Add an efi-firmware key to the POST/PUT {vmid}/config API endpoint.
It needs VM.Config.HWType permission. And deleting efi-firmware from the
config does not trigger volume cleanup, firmware images are shared.

Note that changing the bios type requires VM.Config.Options permissions.
That should probably move to the VM.Config.HWType permission, too.

Signed-off-by: Christian Ludwig <christian_ludwig@genua.de>
---
 src/PVE/API2/Qemu.pm | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 3320313c..6fc7c1f7 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -818,6 +818,7 @@ my $hwtypeoptions = {
     'watchdog' => 1,
     'audio0' => 1,
     'rng0' => 1,
+    'efi-firmware' => 1,
 };
 
 my $generaloptions = {
@@ -2523,6 +2524,11 @@ my $update_vm_api = sub {
                     print "automatic pinning of machine version failed - $@" if $@;
                 }
                 $conf->{pending}->{$opt} = $param->{$opt};
+            } elsif ($opt eq 'efi-firmware') {
+                PVE::Storage::check_volume_access(
+                    $rpcenv, $authuser, $storecfg, $vmid, $param->{$opt},
+                );
+                $conf->{pending}->{$opt} = $param->{$opt};
             } elsif ($opt eq 'cipassword') {
                 if (!PVE::QemuServer::Helpers::windows_version($conf->{ostype})) {
                     # Same logic as in cloud-init (but with the regex fixed...)
-- 
2.34.1