See https://github.com/AMDESE/AMDSEV/issues/236 , too.
** Description changed:
- The firmware descriptor file installed by the current ovmf package
- contains the following content.
+ The firmware descriptor file installed by the current ovmf-amdsev
+ package (2025.11-3ubuntu7) contains the following content.
/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
---
{
- "description": "UEFI firmware for x86_64, with SEV-ES support",
- "interface-types": [
- "uefi"
- ],
- "mapping": {
- "device": "flash",
- "mode": "stateless",
- "executable": {
- "filename": "/usr/share/ovmf/OVMF.amdsev.fd",
- "format": "raw"
- }
- },
- "targets": [
- {
- "architecture": "x86_64",
- "machines": [
- "pc-q35-*"
- ]
- }
- ],
- "features": [
- "amd-sev",
- "amd-sev-es",
- "amd-sev-snp",
- "verbose-dynamic"
- ],
- "tags": [
+ "description": "UEFI firmware for x86_64, with SEV-ES support",
+ "interface-types": [
+ "uefi"
+ ],
+ "mapping": {
+ "device": "flash",
+ "mode": "stateless",
+ "executable": {
+ "filename": "/usr/share/ovmf/OVMF.amdsev.fd",
+ "format": "raw"
+ }
+ },
+ "targets": [
+ {
+ "architecture": "x86_64",
+ "machines": [
+ "pc-q35-*"
+ ]
+ }
+ ],
+ "features": [
+ "amd-sev",
+ "amd-sev-es",
+ "amd-sev-snp",
+ "verbose-dynamic"
+ ],
+ "tags": [
- ]
+ ]
}
---
Although "amd-sev-snp" appears in its feature list, this descriptor is not
compatible with SEV-SNP because only the rom type firmware is accepted.
To allow SEV-SNP instances launch properly, the mapping field should be
updated to:
---
- ...
- "mapping": {
- "device": "memory",
- "filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd"
+ ...
+ "mapping": {
+ "device": "memory",
+ "filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd"
- },
- ...
+ },
+ ...
---
Note:
That "device": "memory" is the flag to tell libvirt to use the -bios option
in qemu, which is described in the qemu command line example in
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
.
** Description changed:
The firmware descriptor file installed by the current ovmf-amdsev
package (2025.11-3ubuntu7) contains the following content.
/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
---
{
"description": "UEFI firmware for x86_64, with SEV-ES support",
"interface-types": [
"uefi"
],
"mapping": {
"device": "flash",
"mode": "stateless",
"executable": {
"filename": "/usr/share/ovmf/OVMF.amdsev.fd",
"format": "raw"
}
},
"targets": [
{
"architecture": "x86_64",
"machines": [
"pc-q35-*"
]
}
],
"features": [
"amd-sev",
"amd-sev-es",
"amd-sev-snp",
"verbose-dynamic"
],
"tags": [
]
}
---
Although "amd-sev-snp" appears in its feature list, this descriptor is not
compatible with SEV-SNP because only the rom type firmware is accepted.
- To allow SEV-SNP instances launch properly, the mapping field should be
updated to:
+ When an instance is created with SEV-SNP encryption and libvirt selects this
firmware, qemu fails to start due to the error "pflash with kvm requires KVM
readonly memory support".
+
+ To allow SEV-SNP instances launch properly, the mapping field should be
+ updated to:
---
...
"mapping": {
"device": "memory",
"filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd"
},
...
---
Note:
That "device": "memory" is the flag to tell libvirt to use the -bios option
in qemu, which is described in the qemu command line example in
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160129
Title:
Descriptor file for amd-sev is not compatible with SEV-SNP
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2160129/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
