On Tue, Jul 21, 2026 at 02:34:06AM -0400, Atharva Tiwari wrote: > Add a flag to detect Apple T2 chips on Intel Macs. > Cache the result to avoid repeated checks. That will > be used in upcoming patches. > > Signed-off-by: Atharva Tiwari <[email protected]> > --- > arch/x86/kernel/quirks.c | 105 ++++++++++++++++++ > include/linux/platform_data/x86/apple.h | 5 + > .../platform_certs/keyring_handler.h | 8 -- > security/integrity/platform_certs/load_uefi.c | 38 ++----- > 4 files changed, 118 insertions(+), 38 deletions(-) > > diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c > index a92f18db9610..300d6436060d 100644 > --- a/arch/x86/kernel/quirks.c > +++ b/arch/x86/kernel/quirks.c > @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, > quirk_intel_purley_xeon_ras > bool x86_apple_machine; > EXPORT_SYMBOL(x86_apple_machine); > > +bool has_apple_t2_chip; > +EXPORT_SYMBOL(has_apple_t2_chip); > + > +static const struct dmi_system_id apple_t2_devices[] __initconst = { > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"), > + }, > + }, > + { > + .matches = { > + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), > + DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"), > + }, > + }, > + { } > +}; > + > void __init early_platform_quirks(void) > { > x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") || > dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc."); > + > + has_apple_t2_chip = dmi_check_system(apple_t2_devices); > } > diff --git a/include/linux/platform_data/x86/apple.h > b/include/linux/platform_data/x86/apple.h > index 079e816c3c21..47b27dceab18 100644 > --- a/include/linux/platform_data/x86/apple.h > +++ b/include/linux/platform_data/x86/apple.h > @@ -6,8 +6,13 @@ > * x86_apple_machine - whether the machine is an x86 Apple Macintosh > */ > extern bool x86_apple_machine; > +/** > + * has_apple_t2_chip - whether the machine has the Apple T2 chip > + */ > +extern bool has_apple_t2_chip; > #else > #define x86_apple_machine false > +#define has_apple_t2_chip false > #endif > > #endif > diff --git a/security/integrity/platform_certs/keyring_handler.h > b/security/integrity/platform_certs/keyring_handler.h > index f92895cc50f6..a355f4400179 100644 > --- a/security/integrity/platform_certs/keyring_handler.h > +++ b/security/integrity/platform_certs/keyring_handler.h > @@ -45,11 +45,3 @@ efi_element_handler_t > get_handler_for_code_signing_keys(const efi_guid_t *sig_ty > efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type); > > #endif > - > -#ifndef UEFI_QUIRK_SKIP_CERT > -#define UEFI_QUIRK_SKIP_CERT(vendor, product) \ > - .matches = { \ > - DMI_MATCH(DMI_BOARD_VENDOR, vendor), \ > - DMI_MATCH(DMI_PRODUCT_NAME, product), \ > - }, > -#endif > diff --git a/security/integrity/platform_certs/load_uefi.c > b/security/integrity/platform_certs/load_uefi.c > index c0d6948446c3..b4096d4c828d 100644 > --- a/security/integrity/platform_certs/load_uefi.c > +++ b/security/integrity/platform_certs/load_uefi.c > @@ -3,42 +3,16 @@ > #include <linux/kernel.h> > #include <linux/sched.h> > #include <linux/cred.h> > -#include <linux/dmi.h> > #include <linux/err.h> > #include <linux/efi.h> > #include <linux/slab.h> > #include <linux/ima.h> > +#include <linux/platform_data/x86/apple.h> > #include <keys/asymmetric-type.h> > #include <keys/system_keyring.h> > #include "../integrity.h" > #include "keyring_handler.h" > > -/* > - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot > - * certificates causes occurrence of a page fault in Apple's firmware and > - * a crash disabling EFI runtime services. The following quirk skips reading > - * these variables. > - */ > -static const struct dmi_system_id uefi_skip_cert[] = { > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, > - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") }, > - { } > -}; > - > /* > * Look to see if a UEFI variable called MokIgnoreDB exists and return true > if > * it does. > @@ -165,10 +139,14 @@ static int __init load_uefi_certs(void) > unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0; > efi_status_t status; > int rc = 0; > - const struct dmi_system_id *dmi_id; > > - dmi_id = dmi_first_match(uefi_skip_cert); > - if (dmi_id) { > + /* > + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure > Boot > + * certificates causes occurrence of a page fault in Apple's firmware > and > + * a crash disabling EFI runtime services. The following quirk skips > reading > + * these variables. > + */ > + if (has_apple_t2_chip) { > pr_err("Reading UEFI Secure Boot Certs is not supported on T2 > Macs.\n"); > return false; > } > -- > 2.43.0 >
Acked-by: Jarkko Sakkinen <[email protected]> BR, Jarkko
