docs: note that SecureBoot disables kexec reboots

public/talos/v1.14/configure-your-talos-cluster/lifecycle-management/upgrading-talos.mdx

@@ -112,7 +112,8 @@ as:
 
 The `--image` flag defaults to the installer image of the `talosctl` version in use, so it can be omitted when upgrading a machine without system extensions to the version matching `talosctl`.
 
-Note that because Talos Linux reboots via the `kexec` syscall, the extra reboot adds very little time.
+Talos Linux reboots via the `kexec` syscall, which skips the firmware, so the extra reboot adds very little time.
+On machines with [SecureBoot](../../platform-specific-installations/bare-metal-platforms/secureboot) enabled, Talos Linux doesn't use `kexec`, and the machine reboots through its firmware instead, so each reboot takes as long as a full boot.
 
 ## Machine configuration changes
 

public/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx

@@ -84,7 +84,7 @@
 
 > Note: There is no support at the moment to upgrade non-UKI (GRUB-based) Talos installation to use UKI/SecureBoot, so a fresh installation is required.
 
 ## SecureBoot with Sidero Labs images
 
 [Sidero Labs](https://www.siderolabs.com/) provides Talos images signed with the [Sidero Labs SecureBoot key](https://factory.talos.dev/secureboot/signing-cert.pem) via [Image Factory](../../learn-more/image-factory).
 
@@ -121,8 +121,13 @@
 
 Once Talos is running in maintenance mode, verify that secure boot is enabled:
 
-```shell
-$ talosctl -n <IP> get securitystate --insecure
+```bash
+talosctl -n <IP> get securitystate --insecure
+```
+
+The output is similar to the following:
+
+```text
 NODE   NAMESPACE   TYPE            ID              VERSION   SECUREBOOT
        runtime     SecurityState   securitystate   1         true
 ```
@@ -181,6 +186,9 @@
 
 It is important to preserve the UKI signing key and the PCR signing key, otherwise the node will not be able to boot with the new UKI and unlock the encrypted partitions.
 
+With SecureBoot enabled, Talos Linux doesn't use `kexec` to reboot.
+Upgrades and reboots go through the UEFI firmware instead, so each one takes as long as a full boot of the machine, and Talos Linux logs `kexec skipped as secure boot is enabled`.
+
 ## Disk encryption with TPM
 
 When encrypting the disk partition for the first time, Talos Linux generates a random disk encryption key and seals (encrypts) it with the TPM device.
@@ -211,11 +219,11 @@
 
 **Note:** The `.pcrsig` section is **not measured** into any PCR, as it contains the signatures for the measurement results themselves.
 
 #### systemd-boot Measurements
 
 The [systemd-boot bootloader](https://www.freedesktop.org/software/systemd/man/latest/systemd-boot.html) can optionally measure loaded boot entries and configuration, though this is typically not used in Talos UKI scenarios since the UKI can be loaded directly.
 
 #### Talos Boot phase measurements (PCR 11)
 
 In addition to the UKI section measurements, Talos extends **PCR 11** with its own boot phases to track the operating system initialization:
 
@@ -236,7 +244,7 @@
 
 This ensures that disk decryption only occurs after the trusted boot chain has been verified, but before any potentially untrusted user workloads start.
 
 #### Configurable PCR binding (Default: PCR 7)
 
 By default, new Talos installations and upgrades maintain binding to **PCR 7**, which includes:
 
@@ -351,7 +359,7 @@
 
 ## SecureBoot with custom keys
 
 ### Generating the keys
 
 Talos requires two set of keys to be used for the SecureBoot process:
 
@@ -362,8 +370,13 @@
 
 Talos provides a utility to generate the keys, but existing PKI  can be used as well:
 
-```shell
-$ talosctl gen secureboot uki --common-name "SecureBoot Key"
+```bash
+talosctl gen secureboot uki --common-name "SecureBoot Key"
+```
+
+The output is similar to the following:
+
+```text
 writing _out/uki-signing-cert.pem
 writing _out/uki-signing-cert.der
 writing _out/uki-signing-key.pem
@@ -374,17 +387,27 @@
 
 PCR signing key can be generated with:
 
-```shell
-$ talosctl gen secureboot pcr
+```bash
+talosctl gen secureboot pcr
+```
+
+The output is similar to the following:
+
+```text
 writing _out/pcr-signing-key.pem
 ```
 
 The file containing the private key is written to disk in PEM-encoded format (RSA 2048-bit key).
 
 Optionally, UEFI automatic key enrollment database can be generated using the `_out/uki-signing-*` files as input:
 
-```shell
-$ talosctl gen secureboot database
+```bash
+talosctl gen secureboot database
+```
+
+The output is similar to the following:
+
+```text
 writing _out/db.auth
 writing _out/KEK.auth
 writing _out/PK.auth

public/talos/v1.15/configure-your-talos-cluster/lifecycle-management/upgrading-talos.mdx

@@ -112,7 +112,8 @@ as:
 
 The `--image` flag defaults to the installer image of the `talosctl` version in use, so it can be omitted when upgrading a machine without system extensions to the version matching `talosctl`.
 
-Note that because Talos Linux reboots via the `kexec` syscall, the extra reboot adds very little time.
+Talos Linux reboots via the `kexec` syscall, which skips the firmware, so the extra reboot adds very little time.
+On machines with [SecureBoot](../../platform-specific-installations/bare-metal-platforms/secureboot) enabled, Talos Linux doesn't use `kexec`, and the machine reboots through its firmware instead, so each reboot takes as long as a full boot.
 
 ## Machine configuration changes
 

public/talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx

@@ -84,7 +84,7 @@
 
 > Note: There is no support at the moment to upgrade non-UKI (GRUB-based) Talos installation to use UKI/SecureBoot, so a fresh installation is required.
 
 ## SecureBoot with Sidero Labs images
 
 [Sidero Labs](https://www.siderolabs.com/) provides Talos images signed with the [Sidero Labs SecureBoot key](https://factory.talos.dev/secureboot/signing-cert.pem) via [Image Factory](../../learn-more/image-factory).
 
@@ -121,8 +121,13 @@
 
 Once Talos is running in maintenance mode, verify that secure boot is enabled:
 
-```shell
-$ talosctl -n <IP> get securitystate --insecure
+```bash
+talosctl -n <IP> get securitystate --insecure
+```
+
+The output is similar to the following:
+
+```text
 NODE   NAMESPACE   TYPE            ID              VERSION   SECUREBOOT
        runtime     SecurityState   securitystate   1         true
 ```
@@ -181,6 +186,9 @@
 
 It is important to preserve the UKI signing key and the PCR signing key, otherwise the node will not be able to boot with the new UKI and unlock the encrypted partitions.
 
+With SecureBoot enabled, Talos Linux doesn't use `kexec` to reboot.
+Upgrades and reboots go through the UEFI firmware instead, so each one takes as long as a full boot of the machine, and Talos Linux logs `kexec skipped as secure boot is enabled`.
+
 ## Disk encryption with TPM
 
 When encrypting the disk partition for the first time, Talos Linux generates a random disk encryption key and seals (encrypts) it with the TPM device.
@@ -211,11 +219,11 @@
 
 **Note:** The `.pcrsig` section is **not measured** into any PCR, as it contains the signatures for the measurement results themselves.
 
 #### systemd-boot Measurements
 
 The [systemd-boot bootloader](https://www.freedesktop.org/software/systemd/man/latest/systemd-boot.html) can optionally measure loaded boot entries and configuration, though this is typically not used in Talos UKI scenarios since the UKI can be loaded directly.
 
 #### Talos Boot phase measurements (PCR 11)
 
 In addition to the UKI section measurements, Talos extends **PCR 11** with its own boot phases to track the operating system initialization:
 
@@ -236,7 +244,7 @@
 
 This ensures that disk decryption only occurs after the trusted boot chain has been verified, but before any potentially untrusted user workloads start.
 
 #### Configurable PCR binding (Default: PCR 7)
 
 By default, new Talos installations and upgrades maintain binding to **PCR 7**, which includes:
 
@@ -351,7 +359,7 @@
 
 ## SecureBoot with custom keys
 
 ### Generating the keys
 
 Talos requires two set of keys to be used for the SecureBoot process:
 
@@ -362,8 +370,13 @@
 
 Talos provides a utility to generate the keys, but existing PKI  can be used as well:
 
-```shell
-$ talosctl gen secureboot uki --common-name "SecureBoot Key"
+```bash
+talosctl gen secureboot uki --common-name "SecureBoot Key"
+```
+
+The output is similar to the following:
+
+```text
 writing _out/uki-signing-cert.pem
 writing _out/uki-signing-cert.der
 writing _out/uki-signing-key.pem
@@ -374,17 +387,27 @@
 
 PCR signing key can be generated with:
 
-```shell
-$ talosctl gen secureboot pcr
+```bash
+talosctl gen secureboot pcr
+```
+
+The output is similar to the following:
+
+```text
 writing _out/pcr-signing-key.pem
 ```
 
 The file containing the private key is written to disk in PEM-encoded format (RSA 2048-bit key).
 
 Optionally, UEFI automatic key enrollment database can be generated using the `_out/uki-signing-*` files as input:
 
-```shell
-$ talosctl gen secureboot database
+```bash
+talosctl gen secureboot database
+```
+
+The output is similar to the following:
+
+```text
 writing _out/db.auth
 writing _out/KEK.auth
 writing _out/PK.auth