[PATCH v2 0/16] Support for custom EFI firmware

[Christian Ludwig <christian_ludwig@genua.de>]

Hi,

here is an updated patch series that brings support for custom UEFI
firmware images. You can find the v1 series at [1] for reference.

In Confidential Computing the aim is to not trust the hypervisor, yet it
runs its bundled firmware in each VM. Some VM appliances also ship their
own firmware images. This series allows to bring your own firmware for
OVMF based VMs.

Today the Proxmox-VE API allows to import a custom efidisk0 (EFIVAR)
already. EFI firmware and EFIVAR data have to match. Otherwise, the VM
might not boot anymore. Therefore, with this series you can set a custom
EFI firmware via the API, along with a custom efidisk. But these are two
steps. And there is no safety net. The GUI is missing a way to set a
custom EFIVAR. So this series only allows to set a custom firmware image
for confidential computing VMs that do not need EFIVAR storage. The
defaults do not change.

The changes in detail:

pve-storage:
 - declares the new 'efi-firmware' content type for file based storage
 - provides upload/download API. There is no limit in file names,
   besides the usual safe character class

qemu-server:
 - adds a 'efi-firmware' config key that can point to 'efi-firmware'
   storage content
 - that config key is only allowed to be set for OVMF based VMs
 - adds API plumbing

pve-manager:
 - adds UI plumbing for the 'efi-firmware' storage content type
 - extends the BIOS chooser dialog with an 'OVMF (custom)' option

pve-docs:
 - adds a custom firmware subsection in the BIOS section

Note that you choose the cutom firmware from the BIOS dialog in the GUI,
therefore the 'efi-firmware' config key has the 'VM.Config.Options'
permission. The same as the BIOS option that the dialog hosts already.

Changes from v1:
 - GUI additions
 - Move 'efi-firmware' VM config option permissions from
   'VM.Config.HWType' to 'VM.Config.Options'
 - some cleanups

Tests and feedback welcome.


 - Christian

[1] https://lore.proxmox.com/pve-devel/20260817115919.abQyMsVBJeHupthBjG6HbiJWe2o8RfIy9CmAttembto@z/