_line":"probing.  New non-volatile memory technology (NVDIMM) exacerbates this"},{"line_number":26,"context_line":"problem since an NVDIMM chip can be physically removed from a system"},{"line_number":27,"context_line":"with the data intact, similar to a hard drive.  Without encryption any"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3f79a3b5_9060250f","line":24,"range":{"start_line":24,"start_character":40,"end_line":24,"end_character":42},"updated":"2018-10-16 12:53:44.000000000","message":"Is this supposed to be \",\" or \"of\"? It\u0027s not clear.","commit_id":"dec416fffac04a9c0f5ad7ada9efe1c222dab876"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"f72ea03e2644db2df78deef019678e0fc7bb5a60","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"While data is typically encrypted today when stored on disk, it is"},{"line_number":23,"context_line":"stored in DRAM in the clear.  This can leave the data vulnerable to"},{"line_number":24,"context_line":"snooping by unauthorized administrators or software or by hardware"},{"line_number":25,"context_line":"probing.  New non-volatile memory technology (NVDIMM) exacerbates this"},{"line_number":26,"context_line":"problem since an NVDIMM chip can be physically removed from a system"},{"line_number":27,"context_line":"with the data intact, similar to a hard drive.  Without encryption any"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3f79a3b5_e615233f","line":24,"range":{"start_line":24,"start_character":40,"end_line":24,"end_character":42},"in_reply_to":"3f79a3b5_9060250f","updated":"2018-10-16 13:24:02.000000000","message":"Yep thanks, that was a bit clumsy.  Fixed in next patch set.","commit_id":"dec416fffac04a9c0f5ad7ada9efe1c222dab876"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"15142cc66f9310e885ce254b391e0ad8a5a981d5","unresolved":false,"context_lines":[{"line_number":128,"context_line":"``trait:HW_CPU_x86_AMD_SEV\u003drequired`` would similarly affect the"},{"line_number":129,"context_line":"process of launching instances."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Alternatives"},{"line_number":132,"context_line":"------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"#. Rather than immediately implementing automatic detection of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3f79a3b5_30583155","line":131,"range":{"start_line":131,"start_character":0,"end_line":131,"end_character":12},"updated":"2018-10-16 12:53:44.000000000","message":"nice analysis in this section. I agree that the chosen path is the best one.","commit_id":"dec416fffac04a9c0f5ad7ada9efe1c222dab876"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"15142cc66f9310e885ce254b391e0ad8a5a981d5","unresolved":false,"context_lines":[{"line_number":355,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"Tempest tests could also be included if SEV hardware is available, either"},{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3f79a3b5_8b055a11","line":358,"updated":"2018-10-16 12:53:44.000000000","message":"Third party CI (from AMD presumably) would be ideal for this.","commit_id":"dec416fffac04a9c0f5ad7ada9efe1c222dab876"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"f72ea03e2644db2df78deef019678e0fc7bb5a60","unresolved":false,"context_lines":[{"line_number":355,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"Tempest tests could also be included if SEV hardware is available, either"},{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3f79a3b5_861eaf5b","line":358,"in_reply_to":"3f79a3b5_8b055a11","updated":"2018-10-16 13:24:02.000000000","message":"Yes, either from AMD labs, or (I guess but I\u0027ll have to check) more likely AMD hardware in SUSE labs.","commit_id":"dec416fffac04a9c0f5ad7ada9efe1c222dab876"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"53259e503d52c949957756a81d50295d189bbfc7","unresolved":false,"context_lines":[{"line_number":31,"context_line":"AMD\u0027s SEV offers a VM protection technology which transparently"},{"line_number":32,"context_line":"encrypts the memory of each VM with a unique key.  It can also"},{"line_number":33,"context_line":"calculate a signature of the memory contents, which can be sent to the"},{"line_number":34,"context_line":"guest owner as an attestation that the memory was encrypted correctly"},{"line_number":35,"context_line":"by the firmware.  SEV is particularly applicable to cloud computing"},{"line_number":36,"context_line":"since it can reduce the amount of trust VMs need to place in the"},{"line_number":37,"context_line":"hypervisor and administrator of their host system."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_002c9c91","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":11},"updated":"2018-10-17 21:30:10.000000000","message":"nit: \"VM\u0027s owner\" to remain consistent with the previous use of VM.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":31,"context_line":"AMD\u0027s SEV offers a VM protection technology which transparently"},{"line_number":32,"context_line":"encrypts the memory of each VM with a unique key.  It can also"},{"line_number":33,"context_line":"calculate a signature of the memory contents, which can be sent to the"},{"line_number":34,"context_line":"guest owner as an attestation that the memory was encrypted correctly"},{"line_number":35,"context_line":"by the firmware.  SEV is particularly applicable to cloud computing"},{"line_number":36,"context_line":"since it can reduce the amount of trust VMs need to place in the"},{"line_number":37,"context_line":"hypervisor and administrator of their host system."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_21a0b0a4","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":11},"in_reply_to":"3f79a3b5_002c9c91","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"53259e503d52c949957756a81d50295d189bbfc7","unresolved":false,"context_lines":[{"line_number":36,"context_line":"since it can reduce the amount of trust VMs need to place in the"},{"line_number":37,"context_line":"hypervisor and administrator of their host system."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Use Cases"},{"line_number":40,"context_line":"---------"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"#. \"As a cloud operator, in order that my users can have greater"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_c0e78445","line":39,"updated":"2018-10-17 21:30:10.000000000","message":"I know this is a spec for SEV, but presumably what the users and operators care about is what SEV lets them do, not what SEV is itself. If you really want to make a distinction between images and flavor, sure, but there\u0027s really only 1.5 use case here: As a user, I don\u0027t want to trust my cloud operator with my secrets, and as a cloud provider, I want to make money off those users by offering them a way of doing just that. Oh and you don\u0027t need quotes.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":36,"context_line":"since it can reduce the amount of trust VMs need to place in the"},{"line_number":37,"context_line":"hypervisor and administrator of their host system."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Use Cases"},{"line_number":40,"context_line":"---------"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"#. \"As a cloud operator, in order that my users can have greater"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_c1f9bc82","line":39,"in_reply_to":"3f79a3b5_c0e78445","updated":"2018-10-18 16:53:20.000000000","message":"Fair enough.  Quotes removed, and shrunk down to 2 use cases.  I agree that it\u0027s only 1.5 use cases, but I think it\u0027s important to phrase the operator and user perspectives separately even those they are different sides of the same coin, since placing yourself in the shoes of a particular persona is one of the main points of phrasing user stories like this ... but based on your suggested wording it sounds like you probably already agree with me on that :-)\n\nBTW the provider is not necessarily making money from the users.  It\u0027s very common that it\u0027s a private cloud and the operators and users all work for the same company, just in different teams.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  that the various layers of the hardware and software hypervisor"},{"line_number":69,"context_line":"  stack are SEV-capable:"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  - The presence of the following XML in the response from a libvirt"},{"line_number":72,"context_line":"    `virConnectGetDomainCapabilities()"},{"line_number":73,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":74,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_1af2cbe5","line":71,"updated":"2018-10-17 19:39:55.000000000","message":"OK so looking at https://libvirt.org/formatdomain.html#sev, support wasn\u0027t in libvirt until 4.4.0. Our currently supported minimum version of libvirt is 1.3.0:\n\nhttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/driver.py#L223\n\nAnd the next minimum is 4.0.0, which is still not new enough for this. If we just never report the trait until the libvirt host capabilities says it\u0027s available, that\u0027s probably good enough, meaning we don\u0027t have to do any specific libvirt version checking in the driver.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  that the various layers of the hardware and software hypervisor"},{"line_number":69,"context_line":"  stack are SEV-capable:"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  - The presence of the following XML in the response from a libvirt"},{"line_number":72,"context_line":"    `virConnectGetDomainCapabilities()"},{"line_number":73,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":74,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_814f44be","line":71,"in_reply_to":"3f79a3b5_1af2cbe5","updated":"2018-10-18 16:53:20.000000000","message":"Exactly.  Have added that as an explicit statement for clarity.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":85,"context_line":"          \u003c/features\u003e"},{"line_number":86,"context_line":"        \u003c/domainCapabilities\u003e"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev`` should have the value ``1``"},{"line_number":89,"context_line":"    to indicate that the kernel has SEV capabilities enabled."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"  Note that both checks are required, since the presence of the first"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_af5cbb58","line":88,"updated":"2018-10-17 19:39:55.000000000","message":"ew, ok so on nova-compute service startup we have to run a privsep grep command on this (if the file even exists)","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":85,"context_line":"          \u003c/features\u003e"},{"line_number":86,"context_line":"        \u003c/domainCapabilities\u003e"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev`` should have the value ``1``"},{"line_number":89,"context_line":"    to indicate that the kernel has SEV capabilities enabled."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"  Note that both checks are required, since the presence of the first"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_cc92534b","line":88,"in_reply_to":"3f79a3b5_af5cbb58","updated":"2018-10-18 16:53:20.000000000","message":"Nope, this should be readable by any non-root user.  Have added that as an explicit statement for clarity.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":91,"context_line":"  Note that both checks are required, since the presence of the first"},{"line_number":92,"context_line":"  does not imply the second."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"- Support a built-in trait which would be automatically detected per"},{"line_number":95,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":96,"context_line":"  called ``HW_CPU_x86_AMD_SEV`` or similar, as an extension of `the"},{"line_number":97,"context_line":"  existing CPU traits mapping"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_2f70abdb","line":94,"range":{"start_line":94,"start_character":12,"end_line":94,"end_character":20},"updated":"2018-10-17 19:39:55.000000000","message":"nit: standard is maybe a better term since I think that\u0027s what we refer to the traits registered in the os-traits library","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":91,"context_line":"  Note that both checks are required, since the presence of the first"},{"line_number":92,"context_line":"  does not imply the second."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"- Support a built-in trait which would be automatically detected per"},{"line_number":95,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":96,"context_line":"  called ``HW_CPU_x86_AMD_SEV`` or similar, as an extension of `the"},{"line_number":97,"context_line":"  existing CPU traits mapping"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_ccab336f","line":94,"range":{"start_line":94,"start_character":12,"end_line":94,"end_character":20},"in_reply_to":"3f79a3b5_2f70abdb","updated":"2018-10-18 16:53:20.000000000","message":"Thanks, have changed \"built-in\" to \"standard\" everywhere.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"fddd76e1ee3a893d8e262d255592e2434ec6ac53","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  existing CPU traits mapping"},{"line_number":98,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"- This built-in trait would indicate that the libvirt driver should"},{"line_number":101,"context_line":"  include extra XML in the guest\u0027s domain definition, to enable SEV"},{"line_number":102,"context_line":"  security, ensure that the VM uses machine type ``q35`` and UEFI via"},{"line_number":103,"context_line":"  OVMF, and that ``iommu_platform\u003don`` is used for all virtio devices,"},{"line_number":104,"context_line":"  e.g.::"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_a704d01a","line":101,"range":{"start_line":100,"start_character":2,"end_line":101,"end_character":52},"updated":"2018-10-18 13:24:18.000000000","message":"do you mean if such a standard trait is requested in the flavor?","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  existing CPU traits mapping"},{"line_number":98,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"- This built-in trait would indicate that the libvirt driver should"},{"line_number":101,"context_line":"  include extra XML in the guest\u0027s domain definition, to enable SEV"},{"line_number":102,"context_line":"  security, ensure that the VM uses machine type ``q35`` and UEFI via"},{"line_number":103,"context_line":"  OVMF, and that ``iommu_platform\u003don`` is used for all virtio devices,"},{"line_number":104,"context_line":"  e.g.::"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_d320a79d","line":101,"range":{"start_line":100,"start_character":2,"end_line":101,"end_character":52},"in_reply_to":"3f79a3b5_a704d01a","updated":"2018-10-18 16:53:20.000000000","message":"Yes. Clarified in PS9.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"      \u003cdomain type\u003d\u0027kvm\u0027\u003e"},{"line_number":107,"context_line":"        \u003cos\u003e"},{"line_number":108,"context_line":"          \u003ctype arch\u003d\u0027x86_64\u0027 machine\u003d\u0027pc-q35-2.11\u0027\u003ehvm\u003c/type\u003e"},{"line_number":109,"context_line":"          \u003cloader readonly\u003d\u0027yes\u0027 type\u003d\u0027pflash\u0027\u003e/usr/share/qemu/ovmf-x86_64-ms-4m-code.bin\u003c/loader\u003e"},{"line_number":110,"context_line":"          \u003cnvram\u003e/var/lib/libvirt/qemu/nvram/sles15-sev-guest_VARS.fd\u003c/nvram\u003e"},{"line_number":111,"context_line":"          \u003cboot dev\u003d\u0027hd\u0027/\u003e"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_2f074b21","line":108,"range":{"start_line":108,"start_character":52,"end_line":108,"end_character":55},"updated":"2018-10-17 19:39:55.000000000","message":"What happens if machine type is !\u003d hvm but HW_CPU_x86_AMD_SEV is required? Do we fail the build and reschedule? I\u0027m thinking about the CONF.libvirt.hw_machine_type option. Note that the image can also specify hw_machine_type which overrides the config. Maybe this is just something that gets sorted out in the libvirt driver\u0027s _get_machine_type() method.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"      \u003cdomain type\u003d\u0027kvm\u0027\u003e"},{"line_number":107,"context_line":"        \u003cos\u003e"},{"line_number":108,"context_line":"          \u003ctype arch\u003d\u0027x86_64\u0027 machine\u003d\u0027pc-q35-2.11\u0027\u003ehvm\u003c/type\u003e"},{"line_number":109,"context_line":"          \u003cloader readonly\u003d\u0027yes\u0027 type\u003d\u0027pflash\u0027\u003e/usr/share/qemu/ovmf-x86_64-ms-4m-code.bin\u003c/loader\u003e"},{"line_number":110,"context_line":"          \u003cnvram\u003e/var/lib/libvirt/qemu/nvram/sles15-sev-guest_VARS.fd\u003c/nvram\u003e"},{"line_number":111,"context_line":"          \u003cboot dev\u003d\u0027hd\u0027/\u003e"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_a73290f2","line":108,"range":{"start_line":108,"start_character":52,"end_line":108,"end_character":55},"in_reply_to":"3f79a3b5_2f074b21","updated":"2018-10-18 16:53:20.000000000","message":"Very good question!  Yes, looks like _get_machine_type() could handle this but should it raise an exception or just override the type?  I don\u0027t know enough about this area to make a judgement call, but I\u0027ve taken a stab in the dark at adding a way forward on this.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":111,"context_line":"          \u003cboot dev\u003d\u0027hd\u0027/\u003e"},{"line_number":112,"context_line":"        \u003c/os\u003e"},{"line_number":113,"context_line":"        \u003claunchSecurity type\u003d\u0027sev\u0027\u003e"},{"line_number":114,"context_line":"          \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":115,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":116,"context_line":"          \u003cpolicy\u003e0x0001\u003c/policy\u003e"},{"line_number":117,"context_line":"        \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_ba4b975c","line":114,"range":{"start_line":114,"start_character":19,"end_line":114,"end_character":21},"updated":"2018-10-17 19:39:55.000000000","message":"This is just an example but it looks like this comes from the hypervisor\u0027s host capabilities:\n\nhttps://libvirt.org/formatdomain.html#sev","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":111,"context_line":"          \u003cboot dev\u003d\u0027hd\u0027/\u003e"},{"line_number":112,"context_line":"        \u003c/os\u003e"},{"line_number":113,"context_line":"        \u003claunchSecurity type\u003d\u0027sev\u0027\u003e"},{"line_number":114,"context_line":"          \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":115,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":116,"context_line":"          \u003cpolicy\u003e0x0001\u003c/policy\u003e"},{"line_number":117,"context_line":"        \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_474e1c3a","line":114,"range":{"start_line":114,"start_character":19,"end_line":114,"end_character":21},"in_reply_to":"3f79a3b5_ba4b975c","updated":"2018-10-18 16:53:20.000000000","message":"Correct; added an explicit statement.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        \u003c/os\u003e"},{"line_number":113,"context_line":"        \u003claunchSecurity type\u003d\u0027sev\u0027\u003e"},{"line_number":114,"context_line":"          \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":115,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":116,"context_line":"          \u003cpolicy\u003e0x0001\u003c/policy\u003e"},{"line_number":117,"context_line":"        \u003c/launchSecurity\u003e"},{"line_number":118,"context_line":"        ..."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_5a50430a","line":115,"range":{"start_line":115,"start_character":27,"end_line":115,"end_character":28},"updated":"2018-10-17 19:39:55.000000000","message":"same as above","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        \u003c/os\u003e"},{"line_number":113,"context_line":"        \u003claunchSecurity type\u003d\u0027sev\u0027\u003e"},{"line_number":114,"context_line":"          \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":115,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":116,"context_line":"          \u003cpolicy\u003e0x0001\u003c/policy\u003e"},{"line_number":117,"context_line":"        \u003c/launchSecurity\u003e"},{"line_number":118,"context_line":"        ..."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_674b1828","line":115,"range":{"start_line":115,"start_character":27,"end_line":115,"end_character":28},"in_reply_to":"3f79a3b5_5a50430a","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        \u003claunchSecurity type\u003d\u0027sev\u0027\u003e"},{"line_number":114,"context_line":"          \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":115,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":116,"context_line":"          \u003cpolicy\u003e0x0001\u003c/policy\u003e"},{"line_number":117,"context_line":"        \u003c/launchSecurity\u003e"},{"line_number":118,"context_line":"        ..."},{"line_number":119,"context_line":"      \u003c/domain\u003e"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_da43f33f","line":116,"range":{"start_line":116,"start_character":18,"end_line":116,"end_character":24},"updated":"2018-10-17 19:39:55.000000000","message":"Looks like this is configurable:\n\nhttps://libvirt.org/formatdomain.html#sev\n\nIs 1 going to be hard-coded? Or configurable via extra spec/image property? It sounds like that has implications for migrating the instance to another host.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        \u003claunchSecurity type\u003d\u0027sev\u0027\u003e"},{"line_number":114,"context_line":"          \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":115,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":116,"context_line":"          \u003cpolicy\u003e0x0001\u003c/policy\u003e"},{"line_number":117,"context_line":"        \u003c/launchSecurity\u003e"},{"line_number":118,"context_line":"        ..."},{"line_number":119,"context_line":"      \u003c/domain\u003e"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_876d149c","line":116,"range":{"start_line":116,"start_character":18,"end_line":116,"end_character":24},"in_reply_to":"3f79a3b5_da43f33f","updated":"2018-10-18 16:53:20.000000000","message":"Added extra detail to cover this.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":160,"context_line":"   indicate to nova\u0027s libvirt driver that SEV should be used when"},{"line_number":161,"context_line":"   booting, the trait could be used solely for scheduling of the"},{"line_number":162,"context_line":"   instance on SEV hosts, and an additional extra spec property such"},{"line_number":163,"context_line":"   as ``hw:sev_policy`` could be used to ensure that the VM is defined"},{"line_number":164,"context_line":"   and booted with the necessary extra SEV-specific domain XML."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"   However this would create extra friction for the operators defining"},{"line_number":167,"context_line":"   SEV-enabled flavors, and it is also hard to imagine why anyone"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_9a6fbbc6","line":164,"range":{"start_line":163,"start_character":3,"end_line":164,"end_character":63},"updated":"2018-10-17 19:39:55.000000000","message":"OK this is like my question above.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":160,"context_line":"   indicate to nova\u0027s libvirt driver that SEV should be used when"},{"line_number":161,"context_line":"   booting, the trait could be used solely for scheduling of the"},{"line_number":162,"context_line":"   instance on SEV hosts, and an additional extra spec property such"},{"line_number":163,"context_line":"   as ``hw:sev_policy`` could be used to ensure that the VM is defined"},{"line_number":164,"context_line":"   and booted with the necessary extra SEV-specific domain XML."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"   However this would create extra friction for the operators defining"},{"line_number":167,"context_line":"   SEV-enabled flavors, and it is also hard to imagine why anyone"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_c7a46cbb","line":164,"range":{"start_line":163,"start_character":3,"end_line":164,"end_character":63},"in_reply_to":"3f79a3b5_9a6fbbc6","updated":"2018-10-18 16:53:20.000000000","message":"Correct.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":175,"context_line":""},{"line_number":176,"context_line":"#. Rather than traits, normal flavor extra specs could be used to"},{"line_number":177,"context_line":"   require the SEV feature; however it is understood that this"},{"line_number":178,"context_line":"   approach is `deprecated in favour of using traits"},{"line_number":179,"context_line":"   \u003chttps://docs.openstack.org/nova/latest/admin/configuration/schedulers.html#computecapabilitiesfilter\u003e`_."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_1a63abe0","line":178,"range":{"start_line":178,"start_character":16,"end_line":178,"end_character":26},"updated":"2018-10-17 19:39:55.000000000","message":"\u003crant\u003e\nWell this is getting the cart before the horse a bit. Flavor extra specs and image properties are still useful when you need a key\u003dvalue pair for configuring something in the guest, like was mentioned above with the sev policy element. We can use traits for that stuff, but then we have to encode the key/value in the trait name and that\u0027s its own ball of suck.\n\u003c/rant\u003e","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":175,"context_line":""},{"line_number":176,"context_line":"#. Rather than traits, normal flavor extra specs could be used to"},{"line_number":177,"context_line":"   require the SEV feature; however it is understood that this"},{"line_number":178,"context_line":"   approach is `deprecated in favour of using traits"},{"line_number":179,"context_line":"   \u003chttps://docs.openstack.org/nova/latest/admin/configuration/schedulers.html#computecapabilitiesfilter\u003e`_."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_67bc78b5","line":178,"range":{"start_line":178,"start_character":16,"end_line":178,"end_character":26},"in_reply_to":"3f79a3b5_1a63abe0","updated":"2018-10-18 16:53:20.000000000","message":"Ah yeah, good point - reworded.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":188,"context_line":"REST API impact"},{"line_number":189,"context_line":"---------------"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"None, although future work may require extending the REST API so that"},{"line_number":192,"context_line":"users can verify the hardware\u0027s attestation that the memory was"},{"line_number":193,"context_line":"encrypted correctly by the firmware."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Security impact"},{"line_number":196,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_3aa54702","line":193,"range":{"start_line":191,"start_character":6,"end_line":193,"end_character":36},"updated":"2018-10-17 19:39:55.000000000","message":"I wouldn\u0027t bet on this given how virt-specific this is, unless the feature can be adopted generically by other virt drivers.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":188,"context_line":"REST API impact"},{"line_number":189,"context_line":"---------------"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"None, although future work may require extending the REST API so that"},{"line_number":192,"context_line":"users can verify the hardware\u0027s attestation that the memory was"},{"line_number":193,"context_line":"encrypted correctly by the firmware."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Security impact"},{"line_number":196,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_67ea38a1","line":193,"range":{"start_line":191,"start_character":6,"end_line":193,"end_character":36},"in_reply_to":"3f79a3b5_3aa54702","updated":"2018-10-18 16:53:20.000000000","message":"Added a sentence about this.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"None."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Future work may want to expose the information that the instance is"},{"line_number":218,"context_line":"running encrypted, e.g. a billing cloud provider might want to impose"},{"line_number":219,"context_line":"a security surcharge, whereby encrypted instances are billed"},{"line_number":220,"context_line":"differently to unencrypted ones."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Other end user impact"},{"line_number":223,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_7a7c1f71","line":220,"range":{"start_line":217,"start_character":0,"end_line":220,"end_character":32},"updated":"2018-10-17 19:39:55.000000000","message":"I think you could also get this w/o a new notification. The instance payload in the versioned notification has the flavor along with it\u0027s extra specs, where this would be defined. That\u0027s not the case with the image backing the server though, the notification would just have the image UUID in it. The consumer could always look up the image to get the properties though (although image properties could change after the instance was created). Anyway, easy thing to add if we ever needed it.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"None."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Future work may want to expose the information that the instance is"},{"line_number":218,"context_line":"running encrypted, e.g. a billing cloud provider might want to impose"},{"line_number":219,"context_line":"a security surcharge, whereby encrypted instances are billed"},{"line_number":220,"context_line":"differently to unencrypted ones."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Other end user impact"},{"line_number":223,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_726e7465","line":220,"range":{"start_line":217,"start_character":0,"end_line":220,"end_character":32},"in_reply_to":"3f79a3b5_7a7c1f71","updated":"2018-10-18 16:53:20.000000000","message":"Great point - changed to address this.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"fddd76e1ee3a893d8e262d255592e2434ec6ac53","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"None."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Future work may want to expose the information that the instance is"},{"line_number":218,"context_line":"running encrypted, e.g. a billing cloud provider might want to impose"},{"line_number":219,"context_line":"a security surcharge, whereby encrypted instances are billed"},{"line_number":220,"context_line":"differently to unencrypted ones."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Other end user impact"},{"line_number":223,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_f255a4fa","line":220,"range":{"start_line":217,"start_character":0,"end_line":220,"end_character":32},"in_reply_to":"3f79a3b5_7a7c1f71","updated":"2018-10-18 13:24:18.000000000","message":"I suggest to first go with the existing instance payload (and the falvor in it) and if the image properties become a problem for some deployers then consider extending notifications.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"None."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Future work may want to expose the information that the instance is"},{"line_number":218,"context_line":"running encrypted, e.g. a billing cloud provider might want to impose"},{"line_number":219,"context_line":"a security surcharge, whereby encrypted instances are billed"},{"line_number":220,"context_line":"differently to unencrypted ones."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Other end user impact"},{"line_number":223,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_93378fdc","line":220,"range":{"start_line":217,"start_character":0,"end_line":220,"end_character":32},"in_reply_to":"3f79a3b5_f255a4fa","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":219,"context_line":"a security surcharge, whereby encrypted instances are billed"},{"line_number":220,"context_line":"differently to unencrypted ones."