| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-02 | |||
| 18:02:22 | dansmith | gmaan: does it? | |
| 18:02:29 | dansmith | just because of the bug? | |
| 18:03:25 | gmaan | yeah mainly for bug, i mean it is still secure until they have valid console token but in case to make it aware that some potential issue is fixed in this change | |
| 18:03:31 | dansmith | I continue to argue that I don't understand the point of documenting every bug we fix a a reno when we also link the bugs, but serious bugs make sense.. not sure this qualifies just because it's security, but okay :) | |
| 18:05:31 | gmaan | honestly saying I do not see this a direct security as console access is still protected by token validation but still it provide a way to add host | |
| 18:06:18 | dansmith | gmaan: it's poisoning the CORS list and you can exhaust host memory by continuing to expand it, but agree, not super serious which is why I thought direct to public and a fix, no embargo | |
| 18:06:44 | dansmith | provides more opportunity for XSS/phishing attack | |
| 18:07:10 | gmaan | yeah, that is valid point | |
| 18:15:04 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 22:47:15 | opendevreview | Merged openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| #openstack-nova - 2026-07-03 | |||
| 07:21:34 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 09:56:20 | gibi | tkajinam: do I understand correctly that if you use stateless firmware (like in SNP) then you cannot reboot the VM from inside the guest? At least I see that the VM stops normally, printing that it will be rebooted but it never starts up. I assume it is connected to the statelessness of things but I can be mistaken | |
| 09:56:49 | gibi | this is the last thing visible in the guest | |
| 09:56:51 | gibi | [ 33.971858] reboot: Restarting system | |
| 10:00:13 | gibi | hm, qemu logs | |
| 10:00:14 | gibi | 2026-07-03T09:53:41.222388Z qemu-kvm: cpus are not resettable, terminating | |
| 10:07:04 | gibi | hm it is not the firmware it is SEV-ES / SNP that has this limitation | |
| 10:07:13 | gibi | I'm filing a bug to document it | |
| 10:13:23 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 10:13:36 | gibi | so it is just a qemu limitation that is being fixed | |
| 10:21:09 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 10:27:18 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:34:00 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:42:09 | ralonsoh | sean-k-mooney, hi! just if you didn't see the conversation in the neutron channel | |
| 10:42:21 | ralonsoh | I created https://bugs.launchpad.net/os-vif/+bug/2159024 | |
| 10:42:29 | ralonsoh | and pushed this: https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 11:21:55 | tkajinam | gibi, oh, thanks for that. I'll check that later | |
| 11:22:10 | sean-k-mooney | ralonsoh: i have not read it back yet but my clinet is there ill reply in the neutorn channel | |
| 11:22:11 | tkajinam | we likely need to block the operation properly at api layer instead of putting the instance in that hung state ... | |
| 11:28:42 | gibi | tkajinam: it does not hung, it stops cleanly. and can be started via the API | |
| 11:28:52 | gibi | but it cannot be fully restarted from the guest | |
| 11:29:46 | gibi | https://bugs.launchpad.net/nova/+bug/2159023 | |
| 11:29:57 | sean-k-mooney | gibi: that os-vif patch above form ralonsoh is a nice easy one to review if you have time | |
| 11:30:35 | sean-k-mooney | gibi: also thts fun, it sound like perhaps a qemu bug | |
| 11:31:12 | sean-k-mooney | you shoudl be able to reboot form inside the guest as that doe not halt the domain | |
| 11:33:16 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 11:33:17 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 11:42:32 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 11:46:53 | opendevreview | Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581 | |
| 12:06:12 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 12:53:46 | tkajinam | gibi, ahh ok. | |
| 12:54:08 | tkajinam | now I remember I saw that behavior during my old testing and just documenting that limitation would be enough now | |
| 12:56:08 | sean-k-mooney | tkajinam: it should be pretty proment | |
| 12:56:27 | sean-k-mooney | its pretty problematic as it a faily core fucntioantliy | |
| 12:57:01 | sean-k-mooney | it means that you can use normal widnows update flows or just reboot normaly for kernel upgrades ectra | |
| 12:57:21 | gibi | sean-k-mooney: it is a qemu limitation that is being lifted in qemu 11 | |
| 12:57:27 | sean-k-mooney | so it defintly need to get reported to qemu or amd as a issue to be adressed not jsut a footnote in our docs | |
| 12:57:37 | sean-k-mooney | gibi: ah cool | |
| 12:57:39 | gibi | they way how qemu did the reset of the vcpu did not work for ES and SEV instances | |
