[PATCH v3 00/19] Support for custom EFI firmware

[Christian Ludwig <christian_ludwig@genua.de>]

Hi,

here is an updated patch series that brings support for custom UEFI
firmware images. You can find the v2 series at [1] and v1 series at [2]
for reference.

In Confidential Computing the aim is to not trust the hypervisor, yet it
runs its bundled firmware in each VM. Some VM appliances also ship their
own firmware images. This series allows to bring your own firmware for
OVMF based VMs.

Today the Proxmox-VE API allows to import a custom efidisk0 (EFIVAR)
already. EFI firmware and EFIVAR data have to match. Otherwise, the VM
might not boot anymore. Therefore, with this series you can set a custom
EFI firmware via the API, along with a custom efidisk. But these are two
steps. And there is no safety net. The GUI is missing a way to set a
custom EFIVAR. So this series only allows to set a custom firmware image
for confidential computing VMs that do not need EFIVAR storage. The
defaults do not change.

The changes in detail:

pve-storage:
 - declares the new 'efi-firmware' content type for file based storage
 - provides upload/download API. File names are restricted to the safe
   character set, because they are used as sub-properties in the GUI.
   File extensions are restricted to '.fd'. So the efi-firmware storage
   can host other types as well in the future.

qemu-server:
 - extends the 'bios' property with an optional 'firmware' sub-property
   with an efi-firmware storage location.
 - the 'firmware' sub-property is only allowed to be set for OVMF based
   VMs.
 - adds API plumbing

pve-manager:
 - adds UI plumbing for the 'efi-firmware' storage content type
 - extends the BIOS chooser dialog with an 'OVMF (custom)' option to
   select the firmware sub-property.
 - restricts custom firmware selection to confidential computing VMs.

pve-docs:
 - adds a custom firmware subsection in the BIOS section

Changes in v3:
 - rebased on current master for all repositories
 - turn 'bios' into a property-string and make the custom firmware its
   'firmware' sub-property (bios: ovmf,firmware=<volid>), instead of a
   separate 'efi-firmware' VM config key (suggested by Fiona)
 - restrict firmware file names to the '.fd' extension (suggested by
   Fiona)
 - validate uploaded and downloaded images as raw (suggested by Fiona)
 - support efi-firmware volumes in volume export/import (suggested by
   Fiona)
 - clearer errors when a configured firmware image is not usable on the
   node, e.g. for templates or restored VMs
 - UI: refuse migration with a local custom firmware image
 - docs: describe migration, replication, templates and backups

Tests and feedback welcome.


 - Christian

[1] https://lore.proxmox.com/pve-devel/cover.1790337423.git@genua.de/
[2] https://lore.proxmox.com/pve-devel/20260817115919.abQyMsVBJeHupthBjG6HbiJWe2o8RfIy9CmAttembto@z/