[SRU] Allow for specifying common baseline CPU model with disabled feature

[Paul Goins]

******** SRU TEMPLATE AT THE BOTTOM *******

Hello,

This is very similar to pad.lv/1852437 (and the related blueprint at https://blueprints.launchpad.net/nova/+spec/allow-disabling-cpu-flags), but there is a very different and important nuance.

A customer I'm working with has two classes of blades that they're trying to use. Their existing ones are Cascade Lake-based; they are presently using the Cascadelake-Server-noTSX CPU model via libvirt.cpu_model in nova.conf. Their new blades are Ice Lake-based, which is a newer processor, which typically would also be able to run based on the Cascade Lake feature set - except that these Ice Lake processors lack the MPX feature defined in the Cascadelake-Server-noTSX model.

The result of this is evident when I try to start nova on the new blades with the Ice Lake CPUs. Even if I specify the following in my nova.conf:

[libvirt]
cpu_mode = custom
cpu_model = Cascadelake-Server-noTSX
cpu_model_extra_flags = -mpx

That is not enough to allow Nova to start; it fails in the libvirt driver in the _check_cpu_compatibility function:

2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service Traceback (most recent call last):
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 771, in _check_cpu_compatibility
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service self._compare_cpu(cpu, self._get_cpu_info(), None)
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 8817, in _compare_cpu
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service raise exception.InvalidCPUInfo(reason=m % {'ret': ret, 'u': u})
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service nova.exception.InvalidCPUInfo: Unacceptable CPU info: CPU doesn't have compatibility.
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service 0
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service Refer to http://libvirt.org/html/libvirt-libvirt-host.html#virCPUCompareResult
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service During handling of the above exception, another exception occurred:
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service Traceback (most recent call last):
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/oslo_service/service.py", line 810, in run_service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service service.start()
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/nova/service.py", line 173, in start
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service self.manager.init_host()
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/nova/compute/manager.py", line 1404, in init_host
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service self.driver.init_host(host=self.host)
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 743, in init_host
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service self._check_cpu_compatibility()
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 777, in _check_cpu_compatibility
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service raise exception.InvalidCPUInfo(msg)
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service nova.exception.InvalidCPUInfo: Configured CPU model: Cascadelake-Server-noTSX is not compatible with host CPU. Please correct your config and try again. Unacceptable CPU info: CPU doesn't have compatibility.
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service 0
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service Refer to http://libvirt.org/html/libvirt-libvirt-host.html#virCPUCompareResult
2022-12-15 17:20:59.562 1836708 ERROR oslo_service.service

If I make a custom libvirt CPU map file which removes the "<feature name='mpx'/>" feature and specify that as the cpu_model instead, I am able to make Nova start - so it does indeed seem to specifically be that single feature which is blocking me. However, editing the libvirt CPU mapping files is probably not the right way to fix this - hence why I'm filing this bug, for discussion of how to support cases like this.

Currently the only "proper" way I'm aware of to work around this right now is to fall back to a Broadwell-based configuration which lacks the "mpx" feature to use as a common baseline, but that's a much older configuration than Cascade Lake and would mean missing out on all the other features which are common in both Cascade Lake and Ice Lake. I would rather if there were a way to use the Cascade Lake settings but simply remove that "mpx" feature from use.

----

Steps to reproduce
==================

On an Ice Lake system lacking the MPX feature (e.g. /proc/cpuinfo reporting model of "Intel(R) Xeon(R) Gold 5318Y"), specify the following settings in nova.conf in libvirt settings:

[libvirt]
cpu_mode = custom
cpu_model = Cascadelake-Server-noTSX
cpu_model_extra_flags = -mpx

Then try to start nova.

Expected result
===============

Nova should start since Cascadelake-Server-noTSX is a subset of Icelake-Server-noTSX, thus allowing the use of Cascadelake-Server-noTSX as a common baseline model for both Cascade Lake and Ice Lake servers.

Actual result
=============

Nova refuses to start, claiming the specified CPU model is incompatible. The "cpu_model_extra_flags = -mpx" config option does not help.

