From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id C4BDB1FF0A7 for ; Mon, 17 Aug 2026 11:37:24 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 221A123BC2; Mon, 17 Aug 2026 11:36:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1786958979; bh=h1AxfkaG9pIqVomOqOgPGLngwwnT/LzNbSwxuDyWq48=; h=Date:From:To:Subject:References:In-Reply-To:From; b=RgjMqQr65Ko0QojPyQZ5/PcZDV1YT9ArtuHoFlqKBxhjOxVVhBAzrFGxKGStSznw6 hSlABRvvHNRyTSCDN3xuddvQnJZVZUDIGM3CNkktx8ODLKOcOaKgf1MIe6N1+GkRU7 PyIWSWPqAQsd2k6U1vopCWPXLQyri5c+2PEHqi8x9BX6f13OkBus8ZX89xDT/Ycb/v wgmIoB0SJesBtdNKAWyLpcotBfH2XQLUfth1l73Xwk6o3uV13GAOGZQJlbbi5/Xq9p yFRoXchKtM7+xtDdLQx5v0VeUFr24LVg4aCPieMEC7C2IeNhMh6zHfyh6vktANsW3P 4ru9J8IrJihbg== Date: Mon, 17 Aug 2026 11:29:38 +0200 From: Christian Ludwig To: , <-b@genua.de>, Subject: [PATCH pve-docs 13/13] qm: Document efi-firmware VM option Message-ID: References: MIME-Version: 1.0 In-Reply-To: X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta07.win.genua.de (10.208.16.107) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----D420EA0C5D818D5F421969A24BDE3865" X-SPAM-LEVEL: Spam detection results: 0 DKIM_INVALID 0.1 DKIM or DK signature exists, but is not valid DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DMARC_PASS -0.1 DMARC pass policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: DY2IPTIGK6XTUOCN3TKICCHTQCXEEKZC X-Message-ID-Hash: DY2IPTIGK6XTUOCN3TKICCHTQCXEEKZC X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ------D420EA0C5D818D5F421969A24BDE3865 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline Signed-off-by: Christian Ludwig --- qm.adoc | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/qm.adoc b/qm.adoc index 5b46cdc..141187b 100644 --- a/qm.adoc +++ b/qm.adoc @@ -1246,6 +1246,39 @@ NOTE: The markers `ms-cert=2023` and `ms-cert=2023w` may indicate partial enrollment. The VM start task log will warn about this. You should apply the enrollment procedure for such EFI disks too. +[[qm_custom_efi_firmware]] +Custom EFI Firmware +^^^^^^^^^^^^^^^^^^^ + +By default, {pve} uses the system-provided OVMF firmware images. If you need a +custom or vendor-specific EFI firmware code image, you can override the default +firmware with the `efi-firmware` VM option. + +The firmware image must first be uploaded to a storage that has the +`efi-firmware` content type enabled. + +To configure a VM to use a custom firmware image: + +---- +# qm set -efi-firmware :efi-firmware/ +---- + +For example: + +---- +# qm set 100 -efi-firmware local:efi-firmware/custom-ovmf-code.fd +---- + +NOTE: The `efi-firmware` option requires `bios` to be set to `ovmf`. The +custom image replaces only the firmware code (pflash0); the EFI vars disk +(`efidisk0`) is still used as normal for storing UEFI variables. + +To remove a custom firmware assignment and revert to the default OVMF image: + +---- +# qm set -delete efi-firmware +---- + [[qm_tpm]] Trusted Platform Module (TPM) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- 2.34.1 ------D420EA0C5D818D5F421969A24BDE3865--