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Other end user impact"},{"line_number":223,"context_line":"---------------------"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The end user will harness SEV through the existing mechanisms of"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_9a59fb01","line":222,"updated":"2018-10-17 19:39:55.000000000","message":"Does this work for both volume-backed and local ephemeral disk image-backed servers? I\u0027m assuming not for volume-backed instances? Would be good to note that if it\u0027s the case.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":219,"context_line":"a security surcharge, whereby encrypted instances are billed"},{"line_number":220,"context_line":"differently to unencrypted ones."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Other end user impact"},{"line_number":223,"context_line":"---------------------"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The end user will harness SEV through the existing mechanisms of"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_9270f0dd","line":222,"in_reply_to":"3f79a3b5_9a59fb01","updated":"2018-10-18 16:53:20.000000000","message":"I\u0027m not sure - I can check, but why might it not work for volume-backed?","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":223,"context_line":"---------------------"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The end user will harness SEV through the existing mechanisms of"},{"line_number":226,"context_line":"traits in flavor extra specs and properties.  Later on it may make"},{"line_number":227,"context_line":"sense to add support for scheduler hints (see the `Future Work`_"},{"line_number":228,"context_line":"section below)."},{"line_number":229,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_9acb3ba6","line":226,"range":{"start_line":226,"start_character":33,"end_line":226,"end_character":43},"updated":"2018-10-17 19:39:55.000000000","message":"image properties","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":223,"context_line":"---------------------"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The end user will harness SEV through the existing mechanisms of"},{"line_number":226,"context_line":"traits in flavor extra specs and properties.  Later on it may make"},{"line_number":227,"context_line":"sense to add support for scheduler hints (see the `Future Work`_"},{"line_number":228,"context_line":"section below)."},{"line_number":229,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_2d13c1b9","line":226,"range":{"start_line":226,"start_character":33,"end_line":226,"end_character":43},"in_reply_to":"3f79a3b5_9acb3ba6","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":246,"context_line":"Memory deduplication mechanisms such as KSM (kernel samepage merging)"},{"line_number":247,"context_line":"would be rendered ineffective."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"Other deployer impact"},{"line_number":250,"context_line":"---------------------"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"In order for users to be able to use SEV, the operator will need to:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_dafbf3bc","line":249,"updated":"2018-10-17 19:39:55.000000000","message":"Requires libvirt\u003e\u003d4.4.0. What about QEMU minimum versions?","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":246,"context_line":"Memory deduplication mechanisms such as KSM (kernel samepage merging)"},{"line_number":247,"context_line":"would be rendered ineffective."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"Other deployer impact"},{"line_number":250,"context_line":"---------------------"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"In order for users to be able to use SEV, the operator will need to:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_8d59b55d","line":249,"in_reply_to":"3f79a3b5_dafbf3bc","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Implementation"},{"line_number":272,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_3a18e71d","line":269,"updated":"2018-10-17 19:39:55.000000000","message":"In thinking about this with things like cold/live migration, if I create a server on a host that is sev-capable, I shouldn\u0027t be able to migrate to another host that is not sev-capable because of the restriction during scheduling on the required trait. An admin could force the instance to a host that is not sev capable by bypassing the scheduler, but that should fail the migration once we try to get to the dest host (for live migration the dest host wouldn\u0027t recognize the sev elements in the domain xml coming from the source). Anyway, we\u0027re deprecating the force flag as an indication it shoudn\u0027t be used, so it\u0027s an edge case we don\u0027t really need to care about.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Implementation"},{"line_number":272,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_02624f16","line":269,"in_reply_to":"3f79a3b5_1295c094","updated":"2018-10-18 16:53:20.000000000","message":"@Balazs Good question - I just double-checked with AMD, and even encrypted to encrypted live migration is not yet supported in the hypervisor software stack, although it will be in the future.  Currently it\u0027s only supported by SEV in the design.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Implementation"},{"line_number":272,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_c258d7fa","line":269,"in_reply_to":"3f79a3b5_3a18e71d","updated":"2018-10-18 16:53:20.000000000","message":"@Matt Yes I think that\u0027s exactly right.  Are you saying this should be mentioned in the \"Upgrade impact\" section though?  I thought this section was specifically for impact on upgrading between nova versions, so I don\u0027t see how it would be relevant to that.  It\u0027s already mentioned in the work items below, but do let me know if you want me to add any extra text about this.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"fddd76e1ee3a893d8e262d255592e2434ec6ac53","unresolved":false,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Implementation"},{"line_number":272,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_1295c094","line":269,"in_reply_to":"3f79a3b5_3a18e71d","updated":"2018-10-18 13:24:18.000000000","message":"Doesn\u0027t even live migration supported (on libvirt level) for VMs with encrypted memory content?","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":297,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":298,"context_line":"   in the flavor of the VM being launched."},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"#. Since `migration of instances between unencrypted and SEV-encrypted"},{"line_number":301,"context_line":"   states is not supported in either direction"},{"line_number":302,"context_line":"   \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":303,"context_line":"   prevent nova from live-migrating an instance from a compute host"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_9a9a5b73","line":300,"updated":"2018-10-17 19:39:55.000000000","message":"I mentioned this above, and I don\u0027t really think it should be a problem given the scheduler should filter out hosts that are not sev-capable if you created a guest using a sev-capable flavor/image. The reverse is not the same, i.e. I can create a guest on a sev-capable host w/o the trait and then migrate it to another host with or without the trait. Or I can resize from a flavor without sev capability to a flavor with sev capability which would require a run through the scheduler to pick a sev capable destination host.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":297,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":298,"context_line":"   in the flavor of the VM being launched."},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"#. Since `migration of instances between unencrypted and SEV-encrypted"},{"line_number":301,"context_line":"   states is not supported in either direction"},{"line_number":302,"context_line":"   \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":303,"context_line":"   prevent nova from live-migrating an instance from a compute host"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_18495eb7","line":300,"in_reply_to":"3f79a3b5_9a9a5b73","updated":"2018-10-18 16:53:20.000000000","message":"Yeah, turns out we can\u0027t allow *any* sort of migration yet where SEV is involved.  I\u0027m not sure whether resize to the same host could work though ...","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"53259e503d52c949957756a81d50295d189bbfc7","unresolved":false,"context_lines":[{"line_number":301,"context_line":"   states is not supported in either direction"},{"line_number":302,"context_line":"   \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":303,"context_line":"   prevent nova from live-migrating an instance from a compute host"},{"line_number":304,"context_line":"   which supports SEV to one which doesn\u0027t.  Alternatively, nova could"},{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_00d1fcf8","line":304,"range":{"start_line":304,"start_character":3,"end_line":304,"end_character":42},"updated":"2018-10-17 21:30:10.000000000","message":"Continuing on the point Matt raised on L116, what effect does the \u003cpolicy\u003e element have on migrations, both cold and live? Even assuming some form of migration is allowed, I\u0027m guessing whatever secret/key is used to encrypt the RAM would have to transit from source to dest - and that\u0027s not guaranteed to be encrypted, is it? Perhaps we should just block any type of migration for SEV instances?","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"2d7d3312e30cf4143f1bb38c05534552c7f9365f","unresolved":false,"context_lines":[{"line_number":301,"context_line":"   states is not supported in either direction"},{"line_number":302,"context_line":"   \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":303,"context_line":"   prevent nova from live-migrating an instance from a compute host"},{"line_number":304,"context_line":"   which supports SEV to one which doesn\u0027t.  Alternatively, nova could"},{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_fb127155","line":304,"range":{"start_line":304,"start_character":3,"end_line":304,"end_character":42},"in_reply_to":"3f79a3b5_00d1fcf8","updated":"2018-10-17 21:46:23.000000000","message":"The key used to encrypt the VM is in the AMD hardware and never leaves the system. So when migration is implemented the VM will need to be decrypted, then re-ecrypted at the source system with a key used only for the transport, then decrypted at the destination system, then re-encrypted with an SEV key on the destination system. None of that logic exists today.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":301,"context_line":"   states is not supported in either direction"},{"line_number":302,"context_line":"   \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":303,"context_line":"   prevent nova from live-migrating an instance from a compute host"},{"line_number":304,"context_line":"   which supports SEV to one which doesn\u0027t.  Alternatively, nova could"},{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_b8cf0a27","line":304,"range":{"start_line":304,"start_character":3,"end_line":304,"end_character":42},"in_reply_to":"3f79a3b5_5becc527","updated":"2018-10-18 16:53:20.000000000","message":"Right now SEV live migration isn\u0027t supported at all, so we\u0027ll just prevent it or rely on any QEMU exception bubbling up.  Reworded accordingly.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"036167e09006ae34373d5b9c32a319f6555e8f91","unresolved":false,"context_lines":[{"line_number":301,"context_line":"   states is not supported in either direction"},{"line_number":302,"context_line":"   \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":303,"context_line":"   prevent nova from live-migrating an instance from a compute host"},{"line_number":304,"context_line":"   which supports SEV to one which doesn\u0027t.  Alternatively, nova could"},{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_5becc527","line":304,"range":{"start_line":304,"start_character":3,"end_line":304,"end_character":42},"in_reply_to":"3f79a3b5_fb127155","updated":"2018-10-17 21:56:54.000000000","message":"FWIW the libvirt docs say this about the policy element:\n\n\"The policy is also transmitted during snapshot and migration flows and enforced on the destination platform.\"\n\nBut if there is stuff nova has to do on the source before the live migration and then setup again on the dest, it\u0027s gonna be complicated and definitely should be documented in the spec.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"#. Similarly, attempts to suspend / resume a domain should either be"},{"line_number":309,"context_line":"   prevented, or the error caught and handled."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Future work"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_1a8e4b33","line":308,"updated":"2018-10-17 19:39:55.000000000","message":"What\u0027s wrong with suspend/resume for sev-enabled guests?","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"2d7d3312e30cf4143f1bb38c05534552c7f9365f","unresolved":false,"context_lines":[{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"#. Similarly, attempts to suspend / resume a domain should either be"},{"line_number":309,"context_line":"   prevented, or the error caught and handled."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Future work"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_c061c412","line":308,"in_reply_to":"3f79a3b5_1a8e4b33","updated":"2018-10-17 21:46:23.000000000","message":"At this time AMD does not support suspend or resume of sev-enabled guests.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"#. Similarly, attempts to suspend / resume a domain should either be"},{"line_number":309,"context_line":"   prevented, or the error caught and handled."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Future work"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_78d172ca","line":308,"in_reply_to":"3f79a3b5_bbd07954","updated":"2018-10-18 16:53:20.000000000","message":"Reworded to be more explicit.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"036167e09006ae34373d5b9c32a319f6555e8f91","unresolved":false,"context_lines":[{"line_number":305,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":306,"context_line":"   libvirt, and handle it appropriately."},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"#. Similarly, attempts to suspend / resume a domain should either be"},{"line_number":309,"context_line":"   prevented, or the error caught and handled."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Future work"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_bbd07954","line":308,"in_reply_to":"3f79a3b5_c061c412","updated":"2018-10-17 21:56:54.000000000","message":"Huh, OK. I guess that goes in the docs too then and we have to handle the error like this says.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"53259e503d52c949957756a81d50295d189bbfc7","unresolved":false,"context_lines":[{"line_number":308,"context_line":"#. Similarly, attempts to suspend / resume a domain should either be"},{"line_number":309,"context_line":"   prevented, or the error caught and handled."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Future work"},{"line_number":312,"context_line":"-----------"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"Looking beyond Stein, there is scope for several strands of additional"},{"line_number":315,"context_line":"work for enriching nova\u0027s SEV support:"},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"- Extend the `ComputeCapabilitiesFilter"},{"line_number":318,"context_line":"  \u003chttps://docs.openstack.org/ocata/config-reference/compute/schedulers.html#computecapabilitiesfilter\u003e`_"},{"line_number":319,"context_line":"  scheduler filter to support scheduler hints, so that SEV can be"},{"line_number":320,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":321,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":322,"context_line":""},{"line_number":323,"context_line":"- Extend nova\u0027s API so that users can access the attestation measurement"},{"line_number":324,"context_line":"  provided by SEV\u0027s ``LAUNCH_MEASURE`` command, in order to verify that"},{"line_number":325,"context_line":"  the guest memory was encrypted correctly by the firmware."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_c060e437","line":325,"range":{"start_line":311,"start_character":0,"end_line":325,"end_character":59},"updated":"2018-10-17 21:30:10.000000000","message":"Eh, no harm in keeping this, but it\u0027s neither here nor there, and as Matt said, the API stuff is unlikely to happen.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":308,"context_line":"#. Similarly, attempts to suspend / resume a domain should either be"},{"line_number":309,"context_line":"   prevented, or the error caught and handled."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Future work"},{"line_number":312,"context_line":"-----------"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"Looking beyond Stein, there is scope for several strands of additional"},{"line_number":315,"context_line":"work for enriching nova\u0027s SEV support:"},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"- Extend the `ComputeCapabilitiesFilter"},{"line_number":318,"context_line":"  \u003chttps://docs.openstack.org/ocata/config-reference/compute/schedulers.html#computecapabilitiesfilter\u003e`_"},{"line_number":319,"context_line":"  scheduler filter to support scheduler hints, so that SEV can be"},{"line_number":320,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":321,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":322,"context_line":""},{"line_number":323,"context_line":"- Extend nova\u0027s API so that users can access the attestation measurement"},{"line_number":324,"context_line":"  provided by SEV\u0027s ``LAUNCH_MEASURE`` command, in order to verify that"},{"line_number":325,"context_line":"  the guest memory was encrypted correctly by the firmware."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_188cfed6","line":325,"range":{"start_line":311,"start_character":0,"end_line":325,"end_character":59},"in_reply_to":"3f79a3b5_c060e437","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":328,"context_line":"Dependencies"},{"line_number":329,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"* Special hardware which supports SEV for development, testing, and CI"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"* Recent versions of the Linux kernel, QEMU, and libvirt which all support"},{"line_number":334,"context_line":"  SEV"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_9ab1fbe6","line":331,"range":{"start_line":331,"start_character":68,"end_line":331,"end_character":70},"updated":"2018-10-17 19:39:55.000000000","message":"Umm, upstream CI isn\u0027t going to test this, right? We likely don\u0027t have the hardware for it. And I assume SUSE isn\u0027t going to be standing up 3rd party CI just for this.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":328,"context_line":"Dependencies"},{"line_number":329,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"* Special hardware which supports SEV for development, testing, and CI"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"* Recent versions of the Linux kernel, QEMU, and libvirt which all support"},{"line_number":334,"context_line":"  SEV"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_f8bca26c","line":331,"range":{"start_line":331,"start_character":68,"end_line":331,"end_character":70},"in_reply_to":"3f79a3b5_9ab1fbe6","updated":"2018-10-18 16:53:20.000000000","message":"ICBW but I think SUSE could probably sort this out; at least that sounds like the most sensible approach to me.  I\u0027ll check though.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":330,"context_line":""},{"line_number":331,"context_line":"* Special hardware which supports SEV for development, testing, and CI"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"* Recent versions of the Linux kernel, QEMU, and libvirt which all support"},{"line_number":334,"context_line":"  SEV"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_7a973f3b","line":333,"updated":"2018-10-17 19:39:55.000000000","message":"Would be good to list the specific minimum required versions here - and not distro package versions, source code versions.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":330,"context_line":""},{"line_number":331,"context_line":"* Special hardware which supports SEV for development, testing, and CI"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"* Recent versions of the Linux kernel, QEMU, and libvirt which all support"},{"line_number":334,"context_line":"  SEV"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_78a89220","line":333,"in_reply_to":"3f79a3b5_7a973f3b","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"eab2ecef6d97c87c9116459bc43d204607152351","unresolved":false,"context_lines":[{"line_number":354,"context_line":"There may be small issues to address due to hard-coded assumptions"},{"line_number":355,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"Tempest tests could also be included if SEV hardware is available, either"},{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_5aab6370","line":358,"range":{"start_line":357,"start_character":0,"end_line":358,"end_character":34},"updated":"2018-10-17 19:39:55.000000000","message":"I guess it\u0027s fine to say this, but I don\u0027t think it\u0027s ever going to happen.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"53259e503d52c949957756a81d50295d189bbfc7","unresolved":false,"context_lines":[{"line_number":354,"context_line":"There may be small issues to address due to hard-coded assumptions"},{"line_number":355,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"Tempest tests could also be included if SEV hardware is available, either"},{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_e04160a9","line":358,"range":{"start_line":357,"start_character":0,"end_line":358,"end_character":34},"in_reply_to":"3f79a3b5_5aab6370","updated":"2018-10-17 21:30:10.000000000","message":"Tempest itself would never do it, as it\u0027s not something we can assert from the Nova REST API. 3rd party CI with a Tempest whitebox-y type plugin would be the best best, if someone ponies up the resources.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":354,"context_line":"There may be small issues to address due to hard-coded assumptions"},{"line_number":355,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"Tempest tests could also be included if SEV hardware is available, either"},{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_b86b8aee","line":358,"range":{"start_line":357,"start_character":0,"end_line":358,"end_character":34},"in_reply_to":"3f79a3b5_e04160a9","updated":"2018-10-18 16:53:20.000000000","message":"Again I would hope SUSE can offer this, but ICBW since I haven\u0027t discussed that internally yet.","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"036167e09006ae34373d5b9c32a319f6555e8f91","unresolved":false,"context_lines":[{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"},{"line_number":362,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"- The `KVM section of the Configuration Guide"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_3bbc6906","line":361,"updated":"2018-10-17 21:56:54.000000000","message":"We\u0027ll also want a feature support matrix entry since this is virt driver specific:\n\nhttps://docs.openstack.org/nova/latest/user/support-matrix.html","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"6bf232a93f3fdb0be6e6fc26a43ab4d78d539882","unresolved":false,"context_lines":[{"line_number":358,"context_line":"in the gate or via third-party CI."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"Documentation Impact"},{"line_number":362,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"- The `KVM section of the Configuration Guide"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3f79a3b5_f84a6280","line":361,"in_reply_to":"3f79a3b5_3bbc6906","updated":"2018-10-18 16:53:20.000000000","message":"Done","commit_id":"4c5d56db3b5711122c91d562dcd0120306ca7898"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"0be6c9d10ba88d763bfa73d882fb434f2a13cce0","unresolved":false,"context_lines":[{"line_number":99,"context_line":"- When present in the flavor, this standard trait would indicate that"},{"line_number":100,"context_line":"  the libvirt driver should include extra XML in the guest\u0027s domain"},{"line_number":101,"context_line":"  definition, to enable SEV security, ensure that the VM uses machine"},{"line_number":102,"context_line":"  type ``q35`` and UEFI via OVMF, and that ``iommu_platform\u003don`` is"},{"line_number":103,"context_line":"  used for all virtio devices, e.g.::"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"      \u003cdomain type\u003d\u0027kvm\u0027\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3f79a3b5_26117ff9","line":102,"updated":"2018-10-19 21:04:25.000000000","message":"\u0027iommu_platform\u003don\u0027 is the qemu option. From libvirt perspective it\u0027s an \u0027iommu\u0027 attribute on the device\u0027s \u003cdriver\u003e element, e.g.\n\n  \u003crng model\u003d\u0027virtio\u0027\u003e\n    \u003cdriver iommu\u003d\u0027on\u0027/\u003e\n    ...\n  \u003c/rng\u003e","commit_id":"fc440707db630c69838b034634011e17c57a407e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"1b1ee98bc9bb32c738d5423ca642a7e300bc7d2a","unresolved":false,"context_lines":[{"line_number":99,"context_line":"- When present in the flavor, this standard trait would indicate that"},{"line_number":100,"context_line":"  the libvirt driver should include extra XML in the guest\u0027s domain"},{"line_number":101,"context_line":"  definition, to enable SEV security, ensure that the VM uses machine"},{"line_number":102,"context_line":"  type ``q35`` and UEFI via OVMF, and that ``iommu_platform\u003don`` is"},{"line_number":103,"context_line":"  used for all virtio devices, e.g.::"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"      \u003cdomain type\u003d\u0027kvm\u0027\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3f79a3b5_e4492d2f","line":102,"in_reply_to":"3f79a3b5_26117ff9","updated":"2018-10-22 10:41:21.000000000","message":"Done","commit_id":"fc440707db630c69838b034634011e17c57a407e"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"0be6c9d10ba88d763bfa73d882fb434f2a13cce0","unresolved":false,"context_lines":[{"line_number":114,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":115,"context_line":"          \u003cpolicy\u003e0x0037\u003c/policy\u003e"},{"line_number":116,"context_line":"        \u003c/launchSecurity\u003e"},{"line_number":117,"context_line":"        ..."},{"line_number":118,"context_line":"      \u003c/domain\u003e"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  SEV requires a Q35 machine type.  If this cannot be satisfied by"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3f79a3b5_e6daa71a","line":117,"updated":"2018-10-19 21:04:25.000000000","message":"A hard memory limit must also be set. I\u0027d suggest vm-mem-size+512M. E.g. assuming a 4G instance\n\n  \u003cmemtune\u003e\n    \u003chard_limit unit\u003d\u0027KiB\u0027\u003e4718592\u003c/hard_limit\u003e\n  \u003c/memtune\u003e","commit_id":"fc440707db630c69838b034634011e17c57a407e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"1b1ee98bc9bb32c738d5423ca642a7e300bc7d2a","unresolved":false,"context_lines":[{"line_number":114,"context_line":"          \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":115,"context_line":"          \u003cpolicy\u003e0x0037\u003c/policy\u003e"},{"line_number":116,"context_line":"        \u003c/launchSecurity\u003e"},{"line_number":117,"context_line":"        ..."},{"line_number":118,"context_line":"      \u003c/domain\u003e"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  SEV requires a Q35 machine type.  If this cannot be satisfied by"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3f79a3b5_a45d75ec","line":117,"in_reply_to":"3f79a3b5_e6daa71a","updated":"2018-10-22 10:41:21.000000000","message":"Done","commit_id":"fc440707db630c69838b034634011e17c57a407e"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"0be6c9d10ba88d763bfa73d882fb434f2a13cce0","unresolved":false,"context_lines":[{"line_number":302,"context_line":"  that the various layers are all SEV ready:"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"  - kernel \u003e\u003d 4.16"},{"line_number":305,"context_line":"  - QEMU \u003e\u003d 12"},{"line_number":306,"context_line":"  - libvirt \u003e\u003d 4.5"},{"line_number":307,"context_line":"  - ovmf \u003d\u003e commit 75b7aa9528bd 2018-07-06"},{"line_number":308,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3f79a3b5_a6810ffd","line":305,"updated":"2018-10-19 21:04:25.000000000","message":"QEMU \u003e\u003d 2.12","commit_id":"fc440707db630c69838b034634011e17c57a407e"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"1b1ee98bc9bb32c738d5423ca642a7e300bc7d2a","unresolved":false,"context_lines":[{"line_number":302,"context_line":"  that the various layers are all SEV ready:"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"  - kernel \u003e\u003d 4.16"},{"line_number":305,"context_line":"  - QEMU \u003e\u003d 12"},{"line_number":306,"context_line":"  - libvirt \u003e\u003d 4.5"},{"line_number":307,"context_line":"  - ovmf \u003d\u003e commit 75b7aa9528bd 2018-07-06"},{"line_number":308,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3f79a3b5_a40255b8","line":305,"in_reply_to":"3f79a3b5_a6810ffd","updated":"2018-10-22 10:41:21.000000000","message":"Oops, good catch thanks! Fixed.","commit_id":"fc440707db630c69838b034634011e17c57a407e"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_x86_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_1a5fe010","line":95,"range":{"start_line":95,"start_character":9,"end_line":95,"end_character":31},"updated":"2018-10-22 12:38:07.000000000","message":"probably just go with HW_CPU_AMD_SEV, unless this is an Intel-specific instruction set extension? (I don\u0027t believe it is...)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_x86_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_c0cada6d","line":95,"range":{"start_line":95,"start_character":9,"end_line":95,"end_character":31},"in_reply_to":"3f79a3b5_1a5fe010","updated":"2018-10-22 13:31:14.000000000","message":"Done","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_9a3450ad","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"updated":"2018-10-22 12:38:07.000000000","message":"This is going to be a problem for resource accounting in a way that is similar to the problem we currently have with placement not tracking the \"overhead\" values for both main memory as well as emulator thread CPU consumption.\n\nWe should discuss this thoroughly. Essentially what this is doing is forcing a completely untracked consumption of resources but only for images that require the AMD SEV trait.\n\nThe flavor consumes, e.g. 24G, of MEMORY_MB resources. This consumption is tracked by the placement service in conjunction with the scheduler\u0027s call to claim_resources() which atomically consumes the resources from a provider\u0027s inventory (from the compute node\u0027s inventory of MEMORY_MB resources).\n\nWith images requiring the AMD SEV trait, we will need to dynamically increase the amount of MEMORY_MB being requested from placement. This amount will differ from the flavor\u0027s published amount of memory consumed, which means that any deployer using flavors to do their capacity management (yes, this is a terrible idea but apparently it\u0027s common practice) will have a skewed idea of how much capacity they have in their cloud (because the flavor doesn\u0027t account for an accurate picture of the consumed memory... it\u0027s now the combination of image and flavor that determines the memory consumption of an instance).\n\nJust something to think about.\n\nNote that our \"solution\" for the overhead problem was just to say to deployers \"alright, set the reserved amount for the relevant inventory to some safe value\". In other words, if the deployer saw that, on average, a compute host was getting 10 VMs that consumed 40G of memory and the hypervisor on that host typically used 128M of memory for each guest, then set the reserved amount for the MEMORY_MB inventory on the host to something like 2GB (1280MB plus some space for safety).