This patch series adds support for launching Intel TDX confidential VMs via QEMU. Attestation will be covered in another patch.
Intel IDX requires QEMU >= v10.1 and kernel >= 6.16. A TDX compatible CPU is also required, with TDX enabled in BIOS. qemu-server will not build without the changes to edk2-firmware. This is based on the work by Philipp Giersfeld. pve-edk2-firmware: Philipp Giersfeld (4): Change name of SEV-related OVMF files Add firmware target for TDFV Add SCSI in NCCFV for TD guest Adapt APIC frequency for TD guest ...to-match-the-one-advertised-by-TDX-m.patch | 27 +++++++++ .../patches/Enable_SCSI_IntelTdx_DXEFV.patch | 52 +++++++++++++++++ debian/patches/series | 2 + debian/pve-edk2-firmware-ovmf.install | 7 ++- debian/rules | 57 ++++++++++++------- 5 files changed, 123 insertions(+), 22 deletions(-) create mode 100644 debian/patches/Adapt-Frequency-to-match-the-one-advertised-by-TDX-m.patch create mode 100644 debian/patches/Enable_SCSI_IntelTdx_DXEFV.patch pve-manager: Philipp Giersfeld (1): Add support for Intel TDX www/manager6/Makefile | 1 + www/manager6/qemu/Options.js | 12 +++++ www/manager6/qemu/TdxEdit.js | 90 ++++++++++++++++++++++++++++++++++++ 3 files changed, 103 insertions(+) create mode 100644 www/manager6/qemu/TdxEdit.js qemu-server: Philipp Giersfeld (3): Adapt AMD SEV code for compatibility with other platforms Add check for TDX support Add support for Intel TDX src/PVE/API2/Qemu.pm | 6 +- src/PVE/QemuMigrate/Helpers.pm | 1 + src/PVE/QemuServer.pm | 27 +++++++-- src/PVE/QemuServer/CPUConfig.pm | 46 ++++++++++++--- src/PVE/QemuServer/OVMF.pm | 51 ++++++++++------- .../query-machine-capabilities.c | 56 ++++++++++++++++++- src/test/cfg2cmd/sev-es.conf.cmd | 2 +- src/test/cfg2cmd/sev-snp.conf.cmd | 2 +- src/test/cfg2cmd/sev-std.conf.cmd | 2 +- src/usr/modules-load.conf | 1 + 10 files changed, 155 insertions(+), 39 deletions(-) -- 2.43.0 _______________________________________________ pve-devel mailing list [email protected] https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
