)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"b701bd05bb20f7b239dd21f69a386b154b3392d8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"06958077_1ef6748d","updated":"2026-08-11 14:30:07.000000000","message":"So this does not change the behavior outside of TDX as the two fields are set together by default and then the TDX codepath overrides the load parts while keeps the secure boot part intact https://review.opendev.org/c/openstack/nova/+/999249/2/nova/virt/libvirt/driver.py#7976","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"7c48ed8f25f7e5c2b5dc093cbff60824270a75bc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1a8949ce_1a9f9a3a","updated":"2026-08-13 07:39:28.000000000","message":"I tested this on ubuntu26 with a custom version of intel tdx firmware without secure boot. `os_secure_boot\u003d\u0027disabled\u0027` correctly selects the nosb version.\n\nhttps://paste.openstack.org/show/bdbleKLLworBpma70kXB/","commit_id":"6ad785f9667b9b939086de64831a4918bb1ebd3d"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"5e24f7f4194c4164e13ad549e6e36f2b4308d813","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"8818f6bc_720c302a","updated":"2026-08-21 15:00:19.000000000","message":"This has now been moved to come before https://review.opendev.org/c/openstack/nova/+/999249","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"cca764fcaeb1021b0221495def4fdf5069a4b906","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"2fd778f8_b5df208a","updated":"2026-08-22 02:56:00.000000000","message":"lgtm","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"a6a2132fdda513d8610089a02fd229df55cff9e2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"17357bad_21c5489b","updated":"2026-08-25 08:14:55.000000000","message":"recheck requeu","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"fb413f93db4056a9ad3fe81e73fc0d4d5aabd148","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"3292dec4_43aec0d5","updated":"2026-08-26 08:19:30.000000000","message":"recheck requeue","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"9d6e7dd608b7beabc75bce91c51b592f4d7f5d54","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"a0af0ca6_f7be4526","updated":"2026-08-22 09:24:55.000000000","message":"recheck tox cover instability\n```\nnova.tests.functional.api.client.OpenStackApiException: Unexpected status code: {\"conflictingRequest\": {\"code\": 409, \"message\": \"Service is unavailable at this time.\"}}\n```","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"cca764fcaeb1021b0221495def4fdf5069a4b906","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"d579e9e7_8352e667","in_reply_to":"8818f6bc_720c302a","updated":"2026-08-22 02:56:00.000000000","message":"yeah. reviewed that change before this one which created confusion. both doing in same change could be better but all good for now. I am fine now. i asked about testing results of secure boot overall but in the next change where we discussed about these flags.","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"}],"nova/virt/libvirt/driver.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f690e2e2bdbab5c4c515d3cfa9420b610ba93fd1","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"86313761_c5c86f5b","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"updated":"2026-08-11 18:57:45.000000000","message":"The current minimum libvirt version supported by nova is 8.0.0 . According to [1] we still need to set loader_secure in case libvirt is olader than 8.6.0 so this can\u0027t be done in this straitfoward way. We can set this based on the libvirt version available though we also have to consider the case where an instance is migrated from libvirt\u003e\u003d8.6.0 to libvirt\u003c8.6.0 .\n\nMaybe we use this flag only when TDX is used ? That might simplify the situation because we can safely assume that libvirt is new enough (because TDX requires libvirt \u003e\u003d11.6.0)\n\nhttps://libvirt.org/kbase/secureboot.html#older-libvirt-versions","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"1890a5c7774bf0b36fb57fdadc789dc2385a5059","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"e95d65c6_8f88ff16","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"in_reply_to":"283db00d_90a700ae","updated":"2026-08-12 08:20:54.000000000","message":"\u003e loader_secure is still set like before, see line 7380, the behavior shouldn\u0027t have changed with this patch, unless I am missing something.\n\nOh yes. I read it wrongly.\n\n\u003e but in hindsight it is probably better to leave it as before and have os_firmware_secure be set based on os_loader_secure.\n\nI think this is a better approach now to limit the scope. We expect we bump the mininum libvirt version in one or two cycles (once ubuntu 24.04 is dropped from supported platforms) and then we can re-consider the default behavior at that point.","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"bbeaeb2cd3fcc32d668403ec64fa37b83b0243ef","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"283db00d_90a700ae","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"in_reply_to":"86313761_c5c86f5b","updated":"2026-08-12 08:15:54.000000000","message":"loader_secure is still set like before, see line `7380`, the behavior shouldn\u0027t have changed with this patch, unless I am missing something. TDX (or others) can then unset it elsewhere, which was already done with the previous patches for TDX.\n\nI\u0027ll add some additional context with the versions so that it is clear that it is still needed, and why it isn\u0027t needed for TDX for instance.\n\nI opted to have os_firmware_secure be set first since it will likely be the one used in the future (after 8.6.0 becomes minimum), but in hindsight it is probably better to leave it as before and have os_firmware_secure be set based on os_loader_secure.","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8b8803f6db6eb1042634e559fa552f410b0a1aaf","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"585f508a_c9867ef5","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"in_reply_to":"e95d65c6_8f88ff16","updated":"2026-08-18 23:05:24.000000000","message":"actully we are overdu bumpoing it now\n\nthe NEXT version listed are the min verison shipt by 24.04\n\nNEXT_MIN_LIBVIRT_VERSION \u003d (10, 0, 0)\nNEXT_MIN_QEMU_VERSION \u003d (8, 2, 2)\n\nso we shoudl have already raised that in 2026.1 we just didnt get aroudn to it\n\nso we proably shoudl raise them this cycle. \nit just a matter of time, no one has had time to do it.\n\nit would be good ot od that early in 2027.1","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"cca764fcaeb1021b0221495def4fdf5069a4b906","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                # doesn\u0027t support SMM (e.g. TDX) clears os_loader_secure later"},{"line_number":7363,"context_line":"                # but keeps os_firmware_secure to preserve the secure boot"},{"line_number":7364,"context_line":"                # intent. loader.secure is still required on libvirt \u003c 8.6.0"},{"line_number":7365,"context_line":"                guest.os_firmware_secure \u003d guest.os_loader_secure"},{"line_number":7366,"context_line":""},{"line_number":7367,"context_line":"                guest.os_firmware \u003d \u0027efi\u0027"},{"line_number":7368,"context_line":"                if hw_firmware_stateless:"}],"source_content_type":"text/x-python","patch_set":5,"id":"85d0650e_c4f9eb3e","line":7365,"range":{"start_line":7365,"start_character":49,"end_line":7365,"end_character":65},"updated":"2026-08-22 02:56:00.000000000","message":"As these are two separate flag for separate purpose, I would like to set it explcitly in each if else block above instead of mirroring it from os_loader_secure. But not any logical change so this can be done later.","commit_id":"ab3ebbb7c253e957d1abd2ac098de6d366fac0b8"}]}