[PATCH pve-manager v3 16/19] ui: qemu: allow selecting a custom EFI firmware image

[Christian Ludwig <christian_ludwig@genua.de>]

Offer a custom EFI firmware image in the BIOS editor, as it is the
'firmware' sub-property of the 'bios' setting. The BIOS selector gains
an 'ovmf-custom' pseudo value, which maps to 'bios=ovmf,firmware=<volid>'
and reveals a storage and image selector. Choosing any other BIOS drops
the sub-property. The 'bios' hardware row shows a custom image as
'OVMF (custom), firmware=<volid>'.

Add helpers to parse and print the 'bios' property-string and use them
wherever the BIOS type is compared.

The image replaces the OVMF code image without touching the EFI vars
store, so only offer it for guests that load the firmware read-only
via '-bios' and have no vars store, i.e. confidential VMs. The API
stays general, so an image that is already set is always shown and can
be cleared, with a hint about the vars store when an EFI disk exists.

Signed-off-by: Christian Ludwig <christian_ludwig@genua.de>
---
 www/manager6/Parser.js                |   8 ++
 www/manager6/Utils.js                 |   2 +
 www/manager6/form/QemuBiosSelector.js |  22 ++++-
 www/manager6/qemu/Architecture.js     |   4 +-
 www/manager6/qemu/BootOrderEdit.js    |   2 +-
 www/manager6/qemu/HardwareView.js     |  36 ++++++-
 www/manager6/qemu/QemuBiosEdit.js     | 131 ++++++++++++++++++++------
 7 files changed, 164 insertions(+), 41 deletions(-)

diff --git a/www/manager6/Parser.js b/www/manager6/Parser.js
index 36df8e9d..ab4a04e7 100644
--- a/www/manager6/Parser.js
+++ b/www/manager6/Parser.js
@@ -457,6 +457,14 @@ Ext.define('PVE.Parser', {
             return arr.join(',');
         },
 
+        parseQemuBios: function (value) {
+            return PVE.Parser.parsePropertyString(value, 'type') ?? {};
+        },
+
+        printQemuBios: function (bios) {
+            return PVE.Parser.printPropertyString(bios, 'type');
+        },
+
         parseQemuSmbios1: function (value) {
             let res = value.split(',').reduce((acc, currentValue) => {
                 const [k, v] = currentValue.split(/[=](.+)/);
diff --git a/www/manager6/Utils.js b/www/manager6/Utils.js
index e83d87ff..11f6d15c 100644
--- a/www/manager6/Utils.js
+++ b/www/manager6/Utils.js
@@ -552,6 +552,8 @@ Ext.define('PVE.Utils', {
                 return 'SeaBIOS';
             } else if (value === 'ovmf') {
                 return 'OVMF (UEFI)';
+            } else if (value === 'ovmf-custom') {
+                return gettext('OVMF (custom)');
             } else {
                 return value;
             }
diff --git a/www/manager6/form/QemuBiosSelector.js b/www/manager6/form/QemuBiosSelector.js
index 40abb589..62f67e32 100644
--- a/www/manager6/form/QemuBiosSelector.js
+++ b/www/manager6/form/QemuBiosSelector.js
@@ -2,13 +2,25 @@ Ext.define('PVE.form.QemuBiosSelector', {
     extend: 'PVE.form.FilteredKVComboBox',
     alias: ['widget.pveQemuBiosSelector'],
 
-    comboItems: [
-        ['__default__', PVE.Utils.render_qemu_bios('')],
-        ['seabios', PVE.Utils.render_qemu_bios('seabios')],
-        ['ovmf', PVE.Utils.render_qemu_bios('ovmf')],
-    ],
+    withCustomFirmware: false,
 
     allowedValuesPerCategory: PVE.qemu.Architecture.allowedFirmware,
 
     setDefaultDisplay: (arch) => PVE.Utils.render_qemu_bios('', arch),
+
+    initComponent: function () {
+        let me = this;
+
+        me.comboItems = [
+            ['__default__', PVE.Utils.render_qemu_bios('')],
+            ['seabios', PVE.Utils.render_qemu_bios('seabios')],
+            ['ovmf', PVE.Utils.render_qemu_bios('ovmf')],
+        ];
+
+        if (me.withCustomFirmware) {
+            me.comboItems.push(['ovmf-custom', PVE.Utils.render_qemu_bios('ovmf-custom')]);
+        }
+
+        me.callParent();
+    },
 });
diff --git a/www/manager6/qemu/Architecture.js b/www/manager6/qemu/Architecture.js
index 7b6ef402..6db8f02e 100644
--- a/www/manager6/qemu/Architecture.js
+++ b/www/manager6/qemu/Architecture.js
@@ -63,8 +63,8 @@ Ext.define('PVE.qemu.Architecture', {
     },
 
     allowedFirmware: {
-        x86_64: ['__default__', 'seabios', 'ovmf'], // default is seabios
-        aarch64: ['ovmf'],
+        x86_64: ['__default__', 'seabios', 'ovmf', 'ovmf-custom'], // default is seabios
+        aarch64: ['ovmf', 'ovmf-custom'],
     },
 
     render_vcpu_architecture: function (value) {
diff --git a/www/manager6/qemu/BootOrderEdit.js b/www/manager6/qemu/BootOrderEdit.js
index 6239aeca..1df37243 100644
--- a/www/manager6/qemu/BootOrderEdit.js
+++ b/www/manager6/qemu/BootOrderEdit.js
@@ -46,7 +46,7 @@ Ext.define('PVE.qemu.BootOrderPanel', {
                         emptyWarning.setHidden(val !== '');
 
                         let showRngPxeWarning =
-                            view.vmconfig?.bios === 'ovmf' &&
+                            PVE.Parser.parseQemuBios(view.vmconfig?.bios).type === 'ovmf' &&
                             !view.vmconfig?.rng0 &&
                             val?.includes('net');
 
diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js
index f7f4b46f..356b3c98 100644
--- a/www/manager6/qemu/HardwareView.js
+++ b/www/manager6/qemu/HardwareView.js
@@ -173,7 +173,17 @@ Ext.define('PVE.qemu.HardwareView', {
                 editor: caps.vms['VM.Config.Options'] ? 'PVE.qemu.BiosEdit' : undefined,
                 defaultValue: '',
                 iconCls: 'microchip',
-                renderer: PVE.Utils.render_qemu_bios,
+                renderer: function (value) {
+                    let bios = PVE.Parser.parseQemuBios(value);
+                    if (bios.firmware) {
+                        return (
+                            PVE.Utils.render_qemu_bios('ovmf-custom') +
+                            ', firmware=' +
+                            Ext.htmlEncode(bios.firmware)
+                        );
+                    }
+                    return PVE.Utils.render_qemu_bios(bios.type);
+                },
             },
             vga: {
                 header: gettext('Display'),
@@ -280,6 +290,12 @@ Ext.define('PVE.qemu.HardwareView', {
             affinity: {
                 visible: false,
             },
+            'amd-sev': {
+                visible: false,
+            },
+            'intel-tdx': {
+                visible: false,
+            },
         };
 
         PVE.Utils.forEachBus(undefined, function (type, id) {
@@ -461,6 +477,20 @@ Ext.define('PVE.qemu.HardwareView', {
                 },
             };
 
+            if (rec.data.key === 'bios') {
+                // A custom EFI firmware image replaces the OVMF code image without touching
+                // the EFI vars store. Only offer when EFI vars are not necessary, i.e. for
+                // confidential VMs. Also offer when one is set already.
+                let value = (key) => me.getObjectValue(key, undefined, true);
+                let cvmType =
+                    PVE.Parser.parsePropertyString(value('amd-sev'), 'type')?.type ??
+                    PVE.Parser.parsePropertyString(value('intel-tdx'), 'type')?.type;
+
+                commonOpts.withCustomFirmware =
+                    ['snp', 'tdx'].includes(cvmType) ||
+                    !!PVE.Parser.parseQemuBios(value('bios')).firmware;
+            }
+
             if (Ext.isString(editor)) {
                 Ext.create(editor, commonOpts);
             } else {
@@ -709,7 +739,9 @@ Ext.define('PVE.qemu.HardwareView', {
                     autoShow: true,
                     url: '/api2/extjs/' + baseurl,
                     pveSelNode: me.pveSelNode,
-                    usesEFI: bios?.value === 'ovmf' || bios?.pending === 'ovmf',
+                    usesEFI: [bios?.value, bios?.pending].some(
+                        (value) => PVE.Parser.parseQemuBios(value).type === 'ovmf',
+                    ),
                     listeners: {
                         destroy: () => me.reload(),
                     },
diff --git a/www/manager6/qemu/QemuBiosEdit.js b/www/manager6/qemu/QemuBiosEdit.js
index a637ed25..3602c1f5 100644
--- a/www/manager6/qemu/QemuBiosEdit.js
+++ b/www/manager6/qemu/QemuBiosEdit.js
@@ -1,9 +1,12 @@
-Ext.define('PVE.qemu.BiosEdit', {
-    extend: 'Proxmox.window.Edit',
-    alias: 'widget.pveQemuBiosEdit',
+Ext.define('PVE.qemu.BiosInputPanel', {
+    extend: 'Proxmox.panel.InputPanel',
+    xtype: 'pveQemuBiosInputPanel',
 
     onlineHelp: 'qm_bios_and_uefi',
-    subject: 'BIOS',
+
+    nodename: undefined,
+
+    withCustomFirmware: false,
 
     viewModel: {
         data: {
@@ -12,38 +15,91 @@ Ext.define('PVE.qemu.BiosEdit', {
         },
         formulas: {
             showEFIDiskHint: (get) => get('bios') === 'ovmf' && !get('efidisk0'),
+            customFirmware: (get) => get('bios') === 'ovmf-custom',
+            // the vars store of an existing EFI disk is kept as it is, so it can go out of sync
+            showVarStoreHint: (get) => get('bios') === 'ovmf-custom' && !!get('efidisk0'),
         },
     },
 
-    items: [
-        {
-            xtype: 'pveQemuBiosSelector',
-            onlineHelp: 'qm_bios_and_uefi',
-            name: 'bios',
-            value: '__default__',
-            bind: {
-                value: '{bios}',
-                category: '{arch}',
+    onGetValues: function (values) {
+        // the custom firmware is a sub-property of 'bios', so it is dropped with any other choice
+        if (values.bios === 'ovmf-custom') {
+            values.bios = PVE.Parser.printQemuBios({ type: 'ovmf', firmware: values.firmware });
+        }
+        delete values.firmware;
+
+        return values;
+    },
+
+    initComponent: function () {
+        let me = this;
+
+        me.items = [
+            {
+                xtype: 'pveQemuBiosSelector',
+                onlineHelp: 'qm_bios_and_uefi',
+                name: 'bios',
+                value: '__default__',
+                withCustomFirmware: me.withCustomFirmware,
+                bind: {
+                    value: '{bios}',
+                    category: '{arch}',
+                },
+                fieldLabel: 'BIOS',
             },
-            fieldLabel: 'BIOS',
-        },
-        {
-            xtype: 'displayfield',
-            name: 'efidisk0',
-            bind: '{efidisk0}',
-            hidden: true,
-        },
-        {
-            xtype: 'displayfield',
-            userCls: 'pmx-hint',
-            value: gettext(
-                'You need to add an EFI disk for storing the EFI settings. See the online help for details.',
-            ),
-            bind: {
-                hidden: '{!showEFIDiskHint}',
+            {
+                xtype: 'displayfield',
+                name: 'efidisk0',
+                bind: '{efidisk0}',
+                hidden: true,
             },
-        },
-    ],
+            {
+                xtype: 'displayfield',
+                userCls: 'pmx-hint',
+                value: gettext(
+                    'You need to add an EFI disk for storing the EFI settings. See the online help for details.',
+                ),
+                bind: {
+                    hidden: '{!showEFIDiskHint}',
+                },
+            },
+            {
+                xtype: 'pveIsoSelector',
+                name: 'firmware',
+                storageContent: 'efi-firmware',
+                fileLabel: gettext('Firmware Image'),
+                nodename: me.nodename,
+                hidden: true,
+                disabled: true,
+                bind: {
+                    hidden: '{!customFirmware}',
+                    disabled: '{!customFirmware}',
+                },
+            },
+            {
+                xtype: 'displayfield',
+                userCls: 'pmx-hint',
+                value: gettext(
+                    'Note: The EFI disk keeps its vars store, which needs to match the custom firmware, otherwise the guest might not boot.',
+                ),
+                bind: {
+                    hidden: '{!showVarStoreHint}',
+                },
+            },
+        ];
+
+        me.callParent();
+    },
+});
+
+Ext.define('PVE.qemu.BiosEdit', {
+    extend: 'Proxmox.window.Edit',
+    alias: 'widget.pveQemuBiosEdit',
+
+    onlineHelp: 'qm_bios_and_uefi',
+    subject: 'BIOS',
+
+    withCustomFirmware: false,
 
     initComponent: function () {
         let me = this;
@@ -54,6 +110,14 @@ Ext.define('PVE.qemu.BiosEdit', {
             throw 'no nodename given';
         }
 
+        me.items = [
+            {
+                xtype: 'pveQemuBiosInputPanel',
+                nodename: me.nodename,
+                withCustomFirmware: me.withCustomFirmware,
+            },
+        ];
+
         me.callParent();
 
         if (!me.isCreate) {
@@ -61,6 +125,11 @@ Ext.define('PVE.qemu.BiosEdit', {
                 success: function ({ result }) {
                     let values = result.data;
                     let arch = PVE.qemu.Architecture.getGuestArchitecture(values.arch, me.nodename);
+                    if (values.bios) {
+                        let bios = PVE.Parser.parseQemuBios(values.bios);
+                        values.bios = bios.firmware ? 'ovmf-custom' : bios.type;
+                        values.firmware = bios.firmware;
+                    }
                     me.setValues(values);
                     me.down('pveQemuBiosSelector').setCategory(arch);
                 },
-- 
2.34.1