OvmfPkg/NvVarsFileLib: disable in case PcdBootRestrictToFirmware is set

In case PcdBootRestrictToFirmware is set, disable loading EFI variables
from NvVars file.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>

diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c
index d4139b911528a52dc457fd9b047a52e1e96df988..86380a867a8e9494388667902707e8eca4252fa5 100644 (file)
--- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c
+++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c
@@ -30,7 +30,9 @@ ConnectNvVarsToFileSystem (
 {\r
   EFI_STATUS  Status;\r
 \r
-  if (FeaturePcdGet (PcdSecureBootSupported)) {\r
+  if (FeaturePcdGet (PcdSecureBootSupported) ||\r
+      FeaturePcdGet (PcdBootRestrictToFirmware))\r
+  {\r
     return EFI_UNSUPPORTED;\r
   }\r
 \r

diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf
index f152c5504661f96a7f54f8b6a2c17fa0f1224668..9ae40ffe4373e8183256450e6965ddb2a865a798 100644 (file)
--- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf
+++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf
@@ -49,6 +49,7 @@
 \r
 [Pcd]\r
   gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdBootRestrictToFirmware\r
 \r
 [Guids]\r
   gEfiFileInfoGuid\r