From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40])
	by lore.proxmox.com (Postfix) with ESMTPS id 6FF291FF0E3
	for <inbox@lore.proxmox.com>; Tue, 21 Jul 2026 16:57:39 +0200 (CEST)
Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1])
	by gate001.proxmox.com (Proxmox) with ESMTP id BE0E721470;
	Tue, 21 Jul 2026 16:57:38 +0200 (CEST)
Message-ID: <8e68bde2-66b3-4cce-a565-22f59b38952e@proxmox.com>
Date: Tue, 21 Jul 2026 16:57:33 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH qemu-server] OVMF: use Microsoft-keyed vars for aarch64
 VMs
To: Lukas Sichert <l.sichert@proxmox.com>, pve-devel@lists.proxmox.com
References: <20260721132152.57755-1-l.sichert@proxmox.com>
Content-Language: en-US
From: Fiona Ebner <f.ebner@proxmox.com>
In-Reply-To: <20260721132152.57755-1-l.sichert@proxmox.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2
X-Bm-Transport-Timestamp: 1784645827276
X-SPAM-LEVEL: Spam detection results:  0
	AWL                     0.233 Adjusted score from AWL reputation of From:
 address
	DMARC_MISSING             0.1 Missing DMARC policy
	KAM_DMARC_STATUS         0.01 Test Rule for DKIM or SPF Failure with Strict
 Alignment (newer systems)
	RCVD_IN_DNSWL_LOW        -0.7 Sender listed at https://www.dnswl.org/,
 low trust
	SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
	SPF_PASS               -0.001 SPF: sender matches SPF record
Message-ID-Hash: S7SJN5IKICG7NKMC4FDIG64XDXU2VEW3
X-Message-ID-Hash: S7SJN5IKICG7NKMC4FDIG64XDXU2VEW3
X-MailFrom: f.ebner@proxmox.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop;
 banned-address; emergency; member-moderation; nonmember-moderation;
 administrivia; implicit-dest; max-recipients; max-size; news-moderation;
 no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Owner: <mailto:pve-devel-owner@lists.proxmox.com>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Subscribe: <mailto:pve-devel-join@lists.proxmox.com>
List-Unsubscribe: <mailto:pve-devel-leave@lists.proxmox.com>

The CODE image is not secure-boot enabled yet. I already sent a series
in May which also covers that:
https://lore.proxmox.com/pve-devel/20260520142044.502304-1-f.ebner@proxmox.com/

Am 21.07.26 um 3:21 PM schrieb Lukas Sichert:
> Currently, starting VMs on aarch64 warns that not all Microsoft UEFI
> 2023 certificates are enrolled.
> 
> Select AAVMF_VARS.ms.fd when pre-enrolled keys are requested to provide
> the Microsoft-enrolled variable store.
> 
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
>  src/PVE/QemuServer/OVMF.pm | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
> index 7a765fad..ffb2b850 100644
> --- a/src/PVE/QemuServer/OVMF.pm
> +++ b/src/PVE/QemuServer/OVMF.pm
> @@ -52,6 +52,9 @@ my $OVMF = {
>          default => [
>              "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.fd",
>          ],
> +        'default-ms' => [
> +            "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.ms.fd",
> +        ],
>      },
>  };
>  
> @@ -83,6 +86,8 @@ my sub get_ovmf_files($$$$) {
>          } else {
>              # TODO: log_warn about use of legacy images for x86_64 with Promxox VE 9
>          }
> +    } elsif ($arch eq 'aarch64') {
> +        $type = 'default-ms' if $efidisk->{'pre-enrolled-keys'};
>      }
>  
>      my ($ovmf_code, $ovmf_vars) = $types->{$type}->@*;