Unable to boot a vm in uefi mode on a kvm arm64 host

### problem

Unable to boot a vm in uefi mode on a kvm arm64 host

### versions

ACS 4.22
KVM Ubuntu 24.0.4

### The steps to reproduce the bug

1. On the kvm host make sure the efi packages (apt install swtpm qemu-efi-aarch64)

2. Create a uefi properties file

```

root@raspberrypi5-cloudstack:~# cat /etc/cloudstack/agent/uefi.properties
# CloudStack Agent UEFI Configuration for ARM64
# This file configures UEFI boot support for ARM64 virtual machines

# Secure boot mode with Microsoft keys
guest.nvram.template.secure=/usr/share/AAVMF/AAVMF_VARS.ms.fd
guest.loader.secure=/usr/share/AAVMF/AAVMF_CODE.ms.fd

# Secure boot mode without Microsoft keys
guest.nvram.template.secboot=/usr/share/AAVMF/AAVMF_VARS.fd
guest.loader.secboot=/usr/share/AAVMF/AAVMF_CODE.secboot.fd

# Standard UEFI mode (default)
guest.nvram.template.legacy=/usr/share/AAVMF/AAVMF_VARS.fd
guest.loader.legacy=/usr/share/AAVMF/AAVMF_CODE.fd

# No secure boot mode (explicitly disabled)
guest.nvram.template.nosecboot=/usr/share/AAVMF/AAVMF_VARS.fd
guest.loader.nosecboot=/usr/share/AAVMF/AAVMF_CODE.no-secboot.fd

# NVRAM storage path
guest.nvram.path=/var/lib/libvirt/qemu/nvram/

```

3. Restart the services

service libvirtd restart

service cloudstack-agent restart

4. Launch a vm select the boot mode as UEFI and secure

5. Exception observed

```
root@raspberrypi5-cloudstack:~# cat /var/log/cloudstack/agent/agent.log |grep -i "logid:04a17230"
2025-12-23 05:51:11,829 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:11,834 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:11,842 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Creating volume b491328b-ef97-4bf3-ab0e-e2973a50a761 from template b2173816-1a35-49ea-b1e1-b1ede4ade146 in pool 1a655239-1930-3a48-b0c5-9069065c283d (NetworkFilesystem) with size (3.50 GB) 3758096384
2025-12-23 05:51:11,843 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Attempting to create volume b491328b-ef97-4bf3-ab0e-e2973a50a761 (NetworkFilesystem) in pool 1a655239-1930-3a48-b0c5-9069065c283d with size (3.50 GB) 3758096384
2025-12-23 05:51:11,903 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Creating volume [/mnt/1a655239-1930-3a48-b0c5-9069065c283d/b491328b-ef97-4bf3-ab0e-e2973a50a761] with backing file [/mnt/1a655239-1930-3a48-b0c5-9069065c283d/b2173816-1a35-49ea-b1e1-b1ede4ade146] as the property [create.full.clone] is [false].
2025-12-23 05:51:12,041 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-4:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:12,077 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-4:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:12,105 WARN [kvm.resource.LibvirtKvmAgentHook] (AgentRequest-Handler-4:[]) (logid:04a17230) Groovy script '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.groovy' is not available. Transformations will not be applied.
2025-12-23 05:51:12,105 WARN [kvm.resource.LibvirtKvmAgentHook] (AgentRequest-Handler-4:[]) (logid:04a17230) Shell script '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.sh' is not available. Transformations will not be applied.
2025-12-23 05:51:12,105 WARN [kvm.resource.LibvirtKvmAgentHook] (AgentRequest-Handler-4:[]) (logid:04a17230) Groovy scripting engine is not initialized. Data transformation skipped.
2025-12-23 05:51:12,107 WARN [resource.wrapper.LibvirtStartCommandWrapper] (AgentRequest-Handler-4:[]) (logid:04a17230) LibvirtException org.libvirt.LibvirtException: XML error: No PCI buses available

```

Workaround

Boot into BIOS and LEGACY

VM boots , verify

On the kvm host dumpxml of the vm

```

hvm
/usr/share/AAVMF/AAVMF_CODE.fd
/var/lib/libvirt/qemu/nvram/i-2-131-VM_VARS.fd

```

login to the vm and verify

ls /sys/firmware/efi

[ -d /sys/firmware/efi ] && echo "UEFI boot" || echo "Legacy BIOS"

### What to do about it?

Cloudstack should BOOT mode UEFI and secure on kvm arm64 hosts

Comienza con la configuración de UEFI en /etc/cloudstack/agent/uefi.properties y la entrada de agent.log que informa de “No PCI buses available.” Compara el XML de la VM generado por dumpxml, incluidas sus entradas de loader y NVRAM, con los casos UEFI que fallan y los casos Legacy que funcionan. Se considera terminado cuando una VM arranca en UEFI y secure mode en un host KVM ARM64 y /sys/firmware/efi está presente.

Escrito por el modelo de indexación a partir del texto del issue.