* [pve-devel] [PATCH qemu-server 1/6] qm enroll-efi-keys: do not remove EFI disk when config was modified during operation
2025-12-11 12:31 [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment Fiona Ebner
@ 2025-12-11 12:31 ` Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 2/6] ovmf: enroll ms 2023 cert: pass along parsed drive Fiona Ebner
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2025-12-11 12:31 UTC (permalink / raw)
To: pve-devel
The EFI disk is already pre-existing and should not be removed in case
the VM configuration was modified during the enrollment operation.
It's not critical if the new certs are enrolled but the marker is not
written to the configuration. Worst case, the operation is just done
again, where virt-fw-vars will just skip enrollment after detecting
that the new certs are already on the disk.
Fixes: 95eb95c3 ("qm enroll-efi-keys: move potential blocking operation out of lock")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/CLI/qm.pm | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index 60fe318e..ca57409f 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -744,14 +744,7 @@ __PACKAGE__->register_method({
my $locked_conf = PVE::QemuConfig->load_config($vmid);
eval { PVE::Tools::assert_if_modified($conf->{digest}, $locked_conf->{digest}) };
- if (my $err = $@) {
- eval {
- my $drive = PVE::QemuServer::Drive::parse_drive('efidisk0', $updated);
- PVE::Storage::vdisk_free($storecfg, $drive->{file});
- };
- warn "failed to clean-up prepared efidisk volume - $@" if $@;
- die "VM ${vmid}: $err";
- }
+ die "VM ${vmid}: $@" if $@;
$locked_conf->{efidisk0} = $updated;
PVE::QemuConfig->write_config($vmid, $locked_conf);
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* [pve-devel] [PATCH qemu-server 2/6] ovmf: enroll ms 2023 cert: pass along parsed drive
2025-12-11 12:31 [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 1/6] qm enroll-efi-keys: do not remove EFI disk when config was modified during operation Fiona Ebner
@ 2025-12-11 12:31 ` Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 3/6] config: apply pending: code style: avoid some line bloat Fiona Ebner
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2025-12-11 12:31 UTC (permalink / raw)
To: pve-devel
This makes the following changes easier.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/CLI/qm.pm | 10 +++++-----
src/PVE/QemuServer.pm | 3 ++-
src/PVE/QemuServer/OVMF.pm | 11 ++++-------
3 files changed, 11 insertions(+), 13 deletions(-)
diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index ca57409f..adf90f3c 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -30,7 +30,7 @@ use PVE::Tools qw(extract_param file_get_contents);
use PVE::API2::Qemu::Agent;
use PVE::API2::Qemu;
use PVE::QemuConfig;
-use PVE::QemuServer::Drive qw(is_valid_drivename);
+use PVE::QemuServer::Drive qw(is_valid_drivename parse_drive print_drive);
use PVE::QemuServer::Helpers;
use PVE::QemuServer::Agent;
use PVE::QemuServer::ImportDisk;
@@ -729,9 +729,9 @@ __PACKAGE__->register_method({
my $storecfg = PVE::Storage::config();
- my $updated = PVE::QemuServer::OVMF::ensure_ms_2023_cert_enrolled(
- $storecfg, $vmid, $conf->{efidisk0},
- );
+ my $efidisk = parse_drive('efidisk0', $conf->{efidisk0});
+ my $updated =
+ PVE::QemuServer::OVMF::ensure_ms_2023_cert_enrolled($storecfg, $vmid, $efidisk);
if (!$updated) {
print "skipping - no pre-enrolled keys or already got ms-cert=2023 marker\n";
@@ -746,7 +746,7 @@ __PACKAGE__->register_method({
eval { PVE::Tools::assert_if_modified($conf->{digest}, $locked_conf->{digest}) };
die "VM ${vmid}: $@" if $@;
- $locked_conf->{efidisk0} = $updated;
+ $locked_conf->{efidisk0} = print_drive($updated);
PVE::QemuConfig->write_config($vmid, $locked_conf);
print "successfully updated efidisk\n";
},
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index d634251b..86f1347c 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5424,7 +5424,8 @@ my sub check_efi_vars {
return if !$conf->{ostype};
return if $conf->{ostype} ne 'win10' && $conf->{ostype} ne 'win11';
- if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($conf->{efidisk0})) {
+ my $efidisk = parse_drive('efidisk0', $conf->{efidisk0});
+ if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($efidisk)) {
# TODO: make the first print a log_warn with PVE 9.2 to make it more noticeable!
print "EFI disk without 'ms-cert=2023' option, suggesting that the Microsoft UEFI 2023"
. " certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!\n";
diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index e5f4cf02..4aa98100 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -279,9 +279,8 @@ sub print_ovmf_commandline {
}
sub should_enroll_ms_2023_cert {
- my ($efidisk_str) = @_;
+ my ($efidisk) = @_;
- my $efidisk = parse_drive('efidisk0', $efidisk_str);
return if !$efidisk->{'pre-enrolled-keys'};
return if $efidisk->{'ms-cert'} && $efidisk->{'ms-cert'} eq '2023';
@@ -289,11 +288,9 @@ sub should_enroll_ms_2023_cert {
}
sub ensure_ms_2023_cert_enrolled {
- my ($storecfg, $vmid, $efidisk_str) = @_;
+ my ($storecfg, $vmid, $efidisk) = @_;
- return if !should_enroll_ms_2023_cert($efidisk_str);
-
- my $efidisk = parse_drive('efidisk0', $efidisk_str);
+ return if !should_enroll_ms_2023_cert($efidisk);
print "efidisk0: enrolling Microsoft UEFI CA 2023\n";
@@ -317,7 +314,7 @@ sub ensure_ms_2023_cert_enrolled {
die "efidisk0: enrolling Microsoft UEFI CA 2023 failed - $err" if $err;
$efidisk->{'ms-cert'} = '2023';
- return print_drive($efidisk);
+ return $efidisk;
}
1;
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* [pve-devel] [PATCH qemu-server 3/6] config: apply pending: code style: avoid some line bloat
2025-12-11 12:31 [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 1/6] qm enroll-efi-keys: do not remove EFI disk when config was modified during operation Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 2/6] ovmf: enroll ms 2023 cert: pass along parsed drive Fiona Ebner
@ 2025-12-11 12:31 ` Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 4/6] config: apply pending: efi: enroll Microsoft UEFI CA 2023 when setting ms-cert=2023 option Fiona Ebner
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2025-12-11 12:31 UTC (permalink / raw)
To: pve-devel
Also in preparation to re-use the parsed drive.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/QemuServer.pm | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 86f1347c..dfa74c4b 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -4986,12 +4986,8 @@ sub vmconfig_apply_pending {
next if $opt eq 'delete'; # just to be sure
eval {
if (defined($conf->{$opt}) && is_valid_drivename($opt)) {
- vmconfig_register_unused_drive(
- $storecfg,
- $vmid,
- $conf,
- parse_drive($opt, $conf->{$opt}),
- );
+ my $old_drive = parse_drive($opt, $conf->{$opt});
+ vmconfig_register_unused_drive($storecfg, $vmid, $conf, $old_drive);
} elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) {
my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt});
if ($conf->{$opt}) {
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* [pve-devel] [PATCH qemu-server 4/6] config: apply pending: efi: enroll Microsoft UEFI CA 2023 when setting ms-cert=2023 option
2025-12-11 12:31 [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment Fiona Ebner
` (2 preceding siblings ...)
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 3/6] config: apply pending: code style: avoid some line bloat Fiona Ebner
@ 2025-12-11 12:31 ` Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH manager 5/6] ui: qemu: hd efi: fix typo in warning Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH manager 6/6] ui: qemu: hardware: efi: allow enrolling Microsoft UEFI CA 2023 Fiona Ebner
5 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2025-12-11 12:31 UTC (permalink / raw)
To: pve-devel
Like this, the 'qm enroll-efi-keys' operation can be done via API too.
The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
should be a way to update that can be automated and done while guests
are running.
