)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"87f0008c86b6ab911ba3fa122ea7f3cb19b81c55","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"90cd70fd_06dbc6cf","updated":"2026-08-07 09:12:24.000000000","message":"I think we have an unhandled exception in the API as I got the following when trying to boot with TDX\n\n```\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi [None req-c7ee143d-432e-407b-b12a-dcc0ba4a2889 admin admin] Unexpected exception in API method: nova.exception.InvalidVideoMode: The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi Traceback (most recent call last):\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/openstack/wsgi.py\", line 766, in wrapped\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return f(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 262, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 262, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 262, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   [Previous line repeated 11 more times]\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 296, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     response \u003d func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/openstack/compute/servers.py\", line 819, in create\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     instances, resv_id \u003d self.compute_api.create(\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                          ^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/compute/api.py\", line 2288, in create\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return self._create_instance(\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/compute/api.py\", line 1757, in _create_instance\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     ) \u003d self._validate_and_build_base_options(\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/compute/api.py\", line 1165, in _validate_and_build_base_options\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     numa_topology \u003d hardware.numa_get_constraints(flavor, image_meta)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 2520, in numa_get_constraints\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     get_locked_memory_constraint(flavor, image_meta)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 1654, in get_locked_memory_constraint\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     me_config \u003d get_mem_encryption_constraint(flavor, image_meta, mach_type)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 1476, in get_mem_encryption_constraint\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     mem_enc_config.check_constraints(image_meta, machine_type, enc_requesters)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 266, in check_constraints\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     raise exception.InvalidVideoMode(emsg % self.model)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi nova.exception.InvalidVideoMode: The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi \nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: INFO nova.api.openstack.wsgi [None req-c7ee143d-432e-407b-b12a-dcc0ba4a2889 admin admin] HTTP exception thrown: Unexpected API Error. Please contact the administrator\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: \u003cclass \u0027nova.exception.InvalidVideoMode\u0027\u003e\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: DEBUG nova.api.openstack.wsgi [None req-c7ee143d-432e-407b-b12a-dcc0ba4a2889 admin admin] Returning 500 to user: Unexpected API Error. Please contact the administrator\n```\nIt should not be a HTTP 500 but either a 400 or a 409\n\nimage:\n```\n((.venv) ) [stack@beast01 nova]$ openstack image show ubuntu-26.04\n+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\n| Field            | Value                                                                                                                                                                                         |\n+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\n| checksum         | 5c3a0a5c0994e4b7c3c161a23ab1754f                                                                                                                                                              |\n| container_format | bare                                                                                                                                                                                          |\n| created_at       | 2026-08-07T09:07:02Z                                                                                                                                                                          |\n| disk_format      | qcow2                                                                                                                                                                                         |\n| file             | /v2/images/efb5881a-0e53-4361-8f27-88ffea8fbd47/file                                                                                                                                          |\n| id               | efb5881a-0e53-4361-8f27-88ffea8fbd47                                                                                                                                                          |\n| min_disk         | 0                                                                                                                                                                                             |\n| min_ram          | 0                                                                                                                                                                                             |\n| name             | ubuntu-26.04                                                                                                                                                                                  |\n| owner            | 111c785db9314bb18eebe68358b708cd                                                                                                                                                              |\n| properties       | hw_firmware_type\u003d\u0027uefi\u0027, os_hash_algo\u003d\u0027sha512\u0027,                                                                                                                                               |\n|                  | os_hash_value\u003d\u00274fff49ba723f58bf0c40aa486b1685f7b85de472bc8960a0deb994bac68e5543cf6072a4d08a0e329570ba27fd770780888612890e6bde68cbf8d3a7cf88fbdb\u0027, os_hidden\u003d\u0027False\u0027,                          |\n|                  | owner_specified.openstack.md5\u003d\u0027\u0027, owner_specified.openstack.object\u003d\u0027images/ubuntu-26.04\u0027, owner_specified.openstack.sha256\u003d\u0027\u0027                                                                 |\n| protected        | False                                                                                                                                                                                         |\n| schema           | /v2/schemas/image                                                                                                                                                                             |\n| size             | 862978048                                                                                                                                                                                     |\n| status           | active                                                                                                                                                                                        |\n| tags             |                                                                                                                                                                                               |\n| updated_at       | 2026-08-07T09:07:08Z                                                                                                                                                                          |\n| virtual_size     | 3758096384                                                                                                                                                                                    |\n| visibility       | shared                                                                                                                                                                                        |\n+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\n```\nflavor:\n```\n((.venv) ) [stack@beast01 nova]$ openstack flavor show m1.tdx\n+----------------------------+----------------------------------------------------------------------------------------+\n| Field                      | Value                                                                                  |\n+----------------------------+----------------------------------------------------------------------------------------+\n| OS-FLV-DISABLED:disabled   | False                                                                                  |\n| OS-FLV-EXT-DATA:ephemeral  | 0                                                                                      |\n| access_project_ids         | None                                                                                   |\n| description                | None                                                                                   |\n| disk                       | 0                                                                                      |\n| id                         | e976b2ad-c4fe-4f81-b55a-3bd70b621efd                                                   |\n| name                       | m1.tdx                                                                                 |\n| os-flavor-access:is_public | True                                                                                   |\n| properties                 | hw:mem_encryption\u003d\u0027true\u0027, hw:mem_encryption_model\u003d\u0027intel-tdx\u0027, hw_firmware_type\u003d\u0027uefi\u0027 |\n| ram                        | 4096                                                                                   |\n| rxtx_factor                | 1.0                                                                                    |\n| swap                       | 0                                                                                      |\n| vcpus                      | 4                                                                                      |\n+----------------------------+----------------------------------------------------------------------------------------+\n((.venv) ) [stack@beast01 nova]$ \n```","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"fee6103a51138338d0a4a18c569ad9283b3393a0","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"238bf8ca_31064a7b","updated":"2026-07-30 09:29:10.000000000","message":"I\u0027ve tested this in a devstack setup on Ubuntu 26.04. It correctly boots and a valid quote can be extracted from within the guest.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"712dfacbdf93d6de669f8df599c0b955a2f5fcc5","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"d0105edd_235c7240","in_reply_to":"64b4d009_d80ee559","updated":"2026-08-07 09:34:04.000000000","message":"If I understand things correctly I should add the Exception (InvalidVideoMode) to\nline 53 in /nova/api/openstack/compute/servers.py \n``INVALID_FLAVOR_IMAGE_EXCEPTIONS`` to prevent this","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"00f98326a6b3f44b04039383061a89c7c4384ba3","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"64b4d009_d80ee559","in_reply_to":"90cd70fd_06dbc6cf","updated":"2026-08-07 09:22:47.000000000","message":"Yes that should be a HTTP 400\n\n\u003e nova.exception.InvalidVideoMode: The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi \n\nI re-used InvalidVideoMode which is a HTTP 400 error, but it looks like it isn\u0027t being handled correctly.\n\nThis check was added as part of https://review.opendev.org/c/openstack/nova/+/998608/3","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"9537c2f20ded6a807b0252a9c2d48be0291ac075","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"de6021a5_83c0485f","in_reply_to":"d0105edd_235c7240","updated":"2026-08-07 11:01:00.000000000","message":"Now fixed","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5544a809_6ed377f0","in_reply_to":"de6021a5_83c0485f","updated":"2026-08-07 13:11:53.000000000","message":"yepp. I can confirm it is fixed now.\n```\n((.venv) ) [stack@beast01 nova]$ openstack server create --image ubuntu-26.04 --flavor m1.tdx --nic net-id\u003dprivate vm1 --wait\nBadRequestException: 400: Client Error for url: http://10.37.137.8/compute/v2.1/servers, The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\n```","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"28518b9f_1068abc3","updated":"2026-08-07 13:11:53.000000000","message":"I\u0027m OK with what I see and understand but there is a relevant comment thread with Takashi where I need help deciding","commit_id":"60586a4872b8b3877fdeeb9baaac860ee6e80eb4"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"53462f1af2e375dfa408f7cc429f7eaa7706136f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c5fb91f6_f44b9f83","updated":"2026-08-14 08:33:47.000000000","message":"As @kajinamit@oss.nttdata.com agrees I\u0027m upgrading my +1 to +2","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6550ef57e03a064275b05c3178abffeeed099c64","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"b72b603a_c39eb006","updated":"2026-08-13 13:08:53.000000000","message":"I\u0027m OK with this. @kajinamit@oss.nttdata.com is there anything open on your side?","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"}],"nova/virt/libvirt/config.py":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1f1e04a179f0e087cbd39af0bc0a2e17672d6cbc","unresolved":true,"context_lines":[{"line_number":3114,"context_line":"    TDX_POLICY_SEPT_VE_DISABLE \u003d 0x1 \u003c\u003c 28"},{"line_number":3115,"context_line":""},{"line_number":3116,"context_line":"    # This is the same default as qemu exposes: bit 0 (the Debug bit) is"},{"line_number":3117,"context_line":"    # left unset, which disables debugging."},{"line_number":3118,"context_line":"    DEFAULT_TDX_POLICY \u003d TDX_POLICY_SEPT_VE_DISABLE"},{"line_number":3119,"context_line":""},{"line_number":3120,"context_line":"    def __init__(self, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"8f451e13_3f90653a","line":3117,"updated":"2026-07-30 09:50:16.000000000","message":"If this is the qemu default then do we need to explicitly repeat it? Could we just let undefined on our level and let qemu default it?","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":false,"context_lines":[{"line_number":3114,"context_line":"    TDX_POLICY_SEPT_VE_DISABLE \u003d 0x1 \u003c\u003c 28"},{"line_number":3115,"context_line":""},{"line_number":3116,"context_line":"    # This is the same default as qemu exposes: bit 0 (the Debug bit) is"},{"line_number":3117,"context_line":"    # left unset, which disables debugging."},{"line_number":3118,"context_line":"    DEFAULT_TDX_POLICY \u003d TDX_POLICY_SEPT_VE_DISABLE"},{"line_number":3119,"context_line":""},{"line_number":3120,"context_line":"    def __init__(self, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3b7d4eab_0df55a89","line":3117,"in_reply_to":"0f0ef4da_81be4d0f","updated":"2026-08-07 13:11:53.000000000","message":"OK, cool, we can rely on the libvirt/qemu defaults for the rest. Thanks.\n\n```\n  \u003claunchSecurity type\u003d\u0027tdx\u0027\u003e\n    \u003cquoteGenerationService/\u003e\n  \u003c/launchSecurity\u003e\n```\nand \n```\ndmeroot@vm1:~# dmesg | grep -i tdx\n[    0.000000] tdx: Guest detected\n[    0.000000] tdx: Attributes: SEPT_VE_DISABLE\n[    0.000000] tdx: TD_CTLS: PENDING_VE_DISABLE ENUM_TOPOLOGY VIRT_CPUID2 REDUCE_VE\n[    7.385843] process: using TDX aware idle routine\n[    7.385843] Memory Encryption Features active: Intel TDX\n[    7.385843] smpboot: CPU0: Intel TDX (family: 0x6, model: 0xcf, stepping: 0x2)\n[    9.005307] systemd[1]: Detected confidential virtualization tdx.\n[   12.872979] systemd[1]: Detected confidential virtualization tdx.\nroot@vm1:~# \n```\nso the defaults looks good to me.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":3114,"context_line":"    TDX_POLICY_SEPT_VE_DISABLE \u003d 0x1 \u003c\u003c 28"},{"line_number":3115,"context_line":""},{"line_number":3116,"context_line":"    # This is the same default as qemu exposes: bit 0 (the Debug bit) is"},{"line_number":3117,"context_line":"    # left unset, which disables debugging."