| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-02 | |||
| 14:53:55 | gibi | Entering emergency mode. Exit the shell to continue. | |
| 14:53:57 | gibi | Type "journalctl" to view system logs. | |
| 14:54:00 | gibi | You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot | |
| 14:54:03 | gibi | after mounting them and attach it to a bug report. | |
| 14:54:59 | tkajinam | ok. you might need to add os_command_line property, too, though I think it's ok as long as domain boots because it indicates that ovmf actually supports measured boot using dkb | |
| 14:55:07 | tkajinam | do you see kernelHashes: yes in libvirt domain ,right ? | |
| 14:55:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | |
| 14:55:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 14:56:13 | gibi | <launchSecurity type='sev-snp' kernelHashes='yes' authorKey='no' vcek='yes'> | |
| 14:56:16 | gibi | yep | |
| 14:56:23 | tkajinam | nice | |
| 14:57:40 | gibi | I really like how attestation made easy via the device added to the guest. As far as I see intel TDX does not have that | |
| 14:57:57 | tkajinam | yeah | |
| 14:58:04 | tkajinam | TDX and SGX complicated it by qgs | |
| 14:58:15 | tkajinam | while in SNP it's fully handled within the hardware | |
| 14:59:48 | tkajinam | the mechanisms to validate integrity of attestation reports is much more complicated in TDX, than SNP | |
| 15:00:51 | tkajinam | that's one of the main reasons SNP is still popular in this area | |
| 15:35:27 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 15:35:27 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 15:38:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: Validate image properties for stateless firmware at API layer https://review.opendev.org/c/openstack/nova/+/995835 | |
| 15:39:24 | opendevreview | Takashi Kajinami proposed openstack/nova master: compute: Validate SEV/SEV-ES support at start up https://review.opendev.org/c/openstack/nova/+/994342 | |
| 15:39:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Detect AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/994764 | |
| 15:39:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | |
| 15:39:26 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | |
| 15:39:26 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | |
| 15:39:27 | opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | |
| 15:39:27 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | |
| 15:39:28 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | |
| 15:39:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 15:39:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | |
| 15:48:07 | opendevreview | Lajos Katona proposed openstack/nova master: Add regression test to repoduce bug 1854844 https://review.opendev.org/c/openstack/nova/+/991772 | |
| 15:48:07 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809 | |
| 15:48:08 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Preserve queue_size during live migration https://review.opendev.org/c/openstack/nova/+/995841 | |
| 15:59:08 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 15:59:09 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 17:49:52 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 17:50:41 | dansmith | gmaan: melwitt: This ^ security bug got publicized a bit earlier than intended, so if you could quickly have a look at that fix real quick I'd appreciate it :) | |
| 17:51:20 | gmaan | dansmith: checking | |
| 17:55:25 | gmaan | at least it is not yet on ML, it can be mark private again ? | |
| 17:58:37 | dansmith | gmaan: I guess it could, but the plan was to mark it public and push up a fix, not embargoed | |
| 17:59:00 | dansmith | it got marked public right away and I just had a few minutes to work up a fix is all :) | |
| 18:01:35 | gmaan | dansmith: ack, lgtm, but it need release notes alslo | |
| 18:02:22 | dansmith | gmaan: does it? | |
| 18:02:29 | dansmith | just because of the bug? | |
| 18:03:25 | gmaan | yeah mainly for bug, i mean it is still secure until they have valid console token but in case to make it aware that some potential issue is fixed in this change | |
| 18:03:31 | dansmith | I continue to argue that I don't understand the point of documenting every bug we fix a a reno when we also link the bugs, but serious bugs make sense.. not sure this qualifies just because it's security, but okay :) | |
| 18:05:31 | gmaan | honestly saying I do not see this a direct security as console access is still protected by token validation but still it provide a way to add host | |
