Replace grub-bhyve for direct UEFI boot.

It is simpler and easier to boot the Linux guest via EFI.  This
makes it possible to abandon using `grub-bhyve` for preloading
and enable a more secure setup (which is compatible with hardened
systems).  With that change, a dedicated EFI System Partition
(ESP) is searched as a separate disk image under `GUEST_ROOT`.

Note that is a non-backward-compatible, breaking change, because
it will not possible to boot guests via GRUB any more.  Albeit it
will be still possible to build the ESP with GRUB if that is still
preferred.

Author: pgj

README.md

@@ -66,8 +66,9 @@ possible:
   15.0-RELEASE.  Later versions will also probably work, but your
   mileage may vary.
 
-- [`grub2-bhyve`] or the corresponding `sysutils/grub2-bhyve` FreeBSD
-  package, so the Linux guest could be booted via GRUB 2.
+- [`bhyve` UEFI firmware] or the corresponding
+  `sysutils/bhyve-firmware` FreeBSD package, so the Linux guest could
+  be booted via EFI.
 
 - [`socat`] or the respective `net/socat` FreeBSD package, through
   which control sockets for `wpa_supplicant(8)` and `hostapd(8)` could
@@ -92,30 +93,32 @@ mostly recommended for development and testing.
 ```console
 # make install \
     PREFIX=<prefix> \
-    LOCALBASE=<prefix of the grub2-bhyve and socat packages> \
-    GUEST_ROOT=<guest disk image location> \
+    LOCALBASE=<prefix of the bhyve-firmware and socat packages> \
+    GUEST_ROOT=<guest disk images location> \
     GUEST_MAN=<guest manual page location> \
     RECOVERY_METHOD=<method to use on suspend and resume> \
     DEVD_FIX=<add extra devd.conf(5) configuration to handle suspend>
 ```
 
 By default, `PREFIX` is set to `/usr/local`.  In addition to that, it
 is possible to set the `LOCALBASE` variable to tell if the prefix
-under which the `grub-bhyve` and `socat` utilities were installed is
-different.
+under which the `bhyve-firmware` data files and the `socat` utility
+were installed is different.
 
 The `GUEST_ROOT` variable should point to the directory that houses
 the files related to the guest.  Note that these are not part of the
 repository and should be installed individually.  For example, such
 files could be installed from the [`freebsd-wifibox-alpine`]
 repository.
 
-- GRUB is going to be configured according to the contents of
-  `grub.cfg`, and then the system is booted from the virtual disk
-  image whose contents should be stored as `disk.img`.
+- `esp.img` should hold the EFI System Partition (ESP), which is a
+  FAT12 file system where either the Linux kernel itself (wrapped in
+  the [EFI stub]) or some other boot loader (e.g. GRUB, Syslinux) is
+  stored, alongside the kernel, its configuration and data files.
 
-- When needed, `device.map` could also be placed there to teach GRUB
-  about the virtual disk image.
+- `root.img` is the contents of the root file system, which is made
+  available for booting as the secondary disk drive, e.g. under
+  `/dev/vdb`, once the kernel has been loaded.
 
 The `RECOVERY_METHOD` variable can be used to tell in which way
 Wifibox should be revived on a suspend/resume pair of events.
@@ -192,6 +195,7 @@ configuration added here!
 [`freebsd-wifibox-port`]: https://github.com/pgj/freebsd-wifibox-port
 [`freebsd-wifibox-alpine`]: https://github.com/pgj/freebsd-wifibox-alpine
 [`net/wpa_supplicant_gui`]: https://cgit.freebsd.org/ports/tree/net/wpa_supplicant_gui
-[`grub2-bhyve`]: https://github.com/grehan-freebsd/grub2-bhyve
+[`bhyve` UEFI firmware]: https://wiki.freebsd.org/bhyve/UEFI
 [`socat`]: http://www.dest-unreach.org/socat/
+[EFI stub]: https://docs.kernel.org/admin-guide/efi-stub.html
 [article]: https://github.com/pgj/freebsd-wifibox/releases/download/freebsd-journal-2024-06/freebsd-journal-wifibox.pdf

sbin/wifibox

@@ -6,7 +6,8 @@ PREFIX=%%PREFIX%%
 LOCALBASE=%%LOCALBASE%%
 VERSION=%%VERSION%%
 GUEST_ROOT=%%GUEST_ROOT%%
-SCRIPT=${PREFIX}/sbin/wifibox
+SCRIPT="${PREFIX}"/sbin/wifibox
+BOOTROOM="${LOCALBASE}"/share/uefi-firmware/BHYVE_UEFI.fd
 LOGDIR=/var/log
 RUNDIR=/var/run/wifibox
 CONFDIR=${PREFIX}/etc/wifibox
@@ -51,10 +52,10 @@ KERNEL_PATH=$(${SYSCTL} -n kern.module_path | ${SED} -E 's/^([^;]*);.*/\1/')
 : "${LS:=/bin/ls}"
 : "${SEQ:=/usr/bin/seq}"
 
-: "${GRUB_BHYVE:=${LOCALBASE}/sbin/grub-bhyve}"
 : "${SOCAT:=${LOCALBASE}/bin/socat}"
 
-DISK_IMAGE="${GUEST_ROOT}/disk.img"
+ESP_IMAGE="${GUEST_ROOT}/esp.img"
+ROOT_IMAGE="${GUEST_ROOT}/root.img"
 
 NMDM_DEVICE=/dev/nmdm-wifibox
 NMDM_A="${NMDM_DEVICE}.1A"
@@ -588,7 +589,6 @@ assert_value_yesno() {
 # shellcheck disable=SC2086
 vm_manager() {
     local _max_vmm_cpus
-    local _nmdm_grub_bhyve
     local _nmdm_bhyve
     local _passthru_bhyve
     local _tap_bhyve
@@ -598,10 +598,6 @@ vm_manager() {
     local _app_conf_ptr="${CONFDIR}/app_config"
     local _app_conf_mode
     local _app_conf_bhyve
-    local _grub_bhyve_args
-    local _grub_bhyve_exit_code
-    local _grub_device_map="${GUEST_ROOT}/device.map"
-    local _grub_cfg="${GUEST_ROOT}/grub.cfg"
     local _nice_priority
     local _bhyve_args
     local _bhyve_devs
@@ -619,7 +615,6 @@ vm_manager() {
 
     if [ "${console}" = "yes" ]; then
 	assert_nmdm_loaded
-	_nmdm_grub_bhyve="-c ${NMDM_A}"
 	_nmdm_bhyve="-l com1,${NMDM_A}"
 	log info "Guest console is configured to use"
     else
@@ -661,21 +656,22 @@ vm_manager() {
 	exit 5
     fi
 
-    log info "Launching guest ${WIFIBOX_VM} from ${GUEST_ROOT} with grub-bhyve"
+    log info "Launching guest ${WIFIBOX_VM} from ${GUEST_ROOT} via UEFI"
 
-    if [ ! -f "${_grub_cfg}" ]; then
-	log error "${_grub_cfg} could not be found, guest cannot be started"
+    if [ ! -f "${ESP_IMAGE}" ]; then
+	log error "${ESP_IMAGE} could not be found, guest cannot be started"
 	quit_daemonization
 	exit 4
     fi
 
-    if [ ! -f "${DISK_IMAGE}" ]; then
-	log error "${DISK_IMAGE} could not be found, guest cannot be started"
+    if [ ! -f "${ROOT_IMAGE}" ]; then
+	log error "${ROOT_IMAGE} could not be found, guest cannot be started"
 	quit_daemonization
 	exit 4
     fi
 
-    _bhyve_devs="virtio-blk,${DISK_IMAGE}"
+    _bhyve_devs="${_bhyve_devs} virtio-blk,${ESP_IMAGE}"
+    _bhyve_devs="${_bhyve_devs} virtio-blk,${ROOT_IMAGE}"
     _bhyve_devs="${_bhyve_devs} virtio-9p,config=${CONFDIR}/appliance,ro"
     _bhyve_devs="${_bhyve_devs} virtio-9p,var=${RUNDIR}/appliance"
     _app_conf=$(${READLINK} -f "%Y" ${_app_conf_ptr})
@@ -697,28 +693,6 @@ vm_manager() {
     fi
 
     log debug "Devices: ${_bhyve_devs}"
-
-    _grub_bhyve_args=""
-    _grub_bhyve_args="${_grub_bhyve_args} -S -M ${memory}"
-    _grub_bhyve_args="${_grub_bhyve_args} -r host ${_nmdm_grub_bhyve}"
-    [ -f "${_grub_device_map}" ] \
-	&& _grub_bhyve_args="${_grub_bhyve_args} -m ${_grub_device_map}"
-    _grub_bhyve_args="${_grub_bhyve_args} -d ${GUEST_ROOT} ${WIFIBOX_VM}"
-
-    log debug "Arguments: ${_grub_bhyve_args}"
-    ${GRUB_BHYVE} ${_grub_bhyve_args} 2>&1 | capture_output debug grub-bhyve
-    _grub_bhyve_exit_code="$?"
-
-    if [ "${_grub_bhyve_exit_code}" -ne "0" ]; then
-	destroy_vm
-
-	log debug "exit_code=${_grub_bhyve_exit_code}"
-	log info "grub-bhyve failed to start, signaling restart after 5 seconds"
-
-	${SLEEP} 5 2>&1 | capture_output debug sleep
-	exit 1
-    fi
-
     log info "Launching guest ${WIFIBOX_VM} from ${GUEST_ROOT} with bhyve"
 
     _bhyve_args=""
@@ -727,6 +701,7 @@ vm_manager() {
     _bhyve_args="${_bhyve_args} ${_nmdm_bhyve}"
     _bhyve_args="${_bhyve_args} -s 0,hostbridge"
     _bhyve_args="${_bhyve_args} -s 31,lpc"
+    _bhyve_args="${_bhyve_args} -l bootrom,${BOOTROOM}"
     _slot=0
 
     for dev in ${_bhyve_devs}; do