On 1 February 2017 at 12:33, David Howells <dhowells@xxxxxxxxxx> wrote: > Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> wrote: > >> So this patch should take AuditMode into account, but not DeployedMode, i.e., >> >> SecureBoot == 0x1 >> SetupMode == 0x0 >> AuditMode == 0x0 (or non-existent) > > If we're in audit mode or setup mode SecureBoot==0 and SetupMode==1 according > to the flowchart, so the check of AuditMode would seem redundant. > > Further, the checks above don't seem to differentiate deployed mode from user > mode. Should they? > >From the OS pov, UserMode and DeployedMode are the same, the only difference being that AuditMode may be entered from UserMode simply by setting the variable to 0x1 (which can only be done before ExitBootServices()). And since AuditMode implies SetupMode (according to the diagram), you are right that we don't need to care about AuditMode either. AFAICT, that makes the entire patch unnecessary, so let's drop it for now. -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
