Unable to boot a vm in uefi mode on a kvm arm64 host

### problem

Unable to boot a vm in uefi mode on a kvm arm64 host

### versions

ACS 4.22
KVM Ubuntu 24.0.4

### The steps to reproduce the bug

1. On the kvm host make sure the efi packages (apt install swtpm qemu-efi-aarch64)

2. Create a uefi properties file

```

root@raspberrypi5-cloudstack:~# cat /etc/cloudstack/agent/uefi.properties
# CloudStack Agent UEFI Configuration for ARM64
# This file configures UEFI boot support for ARM64 virtual machines

# Secure boot mode with Microsoft keys
guest.nvram.template.secure=/usr/share/AAVMF/AAVMF_VARS.ms.fd
guest.loader.secure=/usr/share/AAVMF/AAVMF_CODE.ms.fd

# Secure boot mode without Microsoft keys
guest.nvram.template.secboot=/usr/share/AAVMF/AAVMF_VARS.fd
guest.loader.secboot=/usr/share/AAVMF/AAVMF_CODE.secboot.fd

# Standard UEFI mode (default)
guest.nvram.template.legacy=/usr/share/AAVMF/AAVMF_VARS.fd
guest.loader.legacy=/usr/share/AAVMF/AAVMF_CODE.fd

# No secure boot mode (explicitly disabled)
guest.nvram.template.nosecboot=/usr/share/AAVMF/AAVMF_VARS.fd
guest.loader.nosecboot=/usr/share/AAVMF/AAVMF_CODE.no-secboot.fd

# NVRAM storage path
guest.nvram.path=/var/lib/libvirt/qemu/nvram/

```

3. Restart the services

service libvirtd restart

service cloudstack-agent restart

4. Launch a vm select the boot mode as UEFI and secure

5. Exception observed

```
root@raspberrypi5-cloudstack:~# cat /var/log/cloudstack/agent/agent.log |grep -i "logid:04a17230"
2025-12-23 05:51:11,829 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:11,834 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:11,842 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Creating volume b491328b-ef97-4bf3-ab0e-e2973a50a761 from template b2173816-1a35-49ea-b1e1-b1ede4ade146 in pool 1a655239-1930-3a48-b0c5-9069065c283d (NetworkFilesystem) with size (3.50 GB) 3758096384
2025-12-23 05:51:11,843 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Attempting to create volume b491328b-ef97-4bf3-ab0e-e2973a50a761 (NetworkFilesystem) in pool 1a655239-1930-3a48-b0c5-9069065c283d with size (3.50 GB) 3758096384
2025-12-23 05:51:11,903 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-5:[]) (logid:04a17230) Creating volume [/mnt/1a655239-1930-3a48-b0c5-9069065c283d/b491328b-ef97-4bf3-ab0e-e2973a50a761] with backing file [/mnt/1a655239-1930-3a48-b0c5-9069065c283d/b2173816-1a35-49ea-b1e1-b1ede4ade146] as the property [create.full.clone] is [false].
2025-12-23 05:51:12,041 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-4:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:12,077 INFO [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-4:[]) (logid:04a17230) Trying to fetch storage pool 1a655239-1930-3a48-b0c5-9069065c283d from libvirt
2025-12-23 05:51:12,105 WARN [kvm.resource.LibvirtKvmAgentHook] (AgentRequest-Handler-4:[]) (logid:04a17230) Groovy script '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.groovy' is not available. Transformations will not be applied.
2025-12-23 05:51:12,105 WARN [kvm.resource.LibvirtKvmAgentHook] (AgentRequest-Handler-4:[]) (logid:04a17230) Shell script '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.sh' is not available. Transformations will not be applied.
2025-12-23 05:51:12,105 WARN [kvm.resource.LibvirtKvmAgentHook] (AgentRequest-Handler-4:[]) (logid:04a17230) Groovy scripting engine is not initialized. Data transformation skipped.
2025-12-23 05:51:12,107 WARN [resource.wrapper.LibvirtStartCommandWrapper] (AgentRequest-Handler-4:[]) (logid:04a17230) LibvirtException org.libvirt.LibvirtException: XML error: No PCI buses available

```

Workaround

Boot into BIOS and LEGACY

VM boots , verify

On the kvm host dumpxml of the vm

```

hvm
/usr/share/AAVMF/AAVMF_CODE.fd
/var/lib/libvirt/qemu/nvram/i-2-131-VM_VARS.fd

```

login to the vm and verify

ls /sys/firmware/efi

[ -d /sys/firmware/efi ] && echo "UEFI boot" || echo "Legacy BIOS"

### What to do about it?

Cloudstack should BOOT mode UEFI and secure on kvm arm64 hosts

/etc/cloudstack/agent/uefi.properties の UEFI 設定と、“No PCI buses available.” を報告している agent.log のエントリから始めます。dumpxml で生成された VM XML について、loader と NVRAM のエントリを含め、失敗する UEFI ケースおよび動作する legacy ケースと比較します。ARM64 KVM ホスト上で VM が UEFI および secure mode で起動し、/sys/firmware/efi が存在すれば完了です。

索引モデルが issue の本文から書いたものです。