},{"line_number":3118,"context_line":"    DEFAULT_TDX_POLICY \u003d TDX_POLICY_SEPT_VE_DISABLE"},{"line_number":3119,"context_line":""},{"line_number":3120,"context_line":"    def __init__(self, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"0f0ef4da_81be4d0f","line":3117,"in_reply_to":"8f451e13_3f90653a","updated":"2026-08-04 09:13:05.000000000","message":"Yes that works. I\u0027ll keep the comment for clarity","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1f1e04a179f0e087cbd39af0bc0a2e17672d6cbc","unresolved":false,"context_lines":[{"line_number":3122,"context_line":"            root_name\u003d\u0027launchSecurity\u0027, **kwargs)"},{"line_number":3123,"context_line":""},{"line_number":3124,"context_line":"        # Optional fields ignored:"},{"line_number":3125,"context_line":"        # mrConfigId, mrOwner, mrOwnerConfig"},{"line_number":3126,"context_line":"        self.policy \u003d self.DEFAULT_TDX_POLICY"},{"line_number":3127,"context_line":""},{"line_number":3128,"context_line":"    def format_dom(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"388b94a4_1b52ae03","line":3125,"updated":"2026-07-30 09:50:16.000000000","message":"yepp this is aligned with the spec.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1f1e04a179f0e087cbd39af0bc0a2e17672d6cbc","unresolved":false,"context_lines":[{"line_number":3134,"context_line":"        root.append(policy)"},{"line_number":3135,"context_line":""},{"line_number":3136,"context_line":"        # libvirt fills the default path:"},{"line_number":3137,"context_line":"        # /var/run/tdx-qgs/qgs.socket"},{"line_number":3138,"context_line":"        qgs \u003d etree.Element(\u0027quoteGenerationService\u0027)"},{"line_number":3139,"context_line":"        root.append(qgs)"},{"line_number":3140,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"50df7df6_2ddda465","line":3137,"updated":"2026-07-30 09:50:16.000000000","message":"yepp","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"}],"nova/virt/libvirt/driver.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"91ca5c3bd1bea0d1392db999a3e08503b1585b0a","unresolved":true,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"6824fa4c_1283c830","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"updated":"2026-08-03 16:54:12.000000000","message":"AFAIK cpu_mode is an internal option and is not exposed to users.\nShould we rather avoid reporting TDX capability in case cpu_mode is not host-passthrough ?","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"35788bf122156f41240fdc6de073cd0f6a2f3db0","unresolved":false,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"b917bea5_18008429","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"in_reply_to":"4d8e5d6b_62528f1a","updated":"2026-08-13 15:02:42.000000000","message":"Done","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"9537c2f20ded6a807b0252a9c2d48be0291ac075","unresolved":true,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"4d8e5d6b_62528f1a","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"in_reply_to":"5e951997_60cf819d","updated":"2026-08-07 11:01:00.000000000","message":"Now moved to be a host check","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"5e951997_60cf819d","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"in_reply_to":"6824fa4c_1283c830","updated":"2026-08-04 09:13:05.000000000","message":"Yup that makes more sense!\nWill add a check in https://review.opendev.org/c/openstack/nova/+/994421 instead","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"91ca5c3bd1bea0d1392db999a3e08503b1585b0a","unresolved":true,"context_lines":[{"line_number":7975,"context_line":"        guest.launch_security \u003d vconfig.LibvirtConfigGuestTDXLaunchSecurity()"},{"line_number":7976,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7977,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7978,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7979,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"}],"source_content_type":"text/x-python","patch_set":1,"id":"347cd574_d3b997f9","line":7978,"range":{"start_line":7978,"start_character":37,"end_line":7978,"end_character":74},"updated":"2026-08-03 16:54:12.000000000","message":"Isn\u0027t this a libvirt bug we should fix ?\n\nLibvirt should not require SMM unless the firmware requires it (detected according to the presence of requires-smm feature in its descriptor file), and the descriptor file for TDX firmware does not contain it.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":7975,"context_line":"        guest.launch_security \u003d vconfig.LibvirtConfigGuestTDXLaunchSecurity()"},{"line_number":7976,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7977,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7978,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7979,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"}],"source_content_type":"text/x-python","patch_set":1,"id":"54f7515e_39f06b05","line":7978,"range":{"start_line":7978,"start_character":37,"end_line":7978,"end_character":74},"in_reply_to":"347cd574_d3b997f9","updated":"2026-08-04 09:13:05.000000000","message":"It could be a bug yes, but I more so think that SMM is a requirement of secure loader and since the secure boot flag in Nova (os_secure_boot) explicitly sets secure loader as well as the secure boot flag feature in firmware it gets conflicts here.\n\nSince TDX firmware doesn\u0027t have SMM support, but can have secure boot (and does in my environments), auto-selection doesn\u0027t find suitable firmware, independent of which options for os_secure_boot are used.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"91ca5c3bd1bea0d1392db999a3e08503b1585b0a","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"168f8941_80e6e1f9","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"updated":"2026-08-03 16:54:12.000000000","message":"I\u0027m concerned about this override. How does it behave if a user requests/rejects secure boot ? If the result does not meet the request IMHO we should reject that combination in API layer.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1a3fef2b_fec38257","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"168f8941_80e6e1f9","updated":"2026-08-04 09:13:05.000000000","message":"Yes this was a workaround for the situation that the comment describes. The problem stems from os_loader_secure setting both the firmware feature for secure boot and the secure part of the loader object. I also considered splitting the variable into 2 distinct ones so that in this case only the secure loader part can be disabled. Nova would still set both for secure boot.