admin/chipsec-chipsec
1
0
Fork 0
mirror of https://github.com/chipsec/chipsec synced 2026-06-08 13:31:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

OsIndicationsSupported is only RO after ExitBootServices

Browse Source 
The access_uefispec module currently reports OsIndicationsSupported should be
read-only even when the module is ran from UEFI shell before ExitBootServices
has been called. This is a false positive, OsIndicationsSupported is expected
to be read-write before ExitBootServices.

See https://uefi.org/specs/UEFI/2.10/03_Boot_Manager.html, variables that
should be read-only in all cases are specifically called out as:
"Should be treated as read-only". OsIndicationsSupported is not listed as such.

After ExitBootServices the following applies, as specified in
https://uefi.org/specs/UEFI/2.10/08_Services_Runtime_Services.html#setvariable:

"Once ExitBootServices() is performed, only variables that have
EFI_VARIABLE_RUNTIME_ACCESS and EFI_VARIABLE_NON_VOLATILE set can be set with
SetVariable()."

Signed-off-by: Tamas K Lengyel <tamas.lengyel@oracle.com>
This commit is contained in:
Tamas K Lengyel
2025-07-16 14:59:52 +02:00
committed by dscott90
parent 041357cfe9
commit 69ef1d7a04
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chipsec/modules/common/uefi/access_uefispec.py
+6 -2
View File
@@ -108,7 +108,7 @@ class access_uefispec(BaseModule):
"dbDefault": bs | rt, # RO
"dbxDefault": bs | rt, # RO
"dbtDefault": bs | rt, # RO
"OsIndicationsSupported": bs | rt, # RO
"OsIndicationsSupported": bs | rt, # RO only after ExitBootServices()
"OsIndications": nv | bs | rt,
"SysPrep0001": nv | bs | rt,
"SysPrep0002": nv | bs | rt,
@@ -116,7 +116,11 @@ class access_uefispec(BaseModule):
"VendorKeys": bs | rt # RO
}
self.uefispec_ro_vars = ("HwErrRecSupport", "SetupMode", "SignatureSupport", "SecureBoot", "KEKDefault", "PKDefault", "dbDefault", "dbxDefault", "dbtDefault", "OsIndicationsSupported", "VendorKeys")
self.uefispec_ro_vars = ("HwErrRecSupport", "SetupMode", "SignatureSupport", "SecureBoot", "KEKDefault", "PKDefault", "dbDefault", "dbxDefault", "dbtDefault", "VendorKeys")
uefispec_rt_ro_vars = ("OsIndicationsSupported",)
if not self.cs.os_helper.is_efi():
self.uefispec_ro_vars += uefispec_rt_ro_vars
def is_supported(self) -> bool:
supported = self.cs.helper.EFI_supported()