From 5a6a9f7955f34c7ddf2d045443a9bbb112be4fc7 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 24 Sep 2025 13:27:26 +0200
Subject: [PATCH] OvmfPkg/X86QemuLoadImageLib: do not use the legacy linux
 loader in CVMs.

Do not use the insecure legacy linux loader (which does not
enforce secure boot checks) when running in a confidential VM.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c   | 6 ++++++
 OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
index 0ff8354ebd..b16bdeb47f 100644
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
@@ -437,6 +437,12 @@ QemuLoadKernelImage (
         "OVMF: command line switch for qemu (available in version 10.0 + newer).\n"
         "\n"
         );
+      if (PcdGet64 (PcdConfidentialComputingGuestAttr)) {
+        AsciiPrint (
+          "OVMF: Running in confidential VM, not using insecure legacy linux kernel loader.\n"
+          );
+        return EFI_ACCESS_DENIED;
+      }
 
       RetStatus = QemuFwCfgParseBool (
                     "opt/org.tianocore/EnableLegacyLoader",
diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
index 09babd3be8..127674ab15 100644
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
@@ -44,3 +44,6 @@
 
 [Guids]
   gQemuKernelLoaderFsMediaGuid
+
+[Pcd]
+  gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr