)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"397969b25574680968f6c8dd75dff2d445895b45","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"3d380dcc_b7ac7454","updated":"2026-04-07 08:50:44.000000000","message":"Thank you for preparing SEV-SNP spec!\n\nMost of parts required in our implementation are covered by this spec.\n\nOne thing to add is that in SEV-SNP, the following change looked like required:\n\n- Current nova/virt/libvirt/driver.py has guest.os_loader_type \u003d \u0027pflash\u0027 for all environments. However, to use SEV-SNP, this should be \u0027rom\u0027.\n  - One example code available in GitHub is the following (this commit is snp-latest branch as of now)\n  - https://github.com/AMDESE/AMDSEV/blob/d42d94c8ef66484cde7d8eb22924443a7a83b139/launch-qemu.sh#L242-L247\n \n Also I added tiny comments.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"a7211af836f37c4f4e7625c1cef31d7453b3f69d","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"ef374338_8f39a6ec","in_reply_to":"223d8165_958c060f","updated":"2026-04-08 05:48:56.000000000","message":"Oh, sorry, I checked again, our base version is not the latest master, and I found the following commit is not included in our repository.\nhttps://opendev.org/openstack/nova/commit/37a9596eb155690812d7c762a1a9b7c5f2108126\n\n\nThus my comment does not apply to this spec.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b4838798e8d8a67657997c647e457fc3b632c87c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"223d8165_958c060f","in_reply_to":"3d380dcc_b7ac7454","updated":"2026-04-07 16:58:59.000000000","message":"\u003e Current nova/virt/libvirt/driver.py has guest.os_loader_type \u003d \u0027pflash\u0027 for all environments.\n\nIs this really true? I think we no longer hard-code pflash type since we implemented the firmware selection by libvirt and it should be filled by libvirt automatically.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d3a70e7f3e486e5807297a7997c04f5017550e34","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"e47dc1d3_859ff0ef","in_reply_to":"ef374338_8f39a6ec","updated":"2026-04-08 09:58:38.000000000","message":"OK. Thanks for confirmation.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"03667df29a2cc5b4defe80a06788c21b50fbe798","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"dd761755_f7d2a8aa","updated":"2026-04-09 06:57:33.000000000","message":"I understand whether memoryBacking should be added or not is currently under checking. Looks good me if how we can determine memoryBacking.","commit_id":"38d1a50f0b8d7f06bc6c4f52fccabaa2c647bfa0"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"c1e4f48926ed05eb3ad06457dd6a4157b4a22b2c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"a5300171_f358c33f","updated":"2026-04-10 08:10:37.000000000","message":"I pushed a series of patches of PoC code to gerrit for reference. We use these commits to run SEV-SNP in our environment.\n\nhttps://review.opendev.org/c/openstack/nova/+/983974\nhttps://review.opendev.org/c/openstack/nova/+/983975\nhttps://review.opendev.org/c/openstack/nova/+/983976\nhttps://review.opendev.org/c/openstack/nova/+/983977\nhttps://review.opendev.org/c/openstack/nova/+/983978\nhttps://review.opendev.org/c/openstack/nova/+/983979\nhttps://review.opendev.org/c/openstack/nova/+/983980","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"669e8e3625c672548b3b4b7b3c25fbf9582b85f5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"308adb05_85250a6b","updated":"2026-04-15 16:07:06.000000000","message":"Thank you for preparing this spec Takashi!\n\nI have a few concerns about Direct Kernel Boot and the related attestation measurement support.","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"f07d846e59f9375020c939062004122d48bca7b7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"02b0d268_98efda46","updated":"2026-04-23 08:48:17.000000000","message":"Sorry, there is one more topic concerning the SEV-ES and SEV-SNP traits that I didn\u0027t manage to add to yesterday\u0027s PTG session. I added a comment inline.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"8e6f0ce442be27e022808edcd0e7fca02abcd2c1","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"c2274070_ece2e88c","updated":"2026-05-12 15:38:19.000000000","message":"Overall the spec looks good to me. There are still a few points that need clarification (see inline comments), but the approach is solid.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"2ce1e8c29ad44110b70561f2a11d79c121582413","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":17,"id":"df202332_90be00a6","updated":"2026-05-13 14:05:20.000000000","message":"One latest question see in comments, but overall that looks good to me.\nThanks Takashi creating this spec. 👍","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"02ba7488e4b63efd7ecbf0eb6cd10949eb77647e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":17,"id":"1407454f_63b357b1","updated":"2026-05-21 15:08:03.000000000","message":"a few comments out","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"24e83145_3046f56d","updated":"2026-05-27 11:17:15.000000000","message":"I have a couple of questions.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"b39cc65f_90ed2479","updated":"2026-05-28 14:46:37.000000000","message":"yes, I have a upgrade impact issue, and I agree with @gibizer@gmail.com","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"45618e0c3de3c1bf07e48e990b9407f7787b34ef","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"cc23dea2_015f33e7","updated":"2026-06-02 14:54:25.000000000","message":"-1 until we agreed on the solution","commit_id":"b0557c162b3e2a226575fbf48986d6b52836bf4e"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1b10bd911ec4fdd2311a7b752e93f82031808038","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"0558efc5_41f07e8b","updated":"2026-06-03 12:41:00.000000000","message":"Looks good. Lets have a statement about whitebox testing (even a negative one is OK) then I\u0027m happy to upgrade my vote to +2","commit_id":"fb21531eff39f562e54f00679222b93532880d76"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"9926cb8536d4dcbafe0546cfbbada3fdac0102dc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"c8f719f9_2cd4b04f","in_reply_to":"0558efc5_41f07e8b","updated":"2026-06-03 13:51:27.000000000","message":"Done","commit_id":"fb21531eff39f562e54f00679222b93532880d76"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"0b712e41e32452cd14253acfd9dacd7b233ad57a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":21,"id":"8c46fd0d_342b8482","updated":"2026-07-06 19:06:32.000000000","message":"i would have been -1 on merging this spec but since it is merged and we have an impolatiolhn lets continue reviewing it there.","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":21,"id":"8f55d76e_23be34b4","updated":"2026-06-04 10:08:53.000000000","message":"thanks a lot, +2/+W for me.","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7a68ef88eeb0e08ad659b116be492c62fde982a8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":21,"id":"e700d7f5_f1ece343","updated":"2026-06-03 14:08:26.000000000","message":"thanks, it looks good to me","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"}],"specs/2026.2/approved/amd-sev-snp-libvirt-support.rst":[{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"397969b25574680968f6c8dd75dff2d445895b45","unresolved":true,"context_lines":[{"line_number":121,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 authorKey\u003d\u0027no\u0027 kernelHashes\u003d\u0027no\u0027 vcek\u003d\u0027no\u0027\u003e"},{"line_number":124,"context_line":"      \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":125,"context_line":"      \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":126,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":127,"context_line":"    \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":3,"id":"8762bfaa_00e0f227","line":124,"updated":"2026-04-07 08:50:44.000000000","message":"Looks like cbitpos should be 51 instead of 47 for SEV-SNP.\nhttps://www.qemu.org/docs/master/system/i386/amd-memory-encryption.html\n\nWhen I tried with 47 on our machine, the VM failed with the error like the following:\nqemu-kvm: -accel kvm: sev_common_kvm_init: cbitpos check failed, host \u002751\u0027 requested \u002747\u0027","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b4838798e8d8a67657997c647e457fc3b632c87c","unresolved":true,"context_lines":[{"line_number":121,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 authorKey\u003d\u0027no\u0027 kernelHashes\u003d\u0027no\u0027 vcek\u003d\u0027no\u0027\u003e"},{"line_number":124,"context_line":"      \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":125,"context_line":"      \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":126,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":127,"context_line":"    \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ce582cc6_f6c5c731","line":124,"in_reply_to":"8762bfaa_00e0f227","updated":"2026-04-07 16:58:59.000000000","message":"My understanding is that we should not hard-code this value but the value should match the cbitpos value exposed in domain capabilities (as I mentioned in L132). Can you double-check the value you see in virsh domcapabilities (I expect it shows 51).","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"a7211af836f37c4f4e7625c1cef31d7453b3f69d","unresolved":true,"context_lines":[{"line_number":121,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 authorKey\u003d\u0027no\u0027 kernelHashes\u003d\u0027no\u0027 vcek\u003d\u0027no\u0027\u003e"},{"line_number":124,"context_line":"      \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":125,"context_line":"      \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":126,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":127,"context_line":"    \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":3,"id":"c5030d5d_6ddca5d4","line":124,"in_reply_to":"899d9c3a_641e5829","updated":"2026-04-08 05:48:56.000000000","message":"Yes, virsh dumpxml outputs cbitpos as 51, but our nova code does not give this value. Looks like if xml does not have cbitpos, libvirt will add the correct value automatically. Thus, just like SEV or SEV-ES, implementation of SEV-SNP for nova also does not need to specify or know cbitpos.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"0642677cef0e72b5689fc18cc5381d6ac229c6fb","unresolved":false,"context_lines":[{"line_number":121,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 authorKey\u003d\u0027no\u0027 kernelHashes\u003d\u0027no\u0027 vcek\u003d\u0027no\u0027\u003e"},{"line_number":124,"context_line":"      \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":125,"context_line":"      \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":126,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":127,"context_line":"    \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":3,"id":"e89f0925_6871a9f9","line":124,"in_reply_to":"c5030d5d_6ddca5d4","updated":"2026-04-08 09:57:30.000000000","message":"OK libvirt now fills it automatically https://gitlab.com/libvirt/libvirt/commit/2508d10f67ce8874500deee1592e00430dbdca63 . I\u0027ve adjusted the spec accordingly.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c1b76ea9eb1b4d486c47a886ff8bf5d6966eebef","unresolved":true,"context_lines":[{"line_number":121,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 authorKey\u003d\u0027no\u0027 kernelHashes\u003d\u0027no\u0027 vcek\u003d\u0027no\u0027\u003e"},{"line_number":124,"context_line":"      \u003ccbitpos\u003e47\u003c/cbitpos\u003e"},{"line_number":125,"context_line":"      \u003creducedPhysBits\u003e1\u003c/reducedPhysBits\u003e"},{"line_number":126,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":127,"context_line":"    \u003c/launchSecurity\u003e"}],"source_content_type":"text/x-rst","patch_set":3,"id":"899d9c3a_641e5829","line":124,"in_reply_to":"ce582cc6_f6c5c731","updated":"2026-04-07 17:08:10.000000000","message":"cbitpos may change according to the processor generation. I updated the example to reflect the value in Milan, but again the value shouldn\u0027t be hardcoded but detected automatically, IIUC.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"397969b25574680968f6c8dd75dff2d445895b45","unresolved":true,"context_lines":[{"line_number":250,"context_line":""},{"line_number":251,"context_line":"#. Add the new ``HW_CPU_AMD_SEV_SNP`` trait for os-traits"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"#. Add detection of host SEV-SNP capabilities as detailed above and reshaping"},{"line_number":254,"context_line":"   of existing MEMO_ENCRYPTION_CONTEXT resource."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"#. Add ``mem_encryption_model`` property to ImageMeta object"}],"source_content_type":"text/x-rst","patch_set":3,"id":"d7dc5eff_9beae6bf","line":253,"updated":"2026-04-07 08:50:44.000000000","message":"When introducing, reshaping of RPs was required to use parent-child relationship, but for this work, in my understanding reshaping would not be required, do we have some data to reshape?","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c88d5a88f5201cda5ec0df380feac15c52df5376","unresolved":false,"context_lines":[{"line_number":250,"context_line":""},{"line_number":251,"context_line":"#. Add the new ``HW_CPU_AMD_SEV_SNP`` trait for os-traits"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"#. Add detection of host SEV-SNP capabilities as detailed above and reshaping"},{"line_number":254,"context_line":"   of existing MEMO_ENCRYPTION_CONTEXT resource."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"#. Add ``mem_encryption_model`` property to ImageMeta object"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a3a9378_38a30edf","line":253,"in_reply_to":"6e2ddf00_b08ae834","updated":"2026-04-07 17:02:11.000000000","message":"Oh I have to remove this then. Done.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b4838798e8d8a67657997c647e457fc3b632c87c","unresolved":true,"context_lines":[{"line_number":250,"context_line":""},{"line_number":251,"context_line":"#. Add the new ``HW_CPU_AMD_SEV_SNP`` trait for os-traits"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"#. Add detection of host SEV-SNP capabilities as detailed above and reshaping"},{"line_number":254,"context_line":"   of existing MEMO_ENCRYPTION_CONTEXT resource."},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"#. Add ``mem_encryption_model`` property to ImageMeta object"}],"source_content_type":"text/x-rst","patch_set":3,"id":"6e2ddf00_b08ae834","line":253,"in_reply_to":"d7dc5eff_9beae6bf","updated":"2026-04-07 16:58:59.000000000","message":"We required reshape when we introduced SEV-ES because we had to migrate MEM_ENCRYPTION_CONTEXT. However this change does not change the RP structure so we don\u0027t need reshape again.","commit_id":"0fe5d4338760f426b5d6584a99e8402e90e94351"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"987ae7272f7e6bf1fb397ccd4f851c29866912bb","unresolved":true,"context_lines":[{"line_number":146,"context_line":"     per-instance. However due to lack of per-instance properties in nova,"},{"line_number":147,"context_line":"     these options are out of the current scope."