| 18:06:18 | dansmith | gmaan: it's poisoning the CORS list and you can exhaust host memory by continuing to expand it, but agree, not super serious which is why I thought direct to public and a fix, no embargo | |
| 18:06:44 | dansmith | provides more opportunity for XSS/phishing attack | |
| 18:07:10 | gmaan | yeah, that is valid point | |
| 18:15:04 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 22:47:15 | opendevreview | Merged openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| #openstack-nova - 2026-07-03 | |||
| 07:21:34 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 09:56:20 | gibi | tkajinam: do I understand correctly that if you use stateless firmware (like in SNP) then you cannot reboot the VM from inside the guest? At least I see that the VM stops normally, printing that it will be rebooted but it never starts up. I assume it is connected to the statelessness of things but I can be mistaken | |
| 09:56:49 | gibi | this is the last thing visible in the guest | |
| 09:56:51 | gibi | [ 33.971858] reboot: Restarting system | |
| 10:00:13 | gibi | hm, qemu logs | |
| 10:00:14 | gibi | 2026-07-03T09:53:41.222388Z qemu-kvm: cpus are not resettable, terminating | |
| 10:07:04 | gibi | hm it is not the firmware it is SEV-ES / SNP that has this limitation | |
| 10:07:13 | gibi | I'm filing a bug to document it | |
| 10:13:23 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 10:13:36 | gibi | so it is just a qemu limitation that is being fixed | |
| 10:21:09 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 10:27:18 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:34:00 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:42:09 | ralonsoh | sean-k-mooney, hi! just if you didn't see the conversation in the neutron channel | |
| 10:42:21 | ralonsoh | I created https://bugs.launchpad.net/os-vif/+bug/2159024 | |
| 10:42:29 | ralonsoh | and pushed this: https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 11:21:55 | tkajinam | gibi, oh, thanks for that. I'll check that later | |
| 11:22:10 | sean-k-mooney | ralonsoh: i have not read it back yet but my clinet is there ill reply in the neutorn channel | |
| 11:22:11 | tkajinam | we likely need to block the operation properly at api layer instead of putting the instance in that hung state ... | |
| 11:28:42 | gibi | tkajinam: it does not hung, it stops cleanly. and can be started via the API | |
| 11:28:52 | gibi | but it cannot be fully restarted from the guest | |
| 11:29:46 | gibi | https://bugs.launchpad.net/nova/+bug/2159023 | |
| 11:29:57 | sean-k-mooney | gibi: that os-vif patch above form ralonsoh is a nice easy one to review if you have time | |
| 11:30:35 | sean-k-mooney | gibi: also thts fun, it sound like perhaps a qemu bug | |
| 11:31:12 | sean-k-mooney | you shoudl be able to reboot form inside the guest as that doe not halt the domain | |
| 11:33:16 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 11:33:17 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 11:42:32 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 11:46:53 | opendevreview | Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581 | |
| 12:06:12 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 12:53:46 | tkajinam | gibi, ahh ok. | |
| 12:54:08 | tkajinam | now I remember I saw that behavior during my old testing and just documenting that limitation would be enough now | |
| 12:56:08 | sean-k-mooney | tkajinam: it should be pretty proment | |
| 12:56:27 | sean-k-mooney | its pretty problematic as it a faily core fucntioantliy | |
| 12:57:01 | sean-k-mooney | it means that you can use normal widnows update flows or just reboot normaly for kernel upgrades ectra | |
| 12:57:21 | gibi | sean-k-mooney: it is a qemu limitation that is being lifted in qemu 11 | |
| 12:57:27 | sean-k-mooney | so it defintly need to get reported to qemu or amd as a issue to be adressed not jsut a footnote in our docs | |
| 12:57:37 | sean-k-mooney | gibi: ah cool | |
| 12:57:39 | gibi | they way how qemu did the reset of the vcpu did not work for ES and SEV instances | |
| 12:57:56 | gibi | due to encrypted registers | |
| 12:57:57 | gibi | afaik | |
| 12:58:10 | sean-k-mooney | int13? | |
| 12:58:19 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 12:58:32 | gibi | more details are here ^^ | |
| 12:59:00 | gibi | I haven't tested qemu 11 as it is only available in rawhide at the moment and the machine I have does not like fedora :) | |
| 12:59:34 | sean-k-mooney | ah no i was thinking in INT 19 | |
| 13:00:21 | sean-k-mooney | anyway cool | |
| 13:00:37 | gibi | :) | |