[SOLVED] Unable to start Windows 11 Pro VM after Upgrading to 9.x

Bishop27

Member
Jul 3, 2024
44
1
8
Hello All,


I’ve upgraded to Proxmox Ver 9 after when I tried to startup my Windows 11 Pro I received the error message below:


WARN: EFI disk without 'ms-cert=2023k' option, suggesting that not all UEFI 2023
certificates from Microsoft are enrolled yet.
The UEFI 2011 certificates expire in June 2026! The new certificates are required
for secure boot update for Windows and common Linux distributions.
Use 'Disk Action > Enroll Updated Certificates' in the UI or, while the VM is
shut down, run 'qm enroll-efi-keys 105' to enroll the new certificates.

Well, After running the Command qm enroll-fi-keys

And now receiving this message >
TASK ERROR: cannot prepare PCI pass-through, IOMMU not present

Can someone please assist.

Here are my versions that I’m currently running:

pve-manager/9.2.3
running kernel: 7.0.6-2-pve)

Thank you in advance.
 
Last edited:
Hi @Bishop27

thanks for posting in the forum!

So the EFI messages were just a warning for the soon expiring Secure Boot CAs from Microsoft, which you successfully updated as it seems.

The second error message as it says, has something to do with PCIe Passthrough, so a separate issue, there.

What kind of PCI(e) device are you trying to passthrough?
Please provide the output of the following commands:
Code:
dmesg | grep -e DMAR -e IOMMU
dmesg | grep 'remapping'
qm showcmd 105 --pretty

Also please determine the PCI identifier of the device you are passing through by using lspci and then with the identifier run lspci -vvvs <ID>

Yours sincerely
Jonas
 
  • Like
Reactions: Bishop27
Hi @Bishop27

thanks for posting in the forum!

So the EFI messages were just a warning for the soon expiring Secure Boot CAs from Microsoft, which you successfully updated as it seems.

The second error message as it says, has something to do with PCIe Passthrough, so a separate issue, there.

What kind of PCI(e) device are you trying to passthrough?
Please provide the output of the following commands:
Code:
dmesg | grep -e DMAR -e IOMMU
dmesg | grep 'remapping'
qm showcmd 105 --pretty

Also please determine the PCI identifier of the device you are passing through by using lspci and then with the identifier run lspci -vvvs <ID>

Yours sincerely
Jonas
Hello, below is the information you requested, As you can see the first 2 commands did not produce any output.

~# qm showcmd 105 --pretty
/usr/bin/kvm \
-id 105 \
-name Windows11Pro \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/105.qmp,server=on,wait=off' \
-mon 'chardev=qmp,mode=control' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
-mon 'chardev=qmp-event,mode=control' \
-pidfile /var/run/qemu-server/105.pid \
-daemonize \
-smbios 'type=1,uuid=553dce15-a918-4400-a519-bf578e21e588' \
-drive 'if=pflash,unit=0,format=raw,readonly=on,file=/usr/share/pve-edk2-firmware//OVMF_CODE_4M.secboot.fd' \
-drive 'if=pflash,unit=1,id=drive-efidisk0,format=qcow2,file=/mnt/VM-STORAGE/images/105/vm-105-disk-3.qcow2' \
-smp '4,sockets=1,cores=4,maxcpus=4' \
-nodefaults \
-boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
-vga none \
-nographic \
-global 'kvm-pit.lost_tick_policy=discard' \
-cpu 'qemu64,+aes,-cet-ibt,-cet-ss,enforce,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+pni,+popcnt,+sse4.1,+sse4.2,+ssse3' \
-m 8192 \
-object 'memory-backend-ram,id=ram-node0,size=8192M' \
-numa 'node,nodeid=0,cpus=0-3,memdev=ram-node0' \
-object 'iothread,id=iothread-virtioscsi0' \
-readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
-device 'vmgenid,guid=24f918ab-388d-4cea-b1f2-280c83ad59f6' \
-device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
-device 'vfio-pci,host=0000:00:02.0,id=hostpci0,bus=ich9-pcie-port-1,addr=0x0' \
-chardev 'socket,id=tpmchar,path=/var/run/qemu-server/105.swtpm' \
-tpmdev 'emulator,id=tpmdev,chardev=tpmchar' \
-device 'tpm-tis,tpmdev=tpmdev' \
-chardev 'socket,path=/var/run/qemu-server/105.qga,server=on,wait=off,id=qga0' \
-device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' \
-device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' \
-device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
-iscsi 'initiator-name=iqn.1993-08.org.debian:01:92fca1ee624b' \
-drive 'file=/mnt/ISOIMAGES/template/iso/virtio-win-0.1.240.iso,if=none,id=drive-ide0,media=cdrom,format=raw,aio=io_uring' \
-device 'ide-cd,bus=ide.0,unit=0,drive=drive-ide0,id=ide0,bootindex=101' \
-device 'virtio-scsi-pci,id=virtioscsi0,bus=pci.3,addr=0x1,iothread=iothread-virtioscsi0' \
-drive 'file=/mnt/VM-STORAGE/images/105/vm-105-disk-4.qcow2,if=none,id=drive-scsi0,cache=writeback,discard=on,format=qcow2,aio=io_uring,detect-zeroes=unmap' \
-device 'scsi-hd,bus=virtioscsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0,id=scsi0,rotation_rate=1,bootindex=100' \
-netdev 'type=tap,id=net0,ifname=tap105i0,script=/usr/libexec/qemu-server/pve-bridge,downscript=/usr/libexec/qemu-server/pve-bridgedown,vhost=on' \
-device 'virtio-net-pci,mac=BC:24:11:BF:42:13,netdev=net0,bus=pci.0,addr=0x12,id=net0,rx_queue_size=1024,tx_queue_size=256,bootindex=102' \
-rtc 'driftfix=slew,base=localtime' \
-machine 'hpet=off,type=pc-q35-8.1+pve0'


