[PATCH qemu-server] OVMF: use Microsoft-keyed vars for aarch64 VMs

[PATCH qemu-server] OVMF: use Microsoft-keyed vars for aarch64 VMs

[Lukas Sichert]

Currently, starting VMs on aarch64 warns that not all Microsoft UEFI
2023 certificates are enrolled.

Select AAVMF_VARS.ms.fd when pre-enrolled keys are requested to provide
the Microsoft-enrolled variable store.

Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
---
 src/PVE/QemuServer/OVMF.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index 7a765fad..ffb2b850 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -52,6 +52,9 @@ my $OVMF = {
         default => [
             "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.fd",
         ],
+        'default-ms' => [
+            "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.ms.fd",
+        ],
     },
 };
 
@@ -83,6 +86,8 @@ my sub get_ovmf_files($$$$) {
         } else {
             # TODO: log_warn about use of legacy images for x86_64 with Promxox VE 9
         }
+    } elsif ($arch eq 'aarch64') {
+        $type = 'default-ms' if $efidisk->{'pre-enrolled-keys'};
     }
 
     my ($ovmf_code, $ovmf_vars) = $types->{$type}->@*;
-- 
2.47.3

Re: [PATCH qemu-server] OVMF: use Microsoft-keyed vars for aarch64 VMs

[Fiona Ebner]

The CODE image is not secure-boot enabled yet. I already sent a series
in May which also covers that:
https://lore.proxmox.com/pve-devel/20260520142044.502304-1-f.ebner@proxmox.com/

Am 21.07.26 um 3:21 PM schrieb Lukas Sichert:
> Currently, starting VMs on aarch64 warns that not all Microsoft UEFI
> 2023 certificates are enrolled.
> 
> Select AAVMF_VARS.ms.fd when pre-enrolled keys are requested to provide
> the Microsoft-enrolled variable store.
> 
> Signed-off-by: Lukas Sichert <l.sichert@proxmox.com>
> ---
>  src/PVE/QemuServer/OVMF.pm | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
> index 7a765fad..ffb2b850 100644
> --- a/src/PVE/QemuServer/OVMF.pm
> +++ b/src/PVE/QemuServer/OVMF.pm
> @@ -52,6 +52,9 @@ my $OVMF = {
>          default => [
>              "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.fd",
>          ],
> +        'default-ms' => [
> +            "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.ms.fd",
> +        ],
>      },
>  };
>  
> @@ -83,6 +86,8 @@ my sub get_ovmf_files($$$$) {
>          } else {
>              # TODO: log_warn about use of legacy images for x86_64 with Promxox VE 9
>          }
> +    } elsif ($arch eq 'aarch64') {
> +        $type = 'default-ms' if $efidisk->{'pre-enrolled-keys'};
>      }
>  
>      my ($ovmf_code, $ovmf_vars) = $types->{$type}->@*;

Re: [PATCH qemu-server] OVMF: use Microsoft-keyed vars for aarch64 VMs

[Lukas Sichert]

On 2026-07-21 16:57, Fiona Ebner <f.ebner@proxmox.com> wrote:

> The CODE image is not secure-boot enabled yet. I already sent a series
> in May which also covers that:
> https://lore.proxmox.com/pve-devel/20260520142044.502304-1-f.ebner@proxmox.com/

I must have overlooked that. I will test your patch series instead.
Sorry for the noise.

Re: [PATCH qemu-server] OVMF: use Microsoft-keyed vars for aarch64 VMs

[Fiona Ebner]

Am 21.07.26 um 5:03 PM schrieb Lukas Sichert:
> On 2026-07-21 16:57, Fiona Ebner <f.ebner@proxmox.com> wrote:
> 
>> The CODE image is not secure-boot enabled yet. I already sent a series
>> in May which also covers that:
>> https://lore.proxmox.com/pve-devel/20260520142044.502304-1-f.ebner@proxmox.com/
> 
> I must have overlooked that. I will test your patch series instead.
> Sorry for the noise.

Thanks! And no worries, there is a lot of traffic on here and it has
been a while ^^