)]}'
{"specs/2027.1/approved/flavor-cpu-flags-disable.rst":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"0d5aed04bbf92f6d8b11c5848d24f352364eba2d","unresolved":true,"context_lines":[{"line_number":65,"context_line":"Proposed change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Add a flavor extra spec ``hw:cpu_flags``, a comma-separated list of CPU"},{"line_number":69,"context_line":"flags to disable for the guest, for example::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    openstack flavor set --property hw:cpu_flags\u003d-vmx,-svm \u003cflavor\u003e"}],"source_content_type":"text/x-rst","patch_set":1,"id":"d3e120c2_f2b5a4f8","line":68,"range":{"start_line":68,"start_character":29,"end_line":68,"end_character":38},"updated":"2026-10-15 15:12:26.000000000","message":"Suggestion during the PGT was to rename this to imply more explicitly that this list accepts items to be excluded, and we do not intend to support requiring specific features. (eg cpu_excluded_flags / cpu_disabled_flags / cpu_excluded_flags_list / ... )","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"7ef5c5f95786b9cec56060d09a012e0d549c4bcc","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Proposed change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Add a flavor extra spec ``hw:cpu_flags``, a comma-separated list of CPU"},{"line_number":69,"context_line":"flags to disable for the guest, for example::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    openstack flavor set --property hw:cpu_flags\u003d-vmx,-svm \u003cflavor\u003e"}],"source_content_type":"text/x-rst","patch_set":1,"id":"91d40841_afa08502","line":68,"range":{"start_line":68,"start_character":29,"end_line":68,"end_character":38},"in_reply_to":"6161e698_b5786a75","updated":"2026-11-01 06:49:16.000000000","message":"Done","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":true,"context_lines":[{"line_number":65,"context_line":"Proposed change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Add a flavor extra spec ``hw:cpu_flags``, a comma-separated list of CPU"},{"line_number":69,"context_line":"flags to disable for the guest, for example::"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    openstack flavor set --property hw:cpu_flags\u003d-vmx,-svm \u003cflavor\u003e"}],"source_content_type":"text/x-rst","patch_set":1,"id":"6161e698_b5786a75","line":68,"range":{"start_line":68,"start_character":29,"end_line":68,"end_character":38},"in_reply_to":"d3e120c2_f2b5a4f8","updated":"2026-11-01 06:48:22.000000000","message":"Done. Renamed to hw:cpu_flags_disabled. Values have no - prefix now (e.g. vmx,svm).","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"20224a408e1c051b483c3f809aec938824ff416c","unresolved":true,"context_lines":[{"line_number":73,"context_line":"The syntax and meaning are the same as the existing ``[libvirt]"},{"line_number":74,"context_line":"cpu_model_extra_flags`` option, which already supports disabling flags with"},{"line_number":75,"context_line":"the ``-`` prefix. Only disabling is supported; enabling flags is rejected."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The libvirt driver disables the listed flags in the guest CPU definition,"},{"line_number":78,"context_line":"on top of the host configuration. KVM does not let a guest enable VMX or"},{"line_number":79,"context_line":"SVM when the flag is absent from its CPU, so disabling ``vmx``/``svm``"},{"line_number":80,"context_line":"makes the nested virtualization code unreachable for that guest."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"2db95b2f_2f07992d","line":78,"range":{"start_line":76,"start_character":1,"end_line":78,"end_character":33},"updated":"2026-10-15 13:09:42.000000000","message":"What happens if [libvirt] cpu_model_extra_flags explicitly enables the feature ? I guess we can ignore the one in host config but this needs to be explained.","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":true,"context_lines":[{"line_number":73,"context_line":"The syntax and meaning are the same as the existing ``[libvirt]"},{"line_number":74,"context_line":"cpu_model_extra_flags`` option, which already supports disabling flags with"},{"line_number":75,"context_line":"the ``-`` prefix. Only disabling is supported; enabling flags is rejected."