From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 07DB21FF0A7 for ; Mon, 17 Aug 2026 14:01:35 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id F17FD23E5A; Mon, 17 Aug 2026 14:00:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1786967979; bh=3gwywqC+Io6zgGQZO2vX79RIoSxK6CAQW+4n7MMIARc=; h=Date:From:To:Subject:References:In-Reply-To:From; b=PsObIMA6WwkxDkJhle1enhcRBRNKFse0Hd/SFksdl24pbibhCe5qf8Hfd3sHVS/yq RfIIoMbtC59GPjhtAOu1KmbVrNlWV68PTly+QSpS7l3D2Sh2FSqKaLJMfTt6m8CanD xfHt8pCvBbQ3ewjoGS2vsJ/aeNEPujeKBGPQ8q2UUsSEL6k2XYeTMnBBSSIWh1EUMC eYPXjiOwi+EPHRclEZezjREoxv7hqH6kk/vJfEuY94NaaU07rIP3xgowOa6lVgJ0eu vvoOJC2F1cbQLqXXhslUvyYbIqo24nCiMIdBMgZff1mrKBQYBg5ezOdnEKajoSblvT JgE3K8eE92pbQ== Date: Mon, 17 Aug 2026 13:59:38 +0200 From: Christian Ludwig To: Subject: [PATCH pve-docs 13/13] qm: Document efi-firmware VM option Message-ID: References: MIME-Version: 1.0 In-Reply-To: X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta07.win.genua.de (10.208.16.107) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----E9A5F3A5EAE6E3C0DA1AFD4F286516CC" X-SPAM-LEVEL: Spam detection results: 0 AWL 0.141 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: FTLUV4PHLR7RMMMNNUA5WUDHVLR2QNWQ X-Message-ID-Hash: FTLUV4PHLR7RMMMNNUA5WUDHVLR2QNWQ X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ------E9A5F3A5EAE6E3C0DA1AFD4F286516CC Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline Signed-off-by: Christian Ludwig --- qm.adoc | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/qm.adoc b/qm.adoc index 5b46cdc..141187b 100644 --- a/qm.adoc +++ b/qm.adoc @@ -1246,6 +1246,39 @@ NOTE: The markers `ms-cert=2023` and `ms-cert=2023w` may indicate partial enrollment. The VM start task log will warn about this. You should apply the enrollment procedure for such EFI disks too. +[[qm_custom_efi_firmware]] +Custom EFI Firmware +^^^^^^^^^^^^^^^^^^^ + +By default, {pve} uses the system-provided OVMF firmware images. If you need a +custom or vendor-specific EFI firmware code image, you can override the default +firmware with the `efi-firmware` VM option. + +The firmware image must first be uploaded to a storage that has the +`efi-firmware` content type enabled. + +To configure a VM to use a custom firmware image: + +---- +# qm set -efi-firmware :efi-firmware/ +---- + +For example: + +---- +# qm set 100 -efi-firmware local:efi-firmware/custom-ovmf-code.fd +---- + +NOTE: The `efi-firmware` option requires `bios` to be set to `ovmf`. The +custom image replaces only the firmware code (pflash0); the EFI vars disk +(`efidisk0`) is still used as normal for storing UEFI variables. + +To remove a custom firmware assignment and revert to the default OVMF image: + +---- +# qm set -delete efi-firmware +---- + [[qm_tpm]] Trusted Platform Module (TPM) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- 2.34.1 ------E9A5F3A5EAE6E3C0DA1AFD4F286516CC--