From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id BF2991FF0B0 for ; Tue, 27 Oct 2026 11:15:18 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D78DC2185B; Tue, 27 Oct 2026 11:13:35 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1793095956; bh=+iz4g68SnDQbZffThODWw2mOAE3zzRd8q5jW0C8qaPc=; h=Date:From:To:Subject:References:In-Reply-To:From; b=LlbP2sxTGN3f7orHby4WXdTDyrZamg4HPB6aACvp6L1jXJVobMX8N+5ZLBkvaI7lA ffKwzwf89lktxIxdtKb0nZDf8f75CwIIwphPx/YqfzBKLuIKpfoNiSOErLI/rrVdBW n/3SnGB5GWx0+7/2mGamMWWRPUew3PKCmg8J6r4k+kaBnB1HI5+fc9U7tFO8eMHAg+ ZOq23PzGfr9HmEzU+xFnFYlz8WuP2izvIDgAtApoHg0a8UyoDlDQDUzZlMmETdYP/l YST0lzSPF9Y6u3fH4+UdMxs3xg+HaKvl9270vAwJvGMvOdtcYxmmQ0dN8EgvpcVB2R Ol4XVJ4tQ+nZg== Date: Tue, 27 Oct 2026 11:12:34 +0100 From: Christian Ludwig To: Subject: [PATCH pve-manager v3 16/19] ui: qemu: allow selecting a custom EFI firmware image Message-ID: References: MIME-Version: 1.0 In-Reply-To: X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta08.win.genua.de (10.208.16.108) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline X-SPAM-LEVEL: Spam detection results: 0 AWL 0.063 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: ORZTKXEDBVCDWRJQ6I4IYMVIQR7G3BWT X-Message-ID-Hash: ORZTKXEDBVCDWRJQ6I4IYMVIQR7G3BWT X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Offer a custom EFI firmware image in the BIOS editor, as it is the 'firmware' sub-property of the 'bios' setting. The BIOS selector gains an 'ovmf-custom' pseudo value, which maps to 'bios=ovmf,firmware=' and reveals a storage and image selector. Choosing any other BIOS drops the sub-property. The 'bios' hardware row shows a custom image as 'OVMF (custom), firmware='. Add helpers to parse and print the 'bios' property-string and use them wherever the BIOS type is compared. The image replaces the OVMF code image without touching the EFI vars store, so only offer it for guests that load the firmware read-only via '-bios' and have no vars store, i.e. confidential VMs. The API stays general, so an image that is already set is always shown and can be cleared, with a hint about the vars store when an EFI disk exists. Signed-off-by: Christian Ludwig --- www/manager6/Parser.js | 8 ++ www/manager6/Utils.js | 2 + www/manager6/form/QemuBiosSelector.js | 22 ++++- www/manager6/qemu/Architecture.js | 4 +- www/manager6/qemu/BootOrderEdit.js | 2 +- www/manager6/qemu/HardwareView.js | 36 ++++++- www/manager6/qemu/QemuBiosEdit.js | 131 ++++++++++++++++++++------ 7 files changed, 164 insertions(+), 41 deletions(-) diff --git a/www/manager6/Parser.js b/www/manager6/Parser.js index 36df8e9d..ab4a04e7 100644 --- a/www/manager6/Parser.js +++ b/www/manager6/Parser.js @@ -457,6 +457,14 @@ Ext.define('PVE.Parser', { return arr.join(','); }, + parseQemuBios: function (value) { + return PVE.Parser.parsePropertyString(value, 'type') ?? {}; + }, + + printQemuBios: function (bios) { + return PVE.Parser.printPropertyString(bios, 'type'); + }, + parseQemuSmbios1: function (value) { let res = value.split(',').reduce((acc, currentValue) => { const [k, v] = currentValue.split(/[=](.+)/); diff --git a/www/manager6/Utils.js b/www/manager6/Utils.js index e83d87ff..11f6d15c 100644 --- a/www/manager6/Utils.js +++ b/www/manager6/Utils.js @@ -552,6 +552,8 @@ Ext.define('PVE.Utils', { return 'SeaBIOS'; } else if (value === 'ovmf') { return 'OVMF (UEFI)'; + } else if (value === 'ovmf-custom') { + return gettext('OVMF (custom)'); } else { return value; } diff --git a/www/manager6/form/QemuBiosSelector.js b/www/manager6/form/QemuBiosSelector.js index 40abb589..62f67e32 100644 --- a/www/manager6/form/QemuBiosSelector.js +++ b/www/manager6/form/QemuBiosSelector.js @@ -2,13 +2,25 @@ Ext.define('PVE.form.QemuBiosSelector', { extend: 'PVE.form.FilteredKVComboBox', alias: ['widget.pveQemuBiosSelector'], - comboItems: [ - ['__default__', PVE.Utils.render_qemu_bios('')], - ['seabios', PVE.Utils.render_qemu_bios('seabios')], - ['ovmf', PVE.Utils.render_qemu_bios('ovmf')], - ], + withCustomFirmware: false, allowedValuesPerCategory: PVE.qemu.Architecture.allowedFirmware, setDefaultDisplay: (arch) => PVE.Utils.render_qemu_bios('', arch), + + initComponent: function () { + let me = this; + + me.comboItems = [ + ['__default__', PVE.Utils.render_qemu_bios('')], + ['seabios', PVE.Utils.render_qemu_bios('seabios')], + ['ovmf', PVE.Utils.render_qemu_bios('ovmf')], + ]; + + if (me.withCustomFirmware) { + me.comboItems.push(['ovmf-custom', PVE.Utils.render_qemu_bios('ovmf-custom')]); + } + + me.callParent(); + }, }); diff --git a/www/manager6/qemu/Architecture.js b/www/manager6/qemu/Architecture.js index 7b6ef402..6db8f02e 100644 --- a/www/manager6/qemu/Architecture.js +++ b/www/manager6/qemu/Architecture.js @@ -63,8 +63,8 @@ Ext.define('PVE.qemu.Architecture', { }, allowedFirmware: { - x86_64: ['__default__', 'seabios', 'ovmf'], // default is seabios - aarch64: ['ovmf'], + x86_64: ['__default__', 'seabios', 'ovmf', 'ovmf-custom'], // default is seabios + aarch64: ['ovmf', 'ovmf-custom'], }, render_vcpu_architecture: function (value) { diff --git a/www/manager6/qemu/BootOrderEdit.js b/www/manager6/qemu/BootOrderEdit.js index 6239aeca..1df37243 100644 --- a/www/manager6/qemu/BootOrderEdit.js +++ b/www/manager6/qemu/BootOrderEdit.js @@ -46,7 +46,7 @@ Ext.define('PVE.qemu.BootOrderPanel', { emptyWarning.setHidden(val !== ''); let showRngPxeWarning = - view.vmconfig?.bios === 'ovmf' && + PVE.Parser.parseQemuBios(view.vmconfig?.bios).type === 'ovmf' && !view.vmconfig?.rng0 && val?.includes('net'); diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js index f7f4b46f..356b3c98 100644 --- a/www/manager6/qemu/HardwareView.js +++ b/www/manager6/qemu/HardwareView.js @@ -173,7 +173,17 @@ Ext.define('PVE.qemu.HardwareView', { editor: caps.vms['VM.Config.Options'] ? 'PVE.qemu.BiosEdit' : undefined, defaultValue: '', iconCls: 'microchip', - renderer: PVE.Utils.render_qemu_bios, + renderer: function (value) { + let bios = PVE.Parser.parseQemuBios(value); + if (bios.firmware) { + return ( + PVE.Utils.render_qemu_bios('ovmf-custom') + + ', firmware=' + + Ext.htmlEncode(bios.firmware) + ); + } + return PVE.Utils.render_qemu_bios(bios.type); + }, }, vga: { header: gettext('Display'), @@ -280,6 +290,12 @@ Ext.define('PVE.qemu.HardwareView', { affinity: { visible: false, }, + 'amd-sev': { + visible: false, + }, + 'intel-tdx': { + visible: false, + }, }; PVE.Utils.forEachBus(undefined, function (type, id) { @@ -461,6 +477,20 @@ Ext.define('PVE.qemu.HardwareView', { }, }; + if (rec.data.key === 'bios') { + // A custom EFI firmware image replaces the OVMF code image without touching + // the EFI vars store. Only offer when EFI vars are not necessary, i.e. for + // confidential VMs. Also offer when one is set already. + let value = (key) => me.getObjectValue(key, undefined, true); + let cvmType = + PVE.Parser.parsePropertyString(value('amd-sev'), 'type')?.type ?? + PVE.Parser.parsePropertyString(value('intel-tdx'), 'type')?.type; + + commonOpts.withCustomFirmware = + ['snp', 'tdx'].includes(cvmType) || + !!PVE.Parser.parseQemuBios(value('bios')).firmware; + } + if (Ext.isString(editor)) { Ext.create(editor, commonOpts); } else { @@ -709,7 +739,9 @@ Ext.define('PVE.qemu.HardwareView', { autoShow: true, url: '/api2/extjs/' + baseurl, pveSelNode: me.pveSelNode, - usesEFI: bios?.value === 'ovmf' || bios?.pending === 'ovmf', + usesEFI: [bios?.value, bios?.pending].some( + (value) => PVE.Parser.parseQemuBios(value).type === 'ovmf', + ), listeners: { destroy: () => me.reload(), }, diff --git a/www/manager6/qemu/QemuBiosEdit.js b/www/manager6/qemu/QemuBiosEdit.js