\n\nA similar \"solution\" for AMD SEV-capable hosts could be recommended. If a host is AMD SEV-capable, then take a guess at how many guests would typically occupy that host and just set the reserved amount of MEMORY_MB on that host to (512M*$NUM_GUESTS + $SAFETY_AMOUNT) and problem \"solved\" :)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"413fe54efe88640271a250fec681a56db1b28d5f","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_6eea850d","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_0b152e9b","updated":"2018-10-25 13:17:02.000000000","message":"In PS13 I\u0027ve added some wording to the spec clarifying all this.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"8b547ce460664092b20ee898224668d6fc313d94","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_e389031e","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_14c7b09a","updated":"2018-10-23 14:33:06.000000000","message":"\u003e \u003e You\u0027re affecting consumed resources outside of the scope of the\n \u003e flavor itself, and since (especially public) clouds billed based on\n \u003e the flavor, you\u0027re allowing a vector for the user to consume more\n \u003e resources than they are paying for.\n \u003e \n \u003e Maybe I didn\u0027t explain my suggestion correctly, because that\u0027s not\n \u003e the case.  If the user launches an instance from an image with an\n \u003e SEV trait and a flavor with 4GB of RAM, then the VM would be 3.5GB\n \u003e with 4GB hard limit.  The user is still paying for 4GB, it\u0027s just\n \u003e that they won\u0027t get as much usable memory inside the VM as if they\n \u003e launched a normal non-SEV instance, because SEV overhead is\n \u003e factored into their costs.\n\nAh, I see now...\n\nSo, are you proposing (in this spec) that the virt driver will need to be changed to do memory resource accounting differently?\n\nIn other words, will the libvirt.xml that gets written for a 4GB instance that uses AMD SEV be modified to write this section:\n\n  \u003chard_limit unit\u003d\u0027KiB\u0027\u003e4718592\u003c/hard_limit\u003e\n\nwith only some fraction of the flavor\u0027s memory KiB amount so that the host/hypervisor memory overhead for dealing with AMD SEV will be accounted for some other way?\n\n \u003e \u003e 2) by reducing the flavor size by 512M of memory\n \u003e \n \u003e Ah no - that\u0027s not what I was proposing.  The flavor size would\n \u003e stay the same.\n \u003e \n \u003e \u003e that the hypervisor will need to do the on-the-fly\n \u003e encrypt/decrypt of the guest memory\n \u003e \n \u003e Do you know for sure that\u0027s what it\u0027s needed for?\n\nNo, I was just guessing :)\n\n \u003e  I\u0027m still trying\n \u003e to get a confirmation from the SEV gods, but maybe you already read\n \u003e some docs I didn\u0027t :)  So far I was told that it\u0027s not necessarily\n \u003e (significantly) more overhead than what is required for normal\n \u003e non-SEV instances, but that it needs to be explicitly stated via\n \u003e hard_limit because all the memory needs to be locked down to\n \u003e prevent swapping.  I asked why \u003clocked/\u003e is not required, and the\n \u003e suspicion is that QEMU\u0027s SEV code implicitly triggers the locking. \n \u003e But I can seek further clarification on all this.\n \u003e \n \u003e \u003e you\u0027re still going to need to account for that memory consumption\n \u003e *somewhere*.\n \u003e \n \u003e Sure - I\u0027m suggesting it could be included in the accounting for\n \u003e the flavor.\n \u003e \n \u003e \u003e The reserved amount for an inventory record is used for this\n \u003e purpose. The tricky part here is that it\u0027s essentially a dynamic\n \u003e reservation thing (since it\u0027s really per-instance). Which is why I\n \u003e suggest making it a static reservation thing (at config time by\n \u003e setting the CONF.reserved_host_memory_mb option value). The static\n \u003e reservation approach won\u0027t be super accurate (because you will need\n \u003e to guesstimate how many instances using AMD SEV will go to the host\n \u003e and then add in a little buffer for safety). But it\u0027s a more\n \u003e reasonable approach than trying to dynamically change the reserved\n \u003e MEMORY_MB inventory for the host every time an instance launches.\n \u003e \n \u003e I don\u0027t disagree with any of that.  I\u0027m just wondering if we can\n \u003e avoid the fudge where we reserve $GUESSTIMATE of memory by\n \u003e attributing the ownership (and hence associated costs) of the\n \u003e overhead back to the user who triggered it.  Having said that, if\n \u003e it\u0027s not significantly more overhead than for a normal guest then\n \u003e maybe we can just stick with the existing static reservation\n \u003e approach.  Hopefully the SEV gurus can shed some light here which\n \u003e will guide us in the right direction.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"e2c9fa8de03e1d10d6f2a63ddb50aa1fadfa485a","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_71686b87","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_14c7b09a","updated":"2018-10-22 22:30:28.000000000","message":"Ah, just got a reply moments after posting that last comment:\n\n\u003e The rlimit should cover both guest memory space and io memory space. IIRC, for vfio case libvirt take total guest memory and adds 1G to it to cover all other IO address space. If you want then enable the SEV tracing in QEMU, this can tell us exactly how much memory is getting pinned. Note that just by increasing the rlimit does not mean that guest launch will pin all the memory. We pin the memory only if qemu creates a address space.\n\nHowever I don\u0027t know what rlimit means in this context, so I\u0027ve asked for clarification.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"8b547ce460664092b20ee898224668d6fc313d94","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_63c6534d","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_71686b87","updated":"2018-10-23 14:33:06.000000000","message":"\u003e Ah, just got a reply moments after posting that last comment:\n \u003e \n \u003e \u003e The rlimit should cover both guest memory space and io memory\n \u003e space. IIRC, for vfio case libvirt take total guest memory and adds\n \u003e 1G to it to cover all other IO address space. If you want then\n \u003e enable the SEV tracing in QEMU, this can tell us exactly how much\n \u003e memory is getting pinned. Note that just by increasing the rlimit\n \u003e does not mean that guest launch will pin all the memory. We pin the\n \u003e memory only if qemu creates a address space.\n \u003e \n \u003e However I don\u0027t know what rlimit means in this context, so I\u0027ve\n \u003e asked for clarification.\n\nI don\u0027t either. Perhaps they mean the resource limit on the qemu-kvm processes that comprise guest vCPU threads? If that\u0027s the case, wouldn\u0027t each qemu-kvm process need a separate rlimit specified?","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_e0d036c9","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_9a3450ad","updated":"2018-10-22 13:31:14.000000000","message":"Hmm, oh dear - very good points here!\n\nBut why not just set the VM memory size to be the flavor size *minus* the 512MB required by SEV?  Then there would be no \"stolen\" memory we would have to worry about reserving to avoid overcommit.  Maybe I\u0027m missing something.  But I\u0027ve just mailed our SEV / libvirt experts with that suggestion, in case it\u0027s not a totally idiotic idea :-)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d1bc4cb916ec568d2ff760ae9aef5a0a4fb92b3e","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_e3a7e050","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_e0d036c9","updated":"2018-10-22 13:54:04.000000000","message":"Couple things:\n\n1) what about images that have the AMD SEV trait but not the flavor? :) You\u0027re affecting consumed resources outside of the scope of the flavor itself, and since (especially public) clouds billed based on the flavor, you\u0027re allowing a vector for the user to consume more resources than they are paying for.\n\n2) by reducing the flavor size by 512M of memory that the hypervisor will need to do the on-the-fly encrypt/decrypt of the guest memory, you\u0027re still going to need to account for that memory consumption *somewhere*. The reserved amount for an inventory record is used for this purpose. The tricky part here is that it\u0027s essentially a dynamic reservation thing (since it\u0027s really per-instance). Which is why I suggest making it a static reservation thing (at config time by setting the CONF.reserved_host_memory_mb option value). The static reservation approach won\u0027t be super accurate (because you will need to guesstimate how many instances using AMD SEV will go to the host and then add in a little buffer for safety). But it\u0027s a more reasonable approach than trying to dynamically change the reserved MEMORY_MB inventory for the host every time an instance launches.\n\nhope that makes sense...","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"49a33525f8a54248fce66894f8a259eae9543988","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_0b152e9b","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_e389031e","updated":"2018-10-23 21:12:10.000000000","message":"\u003e Ah, I see now...\n\u003e \n\u003e So, are you proposing (in this spec) that the virt driver will need to be changed to do memory resource accounting differently?\n\nWell sort of, although since I have just received a lot more details from the SEV gods, I\u0027d now describe it more of a change in memory resource *management* rather than accounting.  Here are the pertinent highlights:\n\n\u003e There is *no* additional memory requirement for SEV guest. What you are seeing is, memory need to be pinned for an SEV guest, we attempt to pin all the memory regions allocated by Qemu. The pinning logic check for rlimit and if we exceed the rlimit then kernel fail to pin the memory.\n\u003e \n\u003e [...]\n\u003e \n\u003e In summary, we are not needing any *extra* memory, we just need to pin memory allocated by Qemu to support the VM. In non SEV case we don\u0027t have to pin hence you don\u0027t notice how much extra memory gets allocated to support a guest VM.\n\nReturning to your questions ...\n\n\u003e In other words, will the libvirt.xml that gets written for a 4GB instance that uses AMD SEV be modified to write this section:\n\u003e \n\u003e     \u003chard_limit unit\u003d\u0027KiB\u0027\u003e4718592\u003c/hard_limit\u003e\n\nYes, I think that\u0027s correct, now that we know the larger hard_limit is only required for locking.  Previously I had in mind that if a 4GB flavor was chosen, \u003chard_limit\u003e would be 4GB and \u003cmemory\u003e (and perhaps \u003cmaxMemory\u003e) would be 3.5GB, but that was based on the mistaken assumption that SEV instances incur more overhead than non-SEV.  So from the perspectives of the user and the operator, nothing needs to change here in terms of accounting or reservation; it\u0027s only the virt driver which needs to take care of locking sufficient memory.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"41fcc0c31028f2a60a747da214e90d622a57dfd3","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":105,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":106,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":107,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_14c7b09a","line":107,"range":{"start_line":106,"start_character":4,"end_line":107,"end_character":55},"in_reply_to":"3f79a3b5_e3a7e050","updated":"2018-10-22 22:24:48.000000000","message":"\u003e 1) what about images that have the AMD SEV trait but not the flavor? :)\n\nSame thing - take the memory size of the flavor at launch-time, and reserve 512MB (or whatever\u0027s needed) of that for SEV\u0027s extra demands.\n\n\u003e You\u0027re affecting consumed resources outside of the scope of the flavor itself, and since (especially public) clouds billed based on the flavor, you\u0027re allowing a vector for the user to consume more resources than they are paying for.\n\nMaybe I didn\u0027t explain my suggestion correctly, because that\u0027s not the case.  If the user launches an instance from an image with an SEV trait and a flavor with 4GB of RAM, then the VM would be 3.5GB with 4GB hard limit.  The user is still paying for 4GB, it\u0027s just that they won\u0027t get as much usable memory inside the VM as if they launched a normal non-SEV instance, because SEV overhead is factored into their costs.\n\n\u003e 2) by reducing the flavor size by 512M of memory\n\nAh no - that\u0027s not what I was proposing.  The flavor size would stay the same.\n\n\u003e that the hypervisor will need to do the on-the-fly encrypt/decrypt of the guest memory\n\nDo you know for sure that\u0027s what it\u0027s needed for?  I\u0027m still trying to get a confirmation from the SEV gods, but maybe you already read some docs I didn\u0027t :)  So far I was told that it\u0027s not necessarily (significantly) more overhead than what is required for normal non-SEV instances, but that it needs to be explicitly stated via hard_limit because all the memory needs to be locked down to prevent swapping.  I asked why \u003clocked/\u003e is not required, and the suspicion is that QEMU\u0027s SEV code implicitly triggers the locking.  But I can seek further clarification on all this.\n\n\u003e you\u0027re still going to need to account for that memory consumption *somewhere*.\n\nSure - I\u0027m suggesting it could be included in the accounting for the flavor.\n\n\u003e The reserved amount for an inventory record is used for this purpose. The tricky part here is that it\u0027s essentially a dynamic reservation thing (since it\u0027s really per-instance). Which is why I suggest making it a static reservation thing (at config time by setting the CONF.reserved_host_memory_mb option value). The static reservation approach won\u0027t be super accurate (because you will need to guesstimate how many instances using AMD SEV will go to the host and then add in a little buffer for safety). But it\u0027s a more reasonable approach than trying to dynamically change the reserved MEMORY_MB inventory for the host every time an instance launches.\n\nI don\u0027t disagree with any of that.  I\u0027m just wondering if we can avoid the fudge where we reserve $GUESSTIMATE of memory by attributing the ownership (and hence associated costs) of the overhead back to the user who triggered it.  Having said that, if it\u0027s not significantly more overhead than for a normal guest then maybe we can just stick with the existing static reservation approach.  Hopefully the SEV gurus can shed some light here which will guide us in the right direction.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":141,"context_line":"  If SEV\u0027s requirement of a Q35 machine type cannot be satisfied by"},{"line_number":142,"context_line":"  ``hw_machine_type`` specified by the image (if present), or the"},{"line_number":143,"context_line":"  default specified by ``CONF.libvirt.hw_machine_type``, then an"},{"line_number":144,"context_line":"  exception should be raised so that the build fails."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  ``cbitpos`` and ``reducedPhysBits`` are hypervisor-dependent, and"},{"line_number":147,"context_line":"  can be obtained through the ``sev`` element from the domain"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_ba4eec36","line":144,"updated":"2018-10-22 12:38:07.000000000","message":"++","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        ..."},{"line_number":139,"context_line":"      \u003c/domain\u003e"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  If SEV\u0027s requirement of a Q35 machine type cannot be satisfied by"},{"line_number":142,"context_line":"  ``hw_machine_type`` specified by the image (if present), or the"},{"line_number":143,"context_line":"  default specified by ``CONF.libvirt.hw_machine_type``, then an"},{"line_number":144,"context_line":"  exception should be raised so that the build fails."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  ``cbitpos`` and ``reducedPhysBits`` are hypervisor-dependent, and"},{"line_number":147,"context_line":"  can be obtained through the ``sev`` element from the domain"},{"line_number":148,"context_line":"  capabilities."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  ``policy`` allows a particular SEV policy, as documented in `the AMD"},{"line_number":151,"context_line":"  SEV-KM API Specification`.  Initially the policy will be hardcoded"},{"line_number":152,"context_line":"  and not modifiable by cloud tenants or cloud operators. The policy"},{"line_number":153,"context_line":"  will be::"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    #define SEV_POLICY_NORM \\"},{"line_number":156,"context_line":"        ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":157,"context_line":"          SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  which equates to ``0x0037``.  This permits migration to other"},{"line_number":160,"context_line":"  machines in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":161,"context_line":"  SEV-ES, but doesn\u0027t permit other guests or the hypervisor to"},{"line_number":162,"context_line":"  directly inspect memory.  If the upstream support for SEV-ES does"},{"line_number":163,"context_line":"  not arrive in time then SEV-ES will be not be included in the"},{"line_number":164,"context_line":"  policy."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  A future spec could be submitted to make this configurable via an"},{"line_number":167,"context_line":"  extra spec or image property."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"  For reference, `the AMDSEV GitHub repository"},{"line_number":170,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/\u003e`_ provides `a complete example"},{"line_number":171,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/blob/master/xmls/sample.xml\u003e`_ of"},{"line_number":172,"context_line":"  a domain\u0027s XML definition with `libvirt\u0027s SEV options"},{"line_number":173,"context_line":"  \u003chttps://libvirt.org/formatdomain.html#sev\u003e`_ enabled."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"This work could also mean that images with the property"},{"line_number":176,"context_line":"``trait:HW_CPU_x86_AMD_SEV\u003drequired`` would similarly affect the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_5a5798ca","line":173,"range":{"start_line":141,"start_character":0,"end_line":173,"end_character":56},"updated":"2018-10-22 12:38:07.000000000","message":"nit... this set of paragraphs needs to be de-indented one space","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"41fcc0c31028f2a60a747da214e90d622a57dfd3","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        ..."},{"line_number":139,"context_line":"      \u003c/domain\u003e"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  If SEV\u0027s requirement of a Q35 machine type cannot be satisfied by"},{"line_number":142,"context_line":"  ``hw_machine_type`` specified by the image (if present), or the"},{"line_number":143,"context_line":"  default specified by ``CONF.libvirt.hw_machine_type``, then an"},{"line_number":144,"context_line":"  exception should be raised so that the build fails."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  ``cbitpos`` and ``reducedPhysBits`` are hypervisor-dependent, and"},{"line_number":147,"context_line":"  can be obtained through the ``sev`` element from the domain"},{"line_number":148,"context_line":"  capabilities."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  ``policy`` allows a particular SEV policy, as documented in `the AMD"},{"line_number":151,"context_line":"  SEV-KM API Specification`.  Initially the policy will be hardcoded"},{"line_number":152,"context_line":"  and not modifiable by cloud tenants or cloud operators. The policy"},{"line_number":153,"context_line":"  will be::"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    #define SEV_POLICY_NORM \\"},{"line_number":156,"context_line":"        ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":157,"context_line":"          SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  which equates to ``0x0037``.  This permits migration to other"},{"line_number":160,"context_line":"  machines in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":161,"context_line":"  SEV-ES, but doesn\u0027t permit other guests or the hypervisor to"},{"line_number":162,"context_line":"  directly inspect memory.  If the upstream support for SEV-ES does"},{"line_number":163,"context_line":"  not arrive in time then SEV-ES will be not be included in the"},{"line_number":164,"context_line":"  policy."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  A future spec could be submitted to make this configurable via an"},{"line_number":167,"context_line":"  extra spec or image property."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"  For reference, `the AMDSEV GitHub repository"},{"line_number":170,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/\u003e`_ provides `a complete example"},{"line_number":171,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/blob/master/xmls/sample.xml\u003e`_ of"},{"line_number":172,"context_line":"  a domain\u0027s XML definition with `libvirt\u0027s SEV options"},{"line_number":173,"context_line":"  \u003chttps://libvirt.org/formatdomain.html#sev\u003e`_ enabled."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"This work could also mean that images with the property"},{"line_number":176,"context_line":"``trait:HW_CPU_x86_AMD_SEV\u003drequired`` would similarly affect the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_af40e933","line":173,"range":{"start_line":141,"start_character":0,"end_line":173,"end_character":56},"in_reply_to":"3f79a3b5_0368dcf1","updated":"2018-10-22 22:24:48.000000000","message":"Hrm, that kind of makes the next two words below (\"This work\") look like they refer to just one or two of the preceding paragraphs, rather than the whole bulleted list.  Rather than bikeshedding further I\u0027ll outdent and change those two words to something more explicit.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        ..."},{"line_number":139,"context_line":"      \u003c/domain\u003e"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  If SEV\u0027s requirement of a Q35 machine type cannot be satisfied by"},{"line_number":142,"context_line":"  ``hw_machine_type`` specified by the image (if present), or the"},{"line_number":143,"context_line":"  default specified by ``CONF.libvirt.hw_machine_type``, then an"},{"line_number":144,"context_line":"  exception should be raised so that the build fails."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  ``cbitpos`` and ``reducedPhysBits`` are hypervisor-dependent, and"},{"line_number":147,"context_line":"  can be obtained through the ``sev`` element from the domain"},{"line_number":148,"context_line":"  capabilities."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  ``policy`` allows a particular SEV policy, as documented in `the AMD"},{"line_number":151,"context_line":"  SEV-KM API Specification`.  Initially the policy will be hardcoded"},{"line_number":152,"context_line":"  and not modifiable by cloud tenants or cloud operators. The policy"},{"line_number":153,"context_line":"  will be::"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    #define SEV_POLICY_NORM \\"},{"line_number":156,"context_line":"        ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":157,"context_line":"          SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  which equates to ``0x0037``.  This permits migration to other"},{"line_number":160,"context_line":"  machines in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":161,"context_line":"  SEV-ES, but doesn\u0027t permit other guests or the hypervisor to"},{"line_number":162,"context_line":"  directly inspect memory.  If the upstream support for SEV-ES does"},{"line_number":163,"context_line":"  not arrive in time then SEV-ES will be not be included in the"},{"line_number":164,"context_line":"  policy."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  A future spec could be submitted to make this configurable via an"},{"line_number":167,"context_line":"  extra spec or image property."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"  For reference, `the AMDSEV GitHub repository"},{"line_number":170,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/\u003e`_ provides `a complete example"},{"line_number":171,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/blob/master/xmls/sample.xml\u003e`_ of"},{"line_number":172,"context_line":"  a domain\u0027s XML definition with `libvirt\u0027s SEV options"},{"line_number":173,"context_line":"  \u003chttps://libvirt.org/formatdomain.html#sev\u003e`_ enabled."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"This work could also mean that images with the property"},{"line_number":176,"context_line":"``trait:HW_CPU_x86_AMD_SEV\u003drequired`` would similarly affect the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_e0f9164f","line":173,"range":{"start_line":141,"start_character":0,"end_line":173,"end_character":56},"in_reply_to":"3f79a3b5_5a5798ca","updated":"2018-10-22 13:31:14.000000000","message":"Well, I did choose that indentation level deliberately, because all those paragraphs relate to the same bullet item concerning the changes to libvirt XML.  But if you still prefer them to be outdented after taking that into account, then I don\u0027t have any strong objection.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d1bc4cb916ec568d2ff760ae9aef5a0a4fb92b3e","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        ..."},{"line_number":139,"context_line":"      \u003c/domain\u003e"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  If SEV\u0027s requirement of a Q35 machine type cannot be satisfied by"},{"line_number":142,"context_line":"  ``hw_machine_type`` specified by the image (if present), or the"},{"line_number":143,"context_line":"  default specified by ``CONF.libvirt.hw_machine_type``, then an"},{"line_number":144,"context_line":"  exception should be raised so that the build fails."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  ``cbitpos`` and ``reducedPhysBits`` are hypervisor-dependent, and"},{"line_number":147,"context_line":"  can be obtained through the ``sev`` element from the domain"},{"line_number":148,"context_line":"  capabilities."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  ``policy`` allows a particular SEV policy, as documented in `the AMD"},{"line_number":151,"context_line":"  SEV-KM API Specification`.  Initially the policy will be hardcoded"},{"line_number":152,"context_line":"  and not modifiable by cloud tenants or cloud operators. The policy"},{"line_number":153,"context_line":"  will be::"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    #define SEV_POLICY_NORM \\"},{"line_number":156,"context_line":"        ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":157,"context_line":"          SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  which equates to ``0x0037``.  This permits migration to other"},{"line_number":160,"context_line":"  machines in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":161,"context_line":"  SEV-ES, but doesn\u0027t permit other guests or the hypervisor to"},{"line_number":162,"context_line":"  directly inspect memory.  If the upstream support for SEV-ES does"},{"line_number":163,"context_line":"  not arrive in time then SEV-ES will be not be included in the"},{"line_number":164,"context_line":"  policy."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  A future spec could be submitted to make this configurable via an"},{"line_number":167,"context_line":"  extra spec or image property."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"  For reference, `the AMDSEV GitHub repository"},{"line_number":170,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/\u003e`_ provides `a complete example"},{"line_number":171,"context_line":"  \u003chttps://github.com/AMDESE/AMDSEV/blob/master/xmls/sample.xml\u003e`_ of"},{"line_number":172,"context_line":"  a domain\u0027s XML definition with `libvirt\u0027s SEV options"},{"line_number":173,"context_line":"  \u003chttps://libvirt.org/formatdomain.html#sev\u003e`_ enabled."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"This work could also mean that images with the property"},{"line_number":176,"context_line":"``trait:HW_CPU_x86_AMD_SEV\u003drequired`` would similarly affect the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_0368dcf1","line":173,"range":{"start_line":141,"start_character":0,"end_line":173,"end_character":56},"in_reply_to":"3f79a3b5_e0f9164f","updated":"2018-10-22 13:54:04.000000000","message":"Yeah, probably best to de-indent...","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":195,"context_line":"     \u003chttps://docs.openstack.org/osc-placement/latest/cli/index.html#resource-provider-trait-set\u003e`_"},{"line_number":196,"context_line":"     to each compute node which is SEV-capable."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"   This would have the advantages of decreasing the amount of effort"},{"line_number":199,"context_line":"   required in order to reach a functional prototype, and giving"},{"line_number":200,"context_line":"   operators the flexibility to choose on which compute hosts SEV"},{"line_number":201,"context_line":"   should be allowed.  But conversely it has the disadvantages of"},{"line_number":202,"context_line":"   requiring merging of hardcoded references to a custom trait into"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_7ab294ea","line":199,"range":{"start_line":198,"start_character":37,"end_line":199,"end_character":52},"updated":"2018-10-22 12:38:07.000000000","message":"meh, it\u0027s pretty easy to get a trait added to os-traits :)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":195,"context_line":"     \u003chttps://docs.openstack.org/osc-placement/latest/cli/index.html#resource-provider-trait-set\u003e`_"},{"line_number":196,"context_line":"     to each compute node which is SEV-capable."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"   This would have the advantages of decreasing the amount of effort"},{"line_number":199,"context_line":"   required in order to reach a functional prototype, and giving"},{"line_number":200,"context_line":"   operators the flexibility to choose on which compute hosts SEV"},{"line_number":201,"context_line":"   should be allowed.  But conversely it has the disadvantages of"},{"line_number":202,"context_line":"   requiring merging of hardcoded references to a custom trait into"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_009a1212","line":199,"range":{"start_line":198,"start_character":37,"end_line":199,"end_character":52},"in_reply_to":"3f79a3b5_7ab294ea","updated":"2018-10-22 13:31:14.000000000","message":"OK, have toned down this advantage a bit :-)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":222,"context_line":"   Boolean toggle, using a single trait remains consistent with `a"},{"line_number":223,"context_line":"   pre-existing upstream agreement on how to specify options that"},{"line_number":224,"context_line":"   impact scheduling and configuration"},{"line_number":225,"context_line":"   \u003chttp://lists.openstack.org/pipermail/openstack-dev/2018-October/135446.html\u003e`_."},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"#. Rather than using a standard trait, a normal flavor extra spec"},{"line_number":228,"context_line":"   could be used to require the SEV feature; however it is understood"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_1ac12031","line":225,"updated":"2018-10-22 12:38:07.000000000","message":"++ :)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":229,"context_line":"   that `this approach is less preferable because traits provide"},{"line_number":230,"context_line":"   consistent naming for CPU features in some virt drivers, and"},{"line_number":231,"context_line":"   querying traits is efficient"},{"line_number":232,"context_line":"   \u003chttps://docs.openstack.org/nova/latest/admin/configuration/schedulers.html#computecapabilitiesfilter\u003e`_."