)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"87f0008c86b6ab911ba3fa122ea7f3cb19b81c55","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"90cd70fd_06dbc6cf","updated":"2026-08-07 09:12:24.000000000","message":"I think we have an unhandled exception in the API as I got the following when trying to boot with TDX\n\n```\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi [None req-c7ee143d-432e-407b-b12a-dcc0ba4a2889 admin admin] Unexpected exception in API method: nova.exception.InvalidVideoMode: The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi Traceback (most recent call last):\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/openstack/wsgi.py\", line 766, in wrapped\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return f(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 262, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 262, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 262, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   [Previous line repeated 11 more times]\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/validation/__init__.py\", line 296, in wrapper\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     response \u003d func(*args, **kwargs)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                ^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/api/openstack/compute/servers.py\", line 819, in create\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     instances, resv_id \u003d self.compute_api.create(\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                          ^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/compute/api.py\", line 2288, in create\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     return self._create_instance(\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi            ^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/compute/api.py\", line 1757, in _create_instance\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     ) \u003d self._validate_and_build_base_options(\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/compute/api.py\", line 1165, in _validate_and_build_base_options\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     numa_topology \u003d hardware.numa_get_constraints(flavor, image_meta)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 2520, in numa_get_constraints\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     get_locked_memory_constraint(flavor, image_meta)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 1654, in get_locked_memory_constraint\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     me_config \u003d get_mem_encryption_constraint(flavor, image_meta, mach_type)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 1476, in get_mem_encryption_constraint\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     mem_enc_config.check_constraints(image_meta, machine_type, enc_requesters)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi   File \"/opt/stack/nova/nova/virt/hardware.py\", line 266, in check_constraints\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi     raise exception.InvalidVideoMode(emsg % self.model)\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi nova.exception.InvalidVideoMode: The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi \nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: INFO nova.api.openstack.wsgi [None req-c7ee143d-432e-407b-b12a-dcc0ba4a2889 admin admin] HTTP exception thrown: Unexpected API Error. Please contact the administrator\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: \u003cclass \u0027nova.exception.InvalidVideoMode\u0027\u003e\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: DEBUG nova.api.openstack.wsgi [None req-c7ee143d-432e-407b-b12a-dcc0ba4a2889 admin admin] Returning 500 to user: Unexpected API Error. Please contact the administrator\n```\nIt should not be a HTTP 500 but either a 400 or a 409\n\nimage:\n```\n((.venv) ) [stack@beast01 nova]$ openstack image show ubuntu-26.04\n+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\n| Field            | Value                                                                                                                                                                                         |\n+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\n| checksum         | 5c3a0a5c0994e4b7c3c161a23ab1754f                                                                                                                                                              |\n| container_format | bare                                                                                                                                                                                          |\n| created_at       | 2026-08-07T09:07:02Z                                                                                                                                                                          |\n| disk_format      | qcow2                                                                                                                                                                                         |\n| file             | /v2/images/efb5881a-0e53-4361-8f27-88ffea8fbd47/file                                                                                                                                          |\n| id               | efb5881a-0e53-4361-8f27-88ffea8fbd47                                                                                                                                                          |\n| min_disk         | 0                                                                                                                                                                                             |\n| min_ram          | 0                                                                                                                                                                                             |\n| name             | ubuntu-26.04                                                                                                                                                                                  |\n| owner            | 111c785db9314bb18eebe68358b708cd                                                                                                                                                              |\n| properties       | hw_firmware_type\u003d\u0027uefi\u0027, os_hash_algo\u003d\u0027sha512\u0027,                                                                                                                                               |\n|                  | os_hash_value\u003d\u00274fff49ba723f58bf0c40aa486b1685f7b85de472bc8960a0deb994bac68e5543cf6072a4d08a0e329570ba27fd770780888612890e6bde68cbf8d3a7cf88fbdb\u0027, os_hidden\u003d\u0027False\u0027,                          |\n|                  | owner_specified.openstack.md5\u003d\u0027\u0027, owner_specified.openstack.object\u003d\u0027images/ubuntu-26.04\u0027, owner_specified.openstack.sha256\u003d\u0027\u0027                                                                 |\n| protected        | False                                                                                                                                                                                         |\n| schema           | /v2/schemas/image                                                                                                                                                                             |\n| size             | 862978048                                                                                                                                                                                     |\n| status           | active                                                                                                                                                                                        |\n| tags             |                                                                                                                                                                                               |\n| updated_at       | 2026-08-07T09:07:08Z                                                                                                                                                                          |\n| virtual_size     | 3758096384                                                                                                                                                                                    |\n| visibility       | shared                                                                                                                                                                                        |\n+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\n```\nflavor:\n```\n((.venv) ) [stack@beast01 nova]$ openstack flavor show m1.tdx\n+----------------------------+----------------------------------------------------------------------------------------+\n| Field                      | Value                                                                                  |\n+----------------------------+----------------------------------------------------------------------------------------+\n| OS-FLV-DISABLED:disabled   | False                                                                                  |\n| OS-FLV-EXT-DATA:ephemeral  | 0                                                                                      |\n| access_project_ids         | None                                                                                   |\n| description                | None                                                                                   |\n| disk                       | 0                                                                                      |\n| id                         | e976b2ad-c4fe-4f81-b55a-3bd70b621efd                                                   |\n| name                       | m1.tdx                                                                                 |\n| os-flavor-access:is_public | True                                                                                   |\n| properties                 | hw:mem_encryption\u003d\u0027true\u0027, hw:mem_encryption_model\u003d\u0027intel-tdx\u0027, hw_firmware_type\u003d\u0027uefi\u0027 |\n| ram                        | 4096                                                                                   |\n| rxtx_factor                | 1.0                                                                                    |\n| swap                       | 0                                                                                      |\n| vcpus                      | 4                                                                                      |\n+----------------------------+----------------------------------------------------------------------------------------+\n((.venv) ) [stack@beast01 nova]$ \n```","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"fee6103a51138338d0a4a18c569ad9283b3393a0","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"238bf8ca_31064a7b","updated":"2026-07-30 09:29:10.000000000","message":"I\u0027ve tested this in a devstack setup on Ubuntu 26.04. It correctly boots and a valid quote can be extracted from within the guest.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"712dfacbdf93d6de669f8df599c0b955a2f5fcc5","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"d0105edd_235c7240","in_reply_to":"64b4d009_d80ee559","updated":"2026-08-07 09:34:04.000000000","message":"If I understand things correctly I should add the Exception (InvalidVideoMode) to\nline 53 in /nova/api/openstack/compute/servers.py \n``INVALID_FLAVOR_IMAGE_EXCEPTIONS`` to prevent this","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"00f98326a6b3f44b04039383061a89c7c4384ba3","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"64b4d009_d80ee559","in_reply_to":"90cd70fd_06dbc6cf","updated":"2026-08-07 09:22:47.000000000","message":"Yes that should be a HTTP 400\n\n\u003e nova.exception.InvalidVideoMode: The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\nAug 07 12:08:43 beast01.rhos.lab.eng.brq2.redhat.com devstack@n-api.service[209474]: ERROR nova.api.openstack.wsgi \n\nI re-used InvalidVideoMode which is a HTTP 400 error, but it looks like it isn\u0027t being handled correctly.\n\nThis check was added as part of https://review.opendev.org/c/openstack/nova/+/998608/3","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"9537c2f20ded6a807b0252a9c2d48be0291ac075","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"de6021a5_83c0485f","in_reply_to":"d0105edd_235c7240","updated":"2026-08-07 11:01:00.000000000","message":"Now fixed","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5544a809_6ed377f0","in_reply_to":"de6021a5_83c0485f","updated":"2026-08-07 13:11:53.000000000","message":"yepp. I can confirm it is fixed now.\n```\n((.venv) ) [stack@beast01 nova]$ openstack server create --image ubuntu-26.04 --flavor m1.tdx --nic net-id\u003dprivate vm1 --wait\nBadRequestException: 400: Client Error for url: http://10.37.137.8/compute/v2.1/servers, The intel-tdx memory encryption model is incompatible with an attached video device. Set the \u0027hw_video_model\u0027 image property to \u0027none\u0027 to disable it\n```","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"28518b9f_1068abc3","updated":"2026-08-07 13:11:53.000000000","message":"I\u0027m OK with what I see and understand but there is a relevant comment thread with Takashi where I need help deciding","commit_id":"60586a4872b8b3877fdeeb9baaac860ee6e80eb4"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"53462f1af2e375dfa408f7cc429f7eaa7706136f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c5fb91f6_f44b9f83","updated":"2026-08-14 08:33:47.000000000","message":"As @kajinamit@oss.nttdata.com agrees I\u0027m upgrading my +1 to +2","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"6550ef57e03a064275b05c3178abffeeed099c64","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"b72b603a_c39eb006","updated":"2026-08-13 13:08:53.000000000","message":"I\u0027m OK with this. @kajinamit@oss.nttdata.com is there anything open on your side?","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d93debfc4b5559b48516e1069a375695457b2a70","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"d2cf7b20_c327dcc7","updated":"2026-08-21 02:42:25.000000000","message":"My -1 is to ignore the secure_boot when it is explicitly requested, IMO we should fail as \"os_secure_boot\u003drequired\" and TDX instance requests are conflict and cannot be completed togehter.