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The libvirt driver disables the listed flags in the guest CPU definition,"},{"line_number":78,"context_line":"on top of the host configuration. KVM does not let a guest enable VMX or"},{"line_number":79,"context_line":"SVM when the flag is absent from its CPU, so disabling ``vmx``/``svm``"},{"line_number":80,"context_line":"makes the nested virtualization code unreachable for that guest."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fdb7c77e_5b40ac4b","line":78,"range":{"start_line":76,"start_character":1,"end_line":78,"end_character":33},"in_reply_to":"2db95b2f_2f07992d","updated":"2026-11-01 06:48:22.000000000","message":"Done. The flavor wins over the host config, so the flag stays disabled.","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"7ef5c5f95786b9cec56060d09a012e0d549c4bcc","unresolved":false,"context_lines":[{"line_number":73,"context_line":"The syntax and meaning are the same as the existing ``[libvirt]"},{"line_number":74,"context_line":"cpu_model_extra_flags`` option, which already supports disabling flags with"},{"line_number":75,"context_line":"the ``-`` prefix. Only disabling is supported; enabling flags is rejected."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The libvirt driver disables the listed flags in the guest CPU definition,"},{"line_number":78,"context_line":"on top of the host configuration. KVM does not let a guest enable VMX or"},{"line_number":79,"context_line":"SVM when the flag is absent from its CPU, so disabling ``vmx``/``svm``"},{"line_number":80,"context_line":"makes the nested virtualization code unreachable for that guest."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"aedc40e9_1561c678","line":78,"range":{"start_line":76,"start_character":1,"end_line":78,"end_character":33},"in_reply_to":"fdb7c77e_5b40ac4b","updated":"2026-11-01 06:49:16.000000000","message":"Done","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"0d5aed04bbf92f6d8b11c5848d24f352364eba2d","unresolved":false,"context_lines":[{"line_number":108,"context_line":"* **Use** ``[libvirt] cpu_model_extra_flags`` **with host aggregates.**"},{"line_number":109,"context_line":"  Works today, but partitions capacity between tenants."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"* **A dedicated extra spec such as** ``hw:nested_virt\u003dfalse``. Simpler,"},{"line_number":112,"context_line":"  but a generic list reuses the existing ``cpu_model_extra_flags`` semantics"},{"line_number":113,"context_line":"  and code, and can address future flaws tied to other CPU features without"},{"line_number":114,"context_line":"  a new extra spec each time."}],"source_content_type":"text/x-rst","patch_set":1,"id":"513b4769_b8a4ae22","line":111,"range":{"start_line":111,"start_character":39,"end_line":111,"end_character":59},"updated":"2026-10-15 15:12:26.000000000","message":"We agreed there are a few other flags operators would want to hide so this may not be optimal.","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"20224a408e1c051b483c3f809aec938824ff416c","unresolved":true,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"* **Report a capability trait instead of restricting the feature to fully"},{"line_number":117,"context_line":"  upgraded deployments.** Would allow use during a rolling upgrade, but adds"},{"line_number":118,"context_line":"  an os-traits dependency for little benefit."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Previous proposals to specify guest CPU models, features or modes per"},{"line_number":121,"context_line":"flavor (`Allow specifying cpu model/features in flavor extra-specs or image"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fc87b6a0_0c74c398","line":118,"range":{"start_line":118,"start_character":5,"end_line":118,"end_character":45},"updated":"2026-10-15 13:09:42.000000000","message":"No it is required to ensure that the instance doesn\u0027t land in drivers which doesn\u0027t support this feature, so this is a permanent requirement. Also even for rolling upgrade, upgrade can take some time and adding the appropriate filtering allows you to start using this feature in the middle of upgrade.","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c2dc434245b1d88311488f47b8f4a80ce28f55ec","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"* **Report a capability trait instead of restricting the feature to fully"},{"line_number":117,"context_line":"  upgraded deployments.** Would allow use during a rolling upgrade, but adds"},{"line_number":118,"context_line":"  an os-traits dependency for little benefit."