\n\nThe secure loader part is only required for older versions of Libvirt (which don\u0027t support TDX anyway):\nhttps://libvirt.org/kbase/secureboot.html#older-libvirt-versions\n\nThe current result is that TDX effectively ignores the request for secure boot and gives whatever the firmware has. This is of course not ideal and I think splitting the variable can be a suitable alternative.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"f6ca1f49_e1db2baa","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"1a3fef2b_fec38257","updated":"2026-08-07 13:11:53.000000000","message":"@anton.iacobaeus@canarybit.eu can we get some trackers filed for that split?\n\n@kajinamit@oss.nttdata.com Do I understand it correctly that by merging this we loose support secure boot feature in combination with intel TDX? Or is it more complicated as it depends on the firmwares available? (I.e. I\u0027m wondering if we need to treat this as a blocker or as limitation + follow up)","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"11151c00bdce12bee9425c534772bea495fb037e","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"7d6d7c5b_6b57f0c7","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"22ff0340_26b66215","updated":"2026-08-11 14:12:51.000000000","message":"I created a patch for splitting the variable:\nhttps://review.opendev.org/c/openstack/nova/+/1000472/1\n\nIt is fairly straightforward, but might be out of scope for this spec.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"4fb59162ebfb5780bbe08a33302a88dc2661cc45","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"f80110f2_75edd57c","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"26ff74c0_6de1cccc","updated":"2026-08-10 16:27:06.000000000","message":"Hmm. Could we file a bug for ubuntu to require one without secure boot ?\n\nAnother approach is to require os_loader_secure\u003d\u0027optional\u0027 and omit the secure flag when tdx is enabled, though this causes slightly different behavior in Fedora case because optional usually indicates that \"enable secure boot WHEN available\".","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"35788bf122156f41240fdc6de073cd0f6a2f3db0","unresolved":false,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"3af96bc4_56916415","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"7d6d7c5b_6b57f0c7","updated":"2026-08-13 15:02:42.000000000","message":"I agree with the current approach, if we merge https://review.opendev.org/c/openstack/nova/+/1000472 too.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"6454402a537482129f663eda4c147ddce5affacf","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"26ff74c0_6de1cccc","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"820a4198_430f32cc","updated":"2026-08-10 16:13:40.000000000","message":"\u003e I\u0027ve checked the firmware files in fedora 44 and found two firmware files.\n\n    /usr/share/edk2/ovmf/OVMF.inteltdx.fd (without secure boot)\n    /usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd (with secure boot)\n\nYes, this would be a problem with this current implementation, which would pick whichever is first and effectively ignore the secure boot setting.\n\n\u003e If we know that adding loader.secure\u003dTrue breaks TDX I\u0027d suggest rejecting the instance creation request when both tdx and secure boot are requested. Current libvirt driver sets loader.secure\u003dFalse otherwise, so the nosb version would be selected by libvirt which is consistent with the request.\n\nThe problem is that a nosb version isn\u0027t always available. For instance on Ubuntu 26.04 where there only is a sb version.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"9a5ae526210f685f23c0656db8545db0df2291aa","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"820a4198_430f32cc","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"f6ca1f49_e1db2baa","updated":"2026-08-10 15:43:43.000000000","message":"I\u0027ve checked the firmware files in fedora 44 and found two firmware files.\n\n - /usr/share/edk2/ovmf/OVMF.inteltdx.fd (without secure boot)\n - /usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd (with secure boot)\n\nand I expect that we should allow users to select secure boot according to their requirement (Ubuntu has been following the fiimware patterns in fedora so far).\n\nIf we know that adding loader.secure\u003dTrue breaks TDX I\u0027d suggest rejecting the instance creation request when both tdx and secure boot are requested. Current libvirt driver sets loader.secure\u003dFalse otherwise, so the nosb version would be selected by libvirt which is consistent with the request.\n\nWe can lift that limitation when we implement the new xml pattern.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"4bfb882202e25816d1ce7ec9c03e8abe0ff307e8","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"22ff0340_26b66215","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"f80110f2_75edd57c","updated":"2026-08-11 14:11:03.000000000","message":"\u003e Hmm. Could we file a bug for ubuntu to require one without secure boot ?\n\nI think that solves one part of the problem, but then TDX would only be usable with no secure boot firmware, which seems limiting.\n\n\u003e Another approach is to require os_loader_secure\u003d\u0027optional\u0027 and omit the secure flag when tdx is enabled, though this causes slightly different behavior in Fedora case because optional usually indicates that \"enable secure boot WHEN available\".\n\nThis seems like the most straightforward approach to still support the secure boot version.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"}]}