Suggested-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/QemuServer.pm | 9 +++++++++
src/PVE/QemuServer/OVMF.pm | 16 ++++++++++++++++
2 files changed, 25 insertions(+)
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index dfa74c4b..6492d706 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -4988,6 +4988,15 @@ sub vmconfig_apply_pending {
if (defined($conf->{$opt}) && is_valid_drivename($opt)) {
my $old_drive = parse_drive($opt, $conf->{$opt});
vmconfig_register_unused_drive($storecfg, $vmid, $conf, $old_drive);
+ if ($opt eq 'efidisk0') {
+ my $new_drive = parse_drive($opt, $conf->{pending}->{$opt});
+ PVE::QemuServer::OVMF::drive_change(
+ $storecfg,
+ $vmid,
+ $old_drive,
+ $new_drive,
+ );
+ }
} elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) {
my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt});
if ($conf->{$opt}) {
diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index 4aa98100..58415899 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -317,4 +317,20 @@ sub ensure_ms_2023_cert_enrolled {
return $efidisk;
}
+sub drive_change {
+ my ($storecfg, $vmid, $old_drive, $new_drive) = @_;
+
+ return if $old_drive->{file} ne $new_drive->{file};
+
+ # Note that changing away from ms-cert=2023 is allowed, the marker is not the source of truth.
+ return if $old_drive->{'ms-cert'} && $old_drive->{'ms-cert'} eq '2023';
+
+ return if !$new_drive->{'ms-cert'} || $new_drive->{'ms-cert'} ne '2023';
+
+ # The ms-cert marker was newly changed to 2023, ensure it's enrolled. Clear it first to avoid
+ # detecting as already enrolled.
+ delete $new_drive->{'ms-cert'};
+ ensure_ms_2023_cert_enrolled($storecfg, $vmid, $new_drive);
+}
+
1;
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* [pve-devel] [PATCH manager 5/6] ui: qemu: hd efi: fix typo in warning
2025-12-11 12:31 [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment Fiona Ebner
` (3 preceding siblings ...)
2025-12-11 12:31 ` [pve-devel] [PATCH qemu-server 4/6] config: apply pending: efi: enroll Microsoft UEFI CA 2023 when setting ms-cert=2023 option Fiona Ebner
@ 2025-12-11 12:31 ` Fiona Ebner
2025-12-11 12:31 ` [pve-devel] [PATCH manager 6/6] ui: qemu: hardware: efi: allow enrolling Microsoft UEFI CA 2023 Fiona Ebner
5 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2025-12-11 12:31 UTC (permalink / raw)
To: pve-devel
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
www/manager6/qemu/HDEfi.js | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/www/manager6/qemu/HDEfi.js b/www/manager6/qemu/HDEfi.js
index 6371ebe4..1ae63add 100644
--- a/www/manager6/qemu/HDEfi.js
+++ b/www/manager6/qemu/HDEfi.js
@@ -80,7 +80,7 @@ Ext.define('PVE.qemu.EFIDiskInputPanel', {
},
{
xtype: 'label',
- text: gettext("Warning: The VM currently does not uses 'OVMF (UEFI)' as BIOS."),
+ text: gettext("Warning: The VM currently does not use 'OVMF (UEFI)' as BIOS."),
userCls: 'pmx-hint',
hidden: me.usesEFI,
},
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* [pve-devel] [PATCH manager 6/6] ui: qemu: hardware: efi: allow enrolling Microsoft UEFI CA 2023
2025-12-11 12:31 [pve-devel] [PATCH-SERIES qemu-server/manager 0/6] improve Microsoft UEFI CA 2023 enrollment Fiona Ebner
` (4 preceding siblings ...)
2025-12-11 12:31 ` [pve-devel] [PATCH manager 5/6] ui: qemu: hd efi: fix typo in warning Fiona Ebner
@ 2025-12-11 12:31 ` Fiona Ebner
5 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2025-12-11 12:31 UTC (permalink / raw)
To: pve-devel
When the following conditions are met:
- no pending change on the EFI disk
- OS type Windows 10 or 11
- EFI disk has pre-enrolled-keys
- There is no ms-cert=2023 marker yet
suggest enrolling the new Microsoft UEFI CA 2023.
The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
needs to be an easy way to update.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
www/manager6/qemu/HardwareView.js | 78 +++++++++++++++++++++++++++++++
1 file changed, 78 insertions(+)
diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js
index cf5e2a0f..3025da74 100644
--- a/www/manager6/qemu/HardwareView.js
+++ b/www/manager6/qemu/HardwareView.js
@@ -442,6 +442,63 @@ Ext.define('PVE.qemu.HardwareView', {
handler: run_editor,
});
+ let runEfiEnroll = function () {
+ let rec = sm.getSelection()[0];
+ if (!rec) {
+ return;
+ }
+
+ let efidisk = PVE.Parser.parsePropertyString(rec.data.value, 'file');
+ efidisk['ms-cert'] = '2023';
+
+ let params = {};
+ params[rec.data.key] = PVE.Parser.printPropertyString(efidisk);
+ Proxmox.Utils.API2Request({
+ url: `/api2/extjs/${baseurl}`,
+ waitMsgTarget: me,
+ method: 'POST',
+ params: params,
+ callback: () => me.reload(),
+ failure: (response) => Ext.Msg.alert('Error', response.htmlStatus),
+ success: function (response, options) {
+ if (response.result.data !== null) {
+ Ext.create('Proxmox.window.TaskProgress', {
+ autoShow: true,
+ upid: response.result.data,
+ listeners: {
+ destroy: () => me.reload(),
+ },
+ });
+ }
+ },
+ });
+ };
+
+ let efiEnrollButton = new Proxmox.button.Button({
+ text: gettext('Enroll MS 2023 Cert'),
+ selModel: sm,
+ disabled: true,
+ hidden: true,
+ handler: runEfiEnroll,
+ confirmMsg:
+ gettext(
+ 'If the VM uses BitLocker, run the following command inside Windows Powershell:',
+ ) +
+ '<br><code>manage-bde -protectors -disable <drive></code><br>' +
+ Ext.String.format(
+ // TRANSLATORS: for a shell command: "placeholder could be 'concrete value'"
+ gettext("For example, {0} could be '{1}'."),
+ '<code><drive></code>',
+ '<code>C:</code>',
+ ) +
+ '<br>' +
+ gettext('This is required for each drive with BitLocker before proceeding!') +
+ '<br>' +
+ gettext(
+ 'Otherwise, you will be prompted for the BitLocker recovery key on the next boot!',
+ ),
+ });
+
let move_menuitem = new Ext.menu.Item({
text: gettext('Move Storage'),
tooltip: gettext('Move disk to another storage'),
@@ -616,6 +673,8 @@ Ext.define('PVE.qemu.HardwareView', {
let selection_model = me.getSelectionModel();
let rec = selection_model.getSelection()[0];
+ let isWin10or11 = false;
+
counts = {}; // en/disable hardwarebuttons
let hasCloudInit = false;
me.rstore.getData().items.forEach(function ({ id, data }) {
@@ -629,6 +688,10 @@ Ext.define('PVE.qemu.HardwareView', {
let type = match[1];
counts[type] = (counts[type] || 0) + 1;
}
+
+ if (id === 'ostype' && (data.value === 'win10' || data.value === 'win11')) {
+ isWin10or11 = true;
+ }
});
// heuristic only for disabling some stuff, the backend has the final word.
@@ -655,6 +718,7 @@ Ext.define('PVE.qemu.HardwareView', {
if (!rec) {
remove_btn.disable();
edit_btn.disable();
+ efiEnrollButton.disable();
diskaction_btn.disable();
revert_btn.disable();
return;
@@ -686,6 +750,16 @@ Ext.define('PVE.qemu.HardwareView', {
);
remove_btn.RESTMethod = isUnusedDisk || (isDisk && isRunning) ? 'POST' : 'PUT';
+ let suggestEfiEnroll = false;
+ if (isEfi) {
+ let drive = PVE.Parser.parsePropertyString(value, 'file');
+ suggestEfiEnroll =
+ !pending &&
+ isWin10or11 &&
+ PVE.Parser.parseBoolean(drive['pre-enrolled-keys'], false) &&
+ drive['ms-cert'] !== '2023';
+ }
+
edit_btn.setDisabled(
deleted ||
!row.editor ||
@@ -694,6 +768,9 @@ Ext.define('PVE.qemu.HardwareView', {
(isDisk && !diskCap),
);
+ efiEnrollButton.setDisabled(!suggestEfiEnroll);
+ efiEnrollButton.setHidden(!suggestEfiEnroll);
+
diskaction_btn.setDisabled(
pending || !diskCap || isCloudInit || !(isDisk || isEfi || tpmMoveable),
);
@@ -822,6 +899,7 @@ Ext.define('PVE.qemu.HardwareView', {
},
remove_btn,
edit_btn,
+ efiEnrollButton,
diskaction_btn,
revert_btn,
],
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread