Re: [PATCH v3] efi: Do not import certificates from UEFI Secure Boot for T2 Macs

From: Aditya Garg <gargaditya08@live.com>
To: Lukas Wunner <lukas@wunner.de>
Cc: David Laight <David.Laight@ACULAB.COM>,
	Ard Biesheuvel <ardb@kernel.org>,
	Matthew Garrett <mjg59@srcf.ucam.org>,
	Jeremy Kerr <jk@ozlabs.org>,
	"joeyli.kernel@gmail.com" <joeyli.kernel@gmail.com>,
	"zohar@linux.ibm.com" <zohar@linux.ibm.com>,
	"jmorris@namei.org" <jmorris@namei.org>,
	"eric.snowberg@oracle.com" <eric.snowberg@oracle.com>,
	"dhowells@redhat.com" <dhowells@redhat.com>,
	"jlee@suse.com" <jlee@suse.com>,
	"James.Bottomley@hansenpartnership.com" 
	<James.Bottomley@HansenPartnership.com>,
	"jarkko@kernel.org" <jarkko@kernel.org>,
	"mic@digikod.net" <mic@digikod.net>,
	"dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	"linux-efi@vger.kernel.org" <linux-efi@vger.kernel.org>,
	"linux-security-module@vger.kernel.org" 
	<linux-security-module@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>,
	"keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
	"linux-integrity@vger.kernel.org"
	<linux-integrity@vger.kernel.org>,
	Orlando Chamberlain <redecorating@protonmail.com>,
	Aun-Ali Zaidi <admin@kodeit.net>
Subject: Re: [PATCH v3] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
Date: Sun, 13 Feb 2022 08:36:37 +0000	[thread overview]
Message-ID: <96399AA5-F014-4817-B9E0-B6A988B6268E@live.com> (raw)
In-Reply-To: <20220213073924.GA7648@wunner.de>

> 
> The T2 is represented by a PCI device with ID 106B:1802.  I think it
> would be more elegant to sense presence of that device instead of
> hardcoding a long dmi list, i.e.:
> 
> static bool apple_t2_present(void)
> {
> 	struct pci_dev *pdev;
> 
> 	if (!x86_apple_machine)
> 		return false;
> 
> 	pdev = pci_get_device(PCI_VENDOR_ID_APPLE, 0x1802, NULL);
> 	if (pdev) {
> 		pci_put_dev(pdev);
> 		return true;
> 	}
> 
> 	return false;
> }

I’d rather prefer DMI cause :-
1. There are chances that some non T2 Macs may require this quirk as well. (After all we are talking about Apple)
2. There are slight chances that some non Apple Machines may require this as well

I also am not used to pci based quirks, making it a bit difficult for me to make a patch based on that :(.
The code length is anyways short now.