** Description changed:
+ [ Impact ]
+
+ The firmware descriptor shipped by the ovmf-amdsev package
+ (/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json) advertises the
+ "amd-sev-snp" feature but maps the firmware as a "flash" device in
+ "stateless" mode:
+
+ "mapping": {
+ "device": "flash",
+ "mode": "stateless",
+ "executable": {
+ "filename": "/usr/share/ovmf/OVMF.amdsev.fd",
+ "format": "raw"
+ }
+ },
+
+ AMD SEV/SEV-SNP does not allow code execution from standard read/write
+ pflash memory. SEV-SNP guests require the firmware to be loaded via the
+ QEMU -bios option (i.e. as a stateless ROM image), not through the
+ traditional split pflash architecture.
+
+ Because this descriptor tells libvirt to use pflash, when it selects this
+ firmware for a SEV-SNP instance, QEMU fails to start with:
+
+ pflash with kvm requires KVM readonly memory support
+
+ As a result, SEV-SNP guests cannot be launched with the firmware
+ descriptor provided by the package.
+
+ [ Fix ]
+
+ Change the descriptor mapping to use "device": "memory", which instructs
+ libvirt to load the firmware through QEMU's -bios option instead of
+ pflash:
+
+ "mapping": {
+ "device": "memory",
+ "filename": "/usr/share/ovmf/OVMF.amdsev.fd"
+ },
+
+ The fix is a one-line-intent change to a single JSON descriptor file
+ (debian/descriptors/60-edk2-x86_64-amdsev.json).
+
+ It has been reported and merged in Debian:
+
+ https://salsa.debian.org/qemu-
+ team/edk2/-/commit/cd29050a899b9843835aec07b418931b27a7784a
+
+ This is already fixed in the development release Stonking (edk2
+ 2026.05-2ubuntu1).
+
+ [ Test Plan ]
+
+ On an AMD host with SEV-SNP enabled in firmware and kernel:
+
+ 1. Install the ovmf-amdsev package from -proposed.
+ 2. Confirm the descriptor now maps the firmware as a memory/ROM device:
+
+ grep -A2 '"mapping"'
+ /usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
+
+ It must show "device": "memory" and no "flash"/pflash mapping.
+
+ 3. Define and start a SEV-SNP guest using libvirt (letting libvirt select
+ the firmware automatically via features, or referencing the amdsev
+ firmware). See:
+
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
+
+ 4. Verify the guest boots successfully and QEMU no longer fails with
+ "pflash with kvm requires KVM readonly memory support".
+
+ 5. Inside the guest, confirm SEV-SNP is active, e.g.:
+
+ dmesg | grep -i -E 'sev|snp'
+
+ With the unfixed package, step 4 fails and the guest cannot start.
+
+ [ Where problems could occur ]
+
+ The change only touches the amd-sev firmware descriptor consumed by
+ libvirt/QEMU for AMD SEV/SEV-SNP guests; no firmware binary is rebuilt or
+ modified.
+
+ The switch from "flash" (pflash) to "memory" (-bios) changes how the
+ firmware image is presented to the guest for this specific descriptor.
+ This is the required and expected mode for SEV/SEV-SNP, but if any tooling
+ or automation relied on the previous pflash mapping for the amd-sev
+ firmware, it could observe a behavioural change (e.g. no writable pflash
+ varstore for this firmware). The amd-sev descriptor is only selected for
+ confidential-computing SEV guests, so non-SEV guests and other firmware
+ descriptors are unaffected.
+
+ [ Other Info ]
+
+ Fixed in the development release: edk2 2026.05-2ubuntu1 (LP: #2160129,
+ Fix Released).
+
+ Debian bug/merge: https://salsa.debian.org/qemu-team/edk2/-/merge_requests/29
+ Upstream AMD reference: https://github.com/AMDESE/AMDSEV/issues/236
+
+ -- Original report --
+
The firmware descriptor file installed by the current ovmf-amdsev
package (2025.11-3ubuntu7) contains the following content.
/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
---
{
"description": "UEFI firmware for x86_64, with SEV-ES support",
"interface-types": [
"uefi"
],
"mapping": {
"device": "flash",
"mode": "stateless",
"executable": {
"filename": "/usr/share/ovmf/OVMF.amdsev.fd",
"format": "raw"
}
},
"targets": [
{
"architecture": "x86_64",
"machines": [
"pc-q35-*"
]
}
],
"features": [
"amd-sev",
"amd-sev-es",
"amd-sev-snp",
"verbose-dynamic"
],
"tags": [
]
}
---
Although "amd-sev-snp" appears in its feature list, this descriptor is
not compatible with SEV-SNP. For SEV-SNP instance only the rom type
firmware is accepted, but the descriptor makes libvirt to use pflash
type instead.
When an instance is created with SEV-SNP encryption and libvirt selects
this firmware, qemu fails to start due to the error "pflash with kvm
requires KVM readonly memory support".
To allow SEV-SNP instances launch properly, the mapping field should be
updated to:
---
...
"mapping": {
"device": "memory",
"filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd"
},
...
---
Note:
That "device": "memory" is the flag to tell libvirt to use the -bios option
in qemu, which is described in the qemu command line example in
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
.
