Enable/Disable VirtIo net based on the value of PcdNetworkSupport which
is controlled in NetworkCfgLib, which sets the PCD based on
"etc/networking" qemu file.

With this change, VMM can disable networking even if it is enabled at
compile time. This will allow to reduce attack surface by simply
providing an "etc/networking" value without having to recompile EDK2
completely.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Julien Grall <julien@xen.org>

Signed-off-by: Yuan Yu <yuanyu@google.com>
---
 OvmfPkg/OvmfPkgX64.dsc             |  7 ++++++-
 OvmfPkg/VirtioNetDxe/VirtioNet.inf |  3 +++
 OvmfPkg/VirtioNetDxe/EntryPoint.c  | 10 ++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 6e68f60dc90f..63cce9f65a95 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -686,6 +686,8 @@ [PcdsDynamicDefault]
   gEfiMdePkgTokenSpaceGuid.PcdFSBClock|1000000000
 !endif
 
+  gUefiOvmfPkgTokenSpaceGuid.PcdNetworkSupport|TRUE
+
 [PcdsDynamicHii]
 !include OvmfPkg/OvmfTpmPcdsHii.dsc.inc
 
@@ -953,7 +955,10 @@ [Components]
       NULL|OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf
   }
 !endif
-  OvmfPkg/VirtioNetDxe/VirtioNet.inf
+  OvmfPkg/VirtioNetDxe/VirtioNet.inf {
+    <LibraryClasses>
+      NULL|OvmfPkg/Library/NetworkCfgLib/NetworkCfgLib.inf
+  }
 
   #
   # Usb Support
diff --git a/OvmfPkg/VirtioNetDxe/VirtioNet.inf b/OvmfPkg/VirtioNetDxe/VirtioNet.inf
index ada84ed5543b..37bcf13b7863 100644
--- a/OvmfPkg/VirtioNetDxe/VirtioNet.inf
+++ b/OvmfPkg/VirtioNetDxe/VirtioNet.inf
@@ -54,3 +54,6 @@ [Protocols]
   gEfiSimpleNetworkProtocolGuid  ## BY_START
   gEfiDevicePathProtocolGuid     ## BY_START
   gVirtioDeviceProtocolGuid      ## TO_START
+
+[Pcd]
+  gUefiOvmfPkgTokenSpaceGuid.PcdNetworkSupport       ## CONSUMES
diff --git a/OvmfPkg/VirtioNetDxe/EntryPoint.c b/OvmfPkg/VirtioNetDxe/EntryPoint.c
index c3f41dab57bd..9bf220b9ade5 100644
--- a/OvmfPkg/VirtioNetDxe/EntryPoint.c
+++ b/OvmfPkg/VirtioNetDxe/EntryPoint.c
@@ -9,6 +9,8 @@
 
 **/
 
+#include <PiDxe.h>
+
 #include <Library/UefiLib.h>
 
 #include "VirtioNet.h"
@@ -32,6 +34,14 @@ VirtioNetEntryPoint (
   IN EFI_SYSTEM_TABLE  *SystemTable
   )
 {
+  if (PcdGetBool (PcdNetworkSupport)) {
+    DEBUG ((DEBUG_INFO, "[network] %a - Networking enabled.\n", __FUNCTION__));
+  } else {
+    DEBUG ((DEBUG_INFO, "[network] %a - Networking disabled.\n", __FUNCTION__));
+
+    return EFI_REQUEST_UNLOAD_IMAGE;
+  }
+
   return EfiLibInstallDriverBindingComponentName2 (
            ImageHandle,
            SystemTable,
-- 
2.37.1.559.g78731f0fdb-goog



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#92120): https://edk2.groups.io/g/devel/message/92120
Mute This Topic: https://groups.io/mt/92816626/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-