• Aditya Garg's avatar
    efi: Do not import certificates from UEFI Secure Boot for T2 Macs · 155ca952
    Aditya Garg authored
    On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables
    at early boot to load UEFI Secure Boot certificates, a page fault occurs
    in Apple firmware code and EFI runtime services are disabled with the
    following logs:
    
    [Firmware Bug]: Page fault caused by firmware at PA: 0xffffb1edc0068000
    WARNING: CPU: 3 PID: 104 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0
    (Removed some logs from here)
    Call Trace:
     <TASK>
     page_fault_oops+0x4f/0x2c0
     ? search_bpf_extables+0x6b/0x80
     ? search_module_extables+0x50/0x80
     ? search_exception_tables+0x5b/0x60
     kernelmode_fixup_or_oops+0x9e/0x110
     __bad_area_nosemaphore+0x155/0x190
     bad_area_nosemaphore+0x16/0x20
     do_kern_addr_fault+0x8c/0xa0
     exc_page_fault+0xd8/0x180
     asm_exc_page_fault+0x1e/0x30
    (Removed some logs from here)
     ? __efi_call+0x28/0x30
     ? switch_mm+0x20/0x30
     ? efi_call_rts+0x19a/0x8e0
     ? process_one_work+0x222/0x3f0
     ? worker_thread+0x4a/0x3d0
     ? kthread+0x17a/0x1a0
     ? process_one_work+0x3f0/0x3f0
     ? set_kthread_struct+0x40/0x40
     ? ret_from_fork+0x22/0x30
     </TASK>
    ---[ end trace 1f82023595a5927f ]---
    efi: Froze efi_rts_wq and disabled EFI Runtime Services
    integrity: Couldn't get size: 0x8000000000000015
    integrity: MODSIGN: Couldn't get UEFI db list
    efi: EFI Runtime Services are disabled!
    integrity: Couldn't get size: 0x8000000000000015
    integrity: Couldn't get UEFI dbx list
    integrity: Couldn't get size: 0x8000000000000015
    integrity: Couldn't get mokx list
    integrity: Couldn't get size: 0x80000000
    
    So we avoid reading these UEFI variables and thus prevent the crash.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarAditya Garg <gargaditya08@live.com>
    Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    155ca952
load_uefi.c 6.66 KB