Environment
===========

Nova/OpenStack version: OpenStack Ussuri running on Ubuntu Focal. Specifically, nova packages are at version 2:21.2.4-0ubuntu2.

Hypervisor: libvirt + KVM

Other relevant notes
====================

There are some other open related bugs. The removal of the MPX feature in some Ice Lake processors has manifested in other ways as well. These bugs are primarily in regards to the missing MPX feature breaking how Ice Lake processors are detected, so the nuance is somewhat different - however, they may be worth reviewing as well.

* https://gitlab.com/libvirt/libvirt/-/issues/304: bug regarding the Icelake CPU maps in libvirt not working to detect certain Ice Lakes, instead detecting them as Broadwell-noTSX-IBRS according to "virsh capabilities" due to lacking the MPX feature. (I've personally tested that removing the mpx feature from the associated CPU mapping files allows for detecting as Ice Lake, but that's not the correct way to fix this.)

There is also an interesting comment on this bug at https://gitlab.com/libvirt/libvirt/-/issues/304#note_1065798706. It basically implies that rather than looking at "virsh capabilities", "virsh domcapabilities" should be used instead as it seems to more correctly identify the CPU model even if there are disabled flags like MPX.

* https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1978064: Launchpad-side bug regarding the above issue as encountered in Ubuntu.

===============
SRU Description
===============

[Impact]

When using IceLake CPUs alongside CascadeLake CPUs, the Nova code does not start due to comparing CPU models. It fails before even comparing the flags. Unfortunately, IceLake CPUs are detected as having compatibility with Broadwell, not CascadeLake. Using Broadwell as a common denominator disables many modern features. The Libvirt upstream team will not add specific support to IceLake [1]. The fix [2] in Nova is to ignore CPU check (as a configurable workaround) as let libvirt handle the added/removed flags, which is assumed to work for this specific case.

[Test case]

Due to not having Icelake and Cascadelake CPUs in our usual lab for testing of this specific scenario, the test case for this could be either:

1) run for this SRU is running the charmed-openstack-tester [1] against the environment containing the upgraded package (essentially as it would be in a point release SRU) and expect the test to pass. Test run evidence will be attached to LP.

2) manually deploy nova and the necessary openstack services to get Nova to the code point of validating the issue in a single node. I already achieved this and was able to test the fix by hacking the node code to bypass the need of other services (conductor, keystone, mysql, etc) but for a proper validation a clean installation (without any hackery) is considered mandatory. In such case, the test case would be:

a) Deploy nova and required services in an IceLake machine
b) Make sure the nova.conf has:

cpu_mode = custom
cpu_models = Cascadelake-Server-noTSX
cpu_model_extra_flags = -mpx

c) Check /var/log/nova/nova-compute.log for a successful nova-compute service boot. It will not start properly without the fix, therefore presenting the error:

2024-07-08 15:08:48.378 8399 CRITICAL nova [-] Unhandled error: nova.exception.InvalidCPUInfo: Configured CPU model: Cascadelake-Server-noTSX is not compatible with host CPU. Please correct your config and try again. Unacceptable CPU info: CPU doesn't have compatibility.

d) Install package containing the fix and confirm the successful nova-compute service restart, not containing the error and containing this instead:

2024-07-09 19:41:31.806 243487 DEBUG nova.virt.libvirt.driver [-] cpu compare xml: <cpu match="exact">
  <model>Cascadelake-Server-noTSX</model>
  <feature name="mpx" policy="disable"/>
</cpu>

[Regression Potential]

There is 1 new behavior introduced and 1 changed. The behavior introduced is gated by a new config option that needs to be enabled, and when enabled, it skips running the code. The behavior changed is the one assumed by the default disabled value of the config option. The fact that the code being backported in Yoga-Ussuri is exactly the same as in currently Master (Caracal+), it means that no issues have been found with the code across 4 releases, giving some confidence that the code changed is unlikely to cause issues.

[Other Info]

[1] https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1978064
[2] https://review.opendev.org/c/openstack/nova/+/871969

[Edward Hope-Morley (hopem)]

The reason this doesn't currently work is because Nova does not take the cpu-extra-flags into consideration when checking the host cpu model against one provided in cpu-models [1]. I believe it should be safe to do that so we should try to get that added.