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Also configure the ``memoryBacking`` element to use the ``memfd`` backing::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    \u003cmemoryBacking\u003e"},{"line_number":152,"context_line":"      \u003csource type\u003d\"memfd\"/\u003e"},{"line_number":153,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  .. note::"},{"line_number":156,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":5,"id":"658b8a62_20071ca8","line":153,"range":{"start_line":149,"start_character":0,"end_line":153,"end_character":20},"updated":"2026-04-07 18:08:32.000000000","message":"I have to double-check this requirement. Looking at the latest qemu I guess qemu automatically uses memfd backend when confidential computing is required.","commit_id":"567f4baf00f12a07c6f3e63deb731e7aac09d02f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"093ae4b4d5eaf242b5e24a62f97950595caeda30","unresolved":false,"context_lines":[{"line_number":146,"context_line":"     per-instance. However due to lack of per-instance properties in nova,"},{"line_number":147,"context_line":"     these options are out of the current scope."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Also configure the ``memoryBacking`` element to use the ``memfd`` backing::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    \u003cmemoryBacking\u003e"},{"line_number":152,"context_line":"      \u003csource type\u003d\"memfd\"/\u003e"},{"line_number":153,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  .. note::"},{"line_number":156,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":5,"id":"91015a6e_ed072c95","line":153,"range":{"start_line":149,"start_character":0,"end_line":153,"end_character":20},"in_reply_to":"5f86e845_02eacf07","updated":"2026-04-09 14:05:20.000000000","message":"Further investigation revels that qemu\u003e9.1.0 uses private memfd automatically without being explicitly asked to do so.\n\nhttps://github.com/qemu/QEMU/commit/15f7a80c49cb3637f62fa37fa4a17da913bd91ff\nhttps://github.com/qemu/QEMU/commit/37662d85b0b7dded0ebdf6747bef6c3bb7ed6a0c\nhttps://github.com/qemu/QEMU/commit/dc0d28ca46c0e7ee3c055ad4da24022995bd3765\nhttps://github.com/qemu/QEMU/commit/125b95a6d465a03ff30816eff0b1889aec01f0c3","commit_id":"567f4baf00f12a07c6f3e63deb731e7aac09d02f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"9665a200a2820bdf51de8964f1739a2948604cea","unresolved":false,"context_lines":[{"line_number":146,"context_line":"     per-instance. However due to lack of per-instance properties in nova,"},{"line_number":147,"context_line":"     these options are out of the current scope."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Also configure the ``memoryBacking`` element to use the ``memfd`` backing::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    \u003cmemoryBacking\u003e"},{"line_number":152,"context_line":"      \u003csource type\u003d\"memfd\"/\u003e"},{"line_number":153,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  .. note::"},{"line_number":156,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":5,"id":"a720d739_602d45e8","line":153,"range":{"start_line":149,"start_character":0,"end_line":153,"end_character":20},"in_reply_to":"658b8a62_20071ca8","updated":"2026-04-07 18:28:06.000000000","message":"I\u0027m concluding that this is correct according to https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/ .\n\nI tested the whole SNP implementation using the old AMD\u0027s code which introduced the separate memfd-private backend... I\u0027d be helpful if I can hear opitions about this requirement from people recently testing it.","commit_id":"567f4baf00f12a07c6f3e63deb731e7aac09d02f"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"a7211af836f37c4f4e7625c1cef31d7453b3f69d","unresolved":false,"context_lines":[{"line_number":146,"context_line":"     per-instance. However due to lack of per-instance properties in nova,"},{"line_number":147,"context_line":"     these options are out of the current scope."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Also configure the ``memoryBacking`` element to use the ``memfd`` backing::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    \u003cmemoryBacking\u003e"},{"line_number":152,"context_line":"      \u003csource type\u003d\"memfd\"/\u003e"},{"line_number":153,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  .. note::"},{"line_number":156,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":5,"id":"d192fc59_da7e30b8","line":153,"range":{"start_line":149,"start_character":0,"end_line":153,"end_character":20},"in_reply_to":"a720d739_602d45e8","updated":"2026-04-08 05:48:56.000000000","message":"In our environment, SEV-SNP VM worked without this specification.","commit_id":"567f4baf00f12a07c6f3e63deb731e7aac09d02f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d788d97fbe90fec06e35877cb0f29d22c5b9d25c","unresolved":true,"context_lines":[{"line_number":146,"context_line":"     per-instance. However due to lack of per-instance properties in nova,"},{"line_number":147,"context_line":"     these options are out of the current scope."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  Also configure the ``memoryBacking`` element to use the ``memfd`` backing::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    \u003cmemoryBacking\u003e"},{"line_number":152,"context_line":"      \u003csource type\u003d\"memfd\"/\u003e"},{"line_number":153,"context_line":"    \u003c/memoryBacking\u003e"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  .. note::"},{"line_number":156,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5f86e845_02eacf07","line":153,"range":{"start_line":149,"start_character":0,"end_line":153,"end_character":20},"in_reply_to":"d192fc59_da7e30b8","updated":"2026-04-08 10:05:10.000000000","message":"OK this might not be required looking at the latest KubeVirt implementation. We can probably have this double-checked by people in Yaook, as they also implemented their own SEV-SNP support.","commit_id":"567f4baf00f12a07c6f3e63deb731e7aac09d02f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c9fefe6d0a1f08a5231ca40f6a55a29b5c15c864","unresolved":false,"context_lines":[{"line_number":120,"context_line":"  spec or the ``hw_mem_encryption_model`` image property is present and"},{"line_number":121,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":124,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":125,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"},{"line_number":128,"context_line":"  to find further details about the ``launchSecurity`` element."}],"source_content_type":"text/x-rst","patch_set":8,"id":"bc2b7f64_645d50c7","line":125,"range":{"start_line":123,"start_character":4,"end_line":125,"end_character":21},"updated":"2026-04-08 10:03:46.000000000","message":"Removed the optional fields to simplify the XML.","commit_id":"38d1a50f0b8d7f06bc6c4f52fccabaa2c647bfa0"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"4cabad9243ca82bb7c63b55ba312c95590c1e76d","unresolved":false,"context_lines":[{"line_number":239,"context_line":"Implementation"},{"line_number":240,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"Assignee(s)"},{"line_number":243,"context_line":"-----------"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"Primary assignee:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"38b0c595_af625634","line":242,"updated":"2026-04-10 08:05:54.000000000","message":"I\u0027m also willing to contribute in implementation.","commit_id":"38d1a50f0b8d7f06bc6c4f52fccabaa2c647bfa0"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"669e8e3625c672548b3b4b7b3c25fbf9582b85f5","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"a1725534_63955147","line":133,"updated":"2026-04-15 16:07:06.000000000","message":"From our experience with SNP, SEV kernel hashing (`kernelHashes\u003dyes`) with measurement use cases is only really useful with a unified OVMF and stateless firmware boot as stateful UEFI mode could undermine the trust anchor [1] and taint measurement.\n\nTherefore, in addition to setting `kernelHashes\u003dyes` when detecting Direct Kernel Boot, I think we should also:\n\n1. ensure `guest.os_loader_stateless` is set to `True` [1]\n2. change the `guest.os_loader_type` to `rom` instead of `pflash` [2]\n\n[1] \"If intending to attest the boot measurement, it is required to use a firmware binary that is stateless, as persistent NVRAM can undermine the trust of the secure guest. This is achieved by telling libvirt that a stateless binary is required\" - https://libvirt.org/kbase/launch_security_sev.html#boot-loader\n\n[2] https://marc.info/?l\u003dlibvir-list\u0026m\u003d164218718706402","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"46a84b8319313223a7d495ac7ca19ee51e2dbe76","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"5026f60d_d09ba716","line":133,"in_reply_to":"1ec74930_a2642f0c","updated":"2026-04-22 14:45:35.000000000","message":"I\u0027ve added a note in the deployer impact that users may need to create a firmware descriptor file so that libvirt selects a rom type firmware for sev-snp. I hope this addresses your concern.","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"db004591a5305d7e105f096f4a61881233ff060f","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ec74930_a2642f0c","line":133,"in_reply_to":"218e8bef_cbdc8ff1","updated":"2026-04-16 11:14:28.000000000","message":"I recorded this topic in the PTG etherpad to get wider feedback there.","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"fdb1615f7fdc5e2af6e4ff43a1b115baebc1aef7","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"218e8bef_cbdc8ff1","line":133,"in_reply_to":"26616217_39b2bd5d","updated":"2026-04-16 10:51:19.000000000","message":"\u003e I don\u0027t think requiring rom type is a good idea here because we don\u0027t actually care about the firmware type but we want it to be stateless.\n\nMy point behind this is that the qemu firmware descriptor files in each distro already ships firmware with \u0027device\u0027: \u0027memory\u0027 for sev-snp, so as long as the file is present libvirt should select the rom type firmware eventually without being explicitly asked. We can technically require rom type so that libvirt only select firmwares with \u0027device\u0027: \u0027memory\u0027, but I feel like that is redundant at this stage and may loose flexibility for future change in libvirt.\n\nOn the other hand hw_firmware_stateless can be specificed by users, and we should detect the invalid combination (hw_firmware_stateless\u003dFalse + sev-snp). This may be required regardless of kernelHashes .","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"3701ff01e1a2c2b526b777cef0a330d83ff5eb90","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"8b472e45_f62a9ded","line":133,"in_reply_to":"2675623d_9da96b2c","updated":"2026-04-16 09:56:36.000000000","message":"Kernel hashing as a mechanism might work without these technically, yes. But since this spec is about SEV-SNP specifically, we might also need to consider SNP-specific requirements. As far as I am aware, SNP is considered incompatible with pflash due to its design [3]. A behavior that has matched our own tests so far.\n\nFurthermore, setting `rom` then also seems to make `stateless` mandatory.\n\nHas anybody been successful in creating a functional SNP-enabled VM through libvirt/QEMU without `rom` loader type?\n\n[3] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/BZOKLW4ZYDNUGIZK3NQDR5H7KEGENFG3/","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f679435e19248b0cdaddddc2b3199ba9d3d2be6e","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"26616217_39b2bd5d","line":133,"in_reply_to":"8b472e45_f62a9ded","updated":"2026-04-16 10:23:51.000000000","message":"When I tested the draft implementation by AMD I was able to launch guests with rom type (even with var file) with kernelHash enabled but something might be changed.\n\nMaybe we can require hw_firmware_stateless when SNP is requested ? I don\u0027t think requiring rom type is a good idea here because we don\u0027t actually care about the firmware type but we want it to be stateless.","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"1e7a6cfbcc781c67c73a050652045b575eb3fc81","unresolved":true,"context_lines":[{"line_number":130,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":131,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":134,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":135,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":136,"context_line":"    detected according to the ``kernel_id`` property of the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"2675623d_9da96b2c","line":133,"in_reply_to":"a1725534_63955147","updated":"2026-04-15 17:32:19.000000000","message":"My understanding is that kernelHashes \"can\" work without these technically, and if users aim to get truly trustable measurement using kernelHash, for their attestation workflow, then they can use the image with hw_firmware_stateless property to prohibit non-unified firmware.\n\nI\u0027d not implement these mentioned logics within nova, at least at this stage, to avoid problems caused by changes in qemu/ovmf (for example in case they introduced yet another type, like they did to replace existing pflash with stateless flag by rom type in the past)","commit_id":"2fd4e8ede8261084f1488bd4bf8fb7127612c07d"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d2f061a1336976908c78b7e6954021ada81b6930","unresolved":true,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"Also, the specific QEMU firmware descriptor file, which tells libvirt to use"},{"line_number":225,"context_line":"rom type firmware is required. The content should contain the following"},{"line_number":226,"context_line":"content::"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    {"},{"line_number":229,"context_line":"      \"description\": \"UEFI firmware for x86_64, with SEV-SNP support\","}],"source_content_type":"text/x-rst","patch_set":10,"id":"946264f6_fd018dcd","line":226,"range":{"start_line":226,"start_character":0,"end_line":226,"end_character":7},"updated":"2026-04-22 15:14:00.000000000","message":"This is available in c9s and c10s\n\nhttps://gitlab.com/redhat/centos-stream/rpms/edk2/-/blob/c9s/60-edk2-ovmf-x64-amdsev.json?ref_type\u003dheads\nhttps://gitlab.com/redhat/centos-stream/rpms/edk2/-/blob/c10s/60-edk2-ovmf-x64-amdsev.json?ref_type\u003dheads\n\nbut is not in ubuntu (even in 26.04 beta-ish package)","commit_id":"301829e11b96ecfc244c5a34015125a71dc7d4d3"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"5e82c1e75e8d6848f0520ac07b48d1844adce3cc","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"Also, the specific QEMU firmware descriptor file, which tells libvirt to use"},{"line_number":225,"context_line":"rom type firmware is required. The content should contain the following"},{"line_number":226,"context_line":"content::"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    {"},{"line_number":229,"context_line":"      \"description\": \"UEFI firmware for x86_64, with SEV-SNP support\","}],"source_content_type":"text/x-rst","patch_set":10,"id":"2239cc84_04d488be","line":226,"range":{"start_line":226,"start_character":0,"end_line":226,"end_character":7},"in_reply_to":"946264f6_fd018dcd","updated":"2026-04-22 15:19:56.000000000","message":"Done","commit_id":"301829e11b96ecfc244c5a34015125a71dc7d4d3"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"f07d846e59f9375020c939062004122d48bca7b7","unresolved":true,"context_lines":[{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- Add the new ``HW_CPU_AMD_SEV_SNP`` trait to os-traits."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"- Make the libvirt driver `update the ProviderTree object"},{"line_number":85,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/reference/update-provider-tree.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":12,"id":"5422a841_8e4f9fb8","line":82,"updated":"2026-04-23 08:48:17.000000000","message":"With recent SEV firmware versions, you cannot start SEV-ES VMs on an SEV-SNP-capable host anymore. In early firmware versions you used to be able to start either SEV, SEV-ES or SEV-SNP VMs but that behavior has changed in more recent firmware versions and limits this to SEV and SEV-SNP on SNP-capable hosts (removing the SEV-ES capability).\n\nAccording to AMD, this is by design: https://github.com/AMDESE/AMDSEV/issues/282#issuecomment-3554492101\n\nAs a result, if we detect an SNP-capable host, I think we should *replace* the `HW_CPU_AMD_SEV_ES` trait by `HW_CPU_AMD_SEV_SNP`, instead of just adding the latter.\n\nOtherwise, depending on the firmware version on the host, SEV-ES VMs might get scheduled on such host but fail to start.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b88873317aeac84344b0af9f346584a029a86313","unresolved":true,"context_lines":[{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- Add the new ``HW_CPU_AMD_SEV_SNP`` trait to os-traits."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"- Make the libvirt driver `update the ProviderTree object"},{"line_number":85,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/reference/update-provider-tree.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":12,"id":"6567c46b_26768f10","line":82,"in_reply_to":"22548fbb_13987d0b","updated":"2026-04-23 13:57:10.000000000","message":"I\u0027ve decided to change the structure of RP to detect any instance on the host using SEV-ES during RP update.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"697a98d597f540f2c2785eb285b3122784e932c5","unresolved":true,"context_lines":[{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- Add the new ``HW_CPU_AMD_SEV_SNP`` trait to os-traits."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"- Make the libvirt driver `update the ProviderTree object"},{"line_number":85,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/reference/update-provider-tree.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":12,"id":"22548fbb_13987d0b","line":82,"in_reply_to":"5422a841_8e4f9fb8","updated":"2026-04-23 13:26:31.000000000","message":"OK so they changed the behavior due to https://nvd.nist.gov/vuln/detail/CVE-2025-48514 .\n\nI\u0027m not too sure if removing the trait works properly to detect any existing vms using SEV-ES here. Maybe we should not update the existing RP but create a separate one, and avoid adding the SEV-ES RP(which makes the nova-compute to purge ES RP which causes hard failure in case the node has instances with SEV-ES.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":true,"context_lines":[{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- Add the new ``HW_CPU_AMD_SEV_SNP`` trait to os-traits."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"- Make the libvirt driver `update the ProviderTree object"},{"line_number":85,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/reference/update-provider-tree.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":12,"id":"bfe2b06d_2954d0df","line":82,"in_reply_to":"6567c46b_26768f10","updated":"2026-05-28 14:46:37.000000000","message":"oh wait, so this is not a backwards-compatible SEV support ? if so, there is a large upgrade impact indeed.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- Add the new ``HW_CPU_AMD_SEV_SNP`` trait to os-traits."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"- Make the libvirt driver `update the ProviderTree object"},{"line_number":85,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/reference/update-provider-tree.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":12,"id":"460bd44c_5f0ad915","line":82,"in_reply_to":"a02e5648_569a64f4","updated":"2026-06-04 10:08:53.000000000","message":"Acknowledged","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- Add the new ``HW_CPU_AMD_SEV_SNP`` trait to os-traits."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"- Make the libvirt driver `update the ProviderTree object"},{"line_number":85,"context_line":"  \u003chttps://docs.openstack.org/nova/latest/reference/update-provider-tree.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":12,"id":"a02e5648_569a64f4","line":82,"in_reply_to":"bfe2b06d_2954d0df","updated":"2026-05-28 16:37:30.000000000","message":"This does not affect existing deployments, because SEV-ES is disabled \"when SEV-SNP is enabled\".\n\nHowever I agree this is a large backward-incomatpble change...","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"3e14bb408c42706d54e75c44c92f00bb5e1bb7d1","unresolved":true,"context_lines":[{"line_number":149,"context_line":"     these options are out of the current scope."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"  .. note::"},{"line_number":152,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Alternatives"},{"line_number":155,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"dcc0bfa8_16b0df2c","line":152,"updated":"2026-04-23 08:37:41.000000000","message":"```suggestion\n     The locked attribute doesn\u0027t have to be set for SEV-SNP.\n```\n\nnit: typo","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b88873317aeac84344b0af9f346584a029a86313","unresolved":false,"context_lines":[{"line_number":149,"context_line":"     these options are out of the current scope."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"  .. note::"},{"line_number":152,"context_line":"     The locked attribue doesn\u0027t have to be set for SEV-SNP."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Alternatives"},{"line_number":155,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"20fba7c6_ed28843b","line":152,"in_reply_to":"dcc0bfa8_16b0df2c","updated":"2026-04-23 13:57:10.000000000","message":"Done","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"3e14bb408c42706d54e75c44c92f00bb5e1bb7d1","unresolved":true,"context_lines":[{"line_number":200,"context_line":"In order for users to be able to use SEV-SNP, the operator will need to"},{"line_number":201,"context_line":"perform the following steps:"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"- Deploy SEV-SNP-capable hardware as nova compute hosts."},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":206,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"9eefb77e_f94308ec","line":203,"updated":"2026-04-23 08:37:41.000000000","message":"Do we also want to add another bullet point here that a deployer has to set `cpu_mode` and `cpu_models` in the `[libvirt]` section of `nova.conf` appropriately?\n\nFrom our experience, there are two choices:\n\n1. Set `cpu_mode \u003d host-passthrough` or `cpu_mode \u003d host-model`, effectively mirroring the phyiscal CPU\u0027s specs.\n2. Set `cpu_mode \u003d custom` and set the CPU model(s) in `cpu_models` to SEV-SNP-capable models to simulate those.\n\nFor no. 2 the models are usually found in `/usr/share/libvirt/cpu_map/*.xml`, where the `model name` attribute must be looked up and used.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":true,"context_lines":[{"line_number":200,"context_line":"In order for users to be able to use SEV-SNP, the operator will need to"},{"line_number":201,"context_line":"perform the following steps:"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"- Deploy SEV-SNP-capable hardware as nova compute hosts."},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":206,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"709f35d2_2e4b57ad","line":203,"in_reply_to":"1633d52c_891a3913","updated":"2026-06-04 10:08:53.000000000","message":"agreed with @kajinamit@oss.nttdata.com let\u0027s discuss this on the implementation series (just unresolving this comment so we can remember it)","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b88873317aeac84344b0af9f346584a029a86313","unresolved":true,"context_lines":[{"line_number":200,"context_line":"In order for users to be able to use SEV-SNP, the operator will need to"},{"line_number":201,"context_line":"perform the following steps:"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"- Deploy SEV-SNP-capable hardware as nova compute hosts."},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":206,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3af6e615_15257242","line":203,"in_reply_to":"2864d123_cbedaddf","updated":"2026-04-23 13:57:10.000000000","message":"I think this is too much detail in the spec and I\u0027d rather suggest explaining it in the documentation once the feature implementation is completed.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"8e6f0ce442be27e022808edcd0e7fca02abcd2c1","unresolved":true,"context_lines":[{"line_number":200,"context_line":"In order for users to be able to use SEV-SNP, the operator will need to"},{"line_number":201,"context_line":"perform the following steps:"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"- Deploy SEV-SNP-capable hardware as nova compute hosts."},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":206,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"1633d52c_891a3913","line":203,"in_reply_to":"3af6e615_15257242","updated":"2026-05-12 15:38:19.000000000","message":"+1 it is better to put all the details in the doc.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"73ecb486bc272a50fa58ed0feb94aa0af0fbeb9f","unresolved":true,"context_lines":[{"line_number":200,"context_line":"In order for users to be able to use SEV-SNP, the operator will need to"},{"line_number":201,"context_line":"perform the following steps:"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"- Deploy SEV-SNP-capable hardware as nova compute hosts."},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":206,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"2864d123_cbedaddf","line":203,"in_reply_to":"9eefb77e_f94308ec","updated":"2026-04-23 09:01:48.000000000","message":"When I tried with vCPU model set as EPYC-Rome, the VM still worked and had Attestation Report issued.\n    \u003cmodel fallback\u003d\u0027forbid\u0027\u003eEPYC-Rome\u003c/model\u003e\n\n\nHost CPU must be capable of SEV-SNP, but I think guest vCPU model can be older one without SEV-SNP feature like EPYC-Rome and thus it might not be needed to place notes to set newer model here.\n\n\nWe might have to note that if no.1 host-passthrough is selected, the measurement on the Attestation Report might be effected by precise CPU model of the hypervisor. CPUID (model number) of vCPU is folded into the measurement, and if no.2, the vCPU model is determined by the selected model, but if no.1, the CPUID of vCPU is copied from the physical CPU.\nBut it might be difficult to keep full document about how to guarantee measurement here.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"f8371becb8ecf894208ae5abcaee7a80ad394100","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  that the various layers are all SEV-SNP ready:"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"  - kernel \u003e\u003d 6.11"},{"line_number":214,"context_line":"  - QEMU \u003e\u003d 9.1.0"},{"line_number":215,"context_line":"  - libvirt \u003e\u003d 10.5.0"},{"line_number":216,"context_line":"  - ovmf \u003e\u003d edk2-stable202202"},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"d4c3a7c6_1f2ebfe3","line":214,"updated":"2026-04-23 11:46:45.000000000","message":"This is a minor detail and based on the official 9.1.0 release notes, the SNP support starts with 9.1.0 but do we have any actual positive test results with QEMU 9.1.0 and SNP?\n\nBased on our own testing, with QEMU 9.1.0 SNP VMs would fail to correctly boot because libvirt would crash with an \"invalid argument\" error, regardless of the libvirt version used. Only with 9.2.0+ this was fixed as reported during the 2026.1 PTG [1].\n\nSadly, the release notes for QEMU 9.2.0 do not mention anything related, so I cannot offer an official reference for this.\nHowever, I do recall that during the PTG session from October 2025, another community member also confirmed that they needed to use 9.2.0 due to this issue but unfortunately this statement was not recorded in the etherpad.\n\nThe only other reference is this statement by Ubuntu [2]:\n\n\u003e Ubuntu now supports AMD SEV-SNP on virtualization hosts, thanks to its kernel 6.14 and QEMU 9.2\n\nDo we want to play it safe here and demand 9.2.0?\n\n[1] https://etherpad.opendev.org/p/nova-2026.1-ptg#L641\n\n[2] https://ubuntu.com/confidential-computing","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"cc49aea81c8c7daeb93f2751a89be8edd9503fb0","unresolved":false,"context_lines":[{"line_number":211,"context_line":"  that the various layers are all SEV-SNP ready:"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"  - kernel \u003e\u003d 6.11"},{"line_number":214,"context_line":"  - QEMU \u003e\u003d 9.1.0"},{"line_number":215,"context_line":"  - libvirt \u003e\u003d 10.5.0"},{"line_number":216,"context_line":"  - ovmf \u003e\u003d edk2-stable202202"},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"4f9dd497_5c5dd0e6","line":214,"in_reply_to":"2cbcdd03_ecd57ae9","updated":"2026-04-23 13:12:49.000000000","message":"Thank you for checking, Hiroki.\n\nI guess it might be an Ubuntu-specific quirk then. In this case, I am fine with keeping the current version boundaries.