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"d50723702412e9ab0ad3acecbb7cb497c5882615","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"063994da_736b48d3","updated":"2026-08-18 07:55:16.000000000","message":"recheck https://bugs.launchpad.net/nova/+bug/2163552\n\nand \n\nDetails: Server 037bb495-217d-4c13-8053-e851eb70c93e failed to delete and is in ERROR status. Fault: {\u0027code\u0027: 500, \u0027created\u0027: \u00272026-08-13T08:30:14Z\u0027, \u0027message\u0027: \u0027Virtual Interface creation failed\u0027}., \u003ctraceback object at 0x7c3263412d80\u003e)\n\nthat is probably a neutron instability","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"425cfccb8fda81df66faa45aef87f742a46a4aa2","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c77c99d1_5e2f22f4","in_reply_to":"7bea928a_eba2838d","updated":"2026-08-21 11:42:12.000000000","message":"In this patch secure boot was ignored for TDX and it was a limitation which was then addressed in https://review.opendev.org/c/openstack/nova/+/1000472 following review from @kajinamit@oss.nttdata.com.\n\n\u003e infact i belive gibi had to enabel it for it to work since they only hage firemare descriptors for secure boot.\n\nThis is referring to when gibi tested after the fix.\n\nWhen gibi first tested this patch it was not required to define secure boot since it was always treated as optional, allowing libvirt to select whatever firmware that was available. On the system that gibi was using there was only TDX firmware with secure boot and thus, after the fix, no firmware without secure boot support was able to be found, thus he had to enable it (at least optional).","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bb5112e5814e6a63a963f0d832ec754d4e288a27","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"7bea928a_eba2838d","in_reply_to":"d2cf7b20_c327dcc7","updated":"2026-08-21 10:45:38.000000000","message":"wait the are not ment ot be mutally exclsive\n\nyou are ment to be abel to enabel securer boot and TDX at the same time\n\ninfact i belive gibi had to enabel it for it to work since they only hage firemare descriptors for secure boot.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"804cf443d78cd2a83e21714b59d918ac5b69de22","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"3e991f2e_e441be49","updated":"2026-08-24 13:02:34.000000000","message":"+1 i agree with gmaan here so once that open qustion is resolved i think we can proceed.","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d21d4d9cf78c47e4e21a8d4814e0fa7eb35474d7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"c6264cb8_b0702d1b","updated":"2026-08-24 17:51:22.000000000","message":"all good here","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"79681d7a132fdf6cd00f5e8aeee6d03d3aa913d2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"4d42f301_3de2cf38","updated":"2026-08-22 02:56:55.000000000","message":"overall lgtm now, just wan to know about secure boot testing if VM is all up. accordingly I will convert my vote.","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"29b87eb250bbc343f907fd9f4071195a8def58d9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"0af04345_8d9b26ad","updated":"2026-08-26 13:40:04.000000000","message":"recheck guest ssh timeout","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"a2bece87e05067acc80b8fd03f2f9785f3533722","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"ddc35593_eaf23119","updated":"2026-08-26 08:20:01.000000000","message":"recheck https://bugs.launchpad.net/nova/+bug/2163552","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"c1f58c6193a24c02be82c872be01203a6a45ae86","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"b63c131d_18b8d6f2","updated":"2026-08-24 15:09:03.000000000","message":"recheck nova-next slow node?\n\nDetails: (ServerActionsTestOtherA:test_rebuild_server_in_stop_state) Server 425b27d9-6664-4d8d-bd9d-f7e641057eb8 failed to reach SHUTOFF status and task state \"None\" within the required time (196 s). Current status: REBUILD. Current task state: rebuild_spawning.","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"cf4c871a1d053d14676b50a67b397d298bd4bb09","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"0c8585e3_e50275fb","updated":"2026-08-25 08:15:05.000000000","message":"recheck requeu","commit_id":"6f91fb725264fc8b328d3ccf66c088b236397e74"}],"nova/tests/functional/libvirt/test_intel_tdx.py":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"07f575b094e01b8281fc3fa6e00c42d8406c7b97","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \"\"\"Compute should fail if intel-tdx instance exists but intel-tdx is"},{"line_number":73,"context_line":"        lost"},{"line_number":74,"context_line":"        \"\"\""},{"line_number":75,"context_line":"        # NOTE(antia) Intel TDX does not require staeless firmware but the"},{"line_number":76,"context_line":"        # version is good enough for the test"},{"line_number":77,"context_line":"        libvirt_version \u003d versionutils.convert_version_to_int("},{"line_number":78,"context_line":"            driver.MIN_LIBVIRT_STATELESS_FIRMWARE)"},{"line_number":79,"context_line":"        self.hostname \u003d self.start_compute("},{"line_number":80,"context_line":"            libvirt_version\u003dlibvirt_version)"},{"line_number":81,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"f4834634_6da6f36a","line":78,"range":{"start_line":75,"start_character":8,"end_line":78,"end_character":49},"updated":"2026-08-18 21:16:49.000000000","message":"this comment is confusing.\n\n\nstatelesss firmware was added in 8.6.0 \n\ntdk supprot was intoduced in 11.6.0\n\nhttps://github.com/libvirt/libvirt/commit/5e5528ef14b600a43070c7efc3877e3840725dec\n\nyou are using this constant not because its \"good enouch for the test\"\n\nyou are using it becasue its below the min version that supprot TDX so the tdx supprot will not be reporrted.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"804cf443d78cd2a83e21714b59d918ac5b69de22","unresolved":false,"context_lines":[{"line_number":72,"context_line":"        \"\"\"Compute should fail if intel-tdx instance exists but intel-tdx is"},{"line_number":73,"context_line":"        lost"},{"line_number":74,"context_line":"        \"\"\""},{"line_number":75,"context_line":"        # NOTE(antia) Intel TDX does not require staeless firmware but the"},{"line_number":76,"context_line":"        # version is good enough for the test"},{"line_number":77,"context_line":"        libvirt_version \u003d versionutils.convert_version_to_int("},{"line_number":78,"context_line":"            driver.MIN_LIBVIRT_STATELESS_FIRMWARE)"},{"line_number":79,"context_line":"        self.hostname \u003d self.start_compute("},{"line_number":80,"context_line":"            libvirt_version\u003dlibvirt_version)"},{"line_number":81,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"b8da2aae_677d2811","line":78,"range":{"start_line":75,"start_character":8,"end_line":78,"end_character":49},"in_reply_to":"5f43ff73_f6245877","updated":"2026-08-24 13:02:34.000000000","message":"Acknowledged","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0c798453d70b6bda9c036a4c97efd3e107ccdbcf","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \"\"\"Compute should fail if intel-tdx instance exists but intel-tdx is"},{"line_number":73,"context_line":"        lost"},{"line_number":74,"context_line":"        \"\"\""},{"line_number":75,"context_line":"        # NOTE(antia) Intel TDX does not require staeless firmware but the"},{"line_number":76,"context_line":"        # version is good enough for the test"},{"line_number":77,"context_line":"        libvirt_version \u003d versionutils.convert_version_to_int("},{"line_number":78,"context_line":"            driver.MIN_LIBVIRT_STATELESS_FIRMWARE)"},{"line_number":79,"context_line":"        self.hostname \u003d self.start_compute("},{"line_number":80,"context_line":"            libvirt_version\u003dlibvirt_version)"},{"line_number":81,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f43ff73_f6245877","line":78,"range":{"start_line":75,"start_character":8,"end_line":78,"end_character":49},"in_reply_to":"f4834634_6da6f36a","updated":"2026-08-19 08:23:26.000000000","message":"I completely agree that the comment is confusing, TDX even requires stateless. I will drop the comment. I missed this when updating to require TDX to have stateless support.\n\n\u003e you are using it becasue its below the min version that supprot TDX so the tdx supprot will not be reporrted.\n\nThis is not why it is used. TDX detection is mocked out as part of this test and TDX is reported as enabled for the first part of the test. It is used to get a driver with the requirements. This follows the same pattern as for the SNP test, which also doesn\u0027t have a dedicated version.\n\nhttps://github.com/openstack/nova/blob/master/nova/tests/functional/libvirt/test_amd_sev.py#L162-L193","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"}],"nova/virt/libvirt/config.py":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1f1e04a179f0e087cbd39af0bc0a2e17672d6cbc","unresolved":true,"context_lines":[{"line_number":3114,"context_line":"    TDX_POLICY_SEPT_VE_DISABLE \u003d 0x1 \u003c\u003c 28"},{"line_number":3115,"context_line":""},{"line_number":3116,"context_line":"    # This is the same default as qemu exposes: bit 0 (the Debug bit) is"},{"line_number":3117,"context_line":"    # left unset, which disables debugging."},{"line_number":3118,"context_line":"    DEFAULT_TDX_POLICY \u003d TDX_POLICY_SEPT_VE_DISABLE"},{"line_number":3119,"context_line":""},{"line_number":3120,"context_line":"    def __init__(self, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"8f451e13_3f90653a","line":3117,"updated":"2026-07-30 09:50:16.000000000","message":"If this is the qemu default then do we need to explicitly repeat it? Could we just let undefined on our level and let qemu default it?","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":false,"context_lines":[{"line_number":3114,"context_line":"    TDX_POLICY_SEPT_VE_DISABLE \u003d 0x1 \u003c\u003c 28"},{"line_number":3115,"context_line":""},{"line_number":3116,"context_line":"    # This is the same default as qemu exposes: bit 0 (the Debug bit) is"},{"line_number":3117,"context_line":"    # left unset, which disables debugging."},{"line_number":3118,"context_line":"    DEFAULT_TDX_POLICY \u003d TDX_POLICY_SEPT_VE_DISABLE"},{"line_number":3119,"context_line":""},{"line_number":3120,"context_line":"    def __init__(self, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3b7d4eab_0df55a89","line":3117,"in_reply_to":"0f0ef4da_81be4d0f","updated":"2026-08-07 13:11:53.000000000","message":"OK, cool, we can rely on the libvirt/qemu defaults for the rest. Thanks.\n\n```\n  \u003claunchSecurity type\u003d\u0027tdx\u0027\u003e\n    \u003cquoteGenerationService/\u003e\n  \u003c/launchSecurity\u003e\n```\nand \n```\ndmeroot@vm1:~# dmesg | grep -i tdx\n[    0.000000] tdx: Guest detected\n[    0.000000] tdx: Attributes: SEPT_VE_DISABLE\n[    0.000000] tdx: TD_CTLS: PENDING_VE_DISABLE ENUM_TOPOLOGY VIRT_CPUID2 REDUCE_VE\n[    7.385843] process: using TDX aware idle routine\n[    7.385843] Memory Encryption Features active: Intel TDX\n[    7.385843] smpboot: CPU0: Intel TDX (family: 0x6, model: 0xcf, stepping: 0x2)\n[    9.005307] systemd[1]: Detected confidential virtualization tdx.\n[   12.872979] systemd[1]: Detected confidential virtualization tdx.\nroot@vm1:~# \n```\nso the defaults looks good to me.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":3114,"context_line":"    TDX_POLICY_SEPT_VE_DISABLE \u003d 0x1 \u003c\u003c 28"},{"line_number":3115,"context_line":""},{"line_number":3116,"context_line":"    # This is the same default as qemu exposes: bit 0 (the Debug bit) is"},{"line_number":3117,"context_line":"    # left unset, which disables debugging."},{"line_number":3118,"context_line":"    DEFAULT_TDX_POLICY \u003d TDX_POLICY_SEPT_VE_DISABLE"},{"line_number":3119,"context_line":""},{"line_number":3120,"context_line":"    def __init__(self, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"0f0ef4da_81be4d0f","line":3117,"in_reply_to":"8f451e13_3f90653a","updated":"2026-08-04 09:13:05.000000000","message":"Yes that works. I\u0027ll keep the comment for clarity","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1f1e04a179f0e087cbd39af0bc0a2e17672d6cbc","unresolved":false,"context_lines":[{"line_number":3122,"context_line":"            root_name\u003d\u0027launchSecurity\u0027, **kwargs)"},{"line_number":3123,"context_line":""},{"line_number":3124,"context_line":"        # Optional fields ignored:"},{"line_number":3125,"context_line":"        # mrConfigId, mrOwner, mrOwnerConfig"},{"line_number":3126,"context_line":"        self.policy \u003d self.DEFAULT_TDX_POLICY"},{"line_number":3127,"context_line":""},{"line_number":3128,"context_line":"    def format_dom(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"388b94a4_1b52ae03","line":3125,"updated":"2026-07-30 09:50:16.000000000","message":"yepp this is aligned with the spec.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"1f1e04a179f0e087cbd39af0bc0a2e17672d6cbc","unresolved":false,"context_lines":[{"line_number":3134,"context_line":"        root.append(policy)"},{"line_number":3135,"context_line":""},{"line_number":3136,"context_line":"        # libvirt fills the default path:"},{"line_number":3137,"context_line":"        # /var/run/tdx-qgs/qgs.socket"},{"line_number":3138,"context_line":"        qgs \u003d etree.Element(\u0027quoteGenerationService\u0027)"},{"line_number":3139,"context_line":"        root.append(qgs)"},{"line_number":3140,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"50df7df6_2ddda465","line":3137,"updated":"2026-07-30 09:50:16.000000000","message":"yepp","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"}],"nova/virt/libvirt/driver.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"91ca5c3bd1bea0d1392db999a3e08503b1585b0a","unresolved":true,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"6824fa4c_1283c830","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"updated":"2026-08-03 16:54:12.000000000","message":"AFAIK cpu_mode is an internal option and is not exposed to users.