From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web12.9272.1656493075185691776 for ; Wed, 29 Jun 2022 01:57:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=FNPdNxwF; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1656493078; x=1688029078; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=g9bRpRFGgI0vFdcQ0fUG3itoVAMnPRSXGStRsQ06b9g=; b=FNPdNxwF7W/WnVi5Hz2H1+Wv2Rcivbp3u/op9MrA3IlzD5r5CCCprJc4 gN8qX9U6Fl/VXYNlYr0ySfu/bw4TE3oJAiipgw9BfW2NRegDJ8M2azDj2 5qgQDqLlIpVHlTONyRfKzUfB3Y2kxmQT2ycWz5L14bYr4ZUVsTylXluUd gREiaLBCRbkOyKi0Ga6QYamsoxcp5sLCyziptS+ePTtnXSUzjyA/Ux8pi NNzP/Y55y4FuaG3/Hm78HtRipU4Tqb4pQjBOS7Q2biOAkfKVdSTXE66ja Jp9p6oKjEVZ+rPVbmeXOjOHD2fc24f972vFc0yU4QvJbiGIkeBFAze1e+ w==; X-IronPort-AV: E=McAfee;i="6400,9594,10392"; a="262383777" X-IronPort-AV: E=Sophos;i="5.92,231,1650956400"; d="scan'208";a="262383777" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jun 2022 01:57:58 -0700 X-IronPort-AV: E=Sophos;i="5.92,231,1650956400"; d="scan'208";a="595159059" Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.29.128]) by fmsmga007-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jun 2022 01:57:56 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [PATCH V3 5/7] OvmfPkg/NvVarsFileLib: Shortcut ConnectNvVarsToFileSystem in secure-boot Date: Wed, 29 Jun 2022 16:57:01 +0800 Message-Id: X-Mailer: git-send-email 2.29.2.windows.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Min M Xu OvmfPkg/Library/NvVarsFileLib allows loading variables into emulated varstore from a on-disk NvVars file. We can't allow that when secure boot is active. So check secure-boot feature and shortcut the ConnectNvVarsToFileSystem() function when sb is enabled. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Suggested-by: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c index 21b71524ea48..72289da35819 100644 --- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c +++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c @@ -28,6 +28,12 @@ ConnectNvVarsToFileSystem ( IN EFI_HANDLE FsHandle ) { + #ifdef SECURE_BOOT_FEATURE_ENABLED + + return EFI_UNSUPPORTED; + + #else + EFI_STATUS Status; // @@ -46,6 +52,7 @@ ConnectNvVarsToFileSystem ( } return Status; + #endif } /** -- 2.29.2.windows.2