[PATCH 1/1] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: add security warning

["Gerd Hoffmann" <kraxel@redhat.com>]

OVMF builds in stateless secure boot configuration
(SECURE_BOOT_ENABLE=TRUE + SMM_REQUIRE=FALSE) are expected to use the
emulated variable store (EmuVariableFvbRuntimeDxe) with the store being
re-initialized on each reset (see PlatformInitEmuVariableNvStore())

Using these builds with writable flash is not secure.  Log a warning
message saying so in case we find such a configuration.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
index 61e1f2e196e5..ab7154685424 100644
--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
+++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
@@ -57,6 +57,11 @@ InstallProtocolInterfaces (
                     NULL
                     );
     ASSERT_EFI_ERROR (Status);
+ #ifdef SECURE_BOOT_FEATURE_ENABLED
+    DEBUG ((DEBUG_WARN, "This build is configured for stateless secure boot.\n"));
+    DEBUG ((DEBUG_WARN, "Using this build with writable flash is NOT secure.\n"));
+    // should we ASSERT(0) here?
+ #endif
   } else if (IsDevicePathEnd (FvbDevice->DevicePath)) {
     //
     // Device already exists, so reinstall the FVB protocol
-- 
2.38.1