[PATCH qemu-server 3/4] ovmf: honor pre-enrolled-keys setting for aarch64

[Fiona Ebner <f.ebner@proxmox.com>]

pve-edk2-firmware-aarch64 <= 4.2025.05-2 did not ship the
secure-boot-enabled CODE image yet. If it is present, honor the
pre-enrolled-keys option for the EFI drive. If it does not exist,
because it's a too old version, fall back to the old behavior, but
warn the user.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/QemuServer/OVMF.pm | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index 7a765fad..1b625e33 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -49,6 +49,9 @@ my $OVMF = {
         ],
     },
     aarch64 => {
+        ms => [
+            "$EDK2_FW_BASE/AAVMF_CODE.secboot.fd", "$EDK2_FW_BASE/AAVMF_VARS.ms.fd",
+        ],
         default => [
             "$EDK2_FW_BASE/AAVMF_CODE.fd", "$EDK2_FW_BASE/AAVMF_VARS.fd",
         ],
@@ -83,6 +86,21 @@ my sub get_ovmf_files($$$$) {
         } else {
             # TODO: log_warn about use of legacy images for x86_64 with Promxox VE 9
         }
+    } elsif ($arch eq 'aarch64') {
+        if ($efidisk->{'pre-enrolled-keys'}) {
+            # FIXME: MAJOR VERSION: drop this check and expect that the secure-boot-enabled CODE
+            # image is present. pve-edk2-firmware-aarch64 <= 4.2025.05-2 didn't ship it.
+            if (file_exists("$EDK2_FW_BASE/AAVMF_CODE.secboot.fd")) {
+                $type = 'ms';
+            } else {
+                log_warn(
+                    "requested EFI image with pre-enrolled-keys, but ignoring because"
+                    . " $EDK2_FW_BASE/AAVMF_CODE.secboot.fd' file is missing - check that"
+                    . " pve-edk2-firmware-aarch64 is correctly installed with version > 4.2025.05-2"
+                );
+                delete($efidisk->{'pre-enrolled-keys'});
+            }
+        }
     }
 
     my ($ovmf_code, $ovmf_vars) = $types->{$type}->@*;
-- 
2.47.3