Do framework laptops have a secure boot audit and deployed mode? How do you enter and leave those modes?

Framework Laptop 13
, ,
1

I didn’t find anyone talking about those modes. I’m a bit confused because from looking over the UEFI they seem to be a required part of it.

I saw DHowett in Secureboot setup mode saying you enter setup mode by clearing your variables (which the flow chart agrees with), but no one mentioned getting to audit mode or how to leave deployed mode (I did see someone (reddit maybe?) complaining about being stranded there with an unspecified machine). I certainly didn’t find anything searching the frame work forums for secure boot audit, which should cause it to pop right up.

Is the flow chart in the spec a just a suggestion? Or does UEFI firmware just get shunted out of audit and deployed mode so fast no one ever notices they were in it?

Here’s a flow chart of the different modes from the spec pdf, the page before and after talk a bit more about the different modes. It’s quite dry, I didn’t get too much useful from them besides a slightly dizzy feeling. There might be more else where, but it is a 2100 pages of technical specifications.

https://uefi.org/sites/default/files/resources/UEFI_Spec_2_10_Aug29.pdf#page=1507

I’m mostly asking because from what I read from Gemini (though was unable to verify) on AMD when you reset the firmware you do not reset the secure boot variables. So I’m worried about getting stuck in bricked state due to the GOP driver not getting verified after screwing with my secure boot varibles. I did find one person saying no OpRoms were secure boot verified on FrameWork. So Framework bypasses the GOP driver verification? I thought that was required.

edit: I misread the flow chart, you can go back and forth from user to audit mode while ignoring setup and deployed mode. I did a quick edit reflect that. My question still basically stands, how to get to audit and leave deployed mode?

2

I would not assume Framework exposes Audit/Deployed as user-switchable modes. On most laptops the setup UI only really gives you Setup Mode vs User Mode through key management: clear PK = setup mode, install PK = user mode. Audit/Deployed are UEFI variable states, but firmware often hides them or moves through them internally. Before experimenting, I’d first confirm you can clear Secure Boot keys from the firmware UI on that exact model, and export/save PK/KEK/db/dbx. For the GOP part, if the graphics driver is in the signed firmware volume it may not behave like a separate option ROM you can see or replace.