index a637ed25..3602c1f5 100644 --- a/www/manager6/qemu/QemuBiosEdit.js +++ b/www/manager6/qemu/QemuBiosEdit.js @@ -1,9 +1,12 @@ -Ext.define('PVE.qemu.BiosEdit', { - extend: 'Proxmox.window.Edit', - alias: 'widget.pveQemuBiosEdit', +Ext.define('PVE.qemu.BiosInputPanel', { + extend: 'Proxmox.panel.InputPanel', + xtype: 'pveQemuBiosInputPanel', onlineHelp: 'qm_bios_and_uefi', - subject: 'BIOS', + + nodename: undefined, + + withCustomFirmware: false, viewModel: { data: { @@ -12,38 +15,91 @@ Ext.define('PVE.qemu.BiosEdit', { }, formulas: { showEFIDiskHint: (get) => get('bios') === 'ovmf' && !get('efidisk0'), + customFirmware: (get) => get('bios') === 'ovmf-custom', + // the vars store of an existing EFI disk is kept as it is, so it can go out of sync + showVarStoreHint: (get) => get('bios') === 'ovmf-custom' && !!get('efidisk0'), }, }, - items: [ - { - xtype: 'pveQemuBiosSelector', - onlineHelp: 'qm_bios_and_uefi', - name: 'bios', - value: '__default__', - bind: { - value: '{bios}', - category: '{arch}', + onGetValues: function (values) { + // the custom firmware is a sub-property of 'bios', so it is dropped with any other choice + if (values.bios === 'ovmf-custom') { + values.bios = PVE.Parser.printQemuBios({ type: 'ovmf', firmware: values.firmware }); + } + delete values.firmware; + + return values; + }, + + initComponent: function () { + let me = this; + + me.items = [ + { + xtype: 'pveQemuBiosSelector', + onlineHelp: 'qm_bios_and_uefi', + name: 'bios', + value: '__default__', + withCustomFirmware: me.withCustomFirmware, + bind: { + value: '{bios}', + category: '{arch}', + }, + fieldLabel: 'BIOS', }, - fieldLabel: 'BIOS', - }, - { - xtype: 'displayfield', - name: 'efidisk0', - bind: '{efidisk0}', - hidden: true, - }, - { - xtype: 'displayfield', - userCls: 'pmx-hint', - value: gettext( - 'You need to add an EFI disk for storing the EFI settings. See the online help for details.', - ), - bind: { - hidden: '{!showEFIDiskHint}', + { + xtype: 'displayfield', + name: 'efidisk0', + bind: '{efidisk0}', + hidden: true, }, - }, - ], + { + xtype: 'displayfield', + userCls: 'pmx-hint', + value: gettext( + 'You need to add an EFI disk for storing the EFI settings. See the online help for details.', + ), + bind: { + hidden: '{!showEFIDiskHint}', + }, + }, + { + xtype: 'pveIsoSelector', + name: 'firmware', + storageContent: 'efi-firmware', + fileLabel: gettext('Firmware Image'), + nodename: me.nodename, + hidden: true, + disabled: true, + bind: { + hidden: '{!customFirmware}', + disabled: '{!customFirmware}', + }, + }, + { + xtype: 'displayfield', + userCls: 'pmx-hint', + value: gettext( + 'Note: The EFI disk keeps its vars store, which needs to match the custom firmware, otherwise the guest might not boot.', + ), + bind: { + hidden: '{!showVarStoreHint}', + }, + }, + ]; + + me.callParent(); + }, +}); + +Ext.define('PVE.qemu.BiosEdit', { + extend: 'Proxmox.window.Edit', + alias: 'widget.pveQemuBiosEdit', + + onlineHelp: 'qm_bios_and_uefi', + subject: 'BIOS', + + withCustomFirmware: false, initComponent: function () { let me = this; @@ -54,6 +110,14 @@ Ext.define('PVE.qemu.BiosEdit', { throw 'no nodename given'; } + me.items = [ + { + xtype: 'pveQemuBiosInputPanel', + nodename: me.nodename, + withCustomFirmware: me.withCustomFirmware, + }, + ]; + me.callParent(); if (!me.isCreate) { @@ -61,6 +125,11 @@ Ext.define('PVE.qemu.BiosEdit', { success: function ({ result }) { let values = result.data; let arch = PVE.qemu.Architecture.getGuestArchitecture(values.arch, me.nodename); + if (values.bios) { + let bios = PVE.Parser.parseQemuBios(values.bios); + values.bios = bios.firmware ? 'ovmf-custom' : bios.type; + values.firmware = bios.firmware; + } me.setValues(values); me.down('pveQemuBiosSelector').setCategory(arch); }, -- 2.34.1