\nShould we rather avoid reporting TDX capability in case cpu_mode is not host-passthrough ?","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"35788bf122156f41240fdc6de073cd0f6a2f3db0","unresolved":false,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"b917bea5_18008429","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"in_reply_to":"4d8e5d6b_62528f1a","updated":"2026-08-13 15:02:42.000000000","message":"Done","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"9537c2f20ded6a807b0252a9c2d48be0291ac075","unresolved":true,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"4d8e5d6b_62528f1a","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"in_reply_to":"5e951997_60cf819d","updated":"2026-08-07 11:01:00.000000000","message":"Now moved to be a host check","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":7964,"context_line":""},{"line_number":7965,"context_line":"    def _guest_configure_tdx_mem_encryption(self, guest, model):"},{"line_number":7966,"context_line":"        if guest.cpu.mode !\u003d \"host-passthrough\":"},{"line_number":7967,"context_line":"            emsg \u003d _("},{"line_number":7968,"context_line":"                \"The %(model)s memory encryption model needs host-passthrough\""},{"line_number":7969,"context_line":"                \" and is not compatible with cpu mode \u0027%(cpu_mode)s\u0027\""},{"line_number":7970,"context_line":"            )"},{"line_number":7971,"context_line":""},{"line_number":7972,"context_line":"            raise exception.IncompatibleCPUMode("},{"line_number":7973,"context_line":"                emsg % {\"model\": model, \"cpu_mode\": guest.cpu.mode}"}],"source_content_type":"text/x-python","patch_set":1,"id":"5e951997_60cf819d","line":7970,"range":{"start_line":7967,"start_character":0,"end_line":7970,"end_character":13},"in_reply_to":"6824fa4c_1283c830","updated":"2026-08-04 09:13:05.000000000","message":"Yup that makes more sense!\nWill add a check in https://review.opendev.org/c/openstack/nova/+/994421 instead","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"91ca5c3bd1bea0d1392db999a3e08503b1585b0a","unresolved":true,"context_lines":[{"line_number":7975,"context_line":"        guest.launch_security \u003d vconfig.LibvirtConfigGuestTDXLaunchSecurity()"},{"line_number":7976,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7977,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7978,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7979,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"}],"source_content_type":"text/x-python","patch_set":1,"id":"347cd574_d3b997f9","line":7978,"range":{"start_line":7978,"start_character":37,"end_line":7978,"end_character":74},"updated":"2026-08-03 16:54:12.000000000","message":"Isn\u0027t this a libvirt bug we should fix ?\n\nLibvirt should not require SMM unless the firmware requires it (detected according to the presence of requires-smm feature in its descriptor file), and the descriptor file for TDX firmware does not contain it.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":7975,"context_line":"        guest.launch_security \u003d vconfig.LibvirtConfigGuestTDXLaunchSecurity()"},{"line_number":7976,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7977,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7978,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7979,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"}],"source_content_type":"text/x-python","patch_set":1,"id":"54f7515e_39f06b05","line":7978,"range":{"start_line":7978,"start_character":37,"end_line":7978,"end_character":74},"in_reply_to":"347cd574_d3b997f9","updated":"2026-08-04 09:13:05.000000000","message":"It could be a bug yes, but I more so think that SMM is a requirement of secure loader and since the secure boot flag in Nova (os_secure_boot) explicitly sets secure loader as well as the secure boot flag feature in firmware it gets conflicts here.\n\nSince TDX firmware doesn\u0027t have SMM support, but can have secure boot (and does in my environments), auto-selection doesn\u0027t find suitable firmware, independent of which options for os_secure_boot are used.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"91ca5c3bd1bea0d1392db999a3e08503b1585b0a","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"168f8941_80e6e1f9","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"updated":"2026-08-03 16:54:12.000000000","message":"I\u0027m concerned about this override. How does it behave if a user requests/rejects secure boot ? If the result does not meet the request IMHO we should reject that combination in API layer.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0af3eb1d7764e3d9aee97a94b9266daeaad418bf","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1a3fef2b_fec38257","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"168f8941_80e6e1f9","updated":"2026-08-04 09:13:05.000000000","message":"Yes this was a workaround for the situation that the comment describes. The problem stems from os_loader_secure setting both the firmware feature for secure boot and the secure part of the loader object. I also considered splitting the variable into 2 distinct ones so that in this case only the secure loader part can be disabled. Nova would still set both for secure boot.\n\nThe secure loader part is only required for older versions of Libvirt (which don\u0027t support TDX anyway):\nhttps://libvirt.org/kbase/secureboot.html#older-libvirt-versions\n\nThe current result is that TDX effectively ignores the request for secure boot and gives whatever the firmware has. This is of course not ideal and I think splitting the variable can be a suitable alternative.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7b41c0acd418c55d5eaa6348fba65f3ee9486fde","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"f6ca1f49_e1db2baa","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"1a3fef2b_fec38257","updated":"2026-08-07 13:11:53.000000000","message":"@anton.iacobaeus@canarybit.eu can we get some trackers filed for that split?\n\n@kajinamit@oss.nttdata.com Do I understand it correctly that by merging this we loose support secure boot feature in combination with intel TDX? Or is it more complicated as it depends on the firmwares available? (I.e. I\u0027m wondering if we need to treat this as a blocker or as limitation + follow up)","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"11151c00bdce12bee9425c534772bea495fb037e","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"7d6d7c5b_6b57f0c7","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"22ff0340_26b66215","updated":"2026-08-11 14:12:51.000000000","message":"I created a patch for splitting the variable:\nhttps://review.opendev.org/c/openstack/nova/+/1000472/1\n\nIt is fairly straightforward, but might be out of scope for this spec.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"4fb59162ebfb5780bbe08a33302a88dc2661cc45","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"f80110f2_75edd57c","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"26ff74c0_6de1cccc","updated":"2026-08-10 16:27:06.000000000","message":"Hmm. Could we file a bug for ubuntu to require one without secure boot ?\n\nAnother approach is to require os_loader_secure\u003d\u0027optional\u0027 and omit the secure flag when tdx is enabled, though this causes slightly different behavior in Fedora case because optional usually indicates that \"enable secure boot WHEN available\".","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"35788bf122156f41240fdc6de073cd0f6a2f3db0","unresolved":false,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"3af96bc4_56916415","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"7d6d7c5b_6b57f0c7","updated":"2026-08-13 15:02:42.000000000","message":"I agree with the current approach, if we merge https://review.opendev.org/c/openstack/nova/+/1000472 too.