Proxmox-boot-tool cannot write EFI variables

[gabrioth]

When running "proxmox-boot-tool init" on a new system drive, I get an error message and it doesn't finish. "Failed to create EFI Boot variable entry: Invalid argument"
Anybody know what it's about? Is this an efi/bios setting around secure-boot that needs to be changed?
It affects both nvme0n1 and nvme1n1.

According to "proxmox-boot-tool status" he system is booted with systemd/uefi:
root@proxmox:/# proxmox-boot-tool status
Re-executing '/usr/sbin/proxmox-boot-tool' in new private mount namespace..
System currently booted with uefi
60EC-4347 is configured with: uefi (versions: 5.13.19-6-pve, 5.15.39-1-pve, 5.15.39-4-pve)
60EC-79FD is configured with: uefi (versions: 5.13.19-6-pve, 5.15.39-1-pve, 5.15.39-4-pve)
60EC-B198 is configured with: uefi (versions: 5.13.19-6-pve, 5.15.39-1-pve, 5.15.39-4-pve)

The partition table looks exactly like the drives in my bootable SATA SSDs:

root@proxmox:~# sgdisk -p /dev/nvme1n1
Disk /dev/nvme1n1: 976773168 sectors, 465.8 GiB
Model: KINGSTON SNVS500G
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): 313981E1-2162-4E7C-B56A-24BF764ADCA6
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 976773134
Partitions will be aligned on 8-sector boundaries
Total free space is 0 sectors (0 bytes)

Number Start (sector) End (sector) Size Code Name
1 34 2047 1007.0 KiB EF02
2 2048 1050623 512.0 MiB EF00
3 1050624 976773134 465.3 GiB BF01

Se below for the output and error message when trying to initialize the drives:

root@proxmox:~# proxmox-boot-tool init /dev/nvme1n1p2
Re-executing '/usr/sbin/proxmox-boot-tool' in new private mount namespace..
UUID="BCCE-7159" SIZE="536870912" FSTYPE="vfat" PARTTYPE="c12a7328-f81f-11d2-ba4b-00a0c93ec93b" PKNAME="nvme1n1" MOUNTPOINT=""
Mounting '/dev/nvme1n1p2' on '/var/tmp/espmounts/BCCE-7159'.
Installing systemd-boot..
Created "/var/tmp/espmounts/BCCE-7159/EFI/systemd".
Created "/var/tmp/espmounts/BCCE-7159/EFI/BOOT".
Created "/var/tmp/espmounts/BCCE-7159/loader".
Created "/var/tmp/espmounts/BCCE-7159/loader/entries".
Created "/var/tmp/espmounts/BCCE-7159/EFI/Linux".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/var/tmp/espmounts/BCCE-7159/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/var/tmp/espmounts/BCCE-7159/EFI/BOOT/BOOTX64.EFI".
Random seed file /var/tmp/espmounts/BCCE-7159/loader/random-seed successfully written (512 bytes).
Unable to write 'LoaderSystemToken' EFI variable (firmware problem?), ignoring: Invalid argument
Failed to create EFI Boot variable entry: Invalid argument

 

[gabrioth]

I cannot for the life of me understand what I did, I just messed around with the secure-boot/custom saettings in my bios, but I finally got it to work.
My MSI X470 motherboard had an "enroll" setting under the secure boot menu (actually "windows boot settings"), in which I "enrolled" all PCI storage devices (there were only PCI and USB storage devices listed). After that I booted and it worked.

root@proxmox:~# proxmox-boot-tool init /dev/nvme1n1p2
Re-executing '/usr/sbin/proxmox-boot-tool' in new private mount namespace..
UUID="F006-EEA4" SIZE="536870912" FSTYPE="vfat" PARTTYPE="c12a7328-f81f-11d2-ba4b-00a0c93ec93b" PKNAME="nvme1n1" MOUNTPOINT=""
Mounting '/dev/nvme1n1p2' on '/var/tmp/espmounts/F006-EEA4'.
Installing systemd-boot..
Created "/var/tmp/espmounts/F006-EEA4/EFI/systemd".
Created "/var/tmp/espmounts/F006-EEA4/EFI/BOOT".
Created "/var/tmp/espmounts/F006-EEA4/loader".
Created "/var/tmp/espmounts/F006-EEA4/loader/entries".
Created "/var/tmp/espmounts/F006-EEA4/EFI/Linux".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/var/tmp/espmounts/F006-EEA4/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/var/tmp/espmounts/F006-EEA4/EFI/BOOT/BOOTX64.EFI".
Random seed file /var/tmp/espmounts/F006-EEA4/loader/random-seed successfully written (512 bytes).
Created EFI boot entry "Linux Boot Manager".
Configuring systemd-boot..
Unmounting '/dev/nvme1n1p2'.
Adding '/dev/nvme1n1p2' to list of synced ESPs..
Refreshing kernels and initrds..
Running hook script 'proxmox-auto-removal'..
Running hook script 'zz-proxmox-boot'..
Copying and configuring kernels on /dev/disk/by-uuid/60EC-4347
Copying kernel and creating boot-entry for 5.13.19-6-pve
Copying kernel and creating boot-entry for 5.15.39-1-pve
Copying kernel and creating boot-entry for 5.15.39-4-pve
Copying and configuring kernels on /dev/disk/by-uuid/60EC-79FD
Copying kernel and creating boot-entry for 5.13.19-6-pve
Copying kernel and creating boot-entry for 5.15.39-1-pve
Copying kernel and creating boot-entry for 5.15.39-4-pve
Copying and configuring kernels on /dev/disk/by-uuid/60EC-B198
Copying kernel and creating boot-entry for 5.13.19-6-pve
Copying kernel and creating boot-entry for 5.15.39-1-pve
Copying kernel and creating boot-entry for 5.15.39-4-pve
Copying and configuring kernels on /dev/disk/by-uuid/CADB-731E
Copying kernel and creating boot-entry for 5.13.19-6-pve
Copying kernel and creating boot-entry for 5.15.39-1-pve
Copying kernel and creating boot-entry for 5.15.39-4-pve
Copying and configuring kernels on /dev/disk/by-uuid/F006-EEA4
Copying kernel and creating boot-entry for 5.13.19-6-pve
Copying kernel and creating boot-entry for 5.15.39-1-pve
Copying kernel and creating boot-entry for 5.15.39-4-pve

 

[jsg]

Thank you for sharing this! This is what worked for me. I had simply replaced a drive on a system that had been previously working just fine. I had never had this issue before even having installed proxmox on multiple different machines over the years. I don't understand the whole secure boot thing, clearly. Anyway, thank you for ending my torment.

 

[gabrioth]

Thank you for sharing this! This is what worked for me. I had simply replaced a drive on a system that had been previously working just fine. I had never had this issue before even having installed proxmox on multiple different machines over the years. I don't understand the whole secure boot thing, clearly. Anyway, thank you for ending my torment.

Replies like this one is why I always post the answers to my own questions on forums