From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 4ED381FF0B0 for ; Tue, 27 Oct 2026 11:13:03 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id F213D216E1; Tue, 27 Oct 2026 11:12:29 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1793095925; bh=+Y9ElMZ5xa5hrRASettndDM9g1FTdRbEN2zdeRmluhs=; h=Date:From:To:Subject:From; b=FDUgUsAoy1QGOKETuQibNyTpm2AS9ILWNdrQ+65tR6oZCUWsn4yRDhhOSzkmdK/x+ lgobtwr1HIJQrOKCWngKjLcbPO62W/tr3/AxIJjSXYN8zmCm3Eh3Ty93DlP3YRq9dY yJn+M+aAfQ5EqWNN+rgreWH1xsl4MpHyENq2u2rh5DIgZMj/qwJLHLsw1qG2dYHDhB sH7GNXQuIW40yLZ/HJGXX/0UDjbBQ6gVh4VbgZE7xj9A4WUS9GP3sRY1v8P5kYqXux Ixq5W8AIfDYZiaZkE38NYVE/lx6D8HIYn9mmDo2xjUFttkROQsDcIBCIsvAlmSw1zy r2B9buUVfvHIg== Date: Tue, 27 Oct 2026 11:12:04 +0100 From: Christian Ludwig To: Subject: [PATCH v3 00/19] Support for custom EFI firmware Message-ID: MIME-Version: 1.0 X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta09.win.genua.de (10.208.16.109) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline X-SPAM-LEVEL: Spam detection results: 0 AWL 0.075 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: JHAXHWYX4JXX6CHCRCYDD7IDOZIYK4PH X-Message-ID-Hash: JHAXHWYX4JXX6CHCRCYDD7IDOZIYK4PH X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi, here is an updated patch series that brings support for custom UEFI firmware images. You can find the v2 series at [1] and v1 series at [2] for reference. In Confidential Computing the aim is to not trust the hypervisor, yet it runs its bundled firmware in each VM. Some VM appliances also ship their own firmware images. This series allows to bring your own firmware for OVMF based VMs. Today the Proxmox-VE API allows to import a custom efidisk0 (EFIVAR) already. EFI firmware and EFIVAR data have to match. Otherwise, the VM might not boot anymore. Therefore, with this series you can set a custom EFI firmware via the API, along with a custom efidisk. But these are two steps. And there is no safety net. The GUI is missing a way to set a custom EFIVAR. So this series only allows to set a custom firmware image for confidential computing VMs that do not need EFIVAR storage. The defaults do not change. The changes in detail: pve-storage: - declares the new 'efi-firmware' content type for file based storage - provides upload/download API. File names are restricted to the safe character set, because they are used as sub-properties in the GUI. File extensions are restricted to '.fd'. So the efi-firmware storage can host other types as well in the future. qemu-server: - extends the 'bios' property with an optional 'firmware' sub-property with an efi-firmware storage location. - the 'firmware' sub-property is only allowed to be set for OVMF based VMs. - adds API plumbing pve-manager: - adds UI plumbing for the 'efi-firmware' storage content type - extends the BIOS chooser dialog with an 'OVMF (custom)' option to select the firmware sub-property. - restricts custom firmware selection to confidential computing VMs. pve-docs: - adds a custom firmware subsection in the BIOS section Changes in v3: - rebased on current master for all repositories - turn 'bios' into a property-string and make the custom firmware its 'firmware' sub-property (bios: ovmf,firmware=), instead of a separate 'efi-firmware' VM config key (suggested by Fiona) - restrict firmware file names to the '.fd' extension (suggested by Fiona) - validate uploaded and downloaded images as raw (suggested by Fiona) - support efi-firmware volumes in volume export/import (suggested by Fiona) - clearer errors when a configured firmware image is not usable on the node, e.g. for templates or restored VMs - UI: refuse migration with a local custom firmware image - docs: describe migration, replication, templates and backups Tests and feedback welcome. - Christian [1] https://lore.proxmox.com/pve-devel/cover.1790337423.git@genua.de/ [2] https://lore.proxmox.com/pve-devel/20260817115919.abQyMsVBJeHupthBjG6HbiJWe2o8RfIy9CmAttembto@z/