From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 5F2EC1FF09B for ; Mon, 28 Sep 2026 07:48:36 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4A35C216EA; Mon, 28 Sep 2026 07:48:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1790574466; bh=XvGQfTNVhyWzm5iGHIC6cO0r2fpc7iY7qCnjlZF2pE0=; h=Date:From:To:Subject:From; b=OX3sZv86MrpAcyuh3lK0PcH0ONthFKf4w5dnIVj/IxtKj0XE8HkzWv+tgl41pzPLs CRcS61FHdIn3x2zw6QhKwLHfrKC2YfeztAX0CbEQDQjL1Y00Q4oYyfyFlKtpJAKvzy R0EX0gOPEKumt3FhjQfTe9KFtGGWvLZnzra2K7NAFzZQAQydN7MB8WwnCP7f2LA01c enmVmrZkHwbZ7HSH0ltakk5/jDYASA0c50vr3wVnWklqMEuXrUmA1DPMBbjYuVoo3r cKj/w+fKTXg4OOR4sF6SgyM8D4aRSNAMLZxJbLrZS+6u7Ds7Rb4AI7gtMItaQ2Tm3P /91e4rb/iCRVg== Date: Mon, 28 Sep 2026 07:47:44 +0200 From: Christian Ludwig To: Subject: [PATCH v2 0/16] Support for custom EFI firmware Message-ID: MIME-Version: 1.0 X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta08.win.genua.de (10.208.16.108) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline X-SPAM-LEVEL: Spam detection results: 0 AWL 0.099 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: O5CDR742WYORHFJ5XAGFC3VVBJLSEX6W X-Message-ID-Hash: O5CDR742WYORHFJ5XAGFC3VVBJLSEX6W X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi, here is an updated patch series that brings support for custom UEFI firmware images. You can find the v1 series at [1] for reference. In Confidential Computing the aim is to not trust the hypervisor, yet it runs its bundled firmware in each VM. Some VM appliances also ship their own firmware images. This series allows to bring your own firmware for OVMF based VMs. Today the Proxmox-VE API allows to import a custom efidisk0 (EFIVAR) already. EFI firmware and EFIVAR data have to match. Otherwise, the VM might not boot anymore. Therefore, with this series you can set a custom EFI firmware via the API, along with a custom efidisk. But these are two steps. And there is no safety net. The GUI is missing a way to set a custom EFIVAR. So this series only allows to set a custom firmware image for confidential computing VMs that do not need EFIVAR storage. The defaults do not change. The changes in detail: pve-storage: - declares the new 'efi-firmware' content type for file based storage - provides upload/download API. There is no limit in file names, besides the usual safe character class qemu-server: - adds a 'efi-firmware' config key that can point to 'efi-firmware' storage content - that config key is only allowed to be set for OVMF based VMs - adds API plumbing pve-manager: - adds UI plumbing for the 'efi-firmware' storage content type - extends the BIOS chooser dialog with an 'OVMF (custom)' option pve-docs: - adds a custom firmware subsection in the BIOS section Note that you choose the cutom firmware from the BIOS dialog in the GUI, therefore the 'efi-firmware' config key has the 'VM.Config.Options' permission. The same as the BIOS option that the dialog hosts already. Changes from v1: - GUI additions - Move 'efi-firmware' VM config option permissions from 'VM.Config.HWType' to 'VM.Config.Options' - some cleanups Tests and feedback welcome. - Christian [1] https://lore.proxmox.com/pve-devel/20260817115919.abQyMsVBJeHupthBjG6HbiJWe2o8RfIy9CmAttembto@z/