From: Jarkko Sakkinen <jarkko@kernel.org>
To: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Cc: "Bjorn Helgaas" <bhelgaas@google.com>,
"Thomas Gleixner" <tglx@kernel.org>,
"Ingo Molnar" <mingo@redhat.com>,
"Borislav Petkov" <bp@alien8.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
"Andreas Noever" <andreas.noever@gmail.com>,
"Mika Westerberg" <westeri@kernel.org>,
"Yehezkel Bernat" <YehezkelShB@gmail.com>,
"Hans de Goede" <hansg@kernel.org>,
"Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Roberto Sassu" <roberto.sassu@huawei.com>,
"Dmitry Kasatkin" <dmitry.kasatkin@gmail.com>,
"Eric Snowberg" <eric.snowberg@oracle.com>,
"Paul Moore" <paul@paul-moore.com>,
"James Morris" <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, platform-driver-x86@vger.kernel.org,
linux-integrity@vger.kernel.org, keyrings@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH v3 1/2] treewide: Add a flag to detect the Apple T2 chip
Date: Tue, 21 Jul 2026 13:57:07 +0300 [thread overview]
Message-ID: <al9Qg-0o0XNlo_Z6@kernel.org> (raw)
In-Reply-To: <20260721063412.11588-2-atharvatiwarilinuxdev@gmail.com>
On Tue, Jul 21, 2026 at 02:34:06AM -0400, Atharva Tiwari wrote:
> Add a flag to detect Apple T2 chips on Intel Macs.
> Cache the result to avoid repeated checks. That will
> be used in upcoming patches.
>
> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
> ---
> arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
> include/linux/platform_data/x86/apple.h | 5 +
> .../platform_certs/keyring_handler.h | 8 --
> security/integrity/platform_certs/load_uefi.c | 38 ++-----
> 4 files changed, 118 insertions(+), 38 deletions(-)
>
> diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
> index a92f18db9610..300d6436060d 100644
> --- a/arch/x86/kernel/quirks.c
> +++ b/arch/x86/kernel/quirks.c
> @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
> bool x86_apple_machine;
> EXPORT_SYMBOL(x86_apple_machine);
>
> +bool has_apple_t2_chip;
> +EXPORT_SYMBOL(has_apple_t2_chip);
> +
> +static const struct dmi_system_id apple_t2_devices[] __initconst = {
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
> + },
> + },
> + { }
> +};
> +
> void __init early_platform_quirks(void)
> {
> x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
> dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
> +
> + has_apple_t2_chip = dmi_check_system(apple_t2_devices);
> }
> diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
> index 079e816c3c21..47b27dceab18 100644
> --- a/include/linux/platform_data/x86/apple.h
> +++ b/include/linux/platform_data/x86/apple.h
> @@ -6,8 +6,13 @@
> * x86_apple_machine - whether the machine is an x86 Apple Macintosh
> */
> extern bool x86_apple_machine;
> +/**
> + * has_apple_t2_chip - whether the machine has the Apple T2 chip
> + */
> +extern bool has_apple_t2_chip;
> #else
> #define x86_apple_machine false
> +#define has_apple_t2_chip false
> #endif
>
> #endif
> diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h
> index f92895cc50f6..a355f4400179 100644
> --- a/security/integrity/platform_certs/keyring_handler.h
> +++ b/security/integrity/platform_certs/keyring_handler.h
> @@ -45,11 +45,3 @@ efi_element_handler_t get_handler_for_code_signing_keys(const efi_guid_t *sig_ty
> efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type);
>
> #endif
> -
> -#ifndef UEFI_QUIRK_SKIP_CERT
> -#define UEFI_QUIRK_SKIP_CERT(vendor, product) \
> - .matches = { \
> - DMI_MATCH(DMI_BOARD_VENDOR, vendor), \
> - DMI_MATCH(DMI_PRODUCT_NAME, product), \
> - },
> -#endif
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index c0d6948446c3..b4096d4c828d 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -3,42 +3,16 @@
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <linux/cred.h>
> -#include <linux/dmi.h>
> #include <linux/err.h>
> #include <linux/efi.h>
> #include <linux/slab.h>
> #include <linux/ima.h>
> +#include <linux/platform_data/x86/apple.h>
> #include <keys/asymmetric-type.h>
> #include <keys/system_keyring.h>
> #include "../integrity.h"
> #include "keyring_handler.h"
>
> -/*
> - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> - * certificates causes occurrence of a page fault in Apple's firmware and
> - * a crash disabling EFI runtime services. The following quirk skips reading
> - * these variables.
> - */
> -static const struct dmi_system_id uefi_skip_cert[] = {
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
> - { }
> -};
> -
> /*
> * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
> * it does.
> @@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
> unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
> efi_status_t status;
> int rc = 0;
> - const struct dmi_system_id *dmi_id;
>
> - dmi_id = dmi_first_match(uefi_skip_cert);
> - if (dmi_id) {
> + /*
> + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> + * certificates causes occurrence of a page fault in Apple's firmware and
> + * a crash disabling EFI runtime services. The following quirk skips reading
> + * these variables.
> + */
> + if (has_apple_t2_chip) {
> pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
> return false;
> }
> --
> 2.43.0
>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
next prev parent reply other threads:[~2026-07-21 10:57 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-21 6:34 [PATCH v3 0/2] Add Apple T2 NHI device links Atharva Tiwari
2026-07-21 6:34 ` [PATCH v3 1/2] treewide: Add a flag to detect the Apple T2 chip Atharva Tiwari
2026-07-21 6:44 ` sashiko-bot
2026-07-21 10:57 ` Jarkko Sakkinen [this message]
2026-07-21 15:29 ` Hans de Goede
2026-07-21 6:34 ` [PATCH v3 2/2] thunderbolt: Add device links for Apple T2 NHI Atharva Tiwari
2026-07-21 8:59 ` sashiko-bot
2026-07-21 9:03 ` Ilpo Järvinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=al9Qg-0o0XNlo_Z6@kernel.org \
--to=jarkko@kernel.org \
--cc=YehezkelShB@gmail.com \
--cc=andreas.noever@gmail.com \
--cc=atharvatiwarilinuxdev@gmail.com \
--cc=bhelgaas@google.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=eric.snowberg@oracle.com \
--cc=hansg@kernel.org \
--cc=hpa@zytor.com \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=paul@paul-moore.com \
--cc=platform-driver-x86@vger.kernel.org \
--cc=roberto.sassu@huawei.com \
--cc=serge@hallyn.com \
--cc=tglx@kernel.org \
--cc=westeri@kernel.org \
--cc=x86@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.