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Previous proposals to specify guest CPU models, features or modes per"},{"line_number":121,"context_line":"flavor (`Allow specifying cpu model/features in flavor extra-specs or image"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ae38d9b5_9bf53357","line":118,"range":{"start_line":118,"start_character":5,"end_line":118,"end_character":45},"in_reply_to":"fc87b6a0_0c74c398","updated":"2026-10-15 14:57:32.000000000","message":"During the PTG dan suggested this is a preferred approach and we don\u0027t want to use traits to represent features dependent solely on nova-compute version.\nSo I\u0027ll close my comment here.","commit_id":"fe09b7bc362b183b79cff404a7b800284cd94cd1"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"68c93e654216b190b325b1b0d849c9d5f78a4f3b","unresolved":true,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"* As an operator, I want to enforce this per tenant with the existing"},{"line_number":63,"context_line":"  flavor access mechanism, without rebooting hosts."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Proposed change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f96e09e_55c90ce0","line":64,"updated":"2026-10-26 18:11:55.000000000","message":"Can you add a use-case for something other than nested virt? The example I gave was to prevent users of the cheapest flavors from accessing AVX2 and doing mining or something like that. Not sure that\u0027s the best example, but it seems reasonable. Something other than nested virt to justify the generic approach would be good I think.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"* As an operator, I want to enforce this per tenant with the existing"},{"line_number":63,"context_line":"  flavor access mechanism, without rebooting hosts."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Proposed change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"902507b5_889066b6","line":64,"in_reply_to":"3f96e09e_55c90ce0","updated":"2026-11-01 06:48:22.000000000","message":"Done.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"68c93e654216b190b325b1b0d849c9d5f78a4f3b","unresolved":true,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    openstack flavor set --property hw:cpu_flags_disabled\u003dvmx,svm \u003cflavor\u003e"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Flags are given as libvirt CPU feature names (as listed in libvirt\u0027s"},{"line_number":74,"context_line":"``cpu_map``, e.g. ``vmx``, ``svm``), case-insensitive and without a"},{"line_number":75,"context_line":"``+``/``-`` prefix, the same names accepted by ``[libvirt]"},{"line_number":76,"context_line":"cpu_model_extra_flags``. Values with a prefix are rejected. The API only"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ec3ee811_41503b6f","line":73,"range":{"start_line":73,"start_character":19,"end_line":73,"end_character":26},"updated":"2026-10-26 18:11:55.000000000","message":"Probably best to try to avoid making or implying that this is hypervisor-specific. I think you can say \"cpu feature names\" here, give the examples, and leave it at that, right? Presumably if ironic wanted to use this to disable feature flags at the bios level that would be doable, and vmware may have some different things I imagine.\n\nI think saying \"For example, in the case of libvirt, these are listed in libvirt\u0027s \"cpu_map\", e.g. ...\" makes sense.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    openstack flavor set --property hw:cpu_flags_disabled\u003dvmx,svm \u003cflavor\u003e"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Flags are given as libvirt CPU feature names (as listed in libvirt\u0027s"},{"line_number":74,"context_line":"``cpu_map``, e.g. ``vmx``, ``svm``), case-insensitive and without a"},{"line_number":75,"context_line":"``+``/``-`` prefix, the same names accepted by ``[libvirt]"},{"line_number":76,"context_line":"cpu_model_extra_flags``. Values with a prefix are rejected. The API only"}],"source_content_type":"text/x-rst","patch_set":2,"id":"b4705f46_354d2f90","line":73,"range":{"start_line":73,"start_character":19,"end_line":73,"end_character":26},"in_reply_to":"ec3ee811_41503b6f","updated":"2026-11-01 06:48:22.000000000","message":"Okay.\nDone.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"68c93e654216b190b325b1b0d849c9d5f78a4f3b","unresolved":true,"context_lines":[{"line_number":73,"context_line":"Flags are given as libvirt CPU feature names (as listed in libvirt\u0027s"},{"line_number":74,"context_line":"``cpu_map``, e.g. ``vmx``, ``svm``), case-insensitive and without a"},{"line_number":75,"context_line":"``+``/``-`` prefix, the same names accepted by ``[libvirt]"},{"line_number":76,"context_line":"cpu_model_extra_flags``. Values with a prefix are rejected. The API only"},{"line_number":77,"context_line":"validates the syntax; an unknown flag name makes the build fail on the"},{"line_number":78,"context_line":"compute host. As the name implies, the extra spec only disables flags."},{"line_number":79,"context_line":"Requiring a specific CPU flag is already possible with CPU traits (e.g."}],"source_content_type":"text/x-rst","patch_set":2,"id":"8ee5f46a_04a92a8b","line":76,"range":{"start_line":76,"start_character":25,"end_line":76,"end_character":58},"updated":"2026-10-26 18:11:55.000000000","message":"What does this mean exactly? You say later that these have to be full cpu flag names, else they will result in no build (which is good). I think you can remove this prefix statement, no?","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":false,"context_lines":[{"line_number":73,"context_line":"Flags are given as libvirt CPU feature names (as listed in libvirt\u0027s"},{"line_number":74,"context_line":"``cpu_map``, e.g. ``vmx``, ``svm``), case-insensitive and without a"},{"line_number":75,"context_line":"``+``/``-`` prefix, the same names accepted by ``[libvirt]"},{"line_number":76,"context_line":"cpu_model_extra_flags``. Values with a prefix are rejected. The API only"},{"line_number":77,"context_line":"validates the syntax; an unknown flag name makes the build fail on the"},{"line_number":78,"context_line":"compute host. As the name implies, the extra spec only disables flags."},{"line_number":79,"context_line":"Requiring a specific CPU flag is already possible with CPU traits (e.g."}],"source_content_type":"text/x-rst","patch_set":2,"id":"64d4cace_327cfbd9","line":76,"range":{"start_line":76,"start_character":25,"end_line":76,"end_character":58},"in_reply_to":"8ee5f46a_04a92a8b","updated":"2026-11-01 06:48:22.000000000","message":"It was meant to say that \"+vmx\"/\"-vmx\" (the cpu_model_extra_flags syntax)\nare not accepted, but as you say they would fail as unknown flag names\nanyway. Removed.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"68c93e654216b190b325b1b0d849c9d5f78a4f3b","unresolved":true,"context_lines":[{"line_number":106,"context_line":"* If a libvirt host cannot apply guest CPU flags (for example"},{"line_number":107,"context_line":"  ``cpu_mode \u003d none``), the build fails instead of booting the instance."},{"line_number":108,"context_line":"* Like other ``hw:`` extra specs, it is only supported by the libvirt"},{"line_number":109,"context_line":"  driver."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"The API also rejects requests that disable a CPU flag while requiring the"},{"line_number":112,"context_line":"corresponding CPU trait through either flavor or image metadata (e.g."}],"source_content_type":"text/x-rst","patch_set":2,"id":"6fe5a0f2_d5a893b7","line":109,"updated":"2026-10-26 18:11:55.000000000","message":"This is not true, and also not good to assert. You can say \"this spec will implement this for libvirt only\". Also, you probably need to make the other drivers refuse to boot if this key is set, in line with the bullet above.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":false,"context_lines":[{"line_number":106,"context_line":"* If a libvirt host cannot apply guest CPU flags (for example"},{"line_number":107,"context_line":"  ``cpu_mode \u003d none``), the build fails instead of booting the instance."},{"line_number":108,"context_line":"* Like other ``hw:`` extra specs, it is only supported by the libvirt"},{"line_number":109,"context_line":"  driver."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"The API also rejects requests that disable a CPU flag while requiring the"},{"line_number":112,"context_line":"corresponding CPU trait through either flavor or image metadata (e.g."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1fc7fb83_1c14eea4","line":109,"in_reply_to":"6fe5a0f2_d5a893b7","updated":"2026-11-01 06:48:22.000000000","message":"Sorry. Fixed.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"68c93e654216b190b325b1b0d849c9d5f78a4f3b","unresolved":true,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"The API also rejects requests that disable a CPU flag while requiring the"},{"line_number":112,"context_line":"corresponding CPU trait through either flavor or image metadata (e.g."},{"line_number":113,"context_line":"``hw:cpu_flags_disabled\u003dvmx`` with ``trait:HW_CPU_X86_VMX\u003drequired``)."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Alternatives"},{"line_number":116,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5074175c_ae96ce1a","line":113,"updated":"2026-10-26 18:11:55.000000000","message":"This will be done in the API? It would need to be done for instance create, resize, and rebuild at least. Even though it would be more expensive, it seems better to do this in the compute where we\u0027re going to be doing a spawn operation for any/all of those operations. Maybe other reviewers have opinions here.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":true,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"The API also rejects requests that disable a CPU flag while requiring the"},{"line_number":112,"context_line":"corresponding CPU trait through either flavor or image metadata (e.g."},{"line_number":113,"context_line":"``hw:cpu_flags_disabled\u003dvmx`` with ``trait:HW_CPU_X86_VMX\u003drequired``)."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Alternatives"},{"line_number":116,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ff231150_7a3d40f0","line":113,"in_reply_to":"5074175c_ae96ce1a","updated":"2026-11-01 06:48:22.000000000","message":"I\u0027m not sure whether the API or compute is better. Thinking about it again,\nanother option might be to not check this at all: a required trait (e.g.\nHW_CPU_X86_VMX) only decides which host the instance lands on, and\nhw:cpu_flags_disabled then hides the flag from the guest. We would just\ndocument this behaviour. Thoughts?","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"68c93e654216b190b325b1b0d849c9d5f78a4f3b","unresolved":true,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"No new API or microversion. A new extra spec validator for"},{"line_number":157,"context_line":"``hw:cpu_flags_disabled``. Create, rebuild and resize may be rejected as"},{"line_number":158,"context_line":"described above."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security impact"},{"line_number":161,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"62512a4d_199e71ac","line":158,"updated":"2026-10-26 18:11:55.000000000","message":"Extra spec validators are for set-on-flavor time, not instance boot time, right?","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"fc2d627cbea49b99d73a0e2d962da51acd65ef14","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"No new API or microversion. A new extra spec validator for"},{"line_number":157,"context_line":"``hw:cpu_flags_disabled``. Create, rebuild and resize may be rejected as"},{"line_number":158,"context_line":"described above."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security impact"},{"line_number":161,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"270bdd3b_de404055","line":158,"in_reply_to":"62512a4d_199e71ac","updated":"2026-11-01 06:48:22.000000000","message":"Right, thank you. Fixed.","commit_id":"c551f644d74106d76c85b56796dc57c8a5de3f6b"},{"author":{"_account_id":38924,"name":"YushoYamaguchi","display_name":"YushoYamaguchi","email":"ys-yamaguchi@kddi.com","username":"YushoYamaguchi"},"change_message_id":"35264000f22718e5285b40ae61a056011a466ac9","unresolved":true,"context_lines":[{"line_number":115,"context_line":"  fail the build if ``hw:cpu_flags_disabled`` is set, rather than booting"},{"line_number":116,"context_line":"  the instance with the flags exposed."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"The API also rejects requests that disable a CPU flag while requiring the"},{"line_number":119,"context_line":"corresponding CPU trait through either flavor or image metadata (e.g."},{"line_number":120,"context_line":"``hw:cpu_flags_disabled\u003dvmx`` with ``trait:HW_CPU_X86_VMX\u003drequired``)."},{"line_number":121,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"989f47bd_cc8a2364","line":118,"updated":"2026-11-01 06:54:56.000000000","message":"Note: I\u0027m not sure about this check. \n(https://review.opendev.org/c/openstack/nova-specs/+/1010041/2..3/specs/2027.1/approved/flavor-cpu-flags-disable.rst#b113)\nInstead of rejecting these requests(in the API or in compute),\nanother option might be to not check at all:\na required trait (e.g. HW_CPU_X86_VMX) only decides which host the\ninstance lands on, and hw:cpu_flags_disabled then hides the flag from the\nguest. \nPlease give me a feedback.","commit_id":"db190321624946b4b0d2434b624de12687d30b62"}]}