)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"b701bd05bb20f7b239dd21f69a386b154b3392d8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"06958077_1ef6748d","updated":"2026-08-11 14:30:07.000000000","message":"So this does not change the behavior outside of TDX as the two fields are set together by default and then the TDX codepath overrides the load parts while keeps the secure boot part intact https://review.opendev.org/c/openstack/nova/+/999249/2/nova/virt/libvirt/driver.py#7976","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"7c48ed8f25f7e5c2b5dc093cbff60824270a75bc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1a8949ce_1a9f9a3a","updated":"2026-08-13 07:39:28.000000000","message":"I tested this on ubuntu26 with a custom version of intel tdx firmware without secure boot. `os_secure_boot\u003d\u0027disabled\u0027` correctly selects the nosb version.\n\nhttps://paste.openstack.org/show/bdbleKLLworBpma70kXB/","commit_id":"6ad785f9667b9b939086de64831a4918bb1ebd3d"}],"nova/virt/libvirt/driver.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f690e2e2bdbab5c4c515d3cfa9420b610ba93fd1","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"86313761_c5c86f5b","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"updated":"2026-08-11 18:57:45.000000000","message":"The current minimum libvirt version supported by nova is 8.0.0 . According to [1] we still need to set loader_secure in case libvirt is olader than 8.6.0 so this can\u0027t be done in this straitfoward way. We can set this based on the libvirt version available though we also have to consider the case where an instance is migrated from libvirt\u003e\u003d8.6.0 to libvirt\u003c8.6.0 .\n\nMaybe we use this flag only when TDX is used ? That might simplify the situation because we can safely assume that libvirt is new enough (because TDX requires libvirt \u003e\u003d11.6.0)\n\nhttps://libvirt.org/kbase/secureboot.html#older-libvirt-versions","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"1890a5c7774bf0b36fb57fdadc789dc2385a5059","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"e95d65c6_8f88ff16","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"in_reply_to":"283db00d_90a700ae","updated":"2026-08-12 08:20:54.000000000","message":"\u003e loader_secure is still set like before, see line 7380, the behavior shouldn\u0027t have changed with this patch, unless I am missing something.\n\nOh yes. I read it wrongly.\n\n\u003e but in hindsight it is probably better to leave it as before and have os_firmware_secure be set based on os_loader_secure.\n\nI think this is a better approach now to limit the scope. We expect we bump the mininum libvirt version in one or two cycles (once ubuntu 24.04 is dropped from supported platforms) and then we can re-consider the default behavior at that point.","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"bbeaeb2cd3fcc32d668403ec64fa37b83b0243ef","unresolved":true,"context_lines":[{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_firmware_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"},{"line_number":7368,"context_line":"                    guest.os_firmware_secure \u003d self._check_secure_boot_support("}],"source_content_type":"text/x-python","patch_set":1,"id":"283db00d_90a700ae","line":7365,"range":{"start_line":7365,"start_character":26,"end_line":7365,"end_character":44},"in_reply_to":"86313761_c5c86f5b","updated":"2026-08-12 08:15:54.000000000","message":"loader_secure is still set like before, see line `7380`, the behavior shouldn\u0027t have changed with this patch, unless I am missing something. TDX (or others) can then unset it elsewhere, which was already done with the previous patches for TDX.\n\nI\u0027ll add some additional context with the versions so that it is clear that it is still needed, and why it isn\u0027t needed for TDX for instance.\n\nI opted to have os_firmware_secure be set first since it will likely be the one used in the future (after 8.6.0 becomes minimum), but in hindsight it is probably better to leave it as before and have os_firmware_secure be set based on os_loader_secure.","commit_id":"3673bc2bdeeca323e18685dc046cdbcea8c860a6"}]}