From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 0ED501FF0A7 for ; Mon, 17 Aug 2026 14:00:00 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D762223D8B; Mon, 17 Aug 2026 13:59:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1786967960; bh=MVIEgvm8K24fhcEC1rtSYQaBXGK9yM1bg1J+vtUlEfM=; h=Date:From:To:Subject:From; b=OQwJ9g3rB7BpEpS+DSwLJ2oDskbm858WT47AZLyw6phKBF65TC7TjshNPo1kSt9J1 eV4zJBm9QKODusOJ2dgU4eg9GwmLBpZBAx36N619Bi+EpUbktBLOdDgRSBHwxUHI5z s9yM0czefTttB3ngso+VckhxWYziOCiSTm4D88Zm3kRwsAqtdjRbgCcGkGfGPes4xl cSHEGrFwDh3axq7tk6OCZLG2g24uspQTBfweAzjOEBiyOrvIcZp1+ewk389HilSfT4 NKCQo148YPAo53W0ZTSJbMbshkgVX7e37CostXCHyvEjiEJPMvPIcf5FfIqAnbybL+ 9vddDNE1/BlvA== Date: Mon, 17 Aug 2026 13:59:19 +0200 From: Christian Ludwig To: Subject: [PATCH storage/qemu 0/13]: Custom UEFI firmware in PVE Message-ID: MIME-Version: 1.0 X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta09.win.genua.de (10.208.16.109) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----101970C4E68969C82CA8234C8538041A" X-SPAM-LEVEL: Spam detection results: 0 AWL 0.192 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: 3VHVBY22G2OLGRDCLIVLWTKU5BL6UJD2 X-Message-ID-Hash: 3VHVBY22G2OLGRDCLIVLWTKU5BL6UJD2 X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Message-ID: <20260817115919.abQyMsVBJeHupthBjG6HbiJWe2o8RfIy9CmAttembto@z> ------101970C4E68969C82CA8234C8538041A Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline Hi, this series brings initial support for custom UEFI firmware to PVE. This is useful for confidential computing workloads, where VMs may bring their own firmware and not rely on the hypervisor's. There is also some other software around that ships it's own VM firmware. The firmware needs to be compatible to KVM/Qemu, of course. See the design discussion earlier at [1]. The first part of the series brings a new storage content type for EFI firmware, which can be set on directory-based storage. There is no restriction on the actual firmware file's name. The second part brings new 'efi-firmware' VM config key allows Qemu to use a file from a storage with that new content type, instead of the default firmware. To reduce complexity, this only works with bios=ovmf. This feature is only configurable from the API. The GUI parts were left out on purpose. I am unsure how much we want/need to expose there in the first place. We have tested this with custom UEFI firmware in AMD SEV/SNP confidential VMs. - Christian [1] https://lore.proxmox.com/pve-devel/10513e3f2c0d94bc938a540b4a0a18749eb5ed96.camel@genua.de/ ------101970C4E68969C82CA8234C8538041A--