Replies: 11 comments 39 replies
-
|
If the issue is DBX related you may be able to manually provision your VM with the latest DBX [1]
[1] Info on getting the latest DBX file:
https://uefi.org/revocationlistfile
Thanks,
Andrew Fish
… On Aug 18, 2022, at 11:09 PM, Elrondo46 ***@***.***> wrote:
Hi,
I've Windows 11 virtualized and this update can't be install with this UEFI config in QEMU-KVM, think it's caused by actual UEFI firmware. In real machine no probs, in VMWare (UEFI) no probs.
There is a user have the same problem in Windows 10
https://www.linuxquestions.org/questions/showthread.php?p=6374147#post6374147
—
Reply to this email directly, view it on GitHub <#3221>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD4ZCO6NNKLNQPGG3LALRSDVZ4QK7ANCNFSM567RHBEQ>.
You are receiving this because you are subscribed to this thread.
|
Beta Was this translation helpful? Give feedback.
-
|
How to do that ? |
Beta Was this translation helpful? Give feedback.
-
|
… Sent from my iPhone
On Aug 19, 2022, at 1:18 PM, Elrondo46 ***@***.***> wrote:
How to do that ?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.
|
Beta Was this translation helpful? Give feedback.
-
|
Will the DBX be updated in a later release of the ed2k-ovmf ? |
Beta Was this translation helpful? Give feedback.
-
|
Any updates on this issue? This seems to affect at least a few people and WIndows VMs with Secure Boot can't get past any update once |
Beta Was this translation helpful? Give feedback.
-
|
Likely because not too many people have noticed this issue so far. This also seems to only affect 'older' / longer running Windows 10 VMs that have been created before OVMF with 4M space was a thing (seems to be the default in Proxmox now). This issue just popped up on the 15th of September 2022 so maybe more people will notice these issues and land here. Maybe some don't care about failed updates in Windows VMs as long there is no policy enforcing it to have all updates by date x. Interestingly OVMF on Fedora 36 does not come with a 4M version (at least not obviously named like so), which is why I had to copy mine over from a Proxmox host. 🤔 Nonetheless with my particular system I have had a ton of issues with Glad my findings helped you! |
Beta Was this translation helpful? Give feedback.
-
|
I'm unfamiliar with these packaging details, and how exactly OVMF*fd files get built. I'm happy to create Fedora bug against their ed2k package, if I can have a cogent explanation of what needs to be done to build these images, that I can put into the bug. |
Beta Was this translation helpful? Give feedback.
-
|
I had the same promblem installing KB5012170 on a KVM virtualized machine (Win10 Pro, no secure boot, no vTPM) on Debian 10. What worked for me:
|
Beta Was this translation helpful? Give feedback.
-
|
Changed to 4M files and update success. |
Beta Was this translation helpful? Give feedback.
-
|
Also worked for me. I grabbed the ovmf files from proxmox and used the 4M files for both the bios and the nvram. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Hey guys,
Thanks to @BentHaase for finding out! |
Beta Was this translation helpful? Give feedback.
-
Im on fedora with win11 too. I tried this and it worked. But i checked and my vm has secureboot off now. Thanks don but ya might wanna check that because you wont get feature updates now. |
Beta Was this translation helpful? Give feedback.
-
|
@Windows-Guy: sorry for the late response, but where did you see the "no secure boot"? |
Beta Was this translation helpful? Give feedback.
-
|
I think its in windows settings security devices in win 11. Just google hiw do i tell if secure boot is on in windows whatever. But the gist of it is that fedoras not doing something right yet w those 4m uefis. And when you do what you and i did, that kb5012170 goes away nit because it installed but because secure boot is now off. So the problem didnt go away. Upcoming updates like that one wont be a problem because secure boot is off. What will be a problem is when a feature update like 22h2 comes out. Windows will say your machine doesnt qualify for it. My work arround until this works by default on fedora was to go back to mint. 21.1 came out after i tried this on fedora37 and as long as i picked the uefi that said blah blah 4M.ms. Ir something like that, it worked. I had secboot on and it installed the 2170 update like it was a real machine. Now i should get updates like that and qualify for yearly big updates. Hope this helps |
Beta Was this translation helpful? Give feedback.
-
|
Just thought you should check yours to see if secure boot is enabled. If it is youre done. But if it did what mine did, the problem just got pushed a year out when itll be a bigger problem to start over |
Beta Was this translation helpful? Give feedback.
-
This is happening because the wrong VARS file is being copied. You don't want the 4M version of "OVMF_VARS.fd" for secure boot, you want "OVMF_VARS_4M.ms.fd". I use the ones from the deb file however, so I'm not sure on the exact location from the original guide, but in theory it is probably here: cp /usr/share/edk2/ovmf-4m/OVMF_VARS.ms.fd Don't quote me on that though, it's just a guess! In any case, using the "ms" fd file should re-activate your secure boot (if nothing else was/is broken). |
Beta Was this translation helpful? Give feedback.
-
|
I did as suggested by @donvipre but when I attempt to boot up the virtual machine I only get a blank screen. The CPU peaks so something is happening but nothing else can be seen. I verified the ownership and permissions were the same but that didn't make any difference. So then I thought I would reinstall Win11 and pick the /usr/share/edk2/ovmf-4m lib for the Hypervisor setup but when I attempt to begin the install I get an error message about PCI versus PCIe. I'm very much a noob so my apologies if I'm asking/doing stupid questions |
Beta Was this translation helpful? Give feedback.
-
|
I had the same problem and my host machine is running Mint 21 (Ubuntu 22.04 LTS). I can confirm that changing from OVMF_CODE.fd to OVMF_CODE_4M.fd in the XML solved the issue. |
Beta Was this translation helpful? Give feedback.
