| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-02 | |||
| 15:39:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Ignore SEV-ES when SEV-SNP is detected https://review.opendev.org/c/openstack/nova/+/994343 | |
| 15:39:26 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Omit optional fields for SEV/SEV-ES https://review.opendev.org/c/openstack/nova/+/994921 | |
| 15:39:26 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Support launchSecurity element for SEV-SNP https://review.opendev.org/c/openstack/nova/+/994920 | |
| 15:39:27 | opendevreview | Takashi Kajinami proposed openstack/nova master: AMD SEV: omit iommu='on' for virtio devices https://review.opendev.org/c/openstack/nova/+/909635 | |
| 15:39:27 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Drop sev capability check in launch instance flow https://review.opendev.org/c/openstack/nova/+/994929 | |
| 15:39:28 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-SNP memory encryption https://review.opendev.org/c/openstack/nova/+/994930 | |
| 15:39:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove [libvirt] num_memory_encrypted_guests https://review.opendev.org/c/openstack/nova/+/995120 | |
| 15:39:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Update documentations for AMD SEV-SNP support https://review.opendev.org/c/openstack/nova/+/995090 | |
| 15:48:07 | opendevreview | Lajos Katona proposed openstack/nova master: Add regression test to repoduce bug 1854844 https://review.opendev.org/c/openstack/nova/+/991772 | |
| 15:48:07 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Avoid setting MTU during live migration if different https://review.opendev.org/c/openstack/nova/+/995809 | |
| 15:48:08 | opendevreview | Lajos Katona proposed openstack/nova master: libvirt: Preserve queue_size during live migration https://review.opendev.org/c/openstack/nova/+/995841 | |
| 15:59:08 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 15:59:09 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 17:49:52 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 17:50:41 | dansmith | gmaan: melwitt: This ^ security bug got publicized a bit earlier than intended, so if you could quickly have a look at that fix real quick I'd appreciate it :) | |
| 17:51:20 | gmaan | dansmith: checking | |
| 17:55:25 | gmaan | at least it is not yet on ML, it can be mark private again ? | |
| 17:58:37 | dansmith | gmaan: I guess it could, but the plan was to mark it public and push up a fix, not embargoed | |
| 17:59:00 | dansmith | it got marked public right away and I just had a few minutes to work up a fix is all :) | |
| 18:01:35 | gmaan | dansmith: ack, lgtm, but it need release notes alslo | |
| 18:02:22 | dansmith | gmaan: does it? | |
| 18:02:29 | dansmith | just because of the bug? | |
| 18:03:25 | gmaan | yeah mainly for bug, i mean it is still secure until they have valid console token but in case to make it aware that some potential issue is fixed in this change | |
| 18:03:31 | dansmith | I continue to argue that I don't understand the point of documenting every bug we fix a a reno when we also link the bugs, but serious bugs make sense.. not sure this qualifies just because it's security, but okay :) | |
| 18:05:31 | gmaan | honestly saying I do not see this a direct security as console access is still protected by token validation but still it provide a way to add host | |
| 18:06:18 | dansmith | gmaan: it's poisoning the CORS list and you can exhaust host memory by continuing to expand it, but agree, not super serious which is why I thought direct to public and a fix, no embargo | |
| 18:06:44 | dansmith | provides more opportunity for XSS/phishing attack | |
| 18:07:10 | gmaan | yeah, that is valid point | |
| 18:15:04 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 22:47:15 | opendevreview | Merged openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| #openstack-nova - 2026-07-03 | |||
| 07:21:34 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 09:56:20 | gibi | tkajinam: do I understand correctly that if you use stateless firmware (like in SNP) then you cannot reboot the VM from inside the guest? At least I see that the VM stops normally, printing that it will be rebooted but it never starts up. I assume it is connected to the statelessness of things but I can be mistaken | |
| 09:56:49 | gibi | this is the last thing visible in the guest | |
| 09:56:51 | gibi | [ 33.971858] reboot: Restarting system | |
| 10:00:13 | gibi | hm, qemu logs | |
| 10:00:14 | gibi | 2026-07-03T09:53:41.222388Z qemu-kvm: cpus are not resettable, terminating | |
| 10:07:04 | gibi | hm it is not the firmware it is SEV-ES / SNP that has this limitation | |
| 10:07:13 | gibi | I'm filing a bug to document it | |
| 10:13:23 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 10:13:36 | gibi | so it is just a qemu limitation that is being fixed | |
| 10:21:09 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 10:27:18 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:34:00 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:42:09 | ralonsoh | sean-k-mooney, hi! just if you didn't see the conversation in the neutron channel | |
