| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-07-02 | |||
| 18:06:44 | dansmith | provides more opportunity for XSS/phishing attack | |
| 18:07:10 | gmaan | yeah, that is valid point | |
| 18:15:04 | opendevreview | Dan Smith proposed openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| 22:47:15 | opendevreview | Merged openstack/nova master: Fix mutating global config in websocket proxy https://review.opendev.org/c/openstack/nova/+/995870 | |
| #openstack-nova - 2026-07-03 | |||
| 07:21:34 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 09:56:20 | gibi | tkajinam: do I understand correctly that if you use stateless firmware (like in SNP) then you cannot reboot the VM from inside the guest? At least I see that the VM stops normally, printing that it will be rebooted but it never starts up. I assume it is connected to the statelessness of things but I can be mistaken | |
| 09:56:49 | gibi | this is the last thing visible in the guest | |
| 09:56:51 | gibi | [ 33.971858] reboot: Restarting system | |
| 10:00:13 | gibi | hm, qemu logs | |
| 10:00:14 | gibi | 2026-07-03T09:53:41.222388Z qemu-kvm: cpus are not resettable, terminating | |
| 10:07:04 | gibi | hm it is not the firmware it is SEV-ES / SNP that has this limitation | |
| 10:07:13 | gibi | I'm filing a bug to document it | |
| 10:13:23 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 10:13:36 | gibi | so it is just a qemu limitation that is being fixed | |
| 10:21:09 | opendevreview | Kamil Sambor proposed openstack/nova master: Add concurrency_backend config option for Nova services https://review.opendev.org/c/openstack/nova/+/993760 | |
| 10:27:18 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:34:00 | opendevreview | Rodolfo Alonso proposed openstack/os-vif master: ovs: Pass ``multi_queue`` inside ``ifr`` dict for tuntap devices https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 10:42:09 | ralonsoh | sean-k-mooney, hi! just if you didn't see the conversation in the neutron channel | |
| 10:42:21 | ralonsoh | I created https://bugs.launchpad.net/os-vif/+bug/2159024 | |
| 10:42:29 | ralonsoh | and pushed this: https://review.opendev.org/c/openstack/os-vif/+/995933 | |
| 11:21:55 | tkajinam | gibi, oh, thanks for that. I'll check that later | |
| 11:22:10 | sean-k-mooney | ralonsoh: i have not read it back yet but my clinet is there ill reply in the neutorn channel | |
| 11:22:11 | tkajinam | we likely need to block the operation properly at api layer instead of putting the instance in that hung state ... | |
| 11:28:42 | gibi | tkajinam: it does not hung, it stops cleanly. and can be started via the API | |
| 11:28:52 | gibi | but it cannot be fully restarted from the guest | |
| 11:29:46 | gibi | https://bugs.launchpad.net/nova/+bug/2159023 | |
| 11:29:57 | sean-k-mooney | gibi: that os-vif patch above form ralonsoh is a nice easy one to review if you have time | |
| 11:30:35 | sean-k-mooney | gibi: also thts fun, it sound like perhaps a qemu bug | |
| 11:31:12 | sean-k-mooney | you shoudl be able to reboot form inside the guest as that doe not halt the domain | |
| 11:33:16 | opendevreview | Joan Gilabert proposed openstack/nova master: Report OWNER_NOVA trait on resource providers https://review.opendev.org/c/openstack/nova/+/994299 | |
| 11:33:17 | opendevreview | Joan Gilabert proposed openstack/nova master: Add libvirt driver MDEV ARQ support for Cyborg https://review.opendev.org/c/openstack/nova/+/995840 | |
| 11:42:32 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 11:46:53 | opendevreview | Ashish Gupta proposed openstack/nova master: tests: use file-backed Placement SQLite in functional threading https://review.opendev.org/c/openstack/nova/+/992581 | |
| 12:06:12 | opendevreview | Ashish Gupta proposed openstack/placement master: tests: Support shared file-backed SQLite in placement fixtures https://review.opendev.org/c/openstack/placement/+/993106 | |
| 12:53:46 | tkajinam | gibi, ahh ok. | |
| 12:54:08 | tkajinam | now I remember I saw that behavior during my old testing and just documenting that limitation would be enough now | |
| 12:56:08 | sean-k-mooney | tkajinam: it should be pretty proment | |
| 12:56:27 | sean-k-mooney | its pretty problematic as it a faily core fucntioantliy | |
| 12:57:01 | sean-k-mooney | it means that you can use normal widnows update flows or just reboot normaly for kernel upgrades ectra | |
| 12:57:21 | gibi | sean-k-mooney: it is a qemu limitation that is being lifted in qemu 11 | |
| 12:57:27 | sean-k-mooney | so it defintly need to get reported to qemu or amd as a issue to be adressed not jsut a footnote in our docs | |
| 12:57:37 | sean-k-mooney | gibi: ah cool | |
| 12:57:39 | gibi | they way how qemu did the reset of the vcpu did not work for ES and SEV instances | |
| 12:57:56 | gibi | due to encrypted registers | |
| 12:57:57 | gibi | afaik | |
| 12:58:10 | sean-k-mooney | int13? | |
| 12:58:19 | gibi | https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach | |
| 12:58:32 | gibi | more details are here ^^ | |
| 12:59:00 | gibi | I haven't tested qemu 11 as it is only available in rawhide at the moment and the machine I have does not like fedora :) | |
| 12:59:34 | sean-k-mooney | ah no i was thinking in INT 19 | |
| 13:00:21 | sean-k-mooney | anyway cool | |
| 13:00:37 | gibi | :) | |
| 13:01:08 | sean-k-mooney | if its going away then ya just add an important:: note in the docs is fine | |
| 13:02:19 | sean-k-mooney | qemu 11 isnec quite out yet in distos | |
| 13:02:31 | gibi | yeah | |
| 13:02:33 | gibi | too new | |
| 13:03:35 | gibi | hm, I have it in sid, but that would be even harder to put on this lab machine | |
| 13:03:36 | sean-k-mooney | tkajinam: i would ask that we also put this in the release not for the feature if that ok | |
| 13:03:57 | sean-k-mooney | gibi: you can enable the virt preview repo | |
| 13:04:01 | sean-k-mooney | are you on c10s | |
| 13:04:15 | sean-k-mooney | https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/ | |
| 13:04:41 | sean-k-mooney | htat has qemu 2:11.0.0-11 | |
| 13:05:29 | sean-k-mooney | you just need to add https://copr.fedorainfracloud.org/coprs/g/virtmaint-sig/virt-preview/repo/centos-stream-10/group_virtmaint-sig-virt-preview-centos-stream-10.repo | |
| 13:05:33 | sean-k-mooney | to your repo config | |
| 13:06:03 | gibi | ooh OK, I can try that. The lab machine is on centos10 yes | |
| 13:06:13 | sean-k-mooney | with that said i woudl finish any ohter testing you want to do first before doing that | |
| 13:06:24 | sean-k-mooney | it normally does not breakthing but it can | |
| 13:06:29 | gibi | yeah I'm mostly done with the exploratory testing | |
| 13:08:07 | sean-k-mooney | there was a patch probaly litrally decades ago to add a flag to enabel the virt preview repo in devstack but i dotn think that ever landed | |
| 13:08:32 | sean-k-mooney | i remember "dicusssing" that wehn trying to get dpdk suprpot into openstack | |
| 13:30:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 13:33:40 | sean-k-mooney | tkajinam: locked memory is not ment ot requried hugepages | |
| 13:33:41 | tdemaret | Hi core team, I need help to understant, what I must doing to validate my spec and validate my code : my pr is here, and I think, I don t understand something : https://review.opendev.org/c/openstack/nova-specs/+/979696 - https://review.opendev.org/c/openstack/nova/+/979693 ( I see the merge conflict, but it is a 3 times, I think, I need to validate my spec before I fix it ? ) | |
| 13:34:59 | sean-k-mooney | tkajinam: unless im conflatin gthat with realtime | |
| 13:35:16 | sean-k-mooney | tkajinam: i know i added that so that vdpa would work | |
| 13:35:19 | opendevreview | Takashi Kajinami proposed openstack/nova master: Return 400 for invalid properties for locked memory https://review.opendev.org/c/openstack/nova/+/995813 | |
| 13:35:21 | sean-k-mooney | without needing realtime | |
| 13:35:40 | sean-k-mooney | but i tough it was inteded to work with file backed memory and small pages as well | |
| 13:35:50 | sean-k-mooney | i woudl have to dig back into the history | |
| 13:38:03 | sean-k-mooney | tkajinam: actully no your right https://github.com/openstack/nova-specs/blob/b855fe1b5d192aefa238cd9465fc0ee60568b2d1/specs/zed/implemented/libvirt-viommu-device.rst?plain=1#L61 | |
| 13:38:36 | sean-k-mooney | i intneed it to be set only when hugepages to avodi needign to mark the vm as realtime and foce cpu pinning | |
| 13:39:30 | tkajinam | sean-k-mooney, ah, ok. honestly I found that requirement a bit strange first (because locked memory should work without huge pages afaik) but now it's clearer | |
| 13:39:47 | sean-k-mooney | we could make it work withough hugepages | |
| 13:39:52 | tkajinam | yeah | |
| 13:39:54 | sean-k-mooney | but it was to work around a bug in qemu | |
| 13:40:34 | sean-k-mooney | well actully maybe libvirt, qemu or libvirt did not allcoate addtion locked memroy for pci passhtough or vdpa automaticly | |
| 13:40:48 | sean-k-mooney | so we had to mark the entire mroy as locked as a workaround | |
| 13:41:26 | sean-k-mooney | later version fo libvirt do allocate addtioanl locked memeory for passthough devices but we still have the option | |
| 13:43:02 | tkajinam | ok | |
| 13:43:36 | sean-k-mooney | its still usefull in general but lower level then we woudl have prefered to expose | |
| 13:43:56 | sean-k-mooney | i.e. as an operator you really should not need to think about that when creating flavors | |
| 13:44:14 | tkajinam | I think we could consider lifting the limitation after some quick testings, but IMO we should fix the status code separately in a short term (because 403 doesn't match the actual cause imho) | |
| 13:44:15 | tkajinam | yeah | |
| 13:44:37 | sean-k-mooney | oh i was about to ask if you got a 409 | |
| 13:44:43 | sean-k-mooney | ya 403 is wrong | |
| 13:44:49 | sean-k-mooney | 409 or 400 are fine | |
| 13:44:51 | tkajinam | I'm changing it to 400 | |
| 13:45:39 | sean-k-mooney | well it should be the ame as the other flavor iamge conflicts | |
| 13:46:07 | tkajinam | other flavor image conflicts return 400 now so it's consistent with that behavior | |
| 13:46:09 | tkajinam | tdemaret, I'm unsure what your expect by "validate" but in general we expect that spec is reviewed and approved (you can push actual change for reference) and then actual implementations are reviewed according to the spec | |