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Data model impact"},{"line_number":235,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_5ae478df","line":232,"updated":"2018-10-22 12:38:07.000000000","message":"right, and traits bring scheduling/placement into the picture, which is what you want here.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":281,"context_line":"image UUID in it.  The consumer could look up the image by UUID to"},{"line_number":282,"context_line":"check for the presence of the SEV trait, although this does open up a"},{"line_number":283,"context_line":"potential race window where image properties could change after the"},{"line_number":284,"context_line":"instance was created.  This could be remedied by future work which"},{"line_number":285,"context_line":"would include image properties in the instance launch notification."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Other end user impact"},{"line_number":288,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_7a5cd47f","line":285,"range":{"start_line":284,"start_character":23,"end_line":285,"end_character":67},"updated":"2018-10-22 12:38:07.000000000","message":"or storing the image metadata in instance_extra like we do for the flavor. we do this for the flavor metadata because flavors can be changed/deleted after launching an instance with that flavor...","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":281,"context_line":"image UUID in it.  The consumer could look up the image by UUID to"},{"line_number":282,"context_line":"check for the presence of the SEV trait, although this does open up a"},{"line_number":283,"context_line":"potential race window where image properties could change after the"},{"line_number":284,"context_line":"instance was created.  This could be remedied by future work which"},{"line_number":285,"context_line":"would include image properties in the instance launch notification."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Other end user impact"},{"line_number":288,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_80a62254","line":285,"range":{"start_line":284,"start_character":23,"end_line":285,"end_character":67},"in_reply_to":"3f79a3b5_7a5cd47f","updated":"2018-10-22 13:31:14.000000000","message":"Done","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":384,"context_line":""},{"line_number":385,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":386,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":387,"context_line":"   error caught and handled."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"Future work"},{"line_number":390,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_fafd443c","line":387,"updated":"2018-10-22 12:38:07.000000000","message":"Don\u0027t forget docs!","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":384,"context_line":""},{"line_number":385,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":386,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":387,"context_line":"   error caught and handled."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"Future work"},{"line_number":390,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_2044ee72","line":387,"in_reply_to":"3f79a3b5_fafd443c","updated":"2018-10-22 13:31:14.000000000","message":"Done","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":392,"context_line":"Looking beyond Stein, there is scope for several strands of additional"},{"line_number":393,"context_line":"work for enriching nova\u0027s SEV support:"},{"line_number":394,"context_line":""},{"line_number":395,"context_line":"- Extend the `ComputeCapabilitiesFilter"},{"line_number":396,"context_line":"  \u003chttps://docs.openstack.org/ocata/config-reference/compute/schedulers.html#computecapabilitiesfilter\u003e`_"},{"line_number":397,"context_line":"  scheduler filter to support scheduler hints, so that SEV can be"},{"line_number":398,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":399,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"- Make the SEV policy configurable via an extra spec or image"},{"line_number":402,"context_line":"  property."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_9a9210fb","line":399,"range":{"start_line":395,"start_character":2,"end_line":399,"end_character":56},"updated":"2018-10-22 12:38:07.000000000","message":"This wouldn\u0027t involve the ComputeCapabilitiesFilter, FYI. I think what you\u0027re referring to here is simply the ability for a user to specify they require HW_CPU_AMD_SEV on the `openstack server create` command line (instead of requiring it via the flavor or image).\n\nThe ComputeCapabilitiesFilter would not come into play if traits are used, since the placement service would have already filtered hosts that contain the required trait.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"41fcc0c31028f2a60a747da214e90d622a57dfd3","unresolved":false,"context_lines":[{"line_number":392,"context_line":"Looking beyond Stein, there is scope for several strands of additional"},{"line_number":393,"context_line":"work for enriching nova\u0027s SEV support:"},{"line_number":394,"context_line":""},{"line_number":395,"context_line":"- Extend the `ComputeCapabilitiesFilter"},{"line_number":396,"context_line":"  \u003chttps://docs.openstack.org/ocata/config-reference/compute/schedulers.html#computecapabilitiesfilter\u003e`_"},{"line_number":397,"context_line":"  scheduler filter to support scheduler hints, so that SEV can be"},{"line_number":398,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":399,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"- Make the SEV policy configurable via an extra spec or image"},{"line_number":402,"context_line":"  property."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_cf78c52d","line":399,"range":{"start_line":395,"start_character":2,"end_line":399,"end_character":56},"in_reply_to":"3f79a3b5_2607261a","updated":"2018-10-22 22:24:48.000000000","message":"\u003e No worries. Yeah, the compute capabilities filter doesn\u0027t deal with scheduler hints.\n\nYeah, I spotted that when looking at the code.  But it seemed like the most logical place to add a new hint which is concerned specifically with a type of compute capability, so that\u0027s why I was suggesting it.  But that was based on a (probably mistaken) assumption that there was no other mechanism available for specifying CPU-level requirements at instance launch-time - on that topic please see my questions below at the end of this comment.\n\n\u003e It actually looks at the collection of goop that is thrown into the compute_nodes.stats field. This field is populated by the virt driver with things like the cpu model and (in the case of Ironic) a whole bunch of vendor-specific goop). The ComputeCapabilitiesFilter then looks through that goop to determine if there are matching flavor extra specs for the key/values shoved into compute_nodes.stats.\n\nI\u0027d figured out the flavor extra specs bit, but thanks for the extra info :)\n\n\u003e It\u0027s a mess and definitely not related to scheduler hints :) Avoid\n\u003e if possible.\n\nOK sure, I\u0027m fine with that - but I still don\u0027t quite get how what you\u0027re proposing would work, probably because I\u0027m not too familiar with the placement service yet.  Hence my previous questions:\n\n\u003e Are you saying that because in this case we would have a standard\n\u003e trait, the placement service would automatically honour traits\n\u003e specified on the VM at launch-time, therefore scheduler hints would\n\u003e be totally unnecessary?  If so, which parameter to `openstack\n\u003e server create` would facilitate specification of the required trait\n\u003e - I\u0027m guessing `--property`?\n\nSorry for the newbie request, but any chance of a bit of extra clarity on these? :)  I didn\u0027t spot anything obvious when trawling through the docs.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d1bc4cb916ec568d2ff760ae9aef5a0a4fb92b3e","unresolved":false,"context_lines":[{"line_number":392,"context_line":"Looking beyond Stein, there is scope for several strands of additional"},{"line_number":393,"context_line":"work for enriching nova\u0027s SEV support:"},{"line_number":394,"context_line":""},{"line_number":395,"context_line":"- Extend the `ComputeCapabilitiesFilter"},{"line_number":396,"context_line":"  \u003chttps://docs.openstack.org/ocata/config-reference/compute/schedulers.html#computecapabilitiesfilter\u003e`_"},{"line_number":397,"context_line":"  scheduler filter to support scheduler hints, so that SEV can be"},{"line_number":398,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":399,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"- Make the SEV policy configurable via an extra spec or image"},{"line_number":402,"context_line":"  property."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_2607261a","line":399,"range":{"start_line":395,"start_character":2,"end_line":399,"end_character":56},"in_reply_to":"3f79a3b5_63e75047","updated":"2018-10-22 13:54:04.000000000","message":"No worries. Yeah, the compute capabilities filter doesn\u0027t deal with scheduler hints. It actually looks at the collection of goop that is thrown into the compute_nodes.stats field. This field is populated by the virt driver with things like the cpu model and (in the case of Ironic) a whole bunch of vendor-specific goop). The ComputeCapabilitiesFilter then looks through that goop to determine if there are matching flavor extra specs for the key/values shoved into compute_nodes.stats.\n\nIt\u0027s a mess and definitely not related to scheduler hints :) Avoid if possible.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":392,"context_line":"Looking beyond Stein, there is scope for several strands of additional"},{"line_number":393,"context_line":"work for enriching nova\u0027s SEV support:"},{"line_number":394,"context_line":""},{"line_number":395,"context_line":"- Extend the `ComputeCapabilitiesFilter"},{"line_number":396,"context_line":"  \u003chttps://docs.openstack.org/ocata/config-reference/compute/schedulers.html#computecapabilitiesfilter\u003e`_"},{"line_number":397,"context_line":"  scheduler filter to support scheduler hints, so that SEV can be"},{"line_number":398,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":399,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"- Make the SEV policy configurable via an extra spec or image"},{"line_number":402,"context_line":"  property."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_63e75047","line":399,"range":{"start_line":395,"start_character":2,"end_line":399,"end_character":56},"in_reply_to":"3f79a3b5_9a9210fb","updated":"2018-10-22 13:31:14.000000000","message":"I guess I\u0027m reaching the limits of my current nova knowledge here.  I based this item on my understanding of\n\nhttps://github.com/openstack/nova/blob/88951ca98e1b286b58aa1ad94f9af40b8260c01f/nova/api/openstack/compute/schemas/servers.py#L93\n\nwhich defines the various scheduler hints available in the `_hints` variable, and a perhaps incorrect assumption that scheduler hints would be the only way to specify required VM characteristics at launch-time.  AFAICS each of these hints is honoured by a scheduler filter, so I assumed `ComputeCapabilitiesFilter` would be the logical choice of filter to extend.\n\nAre you saying that because in this case we would have a standard trait, the placement service would automatically honour traits specified on the VM at launch-time, therefore scheduler hints would be totally unnecessary?  If so, which parameter to `openstack server create` would facilitate specification of the required trait - I\u0027m guessing `--property`?","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":398,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":399,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"- Make the SEV policy configurable via an extra spec or image"},{"line_number":402,"context_line":"  property."},{"line_number":403,"context_line":""},{"line_number":404,"context_line":"- Provide some mechanism by which users can access the attestation"},{"line_number":405,"context_line":"  measurement provided by SEV\u0027s ``LAUNCH_MEASURE`` command, in order"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_7ab85477","line":402,"range":{"start_line":401,"start_character":0,"end_line":402,"end_character":11},"updated":"2018-10-22 12:38:07.000000000","message":"I\u0027d avoid this unless it\u0027s really something end-users are clamoring for.","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":398,"context_line":"  chosen to be enabled per instance, eliminating the need for"},{"line_number":399,"context_line":"  operators to configure SEV-specific flavors or images."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"- Make the SEV policy configurable via an extra spec or image"},{"line_number":402,"context_line":"  property."},{"line_number":403,"context_line":""},{"line_number":404,"context_line":"- Provide some mechanism by which users can access the attestation"},{"line_number":405,"context_line":"  measurement provided by SEV\u0027s ``LAUNCH_MEASURE`` command, in order"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_23cab89f","line":402,"range":{"start_line":401,"start_character":0,"end_line":402,"end_character":11},"in_reply_to":"3f79a3b5_7ab85477","updated":"2018-10-22 13:31:14.000000000","message":"Done","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":436,"context_line":"  configuration, e.g. within"},{"line_number":437,"context_line":"  ``nova.tests.unit.virt.libvirt.test_config``"},{"line_number":438,"context_line":""},{"line_number":439,"context_line":"There may be small issues to address due to hard-coded assumptions"},{"line_number":440,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"Tempest tests could also be included if SEV hardware is available, either"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_9a60d00e","line":439,"range":{"start_line":439,"start_character":5,"end_line":439,"end_character":12},"updated":"2018-10-22 12:38:07.000000000","message":"uhm, I\u0027m going to go out on a limb and say there *definitely* will be issues... :)","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"b8f11f1ea5d2bdd585d3b5b0a589de26b329909e","unresolved":false,"context_lines":[{"line_number":436,"context_line":"  configuration, e.g. within"},{"line_number":437,"context_line":"  ``nova.tests.unit.virt.libvirt.test_config``"},{"line_number":438,"context_line":""},{"line_number":439,"context_line":"There may be small issues to address due to hard-coded assumptions"},{"line_number":440,"context_line":"oriented towards Intel CPUs either in Nova code or its tests."},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"Tempest tests could also be included if SEV hardware is available, either"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_033c5c90","line":439,"range":{"start_line":439,"start_character":5,"end_line":439,"end_character":12},"in_reply_to":"3f79a3b5_9a60d00e","updated":"2018-10-22 13:31:14.000000000","message":"Done","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3f291ab89304c9267a53f9bd8aeea959f8d33b14","unresolved":false,"context_lines":[{"line_number":466,"context_line":"  providing and consuming SEV functionality."},{"line_number":467,"context_line":""},{"line_number":468,"context_line":"- The `\"Useful image properties\" section of the Glance Administration Guide \u003chttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\u003e`_"},{"line_number":469,"context_line":"  should have details of the new trait added."},{"line_number":470,"context_line":""},{"line_number":471,"context_line":""},{"line_number":472,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3f79a3b5_da75e8ca","line":469,"updated":"2018-10-22 12:38:07.000000000","message":"Awesome work listing the docs affected. ++","commit_id":"49a349f69f1f9d96a14ebfca21e2e4e6a5ef9a26"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c1c7f66a85bc8758dcd61680798b58c78a5479ba","unresolved":false,"context_lines":[{"line_number":28,"context_line":"stored information such as sensitive data, passwords, or secret keys"},{"line_number":29,"context_line":"can be easily compromised."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"AMD\u0027s SEV offers a VM protection technology which transparently"},{"line_number":32,"context_line":"encrypts the memory of each VM with a unique key.  It can also"},{"line_number":33,"context_line":"calculate a signature of the memory contents, which can be sent to the"},{"line_number":34,"context_line":"VM\u0027s owner as an attestation that the memory was encrypted correctly"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_d3d84e25","line":31,"range":{"start_line":31,"start_character":0,"end_line":31,"end_character":10},"updated":"2018-10-23 19:04:22.000000000","message":"out of interest would this be similar to booting a vm useing intel SGX secure memeory enclaves to back teh guest memory.\n\nor is this differet. i think with SGX the memory is not encrypted but its not acessable by the host kernel.\n\nin this case i guess it is accesable from the hosts kernel but its encrypted?","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"f18071a2fb078c6d121f22a982169408d00ce2e9","unresolved":false,"context_lines":[{"line_number":28,"context_line":"stored information such as sensitive data, passwords, or secret keys"},{"line_number":29,"context_line":"can be easily compromised."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"AMD\u0027s SEV offers a VM protection technology which transparently"},{"line_number":32,"context_line":"encrypts the memory of each VM with a unique key.  It can also"},{"line_number":33,"context_line":"calculate a signature of the memory contents, which can be sent to the"},{"line_number":34,"context_line":"VM\u0027s owner as an attestation that the memory was encrypted correctly"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_8b813ea3","line":31,"range":{"start_line":31,"start_character":0,"end_line":31,"end_character":10},"in_reply_to":"3f79a3b5_d3d84e25","updated":"2018-10-23 21:40:21.000000000","message":"I believe you\u0027re correct, with the loud disclaimer that I am very far from being an expert in either technology :)","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c1c7f66a85bc8758dcd61680798b58c78a5479ba","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_33e8a2a5","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"updated":"2018-10-23 19:04:22.000000000","message":"is this the corerct namespace\ni would expect this to be HW_CPU_X86_SEV","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"fab1c8806ffcf22ed78e79c4d6f063cc553d2342","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_2b14aa41","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"in_reply_to":"3f79a3b5_1e47ada6","updated":"2018-10-23 20:45:09.000000000","message":"Bryan, it\u0027s all these that we\u0027re referring to here:\n\nhttps://github.com/openstack/os-traits/blob/master/os_traits/hw/cpu/x86.py\n\nYou\u0027ll note that aarch64 has some CPU instruction set extensions as well:\n\nhttps://github.com/openstack/os-traits/blob/master/os_traits/hw/cpu/aarch64.py\n\n(some of which are very similar to the x86 ones).\n\nSo, I think it\u0027s appropriate to separate the AMD-specific instruction set extensions to its own namespace.\n\nBest,\n\n-jay","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"f18071a2fb078c6d121f22a982169408d00ce2e9","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_eb15524d","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"in_reply_to":"3f79a3b5_2b14aa41","updated":"2018-10-23 21:40:21.000000000","message":"I have no strong opinion here (I included `_X86_` in the original version of the spec and then dropped it at Jay\u0027s suggestion) - but at risk of bike-shedding, I see that `x86.py` contains both Intel-specific (`VMX`) and AMD-specific (`SVM`) traits.  If we introduce an AMD-specific namespace then presumably we should move `SVM` to it to, which would then require moving `VMX` to an Intel-specific one for consistency.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"80c39cb2910f5abce4e2aa06b324b7445bcc4673","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_bd13ff59","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"in_reply_to":"3f79a3b5_2b14aa41","updated":"2018-10-25 00:43:11.000000000","message":"Thanks for the pointers, Jay. Much appreciated.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1b54fd91af82ced9e3867c1ea6e11d24ce346561","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_de7ff566","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"in_reply_to":"3f79a3b5_33e8a2a5","updated":"2018-10-23 19:12:11.000000000","message":"It\u0027s not an Intel instruction set extension, though, right? It\u0027s an AMD CPU instruction set extension...","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"7026091746ef34cadc5fa354217dfc2140686cde","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_1e47ada6","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"in_reply_to":"3f79a3b5_de7ff566","updated":"2018-10-23 19:34:40.000000000","message":"It is not an Intel extension. It is an AMD only extension. But I will note that some people use the three characters \"X86\" to mean any Intel compatible CPUs, even from other vendors. I am not sure what the convention is in this context.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"343a6108bd07fc45ac70f7f0933c5281c985aa55","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- Support a standard trait which would be automatically detected per"},{"line_number":94,"context_line":"  compute host based on the above logic.  This would most likely be"},{"line_number":95,"context_line":"  called ``HW_CPU_AMD_SEV`` or similar, as an extension of `the"},{"line_number":96,"context_line":"  existing CPU traits mapping"},{"line_number":97,"context_line":"  \u003chttps://github.com/openstack/nova/blob/c5a7002bd571379818c0108296041d12bc171728/nova/virt/libvirt/utils.py#L47\u003e`_."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_017aedee","line":95,"range":{"start_line":95,"start_character":11,"end_line":95,"end_character":25},"in_reply_to":"3f79a3b5_eb15524d","updated":"2018-10-23 23:17:09.000000000","message":"so the x86 namespace is not intend for intel only traits. it is intened to be for any traits related to x86 instruction set and all its extentiosn.\n\nthat said iam going to change my view on this back to\n\nthis should be HW_CPU_AMD_SEV or HW_CPU_SEV becasue thi is not a instuction set extention.\n\nfrom reading\nhttps://developer.amd.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf\n\n this is a plathform feature which is enabled by \nseting bit 47 in phyical page address to 1 to enable encytion \nwhich is done using aes encryption on the cortex A5 coprcessor on all data reads and write for that address using a key genreated on boot.\n\nso because this is a plathfrom feature and not x86 instruction set extention the original namespce is fine.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c1c7f66a85bc8758dcd61680798b58c78a5479ba","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":108,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":109,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_d374ce06","line":107,"range":{"start_line":107,"start_character":3,"end_line":107,"end_character":61},"updated":"2018-10-23 19:04:22.000000000","message":"does this require teh guest to have a vIOMMU?\n\nif so that should be a seperate spec as there are other usecase that require the ablity to enable teh iommu.\n\nif not related to the qeum vIOMMU feature does this require\nhost iommu support? if so we will need a HW_CPU_IOMMU trait for this also.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"822e6f1d35c3ded8d31df3358b9efece5280dcd7","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":108,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":109,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_524ddc39","line":107,"range":{"start_line":107,"start_character":3,"end_line":107,"end_character":61},"in_reply_to":"3f79a3b5_2edef86a","updated":"2018-10-26 00:24:59.000000000","message":"so there are two topic here.\n\nmy original question said another way was\nto set iommu\u003d\"on\" in the driver element does\nthe guesst need to have a viommu device.\nhttps://libvirt.org/formatdomain.html#elementsIommu\n\nor does it just need the host to have an iommu.\n\na  HW_CPU_IOMMU trait to me is asking for the vm to be scheuldied to a host with an iommu.\n\nthat is a difernet thing form asking qemu to emulate an iommue by addign the viommu element to the domain xml.\n\nthe vIOMMU element reuquire the q35 machine type to be used and is required to be able to use a iommu within the guest.\nit enables features such as the use of vfio in the guest and is needed for some features unrelated to SEV but is not supported yet in nova.\n\nif you need to be able to enable the vIOMMU to make SEV work i want to make sure we can do the explicitly without enabling SEV so that we dont have to implement it again later.\n\nif you dont need a vIOMMU in the guest and jsut need to tell qemu to configure the hosts iommu by seting the dirver option then that is fine but i just want to carify if the guest will have acess to a emulated iommu or not.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"502e420b48267c118b24d0093bb675e206ad9ce1","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":108,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":109,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_16b978c3","line":107,"range":{"start_line":107,"start_character":3,"end_line":107,"end_character":61},"in_reply_to":"3f79a3b5_524ddc39","updated":"2018-11-01 16:52:47.000000000","message":"\u003e so there are two topic here.\n\u003e \n\u003e my original question said another way was to set iommu\u003d\"on\" in the driver element does the guesst need to have a viommu device.\n\u003e\n\u003e https://libvirt.org/formatdomain.html#elementsIommu\n\u003e \n\u003e or does it just need the host to have an iommu.\n\nI asked one of our experts at SUSE about this, and got the answer that it doesn\u0027t require a vIOMMU device *or* even a host with IOMMU.  And this answer was confirmed by AMD engineers in a call we had a few moments ago.\n\n\u003e a HW_CPU_IOMMU trait to me is asking for the vm to be scheuldied to a host with an iommu.\n\u003e \n\u003e that is a difernet thing form asking qemu to emulate an iommue by addign the viommu element to the domain xml.\n\nRight.\n\n\u003e the vIOMMU element reuquire the q35 machine type to be used and is required to be able to use a iommu within the guest.  it enables features such as the use of vfio in the guest and is needed for some features unrelated to SEV but is not supported yet in nova.\n\u003e \n\u003e if you need to be able to enable the vIOMMU to make SEV work i want to make sure we can do the explicitly without enabling SEV so that we dont have to implement it again later.\n\u003e \n\u003e if you dont need a vIOMMU in the guest and jsut need to tell qemu to configure the hosts iommu by seting the dirver option then that is fine but i just want to carify if the guest will have acess to a emulated iommu or not.\n\nThe exact info I got from our SUSE guy was:\n\n\u003e this setting needs enabling on virtual (virtio) devices. It enables the virtio flag which indicates \"DMA should be used for this device\". Without the setting virtio will \"share\" IO buffers between host and guest, which doesn\u0027t work since the memory is encrypted. With the setting virtio will use \"virtualizaed DMA\", which ties into the SEV code to do the {en,de}cryption.\n\nAnd again this was corroborated by AMD in the call just now.  Apparently `iommu` is a bit of a misnomer for this attribute, since really it refers to DMA usage rather than IOMMU specifically.\n\nI\u0027ll submit a new patch set 14 soon which will clarify this.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"f18071a2fb078c6d121f22a982169408d00ce2e9","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":108,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":109,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_2edef86a","line":107,"range":{"start_line":107,"start_character":3,"end_line":107,"end_character":61},"in_reply_to":"3f79a3b5_9e75fd88","updated":"2018-10-23 21:40:21.000000000","message":"If SEV requires vIOMMU (which I suspect it does), then any SEV-capable machine with the SEV trait would automatically also have an IOMMU trait, if such a trait was implemented.  It seems unlikely AMD would manufacture chipsets with SEV functionality built in but neutered due to lack of vIOMMU support.\n\nTherefore whilst I have no reason to doubt that a separate spec and workstream defining an IOMMU trait is valid, it seems to me that it could be done orthogonally to the SEV work.\n\nHaving said all that, I can double-check with the SEV gurus.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1b54fd91af82ced9e3867c1ea6e11d24ce346561","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices."},{"line_number":108,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":109,"context_line":"    has been suggested by one of the libvirt engineers."},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_9e75fd88","line":107,"range":{"start_line":107,"start_character":3,"end_line":107,"end_character":61},"in_reply_to":"3f79a3b5_d374ce06","updated":"2018-10-23 19:12:11.000000000","message":"yeah, agreed we could use an IOMMU trait...","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c1c7f66a85bc8758dcd61680798b58c78a5479ba","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_736ffaf9","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"updated":"2018-10-23 19:04:22.000000000","message":"well i think this is unaviodable.\n\nthe use of encrypted memory will leak via the flavor simply via requesting this feature to be enabled using the trait.\n\nas a result any mechanium other then a virt driver config option will mandate that an enduser can tell if there vm is encrypted using sev.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"413fe54efe88640271a250fec681a56db1b28d5f","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_2387c6b5","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_1d0b1322","updated":"2018-10-25 13:17:02.000000000","message":"Yes I wouldn\u0027t be too surprised if it doesn\u0027t prevent side-channel attacks yet.  There are other attack vectors too, e.g.\n\nhttps://www.theregister.co.uk/2018/05/25/amd_epyc_sev_vm_encryption_bypass/\n\nwhich AMD claim to be working on fixing.  That\u0027s why the top of this spec says\n\n\u003e [...] it can reduce the amount of trust VMs need to place in the hypervisor and administrator of their host system\n\nrather than\n\n\u003e [...] it can eliminate the need for VMs to trust the hypervisor and administrator of their host system\n\n:-)\n\nNevertheless this spec is for planning the technical implementation, so hopefully it doesn\u0027t also need to capture an in-depth analysis of the maturity of the underlying technology ;-)","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"4cc7bc051a5953d3237ff23af2c1b8ec1eeae596","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_a17bf928","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_6e1dd00e","updated":"2018-10-23 22:38:42.000000000","message":"My thought is that people who are concerned that they want to keep the choice of using an encrypted VM secret are overly paranoid. But I have interacted with many overly paranoid users/customers. I recommend just planning that people can\u0027t keep that a secret and changing the text in this paragraph to the following:\n\nThis change does not add or handle any secret information other than of course data within the guest VM\u0027s encrypted memory. The choice to encrypt a VM or not may be considered somewhat sensitive information in some environments, but the information regarding whether or not a specific VM is encrypted will be available to the operator of the cloud and anyone who can view the log files.