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"6454402a537482129f663eda4c147ddce5affacf","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"26ff74c0_6de1cccc","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"820a4198_430f32cc","updated":"2026-08-10 16:13:40.000000000","message":"\u003e I\u0027ve checked the firmware files in fedora 44 and found two firmware files.\n\n    /usr/share/edk2/ovmf/OVMF.inteltdx.fd (without secure boot)\n    /usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd (with secure boot)\n\nYes, this would be a problem with this current implementation, which would pick whichever is first and effectively ignore the secure boot setting.\n\n\u003e If we know that adding loader.secure\u003dTrue breaks TDX I\u0027d suggest rejecting the instance creation request when both tdx and secure boot are requested. Current libvirt driver sets loader.secure\u003dFalse otherwise, so the nosb version would be selected by libvirt which is consistent with the request.\n\nThe problem is that a nosb version isn\u0027t always available. For instance on Ubuntu 26.04 where there only is a sb version.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"9a5ae526210f685f23c0656db8545db0df2291aa","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"820a4198_430f32cc","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"f6ca1f49_e1db2baa","updated":"2026-08-10 15:43:43.000000000","message":"I\u0027ve checked the firmware files in fedora 44 and found two firmware files.\n\n - /usr/share/edk2/ovmf/OVMF.inteltdx.fd (without secure boot)\n - /usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd (with secure boot)\n\nand I expect that we should allow users to select secure boot according to their requirement (Ubuntu has been following the fiimware patterns in fedora so far).\n\nIf we know that adding loader.secure\u003dTrue breaks TDX I\u0027d suggest rejecting the instance creation request when both tdx and secure boot are requested. Current libvirt driver sets loader.secure\u003dFalse otherwise, so the nosb version would be selected by libvirt which is consistent with the request.\n\nWe can lift that limitation when we implement the new xml pattern.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"4bfb882202e25816d1ce7ec9c03e8abe0ff307e8","unresolved":true,"context_lines":[{"line_number":7980,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7981,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7982,"context_line":"        # controls both."},{"line_number":7983,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7984,"context_line":""},{"line_number":7985,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7986,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":1,"id":"22ff0340_26b66215","line":7983,"range":{"start_line":7983,"start_character":8,"end_line":7983,"end_character":37},"in_reply_to":"f80110f2_75edd57c","updated":"2026-08-11 14:11:03.000000000","message":"\u003e Hmm. Could we file a bug for ubuntu to require one without secure boot ?\n\nI think that solves one part of the problem, but then TDX would only be usable with no secure boot firmware, which seems limiting.\n\n\u003e Another approach is to require os_loader_secure\u003d\u0027optional\u0027 and omit the secure flag when tdx is enabled, though this causes slightly different behavior in Fedora case because optional usually indicates that \"enable secure boot WHEN available\".\n\nThis seems like the most straightforward approach to still support the secure boot version.","commit_id":"15e33be34ecc8f833e06a07f2cff52b8a26023dd"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"07f575b094e01b8281fc3fa6e00c42d8406c7b97","unresolved":true,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"8b0b3f2f_6557a0e7","line":235,"updated":"2026-08-18 21:16:49.000000000","message":"we need a new version constant for TDX\n\nit was not intoduced to libvirrt until 11.6.0\n\nhttps://github.com/libvirt/libvirt/commit/5e5528ef14b600a43070c7efc3877e3840725dec\n\nwhich is well above our NEXT_MIN_LIBVIRT_VERSION\n\nthat is noted in the spec but not check for in the code","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"7e907cdf7daf7c8ce5bd3b3757966ab55662e1c3","unresolved":true,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"e98d352a_4eef3cb9","line":235,"in_reply_to":"039d91e0_ade123ab","updated":"2026-08-19 08:44:00.000000000","message":"I\u0027m OK with @anton.iacobaeus@canarybit.eu\u0027s approach here. What libvirt reports feels enough.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bb5112e5814e6a63a963f0d832ec754d4e288a27","unresolved":false,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"441bb432_0f85288f","line":235,"in_reply_to":"66377afe_d3408869","updated":"2026-08-21 10:45:38.000000000","message":"we proablly cant remove all the check in general but we normally do ask contibutor to work with libvirt to add flags for things, i rememeber being asked to do that in the past hwen i was at intel and havign to higer contractros with c experince ot develop the feature.\n\nmost companies cant affort that but its something we can also ask for internally.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"100f32414c92abe2e415597ee54ec98f2014a3d0","unresolved":true,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"f3f20430_236f3692","line":235,"in_reply_to":"8b0b3f2f_6557a0e7","updated":"2026-08-18 21:19:28.000000000","message":"the min qemu version is also 10.1 so we need to check for both before reporting supprot for TDX to placemetn as a compute capablity trait and we need to check for this in geernal when usign this feature in the virt driver","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d93debfc4b5559b48516e1069a375695457b2a70","unresolved":false,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"66377afe_d3408869","line":235,"in_reply_to":"c28bd0f2_8615af47","updated":"2026-08-21 02:42:25.000000000","message":"yeah, we eventuality should remove all these version checks and instead check via capabilities ( request libvirt to support them, if they can implement :))","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"320a15f2d1c4a9afb6a4c3ce50a93e1a19e48a3e","unresolved":false,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"c28bd0f2_8615af47","line":235,"in_reply_to":"e98d352a_4eef3cb9","updated":"2026-08-19 09:30:48.000000000","message":"sorry yes i missed that his was reproted via domcaps and we were gating the reporting on that that shoudl work fine for our needs","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"0c798453d70b6bda9c036a4c97efd3e107ccdbcf","unresolved":true,"context_lines":[{"line_number":232,"context_line":"MIN_LIBVIRT_MAXPHYSADDR \u003d (8, 7, 0)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# stateless firmware support"},{"line_number":235,"context_line":"MIN_LIBVIRT_STATELESS_FIRMWARE \u003d (8, 6, 0)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"# Minimum versions supporting igb hw_vif_model"},{"line_number":238,"context_line":"MIN_IGB_LIBVIRT_VERSION \u003d (9, 3, 0)"}],"source_content_type":"text/x-python","patch_set":3,"id":"039d91e0_ade123ab","line":235,"in_reply_to":"f3f20430_236f3692","updated":"2026-08-19 08:23:26.000000000","message":"I left out the Libvirt and QEMU version checks since Libvirt capabilities is able to handle that check on its own. A version of Libvirt without TDX support will not include the tdx entry. A version of QEMU without TDX support compiled will not pass the Libvirt check and thus capability will report it as not supported. There is no dedicated Libvirt/QEMU version check for AMD SEV-SNP, other than the implicit one for AMD SEV-ES, which I don\u0027t think is needed anymore.\n\nExplicit version checking can be limiting in environments where it is built on backports or for example the canonical TDX demo on Ubuntu 24.04.\n\nThis is more so resolved by documentation (see doc patch) which explicitly states the versions of upstream and the requirements.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d93debfc4b5559b48516e1069a375695457b2a70","unresolved":true,"context_lines":[{"line_number":7357,"context_line":"                if os_secure_boot \u003d\u003d \u0027required\u0027:"},{"line_number":7358,"context_line":"                    # hard fail if we don\u0027t support secure boot and it\u0027s"},{"line_number":7359,"context_line":"                    # required"},{"line_number":7360,"context_line":"                    if not self._check_secure_boot_support("},{"line_number":7361,"context_line":"                        arch, mach_type, hw_firmware_type,"},{"line_number":7362,"context_line":"                    ):"},{"line_number":7363,"context_line":"                        raise exception.SecureBootNotSupported()"},{"line_number":7364,"context_line":""},{"line_number":7365,"context_line":"                    guest.os_loader_secure \u003d True"},{"line_number":7366,"context_line":"                elif os_secure_boot \u003d\u003d \u0027optional\u0027:"},{"line_number":7367,"context_line":"                    # only enable it if the host is configured appropriately"}],"source_content_type":"text/x-python","patch_set":3,"id":"b0155561_ef144756","line":7364,"range":{"start_line":7360,"start_character":0,"end_line":7364,"end_character":0},"updated":"2026-08-21 02:42:25.000000000","message":"here we should check if TDX is requested then os_secure_boot \u003d\u003d \u0027required\u0027 will be failed instead of ignoring it later one.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d93debfc4b5559b48516e1069a375695457b2a70","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"6d5781fa_c966134a","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"updated":"2026-08-21 02:42:25.000000000","message":"all understood about secure boot and no need for SMM in TDX. But I am little hesitant to ignore it when it is explicitly request by \u0027os_secure_boot\u003drequired\u0027 in image/flavor.\n\nIt will be a silent ignoring without user knowledge or asking them not to pass the os_secure_boot when they are requesting TDX VM. We should instead fail of os_secure_boot is \u0027required\u0027 and TDX VM is requested. I commented above where we should check TDX reqeuested and fail if secure_boot is explicitly asked by users.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"cce575f25f87497f2d40b8c048fd789480e26560","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"91b75188_14eea37c","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"154b54f7_d7ade312","updated":"2026-08-21 12:45:26.000000000","message":"right but this is a limiation of teh firmware combined with the fact we are enabling stateless firmware i belive.\n\nnova has a policy that it never silently allwos a vm to boot unless all requested fature are provided\n\nso if the image has `os_secure_boot \u003d\u003d \u0027required\u0027` we must enabel secureboot or put the vm in error ignoreign the request is not valid.\n\n\nthe libvirt domain xml docs note that usign the varstore element\n\nhttps://libvirt.org/formatdomain.html#:~:text\u003dvarstore\n\nallows x86 to UEFI authenticated variables without SMM emulation.\nthat may help but we can defer makign that work to a followup\n\nwhat we need to fix in this patch is allwoing the vm to boot without secure boot enabeld when its requested via require\n\nit woudl be valid to unll it out for optional but not require","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bb5112e5814e6a63a963f0d832ec754d4e288a27","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"2a7e1ba7_6a183046","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"1e1e34aa_b8ac0e03","updated":"2026-08-21 10:45:38.000000000","message":"SMM supprot is seperate form secure boot\n\nSMM is system management mode and that is not actully requried for secure boot\nwe also do not promiss to providde SMM mode when you set os_secure_boot \u003d\u003d \u0027required\u0027 that is completely unspecifed\n\ngmaan is correct hat we must fail if \u0027os_secure_boot\u003drequired is set \nbut we shoudl not fail just becasue SMM mode is not aviable.\n`os_secure_boot\u003drequired` is entirly unrelated to SMM","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"fd4bdb367fb1c4e98cb26a464d170480bad11ee8","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"3b59ab3f_71233072","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"27aa719f_129df15e","updated":"2026-08-21 13:48:08.000000000","message":"Yes agreed, I am looking into it. For now I have not updated anything regarding this, and the current approach would be to merge the entire series so that https://review.opendev.org/c/openstack/nova/+/1000472 solves this","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"425cfccb8fda81df66faa45aef87f742a46a4aa2","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"d17bb155_a8c4e812","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"2a7e1ba7_6a183046","updated":"2026-08-21 11:42:12.000000000","message":"SMM support is separate indeed, but what I found during testing is that the secure flag of the loader in libvirt results in a conflict with TDX firmware since it doesn\u0027t support SMM. os_secure_boot\u003drequired forces loader.secure \u003d \"yes\" and thus conflicts with TDX firmware. The follow up patch previously mentioned addresses this by separating the secure boot request into two variables internally, one which controls the secure boot firmware parameter and one which controls secure flag of the loader. The logic for secure boot remains the same, but it enables TDX, for instance, to not set the secure flag in the loader and only the firmware part. Prior to that patch os_secure_boot controls both which is where the limitation comes from. With that patch it is no longer necessary to fail on os_secure_boot\u003drequired for Intel TDX as secure boot works as expected.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"99789d122125966da0181f184fc9f86cd8ada507","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"ef4de008_37f76c55","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"3b59ab3f_71233072","updated":"2026-08-21 14:58:28.000000000","message":"https://review.opendev.org/c/openstack/nova/+/1000472 now comes before this meaning that secure boot now behaves correctly with TDX. Thanks for the guidance!","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"635ea2434d5b09750ca66dd872b438b0f7d47bf6","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"ce3050ab_b3915b0e","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"6a1796cc_db4c1019","updated":"2026-08-24 15:01:07.000000000","message":"Here is some testing material which verifies that at least the guest kernel identifies secure boot as working correctly. This creates 2 TDX instances, one with secure boot and one without. `loader.secure \u003d \"None\"` is always the case and only firmware.feature \u003cname\u003d\"secure-boot\" enabled\u003d\"yes\"\u003e, as can be seen by the xml dump from libvirt.\n\nhttps://paste.openstack.org/show/bt2KoxDsgfLkukmGW4w5/","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"79681d7a132fdf6cd00f5e8aeee6d03d3aa913d2","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"79a5a4de_928c34b6","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"6c51c182_97707a53","updated":"2026-08-22 02:56:55.000000000","message":"ok, seeing this in two changes gave me hard time.\n\nantia, yes, if we do loader.secure \u003d \"yes\" then libvirt restrict pflash variables so they can only be modified when the CPU is running in SMM mode. and SMM is a hypervisor-controlled mode which is beyond the TDX securoity boundaries.\n\nIn non-TDX, loader.secure \u003d \"None\" and firmware.feature \u003cname\u003d\"secure-boot\" enabled\u003d\"yes\"\u003e will not work and libvirt might throw error but in TDX it seems to be the only way. I think this worked in your testing in secure boot case right? just want to make sure it is tested well.\n\nhttps://libvirt.org/formatdomain.html#id4","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"d1a75b789b57afe0415863a5ead57052289d1e47","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"1e1e34aa_b8ac0e03","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"6d5781fa_c966134a","updated":"2026-08-21 07:31:23.000000000","message":"This was addressed in a follow up patch:\nhttps://review.opendev.org/c/openstack/nova/+/1000472\n\nWith that TDX no longer ignores the request for secure boot\n\nI could make changes to this patch to make it more robust without it, but they will be removed later anyway","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"804cf443d78cd2a83e21714b59d918ac5b69de22","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"6a1796cc_db4c1019","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"79a5a4de_928c34b6","updated":"2026-08-24 13:02:34.000000000","message":"+1 lets test this specifc case if we can on tdx hardware adn confirm so we can document and enforce the expected behvior.\n\nwe can move nova to using the version of secure boot without the need for SMM as a spereate feature but that does still require a host vars file which may not be applicable in TDX mode.\n\nthe imporant thing is that os_secure_boot\u003drequired must reuslt in a vm with secure boot functional, so if we cant use secure boot with TDX we need to reject it if we can and  firmware.feature \u003cname\u003d\"secure-boot\" enabled\u003d\"yes\"\u003e and  loader.secure \u003d \"None\" is sufficent to enabel that then we are good.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"1d0767192061627769af07665e0fe7dfd861a06e","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"d0b0cd8f_34dd15b2","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"91b75188_14eea37c","updated":"2026-08-21 12:48:12.000000000","message":"Alright, that makes sense. I will add a rejection for `os_secure_boot \u003d \u0027required\u0027`, which will then be removed again with https://review.opendev.org/c/openstack/nova/+/1000472.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d21d4d9cf78c47e4e21a8d4814e0fa7eb35474d7","unresolved":false,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"07a6cca8_0e163d55","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"973b7e65_3a0dbd0d","updated":"2026-08-24 17:51:22.000000000","message":"perfect, thanks anita for testing and posting the results.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"c5048aa40957d08aa40584d56664d96d7038c03d","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba47cd3d_e1be7366","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"ce3050ab_b3915b0e","updated":"2026-08-24 15:07:28.000000000","message":"Thanks @anton.iacobaeus@canarybit.eu you were faster testing this than me. The test result seem OK to me. Both secure and non secure case works as expectd.","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4d2380b97a30e64f6d76460e8562eaf7bc22ae61","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"973b7e65_3a0dbd0d","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"ce3050ab_b3915b0e","updated":"2026-08-24 15:07:56.000000000","message":"thanks that looks correct to me","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"0718e0c9ec777010ab256cd6a214da17da7b2b9c","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"27aa719f_129df15e","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"d0b0cd8f_34dd15b2","updated":"2026-08-21 13:12:11.000000000","message":"a bettter approch woudl be to move that patch ealier","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":38744,"name":"Anton Iacobaeus","display_name":"antia","email":"anton.iacobaeus@canarybit.eu","username":"antia","status":"Canary Bit"},"change_message_id":"a7c364f3becd1f62d87d661d888420628f7e1d81","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"154b54f7_d7ade312","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"d17bb155_a8c4e812","updated":"2026-08-21 12:13:52.000000000","message":"The error from Libvirt when trying to select TDX firmware with `os_secure-boot\u003drequired`:\n\n```\nDomain restricts pflash programming to SMM, but firmware \u0027/usr/share/qemu/firmware/60-edk2-x86_64-inteltdx.json\u0027 doesn\u0027t support SMM\n```","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"89ee48f6001299a44cdcdef2a9fd4e8f35c30281","unresolved":true,"context_lines":[{"line_number":7967,"context_line":"        # NOTE(antia)"},{"line_number":7968,"context_line":"        # https://github.com/canonical/tdx/commit/a6216d1eeea8140f9db242d74ebc99c54071535f"},{"line_number":7969,"context_line":"        guest.os_loader_readonly \u003d True"},{"line_number":7970,"context_line":"        # NOTE(antia) Intel TDX firmware does not have SMM support but can be"},{"line_number":7971,"context_line":"        # packaged with secure boot. Loader with secure enabled forces SMM and"},{"line_number":7972,"context_line":"        # thus conflicts and prevents firmware auto-discovery. TDX doesn\u0027t use"},{"line_number":7973,"context_line":"        # pflash and thus there is nothing for SMM to protect. A consequence of"},{"line_number":7974,"context_line":"        # this is that the secure-boot option is ignored since os_loader_secure"},{"line_number":7975,"context_line":"        # controls both."},{"line_number":7976,"context_line":"        guest.os_loader_secure \u003d None"},{"line_number":7977,"context_line":""},{"line_number":7978,"context_line":"    def _guest_add_mdevs(self, guest, chosen_mdevs):"},{"line_number":7979,"context_line":"        for chosen_mdev in chosen_mdevs:"}],"source_content_type":"text/x-python","patch_set":3,"id":"6c51c182_97707a53","line":7976,"range":{"start_line":7970,"start_character":0,"end_line":7976,"end_character":37},"in_reply_to":"ef4de008_37f76c55","updated":"2026-08-21 15:24:21.000000000","message":"but i cannot see this is fixed, we still set it to guest.os_loader_secure \u003d None even os_secure_boot\u003drequired. did i miss anything?","commit_id":"2a44070da4a9111d01d5de11c06f62f477dcd72f"}]}