Commit cc3cf42e61 for qemu.org

commit cc3cf42e618a489333ffc18ab020587dc3fac969
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Fri Sep 4 10:55:07 2026 +0200

    hw/uefi: add require-self-signed-pk config option

    Traditional edk2 behavior is to require a self-signed platform key when
    enrolling secure boot certificates in setup mode.  In 2023 a config
    option has been added (PcdRequireSelfSignedPk) which allows to relax
    that requirement, see edk2 commit 566cdfc675fa ("SecurityPkg: limit
    verification of enrolled PK in setup mode").

    This patch adds a similar config option to the qemu uefi variable
    driver.

    No functional change, the default value for the new config option
    maintains existing behavior.

    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260904085509.2267560-2-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c
index 899444af12..21fc50f904 100644
--- a/hw/uefi/var-service-auth.c
+++ b/hw/uefi/var-service-auth.c
@@ -201,16 +201,21 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars_state *uv,

     siglist = uefi_vars_find_siglist(uv, var);
     if (!siglist && setup_mode_is_active(uv) && uefi_vars_is_sb_pk(var)) {
-        /* check PK is self-signed */
-        uefi_variable tmp = {
-            .guid       = EfiGlobalVariable,
-            .name       = (uint16_t *)name_pk,
-            .name_size  = sizeof(name_pk),
-            .attributes = sigdb_attrs,
-            .data       = data + data_offset,
-            .data_size  = va->data_size - data_offset,
-        };
-        return uefi_vars_check_pkcs7_2(&tmp, NULL, NULL, va, data);
+        /* edk2 config option is PcdRequireSelfSignedPk */
+        if (uv->require_self_signed_pk) {
+            /* check PK is self-signed */
+            uefi_variable tmp = {
+                .guid       = EfiGlobalVariable,
+                .name       = (uint16_t *)name_pk,
+                .name_size  = sizeof(name_pk),
+                .attributes = sigdb_attrs,
+                .data       = data + data_offset,
+                .data_size  = va->data_size - data_offset,
+            };
+            return uefi_vars_check_pkcs7_2(&tmp, NULL, NULL, va, data);
+        } else {
+            return true;
+        }
     }

     return uefi_vars_check_pkcs7_2(siglist, NULL, NULL, va, data);
diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index 97a96cae6a..c4acdea275 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -38,6 +38,8 @@ static const Property uefi_vars_sysbus_properties[] = {
                      state.force_secure_boot, false),
     DEFINE_PROP_BOOL("disable-custom-mode", uefi_vars_sysbus_state,
                      state.disable_custom_mode, false),
+    DEFINE_PROP_BOOL("require-self-signed-pk", uefi_vars_sysbus_state,
+                     state.require_self_signed_pk, true),
     DEFINE_PROP_BOOL("use-pio", uefi_vars_sysbus_state,
                      state.use_pio, false),
 };
diff --git a/include/hw/uefi/var-service.h b/include/hw/uefi/var-service.h
index 7d84025cd5..7f74b44233 100644
--- a/include/hw/uefi/var-service.h
+++ b/include/hw/uefi/var-service.h
@@ -76,6 +76,7 @@ struct uefi_vars_state {
     int                               jsonfd;
     bool                              force_secure_boot;
     bool                              disable_custom_mode;
+    bool                              require_self_signed_pk;
     bool                              use_pio;

     /* request + reply capture */