From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id F09C21FF16F for ; Tue, 16 Sep 2025 11:13:11 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 218D2E3E1; Tue, 16 Sep 2025 11:13:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1758009424; x=1758614224; d=canarybit.eu; s=rsa1; h=content-transfer-encoding:mime-version:message-id:date:subject:cc:to:from: from; bh=a2DzP+5SIMM5pkcdXdsaC+2A+pE3EcRXAO61K59cwDQ=; b=aeRdzGLwIPFhLhp4fszYDn2ZMd8IZt4q4GmgEeTZcaAcmMf5c7iIpT2YrHZzhq6OiJyjzOa7FMye7 S2rB5hY9qGPMkTRLxX2DzptQM2eWZpM385gB1o6+kXpQCCKmu6NEgCT1vWJQRCpSum5ZOBoX4/zrCD eYGpAgPcFxcYS2YYjQWtUFW/eKe6exHes13FkyxbFt3obs+zPgLwgnWJ6AK8bHB4jDP38+teWQvD4v oNGQBy0hvsSrJWqCstHYQNuGKEtJhoSQiEt58/K4Dookwyt4l3bik9Ye2HRg1LilqDL/TrcktJ+qsb 7mkovpi7v+EkoAYM0JKnzA+PSpIlH1Q== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; t=1758009424; x=1758614224; d=canarybit.eu; s=ed1; h=content-transfer-encoding:mime-version:message-id:date:subject:cc:to:from: from; bh=a2DzP+5SIMM5pkcdXdsaC+2A+pE3EcRXAO61K59cwDQ=; b=RLrTRTCaj6PXboQRwDucTDQ7VvzHjW7pTKuGUfr14BYIRuE3aVWwcPZubvdfcDuSPz/VZeZq2E+I3 MzAKrniAw== X-HalOne-ID: b53eca29-92d2-11f0-83fe-494313b7f784 From: Anton Iacobaeus To: pve-devel@lists.proxmox.com Date: Tue, 16 Sep 2025 09:52:44 +0200 Message-ID: <20250916075406.33084-2-anton.iacobaeus@canarybit.eu> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 BAYES_00 -1.9 Bayes spam probability is 0 to 1% DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_MISSING 0.1 Missing DMARC policy RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_NONE 0.001 SPF: sender does not publish an SPF Record X-Mailman-Approved-At: Tue, 16 Sep 2025 11:13:12 +0200 Subject: [pve-devel] [PATCH edk2-firmware/manager/qemu-server 0/8] Add support for Intel TDX X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Cc: Anton Iacobaeus Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" This patch series adds support for launching Intel TDX confidential VMs via QEMU. Attestation will be covered in another patch. Intel IDX requires QEMU >= v10.1 and kernel >= 6.16. A TDX compatible CPU is also required, with TDX enabled in BIOS. qemu-server will not build without the changes to edk2-firmware. This is based on the work by Philipp Giersfeld. pve-edk2-firmware: Philipp Giersfeld (4): Change name of SEV-related OVMF files Add firmware target for TDFV Add SCSI in NCCFV for TD guest Adapt APIC frequency for TD guest ...to-match-the-one-advertised-by-TDX-m.patch | 27 +++++++++ .../patches/Enable_SCSI_IntelTdx_DXEFV.patch | 52 +++++++++++++++++ debian/patches/series | 2 + debian/pve-edk2-firmware-ovmf.install | 7 ++- debian/rules | 57 ++++++++++++------- 5 files changed, 123 insertions(+), 22 deletions(-) create mode 100644 debian/patches/Adapt-Frequency-to-match-the-one-advertised-by-TDX-m.patch create mode 100644 debian/patches/Enable_SCSI_IntelTdx_DXEFV.patch pve-manager: Philipp Giersfeld (1): Add support for Intel TDX www/manager6/Makefile | 1 + www/manager6/qemu/Options.js | 12 +++++ www/manager6/qemu/TdxEdit.js | 90 ++++++++++++++++++++++++++++++++++++ 3 files changed, 103 insertions(+) create mode 100644 www/manager6/qemu/TdxEdit.js qemu-server: Philipp Giersfeld (3): Adapt AMD SEV code for compatibility with other platforms Add check for TDX support Add support for Intel TDX src/PVE/API2/Qemu.pm | 6 +- src/PVE/QemuMigrate/Helpers.pm | 1 + src/PVE/QemuServer.pm | 27 +++++++-- src/PVE/QemuServer/CPUConfig.pm | 46 ++++++++++++--- src/PVE/QemuServer/OVMF.pm | 51 ++++++++++------- .../query-machine-capabilities.c | 56 ++++++++++++++++++- src/test/cfg2cmd/sev-es.conf.cmd | 2 +- src/test/cfg2cmd/sev-snp.conf.cmd | 2 +- src/test/cfg2cmd/sev-std.conf.cmd | 2 +- src/usr/modules-load.conf | 1 + 10 files changed, 155 insertions(+), 39 deletions(-) -- 2.43.0 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel