UEFI and Secure Boot for KVM VMs with OVMF

New operating systems increasingly expect UEFI firmware, and Windows 11 requires UEFI with Secure Boot and TPM 2.0. On KVM, UEFI is provided by OVMF, an open-source firmware build. This guide covers UEFI and Secure Boot for KVM VMs.

Before you start

• A KVM host with libvirt and the firmware package: ovmf (Debian/Ubuntu) or edk2-ovmf (RHEL family).
• For a virtual TPM: swtpm and swtpm-tools.
• Firmware type is chosen when the VM is created; switching later needs care (see below).

BIOS vs UEFI for VMs

Create a UEFI VM

virt-install --name uefi01 --memory 4096 --vcpus 2 --machine q35 --boot uefi --disk size=40,bus=virtio --cdrom /var/lib/libvirt/images/ubuntu-24.04-live-server-amd64.iso --os-variant ubuntu24.04 --network bridge=br0,model=virtio --graphics vnc,listen=127.0.0.1 --noautoconsole

libvirt picks a firmware image and creates a per-VM NVRAM file under /var/lib/libvirt/qemu/nvram/ that stores boot entries and variables.

Enable Secure Boot

With recent libvirt, request Secure Boot firmware explicitly:

--boot firmware=efi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=yes,firmware.feature1.name=enrolled-keys,firmware.feature1.enabled=yes

This selects an OVMF build with Microsoft keys enrolled, so Windows and signed Linux distributions boot. Secure Boot requires the q35 machine type and SMM, which libvirt enables automatically for these firmware builds.

Add a virtual TPM

--tpm backend.type=emulator,backend.version=2.0,model=tpm-crb

The TPM state is stored per VM by swtpm. See install a Windows VM on KVM for a full Windows 11/Server example.

Check inside the guest

• Linux: [ -d /sys/firmware/efi ] && echo UEFI and mokutil --sb-state.
• Windows: run msinfo32 and check BIOS Mode and Secure Boot State.

Converting an existing BIOS VM

Changing the VM to UEFI alone will not boot an MBR install. The guest disk must be converted to GPT with an EFI System Partition and a UEFI bootloader (Windows offers mbr2gpt; Linux requires repartitioning or reinstalling GRUB for EFI). Back up first, or reinstall.

Troubleshooting

• Drops to UEFI shell: no boot entry; the disk has no EFI bootloader, or NVRAM was reset. Boot the ISO and repair, or use the firmware boot manager.
• "Access denied" / unsigned kernel: Secure Boot blocks unsigned modules or kernels; sign them, enrol a MOK, or disable Secure Boot for that VM.
• virsh undefine fails: add --nvram to remove the NVRAM file.
• Snapshots unsupported: some libvirt versions limit internal snapshots of UEFI VMs; use external snapshots.

Frequently asked questions

Should all new VMs use UEFI?

For modern OSes, yes. Keep BIOS only for legacy systems or templates that require it.

Does UEFI change performance?

No noticeable runtime difference; boot can be slightly slower.

Can my VPS provider enable Secure Boot?

It is a host setting; ask your provider if your plan supports UEFI templates.

Next steps

• Install a Windows VM on KVM
• Create a VM with virt-install
• KVM common errors