| 10:42:21 | ralonsoh | I created https://bugs.launchpad.net/os-vif/+bug/2159024 | |
| 10:42:29 | ralonsoh | and pushed this: https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 11:21:55 | tkajinam | gibi, oh, thanks for that. I'll check that later | |
| 11:22:10 | sean-k-mooney | ralonsoh: i have not read it back yet but my clinet is there ill reply in the neutorn channel | |
| 11:22:11 | tkajinam | we likely need to block the operation properly at api layer instead of putting the instance in that hung state ... | |
| 11:28:42 | gibi | tkajinam: it does not hung, it stops cleanly. and can be started via the API | |
| 11:28:52 | gibi | but it cannot be fully restarted from the guest | |
| 11:29:46 | gibi | https://bugs.launchpad.net/nova/+bug/2159023 | |
| 11:29:57 | sean-k-mooney | gibi: that os-vif patch above form ralonsoh is a nice easy one to review if you have time | |
| 11:30:35 | sean-k-mooney | gibi: also thts fun, it sound like perhaps a qemu bug | |
| 11:31:12 | sean-k-mooney | you shoudl be able to reboot form inside the guest as that doe not halt the domain | |
| 11:33:16 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 11:33:17 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 11:42:32 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 11:46:53 | opendevreview | Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581 | |
| 12:06:12 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 12:53:46 | tkajinam | gibi, ahh ok. | |
| 12:54:08 | tkajinam | now I remember I saw that behavior during my old testing and just documenting that limitation would be enough now | |
| 12:56:08 | sean-k-mooney | tkajinam: it should be pretty proment | |
| 12:56:27 | sean-k-mooney | its pretty problematic as it a faily core fucntioantliy | |
| 12:57:01 | sean-k-mooney | it means that you can use normal widnows update flows or just reboot normaly for kernel upgrades ectra | |
| 12:57:21 | gibi | sean-k-mooney: it is a qemu limitation that is being lifted in qemu 11 | |
| 12:57:27 | sean-k-mooney | so it defintly need to get reported to qemu or amd as a issue to be adressed not jsut a footnote in our docs | |
| 12:57:37 | sean-k-mooney | gibi: ah cool | |
| 12:57:39 | gibi | they way how qemu did the reset of the vcpu did not work for ES and SEV instances | |
| 12:57:56 | gibi | due to encrypted registers | |
| 12:57:57 | gibi | afaik | |
| 12:58:10 | sean-k-mooney | int13? | |
| 12:58:19 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 12:58:32 | gibi | more details are here ^^ | |
| 12:59:00 | gibi | I haven't tested qemu 11 as it is only available in rawhide at the moment and the machine I have does not like fedora :) | |
| 12:59:34 | sean-k-mooney | ah no i was thinking in INT 19 | |
| 13:00:21 | sean-k-mooney | anyway cool | |
| 13:00:37 | gibi | :) | |
| 13:01:08 | sean-k-mooney | if its going away then ya just add an important:: note in the docs is fine | |
| 13:02:19 | sean-k-mooney | qemu 11 isnec quite out yet in distos | |
| 13:02:31 | gibi | yeah | |
| 13:02:33 | gibi | too new | |
| 13:03:35 | gibi | hm, I have it in sid, but that would be even harder to put on this lab machine | |
| 13:03:36 | sean-k-mooney | tkajinam: i would ask that we also put this in the release not for the feature if that ok | |
| 13:03:57 | sean-k-mooney | gibi: you can enable the virt preview repo | |
| 13:04:01 | sean-k-mooney | are you on c10s | |
| 13:04:15 | sean-k-mooney | https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/ | |
| 13:04:41 | sean-k-mooney | htat has qemu 2:11.0.0-11 | |
| 13:05:29 | sean-k-mooney | you just need to add https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/repo/centos-stream-10/group_virtmaint-sig-virt-preview-centos-stream-10.repo | |
| 13:05:33 | sean-k-mooney | to your repo config | |
| 13:06:03 | gibi | ooh OK, I can try that. The lab machine is on centos10 yes | |
| 13:06:13 | sean-k-mooney | with that said i woudl finish any ohter testing you want to do first before doing that | |
| 13:06:24 | sean-k-mooney | it normally does not breakthing but it can | |
| 13:06:29 | gibi | yeah I'm mostly done with the exploratory testing | |
| 13:08:07 | sean-k-mooney | there was a patch probaly litrally decades ago to add a flag to enabel the virt preview repo in devstack but i dotn think that ever landed | |
| 13:08:32 | sean-k-mooney | i remember "dicusssing" that wehn trying to get dpdk suprpot into openstack | |
| 13:30:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 13:33:40 | sean-k-mooney | tkajinam: locked memory is not ment ot requried hugepages | |
| 13:33:41 | tdemaret | Hi core team, I need help to understant, what I must doing to validate my spec and validate my code : my pr is here, and I think, I don t understand something : https://review.opendev.org/c/openstack/nova-specs/+/979696 - https://review.opendev.org/c/openstack/nova/+/979693 ( I see the merge conflict, but it is a 3 times, I think, I need to validate my spec before I fix it ? ) | |
| 13:34:59 | sean-k-mooney | tkajinam: unless im conflatin gthat with realtime | |