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"c8e4773d55e526dc39c81fa01e3a30e4c5af090d","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  that the various layers are all SEV-SNP ready:"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"  - kernel \u003e\u003d 6.11"},{"line_number":214,"context_line":"  - QEMU \u003e\u003d 9.1.0"},{"line_number":215,"context_line":"  - libvirt \u003e\u003d 10.5.0"},{"line_number":216,"context_line":"  - ovmf \u003e\u003d edk2-stable202202"},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"2cbcdd03_ecd57ae9","line":214,"in_reply_to":"d4c3a7c6_1f2ebfe3","updated":"2026-04-23 11:50:41.000000000","message":"In our environment, we use packages like qemu-kvm-core-9.1.0-15.el9_6.9.x86_64 and SEV-SNP works well.","commit_id":"cdcde8f3e6cf8f601fd09c1590d19637cb1020cf"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"548ad51ef40c4284724762b3b1b76fa662380201","unresolved":true,"context_lines":[{"line_number":8,"context_line":"libvirt driver launching instances with memory encryption by AMD SEV-SNP"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/amd-sev-es-libvirt-support"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This spec proposes work required in order to extend the existing libvirt driver"},{"line_number":14,"context_line":"feature to launch AMD SEV-encrypted instances, to support also using AMD"}],"source_content_type":"text/x-rst","patch_set":13,"id":"7b3ac155_da35848d","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":70},"updated":"2026-05-04 13:32:40.000000000","message":"The BP link is wrong, I guess it should be https://blueprints.launchpad.net/nova/+spec/amd-sev-snp-libvirt-support","commit_id":"aa7d9ededafc2779ead25c9cbd5501817b97f557"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"53062eb87bad64acd25080feadc6583787c4bd1e","unresolved":false,"context_lines":[{"line_number":8,"context_line":"libvirt driver launching instances with memory encryption by AMD SEV-SNP"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/amd-sev-es-libvirt-support"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This spec proposes work required in order to extend the existing libvirt driver"},{"line_number":14,"context_line":"feature to launch AMD SEV-encrypted instances, to support also using AMD"}],"source_content_type":"text/x-rst","patch_set":13,"id":"49bd5264_9e479075","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":70},"in_reply_to":"7b3ac155_da35848d","updated":"2026-05-04 13:41:16.000000000","message":"Oh yes. This is my wrong copy-paste...","commit_id":"aa7d9ededafc2779ead25c9cbd5501817b97f557"},{"author":{"_account_id":35587,"name":"Hiroki Narukawa","email":"hnarukaw@lycorp.co.jp","username":"nhirokinet"},"change_message_id":"5eb4cb1d360c944e9807d02cd472e6c32323a686","unresolved":true,"context_lines":[{"line_number":57,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":58,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"},{"line_number":59,"context_line":"    (AMD-SP) support SEV functionality"},{"line_number":60,"context_line":"    \u003chttps://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c\u003e`_::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        \u003cdomainCapabilities\u003e"},{"line_number":63,"context_line":"          ..."}],"source_content_type":"text/x-rst","patch_set":13,"id":"80a93700_2b7968cb","line":60,"updated":"2026-05-12 11:57:54.000000000","message":"I couldn\u0027t follow this link ( https://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c ), is it correct? Maybe I\u0027m doing wrong while following the link though.\n\nThe commit hash itself looks like correct.\nhttps://gitlab.com/libvirt/libvirt/-/commit/6688393c6b222b5d7cba238f21d55134611ede9c","commit_id":"aa7d9ededafc2779ead25c9cbd5501817b97f557"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"866441c03c070a5c33b247a67cd089520ee7ed9b","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    \u003chttps://libvirt.org/html/libvirt-libvirt-domain.html#virConnectGetDomainCapabilities\u003e`_"},{"line_number":58,"context_line":"    API call `indicates that both QEMU and the AMD Secure Processor"},{"line_number":59,"context_line":"    (AMD-SP) support SEV functionality"},{"line_number":60,"context_line":"    \u003chttps://libvirt.org/git/?p\u003dlibvirt.git;a\u003dcommit;h\u003d6688393c6b222b5d7cba238f21d55134611ede9c\u003e`_::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        \u003cdomainCapabilities\u003e"},{"line_number":63,"context_line":"          ..."}],"source_content_type":"text/x-rst","patch_set":13,"id":"29d00c44_1379fd10","line":60,"in_reply_to":"80a93700_2b7968cb","updated":"2026-05-12 13:57:17.000000000","message":"Done","commit_id":"aa7d9ededafc2779ead25c9cbd5501817b97f557"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"8e6f0ce442be27e022808edcd0e7fca02abcd2c1","unresolved":true,"context_lines":[{"line_number":187,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":188,"context_line":"in flavor extra specs and image properties."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":191,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":192,"context_line":"are applied when SEV-SNP is used."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"9a0ca838_a80b09fe","line":190,"range":{"start_line":190,"start_character":10,"end_line":190,"end_character":21},"updated":"2026-05-12 15:38:19.000000000","message":"TDX mentioned that the VNC console will not work due to memory encryption.\nWill it be the same with SNP ? (if so maybe the document below need an update.\n\nAlso, TDX proposed to add some checks to block `hw_disk_bus\u003dscsi`\n`hw_scsi_model\u003dvirtio-scsi`. It would be great to have a common interface or method for these checks.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"2ce1e8c29ad44110b70561f2a11d79c121582413","unresolved":true,"context_lines":[{"line_number":187,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":188,"context_line":"in flavor extra specs and image properties."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":191,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":192,"context_line":"are applied when SEV-SNP is used."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"7d2864a7_0576d9f9","line":190,"range":{"start_line":190,"start_character":10,"end_line":190,"end_character":21},"in_reply_to":"1fd0b43e_0db09f93","updated":"2026-05-13 14:05:20.000000000","message":"Are there any limitations that would be common across technologies? Would it make sense to have a shared mechanism to block them, with the ability to extend it for each technology?","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"61c8832fa1d0379eb4cbe57dd43a06bf950df7ca","unresolved":true,"context_lines":[{"line_number":187,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":188,"context_line":"in flavor extra specs and image properties."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":191,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":192,"context_line":"are applied when SEV-SNP is used."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"d5f7f525_dd46b76e","line":190,"range":{"start_line":190,"start_character":10,"end_line":190,"end_character":21},"in_reply_to":"7d2864a7_0576d9f9","updated":"2026-05-18 15:50:05.000000000","message":"Yes and the `MemEncryptionConfig` base class, which was introduced during memory encryption refactoring, was added for this purpose.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"8bf152b16fa4ce8776bc6cfe3959a903cc2b5aea","unresolved":true,"context_lines":[{"line_number":187,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":188,"context_line":"in flavor extra specs and image properties."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":191,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":192,"context_line":"are applied when SEV-SNP is used."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"bde359c9_4c214ef0","line":190,"range":{"start_line":190,"start_character":10,"end_line":190,"end_character":21},"in_reply_to":"9a0ca838_a80b09fe","updated":"2026-05-12 16:12:44.000000000","message":"VNC console works for SEV-SNP instances. Also SEV-SNP does not require virtio-scsi and virtio-blk works.\n\nSo these requirements are specific to TDX now.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"b94b5e6d04ca8af37a8e18a5a023b7bd4c61953e","unresolved":true,"context_lines":[{"line_number":187,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":188,"context_line":"in flavor extra specs and image properties."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":191,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":192,"context_line":"are applied when SEV-SNP is used."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"1fd0b43e_0db09f93","line":190,"range":{"start_line":190,"start_character":10,"end_line":190,"end_character":21},"in_reply_to":"bde359c9_4c214ef0","updated":"2026-05-13 13:54:08.000000000","message":"Just a small correction. TDX works with virtio-blk, but not scsi.\n\nThe limitation is TDX specific.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"56f35d6d4b36331cf041f445da8564ba71e27795","unresolved":false,"context_lines":[{"line_number":187,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":188,"context_line":"in flavor extra specs and image properties."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":191,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":192,"context_line":"are applied when SEV-SNP is used."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"161a9b60_ace8e0ff","line":190,"range":{"start_line":190,"start_character":10,"end_line":190,"end_character":21},"in_reply_to":"d5f7f525_dd46b76e","updated":"2026-05-18 16:52:23.000000000","message":"Oh! yes sure. Sorry for the dumb question.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"8e6f0ce442be27e022808edcd0e7fca02abcd2c1","unresolved":true,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":15,"id":"64e1e8ac_c0289972","line":269,"updated":"2026-05-12 15:38:19.000000000","message":"The spec says the SEV-ES resource provider is deleted when SEV-SNP support is detected.\nBut what happens during an upgrade if the host already has SEV-ES instances running and is also SNP-capable? How will the transition be handled when nova-compute restarts and detects SNP support? Will the SEV-ES RP be removed immediately, and what happens to the existing SEV-ES allocations?","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b65cf976e494a5bd7375ab327c13faaebf3a7c26","unresolved":true,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":15,"id":"2b8cea07_79ddf59d","line":269,"in_reply_to":"1aa7a35c_24257b2a","updated":"2026-05-13 07:19:16.000000000","message":"I\u0027ve added the explanation of this requirement.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"2ce1e8c29ad44110b70561f2a11d79c121582413","unresolved":false,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":15,"id":"626174fc_1bafda30","line":269,"in_reply_to":"2b8cea07_79ddf59d","updated":"2026-05-13 14:05:20.000000000","message":"Thanks Takashi. We can look into providing a clear error message for the user during the implementation phase if this situation occurs.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"8bf152b16fa4ce8776bc6cfe3959a903cc2b5aea","unresolved":true,"context_lines":[{"line_number":266,"context_line":"Upgrade impact"},{"line_number":267,"context_line":"--------------"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"None"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":15,"id":"1aa7a35c_24257b2a","line":269,"in_reply_to":"64e1e8ac_c0289972","updated":"2026-05-12 16:12:44.000000000","message":"\u003e Will the SEV-ES RP be removed immediately, and what happens to the existing SEV-ES allocations?\n\nIn that case nova-compute fails to start because it can\u0027t delete SEV-ES RP. Users should disable sev-snp support on that host or evacuate the instance to any other hosts with SEV-ES support remaining. That\u0027s the main purpose of the separate resource provider. The earlier version of this spec uses the existing SEV-ES RP but updates it trait, but that does not fail because placement allows updating traits of existing RP with allocations.","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":16207,"name":"ribaudr","display_name":"uggla","email":"rene.ribaud@gmail.com","username":"uggla","status":"Red Hat"},"change_message_id":"8e6f0ce442be27e022808edcd0e7fca02abcd2c1","unresolved":true,"context_lines":[{"line_number":379,"context_line":"   * - Release Name"},{"line_number":380,"context_line":"     - Description"},{"line_number":381,"context_line":"   * - 2026.2 Hibiscus"},{"line_number":382,"context_line":"     - Approved"}],"source_content_type":"text/x-rst","patch_set":15,"id":"ef6b1a5c_79eb633c","line":382,"range":{"start_line":382,"start_character":7,"end_line":382,"end_character":15},"updated":"2026-05-12 15:38:19.000000000","message":"s/Approved/Introduced/","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b65cf976e494a5bd7375ab327c13faaebf3a7c26","unresolved":false,"context_lines":[{"line_number":379,"context_line":"   * - Release Name"},{"line_number":380,"context_line":"     - Description"},{"line_number":381,"context_line":"   * - 2026.2 Hibiscus"},{"line_number":382,"context_line":"     - Approved"}],"source_content_type":"text/x-rst","patch_set":15,"id":"4122a110_21ff2437","line":382,"range":{"start_line":382,"start_character":7,"end_line":382,"end_character":15},"in_reply_to":"4c1354bc_d1c5f6b6","updated":"2026-05-13 07:19:16.000000000","message":"Done","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"8bf152b16fa4ce8776bc6cfe3959a903cc2b5aea","unresolved":true,"context_lines":[{"line_number":379,"context_line":"   * - Release Name"},{"line_number":380,"context_line":"     - Description"},{"line_number":381,"context_line":"   * - 2026.2 Hibiscus"},{"line_number":382,"context_line":"     - Approved"}],"source_content_type":"text/x-rst","patch_set":15,"id":"4c1354bc_d1c5f6b6","line":382,"range":{"start_line":382,"start_character":7,"end_line":382,"end_character":15},"in_reply_to":"ef6b1a5c_79eb633c","updated":"2026-05-12 16:12:44.000000000","message":"will fix it in the next version","commit_id":"9b31f8589db22157c05470f6f01944d18686296f"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"02ba7488e4b63efd7ecbf0eb6cd10949eb77647e","unresolved":true,"context_lines":[{"line_number":120,"context_line":"  ``trait:HW_CPU_AMD_SEV_SNP\u003drequired``. If conflicting models are requested by"},{"line_number":121,"context_line":"  the instance flavor and the instance image then the request is rejected."},{"line_number":122,"context_line":"  Also ``amd-sev-snp`` requires stateless firmware, so explicit"},{"line_number":123,"context_line":"  ``hw_firmware_stateless\u003dTrue`` image property setting is also required."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"- Change the libvirt driver to include extra XML in the guest\u0027s domain"},{"line_number":126,"context_line":"  definition when the ``hw:mem_encryption_model`` parameter in flavor extra"}],"source_content_type":"text/x-rst","patch_set":17,"id":"62932d9b_80afb5ca","line":123,"updated":"2026-05-21 15:08:03.000000000","message":"so I guess the new MemEncryptionConfigSevSnp class would have another check_constraints() method verifying this ?","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"be7b75b6ca762eeb1be89edc08f42ccfa28e2d46","unresolved":true,"context_lines":[{"line_number":120,"context_line":"  ``trait:HW_CPU_AMD_SEV_SNP\u003drequired``. If conflicting models are requested by"},{"line_number":121,"context_line":"  the instance flavor and the instance image then the request is rejected."},{"line_number":122,"context_line":"  Also ``amd-sev-snp`` requires stateless firmware, so explicit"},{"line_number":123,"context_line":"  ``hw_firmware_stateless\u003dTrue`` image property setting is also required."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"- Change the libvirt driver to include extra XML in the guest\u0027s domain"},{"line_number":126,"context_line":"  definition when the ``hw:mem_encryption_model`` parameter in flavor extra"}],"source_content_type":"text/x-rst","patch_set":17,"id":"e136f16f_e6896cf2","line":123,"in_reply_to":"62932d9b_80afb5ca","updated":"2026-05-21 15:50:01.000000000","message":"Yes, that\u0027s the plan. MemEncryptionConfigSevSnp extends check_constraints and additionally validates this.","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":false,"context_lines":[{"line_number":120,"context_line":"  ``trait:HW_CPU_AMD_SEV_SNP\u003drequired``. If conflicting models are requested by"},{"line_number":121,"context_line":"  the instance flavor and the instance image then the request is rejected."},{"line_number":122,"context_line":"  Also ``amd-sev-snp`` requires stateless firmware, so explicit"},{"line_number":123,"context_line":"  ``hw_firmware_stateless\u003dTrue`` image property setting is also required."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"- Change the libvirt driver to include extra XML in the guest\u0027s domain"},{"line_number":126,"context_line":"  definition when the ``hw:mem_encryption_model`` parameter in flavor extra"}],"source_content_type":"text/x-rst","patch_set":17,"id":"d25c804a_0f5ab868","line":123,"in_reply_to":"e136f16f_e6896cf2","updated":"2026-05-28 14:46:37.000000000","message":"Acknowledged","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"02ba7488e4b63efd7ecbf0eb6cd10949eb77647e","unresolved":true,"context_lines":[{"line_number":159,"context_line":"Alternatives"},{"line_number":160,"context_line":"------------"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"None"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Data model impact"},{"line_number":165,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"8028fa6e_72671d7b","line":162,"updated":"2026-05-21 15:08:03.000000000","message":"hmmm, really ? you could say that we could just reuse the existing resource providers for SEV-ES as you discussed in previous PSes.","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"3526ba0cabeeb5c9e4763e6493e2d94cb8b4da03","unresolved":false,"context_lines":[{"line_number":159,"context_line":"Alternatives"},{"line_number":160,"context_line":"------------"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"None"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Data model impact"},{"line_number":165,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"bf331632_2ba93f7a","line":162,"in_reply_to":"8028fa6e_72671d7b","updated":"2026-05-21 16:04:26.000000000","message":"Done","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"02ba7488e4b63efd7ecbf0eb6cd10949eb77647e","unresolved":true,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":"  - kernel \u003e\u003d 6.11"},{"line_number":219,"context_line":"  - QEMU \u003e\u003d 9.1.0"},{"line_number":220,"context_line":"  - libvirt \u003e\u003d 10.5.0"},{"line_number":221,"context_line":"  - ovmf \u003e\u003d edk2-stable202202"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"  These requirements can be met by using `Ubuntu 25.04 or later"}],"source_content_type":"text/x-rst","patch_set":17,"id":"98436c24_1cd523d6","line":220,"updated":"2026-05-21 15:08:03.000000000","message":"make sure that we can verify them by variables like https://github.com/openstack/nova/blob/6901f0cdddc199fe23aef0cd34f86ae2066ead30/nova/virt/libvirt/driver.py#L238-L239","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":"  - kernel \u003e\u003d 6.11"},{"line_number":219,"context_line":"  - QEMU \u003e\u003d 9.1.0"},{"line_number":220,"context_line":"  - libvirt \u003e\u003d 10.5.0"},{"line_number":221,"context_line":"  - ovmf \u003e\u003d edk2-stable202202"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"  These requirements can be met by using `Ubuntu 25.04 or later"}],"source_content_type":"text/x-rst","patch_set":17,"id":"992f5237_d0d30985","line":220,"in_reply_to":"43d6ecf3_2a9fb11b","updated":"2026-06-04 10:08:53.000000000","message":"Acknowledged","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"be7b75b6ca762eeb1be89edc08f42ccfa28e2d46","unresolved":true,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":"  - kernel \u003e\u003d 6.11"},{"line_number":219,"context_line":"  - QEMU \u003e\u003d 9.1.0"},{"line_number":220,"context_line":"  - libvirt \u003e\u003d 10.5.0"},{"line_number":221,"context_line":"  - ovmf \u003e\u003d edk2-stable202202"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"  These requirements can be met by using `Ubuntu 25.04 or later"}],"source_content_type":"text/x-rst","patch_set":17,"id":"43d6ecf3_2a9fb11b","line":220,"in_reply_to":"98436c24_1cd523d6","updated":"2026-05-21 15:50:01.000000000","message":"For kernel we can safely assume that the version requirement is met as long as the kernel parameter exist.\nFor QEMU and libvirt we may need explicit version checks.","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"02ba7488e4b63efd7ecbf0eb6cd10949eb77647e","unresolved":true,"context_lines":[{"line_number":257,"context_line":"might need to be created additionally. See the `libvirt mailing list post"},{"line_number":258,"context_line":"\u003chttps://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/BZOKLW4ZYDNUGIZK3NQDR5H7KEGENFG3/\u003e`_"},{"line_number":259,"context_line":"for reference."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Developer impact"},{"line_number":262,"context_line":"----------------"},{"line_number":263,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"d90be46f_9d4960e5","line":260,"updated":"2026-05-21 15:08:03.000000000","message":"I guess you need to say that live-migration won\u0027t be accepted by the compute API too.","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"3526ba0cabeeb5c9e4763e6493e2d94cb8b4da03","unresolved":false,"context_lines":[{"line_number":257,"context_line":"might need to be created additionally. See the `libvirt mailing list post"},{"line_number":258,"context_line":"\u003chttps://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/BZOKLW4ZYDNUGIZK3NQDR5H7KEGENFG3/\u003e`_"},{"line_number":259,"context_line":"for reference."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Developer impact"},{"line_number":262,"context_line":"----------------"},{"line_number":263,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"21e86b24_28c5749b","line":260,"in_reply_to":"8947bec1_bcf79576","updated":"2026-05-21 16:04:26.000000000","message":"Done","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ce6d796789414d69655cd872568c99cb30c61e5d","unresolved":true,"context_lines":[{"line_number":257,"context_line":"might need to be created additionally. See the `libvirt mailing list post"},{"line_number":258,"context_line":"\u003chttps://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/BZOKLW4ZYDNUGIZK3NQDR5H7KEGENFG3/\u003e`_"},{"line_number":259,"context_line":"for reference."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Developer impact"},{"line_number":262,"context_line":"----------------"},{"line_number":263,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"8947bec1_bcf79576","line":260,"in_reply_to":"d90be46f_9d4960e5","updated":"2026-05-21 15:55:32.000000000","message":"This was implicitly mentioned by the \"Other end user impact\", but I\u0027ll describe it directly because that\u0027s a FAQ.","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"02ba7488e4b63efd7ecbf0eb6cd10949eb77647e","unresolved":true,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"If any instances with SEV-ES encryption are already created in the compute"},{"line_number":270,"context_line":"host, nova-compute fails to start because deleting the SEV-ES resource provider"},{"line_number":271,"context_line":"is rejected by placement due to the remaining allocations."},{"line_number":272,"context_line":"Operators should migrate the existing instances with SEV-ES encryption before"},{"line_number":273,"context_line":"SEV-SNP is enabled."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"7d43a63c_2d04efdb","line":271,"updated":"2026-05-21 15:08:03.000000000","message":"would we return a specific exception explaining it better than \u0027sorry, you already have allocations\u0027 ?","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"3526ba0cabeeb5c9e4763e6493e2d94cb8b4da03","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"If any instances with SEV-ES encryption are already created in the compute"},{"line_number":270,"context_line":"host, nova-compute fails to start because deleting the SEV-ES resource provider"},{"line_number":271,"context_line":"is rejected by placement due to the remaining allocations."},{"line_number":272,"context_line":"Operators should migrate the existing instances with SEV-ES encryption before"},{"line_number":273,"context_line":"SEV-SNP is enabled."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"49a14662_1d0ae233","line":271,"in_reply_to":"4911e34d_f594a6ea","updated":"2026-05-21 16:04:26.000000000","message":"Done","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"be7b75b6ca762eeb1be89edc08f42ccfa28e2d46","unresolved":true,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"If any instances with SEV-ES encryption are already created in the compute"},{"line_number":270,"context_line":"host, nova-compute fails to start because deleting the SEV-ES resource provider"},{"line_number":271,"context_line":"is rejected by placement due to the remaining allocations."},{"line_number":272,"context_line":"Operators should migrate the existing instances with SEV-ES encryption before"},{"line_number":273,"context_line":"SEV-SNP is enabled."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"4911e34d_f594a6ea","line":271,"in_reply_to":"7d43a63c_2d04efdb","updated":"2026-05-21 15:50:01.000000000","message":"We can implement start up validation for it. I\u0027ll add that.","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"3526ba0cabeeb5c9e4763e6493e2d94cb8b4da03","unresolved":false,"context_lines":[{"line_number":290,"context_line":"#. Add the new ``HW_CPU_AMD_SEV_SNP`` trait for os-traits"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"#. Add detection of host SEV-SNP capabilities as detailed above so that"},{"line_number":293,"context_line":"   the ``HW_CPU_AMD_SEV_SNP`` trait to added to the new/existing SEV-ES RP."},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"#. Add ``mem_encryption_model`` property to ImageMeta object"},{"line_number":296,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"810020b1_f1d0480e","line":293,"range":{"start_line":293,"start_character":48,"end_line":293,"end_character":75},"updated":"2026-05-21 16:04:26.000000000","message":"This needs to be updated","commit_id":"1ab247667ec96e4e25f4da208657e6e0ada726b0"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":42,"context_line":"#. As a cloud user, in order to reduce data leakage risks further, I want to"},{"line_number":43,"context_line":"   be able to boot VM instances with SEV-SNP functionality. Also I want to"},{"line_number":44,"context_line":"   verify integrity of my VMs using attestation reports generated by"},{"line_number":45,"context_line":"   the secure processor within AMD CPUs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7ec52a82_c00196d7","line":45,"updated":"2026-05-27 11:17:15.000000000","message":"in scope or out of scope?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"151d674b912fbbc8e4a54c13739aeb08472715f6","unresolved":true,"context_lines":[{"line_number":42,"context_line":"#. As a cloud user, in order to reduce data leakage risks further, I want to"},{"line_number":43,"context_line":"   be able to boot VM instances with SEV-SNP functionality. Also I want to"},{"line_number":44,"context_line":"   verify integrity of my VMs using attestation reports generated by"},{"line_number":45,"context_line":"   the secure processor within AMD CPUs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a76ca37_62a3f614","line":45,"in_reply_to":"6061f91d_b3d91c99","updated":"2026-06-01 14:39:22.000000000","message":"The device to obtain attestation report is automatically exposed when SEV-SNP is enabled (it requires appropriate guest kernel support to to let guest actually read the report data generated and signed by the security chip within CPU).\nBy default the report includes information about TEE (like cpu info, the policy and etc) but the report contains digest about bootchain elements when kernelHashes is set. I\u0027ll clarify this point in the next version.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":42,"context_line":"#. As a cloud user, in order to reduce data leakage risks further, I want to"},{"line_number":43,"context_line":"   be able to boot VM instances with SEV-SNP functionality. Also I want to"},{"line_number":44,"context_line":"   verify integrity of my VMs using attestation reports generated by"},{"line_number":45,"context_line":"   the secure processor within AMD CPUs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"88288cc6_303b8241","line":45,"in_reply_to":"7ec52a82_c00196d7","updated":"2026-05-28 16:37:30.000000000","message":"It\u0027s in scope and is achieved by kernelHashes support.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"522f982185883856e3eb4ef08bf52029ea5d3fd4","unresolved":true,"context_lines":[{"line_number":42,"context_line":"#. As a cloud user, in order to reduce data leakage risks further, I want to"},{"line_number":43,"context_line":"   be able to boot VM instances with SEV-SNP functionality. Also I want to"},{"line_number":44,"context_line":"   verify integrity of my VMs using attestation reports generated by"},{"line_number":45,"context_line":"   the secure processor within AMD CPUs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"6061f91d_b3d91c99","line":45,"in_reply_to":"88288cc6_303b8241","updated":"2026-05-29 09:58:14.000000000","message":"hm, then I\u0027m missing something in the description of kernelHashes below. What is that attestation report, who has access to it and in what form? Is it something that directly and automatically gets exposed to the guest?