uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

OvmfPkg/X86QemuLoadImageLib: do not use the legacy linux loader in CVMs.

Browse source 
Do not use the insecure legacy linux loader (which does not
enforce secure boot checks) when running in a confidential VM.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gerd Hoffmann 2025-09-24 13:27:26 +02:00 • committed by mergify[bot]
parent 8b22c532b3
commit 5a6a9f7955
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
View file

@ -437,6 +437,12 @@ QemuLoadKernelImage (
"OVMF: command line switch for qemu (available in version 10.0 + newer).\n"
"\n"
);
if (PcdGet64 (PcdConfidentialComputingGuestAttr)) {
AsciiPrint (
"OVMF: Running in confidential VM, not using insecure legacy linux kernel loader.\n"
);
return EFI_ACCESS_DENIED;
}
RetStatus = QemuFwCfgParseBool (
"opt/org.tianocore/EnableLegacyLoader",

3
OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
View file

@ -44,3 +44,6 @@
[Guids]
gQemuKernelLoaderFsMediaGuid
[Pcd]
gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr