[SOLVED] ZFS no EFI disk for Secure Boot

[Afox]

Hello,

it is not possible to add a Secure Boot compatible EFI disk (4m) on a ZFS volume with current pve-manager 7.0.-13.

Is that a bug or simply not possible?

Regards,

Afox

 

[fiona]

Hi,
where do you get the error and what is the exact error message? Please also share the output of pveversion -v.

 

[Afox]

Hello,
I don´t get an error. I simply can´t add a Secure Boot compatible EFI disk (4m) with pre-enrolled keys and after boot mokutils says "Secure Boot not enabled".
It adds a raw EFI disk.
Regards

 

[fiona]

Hi,
thanks for the report! There do seem to be a few issues with the recent EFI-related updates.

Could you post the configuration of the VM qm config ID? Try using machine type q35 if you're not already using that.

Please also share the output of pveversion -v.

EDIT: What guest (exact version) is running in the VM?

 

[Afox]

Spoiler: qm config

agent: 1
bios: ovmf
boot: order=scsi0;ide2;net0
cores: 2
cpu: host
efidisk0: local-zfs:guest-disk-1,size=1M
ide2: none,media=cdrom
machine: q35
memory: 8196
name: guest
net0: virtio=#censored#,bridge=vmbr#,firewall=1
numa: 1
ostype: l26
scsi0: local-zfs:guest-disk-0,discard=on,size=#censored#
scsihw: virtio-scsi-pci
smbios1: uuid=#censored#
sockets: 1
vga: qxl
vmgenid: #censored#

Spoiler: pveversion

proxmox-ve: 7.0-2 (running kernel: 5.11.22-5-pve)
pve-manager: 7.0-13 (running version: 7.0-13/7aa7e488)
pve-kernel-helper: 7.1-2
pve-kernel-5.11: 7.0-8
pve-kernel-5.11.22-5-pve: 5.11.22-10
pve-kernel-5.11.22-4-pve: 5.11.22-9
ceph-fuse: 15.2.14-pve1
corosync: 3.1.5-pve1
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown2: 3.1.0-1+pmx3
ksm-control-daemon: 1.4-1
libjs-extjs: 7.0.0-1
libknet1: 1.22-pve1
libproxmox-acme-perl: 1.3.0
libproxmox-backup-qemu0: 1.2.0-1
libpve-access-control: 7.0-5
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.0-10
libpve-guest-common-perl: 4.0-2
libpve-http-server-perl: 4.0-3
libpve-storage-perl: 7.0-12
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 4.0.9-4
lxcfs: 4.0.8-pve2
novnc-pve: 1.2.0-3
openvswitch-switch: 2.15.0+ds1-2
proxmox-backup-client: 2.0.11-1
proxmox-backup-file-restore: 2.0.11-1
proxmox-mini-journalreader: 1.2-1
proxmox-widget-toolkit: 3.3-6
pve-cluster: 7.0-3
pve-container: 4.0-10
pve-docs: 7.0-5
pve-edk2-firmware: 3.20210831-1
pve-firewall: 4.2-3
pve-firmware: 3.3-2
pve-ha-manager: 3.3-1
pve-i18n: 2.5-1
pve-qemu-kvm: 6.0.0-4
pve-xtermjs: 4.12.0-1
qemu-server: 7.0-16
smartmontools: 7.2-1
spiceterm: 3.2-2
vncterm: 1.7-1
zfsutils-linux: 2.0.5-pve1

The guest is Debian 11.

 

[fiona]

You need to detach the current EFI disk before you can add the new one with the secure boot support. After doing that, you'll need to re-create the boot entry as described here. If it works, you can fully delete the old EFI disk (will now be unused0). If it doesn't, switch back to that one (requires manually editing the configuration).

 

[Afox]

I already did that. Adding the new EFI disk does not offer me the option to add the new EFI partition with pre-enrolled keys.

Edit: I have to step back from my statement. I think it was a cache issue. Sorry!