Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <fbce35c31f543527d171dd9988b29248d740fb17.camel@linux.ibm.com>
Subject: Re: [PATCHv2 RESEND] efi: Correct Macmini DMI match in uefi cert
 quirk
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Orlando Chamberlain <redecorating@protonmail.com>,
        linux-kernel@vger.kernel.org
Cc:     jarkko@kernel.org, dmitry.kasatkin@gmail.com, paul@paul-moore.com,
        jmorris@namei.org, serge@hallyn.com, gargaditya08@live.com,
        linux-integrity@vger.kernel.org, keyrings@vger.kernel.org,
        linux-security-module@vger.kernel.org, stable@vger.kernel.org,
        Samuel Jiang <chyishian.jiang@gmail.com>
Date:   Fri, 30 Sep 2022 14:24:32 -0400
In-Reply-To: <20220929114906.85021-1-redecorating@protonmail.com>
References: <20220929114906.85021-1-redecorating@protonmail.com>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi Orlando,

On Thu, 2022-09-29 at 11:49 +0000, Orlando Chamberlain wrote:
> It turns out Apple doesn't capitalise the "mini" in "Macmini" in DMI, which
> is inconsistent with other model line names.
> 
> Correct the capitalisation of Macmini in the quirk for skipping loading
> platform certs on T2 Macs.
> 
> Currently users get:
> 
> ------------[ cut here ]------------
> [Firmware Bug]: Page fault caused by firmware at PA: 0xffffa30640054000
> WARNING: CPU: 1 PID: 8 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x55/0xe0
> Modules linked in:
> CPU: 1 PID: 8 Comm: kworker/u12:0 Not tainted 5.18.14-arch1-2-t2 #1 4535eb3fc40fd08edab32a509fbf4c9bc52d111e
> Hardware name: Apple Inc. Macmini8,1/Mac-7BA5B2DFE22DDD8C, BIOS 1731.120.10.0.0 (iBridge: 19.16.15071.0.0,0) 04/24/2022
> Workqueue: efi_rts_wq efi_call_rts
> ...
> ---[ end trace 0000000000000000 ]---
> efi: Froze efi_rts_wq and disabled EFI Runtime Services
> integrity: Couldn't get size: 0x8000000000000015
> integrity: MODSIGN: Couldn't get UEFI db list
> efi: EFI Runtime Services are disabled!
> integrity: Couldn't get size: 0x8000000000000015
> integrity: Couldn't get UEFI dbx list
> 
> Fixes: 155ca952c7ca ("efi: Do not import certificates from UEFI Secure Boot for T2 Macs")
> Cc: stable@vger.kernel.org
> Cc: Aditya Garg <gargaditya08@live.com>
> Tested-by: Samuel Jiang <chyishian.jiang@gmail.com>
> Signed-off-by: Orlando Chamberlain <redecorating@protonmail.com>

Thanks!  The patch is now queued in the next-integrity branch.

Mimi