** Also affects: edk2-hwe (Ubuntu)
Importance: Undecided
Status: New
** Also affects: edk2 (Ubuntu Resolute)
Importance: Undecided
Status: New
** Also affects: edk2-hwe (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: edk2 (Ubuntu Resolute)
Assignee: (unassigned) => Hector CAO (hectorcao)
** Changed in: edk2-hwe (Ubuntu)
Assignee: (unassigned) => Hector CAO (hectorcao)
** Changed in: edk2-hwe (Ubuntu Resolute)
Assignee: (unassigned) => Hector CAO (hectorcao)
** Description changed:
[ Impact ]
+
+ - Only affect >= Resolute
The firmware descriptor shipped by the ovmf-amdsev package
(/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json) advertises the
"amd-sev-snp" feature but maps the firmware as a "flash" device in
"stateless" mode:
- "mapping": {
- "device": "flash",
- "mode": "stateless",
- "executable": {
- "filename": "/usr/share/ovmf/OVMF.amdsev.fd",
- "format": "raw"
- }
- },
+ "mapping": {
+ "device": "flash",
+ "mode": "stateless",
+ "executable": {
+ "filename": "/usr/share/ovmf/OVMF.amdsev.fd",
+ "format": "raw"
+ }
+ },
AMD SEV/SEV-SNP does not allow code execution from standard read/write
pflash memory. SEV-SNP guests require the firmware to be loaded via the
QEMU -bios option (i.e. as a stateless ROM image), not through the
traditional split pflash architecture.
Because this descriptor tells libvirt to use pflash, when it selects this
firmware for a SEV-SNP instance, QEMU fails to start with:
- pflash with kvm requires KVM readonly memory support
+ pflash with kvm requires KVM readonly memory support
As a result, SEV-SNP guests cannot be launched with the firmware
descriptor provided by the package.
[ Fix ]
Change the descriptor mapping to use "device": "memory", which instructs
libvirt to load the firmware through QEMU's -bios option instead of
pflash:
- "mapping": {
- "device": "memory",
- "filename": "/usr/share/ovmf/OVMF.amdsev.fd"
- },
+ "mapping": {
+ "device": "memory",
+ "filename": "/usr/share/ovmf/OVMF.amdsev.fd"
+ },
The fix is a one-line-intent change to a single JSON descriptor file
(debian/descriptors/60-edk2-x86_64-amdsev.json).
It has been reported and merged in Debian:
https://salsa.debian.org/qemu-
team/edk2/-/commit/cd29050a899b9843835aec07b418931b27a7784a
This is already fixed in the development release Stonking (edk2
2026.05-2ubuntu1).
[ Test Plan ]
On an AMD host with SEV-SNP enabled in firmware and kernel:
1. Install the ovmf-amdsev package from -proposed.
2. Confirm the descriptor now maps the firmware as a memory/ROM device:
- grep -A2 '"mapping"'
+ grep -A2 '"mapping"'
/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
- It must show "device": "memory" and no "flash"/pflash mapping.
+ It must show "device": "memory" and no "flash"/pflash mapping.
3. Define and start a SEV-SNP guest using libvirt (letting libvirt select
- the firmware automatically via features, or referencing the amdsev
- firmware). See:
-
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
+ the firmware automatically via features, or referencing the amdsev
+ firmware). See:
+
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
4. Verify the guest boots successfully and QEMU no longer fails with
- "pflash with kvm requires KVM readonly memory support".
+ "pflash with kvm requires KVM readonly memory support".
5. Inside the guest, confirm SEV-SNP is active, e.g.:
- dmesg | grep -i -E 'sev|snp'
+ dmesg | grep -i -E 'sev|snp'
With the unfixed package, step 4 fails and the guest cannot start.
[ Where problems could occur ]
The change only touches the amd-sev firmware descriptor consumed by
libvirt/QEMU for AMD SEV/SEV-SNP guests; no firmware binary is rebuilt or
modified.
The switch from "flash" (pflash) to "memory" (-bios) changes how the
firmware image is presented to the guest for this specific descriptor.
This is the required and expected mode for SEV/SEV-SNP, but if any tooling
or automation relied on the previous pflash mapping for the amd-sev
firmware, it could observe a behavioural change (e.g. no writable pflash
varstore for this firmware). The amd-sev descriptor is only selected for
confidential-computing SEV guests, so non-SEV guests and other firmware
descriptors are unaffected.
[ Other Info ]
Fixed in the development release: edk2 2026.05-2ubuntu1 (LP: #2160129,
Fix Released).
Debian bug/merge: https://salsa.debian.org/qemu-team/edk2/-/merge_requests/29
Upstream AMD reference: https://github.com/AMDESE/AMDSEV/issues/236
-- Original report --
The firmware descriptor file installed by the current ovmf-amdsev
package (2025.11-3ubuntu7) contains the following content.
/usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json
---
{
"description": "UEFI firmware for x86_64, with SEV-ES support",
"interface-types": [
"uefi"
],
"mapping": {
"device": "flash",
"mode": "stateless",
"executable": {
"filename": "/usr/share/ovmf/OVMF.amdsev.fd",
"format": "raw"
}
},
"targets": [
{
"architecture": "x86_64",
"machines": [
"pc-q35-*"
]
}
],
"features": [
"amd-sev",
"amd-sev-es",
"amd-sev-snp",
"verbose-dynamic"
],
"tags": [
]
}
---
Although "amd-sev-snp" appears in its feature list, this descriptor is
not compatible with SEV-SNP. For SEV-SNP instance only the rom type
firmware is accepted, but the descriptor makes libvirt to use pflash
type instead.
When an instance is created with SEV-SNP encryption and libvirt selects
this firmware, qemu fails to start due to the error "pflash with kvm
requires KVM readonly memory support".
To allow SEV-SNP instances launch properly, the mapping field should be
updated to:
---
...
"mapping": {
"device": "memory",
"filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd"
},
...
---
Note:
That "device": "memory" is the flag to tell libvirt to use the -bios option
in qemu, which is described in the qemu command line example in
https://ubuntu.com/server/docs/how-to/virtualisation/sev-snp/#host-configuration
.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160129
Title:
Descriptor file for amd-sev is not compatible with SEV-SNP
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2160129/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