| 12:57:56 | gibi | due to encrypted registers | |
| 12:57:57 | gibi | afaik | |
| 12:58:10 | sean-k-mooney | int13? | |
| 12:58:19 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 12:58:32 | gibi | more details are here ^^ | |
| 12:59:00 | gibi | I haven't tested qemu 11 as it is only available in rawhide at the moment and the machine I have does not like fedora :) | |
| 12:59:34 | sean-k-mooney | ah no i was thinking in INT 19 | |
| 13:00:21 | sean-k-mooney | anyway cool | |
| 13:00:37 | gibi | :) | |
| 13:01:08 | sean-k-mooney | if its going away then ya just add an important:: note in the docs is fine | |
| 13:02:19 | sean-k-mooney | qemu 11 isnec quite out yet in distos | |
| 13:02:31 | gibi | yeah | |
| 13:02:33 | gibi | too new | |
| 13:03:35 | gibi | hm, I have it in sid, but that would be even harder to put on this lab machine | |
| 13:03:36 | sean-k-mooney | tkajinam: i would ask that we also put this in the release not for the feature if that ok | |
| 13:03:57 | sean-k-mooney | gibi: you can enable the virt preview repo | |
| 13:04:01 | sean-k-mooney | are you on c10s | |
| 13:04:15 | sean-k-mooney | https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/ | |
| 13:04:41 | sean-k-mooney | htat has qemu 2:11.0.0-11 | |
| 13:05:29 | sean-k-mooney | you just need to add https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/repo/centos-stream-10/group_virtmaint-sig-virt-preview-centos-stream-10.repo | |
| 13:05:33 | sean-k-mooney | to your repo config | |
| 13:06:03 | gibi | ooh OK, I can try that. The lab machine is on centos10 yes | |
| 13:06:13 | sean-k-mooney | with that said i woudl finish any ohter testing you want to do first before doing that | |
| 13:06:24 | sean-k-mooney | it normally does not breakthing but it can | |
| 13:06:29 | gibi | yeah I'm mostly done with the exploratory testing | |
| 13:08:07 | sean-k-mooney | there was a patch probaly litrally decades ago to add a flag to enabel the virt preview repo in devstack but i dotn think that ever landed | |
| 13:08:32 | sean-k-mooney | i remember "dicusssing" that wehn trying to get dpdk suprpot into openstack | |
| 13:30:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 13:33:40 | sean-k-mooney | tkajinam: locked memory is not ment ot requried hugepages | |
| 13:33:41 | tdemaret | Hi core team, I need help to understant, what I must doing to validate my spec and validate my code : my pr is here, and I think, I don t understand something : https://review.opendev.org/c/openstack/nova-specs/+/979696 - https://review.opendev.org/c/openstack/nova/+/979693 ( I see the merge conflict, but it is a 3 times, I think, I need to validate my spec before I fix it ? ) | |
| 13:34:59 | sean-k-mooney | tkajinam: unless im conflatin gthat with realtime | |
| 13:35:16 | sean-k-mooney | tkajinam: i know i added that so that vdpa would work | |
| 13:35:19 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 13:35:21 | sean-k-mooney | without needing realtime | |
| 13:35:40 | sean-k-mooney | but i tough it was inteded to work with file backed memory and small pages as well | |
| 13:35:50 | sean-k-mooney | i woudl have to dig back into the history | |
| 13:38:03 | sean-k-mooney | tkajinam: actully no your right https://github.com/openstack/nova-specs/blob/b855fe1b5d192aefa238cd9465fc0ee60568b2d1/specs/zed/implemented/libvirt-viommu-device.rst?plain=1#L61 | |
| 13:38:36 | sean-k-mooney | i intneed it to be set only when hugepages to avodi needign to mark the vm as realtime and foce cpu pinning | |
| 13:39:30 | tkajinam | sean-k-mooney, ah, ok. honestly I found that requirement a bit strange first (because locked memory should work without huge pages afaik) but now it's clearer | |
| 13:39:47 | sean-k-mooney | we could make it work withough hugepages | |
| 13:39:52 | tkajinam | yeah | |
| 13:39:54 | sean-k-mooney | but it was to work around a bug in qemu | |
| 13:40:34 | sean-k-mooney | well actully maybe libvirt, qemu or libvirt did not allcoate addtion locked memroy for pci passhtough or vdpa automaticly | |
| 13:40:48 | sean-k-mooney | so we had to mark the entire mroy as locked as a workaround | |
| 13:41:26 | sean-k-mooney | later version fo libvirt do allocate addtioanl locked memeory for passthough devices but we still have the option | |
| 13:43:02 | tkajinam | ok | |
| 13:43:36 | sean-k-mooney | its still usefull in general but lower level then we woudl have prefered to expose | |
| 13:43:56 | sean-k-mooney | i.e. as an operator you really should not need to think about that when creating flavors | |
| 13:44:14 | tkajinam | I think we could consider lifting the limitation after some quick testings, but IMO we should fix the status code separately in a short term (because 403 doesn't match the actual cause imho) | |
| 13:44:15 | tkajinam | yeah | |
| 13:44:37 | sean-k-mooney | oh i was about to ask if you got a 409 | |