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"f18071a2fb078c6d121f22a982169408d00ce2e9","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_6e1dd00e","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_736ffaf9","updated":"2018-10-23 21:40:21.000000000","message":"The trait could be specified on the image rather than the flavor, in which case access to the image\u0027s metadata could be limited to a particular project.  Similarly if SEV is requested per-instance rather than via the CPU trait on the  flavor or image used.  But yeah this text (which I didn\u0027t write) seems more concerned with hiding the choice to use SEV from the operator, which doesn\u0027t seem realistic anyway, since they can simply look at the libvirt domain definition.  @Bryan, any thoughts here?","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"413fe54efe88640271a250fec681a56db1b28d5f","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_c35e1250","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_a17bf928","updated":"2018-10-25 13:17:02.000000000","message":"\u003e I recommend just planning that people can\u0027t keep that a secret and changing the text in this paragraph to the following:\n\u003e \n\u003e This change does not add or handle any secret information other than of course data within the guest VM\u0027s encrypted memory. The choice to encrypt a VM or not may be considered somewhat sensitive information in some environments, but the information regarding whether or not a specific VM is encrypted will be available to the operator of the cloud and anyone who can view the log files.\n\nDone.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"343a6108bd07fc45ac70f7f0933c5281c985aa55","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_e12c91b3","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_a17bf928","updated":"2018-10-23 23:17:09.000000000","message":"diging into https://developer.amd.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf\na little more its rather unfortunate that the cypher used to generate the aes key is generated using a NIST SP 800-90A complient random number generator as a sources as it is has previously been show that the NSA inserted a backdoor into \nthe NIST SP 800-90A standard.\n\nthe other factor to be aware of is that this encryption only takes effect between the l3 cache and dram so while the data is sitting in l1-l3 cache it is decrypted and vulnerable to  modification or observation by a mechanism that is able to acess thoses cache regions.\n\nbased on this fact SEV would  not provide protection in the case of the L1TF vulnerabilities or the specter/meltdown speculative execution exploits that were able to leverage cache sharing to exfiltrate data.\n\nso we should be very clear that this does not provide host level ioslatio at the cache level simply encryptes data on stores to dram and decyptes it on reads.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"502e420b48267c118b24d0093bb675e206ad9ce1","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_f1eb510e","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_b2deb039","updated":"2018-11-01 16:52:47.000000000","message":"Yes thanks, this is good feedback.\n\nIn the call with AMD just now, I asked for and received clarification on the level of security which SEV provides.  So I\u0027ll address your feedback in in patch set 14 by working with one of my colleagues to provide more clarity around the expectations regarding security set both a) within the spec and b) by the documentation which the spec requests.\n\nThe paragraph immediately below this one already recommends that the OpenStack Security Group are involved throughout the whole process, but if you have further recommendations on how to improve the workflow the spec describes so that everyone including operators are properly informed, please don\u0027t hesitate to let me know.\n\nStay tuned for patch set 14 :-)","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"822e6f1d35c3ded8d31df3358b9efece5280dcd7","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_b2deb039","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_c35e1250","updated":"2018-10-26 00:24:59.000000000","message":"i was not suggesting we do a security analysis here. i for one am not qualified to do so but rather i just wanted to highlight some cursory observation to make sure that any messaging we do in documentation or discussion of the feature\ndo not miss lead operators.\n\nsomeone who has not looked into how the feature works could assume that since the vms memory is encrypted that no one could observer the contence of the memeory but since the processor cache is not encyrpted if you can observer the contence of the cache you can reconstruct the memory of the guest.\n\nso this was more asking that any release notes and docs related to this be reviewed by open stack security team and subject mater experts for accuracy to not imply more security then is actully offered.\n\nif you do respin it would be nice to sate specifclly that data in the proceor cache is not encypeted in any way so that\nother reviews dont have to read the white papers on this feautre to figure that out for themselves.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"80c39cb2910f5abce4e2aa06b324b7445bcc4673","unresolved":false,"context_lines":[{"line_number":251,"context_line":"Security impact"},{"line_number":252,"context_line":"---------------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"This change does not add or handle any secret information (other than"},{"line_number":255,"context_line":"of course data within the guest VM\u0027s encrypted memory).  The choice to"},{"line_number":256,"context_line":"encrypt a VM or not may be considered somewhat sensitive information"},{"line_number":257,"context_line":"in some environments, but this information will be logged to"},{"line_number":258,"context_line":"facilitate troubleshooting in cases where the SEV functionality is"},{"line_number":259,"context_line":"suspected of causing an issue.  If user feedback indicates that this"},{"line_number":260,"context_line":"information should not be logged then this decision could be changed"},{"line_number":261,"context_line":"in future."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"It is strongly recommended that `the OpenStack Security Group"},{"line_number":264,"context_line":"\u003copenstack-security@lists.openstack.org\u003e`_ is kept in the loop and"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3f79a3b5_1d0b1322","line":261,"range":{"start_line":254,"start_character":0,"end_line":261,"end_character":10},"in_reply_to":"3f79a3b5_e12c91b3","updated":"2018-10-25 00:43:11.000000000","message":"The AMD hardware RNG uses the CTR_DRBG construct from SP 800-90A which has not been found to be susceptible to any back doors AFAIK. It is much simpler and uses AES counter mode to generate the random numbers. I have found that simplicity is generally good for security so this is good news in my view.","commit_id":"7218c8f5eb86af452b0d6baddb76aef569815e8f"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    This functionality-oriented check should preempt the need for any"},{"line_number":84,"context_line":"    version checking in the driver."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev`` should have the value ``1``"},{"line_number":87,"context_line":"    to indicate that the kernel has SEV capabilities enabled.  This"},{"line_number":88,"context_line":"    should be readable by any user (i.e. even non-root)."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  Note that both checks are required, since the presence of the first"},{"line_number":91,"context_line":"  does not imply the second."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_14bdf765","line":88,"range":{"start_line":86,"start_character":0,"end_line":88,"end_character":56},"updated":"2018-11-09 15:42:54.000000000","message":"I\u0027m assuming we\u0027ll just check this once on startup in order to provide the trait in the update_provider_tree() method. If the operator needs to change the value in /sys/module/kvm_amd/parameters/sev to disable support, they can restart the compute service to flush the change.\n\nYou don\u0027t need to be explicit in the spec since this is an implementation detail, I\u0027m just curious.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    This functionality-oriented check should preempt the need for any"},{"line_number":84,"context_line":"    version checking in the driver."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev`` should have the value ``1``"},{"line_number":87,"context_line":"    to indicate that the kernel has SEV capabilities enabled.  This"},{"line_number":88,"context_line":"    should be readable by any user (i.e. even non-root)."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  Note that both checks are required, since the presence of the first"},{"line_number":91,"context_line":"  does not imply the second."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_ffddaf6d","line":88,"range":{"start_line":86,"start_character":0,"end_line":88,"end_character":56},"in_reply_to":"3f79a3b5_14bdf765","updated":"2018-11-10 00:24:58.000000000","message":"That sounds entirely reasonable to me.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices.  Despite"},{"line_number":108,"context_line":"    the name, this does not require the guest or host to have an IOMMU"},{"line_number":109,"context_line":"    device, but merely enables the virtio flag which indicates that"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_34511332","line":106,"range":{"start_line":106,"start_character":41,"end_line":106,"end_character":54},"updated":"2018-11-09 15:42:54.000000000","message":"Huh, is this bug 1607400 still valid?\n\nNote there are a couple of other UEFI bugs, not sure how those will interact with this:\n\nhttps://bugs.launchpad.net/nova/+bug/1785123\n\nhttps://bugs.launchpad.net/nova/+bug/1633447\n\nIn other words, are those going to be dependencies for this feature, i.e. would we be building a house on sand if we don\u0027t fix those pretty glaring looking bugs first?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"85daeb50a478fdee28f4348f74a236c880a11baf","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices.  Despite"},{"line_number":108,"context_line":"    the name, this does not require the guest or host to have an IOMMU"},{"line_number":109,"context_line":"    device, but merely enables the virtio flag which indicates that"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_aed12bfc","line":106,"range":{"start_line":106,"start_character":41,"end_line":106,"end_character":54},"in_reply_to":"3f79a3b5_29f76490","updated":"2018-11-13 23:01:46.000000000","message":"ACK - working to get more clarity on this.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices.  Despite"},{"line_number":108,"context_line":"    the name, this does not require the guest or host to have an IOMMU"},{"line_number":109,"context_line":"    device, but merely enables the virtio flag which indicates that"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_9fb03bfe","line":106,"range":{"start_line":106,"start_character":41,"end_line":106,"end_character":54},"in_reply_to":"3f79a3b5_34511332","updated":"2018-11-10 00:24:58.000000000","message":"Very good points.  I\u0027m pretty sure Dirk or one of our other colleagues fixed 1607400 ages ago, but yes we should check :)  Regarding 1785123, cold migration shouldn\u0027t be an issue since qemu/libvirt don\u0027t support this yet, but I\u0027ll try to find out about resize.  1633447 could be an issue.  For all of these, SUSE already has a team of specialists assembled who should have the expertise to address them whether at kernel / qemu / libvirt / OpenStack level.  Plus of course AMD has pledged support.  So I\u0027m pretty confident these can be dealt with, but I will highlight these issues with the relevant folks to mitigate risk.  Of course I\u0027m more than happy to discuss in Berlin next week too.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"aecc26e638d01a1e04672b8730d012fe5e2e2652","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  - SEV security is enabled."},{"line_number":104,"context_line":"  - The boot disk cannot be ``virtio-blk`` (due to a resource constraint"},{"line_number":105,"context_line":"    w.r.t. bounce buffers)."},{"line_number":106,"context_line":"  - The VM uses machine type ``q35`` and UEFI via OVMF."},{"line_number":107,"context_line":"  - The ``iommu`` attribute is ``on`` for all virtio devices.  Despite"},{"line_number":108,"context_line":"    the name, this does not require the guest or host to have an IOMMU"},{"line_number":109,"context_line":"    device, but merely enables the virtio flag which indicates that"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_29f76490","line":106,"range":{"start_line":106,"start_character":41,"end_line":106,"end_character":54},"in_reply_to":"3f79a3b5_9fb03bfe","updated":"2018-11-12 14:09:58.000000000","message":"if cold migration cant be supported with sev \nit would be good to call that out specifcaly in the spec.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_b40be32a","line":113,"updated":"2018-11-09 15:42:54.000000000","message":"\u003e Therefore no changes in\n    memory accounting or reservation should be required.\n\nIn other words, we don\u0027t need to account for memory_mb overhead here?\n\nhttps://github.com/openstack/nova/blob/e27905f482ba26d2bbf3ae5d948dee37523042d5/nova/virt/libvirt/driver.py#L779\n\nHow do we set the hard memory limit then? And what do we set it to? Flavor.ram + 512? If so, wouldn\u0027t that be an overhead which we need to track for usage?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"aecc26e638d01a1e04672b8730d012fe5e2e2652","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_2c53f26f","line":113,"in_reply_to":"3f79a3b5_1c4c27c7","updated":"2018-11-12 14:09:58.000000000","message":"tl;dr we cant assume 512MB is the correct value in all cases.\n\ndefineing correct for that specific config value require prior knoladge of the workload that will be deployed on that node as the overhead is dependent on the vm configuration (cores,ram, disk cache mode, vgpu ram...) so you cant assuem 512mb is always correct. \n\nfor small instance it will likely be less then that but for lage instance it can be more.\n\nin general i have usually reserved between 6GB and 8GB of space on systems with less then 128G of ram  and up to 16GB in  CONF.reserved_host_memory_mb for larger systems.\n\nthat was derived by looking at the largest and smallest instance sizes i wanted to offer, calualte how many of each they could to run on each host, spawn that target number and mesure the overhead.\n\ne.g. fill host to target amount with all smallest and all largest size an measure overhead in both cases. this give you the upper and lower bound on the overhead you can expect and usually you will reserve the upper bound form the small instance cases + a GB or two for livemigration/error cases that may need extra ram. if SEV will required significant changes to ht huristics that operators use to determin that value then we should document that however it may not need to be in the sepc.\n\nthis works im most cases but would obviously not work with special vms that have extra requests for things like large amount of video ram. e.g. setting hw_video:ram_max_mb\u003d1024\nhttps://github.com/openstack/glance/blob/master/etc/metadefs/compute-libvirt-image.json#L57-L62\n\nthe gpu ram in this case is also accounted for by the overhead and not as part of the ram of the guest. that is likely an oversight but the point im trying to make is that if SEV would effect how that memory is allocated then hard memory limit must account for that also.\n\nin orther words if the memtune value needs to include all memory regions allocated by qemu you cannot just use  flavor.ram + 512 you must also include hw_video:ram_max_mb and any other tunables that would allow adddtional memory allocations but fortunetly i belive that is the only one.\n\nthis is definitely an implementation detail however so its important to think about but i dont think we need to list every extra spec/image metadata key that could effect this calculation in the spec.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"826e44391e49d7b56f33f97b4dbc6582f0a6e895","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_4593b4a4","line":113,"in_reply_to":"3f79a3b5_1f6aeb4e","updated":"2018-11-10 02:44:32.000000000","message":"If we\u0027re claiming flavor.ram + 512, then it\u0027s an overhead, and I don\u0027t see how we can\u0027t be adjusting the overhead method in the libvirt driver.\n\nGranted, the overhead calculation stuff is part of the old-style ResourceTracker claims process in the compute service, and isn\u0027t accounted for in the placement service, nor what we allocated for MEMORY_MB during scheduling. In the past (Boston summit specifically) I believe we just shrugged it off for the most part saying operators can offset the extra untracked usage by increasing the reserved amount of inventory for the given compute node resource provider. Maybe that\u0027s what Jay was suggesting, but again, if that\u0027s the case it should definitely be documented as a thing people (operators) will need to be aware of when enabling this feature, and would be good to call it out in the spec as a reminder.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"85daeb50a478fdee28f4348f74a236c880a11baf","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_493df18b","line":113,"in_reply_to":"3f79a3b5_2c53f26f","updated":"2018-11-13 23:01:46.000000000","message":"Yeah you\u0027re right - I just got an email confirming that the 512MB figure I was previously told is incorrect.  It also confirmed what you just wrote that it will indeed require doing some calculations in order to obtain an accurate figure for the hard limit, which needs to include not just guest RAM and video RAM but also ROM, I/O space, pflash...  I\u0027m getting advice from the QEMU experts now on the best way to do this, but one idea has just been proposed is to enhance QEMU so that it performs the calculation itself and can expose the result to callers.  In the meantime, it looks like it will be necessary to also check the hw_video_ram image property which can force nova to use less video RAM than specified by hw_video:ram_max_mb (but not more):\n\nhttps://docs.openstack.org/glance/rocky/admin/useful-image-properties.html","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"818597ba6ead22cf32f58cf253e811f02f7fd1c1","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_f8edd78c","line":113,"in_reply_to":"3f79a3b5_39a5bcb3","updated":"2018-11-27 11:31:17.000000000","message":"yep i mentioned that you could use hugepages to make the guest memory suitable for DMA/memory pinning on line 118 :)\n\nit is how we avoid this mess for ovs-dpdk such that we can\npin the guest memory in place to be able to map it from ovs to enable vhost-user to work.\n\nspeaking of which if the guest memory is encrypted... this is likely to break vhost-user or any other shared memory netwroking solution meaning that any netwroking backed that used vhost-user such as  vpp, ovs-dpdk and netronomes virtio-forwarder, vrouter or snabswitch host would not work with SEV guests. \n\nthat is assuming that the virtio-net-pci device queues  that are part of the qemu frontend are encypted also. if they are not then qemu can still pass the memory mapping tables to the vhost-user backend and it can mmap the queue into its own address space. \n\ndo you know if the memory backing virtio-net devices are also encypted? i assume they would have to not be encrypted for stardard kernel vhost to work also but it would be good to confirm.\n\nin anycase i think just requiring huge pages would simplify this alot. that said i have been trying to remove that requiremnt for a while for ovs-dpdk so i can understand wanted to support a fall back. we should ensure that the nova code can run SEV guests with hugepages enabled also however.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"a0f89ea0d9daefba33efd1095022f7cd5ac8eee5","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_1c4c27c7","line":113,"in_reply_to":"3f79a3b5_4593b4a4","updated":"2018-11-12 11:26:48.000000000","message":"\u003e If we\u0027re claiming flavor.ram + 512, then it\u0027s an overhead, and I don\u0027t see how we can\u0027t be adjusting the overhead method in the libvirt driver.\n\nThe overhead isn\u0027t changing at all from non-SEV VMs, therefore it should already be covered by CONF.reserved_host_memory_mb (but see the final paragraph below regarding this assumption).  The libvirt domain needs adjusting purely so that *all* the memory regions allocated by QEMU (not just guest RAM but guest ROM, guest I/O space, guest pflash, guest VGA buffer etc.) get locked in memory so that they can be used by SEV.  The flavor specifies only the guest RAM, and all other memory regions are implicitly created by QEMU.\n\nThe \u003cmemtune\u003e element in libvirt will result in getrlimit / setrlimit system calls to update the resource limits.  The pinning logic checks the rlimit and if it\u0027s exceeded then the kernel will fail to pin the memory.  Therefore the rlimit set by the libvirt must ensure that it has covered all the memory regions and not just the guest RAM.\n\nIt\u0027s worth noting that when device pass-through is used in a non-SEV scenario then libvirt automatically does very similar thing.\n\nHere\u0027s an extra quote from an AMD engineer; probably more detail than is required here but reproduced just in case you\u0027re curious:\n\n\u003e VFIO does not have to pin the pflash or some of the guest ROMs (because nobody is going to perform DMA on them).  These memory regions get mapped in guest RAM and hence they must be pinned for guest boot up. E.g. pflash contains the guest BIOS and we can\u0027t let host swap the pflash memory regions while guest is booting.\n\u003e \n\u003e In simplest approach you just enable QEMU trace and see how many regions gets added. We need to pin all those regions. The SEV code registers a callback in QEMU memory subsystem. We get called when memory regions are created -- during callback we don\u0027t know memory type (RAM, ROM, ROMD).  We attempt to pin the newly created regions.  VFIO memory pin logic is inside the kernel which gets called after memory regions are created and they can be a bit smart because QEMU tells KVM the memory type while registering the memory slot with KVM.\n\nBut returning to your feedback ...\n\n\u003e Granted, the overhead calculation stuff is part of the old-style ResourceTracker claims process in the compute service, and isn\u0027t accounted for in the placement service, nor what we allocated for MEMORY_MB during scheduling. In the past (Boston summit specifically) I believe we just shrugged it off for the most part saying operators can offset the extra untracked usage by increasing the reserved amount of inventory for the given compute node resource provider.\n\nRight - but in this case there is no *extra* untracked usage, just the untracked usage which should have already been accounted for by CONF.reserved_host_memory_mb.\n\n\u003e Maybe that\u0027s what Jay was suggesting, but again, if that\u0027s the case it should definitely be documented as a thing people (operators) will need to be aware of when enabling this feature, and would be good to call it out in the spec as a reminder.\n\nEnabling SEV should not require operators to change CONF.reserved_host_memory_mb, but it will make it more important than ever that their existing reservation value is correct, so sure - I\u0027ve captured a TODO so that the next patch set will make this explicit.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"b84e4d4b208ceafff39359380220c1927d1aff7b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_d00919db","line":113,"in_reply_to":"3f79a3b5_493df18b","updated":"2018-11-21 23:05:53.000000000","message":"After instrumenting qemu to see which memory regions are locked we can be a bit more explicit wrt calculating the hard memory limit. I think a good formula is\n\nhard_limit \u003d guest RAM + guest video memory + ROMs/ACPI tables\n\nThe first two values come from VM config. ROMs/ACPI tables \u003d 10832K \u003d 4096K (UEFI ROM) + 4096K (UEFI var store) + 128K (pc.rom) + 128K (isa-bios) + 2384K (ACPI tables). I would suggest adding a few hundred kilo bytes of padding. ROM sizes have been known to change and adding some padding will accommodate that\n\nhard_limit \u003d guest RAM + guest video memory + 12832K\n\nBTW, it may have been mentioned elsewhere in this thread, but using huge pages alleviates the need for specifying \u003chard_limit\u003e.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_1f6aeb4e","line":113,"in_reply_to":"3f79a3b5_b40be32a","updated":"2018-11-10 00:24:58.000000000","message":"\u003e How do we set the hard memory limit then? And what do we set it to?\n\u003e Flavor.ram + 512?\n\nYes, that\u0027s my understanding.\n\n\u003e If so, wouldn\u0027t that be an overhead which we need\n\u003e to track for usage?\n\nI don\u0027t believe so, as per the next couple of sentences and the discussion with Jay buried in previous patch sets, which I expect would have been easy to miss.  But I have to provide the caveat that I know very little about nova\u0027s memory reservation / accounting, so that\u0027s just my best judgement based on (fairly detailed) discussions with QEMU / libvirt gurus within SUSE and AMD.  If you go through the comments on earlier patchsets you\u0027ll see some relevant quotes I provided, which I hope will set your mind at ease (at least it seemed to for Jay and felt credible to me too), but I absolutely reserve the right to be wrong ;-)","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"0b3ae1f3bbcac826e72e69c89f68c80e0a285187","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_e339d5cf","line":113,"in_reply_to":"3f79a3b5_d00919db","updated":"2018-11-23 17:45:22.000000000","message":"@Jim Thanks, that\u0027s super helpful!  Is pflash included in one of those?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"1d32564259bb2fadad3c4d012732f35c90c39c55","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_39a5bcb3","line":113,"in_reply_to":"3f79a3b5_e339d5cf","updated":"2018-11-23 22:51:49.000000000","message":"Yes. It\u0027s the 4096K UEFI variable store.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"3ccf8a3fcb530b9bbdde0258749a18ab848dbeee","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":111,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":112,"context_line":"    shared between host and guest."},{"line_number":113,"context_line":"  - A hard memory limit must also be set.  VM memory size plus 512MB"},{"line_number":114,"context_line":"    has been suggested by one of the libvirt engineers.  However this"},{"line_number":115,"context_line":"    does not reflect a requirement for additional memory; it is only"},{"line_number":116,"context_line":"    required in order to pin all the memory regions allocated by QEMU,"},{"line_number":117,"context_line":"    so that they cannot be swapped to disk.  Therefore no changes in"},{"line_number":118,"context_line":"    memory accounting or reservation should be required."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  So for example assuming a 4GB VM::"},{"line_number":121,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_fd45ed9c","line":118,"range":{"start_line":113,"start_character":2,"end_line":118,"end_character":56},"updated":"2018-11-07 19:20:23.000000000","message":"nit: you could force the pinnin of memory by using hugepages or enableing realtime priority on the cpus.\n\nin both cases we will memlock the memory so that it cannot be swapped out allowing it to be used for DMA.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":154,"context_line":"default specified by ``CONF.libvirt.hw_machine_type``, then an"},{"line_number":155,"context_line":"exception should be raised so that the build fails."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"``cbitpos`` and ``reducedPhysBits`` are hypervisor-dependent, and can"},{"line_number":158,"context_line":"be obtained through the ``sev`` element from the domain capabilities."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"``policy`` allows a particular SEV policy, as documented in `the AMD"},{"line_number":161,"context_line":"SEV-KM API Specification`.  Initially the policy will be hardcoded and"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_8f09f429","line":158,"range":{"start_line":157,"start_character":0,"end_line":158,"end_character":69},"updated":"2018-11-09 15:42:54.000000000","message":"Yup, OK: https://libvirt.org/formatdomaincaps.html#elementsSEV","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":166,"context_line":"      ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":167,"context_line":"        SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"which equates to ``0x0037``.  This permits migration to other machines"},{"line_number":170,"context_line":"in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":171,"context_line":"SEV-ES, but doesn\u0027t permit other guests or the hypervisor to directly"},{"line_number":172,"context_line":"inspect memory.  If the upstream support for SEV-ES does not arrive in"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_cf1ccc66","line":169,"range":{"start_line":169,"start_character":43,"end_line":169,"end_character":52},"updated":"2018-11-09 15:42:54.000000000","message":"Again, is bug 1785123 related to this?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"aecc26e638d01a1e04672b8730d012fe5e2e2652","unresolved":false,"context_lines":[{"line_number":166,"context_line":"      ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":167,"context_line":"        SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"which equates to ``0x0037``.  This permits migration to other machines"},{"line_number":170,"context_line":"in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":171,"context_line":"SEV-ES, but doesn\u0027t permit other guests or the hypervisor to directly"},{"line_number":172,"context_line":"inspect memory.  If the upstream support for SEV-ES does not arrive in"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_a2af09df","line":169,"range":{"start_line":169,"start_character":43,"end_line":169,"end_character":52},"in_reply_to":"3f79a3b5_37f7bc90","updated":"2018-11-12 14:09:58.000000000","message":"if migration is not supported we need to very clearly call that out and perferably list the matix of what works today and what can work in the future.\n\ni had assumed that cold migration would jsut work as for cold migration we shutdown the vm, copy the disk and then start a new vm with the copied disk and all the same ports ectra as we had previously.\n\nruntime encryption of the guest memory should not unless i missed something effect that in anyway.\n\nsimilarly snapshot/shelve should work for similar reasons. e.g. we are just storing the disk as an image and when we restore or unshelve an instance we just spawn a new vm with the same disk and in the unshvel case nics/other resouces it had orginally on a new host.\n\nevactuate we just receate the vm on different host discarding form the original disk in glance discarding all state that was present on the source node so this should jsut work also.\n\nlive migration i guess would require specific support to enable but the rest should just work right?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"85daeb50a478fdee28f4348f74a236c880a11baf","unresolved":false,"context_lines":[{"line_number":166,"context_line":"      ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":167,"context_line":"        SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"which equates to ``0x0037``.  This permits migration to other machines"},{"line_number":170,"context_line":"in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":171,"context_line":"SEV-ES, but doesn\u0027t permit other guests or the hypervisor to directly"},{"line_number":172,"context_line":"inspect memory.  If the upstream support for SEV-ES does not arrive in"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_5bc854a6","line":169,"range":{"start_line":169,"start_character":43,"end_line":169,"end_character":52},"in_reply_to":"3f79a3b5_a2af09df","updated":"2018-11-13 23:01:46.000000000","message":"Yes agreed - I think (and at least one qemu/libvirt expert agrees) everything other than live migration should work assuming we can fix the UEFI NVRAM bugs which as Matt pointed out are currently causing problems when restarting VMs.