Apple's New Hardware With The T2 Security Chip Will Currently Block Linux From Booting

[Hi-Angel]

Please dont't forget Lenovo and HP:

http://support.lenovo.com/us/en/solutions/pd031426

https://certification.ubuntu.com/certification/make/HP/

Sorry to disappoint, but both sources are a bust.

The "Lenovo reference" lists for example "X260", however it has a fingerprint reader, and Lenovo didn't bother to release drivers for it. Their forum has a giant thread with 102k views.

The "Ubuntu reference" has for example nice DELL 5495, however this device has a touchpad that claims to be a mouse, so don't expect any gestures, scroll, taps-to-click to work.

[Michael]

Update 2: It looks like even if disabling the Secure Boot functionality, the T2 chip is reportedly still blocking operating systems aside from macOS and Windows 10.

[starshipeleven]

That has absolutely zero to do with opening up T2. All that discuss is how to get around secure boot. None of the facilities or advantages of T2 would be available to Linux users.

Total Apple-fanboy BS, as usual. The T2 is a glorified EC (= Embedded Controller) that any laptop in the last decades has and uses to deal with basic stuff like power management, battery charging and operating other low-level stuff on the board without needing to wake up the main CPU and require some kind of OS and driver (and more importantly disclose hardware secrets).

In this case it also has access to the TPM or is the TPM, and can do various annoying stuff like checking that all other components of the laptop are "paired" to the motherboard and refuse to use them if they are not (similar to what happens on newer iPhones), because fuck third party repair.
This is only partially enabled because of obvious reasons, but there are strong indications that they will enable that once they feel ready.

The T2 is only partially involved in this reported issue (it's just the key storage), which is basically a Secure Boot issue. The T2 is far too low-level to deal with reading files from a disk and checking signatures on its own.

While it manages the boot process it is also effectively a coprocessor handling many other cores, effectively off loading the main CPU. As far as I know none of those facilities is accessible from Linux thus a closed system. That does bring up an interesting question about how disk access works

Disk access works the same as with any other Intel system, at most the T2 is talking to the SSD controller to tell it the decryption key (which is a task done by the main CPU when booting in other systems), Apple can't make custom x86 hardware.

Which also means that this T2 is running parallel to the Intel ME, and I quite frankly suspect that it is actually just a ME "application" or software module. As what it does is exactly what the ME is designed to do (and doing in more locked down systems).

[onicsis]

And I thought Secure Boot was trash...

In many computers Secure Boot can be easily disabled directly from BIOS, anyway.

---

Really, why should Apple care about any Linux distribution. On a typical HP or Dell machine Ubuntu works fine.

[wizard69]

You're right, so the following article is fake news then? https://www.omgubuntu.co.uk/2018/11/...ant-boot-linux

That has absolutely zero to do with opening up T2. All that discuss is how to get around secure boot. None of the facilities or advantages of T2 would be available to Linux users.

I think your response, like many others Apple related, shows a misunderstanding as to what T2 is doing on the Macs. While it manages the boot process it is also effectively a coprocessor handling many other cores, effectively off loading the main CPU. As far as I know none of those facilities is accessible from Linux thus a closed system. That does bring up an interesting question about how disk access works

[wizard69]

Apple has no interest--nor does Microsoft--in catering to Linux on the consumer end of products. Both have their ecosystems for consumers and financially makes zero sense for them to cater to Linux consumers. Microsoft has extended Linux on servers for their cloud back end services to tie back into their Windows focused consumers and to a lesser extent Office for Mac.

Of course not! Why would MS or Apple spend time courting OS users that have nothing to do with them? It is Apples focus on its own hardware and operating systems that makes for a price justification in people’s minds. That focus has resulted in a Apple haveing products on the market that nobody can match. Some like iPad and iPhone are years ahead of the competition where it counts.

Most developers who can't afford a laptop for each platform, or whatnot really have no business model and equity to work as a full-time developer.

Many developers do start out focused on one platform though. They may even stay on that platform for years. You highlight an important element here though -developers in business -something many Linux users don’t grasp. Developers in the MS and Apple worlds are often feeding themselves, putting a roof overhead and other wise functioning positively in their communities.

Perhaps Michael could spare a piece of hardware seeing as he's gifted dozens of units per year? /s

It’s too bad I don’t have the money to buy a donor machine for a Michael. Micheal via Phoronix is probably the best place to get honest testing done with good system comparisons. Phoronix is certain joy less biased than many places on the net.