The point about capabilities vs. domcapabilities is interesting and if the latter is the more accurate source of information, Nova should probably be using it.

[1] https://github.com/openstack/nova/blob/8a476061c5e034016668cd9e5a20c4430ef6b68d/nova/virt/libvirt/driver.py#L987

[Paul Goins (vultaire)]

As requested out-of-band by Edward, provided "virsh capabilities" and "virsh domcapabilities" output from both an M5 and M6 blade. In the M6 case, we can clearly see that "virsh capabilities" detects as Broadwell while "virsh domcapabilities" detects as Ice Lake.

[Artom Lifshitz (notartom)]

Are you able to try with this change that is merged on master and is in the process of being backported? Sounds like it should fix your situation.

[1] https://review.opendev.org/q/I8ef9db851b37c5249d2efbe09a15a1ddbae8205d

[Artom Lifshitz (notartom)]

(Setting to Incomplete waiting for your answer, please move to New when you reply)

[Launchpad Janitor (janitor)]

[Expired for OpenStack Compute (nova) because there has been no activity for 60 days.]

[Mauricio Faria de Oliveira (mfo)]

The patch is present in Ubuntu Mantic and later.

$ git grep skip_cpu_compare_at_startup pkg/ubuntu/oracular-devel -- nova/conf/workarounds.py
pkg/ubuntu/oracular-devel:nova/conf/workarounds.py: cfg.BoolOpt('skip_cpu_compare_at_startup',

$ git grep skip_cpu_compare_at_startup pkg/ubuntu/noble-devel -- nova/conf/workarounds.py
pkg/ubuntu/noble-devel:nova/conf/workarounds.py: cfg.BoolOpt('skip_cpu_compare_at_startup',

$ git grep skip_cpu_compare_at_startup pkg/ubuntu/mantic-devel -- nova/conf/workarounds.py
pkg/ubuntu/mantic-devel:nova/conf/workarounds.py: cfg.BoolOpt('skip_cpu_compare_at_startup',

$ git grep skip_cpu_compare_at_startup pkg/ubuntu/jammy-devel -- nova/conf/workarounds.py
$

$ git grep skip_cpu_compare_at_startup pkg/ubuntu/focal-devel -- nova/conf/workarounds.py
$

$ git grep skip_cpu_compare_at_startup pkg/ubuntu/bionic-devel -- nova/conf/workarounds.py
$

[Mauricio Faria de Oliveira (mfo)]

The patch cannot be applied to Ubuntu Bionic (18.04), since its libvirt version is older than the minimum required (mentioned in the patch).

The Ubuntu Cloud Archive for Bionic (eg, from Focal / Ussuri) can be used/patched though, as it provides a sufficiently newer version of libvirt.

`QEMU >=2.9 and libvirt >= 4.4.0 are the mininum required versions`

$ rmadison -a source libvirt -s bionic-updates # ubuntu archive
 libvirt | 4.0.0-1ubuntu8.21 | bionic-updates | source

$ cmadison libvirt | grep bionic-updates # cloud archive
 libvirt | 5.0.0-1ubuntu2.6~cloud3 | stein | bionic-updates | source
 libvirt | 5.4.0-0ubuntu5.4~cloud1.1 | train | bionic-updates | source
 libvirt | 6.0.0-0ubuntu8.16~cloud0 | ussuri | bionic-updates | source

[Mauricio Faria de Oliveira (mfo)]

Hi Rodrigo,

Thanks for the debdiffs and SRU template!

I've had minor changes to the Jammy upload, and build-tested it in a PPA [1].
It looks good; uploading!

(I'm looking into/building Focal.)

[1] https://launchpad.net/~mfo/+archive/ubuntu/lp1999814

[Andreas Hasenack (ahasenack)]

Hello Paul, or anyone else affected,

Accepted nova into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nova/3:25.2.1-0ubuntu2.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Mauricio Faria de Oliveira (mfo)]

Likewise for Focal. Uploaded!