# lspci -vvvs 00:02:0
02:00.0 Ethernet controller: Intel Corporation Ethernet Controller I225-V (rev 03)


Subsystem: Intel Corporation Device 0000


Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+


Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-


Latency: 0, Cache Line Size: 64 bytes


Interrupt: pin A routed to IRQ 19


Region 0: Memory at 50600000 (32-bit, non-prefetchable) [size=1M]


Region 3: Memory at 50700000 (32-bit, non-prefetchable) [size=16K]


Capabilities: [40] Power Management version 3


Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)


Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=1 PME-


Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+


Address: 0000000000000000 Data: 0000


Masking: 00000000 Pending: 00000000


Capabilities: [70] MSI-X: Enable+ Count=5 Masked-


Vector table: BAR=3 offset=00000000


PBA: BAR=3 offset=00002000


Capabilities: [a0] Express (v2) Endpoint, IntMsgNum 0


DevCap: MaxPayload 512 bytes, PhantFunc 0, Latency L0s <512ns, L1 <64us


ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset+ SlotPowerLimit 0W TEE-IO-


DevCtl: CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+


RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+ FLReset-


MaxPayload 256 bytes, MaxReadReq 512 bytes


DevSta: CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-


LnkCap: Port #0, Speed 5GT/s, Width x1, ASPM L1, Exit Latency L1 <4us


ClockPM- Surprise- LLActRep- BwNot- ASPMOptComp+


LnkCtl: ASPM Disabled; RCB 64 bytes, LnkDisable- CommClk+


ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-


LnkSta: Speed 5GT/s, Width x1


TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-


DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+


10BitTagComp- 10BitTagReq- OBFF Not Supported, ExtFmt- EETLPPrefix-


EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-


FRS- TPHComp- ExtTPHComp-


AtomicOpsCap: 32bit- 64bit- 128bitCAS-


DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-


AtomicOpsCtl: ReqEn-


IDOReq- IDOCompl- LTR+ EmergencyPowerReductionReq-


10BitTagReq- OBFF Disabled, EETLPPrefixBlk-


LnkCtl2: Target Link Speed: 5GT/s, EnterCompliance- SpeedDis-


Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-


Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot


LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete- EqualizationPhase1-


EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-


Retimer- 2Retimers- CrosslinkRes: unsupported


Capabilities: [100 v2] Advanced Error Reporting


UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP-


ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-


PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-


UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP-


ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-


PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-


UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+


ECRC- UnsupReq- ACSViol- UncorrIntErr+ BlockedTLP- AtomicOpBlocked- TLPBlockedErr-


PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-


CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr- CorrIntErr- HeaderOF-


CEMsk: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+ CorrIntErr- HeaderOF-


AERCap: First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-


MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-


HeaderLog: 00000000 00000000 00000000 00000000


Capabilities: [140 v1] Device Serial Number 58-47-ca-ff-ff-74-19-2b


Capabilities: [1c0 v1] Latency Tolerance Reporting


Max snoop latency: 3145728ns


Max no snoop latency: 3145728ns


Capabilities: [1f0 v1] Precision Time Measurement


PTMCap: Requester+ Responder- Root-


PTMClockGranularity: 4ns


PTMControl: Enabled+ RootSelected-


PTMEffectiveGranularity: 4ns


Capabilities: [1e0 v1] L1 PM Substates


L1SubCap: PCI-PM_L1.2- PCI-PM_L1.1+ ASPM_L1.2- ASPM_L1.1+ L1_PM_Substates+


L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-


L1SubCtl2:


Kernel driver in use: igc


Kernel modules: igc
 
Last edited:
Hello, below is the information you requested, As you can see the first 2 commands did not produce any output.
This strengthens @leesteken 's point with the BIOS update / reset.
Please check the configuration there for IOMMU or VT-d / AMD-Vi and other virtualization related options.

Apart from that i can just ask you to re-verify that all the configuration mentioned here [1] is in place and applied.

[1] https://pve.proxmox.com/wiki/PCI(e)_Passthrough
 
  • Like
Reactions: Bishop27
Thank you Both!!! I look into the BIOS yesterday and notice VT-d was set back to the default which is disable. Enabled it and now I can spin up windows!!!