-
Similar here, Fedora 37, have a VM without secure-boot, or Bitlocker. There was no OVMF file set in XML. It did not let me apply with the path setting added due to an auto-select firmware setting. I could not find how to turn that off, so I recreated the VM, reused the disk. I also had to use a backup of the VRAM file, because it got deleted with the old VM afterwards. Booted right away without issues. (In Fedora 37 the 4M images are in a directory next to the small images.) |
Beta Was this translation helpful? Give feedback.
{{title}}
{{editor}}'s edit
{{editor}}'s edit
-
|
I want 3 things in my win11 kvm so ive been debating between mint and fedora id just did a fresh install of mint 21.1 im done |
Beta Was this translation helpful? Give feedback.
-
|
@Windows-Guy this reads like a poem -- I love it. If you really want Fedora, I've used KVM/QEMU on it as a host, though, with Win11 & Win10 (when I realised how bloaty Win11 is) as guests. My method was to use I'm now using openSUSE and really enjoying it. I moved over my Win10 VM but forgot to copy the config so redid it from scratch, just importing the <os>
<type arch="x86_64" machine="pc-q35-7.1">hvm</type>
<loader readonly="yes" type="pflash">/usr/share/qemu/ovmf-x86_64-ms-4m-code.bin</loader>
<nvram>/home/kjkent/vm/win10ltsc2021.vars.secboot.fd</nvram>
<boot dev="hd"/>
</os> |
Beta Was this translation helpful? Give feedback.
-
|
I just tried fedora 38, it still doesnt work by some default pick. It seems that the 4m edk2 stuff id there but you cant pick it in virt manager. In any case, it works perfectly in mint 21.1. Im officially done with this project. I think the problem with bleeding edge distros is it take so much time to integrate all the new stuff that the project as a whole never gets any quality control because its a moving target every 6 months. |
Beta Was this translation helpful? Give feedback.
-
|
This needs to be resolved in the virt-manager package. I have created a bug against virt-manager, to add the 4m images, and, yes, nothing have happened on it, yet. |
Beta Was this translation helpful? Give feedback.
-
|
I was finally able to get this to work under Fedora 37 using Virtual Machine. I followed this set of directions to reinstall Windows 11 in a Virtual Machine: https://getlabsdone.com/how-to-install-windows-11-on-kvm/#tpm-and-secureboot When I got to step 8. Enable Secure-Boot, I had to do the follow:
When Windows 11 was up and running, all updates have applied successfully. |
Beta Was this translation helpful? Give feedback.
-
|
Forgot to mention that after setting up a domain, you'll still need to manually copy the OVMF-VARS to overwrite the one that libvirt installs. |
Beta Was this translation helpful? Give feedback.
-
|
Ahh, right ... I did say previously that I was new to this. Thanks for the correction! |
Beta Was this translation helpful? Give feedback.
{{title}}
{{editor}}'s edit
{{editor}}'s edit
-
|
I agree and these are the steps I did while setting up a new domain/VM:
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for directing me in the right direction. But with the I've tested it then with the latest |
Beta Was this translation helpful? Give feedback.
-
|
Using the .fd from the Debian package worked for me too. |
Beta Was this translation helpful? Give feedback.
-
|
Im pretty new to virtualization in fedora and i was not able to start the windows installer for a new VM with qemu. even after reading this thread. however when i downgraded edk2-ovmf (sudo dnf downgrade edk2-ovmf) i was able to run a new VM + installer withouth a problem. Hope that helps someone! |
Beta Was this translation helpful? Give feedback.
-
|
That fixed it for me - thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Same issue on my machine Hello. I am using Fedora 38. I cannot run current windows 10 and windows 11 images in UEFI mode. |
Beta Was this translation helpful? Give feedback.
-
|
This error ""The PCI controller with index='0' must be model='pci-root' for this machine type, but model='pcie-root' was found instead"" is due to a bug in Virtual-manager (which I was alluding to in my initial response). I encountered this too and found this info (virt-manager/virt-manager#398): _You select win10, so virt-manager defaults to q35. When you enter the 'Customize' wizard, virt-manager pre-populate the XML with a bunch of pcie controller bits, to enable PCIe hotplug on q35. You are trying to switch back to machine=pc, but then libvirt says 'hey all those pcie bits in the XML aren't valid for machine=pc'. Yes that's a bug in virt-manager You can work around this by deleting all the <controller type='pci* bits in the XML first, with the XML editor tab in the virt-manager Overview section, and then change q35 to pc. But yeah virt-manager needs to be fixed too_ You'll want to do that above prior to booting up |
Beta Was this translation helpful? Give feedback.
{{title}}
{{editor}}'s edit
{{editor}}'s edit
-
Same issue :(
|
Beta Was this translation helpful? Give feedback.
-
|
So... |
Beta Was this translation helpful? Give feedback.
-
|
I think until Virtual-Machine Manager fixes the secure boot process this is broke under Fedora 38. You can try what others have documented above (e.g., DutchTurtle's post from 3 weeks ago). I can't do that without running the risk of breaking my existing windows 11 virtual machine. svarshavchik has opened a bug on this issue as documented above. Sorry for not being able to provide much help. |
Beta Was this translation helpful? Give feedback.
-
np, thanks for helps |
Beta Was this translation helpful? Give feedback.
{{title}}
-
Hi,
I've Windows 11 virtualized and this update can't be install with this UEFI config in QEMU-KVM, think it's caused by actual UEFI firmware. In real machine no probs, in VMWare (UEFI) no probs.
There is a user have the same problem in Windows 10
https://www.linuxquestions.org/questions/showthread.php?p=6374147#post6374147
Beta Was this translation helpful? Give feedback.
All reactions