[pve-devel] [PATCH edk2-firmware/manager/qemu-server v2 0/7] Add support for Intel TDX

[Anton Iacobaeus]

This patch series adds support for launching Intel TDX confidential VMs
via QEMU. Attestation will be covered in another patch.

Intel TDX requires QEMU >= v10.1 and kernel >= 6.16. A TDX compatible
CPU is also required, with TDX enabled in BIOS.

Thanks to Thomas for the review.

Changes since v1 https://lists.proxmox.com/pipermail/pve-devel/2025-September/075218.html
* Added symlinks to OVMF_CVM_* firmware targets for backward compatibility
* Dropped 4th patch to pve-edk2-firmware, the problem has been resolved by QEMU in v10.1
  See https://github.com/intel-staging/qemu-tdx/commit/f77516360fd2a3306fb9b33b268f50cc301913c7
* Reworked error handling for MSR reading

pve-edk2-firmware:

Philipp Giersfeld (3):
  Change name of SEV-related OVMF files
  Add firmware target for TDFV
  Add SCSI in NCCFV for TD guest

 .../patches/Enable_SCSI_IntelTdx_DXEFV.patch  | 52 ++++++++++++++++
 debian/patches/series                         |  1 +
 debian/pve-edk2-firmware-ovmf.install         |  7 ++-
 debian/pve-edk2-firmware-ovmf.links           |  3 +
 debian/rules                                  | 59 +++++++++++++------
 5 files changed, 100 insertions(+), 22 deletions(-)
 create mode 100644 debian/patches/Enable_SCSI_IntelTdx_DXEFV.patch
 create mode 100644 debian/pve-edk2-firmware-ovmf.links

pve-manager:

Philipp Giersfeld (1):
  Add support for Intel TDX

 www/manager6/Makefile        |  1 +
 www/manager6/qemu/Options.js | 12 +++++
 www/manager6/qemu/TdxEdit.js | 90 ++++++++++++++++++++++++++++++++++++
 3 files changed, 103 insertions(+)
 create mode 100644 www/manager6/qemu/TdxEdit.js
 
qemu-server:

Philipp Giersfeld (3):
  Adapt AMD SEV code for compatibility with other platforms
  Add check for TDX support
  Add support for Intel TDX

 src/PVE/API2/Qemu.pm                          |  6 +-
 src/PVE/QemuMigrate/Helpers.pm                |  1 +
 src/PVE/QemuServer.pm                         | 27 +++++-
 src/PVE/QemuServer/CPUConfig.pm               | 46 +++++++--
 src/PVE/QemuServer/OVMF.pm                    | 51 ++++++----
 .../query-machine-capabilities.c              | 97 ++++++++++++++++---
 src/test/cfg2cmd/sev-es.conf.cmd              |  2 +-
 src/test/cfg2cmd/sev-snp.conf.cmd             |  2 +-
 src/test/cfg2cmd/sev-std.conf.cmd             |  2 +-
 src/usr/modules-load.conf                     |  1 +
 10 files changed, 184 insertions(+), 51 deletions(-)
 
-- 
2.43.0