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac545979e5765560928018afeca12fd9b97acd54","unresolved":false,"context_lines":[{"line_number":42,"context_line":"#. As a cloud user, in order to reduce data leakage risks further, I want to"},{"line_number":43,"context_line":"   be able to boot VM instances with SEV-SNP functionality. Also I want to"},{"line_number":44,"context_line":"   verify integrity of my VMs using attestation reports generated by"},{"line_number":45,"context_line":"   the secure processor within AMD CPUs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"eaf32f64_f02b6d1f","line":45,"in_reply_to":"9a76ca37_62a3f614","updated":"2026-06-01 15:56:02.000000000","message":"I\u0027ve added a few more sentences (mainly in problem description) to cover this.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"136748bb62dae22bfca523ef130e2fbfa7fb49d7","unresolved":false,"context_lines":[{"line_number":42,"context_line":"#. As a cloud user, in order to reduce data leakage risks further, I want to"},{"line_number":43,"context_line":"   be able to boot VM instances with SEV-SNP functionality. Also I want to"},{"line_number":44,"context_line":"   verify integrity of my VMs using attestation reports generated by"},{"line_number":45,"context_line":"   the secure processor within AMD CPUs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"44138b30_b9c7dfaa","line":45,"in_reply_to":"eaf32f64_f02b6d1f","updated":"2026-06-02 10:43:36.000000000","message":"Thanks. So the guest can grab the report without nova needing to add anything. Good to know.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":true,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev_snp`` should have the value ``Y``"},{"line_number":76,"context_line":"    to indicate that the kernel has SEV-SNP capabilities enabled.  This"},{"line_number":77,"context_line":"    should be readable by any user (i.e. even non-root)."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":18,"id":"80dc1331_67205f3e","line":77,"updated":"2026-05-28 14:46:37.000000000","message":"provided the operator enabled SNP in the BIOS 😉","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev_snp`` should have the value ``Y``"},{"line_number":76,"context_line":"    to indicate that the kernel has SEV-SNP capabilities enabled.  This"},{"line_number":77,"context_line":"    should be readable by any user (i.e. even non-root)."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"  - Check QEMU version and libvirt version to determine whether the available"},{"line_number":80,"context_line":"    QEMU binary and libvirt binary support SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":18,"id":"3af01e98_892586b9","line":77,"in_reply_to":"80dc1331_67205f3e","updated":"2026-06-04 10:08:53.000000000","message":"Done","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":104,"context_line":"  provider for SEV-ES ASIDs pool is deleted. This follows the recent firmware"},{"line_number":105,"context_line":"  update which disables SEV-ES when SEV-SNP is enabled, to solve"},{"line_number":106,"context_line":"  `CVE-2025-48514 \u003chttps://nvd.nist.gov/vuln/detail/CVE-2025-48514\u003e`_ ."},{"line_number":107,"context_line":"  The maxESGuests attribute exposed by libvirt will be used to determine"},{"line_number":108,"context_line":"  the maximum number of guests with SEV-SNP support."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"  .. note::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"09207a95_0bb75528","line":107,"range":{"start_line":107,"start_character":6,"end_line":107,"end_character":17},"updated":"2026-05-27 11:17:15.000000000","message":"just to double check, maxESGuests are valid for SNP guests as well? the libvirt doc does not mention SNP specificly for this https://libvirt.org/formatdomaincaps.html#sev-capabilities","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":true,"context_lines":[{"line_number":104,"context_line":"  provider for SEV-ES ASIDs pool is deleted. This follows the recent firmware"},{"line_number":105,"context_line":"  update which disables SEV-ES when SEV-SNP is enabled, to solve"},{"line_number":106,"context_line":"  `CVE-2025-48514 \u003chttps://nvd.nist.gov/vuln/detail/CVE-2025-48514\u003e`_ ."},{"line_number":107,"context_line":"  The maxESGuests attribute exposed by libvirt will be used to determine"},{"line_number":108,"context_line":"  the maximum number of guests with SEV-SNP support."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"  .. note::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"4cf49c80_2be23ff1","line":107,"range":{"start_line":107,"start_character":6,"end_line":107,"end_character":17},"in_reply_to":"09207a95_0bb75528","updated":"2026-05-28 14:46:37.000000000","message":"I\u0027m afraid of an upgrade impact: if I have an existing AMD Epyc 3st CPU host using AMD SEV-ES and if I upgrade both my OS and Nova, then my existing instances would no longer work, right ?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  provider for SEV-ES ASIDs pool is deleted. This follows the recent firmware"},{"line_number":105,"context_line":"  update which disables SEV-ES when SEV-SNP is enabled, to solve"},{"line_number":106,"context_line":"  `CVE-2025-48514 \u003chttps://nvd.nist.gov/vuln/detail/CVE-2025-48514\u003e`_ ."},{"line_number":107,"context_line":"  The maxESGuests attribute exposed by libvirt will be used to determine"},{"line_number":108,"context_line":"  the maximum number of guests with SEV-SNP support."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"  .. note::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"d8dffbcf_8e13f6e8","line":107,"range":{"start_line":107,"start_character":6,"end_line":107,"end_character":17},"in_reply_to":"24e0d436_5cb7d539","updated":"2026-06-04 10:08:53.000000000","message":"Acknowledged","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":104,"context_line":"  provider for SEV-ES ASIDs pool is deleted. This follows the recent firmware"},{"line_number":105,"context_line":"  update which disables SEV-ES when SEV-SNP is enabled, to solve"},{"line_number":106,"context_line":"  `CVE-2025-48514 \u003chttps://nvd.nist.gov/vuln/detail/CVE-2025-48514\u003e`_ ."},{"line_number":107,"context_line":"  The maxESGuests attribute exposed by libvirt will be used to determine"},{"line_number":108,"context_line":"  the maximum number of guests with SEV-SNP support."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"  .. note::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"24e0d436_5cb7d539","line":107,"range":{"start_line":107,"start_character":6,"end_line":107,"end_character":17},"in_reply_to":"4cf49c80_2be23ff1","updated":"2026-05-28 16:37:30.000000000","message":"\u003e just to double check, maxESGuests are valid for SNP guests as well? \n\nmaxESGuests reads the specific CPUID which exposes the minimum ASID for SEV, so it is valid for SEV-SNP.\n\n\u003e I\u0027m afraid of an upgrade impact: if I have an existing AMD Epyc 3st CPU host using AMD SEV-ES and if I upgrade both my OS and Nova, then my existing instances would no longer work, right ?\n\nNo. Just upgrading OS and nova does not break anything, because SEV-SNP is an opt-in feature. SEV-SNP support should be explicitly enabled in BIOS/UEFI and the kvm_amd kernel module. Once you enable SEV-SNP, existing SEV-ES instances may no longer start in that node.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"e8f85e81_27fe426e","line":116,"updated":"2026-05-27 11:17:15.000000000","message":"Let\u0027s discuss it a bit. \n\nSo as far as I understand. With a CPU firmware update AMD disabled SEV-ES support in the CPU. Is it so? If yes, then that firmware update might or might not deployed on the host at the moment. So the support of ES guests does not depend on the OpenStack Hibiscus nova-compute version but depends on the CPU firmware version. So we should not mix the two.\n\nIs there a way to detect that the CPU firmware is deployed. Will libvirt report ES support in that case?\n\nI guess applying the firmware upgrade needs a CPU restart and therefore VMs using the CPU are stopped and then they will fail to start again after the firmware upgrade as the requested ES feature is removed. Is it so?\n\nI think we need a separate backportable bugfix to handle SEV-ES CPU feature removal as it can happen with computes running older nova versions. This fix should:\n* detect if the CPU feature is removed and there are VMs using that feature and not marked for deletion and prevent nova-compute to startup and ask the deployer to evacuate or delete such VMs. \n* remove the SEV-ES inventory from Placement if no VMs are using such inventory.\n\nWhen this bugfix is in place the SEV-SNP feature can be implemented on top independently from the SEV-ES complication.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1b10bd911ec4fdd2311a7b752e93f82031808038","unresolved":false,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"ce609e06_39148df9","line":116,"in_reply_to":"0ed6be26_66a83cf0","updated":"2026-06-03 12:41:00.000000000","message":"Thanks it is clear to me now.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"0f4c8bea313a53e88fd0ff3d070a23b6f7dcd2c1","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"0ed6be26_66a83cf0","line":116,"in_reply_to":"29cfd6fe_b981860d","updated":"2026-06-02 15:55:37.000000000","message":"\u003e Yes, so that means that ES is still supported on a upgraded compute even if the firmware is updated... until the operator modifies the BIOS option for asking to use SNP.\n\nYes. This is almost correct.\nThe only exception scenario is when users installed older firmware which does not prohibit enabling both ES and SNP in the same node and enabled SEV-SNP. However I\u0027ll ignore this corner case now because users should upgrade their firmware some day in the future and this combination will be prohibited then.\n\n\u003e That said, we don\u0027t have any sev_snp CPU flag until the BIOS is modified, so we continue to support SEV-ES, right?\n\nThis is correct.\n\n\u003e OKAY, so I see a solution : when restarting a compute, we can look at /proc/cpuinfo to look at the snp flag. If we have existing instances using ES, we stop the compute. That way, operators would need to move the SEV-ES instances to other hosts before modifying the BIOS option but if they forget about it, they could also just reboot the host, modify the BIOS to no longer ask for SNP, restart the compute and then move the instances before modifying again the BIOS option.\n\nThat makes sense.\n\nInitially I was planning to check kvm module parameter to detect availability of sev-snp, but technically users can enable SEV-SNP in bios but still disable it in KVM module layer. Even in this setting SEV-ES no longer works so we should check cpuflag directly for accurate detection.\n\nLet me update the spec accordingly.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"522f982185883856e3eb4ef08bf52029ea5d3fd4","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"8e51df73_640722de","line":116,"in_reply_to":"3d63f1b2_99c0e8f1","updated":"2026-05-29 09:58:14.000000000","message":"OK thanks for he clarification. So the actual gating of the removal of SEV-ES support is a BIOS config option, the one that enables SEV-SNP. Indeed it makes our life a bit easier. Then I suggest to\n* nova-compute at startup checks for ES support. If ES support is now not available but there are VMs exists on the host needing ES support then nova-compute refuses to start and emits logs to guide the human deployer to change back the BIOS config to disable SNP and therefore reenable ES, and move the ES dependent VMs. This change can be done without any SNP detection code (I assume), it should work based on our ES detection code. This way this can be a backportable bugfix. So if SNP is accidentally enabled in BIOS while older nova runs on the host and ES VMs are on the host then the older nova can have the same safety measure.\n* during the SNP feature implementation if SNP is enabled and no ES VMs are on the host, nova-compute is free to remove the ES resource inventory and add SNP resource inventory in placement.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"136748bb62dae22bfca523ef130e2fbfa7fb49d7","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"d81f9beb_aebf87a4","line":116,"in_reply_to":"5a253b01_70b7bf2f","updated":"2026-06-02 10:43:36.000000000","message":"Sorry I does not fully get what is the case now. Which is the case?\n* A) both SEV-ES and SEV-SNP can be used in parallel even after the firmware update. If so then lets state that and have some wording about how we split the available ASIDs between SEV-ES and SEV-SNP guests.\n\n* B) SEV-ES and SEV-SNP cannot be used on the same machine at the same time. When SNP is enabled ES cannot be used any more (just the detection that causes both feature as reported). If this is the case then lets state that in the spec and then add wording to what nova will do if there are guests on the host using SEV-ES when that feature is not longer available (as discusses in this comment thread)","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"45618e0c3de3c1bf07e48e990b9407f7787b34ef","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"29cfd6fe_b981860d","line":116,"in_reply_to":"6970e4ca_a18bd571","updated":"2026-06-02 14:54:25.000000000","message":"Yes, so that means that ES is still supported on a upgraded compute even if the firmware is updated... until the operator modifies the BIOS option for asking to use SNP.\n\nThat said, we don\u0027t have any sev_snp CPU flag until the BIOS is modified, so we continue to support SEV-ES, right?\n\nOKAY, so I see a solution : when restarting a compute, we can look at /proc/cpuinfo to look at the snp flag. If we have existing instances using ES, we stop the compute. That way, operators would need to move the SEV-ES instances to other hosts before modifying the BIOS option but if they forget about it, they could also just reboot the host, modify the BIOS to no longer ask for SNP, restart the compute and then move the instances before modifying again the BIOS option.\n\nAm I right?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"e995decb599876b465e3445c99578624f062f4e3","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"5a253b01_70b7bf2f","line":116,"in_reply_to":"8e51df73_640722de","updated":"2026-06-01 15:24:33.000000000","message":"Sorry I think my previous explanation was wrong.