[PATCH storage/qemu 0/13]: Custom UEFI firmware in PVE

[Christian Ludwig <christian_ludwig@genua.de>]

[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]

Hi,

this series brings initial support for custom UEFI firmware to PVE.
This is useful for confidential computing workloads, where VMs may
bring their own firmware and not rely on the hypervisor's. There is
also some other software around that ships it's own VM firmware. The
firmware needs to be compatible to KVM/Qemu, of course. See the design
discussion earlier at [1].

The first part of the series brings a new storage content type for EFI
firmware, which can be set on directory-based storage. There is no
restriction on the actual firmware file's name.

The second part brings new 'efi-firmware' VM config key allows Qemu to
use a file from a storage with that new content type, instead of the
default firmware. To reduce complexity, this only works with bios=ovmf.

This feature is only configurable from the API. The GUI parts were left
out on purpose. I am unsure how much we want/need to expose there in the
first place.

We have tested this with custom UEFI firmware in AMD SEV/SNP
confidential VMs.


 - Christian

[1] https://lore.proxmox.com/pve-devel/10513e3f2c0d94bc938a540b4a0a18749eb5ed96.camel@genua.de/