[PATCH 1/2] treewide: Add a flag to detect the Apple T2 chip
From: Atharva Tiwari <hidden>
Date: 2026-07-19 18:03:57
Also in:
keyrings, linux-integrity, linux-pci, linux-usb, lkml, platform-driver-x86
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), pci subsystem, security subsystem, the rest, x86 architecture (32-bit and 64-bit), x86 platform drivers · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Bjorn Helgaas, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, Hans de Goede, Ilpo Järvinen
Add a flag to detect Apple T2 chips on Intel Macs. Cache the result to avoid repeated checks. That will be used in upcoming patches. Signed-off-by: Atharva Tiwari <redacted> --- arch/x86/pci/fixup.c | 10 +++++ include/linux/platform_data/x86/apple.h | 5 +++ security/integrity/platform_certs/load_uefi.c | 38 ++++--------------- 3 files changed, 23 insertions(+), 30 deletions(-)
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index b301c6c8df75..fbd204ca4c6d 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c@@ -7,6 +7,7 @@ #include <linux/delay.h> #include <linux/dmi.h> #include <linux/pci.h> +#include <linux/platform_data/x86/apple.h> #include <linux/suspend.h> #include <linux/vgaarb.h> #include <asm/amd/node.h>
@@ -995,6 +996,15 @@ static void asus_disable_nvme_d3cold(struct pci_dev *pdev) } DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x9a09, asus_disable_nvme_d3cold); +bool has_t2_chip; +EXPORT_SYMBOL(has_t2_chip); + +static void apple_has_t2_chip(struct pci_dev *pdev) +{ + has_t2_chip = true; +} +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_APPLE, 0x1801, apple_has_t2_chip); + #ifdef CONFIG_SUSPEND /* * Root Ports on some AMD SoCs advertise PME_Support for D3hot and D3cold, but
diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
index 079e816c3c21..a2ab63bd1eac 100644
--- a/include/linux/platform_data/x86/apple.h
+++ b/include/linux/platform_data/x86/apple.h@@ -6,8 +6,13 @@ * x86_apple_machine - whether the machine is an x86 Apple Macintosh */ extern bool x86_apple_machine; +/** + * has_t2_chip - whether the machine has the Apple T2 chip + */ +extern bool has_t2_chip; #else #define x86_apple_machine false +#define has_t2_chip false #endif #endif
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index c0d6948446c3..da57ac322e72 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c@@ -3,42 +3,16 @@ #include <linux/kernel.h> #include <linux/sched.h> #include <linux/cred.h> -#include <linux/dmi.h> #include <linux/err.h> #include <linux/efi.h> #include <linux/slab.h> #include <linux/ima.h> +#include <linux/platform_data/x86/apple.h> #include <keys/asymmetric-type.h> #include <keys/system_keyring.h> #include "../integrity.h" #include "keyring_handler.h" -/* - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot - * certificates causes occurrence of a page fault in Apple's firmware and - * a crash disabling EFI runtime services. The following quirk skips reading - * these variables. - */ -static const struct dmi_system_id uefi_skip_cert[] = { - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") }, - { } -}; - /* * Look to see if a UEFI variable called MokIgnoreDB exists and return true if * it does.
@@ -165,10 +139,14 @@ static int __init load_uefi_certs(void) unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0; efi_status_t status; int rc = 0; - const struct dmi_system_id *dmi_id; - dmi_id = dmi_first_match(uefi_skip_cert); - if (dmi_id) { + /* + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot + * certificates causes occurrence of a page fault in Apple's firmware and + * a crash disabling EFI runtime services. The following quirk skips reading + * these variables. + */ + if (has_t2_chip) { pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n"); return false; }
--
2.43.0