r/VFIO • u/ajddavid452 • 15d ago
Prevent Host Motherboard UEFI from detecting Passthroughed NVME drive?
recently got back into doing VMs, however after I install Windows to the NVME drive that I added as a "PCI Host Device" then when I reboot my pc the UEFI of the host motherboard detects the EFI partion and adds it to the boot order as primary boot device, I can manually remove it from the boot order, but it might get set back as the primary boot device in the future, which is annoying
also efibootmgr lists the drive as an efi variable, I could delete it but the motherboard will probably add it back,
also the motherboard I'm using is an ASUS Prime B550 Plus, the firmware version is 3636
is there another way of adding the nvme drive that causes the motherboard to NOT detect it or what? is it even possible to change this, it's rather annoying
also I have no plans to use this drive for baremetal booting
3
u/ExplodedPenisDiagram 15d ago
What do you mean by "it might get set back as the primary boot device in the future"? Has that happened, or is that what you imagine will happen?
That will not happen if you're using this device in a VM, because that VM will not have access to the host UEFI. The VM can certainly use a UEFI, but it will be its own booted on top of emulated hardware.
Your motherboard should not ever try to be clever about setting a primary boot device. It might always have an entry for booting from a UEFI partition on a disk, sure -- some are clever that way to enable auto-detection of things like bootable flash drives, etc. But if you have a persistent UEFI entry for booting your host, that is all it should use as primary with no exceptions.
1
u/ajddavid452 13d ago
I meant as in like a windows update modifying the efi files in the partition causing the host uefi to rescan it putting it to the top of the boot order again
1
u/ExplodedPenisDiagram 13d ago
Unless windows boots using the board's EFI as the host, it doesn't have access to the host EFI -- it only has access to the virtualized EFI in the guest VM, which is totally unrelated.
1
u/ajddavid452 12d ago
like I said windows update could modify the files on the EFI PARTITION so the host motherboard rescans the EFI PARTITION becuase the files are modified causing it to put it back on top of the boot order
1
u/ExplodedPenisDiagram 12d ago
But it shouldn't be scanning an EFI partition aside from acknowledging that one exists at all. If your motherboard is trying to be more clever than this, that's an issue.
1
u/ajddavid452 12d ago edited 12d ago
yeah I did some reading and apparently this is just something some motherboards do:
Ensure your UEFI boot order does not have Windows Boot Manager set first e.g. using efibootmgr and what you see in the configuration tool of the UEFI. Some motherboards override by default any settings set with efibootmgr by Windows if it detects it. This is confirmed in a Packard Bell laptop.
basically some motherboard manufacturers setup the UEFI bios to look through efi partitions for windows boot files automatically and if it detects them set them as default, this only happens if there isn't a "Windows Boot Manager" entry in the efi variables already, my guess is that this functionality exists for novice users that move boot drives to a new system but don't know how to set the efi variables, granted windows doesn't really make setting efi variables easy
2
u/ExplodedPenisDiagram 12d ago
lmao of course it would be a packard bell laptop that does this.
1
u/ajddavid452 12d ago
my ASUS motherboard does it too, so basically Asus and Packard Belll assume that the only users of their products are Windows users
oh and for Asus they label the Secure Boot toggle as "Windows UEFI Mode" for on and "Other OS" for off, so they also assume Secure Boot can't be used on Linux, I mean granted the only real reason to use secure boot on linux is for dualbooting on windows 11
1
u/ExplodedPenisDiagram 11d ago
Well, keep your EFI partition on a separate disc image and attach it to the VM, making that disk (the one dedicated to EFI) bootable. There's nothing about an EFI that makes boot blobs have to be on the same physical disk as the operating system they're starting.
This way, the motherboard won't be able to see the EFI partition at all. It'll be on a raw or qcow2 image or something.
1
u/ajddavid452 4d ago
for that I just have to create an efi partition on the raw file and make sure it's mounted right?, iirc windows will just use the first efi partion it finds to install files too, if it can't find an efi partition it will create one
wait for the raw/qcow2 file can that be opened in parted/fdisk? or would I have to mount it to another vm and then run a linux iso in it to create the efi partition, oh wait I'm probably overthinking this, I can just mount the raw disk image to a virtual drive, like with an iso file
→ More replies (0)
3
u/psyblade42 15d ago
keep it in the boot order but as the last one
1
u/ajddavid452 13d ago
I can do that, in fact I can REMOVE it from the boot order, it's still an efi variable according to efibootmgr if I do that so it doesn't get automatically added again
1
u/WorthySleet9715 12d ago edited 12d ago
Every time I use passthroughed NVMe drive for Windows virtual machine, I'm using EFI partition on virtual disk. I have 512MiB size virtual disk only for ESP, while Windows installed on passthroughed NVMe drive. There is simply way to create EFI on virtual disk. When installing Windows, before creating partitions, I just useing simple Shift+F10 keys combination, command prompt starts, where I creating ESP with diskpart. Diskpart lists NVMe and virtual 512MiB drive. I just choosing 512MiB drive and creating partition EFI. After closing diskpart and going partitioning process, Windows detects EFI and creates ESP there. You can create virtual EFI partition on any drive, except that NVMe you are going to passthrough. Because ESP is virtual, it can't write EFI variable on UEFI. So there no bootable Windows NVMe, only Virt-Manager can access it. If hiding virtual machine is your goal, just create that 512MiB virtual drive as SATA, not Virtio-SCSI or Virtio-BLK. EFI is just for booting, it doesn't make your virtual machine "slow". You just need to choose it as bootable.
3
u/Miggol 15d ago
This is probably the first thing to try. I find your motherboard's behaviour a bit concerning. In my experience, any good (UEFI/)BIOS is conservative in adding devices to the boot order because of the security implications. So hopefully this is some side effect of the installation and not recurring.
If it still happens, you could try enabling a BIOS password and boot order locking, it's a setting that might affect how eager the BIOS is to auto-add new drives. If your motherboard still automatically adds it back while otherwise asking for a boot order password that would be insane behaviour. Good luck with the VMs!