\n\nFurther digging revealed that sev_es cpu flag DOES NOT disappear after firmware is upgraded and SEV-SNP is enabled, due to the way kernel detects these features currently, and the amd_sev_es and amd_sev_snp in kvm_amd kernel module parameters are both true in this case.\nSo the only way to detect disabled SEV-ES is to check the availability of SEV-SNP. ..","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3d63f1b2_99c0e8f1","line":116,"in_reply_to":"a096b35e_31ef116b","updated":"2026-05-28 16:37:30.000000000","message":"\u003e With a CPU firmware update AMD disabled SEV-ES support in the CPU. Is it so?\n\nNo. SEV-ES is still enabled after firmware update. If you update firmware and then enable SEV-SNP (or vise versa) SEV-ES is disabled.\n\nSo I think we can safely assume that the firmware update does not affect existing deployments (Users may not attempt to enable SEV-SNP there).\nWe can add a big warning in the documentation to tell users avoid enabling SEV-SNP, though.\n\n\u003e Is there a way to detect that the CPU firmware is deployed.\n\nsev_es cpu flag disappears when SEV-ES is disabled so the cpu flag can be used.\n\n\n\u003e Will libvirt report ES support in that case?\n\nYes, because current libvirt does not check actual cpu flag. (it does not check sev_es flag in kvm module, either)","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f2378cd1262e766ebfcdd9bca4aa6187ca6353a9","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"6970e4ca_a18bd571","line":116,"in_reply_to":"d81f9beb_aebf87a4","updated":"2026-06-02 13:49:25.000000000","message":"B is correct.\n\nAfter firmware update, SEV-ES and SEV-SNP can\u0027t be enabled at the same time in the single machine. However cpu flag is unchanged during firmware update, and even firmware upgrade cpu flag (in /proc/cpuinfo) and kvm_amd module (in /sys/module/kvm_amd/parameters/sev_es ) still reports that SEV-ES is still available (which is wrong actually), and just checking these flags doesn\u0027t allow us to accurately ditermine the availability of SEV-ES.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":true,"context_lines":[{"line_number":113,"context_line":"     this feature is out of our current scope."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  The libvirt driver checks existing instances in that host during"},{"line_number":116,"context_line":"  ``init_host``, and fails if any of them requires SEV-ES ."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- Extend handling of the ``hw:mem_encryption_model`` parameter in flavor"},{"line_number":119,"context_line":"  extra specs, and the ``hw_mem_encryption_model`` image property, to support"}],"source_content_type":"text/x-rst","patch_set":18,"id":"a096b35e_31ef116b","line":116,"in_reply_to":"e8f85e81_27fe426e","updated":"2026-05-28 14:46:37.000000000","message":"Yes, I guess we should stop nova-compute automatically if we find instances using SEV-ES XML.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":131,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":134,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":135,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"}],"source_content_type":"text/x-rst","patch_set":18,"id":"fceb83b2_bdc83f2e","line":134,"updated":"2026-05-27 11:17:15.000000000","message":"based on https://libvirt.org/formatdomain.html#launch-security we need something like\n```\n  \u003claunchSecurity type\u003d\u0027sev-snp\u0027 authorKey\u003d\u0027yes\u0027 vcek\u003d\u0027no\u0027\u003e\n```\nbut I don\u0027t know what we should set to authorKey or vcek.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":131,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":134,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":135,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"}],"source_content_type":"text/x-rst","patch_set":18,"id":"5946a9bd_63d91f06","line":134,"in_reply_to":"52ce12db_31c86ce0","updated":"2026-05-28 16:37:30.000000000","message":"Omitting the vcek key is treated as vcek\u003d\u0027yes\u0027, and enables usage of vcek. vcek is commonly used because it uses the keys generated and baked into the CPU by AMD. vlek (which is used when vcek\u003d\u0027no\u0027) relies on special keys provided only for specific cloud providers.\n\nauthorKey is used only when idAuth is used, but idAuth is currently out of the scope so can be ignored.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"522f982185883856e3eb4ef08bf52029ea5d3fd4","unresolved":true,"context_lines":[{"line_number":131,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":134,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":135,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"}],"source_content_type":"text/x-rst","patch_set":18,"id":"5bc10042_ef31d9e9","line":134,"in_reply_to":"5946a9bd_63d91f06","updated":"2026-05-29 09:58:14.000000000","message":"OK. can we add some words about it to the spec just to avoid future confusion between the example in the libvirt doc an in nova usage?\n\ndo we need to set authorKey to no explicity?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"e995decb599876b465e3445c99578624f062f4e3","unresolved":true,"context_lines":[{"line_number":131,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":134,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":135,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"}],"source_content_type":"text/x-rst","patch_set":18,"id":"d50fe50c_27ceb83c","line":134,"in_reply_to":"5bc10042_ef31d9e9","updated":"2026-06-01 15:24:33.000000000","message":"Will do.\n\nauthoKey is mapped to the author-key-enabled option in qemu. Libvirt does not set this option when it\u0027s not explicitly set in xml, so and the option in qemu defaults to False, so we don\u0027t have to set it to no explicitly.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac545979e5765560928018afeca12fd9b97acd54","unresolved":false,"context_lines":[{"line_number":131,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":134,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":135,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"}],"source_content_type":"text/x-rst","patch_set":18,"id":"c2c785f1_767111f2","line":134,"in_reply_to":"d50fe50c_27ceb83c","updated":"2026-06-01 15:56:02.000000000","message":"I\u0027ve decided to explicitly set these options and updated the section to cover these two. Let me know if anything is still unclear.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"4229bc4baf024917335876c1b5cb811bb9f7d975","unresolved":true,"context_lines":[{"line_number":131,"context_line":"  is set to ``amd-sev-snp``::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    \u003claunchSecurity type\u003d\u0027sev-snp\u0027 kernelHashes\u003d\u0027no\u0027\u003e"},{"line_number":134,"context_line":"      \u003cpolicy\u003e0x00030000\u003c/policy\u003e"},{"line_number":135,"context_line":"    \u003c/launchSecurity\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  See `the libvirt guide \u003chttps://libvirt.org/formatdomain.html#launch-security\u003e`_"}],"source_content_type":"text/x-rst","patch_set":18,"id":"52ce12db_31c86ce0","line":134,"in_reply_to":"fceb83b2_bdc83f2e","updated":"2026-05-28 14:46:37.000000000","message":"agreed","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":138,"context_line":"  to find further details about the ``launchSecurity`` element."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":141,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":144,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"}],"source_content_type":"text/x-rst","patch_set":18,"id":"e0e09637_b9a6b6f4","line":141,"updated":"2026-05-27 11:17:15.000000000","message":"as far as I see there is a different policy table for sev-snp in the libvirt doc. Is this 30000 correct for snp as well?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"522f982185883856e3eb4ef08bf52029ea5d3fd4","unresolved":false,"context_lines":[{"line_number":138,"context_line":"  to find further details about the ``launchSecurity`` element."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":141,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":144,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"}],"source_content_type":"text/x-rst","patch_set":18,"id":"dde0ea60_c2b92827","line":141,"in_reply_to":"b871f274_b6d916c5","updated":"2026-05-29 09:58:14.000000000","message":"Acknowledged","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":138,"context_line":"  to find further details about the ``launchSecurity`` element."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  - The ``policy`` attribute is hard-coded to the most standard value at this"},{"line_number":141,"context_line":"    moment following the existing AMD SEV/SEV-ES support."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":144,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"}],"source_content_type":"text/x-rst","patch_set":18,"id":"b871f274_b6d916c5","line":141,"in_reply_to":"e0e09637_b9a6b6f4","updated":"2026-05-28 16:37:30.000000000","message":"\u003e as far as I see there is a different policy table for sev-snp in the libvirt doc.\n \nYes. SEV and SEV-ES uses the same field definition while SEV-SNP uses its own, different one.\n\n\n\u003e Is this 30000 correct for snp as well?\n\n`0x00030000` is the most standard value which works in most of the cases.\n\nTechnically the policy describes the requirement from guest\u0027s perspective, so we might be able to implement a mechanism to let users request explcit policy in the future.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":false,"context_lines":[{"line_number":143,"context_line":"  - The ``kernelHashes`` attribute is set to ``yes`` when the instance uses"},{"line_number":144,"context_line":"    Direct Kernel Boot, to allow guest owners to measure bootchain components"},{"line_number":145,"context_line":"    (OVMF, initramfs, kernel and kernel args). Usage of Direct Kernel Boot is"},{"line_number":146,"context_line":"    detected according to the ``kernel_id`` property of the image."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"  - The ``cbitpos`` attribute and the ``reducedPhysBits`` attribute are not"},{"line_number":149,"context_line":"    explicitly defined because these are optional since"}],"source_content_type":"text/x-rst","patch_set":18,"id":"150a1c11_75ebee6f","line":146,"updated":"2026-05-27 11:17:15.000000000","message":"OK","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":false,"context_lines":[{"line_number":150,"context_line":"    `libvirt v6.9.0 \u003cgitlab.com/libvirt/libvirt/commit/2508d10f67c\u003e`_  ."},{"line_number":151,"context_line":"    These may be removed from the existing SEV/SEV-ES implementation."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"  .. note::"},{"line_number":154,"context_line":"     SEV-SNP supports a few more fields such as idBlock, idAuth and hostData."},{"line_number":155,"context_line":"     These are expected to be provided by guest owner, thus should be defined"},{"line_number":156,"context_line":"     per-instance. However due to lack of per-instance properties in nova,"},{"line_number":157,"context_line":"     these options are out of the current scope."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  .. note::"},{"line_number":160,"context_line":"     The locked attribute doesn\u0027t have to be set for SEV-SNP."}],"source_content_type":"text/x-rst","patch_set":18,"id":"b2a76e97_fbd92f25","line":157,"range":{"start_line":153,"start_character":0,"end_line":157,"end_character":48},"updated":"2026-05-27 11:17:15.000000000","message":"OK","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":194,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":195,"context_line":"in flavor extra specs and image properties."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":198,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":199,"context_line":"are applied when SEV-SNP is used. For example live migration and suspend are"},{"line_number":200,"context_line":"both unsupported for SEV-SNP encrypted instances."}],"source_content_type":"text/x-rst","patch_set":18,"id":"fcc38729_5644755a","line":197,"updated":"2026-05-27 11:17:15.000000000","message":"but if locked memory is not needed (L159) then some of the memory limitations can be removed?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"136748bb62dae22bfca523ef130e2fbfa7fb49d7","unresolved":false,"context_lines":[{"line_number":194,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":195,"context_line":"in flavor extra specs and image properties."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":198,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":199,"context_line":"are applied when SEV-SNP is used. For example live migration and suspend are"},{"line_number":200,"context_line":"both unsupported for SEV-SNP encrypted instances."}],"source_content_type":"text/x-rst","patch_set":18,"id":"ceadedaa_6e038119","line":197,"in_reply_to":"427011d9_590d6670","updated":"2026-06-02 10:43:36.000000000","message":"Acknowledged","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c1f783102ca4fd5c61b60354927e43a9c74eb4cf","unresolved":true,"context_lines":[{"line_number":194,"context_line":"The end user will harness SEV-SNP through the existing mechanisms of resources"},{"line_number":195,"context_line":"in flavor extra specs and image properties."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Also `the limitations of AMD SEV-encrypted guest"},{"line_number":198,"context_line":"\u003chttps://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations\u003e`_"},{"line_number":199,"context_line":"are applied when SEV-SNP is used. For example live migration and suspend are"},{"line_number":200,"context_line":"both unsupported for SEV-SNP encrypted instances."}],"source_content_type":"text/x-rst","patch_set":18,"id":"427011d9_590d6670","line":197,"in_reply_to":"fcc38729_5644755a","updated":"2026-06-01 13:10:23.000000000","message":"No. These are still applied to SEV-SNP. SEV-SNP uses private memfd, which prevents guest memory access by host, so behaves similarly to SEV-ES guest with memory locked.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6aff4d1b32ab8b951829b8ca79a3574e12b282c0","unresolved":true,"context_lines":[{"line_number":218,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"- Set minimum ASID for SEV (non-ES) guests in BIOS (or UEFI) to a value greater"},{"line_number":221,"context_line":"  than 0."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"- Ensure that they have an appropriately configured software stack, so"},{"line_number":224,"context_line":"  that the various layers are all SEV-SNP ready:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"48492153_6d13d576","line":221,"updated":"2026-05-27 11:17:15.000000000","message":"really? Do they need to allocate some ASID to pure SEV?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"522f982185883856e3eb4ef08bf52029ea5d3fd4","unresolved":true,"context_lines":[{"line_number":218,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"- Set minimum ASID for SEV (non-ES) guests in BIOS (or UEFI) to a value greater"},{"line_number":221,"context_line":"  than 0."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"- Ensure that they have an appropriately configured software stack, so"},{"line_number":224,"context_line":"  that the various layers are all SEV-SNP ready:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"84bba20e_61ce9767","line":221,"in_reply_to":"0a06d6dd_3385fc1c","updated":"2026-05-29 09:58:14.000000000","message":"ahh, so what we set in bios is the minimum *index* of the ASID for SEV not the minimum number of ASID for SEV. And anyhthing below that minimum index for SEV is for SEV-ES and SEV-SNP Can we clarify this in the spec?","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ae3ea3430c6de04983f2139de6ab8851906fad3c","unresolved":true,"context_lines":[{"line_number":218,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"- Set minimum ASID for SEV (non-ES) guests in BIOS (or UEFI) to a value greater"},{"line_number":221,"context_line":"  than 0."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"- Ensure that they have an appropriately configured software stack, so"},{"line_number":224,"context_line":"  that the various layers are all SEV-SNP ready:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"0a06d6dd_3385fc1c","line":221,"in_reply_to":"48492153_6d13d576","updated":"2026-05-28 16:37:30.000000000","message":"Yes and no.\n\n\"Using SEV with AMD EPYC™ Processors\"  in https://www.amd.com/ja/developer/sev.html describes how that configuration works.\n\n\u003d\u003d\u003d\n\n*What is MinSEVASID?*\n\nMinSEVAsid is the minimum ASID that lets you run SEV guests, everything below that is for SEV-ES and SEV-SNP guests. For example, if MinSEVAsid is set to 8, then ASIDs 1-7 can only be assigned to SEV-ES or SEV-SNP guests, and ASIDs 8-(max) can only be used for SEV guests.\n\n\u003d\u003d\u003d\n\nIf a server has 256 ASIDs and only SEV-SNP should be used then MinSEVAsid needs to be set to 257.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac545979e5765560928018afeca12fd9b97acd54","unresolved":false,"context_lines":[{"line_number":218,"context_line":"  - AMD EPYC 7003 (Milan) or later"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"- Set minimum ASID for SEV (non-ES) guests in BIOS (or UEFI) to a value greater"},{"line_number":221,"context_line":"  than 0."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"- Ensure that they have an appropriately configured software stack, so"},{"line_number":224,"context_line":"  that the various layers are all SEV-SNP ready:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"df0d9f39_f595a059","line":221,"in_reply_to":"84bba20e_61ce9767","updated":"2026-06-01 15:56:02.000000000","message":"I\u0027ve added the explanation about this.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"8144be4cc2d8c2368cb1e714aaeaf8a88215642e","unresolved":true,"context_lines":[{"line_number":348,"context_line":"- the use of a trait to include extra SEV-specific libvirt domain XML"},{"line_number":349,"context_line":"  configuration, e.g. within"},{"line_number":350,"context_line":"  ``nova.tests.unit.virt.libvirt.test_config``"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"Documentation Impact"},{"line_number":354,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"fc0e4833_b6f07fbb","line":351,"updated":"2026-06-01 14:32:20.000000000","message":"I assume you are testing the feature locally with real HW maybe with devstack. I\u0027m wondering if such testing can be automated via https://github.com/openstack/whitebox-tempest-plugin and therefore shared, so that others can run the same test locally with capable hardware too. \n\nObviously these test will not run in our first party CI due to HW limitations. But would help our local verification effort.\n\nHow do you feel about this? (Feel free to say no, I won\u0027t block on this)","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"136748bb62dae22bfca523ef130e2fbfa7fb49d7","unresolved":true,"context_lines":[{"line_number":348,"context_line":"- the use of a trait to include extra SEV-specific libvirt domain XML"},{"line_number":349,"context_line":"  configuration, e.g. within"},{"line_number":350,"context_line":"  ``nova.tests.unit.virt.libvirt.test_config``"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"Documentation Impact"},{"line_number":354,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"342cd842_4332c950","line":351,"in_reply_to":"e03a8f24_08c9efaa","updated":"2026-06-02 10:43:36.000000000","message":"OK let\u0027s see if @hnarukaw@lycorp.co.jp have bandwidth for it or not.","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac545979e5765560928018afeca12fd9b97acd54","unresolved":true,"context_lines":[{"line_number":348,"context_line":"- the use of a trait to include extra SEV-specific libvirt domain XML"},{"line_number":349,"context_line":"  configuration, e.g. within"},{"line_number":350,"context_line":"  ``nova.tests.unit.virt.libvirt.test_config``"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"Documentation Impact"},{"line_number":354,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"e03a8f24_08c9efaa","line":351,"in_reply_to":"fc0e4833_b6f07fbb","updated":"2026-06-01 15:56:02.000000000","message":"It\u0027s technically possible but I myself can\u0027t be committed to it atm due to own bw. It might depend on @hnarukaw@lycorp.co.jp .","commit_id":"bac24ddba3623a62e9dac82c449bb5ae35ae75dc"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1b10bd911ec4fdd2311a7b752e93f82031808038","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  is present. Also its ``init_host`` should fail if the flag is detected and"},{"line_number":60,"context_line":"  there are any existing instances with SEV-ES encryption in its host, with"},{"line_number":61,"context_line":"  the explicit error message to request operators to disable SEV-SNP or migrate"},{"line_number":62,"context_line":"  all these instances to different nodes."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"  .. note::"},{"line_number":65,"context_line":"     The change described above is required because the recent firmware update"}],"source_content_type":"text/x-rst","patch_set":20,"id":"ba9778ef_46cf2f03","line":62,"updated":"2026-06-03 12:41:00.000000000","message":"could we make this init_host check in a separate, backportable commit? (probably an implementation detail)","commit_id":"fb21531eff39f562e54f00679222b93532880d76"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  is present. Also its ``init_host`` should fail if the flag is detected and"},{"line_number":60,"context_line":"  there are any existing instances with SEV-ES encryption in its host, with"},{"line_number":61,"context_line":"  the explicit error message to request operators to disable SEV-SNP or migrate"},{"line_number":62,"context_line":"  all these instances to different nodes."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"  .. note::"},{"line_number":65,"context_line":"     The change described above is required because the recent firmware update"}],"source_content_type":"text/x-rst","patch_set":20,"id":"d3182f59_412d7b00","line":62,"in_reply_to":"08eb306c_80067192","updated":"2026-06-04 10:08:53.000000000","message":"agreed with @gibizer@gmail.com, let\u0027s keep this comment unresolved but let\u0027s look at that on the implementation series then.","commit_id":"fb21531eff39f562e54f00679222b93532880d76"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"9926cb8536d4dcbafe0546cfbbada3fdac0102dc","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  is present. Also its ``init_host`` should fail if the flag is detected and"},{"line_number":60,"context_line":"  there are any existing instances with SEV-ES encryption in its host, with"},{"line_number":61,"context_line":"  the explicit error message to request operators to disable SEV-SNP or migrate"},{"line_number":62,"context_line":"  all these instances to different nodes."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"  .. note::"},{"line_number":65,"context_line":"     The change described above is required because the recent firmware update"}],"source_content_type":"text/x-rst","patch_set":20,"id":"08eb306c_80067192","line":62,"in_reply_to":"ba9778ef_46cf2f03","updated":"2026-06-03 13:51:27.000000000","message":"I think it\u0027s possible, and we can discuss it once how portable the change is.\nIn the worst case existing users may not be affected, because SEV-SNP is an opt-in feature atm and they can easily disable it (because SEV-SNP is not supported by older releases of nova).","commit_id":"fb21531eff39f562e54f00679222b93532880d76"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"0b712e41e32452cd14253acfd9dacd7b233ad57a","unresolved":true,"context_lines":[{"line_number":59,"context_line":"  is present. Also its ``init_host`` should fail if the flag is detected and"},{"line_number":60,"context_line":"  there are any existing instances with SEV-ES encryption in its host, with"},{"line_number":61,"context_line":"  the explicit error message to request operators to disable SEV-SNP or migrate"},{"line_number":62,"context_line":"  all these instances to different nodes."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"  .. note::"},{"line_number":65,"context_line":"     The change described above is required because the recent firmware update"}],"source_content_type":"text/x-rst","patch_set":20,"id":"e5cd6dee_0538d330","line":62,"in_reply_to":"d3182f59_412d7b00","updated":"2026-07-06 19:06:32.000000000","message":"we have rejected spec for parsing /sys and proc before and requried contributors to fix or extend libvirt in the past so im very suppries this was not a automatic -1 if not -2\n\nanyway we can continue the dicussion on the implemaiton patch but i agree this shoudl not be done in the comptue manager, if we have this check it shoudl adn can be done in the libvirt driver.\n\ni would be reluctant to backport this by the way.\ni don\u0027t think tis nova job to validate firmware or kernel configuration.\n\ni get the desire to fail fact but /proc and /sys are not generally condier stable interfaces and we have been burt by this in the past. including for the sev feature\n\nhttps://github.com/openstack/nova/commit/ab51a5dd25b8d4c66562148b43b1022eb5ceed7e\n\nbut also for mellanox\u0027s hardware offload capabilities and to a lesser degree with mdev parsing.\n\nwe have allowed limited use of sysfs in the past but its effectily alwasy tech debt","commit_id":"fb21531eff39f562e54f00679222b93532880d76"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"0b712e41e32452cd14253acfd9dacd7b233ad57a","unresolved":true,"context_lines":[{"line_number":89,"context_line":"    Also the ``maxESGuests`` field should be present and its value should be"},{"line_number":90,"context_line":"    a positive (non-zero) value."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev_snp`` should have the value ``Y``"},{"line_number":93,"context_line":"    to indicate that SEV-SNP support is enabled in BIOS (or UEFI) and also"},{"line_number":94,"context_line":"    the SEV-SNP support of the kvm kernel module is enabled. This sysfs path"},{"line_number":95,"context_line":"    should be readable by any user (i.e. even non-root)."}],"source_content_type":"text/x-rst","patch_set":21,"id":"7eab6632_9c2a4831","line":92,"range":{"start_line":92,"start_character":4,"end_line":92,"end_character":46},"updated":"2026-07-06 19:06:32.000000000","message":"this i disagre with\n\nwe shoudl be checking the lauchsecurte enum and only that.","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f0d760f5a71fa28c5c69122673671fa8bf64dec0","unresolved":true,"context_lines":[{"line_number":89,"context_line":"    Also the ``maxESGuests`` field should be present and its value should be"},{"line_number":90,"context_line":"    a positive (non-zero) value."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  - ``/sys/module/kvm_amd/parameters/sev_snp`` should have the value ``Y``"},{"line_number":93,"context_line":"    to indicate that SEV-SNP support is enabled in BIOS (or UEFI) and also"},{"line_number":94,"context_line":"    the SEV-SNP support of the kvm kernel module is enabled. This sysfs path"},{"line_number":95,"context_line":"    should be readable by any user (i.e. even non-root)."}],"source_content_type":"text/x-rst","patch_set":21,"id":"38f7a162_69b0928d","line":92,"range":{"start_line":92,"start_character":4,"end_line":92,"end_character":46},"in_reply_to":"7eab6632_9c2a4831","updated":"2026-07-07 08:30:44.000000000","message":"Unfortunately current libvirt does not check this and reports that snp is available even when it\u0027s disabled in kernel/firmware. Although we can fix it technically nova already checks similar sysfs paths for SEV/SEV-ES already so this is not a very new mechanism added specifically for SEV-SNP.","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[{"line_number":121,"context_line":"  The ``maxESGuests`` attribute exposed by libvirt will be used to determine"},{"line_number":122,"context_line":"  the amount of the ``MEM_ENCRYPTION_CONTEXT`` resource in the SEV-SNP resource"},{"line_number":123,"context_line":"  provider. This value reflects the CPUID field which represents the number of"},{"line_number":124,"context_line":"  ASIDs available for SEV-ES or SEV-SNP."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  .. note::"},{"line_number":127,"context_line":"     SEV-SNP uses a separate ASID pool when ciphertext hiding (which is"}],"source_content_type":"text/x-rst","patch_set":21,"id":"143cb0fd_720e83d0","line":124,"updated":"2026-06-04 10:08:53.000000000","message":"++","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"1dbea69bf0b43523fcb5942754b26a154b94d3b5","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  \u003chttps://opendev.org/openstack/whitebox-tempest-plugin/src/branch/master\u003e`_"},{"line_number":381,"context_line":"  to launch instances with SEV-SNP encryption. Although this can\u0027t be run in"},{"line_number":382,"context_line":"  CI due to lack of the required hardware, but helps other developers to"},{"line_number":383,"context_line":"  verify the feature."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"Documentation Impact"},{"line_number":386,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":21,"id":"4c6524d5_c3662557","line":383,"updated":"2026-06-04 10:08:53.000000000","message":"++","commit_id":"23d1fcc001b46bf820861bdf25f67d54294829ed"}]}