To think Apple would ever open up the T2 to the Linux community is myopic at best, and moronic at worst. Their entire UEFI, HEVC, etc., is tied to that chip and will be in every product moving forward.

Of course they will not open up the T2 but that doesn’t mean a boot solution for Linux couldn’t be found. In any event I think people are too quick to dismiss the positives that T2 offers Apples systems. As you pointed out it has many functions that effectively puts T2 in a coprocessor role. It would be interesting to see how that impacts performance with operations that T2 can handle. For Apple having one HEVC hardware decoder to work with going forward must be a relief, there is now no need to adapt to all the different GPU hardware out there.

While it it is likely a long shot, maybe impossible with current management at Apple, I can dream about Linux drivers for the T2 chip. Imagine accessing Siri from Linux as easily as done on Mac OS or having access to the HEVC decoder. While I know this is unlikely to happen it does have certain appeal.

I can’t say I like every pricing move Apple has made, however with a bit of shopping at discounters and a focus on the right price points, the value equation really isn’t that bad with Apple Mini hardware. This even more so if you factor in T2 and other Apple innovations.

[Vistaus]

To think Apple would ever open up the T2 to the Linux community is myopic at best, and moronic at worst. Their entire UEFI, HEVC, etc., is tied to that chip and will be in every product moving forward.

You're right, so the following article is fake news then? https://www.omgubuntu.co.uk/2018/11/...ant-boot-linux

[Vistaus]

No, they do NOT block Linux *entirely*: https://www.omgubuntu.co.uk/2018/11/...ant-boot-linux

[Marc Driftmeyer]

Unless you are a developer and want to test/develop on windows, macos and linux but don't want multiple machines around.

Apple has no interest--nor does Microsoft--in catering to Linux on the consumer end of products. Both have their ecosystems for consumers and financially makes zero sense for them to cater to Linux consumers. Microsoft has extended Linux on servers for their cloud back end services to tie back into their Windows focused consumers and to a lesser extent Office for Mac.

Most developers who can't afford a laptop for each platform, or whatnot really have no business model and equity to work as a full-time developer.

Perhaps Michael could spare a piece of hardware seeing as he's gifted dozens of units per year? /s

To think Apple would ever open up the T2 to the Linux community is myopic at best, and moronic at worst. Their entire UEFI, HEVC, etc., is tied to that chip and will be in every product moving forward.

[wizard69]

Honestly, I've always wondered why someone would buy highly overpriced Apple hardware to put GNU/Linux on it.
I know some people buy Apple because it's cool and/or it shows that they have money to spend (often taxpayers' money, of my experience ; and after that, they say government must save money…) but a technically informed person (GNU/Linux user) should not do that.
I also heard some people saying macOS is easier to use than GNU/Linux (macOS most probably not harder to use, but distros like Mint are easy to use ; the only potential hard thing is BIOS configuration when installing, especially with UEFI) and safer than Windows (which (10) I actually find pretty hard and inconvenient when I use it for games ; I will never use it again as main OS), but in this case, you do not put GNU/Linux on your mac.

I think you have been mis informed about Apple hardware. Not all of it is grossly overpriced even the Mac Mini has machines with rational price points. In the case of the Mini and the MBA you are getting bleeding edge hardware with the T2 acting effectively as a co processor. Shop carefully and you will not be paying for a highly overpriced machine.

As for Mac OS it is in fact worth the little bit of extra one pays for it. I run Mac hardware at home and on a few systems at work, mostly Windows at work and a few Linux machines at home. It is safe to say Mac OS is light years ahead of Linux and Windows when it comes to stability and reliability. It is also better supported than either of those platforms.

I say this with complete confidence but also acknowledge that Mac OS is only supported on limited hardware. Windows is by far the most I’ll behaved OS out there. Linux is pretty good relative to Windows, in my case we are talking the Fedora flavor. Even Fedora is held back by the state of gnome and decisions made there to stay with old development strategy’s. Apples greatest advantage in my mind is their ability to drive third party developers in the right direction. That really started with the advent of LLVM/CLang, the focus on APIs and now Swift. Making things easy (most of the time) for developers has lead to a lot of good quality software for the Mac OS and IOS platforms. Contrast this with Linux that can leave you with broken apps just about anytime after an update.

By by the way I’m not saying Apple is perfect and that software hasn’t been broken after an update or two. However the problem is far less on Mac OS than any other platform. You generally have only one major system update a year and with a solid focus on API stability you are not impacted nearly as much as on Linux. When there are issues you are at times anyways warned by Apple that some apps will require updates. On Linux broken software is always a surprise after an update.