VM start stuck on "Guest has not initialized the display (yet)."

lukasz_s

Xcp-ng version 8.3 (upgraded from Xen 8.0)
Installed all available patches.
Managed by XO community version latest.

Settings for VM:
Boot firmware: uefi
Secure boot: enabled
VTPM: enabled

Hi guys

Windows 11 installation from iso , works ok, installation has done, but after finishing installation and reboot vm stuck on screen with "VM start stuck on "Guest has not initialized the display (yet)."
Cant even enter the uefi setting or boot from iso.
I tried starting with or without mounted iso, tried disable secure boot, but no luck, vm even don' try boot up , screen freezes on that phrase.

The error i see in /var/log/xensource.log :

error||75157 :::80|dispatch:VM.get_secureboot_readiness D:6fb3730d40a6|backtrace] VM.get_secureboot_readiness R:77a097481bb1 failed with exception Forkhelpers.Spawn_internal_error("unserialize_variables: Failed to unserialize variable!\\n", "", _)

Do You have any clues how to handle it ?

Regards

dinhngtu

@lukasz_s Hi, this is due to the withdrawn Secure Boot update.

You can recover by installing a preliminary test update here:

wget https://koji.xcp-ng.org/repos/user/8/8.3/xcpng-users.repo -O /etc/yum.repos.d/xcpng-users.repo
yum update --enablerepo=xcp-ng-ndinh1 varstored varstored-tools
secureboot-certs clear

Then propagate SB certs to make sure that subsequent dbx updates will run normally.

Sorry for the inconvenience.

lukasz_s

@dinhngtu Thanks, works ok for now

dinhngtu

@lukasz_s Thanks. As this is a test update, please take note of any issues especially with new Windows installations.

For reference, here are the prerelease notes:

Both varstored and varstored-tools must be updated together.
After the update, to ensure that the new varstored version is running, VMs must be migrated to an updated host (e.g. using RPU) or rebooted.
You must run secureboot-certs clear if you're updating from 1.2.0-2.4 or 1.2.0-3.1 and have previously run secureboot-certs install with the above versions installed.
If you are unsure, it's recommended to run secureboot-certs clear anyway.
If you have already propagated UEFI certificates to your existing VMs following the varstored 1.2.0-3.1 update, it's recommended to update to 1.2.0-3.2 and propagate UEFI certificates again.

flakpyro

@dinhngtu said in VM start stuck on "Guest has not initialized the display (yet).":

You must run secureboot-certs clear if you're updating from 1.2.0-2.4 or 1.2.0-3.1 and have previously run secureboot-certs install with the above versions installed.

Should we run this before installing the update or after 1.2.0-3.2 has been installed?

lukasz_s

@dinhngtu thanks for advice

i've upgraded varstored and varstored-tools:

rpm -qa | grep varstored
varstored-1.2.0-3.2
varstored-tools-1.2.0-3.2

than i've cleared varstore with secureboot-certs clear
should taht folder contain more files ?

ls /usr/share/varstored/
KEK.uth
PK.auth
db.auth

what about dbx file ?

dinhngtu

@flakpyro said in VM start stuck on "Guest has not initialized the display (yet).":

@dinhngtu said in VM start stuck on "Guest has not initialized the display (yet).":

You must run secureboot-certs clear if you're updating from 1.2.0-2.4 or 1.2.0-3.1 and have previously run secureboot-certs install with the above versions installed.

Should we run this before installing the update or after 1.2.0-3.2 has been installed?

You should run that preferably after updating all hosts.

@lukasz_s said in VM start stuck on "Guest has not initialized the display (yet).":

@dinhngtu thanks for advice

i've upgraded varstored and varstored-tools:
rpm -qa | grep varstored
varstored-1.2.0-3.2
varstored-tools-1.2.0-3.2
than i've cleared varstore with secureboot-certs clear
should taht folder contain more files ?
ls /usr/share/varstored/
KEK.uth
PK.auth
db.auth
what about dbx file ?

That file is not shipped with varstored nor needed for now. We're validating the final 1.2.0-3.2 and preparing our guidance for the official update.