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"826e44391e49d7b56f33f97b4dbc6582f0a6e895","unresolved":false,"context_lines":[{"line_number":166,"context_line":"      ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":167,"context_line":"        SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"which equates to ``0x0037``.  This permits migration to other machines"},{"line_number":170,"context_line":"in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":171,"context_line":"SEV-ES, but doesn\u0027t permit other guests or the hypervisor to directly"},{"line_number":172,"context_line":"inspect memory.  If the upstream support for SEV-ES does not arrive in"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_e5e76044","line":169,"range":{"start_line":169,"start_character":43,"end_line":169,"end_character":52},"in_reply_to":"3f79a3b5_bfb3b7eb","updated":"2018-11-10 02:44:32.000000000","message":"\u003e I could submit yet another patch set addressing nitpicks like this, although I\u0027m slightly worried about testing everyone\u0027s patience by submitting endless patch sets in a quest for perfection ;-)\n\nSorry, I\u0027m not trying to nit pick. I\u0027m asking a lot of questions because this really sounds like an extremely limited, technical debt-ridden feature and we get burned by adding stuff like this and then not being able to close the gaps later. So I\u0027m being defensive and probing because I want to know what we\u0027re getting into before we approve it.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":166,"context_line":"      ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":167,"context_line":"        SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"which equates to ``0x0037``.  This permits migration to other machines"},{"line_number":170,"context_line":"in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":171,"context_line":"SEV-ES, but doesn\u0027t permit other guests or the hypervisor to directly"},{"line_number":172,"context_line":"inspect memory.  If the upstream support for SEV-ES does not arrive in"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_bfb3b7eb","line":169,"range":{"start_line":169,"start_character":43,"end_line":169,"end_character":52},"in_reply_to":"3f79a3b5_cf1ccc66","updated":"2018-11-10 00:24:58.000000000","message":"No, because not even QEMU / libvirt support migration of SEV VMs yet.  IIUC the policy here is only applicable at the hardware level.  One could instead read it as \"In the future, this will permit migration to other machines [...]\".  I could submit yet another patch set addressing nitpicks like this, although I\u0027m slightly worried about testing everyone\u0027s patience by submitting endless patch sets in a quest for perfection ;-)\n\nHaving said that, based on your further comments below, it sounds like maybe there are enough more significant issues to address in order to warrant another patch set.  I\u0027m hoping we can chat about this in Berlin and make some quick progress on it.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"a0f89ea0d9daefba33efd1095022f7cd5ac8eee5","unresolved":false,"context_lines":[{"line_number":166,"context_line":"      ((SEV_POLICY)(SEV_POLICY_NODBG|SEV_POLICY_NOKS| \\"},{"line_number":167,"context_line":"        SEV_POLICY_ES|SEV_POLICY_DOMAIN|SEV_POLICY_SEV))"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"which equates to ``0x0037``.  This permits migration to other machines"},{"line_number":170,"context_line":"in the same cluster [#]_ (i.e. with the same OCA cert) and uses"},{"line_number":171,"context_line":"SEV-ES, but doesn\u0027t permit other guests or the hypervisor to directly"},{"line_number":172,"context_line":"inspect memory.  If the upstream support for SEV-ES does not arrive in"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_37f7bc90","line":169,"range":{"start_line":169,"start_character":43,"end_line":169,"end_character":52},"in_reply_to":"3f79a3b5_e5e76044","updated":"2018-11-12 11:26:48.000000000","message":"No need for any apology here ;-)  To be clear, whether we label them nitpicks or something else, I welcome all feedback with open arms, no matter how small it is :-)  So don\u0027t worry, you don\u0027t need to justify being defensive and probing - I\u0027m 100% on board with the goal of getting the specification phase right to ensure we\u0027ve planned the right journey before we embark on it.\n\nI definitely didn\u0027t mean to deflect your perfectly valid point that \"This permits migration [...]\" could be worded better (e.g. \"In the future, this will permit migration [...]\" like I suggested).  Indeed, it would have only taken a few seconds to tweak this and submit a new patch set.  I\u0027m just conscious of the impact of drowning reviewers in an unnecessarily large number of patch sets, each with tiny incremental changes.  So I\u0027m trying to take a more considerate approach by holding off until I have enough other changes ready for review, and then batching them up into a single new patch set.  Hope that makes sense.\n\nTo extend the comments I made elsewhere on this review, yes you are right that as it stands this feature is (necessarily) limited, e.g. due to missing support for migration etc. in QEMU and libvirt.  So maybe it\u0027s fair to call this technical debt, although the debt is more architectural / functional in nature - I don\u0027t expect it should be necessary to introduce unclean code which requires a significant amount of tidy-up in the future.  Furthermore I think it\u0027s entirely possible to provide assurances that the remainder of this work *will* be carried out, and I\u0027m more than happy to host discussions to that effect in Berlin and beyond.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"f857360fdf75041cbe1b778e1bb3998cbae4f007","unresolved":false,"context_lines":[{"line_number":260,"context_line":"Security impact"},{"line_number":261,"context_line":"---------------"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"This change does not add or handle any secret information other than"},{"line_number":264,"context_line":"of course data within the guest VM\u0027s encrypted memory.  The secrets"},{"line_number":265,"context_line":"used to implement SEV are locked inside the AMD hardware.  The"},{"line_number":266,"context_line":"hardware random number generator uses the CTR_DRBG construct from"},{"line_number":267,"context_line":"`NIST SP 800-90A \u003chttps://en.wikipedia.org/wiki/NIST_SP_800-90A\u003e`_"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_eacdf6b9","line":264,"range":{"start_line":263,"start_character":0,"end_line":264,"end_character":54},"updated":"2018-11-09 16:03:20.000000000","message":"So, this is just a feature enablement in the hardware/hypervisor, that the guest uses to ensure the physical backing of its memory is encrypted, right? Meaning, nova doesn\u0027t have to get, provide, store, or transport keys or anything?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"657bbd1ecd8927f1d506e8e9bcbd7080bbb6ab4f","unresolved":false,"context_lines":[{"line_number":260,"context_line":"Security impact"},{"line_number":261,"context_line":"---------------"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"This change does not add or handle any secret information other than"},{"line_number":264,"context_line":"of course data within the guest VM\u0027s encrypted memory.  The secrets"},{"line_number":265,"context_line":"used to implement SEV are locked inside the AMD hardware.  The"},{"line_number":266,"context_line":"hardware random number generator uses the CTR_DRBG construct from"},{"line_number":267,"context_line":"`NIST SP 800-90A \u003chttps://en.wikipedia.org/wiki/NIST_SP_800-90A\u003e`_"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_b69c4470","line":264,"range":{"start_line":263,"start_character":0,"end_line":264,"end_character":54},"in_reply_to":"3f79a3b5_eacdf6b9","updated":"2018-11-09 20:32:09.000000000","message":"That is correct. Nova does not handle keys.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":320,"context_line":"check for the presence of the SEV trait, although this does open up a"},{"line_number":321,"context_line":"potential race window where image properties could change after the"},{"line_number":322,"context_line":"instance was created.  This could be remedied by future work which"},{"line_number":323,"context_line":"would include image properties in the instance launch notification, or"},{"line_number":324,"context_line":"storing the image metadata in ``instance_extra`` as is currently done"},{"line_number":325,"context_line":"for the flavor."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"Other end user impact"},{"line_number":328,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_4f843c57","line":325,"range":{"start_line":323,"start_character":68,"end_line":325,"end_character":15},"updated":"2018-11-09 15:42:54.000000000","message":"nit: we likely wouldn\u0027t do this since we already store the image meta in the instance_system_metadata table. So the data is already there for the using, we just don\u0027t use it for versioned notifications (until there is a need to do so). You don\u0027t need to update the spec for this, I\u0027m just showing off.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":320,"context_line":"check for the presence of the SEV trait, although this does open up a"},{"line_number":321,"context_line":"potential race window where image properties could change after the"},{"line_number":322,"context_line":"instance was created.  This could be remedied by future work which"},{"line_number":323,"context_line":"would include image properties in the instance launch notification, or"},{"line_number":324,"context_line":"storing the image metadata in ``instance_extra`` as is currently done"},{"line_number":325,"context_line":"for the flavor."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"Other end user impact"},{"line_number":328,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_3fc7a748","line":325,"range":{"start_line":323,"start_character":68,"end_line":325,"end_character":15},"in_reply_to":"3f79a3b5_4f843c57","updated":"2018-11-10 00:24:58.000000000","message":"LOL X-D\n\nWell count me impressed, and possibly Jay too since this information was taken directly from his previous comment:\n\nhttps://review.openstack.org/#/c/609779/10/specs/stein/approved/amd-sev-libvirt-support.rst@285","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":374,"context_line":"Developer impact"},{"line_number":375,"context_line":"----------------"},{"line_number":376,"context_line":""},{"line_number":377,"context_line":"None"},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"Upgrade impact"},{"line_number":380,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_4f0e7cd8","line":377,"range":{"start_line":377,"start_character":0,"end_line":377,"end_character":4},"updated":"2018-11-09 15:42:54.000000000","message":"I\u0027m pretty sure I mentioned this before, but this spec is very light on limitations of SEV-enabled VMs, particularly with things like move operations (cold/live migration, evacuate) and shelve/unshelve. Given the bugs pointed out earlier, is migration even possible? And if the VM is shelved, does any of the encrypted data need to be snapshot with it (it\u0027s unclear to me if the data is encrypted in the root disk or in some other file on local storage).\n\nAlso, are there any restrictions with volume-backed instances?\n\n(later)\n\nOK I see a mention about migrations in the \u0027work items\u0027 section below. There should probably be a \"Limitations\" sub-section in the proposed change to point out any known issues/limitations which are going to be imposed on SEV-enabled VMs before it\u0027s a foot note at the bottom of the spec. And if those bugs I noted above are related to this limitation, then we should list those in the spec for posterity.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":374,"context_line":"Developer impact"},{"line_number":375,"context_line":"----------------"},{"line_number":376,"context_line":""},{"line_number":377,"context_line":"None"},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"Upgrade impact"},{"line_number":380,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_df04737f","line":377,"range":{"start_line":377,"start_character":0,"end_line":377,"end_character":4},"in_reply_to":"3f79a3b5_4f0e7cd8","updated":"2018-11-10 00:24:58.000000000","message":"Good points here, thanks.  Let me consult with some SEV gurus and get back to you on this.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":379,"context_line":"Upgrade impact"},{"line_number":380,"context_line":"--------------"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"None"},{"line_number":383,"context_line":""},{"line_number":384,"context_line":"Implementation"},{"line_number":385,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_2fe8e0dd","line":382,"updated":"2018-11-09 15:42:54.000000000","message":"Thinking out loud, if an operator is doing rolling upgrades with Rocky computes to Stein, they could be live migrating VMs around as they upgrade. Since the trait is in the flavor (or image), and that would be used during scheduling, we shouldn\u0027t be able to live migrate a SEV-enabled VM to a compute host that doesn\u0027t support it b/c the scheduler will filter those hosts out via the trait. So we should be OK there.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":379,"context_line":"Upgrade impact"},{"line_number":380,"context_line":"--------------"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"None"},{"line_number":383,"context_line":""},{"line_number":384,"context_line":"Implementation"},{"line_number":385,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_7f967ff0","line":382,"in_reply_to":"3f79a3b5_2fe8e0dd","updated":"2018-11-10 00:24:58.000000000","message":"Correct.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":417,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":418,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":421,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_afde300c","line":420,"range":{"start_line":420,"start_character":3,"end_line":420,"end_character":15},"updated":"2018-11-09 15:42:54.000000000","message":"How are you going to prevent this? Within the virt driver? Certainly we aren\u0027t going to add libvirt-specific checks in the generic conductor/compute manager code paths for live/cold migration and evacuate, unless those would just be something as simple as checking to see if the request spec has a flavor/image with the SEV trait on it and fail the migration during scheduling?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":417,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":418,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":421,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_3f232708","line":420,"range":{"start_line":420,"start_character":3,"end_line":420,"end_character":15},"in_reply_to":"3f79a3b5_2ae8cedd","updated":"2018-11-10 00:24:58.000000000","message":"Good thoughts - all sound logical to me, but not being a nova expert I\u0027ll definitely welcome advice on this.  Hopefully we can bash heads together next week, worst case maybe over lunch or something if there are no spare Forum slots free (unfortunately I didn\u0027t think of submitting a Forum topic until it was too late).","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a23af6d1f3aeefc7ff6de4fbaf4f42f2c11a5857","unresolved":false,"context_lines":[{"line_number":417,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":418,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":421,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_2ae8cedd","line":420,"range":{"start_line":420,"start_character":3,"end_line":420,"end_character":15},"in_reply_to":"3f79a3b5_6a0ec633","updated":"2018-11-09 16:09:38.000000000","message":"\u003e That check would still be libvirt-specific as another hypervisor could implement this and the necessary migration. Similarly, newer libvirt may support this.\n\nYeah agreed and thought about that while writing it.\n\n\u003e I don\u0027t love it, but I imagine it applies to more cases than just this where we kinda drop things on the floor after doing an expensive schedule or prep only to find that the virt driver knew this wasn\u0027t going to work all along. Just a thought.\n\nYeah it\u0027s an option, and probably better than getting a 202 from the API and then later see the operation failed.\n\nThat really ties back into the old granular capabilities stuff that\u0027s been kicked around since at least Barcelona where we define capabilities at the API level, the compute level, and down to the per-instance level. As such, it might be worth thinking through that again before just throwing something in for this blueprint (as in just putting a \"I can\u0027t be moved, or really do anything\" flag for SEV instances).","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"f857360fdf75041cbe1b778e1bb3998cbae4f007","unresolved":false,"context_lines":[{"line_number":417,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":418,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":421,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_6a0ec633","line":420,"range":{"start_line":420,"start_character":3,"end_line":420,"end_character":15},"in_reply_to":"3f79a3b5_afde300c","updated":"2018-11-09 16:03:20.000000000","message":"That check would still be libvirt-specific as another hypervisor could implement this and the necessary migration. Similarly, newer libvirt may support this.\n\nWe /could/ add something like a supports_$action key to system_metadata for instances with special properties like this. Things that can\u0027t be performed could be stopped at the API layer synchronously for instances with those limitations. Re-use of this for things like (blocking) live migration of ironic instances, or even known-to-be-broken NUMA, cpu-pinned, etc instances.\n\nI don\u0027t love it, but I imagine it applies to more cases than just this where we kinda drop things on the floor after doing an expensive schedule or prep only to find that the virt driver knew this wasn\u0027t going to work all along. Just a thought.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"aecc26e638d01a1e04672b8730d012fe5e2e2652","unresolved":false,"context_lines":[{"line_number":418,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":421,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_e2450117","line":421,"range":{"start_line":421,"start_character":3,"end_line":421,"end_character":11},"updated":"2018-11-12 14:09:58.000000000","message":"resizing should be allowed as that shuts down the instance before its moved. live resize is a different matter.\nwe dont currently support that anyway but if we did i can see how that would be tricky to support with sev.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"85daeb50a478fdee28f4348f74a236c880a11baf","unresolved":false,"context_lines":[{"line_number":418,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":421,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_353f9885","line":421,"range":{"start_line":421,"start_character":3,"end_line":421,"end_character":11},"in_reply_to":"3f79a3b5_e2450117","updated":"2018-11-13 23:01:46.000000000","message":"Agreed, live resize would currently be impossible.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_4fe67cdd","line":425,"updated":"2018-11-09 15:42:54.000000000","message":"Does this include all of these APIs?\n\n* suspend/resume\n* pause/unpause\n* stop/start\n\nHow about reboot?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"a0f89ea0d9daefba33efd1095022f7cd5ac8eee5","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_b7250cc2","line":425,"in_reply_to":"3f79a3b5_45d8947e","updated":"2018-11-12 11:26:48.000000000","message":"Yeah, in that case the guests would need to be shut down and restarted elsewhere.  We could easily document that short-term caveat and then remove it when migrate/snapshot support is added.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1d20a9f038214ae9fe513d8c06bd8cef383cafda","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_6fffb834","line":425,"in_reply_to":"3f79a3b5_4fe67cdd","updated":"2018-11-09 15:44:17.000000000","message":"How about snapshots - can we create snapshots of SEV-enabled VMs and then create a new VM from those snapshots?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_df779306","line":425,"in_reply_to":"3f79a3b5_6acc8661","updated":"2018-11-10 00:24:58.000000000","message":"That matches my understanding but I\u0027ll check - @Bryan perhaps you can chip in here?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"9b55ce2fdad258213dee2f4575333cb1db0e8c03","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_6acc8661","line":425,"in_reply_to":"3f79a3b5_6fffb834","updated":"2018-11-09 16:21:29.000000000","message":"My uninformed guess is that things like reboot, cold-migrate, and snapshots should be fine because they don\u0027t depend on the running state of the guest, and thus the encrypted memory which is (likely) tied to some hardware state that can\u0027t be saved or transported.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"aecc26e638d01a1e04672b8730d012fe5e2e2652","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_22d4591d","line":425,"in_reply_to":"3f79a3b5_b7250cc2","updated":"2018-11-12 14:09:58.000000000","message":"live snapshot should \"just work\" cold snapshot today does a libvirt managed save which is whay suspend does e.g. a suspend to disk that could break with sev.\n\npause is a suspend to ram e.g. the ram is not deallocated or touched for the guest in any way the vcpu process just sleep until the instance is unpasued so that should work with SEV\n\nstart stop should also work.\n\nsince suspend to disk is just an optimisation in the cold snapshot case and we are actully allow to do a full stop and start when snapshoting we could fallback to that behavior if we detect its an SEV guest.\n\nthe fact we detach all pci devices as part of suspend today already means if you have a application using a gpu or sriov device and you do a managed save its gong to see the device be detached and reattach so it will likely a ready have crashed if it cant handle that so a shutdown and start i think is actually a lot friendlier to the workload then what we do today as it can at least try to exit gracefully.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"826e44391e49d7b56f33f97b4dbc6582f0a6e895","unresolved":false,"context_lines":[{"line_number":422,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":423,"context_line":"   libvirt, and handle it appropriately."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"#. Similarly, attempts to suspend / resume an SEV-encrypted domain are"},{"line_number":426,"context_line":"   not yet supported, and therefore should either be prevented, or the"},{"line_number":427,"context_line":"   error caught and handled."},{"line_number":428,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_45d8947e","line":425,"in_reply_to":"3f79a3b5_df779306","updated":"2018-11-10 02:44:32.000000000","message":"My biggest concern is if we can\u0027t snapshot, because if we can\u0027t migrate and if we can\u0027t snapshot, this is severely limited in case the operator needs to get guests off a host because it\u0027s being upgraded or needs to undergo some other kind of maintenance.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":497,"context_line":"  should be updated with details of how to set up SEV-capable hypervisors."},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"- The `Required traits section of the Flavors chapter in the End User Guide"},{"line_number":500,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/user/flavors.html#extra-specs-required-traits\u003e`_"},{"line_number":501,"context_line":"  could have details of the new trait added."},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"Other non-nova documentation should be updated too:"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_cf7dace5","line":500,"range":{"start_line":500,"start_character":3,"end_line":500,"end_character":87},"updated":"2018-11-09 15:42:54.000000000","message":"I don\u0027t think this would probably be appropriate to enumerate the various traits. If it\u0027s a standard trait in the os-traits library, then I think that is where the documentation about the trait should probably live, although the feature support matrix/admin docs above will also probably note the required trait.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":497,"context_line":"  should be updated with details of how to set up SEV-capable hypervisors."},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"- The `Required traits section of the Flavors chapter in the End User Guide"},{"line_number":500,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/user/flavors.html#extra-specs-required-traits\u003e`_"},{"line_number":501,"context_line":"  could have details of the new trait added."},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"Other non-nova documentation should be updated too:"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_1f73cbe6","line":500,"range":{"start_line":500,"start_character":3,"end_line":500,"end_character":87},"in_reply_to":"3f79a3b5_cf7dace5","updated":"2018-11-10 00:24:58.000000000","message":"ACK, adding as TODO for a future patch set, although please see questions below.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c673b8150fd4e57a55692f613030e1d524a3c6aa","unresolved":false,"context_lines":[{"line_number":508,"context_line":"  would be an ideal location to describe the whole process of"},{"line_number":509,"context_line":"  providing and consuming SEV functionality."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"- The `\"Useful image properties\" section of the Glance Administration Guide \u003chttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\u003e`_"},{"line_number":512,"context_line":"  should have details of the new trait added."},{"line_number":513,"context_line":""},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_ef5d087c","line":512,"range":{"start_line":511,"start_character":2,"end_line":512,"end_character":45},"updated":"2018-11-09 15:42:54.000000000","message":"Same comment about flavors above.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"a0f89ea0d9daefba33efd1095022f7cd5ac8eee5","unresolved":false,"context_lines":[{"line_number":508,"context_line":"  would be an ideal location to describe the whole process of"},{"line_number":509,"context_line":"  providing and consuming SEV functionality."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"- The `\"Useful image properties\" section of the Glance Administration Guide \u003chttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\u003e`_"},{"line_number":512,"context_line":"  should have details of the new trait added."},{"line_number":513,"context_line":""},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_69231cab","line":512,"range":{"start_line":511,"start_character":2,"end_line":512,"end_character":45},"in_reply_to":"3f79a3b5_25d9d87f","updated":"2018-11-12 11:26:48.000000000","message":"OK, sure - I\u0027ll change this in the new patch set.  So what\u0027s the policy (or at least rule of thumb you\u0027d recommend) for deciding which traits should or shouldn\u0027t be documented in the nova flavor extra specs and glance useful image properties docs?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"826e44391e49d7b56f33f97b4dbc6582f0a6e895","unresolved":false,"context_lines":[{"line_number":508,"context_line":"  would be an ideal location to describe the whole process of"},{"line_number":509,"context_line":"  providing and consuming SEV functionality."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"- The `\"Useful image properties\" section of the Glance Administration Guide \u003chttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\u003e`_"},{"line_number":512,"context_line":"  should have details of the new trait added."},{"line_number":513,"context_line":""},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_25d9d87f","line":512,"range":{"start_line":511,"start_character":2,"end_line":512,"end_character":45},"in_reply_to":"3f79a3b5_5f56232d","updated":"2018-11-10 02:44:32.000000000","message":"I don\u0027t expect us to document every single trait from os-traits in the nova flavor extra specs and glance useful image properties docs. That seems excessive and hard to maintain.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":508,"context_line":"  would be an ideal location to describe the whole process of"},{"line_number":509,"context_line":"  providing and consuming SEV functionality."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"- The `\"Useful image properties\" section of the Glance Administration Guide \u003chttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\u003e`_"},{"line_number":512,"context_line":"  should have details of the new trait added."},{"line_number":513,"context_line":""},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_828d82db","line":512,"range":{"start_line":511,"start_character":2,"end_line":512,"end_character":45},"in_reply_to":"3f79a3b5_69231cab","updated":"2018-12-06 20:25:36.000000000","message":"I would leave that to dedicated documentation about a given feature and explain what configuration (flavor/image/host) needs to happen for that feature.","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"d5da1bf73e7d20e1aea20e7b9fb31e2a9b2002b4","unresolved":false,"context_lines":[{"line_number":508,"context_line":"  would be an ideal location to describe the whole process of"},{"line_number":509,"context_line":"  providing and consuming SEV functionality."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"- The `\"Useful image properties\" section of the Glance Administration Guide \u003chttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\u003e`_"},{"line_number":512,"context_line":"  should have details of the new trait added."},{"line_number":513,"context_line":""},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_5f56232d","line":512,"range":{"start_line":511,"start_character":2,"end_line":512,"end_character":45},"in_reply_to":"3f79a3b5_ef5d087c","updated":"2018-11-10 00:24:58.000000000","message":"You mean \"Same comment *as for* flavors above\"?  Not nit-picking, just checking I understand your point correctly.  Are you saying that that chapter shouldn\u0027t try to enumerate the various traits, and it should be sufficient to document it in os-traits.  I\u0027m trying to reconcile this with what you wrote here: https://bugs.launchpad.net/nova/+bug/1796857/comments/1 since I got the impression from the latter that the intention was complete enumeration - otherwise what\u0027s the criteria for choosing a subset of traits to document outside os-traits?","commit_id":"86bbc6c753505446252bf1be72b85c8d4347a2ae"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"71fc34b44c2764b36783691372bc4fc5fd8f14ca","unresolved":false,"context_lines":[{"line_number":139,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"},{"line_number":140,"context_line":"    ACPI tables              2384KB                 `reserved_host_memory_mb`_"},{"line_number":141,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    It is also recommended to include an additional padding of around"},{"line_number":144,"context_line":"    256KB for safety, since ROM sizes can occasionally change."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_d35d52eb","line":142,"updated":"2018-11-27 22:14:13.000000000","message":"Would it be best to consolidate all these constants to one \"ROMs/ACPI\" constant? I like Sean\u0027s 16MB suggestion to give plenty of buffer in case ROM sizes change.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"d5c4069d1ce67d2aeee57c77d45c501bdfa35df1","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":114,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":115,"context_line":"    shared between host and guest."},{"line_number":116,"context_line":"  - A hard memory limit must also be set via ``\u003chard_limit\u003e`` in the"},{"line_number":117,"context_line":"    ``\u003cmemtune\u003e`` section of the domain\u0027s XML.  This does *not*"},{"line_number":118,"context_line":"    reflect a requirement for additional memory; it is only required"},{"line_number":119,"context_line":"    in order to pin all the memory regions allocated by QEMU, so that"},{"line_number":120,"context_line":"    they cannot be swapped to disk."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Note that this memory pinning is expected to be a temporary"},{"line_number":123,"context_line":"    requirement; the latest firmwares already support page copying (as"},{"line_number":124,"context_line":"    documented by the ``COPY`` API in the `AMD SEV-KM API"},{"line_number":125,"context_line":"    Specification`_), so when OS starts supporting the page-move or"},{"line_number":126,"context_line":"    page-migration commmand then it will no longer be needed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    Based on instrumentation of QEMU, the limit per VM should be"},{"line_number":129,"context_line":"    calculated and accounted for as follows:"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":132,"context_line":"    Memory region type       Size                   Accounting mechanism"},{"line_number":133,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":134,"context_line":"    VM RAM                   set by flavor          placement service"},{"line_number":135,"context_line":"    video memory             set by flavor/image    placement service"},{"line_number":136,"context_line":"    UEFI ROM                 4096KB                 `reserved_host_memory_mb`_"},{"line_number":137,"context_line":"    UEFI var store (pflash)  4096KB                 `reserved_host_memory_mb`_"},{"line_number":138,"context_line":"    pc.rom                   128KB                  `reserved_host_memory_mb`_"},{"line_number":139,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"},{"line_number":140,"context_line":"    ACPI tables              2384KB                 `reserved_host_memory_mb`_"},{"line_number":141,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    It is also recommended to include an additional padding of around"},{"line_number":144,"context_line":"    256KB for safety, since ROM sizes can occasionally change."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    The first two values are expected to commonly vary per VM, and"},{"line_number":147,"context_line":"    are already accounted for dynamically by the placement service."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_f34ad857","line":144,"range":{"start_line":116,"start_character":1,"end_line":144,"end_character":62},"updated":"2018-11-27 12:07:57.000000000","message":"so i just left a comment on the previos patchset which im not going to fully go into again\nhttps://review.openstack.org/#/c/609779/14/specs/stein/approved/amd-sev-libvirt-support.rst@113\n\nbut i would like to raise a few things\nfist the fix overhead  is a litle under 11MB but i would suggest rounding up to 16MB + vm ram + video memory to give a  good buffer.\n\nsecond hugepages are a thing and SEV guests should work with them so can you update this to clarify that. e.g. we should support booting vms with hw:mem_page_size\u003dlarge and HW_CPU_AMD_SEV\n\nthird can you clarify if the vhost-net-pci device queue are encypted and more specifically can sev guest be used with vhost-user. if it cannot then sev gest would be incompatible\nwith host using ovs-dpdk,vpp,vrouter,snabb swtich or netronome virtio-forwarder for networking. it would also be incompatile with future smartnics that used vhost-user or vhost-vfio.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":114,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":115,"context_line":"    shared between host and guest."},{"line_number":116,"context_line":"  - A hard memory limit must also be set via ``\u003chard_limit\u003e`` in the"},{"line_number":117,"context_line":"    ``\u003cmemtune\u003e`` section of the domain\u0027s XML.  This does *not*"},{"line_number":118,"context_line":"    reflect a requirement for additional memory; it is only required"},{"line_number":119,"context_line":"    in order to pin all the memory regions allocated by QEMU, so that"},{"line_number":120,"context_line":"    they cannot be swapped to disk."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Note that this memory pinning is expected to be a temporary"},{"line_number":123,"context_line":"    requirement; the latest firmwares already support page copying (as"},{"line_number":124,"context_line":"    documented by the ``COPY`` API in the `AMD SEV-KM API"},{"line_number":125,"context_line":"    Specification`_), so when OS starts supporting the page-move or"},{"line_number":126,"context_line":"    page-migration commmand then it will no longer be needed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    Based on instrumentation of QEMU, the limit per VM should be"},{"line_number":129,"context_line":"    calculated and accounted for as follows:"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":132,"context_line":"    Memory region type       Size                   Accounting mechanism"},{"line_number":133,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":134,"context_line":"    VM RAM                   set by flavor          placement service"},{"line_number":135,"context_line":"    video memory             set by flavor/image    placement service"},{"line_number":136,"context_line":"    UEFI ROM                 4096KB                 `reserved_host_memory_mb`_"},{"line_number":137,"context_line":"    UEFI var store (pflash)  4096KB                 `reserved_host_memory_mb`_"},{"line_number":138,"context_line":"    pc.rom                   128KB                  `reserved_host_memory_mb`_"},{"line_number":139,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"},{"line_number":140,"context_line":"    ACPI tables              2384KB                 `reserved_host_memory_mb`_"},{"line_number":141,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    It is also recommended to include an additional padding of around"},{"line_number":144,"context_line":"    256KB for safety, since ROM sizes can occasionally change."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    The first two values are expected to commonly vary per VM, and"},{"line_number":147,"context_line":"    are already accounted for dynamically by the placement service."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_976f54c5","line":144,"range":{"start_line":116,"start_character":1,"end_line":144,"end_character":62},"in_reply_to":"3f79a3b5_2e53e2de","updated":"2018-12-15 01:16:49.000000000","message":"Added a mention of the performance overhead in patch set 16.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"1885e73e3e7f3619a4181e64d0bb2b4b5f186d13","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":114,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":115,"context_line":"    shared between host and guest."},{"line_number":116,"context_line":"  - A hard memory limit must also be set via ``\u003chard_limit\u003e`` in the"},{"line_number":117,"context_line":"    ``\u003cmemtune\u003e`` section of the domain\u0027s XML.  This does *not*"},{"line_number":118,"context_line":"    reflect a requirement for additional memory; it is only required"},{"line_number":119,"context_line":"    in order to pin all the memory regions allocated by QEMU, so that"},{"line_number":120,"context_line":"    they cannot be swapped to disk."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Note that this memory pinning is expected to be a temporary"},{"line_number":123,"context_line":"    requirement; the latest firmwares already support page copying (as"},{"line_number":124,"context_line":"    documented by the ``COPY`` API in the `AMD SEV-KM API"},{"line_number":125,"context_line":"    Specification`_), so when OS starts supporting the page-move or"},{"line_number":126,"context_line":"    page-migration commmand then it will no longer be needed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    Based on instrumentation of QEMU, the limit per VM should be"},{"line_number":129,"context_line":"    calculated and accounted for as follows:"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":132,"context_line":"    Memory region type       Size                   Accounting mechanism"},{"line_number":133,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":134,"context_line":"    VM RAM                   set by flavor          placement service"},{"line_number":135,"context_line":"    video memory             set by flavor/image    placement service"},{"line_number":136,"context_line":"    UEFI ROM                 4096KB                 `reserved_host_memory_mb`_"},{"line_number":137,"context_line":"    UEFI var store (pflash)  4096KB                 `reserved_host_memory_mb`_"},{"line_number":138,"context_line":"    pc.rom                   128KB                  `reserved_host_memory_mb`_"},{"line_number":139,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"},{"line_number":140,"context_line":"    ACPI tables              2384KB                 `reserved_host_memory_mb`_"},{"line_number":141,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    It is also recommended to include an additional padding of around"},{"line_number":144,"context_line":"    256KB for safety, since ROM sizes can occasionally change."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    The first two values are expected to commonly vary per VM, and"},{"line_number":147,"context_line":"    are already accounted for dynamically by the placement service."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_2e53e2de","line":144,"range":{"start_line":116,"start_character":1,"end_line":144,"end_character":62},"in_reply_to":"3f79a3b5_f34ad857","updated":"2018-11-28 22:49:22.000000000","message":"I think the only unanswered question is whether virtio-net device queues are encrypted. They are not, due to the required iommu\u003d\u0027on\u0027 attribute mentioned at line 110. This tells the virtio driver in the guest to use the DMA APIs. Note that the \"DMA\" will go through bounce buffers, so expect some overhead compared to a non-SEV guests.\n\nBTW, I wonder if such shared memory network solutions fly in the face of users wanting their instance\u0027s memory encrypted?","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    virtualized DMA should be used.  This ties into the SEV code to"},{"line_number":114,"context_line":"    handle memory encryption/decryption, and prevents IO buffers being"},{"line_number":115,"context_line":"    shared between host and guest."},{"line_number":116,"context_line":"  - A hard memory limit must also be set via ``\u003chard_limit\u003e`` in the"},{"line_number":117,"context_line":"    ``\u003cmemtune\u003e`` section of the domain\u0027s XML.  This does *not*"},{"line_number":118,"context_line":"    reflect a requirement for additional memory; it is only required"},{"line_number":119,"context_line":"    in order to pin all the memory regions allocated by QEMU, so that"},{"line_number":120,"context_line":"    they cannot be swapped to disk."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Note that this memory pinning is expected to be a temporary"},{"line_number":123,"context_line":"    requirement; the latest firmwares already support page copying (as"},{"line_number":124,"context_line":"    documented by the ``COPY`` API in the `AMD SEV-KM API"},{"line_number":125,"context_line":"    Specification`_), so when OS starts supporting the page-move or"},{"line_number":126,"context_line":"    page-migration commmand then it will no longer be needed."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    Based on instrumentation of QEMU, the limit per VM should be"},{"line_number":129,"context_line":"    calculated and accounted for as follows:"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":132,"context_line":"    Memory region type       Size                   Accounting mechanism"},{"line_number":133,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":134,"context_line":"    VM RAM                   set by flavor          placement service"},{"line_number":135,"context_line":"    video memory             set by flavor/image    placement service"},{"line_number":136,"context_line":"    UEFI ROM                 4096KB                 `reserved_host_memory_mb`_"},{"line_number":137,"context_line":"    UEFI var store (pflash)  4096KB                 `reserved_host_memory_mb`_"},{"line_number":138,"context_line":"    pc.rom                   128KB                  `reserved_host_memory_mb`_"},{"line_number":139,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"},{"line_number":140,"context_line":"    ACPI tables              2384KB                 `reserved_host_memory_mb`_"},{"line_number":141,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    It is also recommended to include an additional padding of around"},{"line_number":144,"context_line":"    256KB for safety, since ROM sizes can occasionally change."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    The first two values are expected to commonly vary per VM, and"},{"line_number":147,"context_line":"    are already accounted for dynamically by the placement service."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_776cf8d1","line":144,"range":{"start_line":116,"start_character":1,"end_line":144,"end_character":62},"in_reply_to":"3f79a3b5_f34ad857","updated":"2018-12-15 01:16:49.000000000","message":"This is now all clarified in the next patchset.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":156,"context_line":"    if it\u0027s too high, there\u0027s a risk of the host crashing because it"},{"line_number":157,"context_line":"    cannot reclaim the memory used by the guest."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    Therefore it may be prudent to implement an extra check which"},{"line_number":160,"context_line":"    multiplies this overhead by the number of instances and ensures"},{"line_number":161,"context_line":"    that it does not exceed a threshold."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. _reserved_host_memory_mb:"},{"line_number":164,"context_line":"   https://docs.openstack.org/nova/rocky/configuration/config.html#DEFAULT.reserved_host_memory_mb"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_228d8e7c","line":161,"range":{"start_line":159,"start_character":4,"end_line":161,"end_character":40},"updated":"2018-12-06 20:25:36.000000000","message":"Are you suggesting this is something the libvirt driver would do during it\u0027s overhead check, or when spawning a SEV guest? Or maybe just something that could be done down the line if this becomes too hard without built in automation from nova?","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"8d8676ff686110ab6a1c432f29fc5b9b44343311","unresolved":false,"context_lines":[{"line_number":156,"context_line":"    if it\u0027s too high, there\u0027s a risk of the host crashing because it"},{"line_number":157,"context_line":"    cannot reclaim the memory used by the guest."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    Therefore it may be prudent to implement an extra check which"},{"line_number":160,"context_line":"    multiplies this overhead by the number of instances and ensures"},{"line_number":161,"context_line":"    that it does not exceed a threshold."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. _reserved_host_memory_mb:"},{"line_number":164,"context_line":"   https://docs.openstack.org/nova/rocky/configuration/config.html#DEFAULT.reserved_host_memory_mb"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_c187e710","line":161,"range":{"start_line":159,"start_character":4,"end_line":161,"end_character":40},"in_reply_to":"3f79a3b5_09ef4b80","updated":"2018-12-07 15:50:04.000000000","message":"\u003e returning a failure to the user during VM boot is far preferable to either VMs getting randomly killed or the host crashing.\n\nYes totally agree, I just wasn\u0027t sure if you are asserting we\u0027d add a check in the driver for this during each VM spawn to make sure we don\u0027t go over the hard limit and break things, or if this is something we *could* do as part of a future hardening opportunity. I read it as the latter, which is OK for v1 of this feature if the hard limit / reserved host ram calculation is properly documented (in nova docs).","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":156,"context_line":"    if it\u0027s too high, there\u0027s a risk of the host crashing because it"},{"line_number":157,"context_line":"    cannot reclaim the memory used by the guest."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    Therefore it may be prudent to implement an extra check which"},{"line_number":160,"context_line":"    multiplies this overhead by the number of instances and ensures"},{"line_number":161,"context_line":"    that it does not exceed a threshold."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. _reserved_host_memory_mb:"},{"line_number":164,"context_line":"   https://docs.openstack.org/nova/rocky/configuration/config.html#DEFAULT.reserved_host_memory_mb"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_5769bcbc","line":161,"range":{"start_line":159,"start_character":4,"end_line":161,"end_character":40},"in_reply_to":"3f79a3b5_1bd2cd61","updated":"2018-12-15 01:16:49.000000000","message":"Done","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":156,"context_line":"    if it\u0027s too high, there\u0027s a risk of the host crashing because it"},{"line_number":157,"context_line":"    cannot reclaim the memory used by the guest."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    Therefore it may be prudent to implement an extra check which"},{"line_number":160,"context_line":"    multiplies this overhead by the number of instances and ensures"},{"line_number":161,"context_line":"    that it does not exceed a threshold."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. _reserved_host_memory_mb:"},{"line_number":164,"context_line":"   https://docs.openstack.org/nova/rocky/configuration/config.html#DEFAULT.reserved_host_memory_mb"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_09ef4b80","line":161,"range":{"start_line":159,"start_character":4,"end_line":161,"end_character":40},"in_reply_to":"3f79a3b5_228d8e7c","updated":"2018-12-07 14:17:44.000000000","message":"I think the driver could do it. It\u0027s not exactly ideal compared to (say) checking at placement time, but it\u0027s a backstop which only applies if the operator didn\u0027t pay attention to the docs warning them to set reserved_host_memory_mb *and* a large number of SEV guests get deployed onto the host.  Of course this is not a far-fetched scenario, but in that case returning a failure to the user during VM boot is far preferable to either VMs getting randomly killed or the host crashing.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"5805537c832ef73e5ff10ea8320e570113e33f0c","unresolved":false,"context_lines":[{"line_number":156,"context_line":"    if it\u0027s too high, there\u0027s a risk of the host crashing because it"},{"line_number":157,"context_line":"    cannot reclaim the memory used by the guest."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    Therefore it may be prudent to implement an extra check which"},{"line_number":160,"context_line":"    multiplies this overhead by the number of instances and ensures"},{"line_number":161,"context_line":"    that it does not exceed a threshold."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. _reserved_host_memory_mb:"},{"line_number":164,"context_line":"   https://docs.openstack.org/nova/rocky/configuration/config.html#DEFAULT.reserved_host_memory_mb"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_1bd2cd61","line":161,"range":{"start_line":159,"start_character":4,"end_line":161,"end_character":40},"in_reply_to":"3f79a3b5_c187e710","updated":"2018-12-12 15:44:44.000000000","message":"I\u0027m actually hoping to get the check in v1, but I guess it depends on how smoothly all the other work goes ;-)  Either way, yes I will certainly make sure that the reserved ram calculation is properly documented!","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"d5c4069d1ce67d2aeee57c77d45c501bdfa35df1","unresolved":false,"context_lines":[{"line_number":237,"context_line":".. [#] Even though live migration is not currently supported by the"},{"line_number":238,"context_line":"       hypervisor software stack, it will be in the future."},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"Limitations"},{"line_number":241,"context_line":"-----------"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"- The operating system running in an encrypted virtual machine must"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_f381784d","line":240,"range":{"start_line":240,"start_character":0,"end_line":240,"end_character":11},"updated":"2018-11-27 12:07:57.000000000","message":"so this section is new from the last revision.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":237,"context_line":".. [#] Even though live migration is not currently supported by the"},{"line_number":238,"context_line":"       hypervisor software stack, it will be in the future."},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"Limitations"},{"line_number":241,"context_line":"-----------"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"- The operating system running in an encrypted virtual machine must"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_496c6304","line":240,"range":{"start_line":240,"start_character":0,"end_line":240,"end_character":11},"in_reply_to":"3f79a3b5_f381784d","updated":"2018-12-07 14:17:44.000000000","message":"Correct, I added it on Matt\u0027s request.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"d5c4069d1ce67d2aeee57c77d45c501bdfa35df1","unresolved":false,"context_lines":[{"line_number":250,"context_line":"  SEV-encrypted instances will need to be fully shut down before"},{"line_number":251,"context_line":"  migrating off an SEV host."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_53c06c7d","line":254,"range":{"start_line":253,"start_character":1,"end_line":254,"end_character":15},"updated":"2018-11-27 12:07:57.000000000","message":"this is a rather sever limitation as it means sriov networking will not work nor will hardware offloaded ovs.\n\ncan you respond here with the answer to my vhost user question from above.\n\nif SEV guest cannot use pci passthrough, sriov  or vhost-user backed interface then that eliminates all highspeed networking options supported by openstack meaning SEV guests cannot be used for telco/nfv workloads.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":250,"context_line":"  SEV-encrypted instances will need to be fully shut down before"},{"line_number":251,"context_line":"  migrating off an SEV host."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_a25d1eec","line":254,"range":{"start_line":253,"start_character":1,"end_line":254,"end_character":15},"in_reply_to":"3f79a3b5_53c06c7d","updated":"2018-12-06 20:25:36.000000000","message":"I believe Jim replied on L144. You can play fast and loose or slow and conservative for now.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":250,"context_line":"  SEV-encrypted instances will need to be fully shut down before"},{"line_number":251,"context_line":"  migrating off an SEV host."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_f75fa80e","line":254,"range":{"start_line":253,"start_character":1,"end_line":254,"end_character":15},"in_reply_to":"3f79a3b5_a25d1eec","updated":"2018-12-15 01:16:49.000000000","message":"This is now explained more explicitly in patch set 16.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"d5c4069d1ce67d2aeee57c77d45c501bdfa35df1","unresolved":false,"context_lines":[{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_536e2c97","line":256,"range":{"start_line":256,"start_character":6,"end_line":256,"end_character":15},"updated":"2018-11-27 12:07:57.000000000","message":"does that imply that cinder volumes can use virtio-blk without issue provided the boot disk is virtio-scsi","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_c2b93ac6","line":256,"range":{"start_line":256,"start_character":6,"end_line":256,"end_character":15},"in_reply_to":"3f79a3b5_536e2c97","updated":"2018-12-06 20:25:36.000000000","message":"And this ties back into L110 right?","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_c9bb9371","line":256,"range":{"start_line":256,"start_character":6,"end_line":256,"end_character":15},"in_reply_to":"3f79a3b5_c2b93ac6","updated":"2018-12-07 14:17:44.000000000","message":"Getting confirmation on this.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":253,"context_line":"- SEV-encrypted VMs cannot contain directly accessible host devices (PCI"},{"line_number":254,"context_line":"  passthrough)."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_175b4424","line":256,"range":{"start_line":256,"start_character":6,"end_line":256,"end_character":15},"in_reply_to":"3f79a3b5_c9bb9371","updated":"2018-12-15 01:16:49.000000000","message":"Confirmed and stated in patch set 16.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"d5c4069d1ce67d2aeee57c77d45c501bdfa35df1","unresolved":false,"context_lines":[{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"},{"line_number":260,"context_line":"and various layer of software receive new features."},{"line_number":261,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_73efa8b1","line":258,"updated":"2018-11-27 12:07:57.000000000","message":"are there any other limitation on guest devices.\n\ndo the spice/vnc/serial/RDP consoles work with sev guest\n\nwhat about qemu guest agent which reliese on qemu channels. if not the we will be unable to quies disks when snapshoting.\n\ni assume that mdev vGPU support will not work due to the pci passthrough limitation and the fact that the mdev based aproch relies on vfio which is the same kernel driver layer that is used for sriov.\n\nthere are several other edgecases that i can think of but they are the main ones.\n\ni have already assumed this would work but i assume cinder volumes work correctly with sev guests and on a related note config drive should work but if not please list it here.\n\ni have asked above about hugepages but if they cannot be supproted i would like to document that and state why but as previous comments have stated the should work this is just house keeping.\n\nits only vaguely related but also i assueme that virtual numa topology can also be configred with SEV guests since it is not listed here e.g. hw:numa_nodes\u003d2\n\ni think those are most if not all the ways that memory or devices can be modified within the guest that could have interactions with SEV but if we know the answer it would be could to document them.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"},{"line_number":260,"context_line":"and various layer of software receive new features."},{"line_number":261,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_09842bae","line":258,"in_reply_to":"3f79a3b5_02c97250","updated":"2018-12-07 14:17:44.000000000","message":"ACK, good question - I think it should work fine but I\u0027m getting confirmation for you.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"},{"line_number":260,"context_line":"and various layer of software receive new features."},{"line_number":261,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_b759302b","line":258,"in_reply_to":"3f79a3b5_09842bae","updated":"2018-12-15 01:16:49.000000000","message":"All covered in patch set 16 in far more detail than you ever wanted ;-) including 2 workarounds and 3 possible code-changes for the IDE config-drive issue.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2697,"name":"Jim Fehlig","email":"jfehlig@suse.com","username":"jfehlig"},"change_message_id":"71fc34b44c2764b36783691372bc4fc5fd8f14ca","unresolved":false,"context_lines":[{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"},{"line_number":260,"context_line":"and various layer of software receive new features."},{"line_number":261,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_ff760fd6","line":258,"in_reply_to":"3f79a3b5_73efa8b1","updated":"2018-11-27 22:14:13.000000000","message":"All the consoles (spice, vnc, etc) work as does the guest agent. mdev vGPU will not work for the reasons you mention, but note that AMD considers the PCI passthrough limitation a bug. They are working on fixes for kvm and qemu to propagate memory type info through to the memory_region_add callback, so that mmio memory type can be ignored when pinning the region.\n\nHugepages work fine with SEV guests and should be preferred IMO. As you say it avoids the need for specifying \u003chard_limit\u003e.\n\nvNUMA seems to work fine too. I\u0027ve created SEV encrypted, 4 node vNUMA guests, whose vcpu and memory where allocated from specified physical nodes, and haven\u0027t noticed any problems.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":255,"context_line":""},{"line_number":256,"context_line":"- The boot disk of SEV-encrypted VMs cannot be ``virtio-blk``.  Using"},{"line_number":257,"context_line":"  ``virtio-scsi`` or SATA for the boot disk works as expected."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"These limitations will be removed in the future as the hardware, firmware,"},{"line_number":260,"context_line":"and various layer of software receive new features."},{"line_number":261,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_02c97250","line":258,"in_reply_to":"3f79a3b5_ff760fd6","updated":"2018-12-06 20:25:36.000000000","message":"\u003e i have already assumed this would work but i assume cinder volumes work correctly with sev guests and on a related note config drive should work but if not please list it here.\n\nI\u0027m interested in a clear answer on that as well. Those are kind of table stakes for nova functionality.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":492,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":493,"context_line":"   in the flavor of the VM being launched."},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"#. Since migration between hosts is not (yet) supported for"},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"   - SEV-encrypted instances, nor"},{"line_number":498,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_62f9467f","line":495,"range":{"start_line":495,"start_character":9,"end_line":495,"end_character":18},"updated":"2018-12-06 20:25:36.000000000","message":"(live)","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"5805537c832ef73e5ff10ea8320e570113e33f0c","unresolved":false,"context_lines":[{"line_number":492,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":493,"context_line":"   in the flavor of the VM being launched."},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"#. Since migration between hosts is not (yet) supported for"},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"   - SEV-encrypted instances, nor"},{"line_number":498,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_dbb45521","line":495,"range":{"start_line":495,"start_character":9,"end_line":495,"end_character":18},"in_reply_to":"3f79a3b5_01695f59","updated":"2018-12-12 15:44:44.000000000","message":"Cool, thanks.  If another revision isn\u0027t needed I\u0027ll submit a follow-up review to address this and a few other minor tweaks.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"8d8676ff686110ab6a1c432f29fc5b9b44343311","unresolved":false,"context_lines":[{"line_number":492,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":493,"context_line":"   in the flavor of the VM being launched."},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"#. Since migration between hosts is not (yet) supported for"},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"   - SEV-encrypted instances, nor"},{"line_number":498,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_01695f59","line":495,"range":{"start_line":495,"start_character":9,"end_line":495,"end_character":18},"in_reply_to":"3f79a3b5_2937a74e","updated":"2018-12-07 15:50:04.000000000","message":"It\u0027s a nit, only update if you need to do another revision.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":492,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":493,"context_line":"   in the flavor of the VM being launched."},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"#. Since migration between hosts is not (yet) supported for"},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"   - SEV-encrypted instances, nor"},{"line_number":498,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_2937a74e","line":495,"range":{"start_line":495,"start_character":9,"end_line":495,"end_character":18},"in_reply_to":"3f79a3b5_62f9467f","updated":"2018-12-07 14:17:44.000000000","message":"Good catch - will submit a fix for this.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":492,"context_line":"   the required XML to the VM\u0027s domain definition if the new trait is"},{"line_number":493,"context_line":"   in the flavor of the VM being launched."},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"#. Since migration between hosts is not (yet) supported for"},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"   - SEV-encrypted instances, nor"},{"line_number":498,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_d754ecf3","line":495,"range":{"start_line":495,"start_character":9,"end_line":495,"end_character":18},"in_reply_to":"3f79a3b5_dbb45521","updated":"2018-12-15 01:16:49.000000000","message":"Done","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":499,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":500,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":503,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":504,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":505,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_e21236ad","line":502,"updated":"2018-12-06 20:25:36.000000000","message":"Fair to leave this to an implementation detail later, since there was quite a bit of discussion on this point in PS14, but we don\u0027t have awesome answers. Worst case is admin tries to live migrate a SEV-enabled guest and it fails in the compute/driver layer which isn\u0027t pretty but at least it shouldn\u0027t corrupt anything. We could build in higher-layer checks later if it becomes a major nuisance for operators.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":499,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":500,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":503,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":504,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":505,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_779158a7","line":502,"in_reply_to":"3f79a3b5_093aeb30","updated":"2018-12-15 01:16:49.000000000","message":"Done","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":499,"context_line":"   - `between unencrypted and SEV-encrypted states in either direction"},{"line_number":500,"context_line":"     \u003chttps://github.com/qemu/qemu/commit/8fa4466d77b44f4f58f3836601f31ca5e401485d\u003e`_,"},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"   prevent nova from live-migrating any SEV-encrypted instance, or"},{"line_number":503,"context_line":"   resizing onto a different compute host.  Alternatively, nova could"},{"line_number":504,"context_line":"   catch the error raised by QEMU, which would be propagated via"},{"line_number":505,"context_line":"   libvirt, and handle it appropriately."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_093aeb30","line":502,"in_reply_to":"3f79a3b5_e21236ad","updated":"2018-12-07 14:17:44.000000000","message":"Yup.  I\u0027ll submit a change which incorporates some of your wording here.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":548,"context_line":""},{"line_number":549,"context_line":"* UEFI bugs will need to be addressed"},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"  - `Bug #1607400 “UEFI not supported on SLES” : Bugs : OpenStack Compute (nova) \u003chttps://bugs.launchpad.net/nova/+bug/1607400\u003e`_"},{"line_number":552,"context_line":"  - `Bug #1785123 “UEFI NVRAM lost on cold migration or resize” : Bugs : OpenStack Compute (nova) \u003chttps://bugs.launchpad.net/nova/+bug/1785123\u003e`_"},{"line_number":553,"context_line":"  - `Bug #1633447 “nova stop/start or reboot --hard resets uefi nvram...” : Bugs : OpenStack Compute (nova) \u003chttps://bugs.launchpad.net/nova/+bug/1633447\u003e`_"},{"line_number":554,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_e267964e","line":551,"updated":"2018-12-06 20:25:36.000000000","message":"After talking with Adam in Berlin and the comments on the bug, I have invalidated this since it\u0027s not clear to me that this is still an issue. I believe the answer was that SUSE works around this in packaging.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":548,"context_line":""},{"line_number":549,"context_line":"* UEFI bugs will need to be addressed"},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"  - `Bug #1607400 “UEFI not supported on SLES” : Bugs : OpenStack Compute (nova) \u003chttps://bugs.launchpad.net/nova/+bug/1607400\u003e`_"},{"line_number":552,"context_line":"  - `Bug #1785123 “UEFI NVRAM lost on cold migration or resize” : Bugs : OpenStack Compute (nova) \u003chttps://bugs.launchpad.net/nova/+bug/1785123\u003e`_"},{"line_number":553,"context_line":"  - `Bug #1633447 “nova stop/start or reboot --hard resets uefi nvram...” : Bugs : OpenStack Compute (nova) \u003chttps://bugs.launchpad.net/nova/+bug/1633447\u003e`_"},{"line_number":554,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_89f91b82","line":551,"in_reply_to":"3f79a3b5_e267964e","updated":"2018-12-07 14:17:44.000000000","message":"That\u0027s correct - we work around for SLE 12, and there is a proper fix in SLE \u003e\u003d 15 (in case you\u0027re wondering, 13 and 14 don\u0027t exist - don\u0027t ask ;-)","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9e9373f0afe02a7d1b4bb37df7d3008577774990","unresolved":false,"context_lines":[{"line_number":589,"context_line":"  should be updated with details of how to set up SEV-capable"},{"line_number":590,"context_line":"  hypervisors.  It would be prudent to mention the current"},{"line_number":591,"context_line":"  `limitations`_ here too, including the impact on compute host"},{"line_number":592,"context_line":"  maintenance."},{"line_number":593,"context_line":""},{"line_number":594,"context_line":"Other non-nova documentation should be updated too:"},{"line_number":595,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_a2ed1e8e","line":592,"updated":"2018-12-06 20:25:36.000000000","message":"And the reserved_host_memory_mb calculation.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"86f4a25e99ce705cecdbd2cea248aa3d976671e1","unresolved":false,"context_lines":[{"line_number":589,"context_line":"  should be updated with details of how to set up SEV-capable"},{"line_number":590,"context_line":"  hypervisors.  It would be prudent to mention the current"},{"line_number":591,"context_line":"  `limitations`_ here too, including the impact on compute host"},{"line_number":592,"context_line":"  maintenance."},{"line_number":593,"context_line":""},{"line_number":594,"context_line":"Other non-nova documentation should be updated too:"},{"line_number":595,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_97943499","line":592,"in_reply_to":"3f79a3b5_09e50bcf","updated":"2018-12-15 01:16:49.000000000","message":"Done","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"cc6989bc691f4f00edc610a4d9fddd583b572d37","unresolved":false,"context_lines":[{"line_number":589,"context_line":"  should be updated with details of how to set up SEV-capable"},{"line_number":590,"context_line":"  hypervisors.  It would be prudent to mention the current"},{"line_number":591,"context_line":"  `limitations`_ here too, including the impact on compute host"},{"line_number":592,"context_line":"  maintenance."},{"line_number":593,"context_line":""},{"line_number":594,"context_line":"Other non-nova documentation should be updated too:"},{"line_number":595,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3f79a3b5_09e50bcf","line":592,"in_reply_to":"3f79a3b5_a2ed1e8e","updated":"2018-12-07 14:17:44.000000000","message":"ACK - will submit a fix for this.","commit_id":"82ab3c7a33397a89f364ab8aab10af445786aea2"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":68,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":69,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"},{"line_number":70,"context_line":"    (AMD-SP) support SEV functionality"},{"line_number":71,"context_line":"    \u003chttps://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c\u003e`_::"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        \u003cdomainCapabilities\u003e"},{"line_number":74,"context_line":"          ..."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e8694c8b","line":71,"updated":"2019-01-03 15:56:36.000000000","message":"Attempting to open the above URL caused my Firefox NoScript plugin to block the URL due to concerns about cross-site scripting. Just FYI...","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":68,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":69,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"},{"line_number":70,"context_line":"    (AMD-SP) support SEV functionality"},{"line_number":71,"context_line":"    \u003chttps://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c\u003e`_::"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        \u003cdomainCapabilities\u003e"},{"line_number":74,"context_line":"          ..."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_a05fd8e3","line":71,"in_reply_to":"ffd0ebdf_e8694c8b","updated":"2019-01-03 18:22:45.000000000","message":"Hrm, I don\u0027t really understand why that happens.  Isn\u0027t it just a plain hyperlink?  Suggestions for how to fix are welcome!","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":125,"context_line":"  - All the memory regions allocated by QEMU must be pinned, so that"},{"line_number":126,"context_line":"    they cannot be swapped to disk.  This can be achieved by setting a"},{"line_number":127,"context_line":"    hard memory limit via ``\u003chard_limit\u003e`` in the ``\u003cmemtune\u003e``"},{"line_number":128,"context_line":"    section of the domain\u0027s XML.  This does *not* reflect a"},{"line_number":129,"context_line":"    requirement for additional memory; it is only required in order to"},{"line_number":130,"context_line":"    achieve the memory pinning."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    Another method for pinning the memory is to enable `hugepages"},{"line_number":133,"context_line":"    \u003chttps://docs.openstack.org/nova/rocky/admin/huge-pages.html\u003e`_ by"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_682c7c47","line":130,"range":{"start_line":128,"start_character":33,"end_line":130,"end_character":31},"updated":"2019-01-03 15:56:36.000000000","message":"ack. thanks for adding this :)","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":152,"context_line":"    VM RAM                   set by flavor          placement service"},{"line_number":153,"context_line":"    video memory             set by flavor/image    placement service"},{"line_number":154,"context_line":"    UEFI ROM                 4096KB                 `reserved_host_memory_mb`_"},{"line_number":155,"context_line":"    UEFI var store (pflash)  4096KB                 `reserved_host_memory_mb`_"},{"line_number":156,"context_line":"    pc.rom                   128KB                  `reserved_host_memory_mb`_"},{"line_number":157,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_48b5f8ed","line":154,"range":{"start_line":154,"start_character":51,"end_line":154,"end_character":78},"updated":"2019-01-03 15:56:36.000000000","message":"technically, this is also managed by the placement service :) It goes in the MEMORY_MB inventory\u0027s reserved value:\n\nhttps://github.com/openstack/nova/blob/8ef3d253a086e4f8575f5221d4515cda421abea2/nova/virt/libvirt/driver.py#L6513\n\nNo need to change this table, though.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":152,"context_line":"    VM RAM                   set by flavor          placement service"},{"line_number":153,"context_line":"    video memory             set by flavor/image    placement service"},{"line_number":154,"context_line":"    UEFI ROM                 4096KB                 `reserved_host_memory_mb`_"},{"line_number":155,"context_line":"    UEFI var store (pflash)  4096KB                 `reserved_host_memory_mb`_"},{"line_number":156,"context_line":"    pc.rom                   128KB                  `reserved_host_memory_mb`_"},{"line_number":157,"context_line":"    isa-bios                 128KB                  `reserved_host_memory_mb`_"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_40706c73","line":154,"range":{"start_line":154,"start_character":51,"end_line":154,"end_character":78},"in_reply_to":"ffd0ebdf_48b5f8ed","updated":"2019-01-03 18:22:45.000000000","message":"Good to know, thanks!","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":164,"context_line":"    It is also recommended to include an additional padding of at"},{"line_number":165,"context_line":"    least 256KB for safety, since ROM sizes can occasionally change."},{"line_number":166,"context_line":"    For example the total of 10832KB required here for ROMs / ACPI"},{"line_number":167,"context_line":"    tables could be rounded up to 16MB."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"    The first two values are expected to commonly vary per VM, and"},{"line_number":170,"context_line":"    are already accounted for dynamically by the placement service."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_0894d043","line":167,"range":{"start_line":167,"start_character":11,"end_line":167,"end_character":16},"updated":"2019-01-03 15:56:36.000000000","message":"s/could/should/\n\nAlso, recommend basically putting all of this (excellent) information in this section into the user and ops guides in your eventual patch series. It\u0027s awesome info.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":164,"context_line":"    It is also recommended to include an additional padding of at"},{"line_number":165,"context_line":"    least 256KB for safety, since ROM sizes can occasionally change."},{"line_number":166,"context_line":"    For example the total of 10832KB required here for ROMs / ACPI"},{"line_number":167,"context_line":"    tables could be rounded up to 16MB."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"    The first two values are expected to commonly vary per VM, and"},{"line_number":170,"context_line":"    are already accounted for dynamically by the placement service."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e06c009e","line":167,"range":{"start_line":167,"start_character":11,"end_line":167,"end_character":16},"in_reply_to":"ffd0ebdf_0894d043","updated":"2019-01-03 18:22:45.000000000","message":"Will fix in subsequent review.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":277,"context_line":"features:"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"- SEV-encrypted VMs cannot yet be live-migrated, or suspended,"},{"line_number":280,"context_line":"  consequently nor resumed.  As already mentioned, support is coming"},{"line_number":281,"context_line":"  in the future.  However this does mean that in the short term, usage"},{"line_number":282,"context_line":"  of SEV will have an impact on compute node maintenance, since"},{"line_number":283,"context_line":"  SEV-encrypted instances will need to be fully shut down before"},{"line_number":284,"context_line":"  migrating off an SEV host."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_6839dc3f","line":281,"range":{"start_line":280,"start_character":51,"end_line":281,"end_character":15},"updated":"2019-01-03 15:56:36.000000000","message":"I\u0027m very curious how support for live migration of VMs with encrypted memory is ever going to be supported... seems to me that the source and destination host would somehow need to share their hardware-stored-and-created secrets with each other over some trusted transmission path. And, doing so opens up a whole slew of security concerns and potential backdoors, I presume.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":24938,"name":"Bryan Stephenson","email":"bryan.stephenson@suse.com","username":"bryans"},"change_message_id":"6054ae746a489538de2dfe62a0b9270111912739","unresolved":false,"context_lines":[{"line_number":277,"context_line":"features:"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"- SEV-encrypted VMs cannot yet be live-migrated, or suspended,"},{"line_number":280,"context_line":"  consequently nor resumed.  As already mentioned, support is coming"},{"line_number":281,"context_line":"  in the future.  However this does mean that in the short term, usage"},{"line_number":282,"context_line":"  of SEV will have an impact on compute node maintenance, since"},{"line_number":283,"context_line":"  SEV-encrypted instances will need to be fully shut down before"},{"line_number":284,"context_line":"  migrating off an SEV host."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_80ebb4ae","line":281,"range":{"start_line":280,"start_character":51,"end_line":281,"end_character":15},"in_reply_to":"ffd0ebdf_6839dc3f","updated":"2019-01-03 18:16:36.000000000","message":"The plan is to decrypt the encrypted memory on the source machine using the SEV keys, encrypt it with a different key used only for transmission over a network (possibly just using TLS), decrypt it at the target machine, and then re-encrypt using the target machine\u0027s SEV key. The SEV keys will not be allowed out of their secure hardware home.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3ae27a95fb66383d87650d2e10f1c99bdad6d4","unresolved":false,"context_lines":[{"line_number":311,"context_line":"     break images with legacy OS\u0027s which expect the config drive to be"},{"line_number":312,"context_line":"     an IDE CD-ROM.  It would also not deal with other CD-ROM devices."},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"  #. Set the (largely undocumented) ``hw_cdrom_bus`` image property to"},{"line_number":315,"context_line":"     ``virtio-scsi``, which is recommended as a replacement for"},{"line_number":316,"context_line":"     ``ide``."},{"line_number":317,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"3f79a3b5_f23f9adb","line":314,"range":{"start_line":314,"start_character":14,"end_line":314,"end_character":34},"updated":"2018-12-17 21:31:12.000000000","message":"True:\n\nhttps://docs.openstack.org/glance/latest/admin/useful-image-properties.html\n\nI reported bug 1808868 for the lack of docs.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":311,"context_line":"     break images with legacy OS\u0027s which expect the config drive to be"},{"line_number":312,"context_line":"     an IDE CD-ROM.  It would also not deal with other CD-ROM devices."},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"  #. Set the (largely undocumented) ``hw_cdrom_bus`` image property to"},{"line_number":315,"context_line":"     ``virtio-scsi``, which is recommended as a replacement for"},{"line_number":316,"context_line":"     ``ide``."},{"line_number":317,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_c0321ca8","line":314,"range":{"start_line":314,"start_character":14,"end_line":314,"end_character":34},"in_reply_to":"3f79a3b5_f23f9adb","updated":"2019-01-03 18:22:45.000000000","message":"Thanks, will add a hyperlink.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3ae27a95fb66383d87650d2e10f1c99bdad6d4","unresolved":false,"context_lines":[{"line_number":312,"context_line":"     an IDE CD-ROM.  It would also not deal with other CD-ROM devices."},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"  #. Set the (largely undocumented) ``hw_cdrom_bus`` image property to"},{"line_number":315,"context_line":"     ``virtio-scsi``, which is recommended as a replacement for"},{"line_number":316,"context_line":"     ``ide``."},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"  Some potentially cleaner long-term solutions which require code"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3f79a3b5_3214324f","line":315,"range":{"start_line":315,"start_character":7,"end_line":315,"end_character":18},"updated":"2018-12-17 21:31:12.000000000","message":"nit: this won\u0027t work, it\u0027s either \u0027virtio\u0027 or \u0027scsi\u0027:\n\nhttps://github.com/openstack/nova/blob/48ad73e1faf966badab1f0344baad9f4f4055abf/nova/objects/fields.py#L320\n\nhttps://github.com/openstack/nova/blob/48ad73e1faf966badab1f0344baad9f4f4055abf/nova/virt/libvirt/blockinfo.py#L198","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":312,"context_line":"     an IDE CD-ROM.  It would also not deal with other CD-ROM devices."},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"  #. Set the (largely undocumented) ``hw_cdrom_bus`` image property to"},{"line_number":315,"context_line":"     ``virtio-scsi``, which is recommended as a replacement for"},{"line_number":316,"context_line":"     ``ide``."},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"  Some potentially cleaner long-term solutions which require code"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_20a2089c","line":315,"range":{"start_line":315,"start_character":7,"end_line":315,"end_character":18},"in_reply_to":"3f79a3b5_3214324f","updated":"2019-01-03 18:22:45.000000000","message":"Ah thanks, good catch.  Yeah, it\u0027s `hw_scsi_model` which needs to be `virtio-scsi`.  Will submit a fix.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":323,"context_line":"expected to be limited when SEV encryption is used:"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"- Cold migration or shelve, since they power off the VM before the"},{"line_number":326,"context_line":"  operation at which point there is no encrypted memory"},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"- Snapshot, since it only snapshots the disk"},{"line_number":329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e8c14c30","line":326,"range":{"start_line":326,"start_character":12,"end_line":326,"end_character":55},"updated":"2019-01-03 15:56:36.000000000","message":"unless PMEM is used... currently not supported, but there is work underway to add support for PMEM. Just something to keep in mind.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":323,"context_line":"expected to be limited when SEV encryption is used:"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"- Cold migration or shelve, since they power off the VM before the"},{"line_number":326,"context_line":"  operation at which point there is no encrypted memory"},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"- Snapshot, since it only snapshots the disk"},{"line_number":329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e0e5e039","line":326,"range":{"start_line":326,"start_character":12,"end_line":326,"end_character":55},"in_reply_to":"ffd0ebdf_e8c14c30","updated":"2019-01-03 18:22:45.000000000","message":"Ah, interesting - thanks.  I\u0027ll add a hyperlink in a separate review.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":335,"context_line":""},{"line_number":336,"context_line":"- Use of spice / VNC / serial / RDP consoles"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"- vNUMA"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"Alternatives"},{"line_number":341,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_28cd145d","line":338,"range":{"start_line":338,"start_character":2,"end_line":338,"end_character":7},"updated":"2019-01-03 15:56:36.000000000","message":"by vNUMA I presume you are referring to a guest\u0027s virtual NUMA topology? Or is there some specific technology called vNUMA?","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":335,"context_line":""},{"line_number":336,"context_line":"- Use of spice / VNC / serial / RDP consoles"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"- vNUMA"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"Alternatives"},{"line_number":341,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e0be40fe","line":338,"range":{"start_line":338,"start_character":2,"end_line":338,"end_character":7},"in_reply_to":"ffd0ebdf_28cd145d","updated":"2019-01-03 18:22:45.000000000","message":"Yes to the former - I think vNUMA is just a convenient abbreviation.  I\u0027ll add this hyperlink in a separate review:\n\nhttps://www.suse.com/documentation/sles-12/singlehtml/article_vt_best_practices/article_vt_best_practices.html#sec.vt.best.perf.numa.vmguest","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":386,"context_line":"   could be used to require the SEV feature; however it is understood"},{"line_number":387,"context_line":"   that `this approach is less preferable because traits provide"},{"line_number":388,"context_line":"   consistent naming for CPU features in some virt drivers, and"},{"line_number":389,"context_line":"   querying traits is efficient"},{"line_number":390,"context_line":"   \u003chttps://docs.openstack.org/nova/latest/admin/configuration/schedulers.html#computecapabilitiesfilter\u003e`_."},{"line_number":391,"context_line":""},{"line_number":392,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e8d62cf2","line":389,"updated":"2019-01-03 15:56:36.000000000","message":"++","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d3b1a7cf434763ef89ec99dbf203a7f0b2061379","unresolved":false,"context_lines":[{"line_number":414,"context_line":"used to implement SEV are locked inside the AMD hardware.  The"},{"line_number":415,"context_line":"hardware random number generator uses the CTR_DRBG construct from"},{"line_number":416,"context_line":"`NIST SP 800-90A \u003chttps://en.wikipedia.org/wiki/NIST_SP_800-90A\u003e`_"},{"line_number":417,"context_line":"which has not been found to be susceptible to any back doors.  It uses"},{"line_number":418,"context_line":"AES counter mode to generate the random numbers."},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"SEV protects data of a VM from attacks originating from outside the"}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_a87d84e8","line":417,"range":{"start_line":417,"start_character":0,"end_line":417,"end_character":61},"updated":"2019-01-03 15:56:36.000000000","message":"and thus my curiosity about live migration ever being supported in the future... :)","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3ae27a95fb66383d87650d2e10f1c99bdad6d4","unresolved":false,"context_lines":[{"line_number":598,"context_line":"   #. Introduce a new ``nova.conf`` option for specifying the default"},{"line_number":599,"context_line":"      bus to use for CD-ROMs.  Then for instance the default could be"},{"line_number":600,"context_line":"      ``scsi`` (for consistency with other CPU architectures) or"},{"line_number":601,"context_line":"      ``virtio-scsi``, with ``hw_cdrom_bus`` overriding this value"},{"line_number":602,"context_line":"      where needed.  This is likely to be more future-proof as the use"},{"line_number":603,"context_line":"      of very old machine types is gradually phased out, although the"},{"line_number":604,"context_line":"      downside is a small risk of breaking legacy images."}],"source_content_type":"text/x-rst","patch_set":16,"id":"3f79a3b5_35473c54","line":601,"range":{"start_line":601,"start_character":7,"end_line":601,"end_character":19},"updated":"2018-12-17 21:31:12.000000000","message":"same","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":598,"context_line":"   #. Introduce a new ``nova.conf`` option for specifying the default"},{"line_number":599,"context_line":"      bus to use for CD-ROMs.  Then for instance the default could be"},{"line_number":600,"context_line":"      ``scsi`` (for consistency with other CPU architectures) or"},{"line_number":601,"context_line":"      ``virtio-scsi``, with ``hw_cdrom_bus`` overriding this value"},{"line_number":602,"context_line":"      where needed.  This is likely to be more future-proof as the use"},{"line_number":603,"context_line":"      of very old machine types is gradually phased out, although the"},{"line_number":604,"context_line":"      downside is a small risk of breaking legacy images."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e0c40043","line":601,"range":{"start_line":601,"start_character":7,"end_line":601,"end_character":19},"in_reply_to":"3f79a3b5_35473c54","updated":"2019-01-03 18:22:45.000000000","message":"ACK, submitting a fix.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3ae27a95fb66383d87650d2e10f1c99bdad6d4","unresolved":false,"context_lines":[{"line_number":605,"context_line":""},{"line_number":606,"context_line":"      If there exist clouds where such legacy x86 images are common,"},{"line_number":607,"context_line":"      the option could then be set to ``ide`` and"},{"line_number":608,"context_line":"      ``hw_cdrom_bus\u003dvirtio-scsi`` overriding when newer machine types"},{"line_number":609,"context_line":"      are required for SEV (or any other reason).  Although this is"},{"line_number":610,"context_line":"      perhaps sufficiently unlikely as to make a new config option"},{"line_number":611,"context_line":"      overkill."}],"source_content_type":"text/x-rst","patch_set":16,"id":"3f79a3b5_1544804d","line":608,"range":{"start_line":608,"start_character":21,"end_line":608,"end_character":32},"updated":"2018-12-17 21:31:12.000000000","message":"Again, this would either have to be \u0027virtio\u0027 or \u0027scsi\u0027.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":605,"context_line":""},{"line_number":606,"context_line":"      If there exist clouds where such legacy x86 images are common,"},{"line_number":607,"context_line":"      the option could then be set to ``ide`` and"},{"line_number":608,"context_line":"      ``hw_cdrom_bus\u003dvirtio-scsi`` overriding when newer machine types"},{"line_number":609,"context_line":"      are required for SEV (or any other reason).  Although this is"},{"line_number":610,"context_line":"      perhaps sufficiently unlikely as to make a new config option"},{"line_number":611,"context_line":"      overkill."}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_00c26434","line":608,"range":{"start_line":608,"start_character":21,"end_line":608,"end_character":32},"in_reply_to":"3f79a3b5_1544804d","updated":"2019-01-03 18:22:45.000000000","message":"ACK, submitting a fix.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3ae27a95fb66383d87650d2e10f1c99bdad6d4","unresolved":false,"context_lines":[{"line_number":690,"context_line":"  `limitations`_ here too, including the impact on compute host"},{"line_number":691,"context_line":"  maintenance, and the need to correctly calculate"},{"line_number":692,"context_line":"  `reserved_host_memory_mb`_ based on the expected maximum number of"},{"line_number":693,"context_line":"  SEV guests simultaneously running on the host."},{"line_number":694,"context_line":""},{"line_number":695,"context_line":"Other non-nova documentation should be updated too:"},{"line_number":696,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"3f79a3b5_956090d3","line":693,"updated":"2018-12-17 21:31:12.000000000","message":"And config drive, etc...","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"},{"author":{"_account_id":2394,"name":"Adam Spiers","email":"aspiers@suse.com","username":"adam.spiers"},"change_message_id":"4c35cf4f74bfe34548a46faa6f0752f8bfb5e968","unresolved":false,"context_lines":[{"line_number":690,"context_line":"  `limitations`_ here too, including the impact on compute host"},{"line_number":691,"context_line":"  maintenance, and the need to correctly calculate"},{"line_number":692,"context_line":"  `reserved_host_memory_mb`_ based on the expected maximum number of"},{"line_number":693,"context_line":"  SEV guests simultaneously running on the host."},{"line_number":694,"context_line":""},{"line_number":695,"context_line":"Other non-nova documentation should be updated too:"},{"line_number":696,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"ffd0ebdf_e053a0e1","line":693,"in_reply_to":"3f79a3b5_956090d3","updated":"2019-01-03 18:22:45.000000000","message":"Sure - the backlink covers this but I\u0027ll add it in explicitly in a new change.","commit_id":"3a6c649a04ace1742682d63242ba6c18ba26eb9b"}]}