Index: trunk/src/VBox/Main/include/NvramStoreImpl.h
===================================================================
--- trunk/src/VBox/Main/include/NvramStoreImpl.h	(revision 91534)
+++ trunk/src/VBox/Main/include/NvramStoreImpl.h	(revision 91535)
@@ -72,7 +72,10 @@
 
     int i_loadStore(const char *pszPath);
-    int i_loadStoreFromTar(RTVFSFSSTREAM hVfsFssTar);
     int i_saveStore(void);
-    int i_saveStoreAsTar(void);
+
+#ifndef VBOX_COM_INPROC
+    HRESULT i_retainUefiVarStore(PRTVFS phVfs, bool fReadonly);
+    HRESULT i_releaseUefiVarStore(RTVFS hVfs);
+#endif
 
 private:
@@ -84,4 +87,7 @@
     // Wrapped NVRAM store members
     HRESULT initUefiVariableStore(ULONG aSize);
+
+    int i_loadStoreFromTar(RTVFSFSSTREAM hVfsFssTar);
+    int i_saveStoreAsTar(void);
 
 #ifdef VBOX_COM_INPROC
Index: trunk/src/VBox/Main/include/UefiVariableStoreImpl.h
===================================================================
--- trunk/src/VBox/Main/include/UefiVariableStoreImpl.h	(revision 91534)
+++ trunk/src/VBox/Main/include/UefiVariableStoreImpl.h	(revision 91535)
@@ -41,5 +41,5 @@
 
     // public initializer/uninitializer for internal purposes only
-    HRESULT init(NvramStore *aParent, Machine *pMachine, RTVFS hVfsUefiVarStore);
+    HRESULT init(NvramStore *aParent, Machine *pMachine);
     void uninit();
 
@@ -74,4 +74,7 @@
     void i_uefiAttrMaskToVec(uint32_t fAttr, std::vector<UefiVariableAttributes_T> &aAttributes);
 
+    HRESULT i_retainUefiVariableStore(bool fReadonly);
+    HRESULT i_releaseUefiVariableStore(void);
+
     HRESULT i_uefiVarStoreAddVar(PCEFI_GUID pGuid, const char *pszVar, uint32_t fAttr, PRTVFSFILE phVfsFile);
     HRESULT i_uefiVarStoreSetVar(PCEFI_GUID pGuid, const char *pszVar, uint32_t fAttr, const void *pvData, size_t cbData);
Index: trunk/src/VBox/Main/src-all/NvramStoreImpl.cpp
===================================================================
--- trunk/src/VBox/Main/src-all/NvramStoreImpl.cpp	(revision 91534)
+++ trunk/src/VBox/Main/src-all/NvramStoreImpl.cpp	(revision 91535)
@@ -339,15 +339,6 @@
             if (it != m->bd->mapNvram.end())
             {
-                RTVFSFILE hVfsFileNvram = it->second;
-                RTVFS hVfsEfiVarStore;
-                int vrc = RTEfiVarStoreOpenAsVfs(hVfsFileNvram, 0 /*fMntFlags*/, 0 /*fVarStoreFlags*/, &hVfsEfiVarStore,
-                                                 NULL /*pErrInfo*/);
-                if (RT_SUCCESS(vrc))
-                {
-                    unconst(m->pUefiVarStore).createObject();
-                    m->pUefiVarStore->init(this, m->pParent, hVfsEfiVarStore);
-                }
-                else
-                    hrc = setError(E_FAIL, tr("Opening the UEFI variable store failed (%Rrc)."), vrc);
+                unconst(m->pUefiVarStore).createObject();
+                m->pUefiVarStore->init(this, m->pParent);
             }
             else
@@ -710,4 +701,45 @@
 
 #ifndef VBOX_COM_INPROC
+HRESULT NvramStore::i_retainUefiVarStore(PRTVFS phVfs, bool fReadonly)
+{
+    /* the machine needs to be mutable */
+    AutoMutableStateDependency adep(m->pParent);
+    if (FAILED(adep.rc())) return adep.rc();
+
+    AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
+
+    HRESULT hrc = S_OK;
+    NvramStoreIter it = m->bd->mapNvram.find("efi/nvram");
+    if (it != m->bd->mapNvram.end())
+    {
+        RTVFSFILE hVfsFileNvram = it->second;
+        RTVFS hVfsEfiVarStore;
+        uint32_t fMntFlags = fReadonly ? RTVFSMNT_F_READ_ONLY : 0;
+
+        int vrc = RTEfiVarStoreOpenAsVfs(hVfsFileNvram, fMntFlags, 0 /*fVarStoreFlags*/, &hVfsEfiVarStore,
+                                         NULL /*pErrInfo*/);
+        if (RT_SUCCESS(vrc))
+        {
+            *phVfs = hVfsEfiVarStore;
+            if (!fReadonly)
+                m->pParent->i_setModified(Machine::IsModified_NvramStore);
+        }
+        else
+            hrc = setError(E_FAIL, tr("Opening the UEFI variable store failed (%Rrc)."), vrc);
+    }
+    else
+        hrc = setError(VBOX_E_OBJECT_NOT_FOUND, tr("The UEFI NVRAM file is not existing for this machine."));
+
+    return hrc;
+}
+
+
+HRESULT NvramStore::i_releaseUefiVarStore(RTVFS hVfs)
+{
+    RTVfsRelease(hVfs);
+    return S_OK;
+}
+
+
 /**
  *  Loads settings from the given machine node.
@@ -753,6 +785,4 @@
 
     data.strNvramPath = m->bd->strNvramPath;
-
-    unconst(m->pUefiVarStore) = NULL;
 
     int vrc = i_saveStore();
Index: trunk/src/VBox/Main/src-server/UefiVariableStoreImpl.cpp
===================================================================
--- trunk/src/VBox/Main/src-server/UefiVariableStoreImpl.cpp	(revision 91534)
+++ trunk/src/VBox/Main/src-server/UefiVariableStoreImpl.cpp	(revision 91535)
@@ -89,7 +89,6 @@
  * @param   aParent                     The NVRAM store owning the UEFI NVRAM content.
  * @param   pMachine
- * @param   hVfsUefiVarStore            The UEFI variable store VFS handle.
- */
-HRESULT UefiVariableStore::init(NvramStore *aParent, Machine *pMachine, RTVFS hVfsUefiVarStore)
+ */
+HRESULT UefiVariableStore::init(NvramStore *aParent, Machine *pMachine)
 {
     LogFlowThisFuncEnter();
@@ -105,7 +104,7 @@
 
     /* share the parent weakly */
-    unconst(m->pParent) = aParent;
+    unconst(m->pParent)  = aParent;
     unconst(m->pMachine) = pMachine;
-    m->hVfsUefiVarStore = hVfsUefiVarStore;
+    m->hVfsUefiVarStore  = NIL_RTVFS;
 
     autoInitSpan.setSucceeded();
@@ -129,5 +128,5 @@
         return;
 
-    RTVfsRelease(m->hVfsUefiVarStore);
+    Assert(m->hVfsUefiVarStore == NIL_RTVFS);
 
     unconst(m->pParent) = NULL;
@@ -147,7 +146,9 @@
     if (FAILED(adep.rc())) return adep.rc();
 
+    HRESULT hrc = i_retainUefiVariableStore(true /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
     AutoReadLock rlock(this COMMA_LOCKVAL_SRC_POS);
 
-    HRESULT hrc = S_OK;
     uint64_t cbVar = 0;
     int vrc = i_uefiVarStoreQueryVarSz("PK", &cbVar);
@@ -178,4 +179,5 @@
         hrc = setError(E_FAIL, tr("Failed to query the platform key variable size: %Rrc"), vrc);
 
+    i_releaseUefiVariableStore();
     return hrc;
 }
@@ -187,4 +189,7 @@
     AutoMutableStateDependency adep(m->pMachine);
     if (FAILED(adep.rc())) return adep.rc();
+
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
 
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
@@ -196,14 +201,17 @@
     {
         uint8_t bVar = fEnabled ? 0x1 : 0x0;
-        return i_uefiVarStoreSetVar(&GuidSecureBootEnable, "SecureBootEnable",
-                                      EFI_VAR_HEADER_ATTR_NON_VOLATILE
-                                    | EFI_VAR_HEADER_ATTR_BOOTSERVICE_ACCESS
-                                    | EFI_VAR_HEADER_ATTR_RUNTIME_ACCESS,
-                                    &bVar, sizeof(bVar));
+        hrc = i_uefiVarStoreSetVar(&GuidSecureBootEnable, "SecureBootEnable",
+                                     EFI_VAR_HEADER_ATTR_NON_VOLATILE
+                                   | EFI_VAR_HEADER_ATTR_BOOTSERVICE_ACCESS
+                                   | EFI_VAR_HEADER_ATTR_RUNTIME_ACCESS,
+                                   &bVar, sizeof(bVar));
     }
     else if (vrc == VERR_FILE_NOT_FOUND) /* No platform key means no secure boot support. */
-        return setError(VBOX_E_OBJECT_NOT_FOUND, tr("Secure boot is not available because the platform key (PK) is not enrolled"));
-
-    return setError(E_FAIL, tr("Failed to query the platform key variable size: %Rrc"), vrc);
+        hrc = setError(VBOX_E_OBJECT_NOT_FOUND, tr("Secure boot is not available because the platform key (PK) is not enrolled"));
+    else
+        hrc = setError(E_FAIL, tr("Failed to query the platform key variable size: %Rrc"), vrc);
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -217,4 +225,7 @@
     if (FAILED(adep.rc())) return adep.rc();
 
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
 
@@ -222,5 +233,8 @@
     EFI_GUID OwnerGuid;
     RTEfiGuidFromUuid(&OwnerGuid, aOwnerUuid.raw());
-    return i_uefiVarStoreSetVar(&OwnerGuid, aName.c_str(), fAttr, &aData.front(), aData.size());
+    hrc = i_uefiVarStoreSetVar(&OwnerGuid, aName.c_str(), fAttr, &aData.front(), aData.size());
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -244,7 +258,13 @@
                                                std::vector<BYTE> &aData)
 {
-    RT_NOREF(aName, aOwnerUuid, aAttributes, aData);
-
-    HRESULT hrc = S_OK;
+    /* the machine needs to be mutable */
+    AutoMutableStateDependency adep(m->pMachine);
+    if (FAILED(adep.rc())) return adep.rc();
+
+    HRESULT hrc = i_retainUefiVariableStore(true /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
+    AutoReadLock rlock(this COMMA_LOCKVAL_SRC_POS);
+
     uint32_t fAttr;
     int vrc = i_uefiVarStoreQueryVarAttr(aName.c_str(), &fAttr);
@@ -276,4 +296,5 @@
         hrc = setError(VBOX_E_IPRT_ERROR, tr("Failed to query the attributes of variable '%s': %Rrc"), aName.c_str(), vrc);
 
+    i_releaseUefiVariableStore();
     return hrc;
 }
@@ -286,4 +307,7 @@
     AutoMutableStateDependency adep(m->pMachine);
     if (FAILED(adep.rc())) return adep.rc();
+
+    HRESULT hrc = i_retainUefiVariableStore(true /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
 
     AutoReadLock rlock(this COMMA_LOCKVAL_SRC_POS);
@@ -317,4 +341,6 @@
     }
 
+    i_releaseUefiVariableStore();
+
     if (RT_FAILURE(vrc))
         return setError(VBOX_E_IPRT_ERROR, tr("Failed to query the variables: %Rrc"), vrc);
@@ -329,4 +355,7 @@
     AutoMutableStateDependency adep(m->pMachine);
     if (FAILED(adep.rc())) return adep.rc();
+
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
 
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
@@ -341,6 +370,9 @@
     const com::Guid GuidVBox(UuidVBox);
 
-    return i_uefiVarStoreAddSignatureToDb(&GuidGlobalVar, "PK", g_abUefiOracleDefPk, g_cbUefiOracleDefPk,
-                                          GuidVBox, SignatureType_X509);
+    hrc = i_uefiVarStoreAddSignatureToDb(&GuidGlobalVar, "PK", g_abUefiOracleDefPk, g_cbUefiOracleDefPk,
+                                         GuidVBox, SignatureType_X509);
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -352,8 +384,14 @@
     if (FAILED(adep.rc())) return adep.rc();
 
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
 
     EFI_GUID GuidGlobalVar = EFI_GLOBAL_VARIABLE_GUID;
-    return i_uefiVarStoreAddSignatureToDbVec(&GuidGlobalVar, "PK", aData, aOwnerUuid, SignatureType_X509);
+    hrc = i_uefiVarStoreAddSignatureToDbVec(&GuidGlobalVar, "PK", aData, aOwnerUuid, SignatureType_X509);
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -365,8 +403,14 @@
     if (FAILED(adep.rc())) return adep.rc();
 
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
 
     EFI_GUID GuidGlobalVar = EFI_GLOBAL_VARIABLE_GUID;
-    return i_uefiVarStoreAddSignatureToDbVec(&GuidGlobalVar, "KEK", aData, aOwnerUuid, enmSignatureType);
+    hrc = i_uefiVarStoreAddSignatureToDbVec(&GuidGlobalVar, "KEK", aData, aOwnerUuid, enmSignatureType);
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -378,8 +422,14 @@
     if (FAILED(adep.rc())) return adep.rc();
 
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
 
     EFI_GUID GuidSecurityDb = EFI_GLOBAL_VARIABLE_GUID;
-    return i_uefiVarStoreAddSignatureToDbVec(&GuidSecurityDb, "db", aData, aOwnerUuid, enmSignatureType);
+    hrc = i_uefiVarStoreAddSignatureToDbVec(&GuidSecurityDb, "db", aData, aOwnerUuid, enmSignatureType);
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -391,8 +441,14 @@
     if (FAILED(adep.rc())) return adep.rc();
 
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
+
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
 
     EFI_GUID GuidSecurityDb = EFI_IMAGE_SECURITY_DATABASE_GUID;
-    return i_uefiVarStoreAddSignatureToDbVec(&GuidSecurityDb, "dbx", aData, aOwnerUuid, enmSignatureType);
+    hrc = i_uefiVarStoreAddSignatureToDbVec(&GuidSecurityDb, "dbx", aData, aOwnerUuid, enmSignatureType);
+
+    i_releaseUefiVariableStore();
+    return hrc;
 }
 
@@ -402,4 +458,7 @@
     AutoMutableStateDependency adep(m->pMachine);
     if (FAILED(adep.rc())) return adep.rc();
+
+    HRESULT hrc = i_retainUefiVariableStore(false /*fReadonly*/);
+    if (FAILED(hrc)) return hrc;
 
     AutoWriteLock wlock(this COMMA_LOCKVAL_SRC_POS);
@@ -415,6 +474,6 @@
     const com::Guid GuidMs(UuidMs);
 
-    HRESULT hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidGlobalVar, "KEK", g_abUefiMicrosoftKek, g_cbUefiMicrosoftKek,
-                                                 GuidMs, SignatureType_X509);
+    hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidGlobalVar, "KEK", g_abUefiMicrosoftKek, g_cbUefiMicrosoftKek,
+                                         GuidMs, SignatureType_X509);
     if (SUCCEEDED(hrc))
     {
@@ -426,4 +485,5 @@
     }
 
+    i_releaseUefiVariableStore();
     return hrc;
 }
@@ -591,4 +651,31 @@
 
 /**
+ * Retains the reference of the variable store from the parent.
+ *
+ * @returns COM status code.
+ * @param   fReadonly           Flag whether the access is readonly.
+ */
+HRESULT UefiVariableStore::i_retainUefiVariableStore(bool fReadonly)
+{
+    Assert(m->hVfsUefiVarStore = NIL_RTVFS);
+    return m->pParent->i_retainUefiVarStore(&m->hVfsUefiVarStore, fReadonly);
+}
+
+
+/**
+ * Releases the reference of the variable store from the parent.
+ *
+ * @returns COM status code.
+ */
+HRESULT UefiVariableStore::i_releaseUefiVariableStore(void)
+{
+    RTVFS hVfs = m->hVfsUefiVarStore;
+
+    m->hVfsUefiVarStore = NIL_RTVFS;
+    return m->pParent->i_releaseUefiVarStore(hVfs);
+}
+
+
+/**
  * Adds the given variable to the variable store.
  *
