* [PATCH v2 0/2] Add Apple T2 NHI device links
@ 2026-07-21 5:45 Atharva Tiwari
2026-07-21 5:45 ` [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip Atharva Tiwari
2026-07-21 5:45 ` [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI Atharva Tiwari
0 siblings, 2 replies; 6+ messages in thread
From: Atharva Tiwari @ 2026-07-21 5:45 UTC (permalink / raw)
Cc: Atharva Tiwari, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
This series adds a cached flag to detect Apple T2 systems, then uses it
to create device links for the Thunderbolt NHI.
Changes in v2:
- Used a less generic name for has_t2_chip
- Used DMI instead of PCI for has_apple_t2_chip to avoid PCI problems
- Initialized ret in tb_apple_add_links
Link to v1:
https://lore.kernel.org/all/20260719180308.1398-1-atharvatiwarilinuxdev@gmail.com/
Atharva Tiwari (2):
treewide: Add a flag to detect the Apple T2 chip
thunderbolt: Add device links for Apple T2 NHI
arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
drivers/thunderbolt/tb.c | 51 ++++++++-
include/linux/platform_data/x86/apple.h | 5 +
security/integrity/platform_certs/load_uefi.c | 38 ++-----
4 files changed, 168 insertions(+), 31 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip
2026-07-21 5:45 [PATCH v2 0/2] Add Apple T2 NHI device links Atharva Tiwari
@ 2026-07-21 5:45 ` Atharva Tiwari
2026-07-21 5:57 ` sashiko-bot
2026-07-21 10:56 ` Jarkko Sakkinen
2026-07-21 5:45 ` [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI Atharva Tiwari
1 sibling, 2 replies; 6+ messages in thread
From: Atharva Tiwari @ 2026-07-21 5:45 UTC (permalink / raw)
Cc: Atharva Tiwari, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
Add a flag to detect Apple T2 chips on Intel Macs.
Cache the result to avoid repeated checks. That will
be used in upcoming patches.
Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
---
arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
include/linux/platform_data/x86/apple.h | 5 +
security/integrity/platform_certs/load_uefi.c | 38 ++-----
3 files changed, 118 insertions(+), 30 deletions(-)
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index a92f18db9610..74b29738d404 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
bool x86_apple_machine;
EXPORT_SYMBOL(x86_apple_machine);
+bool has_apple_t2_chip;
+EXPORT_SYMBOL(has_apple_t2_chip);
+
+static const struct dmi_system_id apple_t2_devices[] = {
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
+ },
+ },
+ { }
+};
+
void __init early_platform_quirks(void)
{
x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
+
+ has_apple_t2_chip = dmi_check_system(apple_t2_devices);
}
diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
index 079e816c3c21..50bbcc5134fc 100644
--- a/include/linux/platform_data/x86/apple.h
+++ b/include/linux/platform_data/x86/apple.h
@@ -6,8 +6,13 @@
* x86_apple_machine - whether the machine is an x86 Apple Macintosh
*/
extern bool x86_apple_machine;
+/**
+ * has_apple_t2_chip - whether the machine has the Apple T2 chip
+ */
+extern bool has_apple_t2_chip;
#else
#define x86_apple_machine false
+#define has_t2_chip false
#endif
#endif
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index c0d6948446c3..b4096d4c828d 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -3,42 +3,16 @@
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/cred.h>
-#include <linux/dmi.h>
#include <linux/err.h>
#include <linux/efi.h>
#include <linux/slab.h>
#include <linux/ima.h>
+#include <linux/platform_data/x86/apple.h>
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include "../integrity.h"
#include "keyring_handler.h"
-/*
- * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
- * certificates causes occurrence of a page fault in Apple's firmware and
- * a crash disabling EFI runtime services. The following quirk skips reading
- * these variables.
- */
-static const struct dmi_system_id uefi_skip_cert[] = {
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
- { }
-};
-
/*
* Look to see if a UEFI variable called MokIgnoreDB exists and return true if
* it does.
@@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
efi_status_t status;
int rc = 0;
- const struct dmi_system_id *dmi_id;
- dmi_id = dmi_first_match(uefi_skip_cert);
- if (dmi_id) {
+ /*
+ * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
+ * certificates causes occurrence of a page fault in Apple's firmware and
+ * a crash disabling EFI runtime services. The following quirk skips reading
+ * these variables.
+ */
+ if (has_apple_t2_chip) {
pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
return false;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI
2026-07-21 5:45 [PATCH v2 0/2] Add Apple T2 NHI device links Atharva Tiwari
2026-07-21 5:45 ` [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip Atharva Tiwari
@ 2026-07-21 5:45 ` Atharva Tiwari
2026-07-21 5:58 ` sashiko-bot
1 sibling, 1 reply; 6+ messages in thread
From: Atharva Tiwari @ 2026-07-21 5:45 UTC (permalink / raw)
Cc: Atharva Tiwari, Andre Eikmeyer, Bjorn Helgaas, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Andreas Noever, Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
From: Andre Eikmeyer <andre@negmaster.com>
Thunderbolt NHI on T2 Macs (2018-2020). The NHI and its
associated PCIe root ports all sit directly on the root complex
with no upstream port. Apple's ACPI tables name Thunderbolt root
ports as TRP0, TRP1, etc. Find them and create device links back
to the NHI so that PCIe tunnels can be re-established after sleep.
Co-developed-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Signed-off-by: Andre Eikmeyer <andre@negmaster.com>
---
drivers/thunderbolt/tb.c | 51 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 50 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index c69c323e6952..ca47bfbcefdf 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -6,6 +6,7 @@
* Copyright (C) 2019, Intel Corporation
*/
+#include <linux/acpi.h>
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/delay.h>
@@ -3305,11 +3306,59 @@ static const struct tb_cm_ops tb_cm_ops = {
static bool tb_apple_add_links(struct tb_nhi *nhi)
{
struct pci_dev *upstream, *pdev;
- bool ret;
+ bool ret = false;
if (!x86_apple_machine)
return false;
+ /* On T2 Macs. the root ports are stored in ACPI as TRP0,
+ * TRP1, etc. Find them and create device links
+ * so that PCIe tunnels can be re-established after
+ * sleep.
+ */
+ if (has_apple_t2_chip) {
+ struct acpi_device *adev;
+ unsigned int slot, func;
+ const struct device_link *link;
+ const char *bid;
+
+ for (slot = 0; slot < 32; slot++) {
+ for (func = 0; func < 8; func++) {
+ pdev = pci_get_slot(nhi->pdev->bus, PCI_DEVFN(slot, func));
+ if (!pdev)
+ continue;
+
+ if (!pci_is_pcie(pdev) || pci_pcie_type(pdev) !=
+ PCI_EXP_TYPE_ROOT_PORT)
+ goto put_pdev;
+
+ adev = ACPI_COMPANION(&pdev->dev);
+ if (!adev)
+ goto put_pdev;
+
+ bid = acpi_device_bid(adev);
+ if (!bid || strncmp(bid, "TRP", 3) != 0)
+ goto put_pdev;
+
+ link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+ DL_FLAG_AUTOREMOVE_SUPPLIER |
+ DL_FLAG_PM_RUNTIME);
+ if (link) {
+ dev_dbg(&nhi->pdev->dev, "created link from %s\n",
+ dev_name(&pdev->dev));
+ ret = true;
+ } else
+ dev_warn(&nhi->pdev->dev,
+ "device link creation from %s failed\n",
+ dev_name(&pdev->dev));
+
+put_pdev:
+ pci_dev_put(pdev);
+ }
+ }
+ return ret;
+ }
+
switch (nhi->pdev->device) {
case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip
2026-07-21 5:45 ` [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip Atharva Tiwari
@ 2026-07-21 5:57 ` sashiko-bot
2026-07-21 10:56 ` Jarkko Sakkinen
1 sibling, 0 replies; 6+ messages in thread
From: sashiko-bot @ 2026-07-21 5:57 UTC (permalink / raw)
To: Atharva Tiwari; +Cc: linux-pci
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Low] Build failure on non-x86 architectures due to an undeclared identifier in the fallback macro.
- [Low] The `apple_t2_devices` DMI match table wastes memory because it lacks the `__initconst` attribute.
- [Low] Leftover `UEFI_QUIRK_SKIP_CERT` macro is completely unused after removing the DMI table in `load_uefi.c`.
--
--- Patch [1]: [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip ---
commit 7dbd2538a2e2da67cae6a20bc7aa3350603d9016
Author: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
treewide: Add a flag to detect the Apple T2 chip
This commit adds a flag to detect Apple T2 chips on Intel Macs and caches
the result to avoid repeated checks. It introduces a DMI match table in x86
quirks and updates UEFI certificate loading code to use this new cached flag.
> diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
> index a92f18db96100..74b29738d4046 100644
> --- a/arch/x86/kernel/quirks.c
> +++ b/arch/x86/kernel/quirks.c
[ ... ]
> @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
> bool x86_apple_machine;
> EXPORT_SYMBOL(x86_apple_machine);
>
> +bool has_apple_t2_chip;
> +EXPORT_SYMBOL(has_apple_t2_chip);
> +
> +static const struct dmi_system_id apple_t2_devices[] = {
[Severity: Low]
Since apple_t2_devices is only used by early_platform_quirks() which is
marked __init, should this array be marked with __initconst so its memory
can be freed after system initialization?
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
[ ... ]
> diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
> index 079e816c3c219..50bbcc5134fcb 100644
> --- a/include/linux/platform_data/x86/apple.h
> +++ b/include/linux/platform_data/x86/apple.h
> @@ -6,8 +6,13 @@
> * x86_apple_machine - whether the machine is an x86 Apple Macintosh
> */
> extern bool x86_apple_machine;
> +/**
> + * has_apple_t2_chip - whether the machine has the Apple T2 chip
> + */
> +extern bool has_apple_t2_chip;
> #else
> #define x86_apple_machine false
> +#define has_t2_chip false
[Severity: Low]
Does this fallback macro name cause a build regression on non-x86 architectures?
The macro is named has_t2_chip here, but the generic UEFI code in
load_uefi_certs() expects has_apple_t2_chip. When CONFIG_LOAD_UEFI_KEYS is
enabled on other architectures, could this result in an undeclared identifier
error since has_apple_t2_chip would not be defined?
> #endif
>
> #endif
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index c0d6948446c30..b4096d4c828d4 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
[ ... ]
> -/*
> - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> - * certificates causes occurrence of a page fault in Apple's firmware and
> - * a crash disabling EFI runtime services. The following quirk skips reading
> - * these variables.
> - */
> -static const struct dmi_system_id uefi_skip_cert[] = {
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
[Severity: Low]
With the removal of the uefi_skip_cert array, the UEFI_QUIRK_SKIP_CERT
macro defined in security/integrity/platform_certs/keyring_handler.h
appears to be completely unused.
Should that macro definition be cleaned up as well to prevent leftover code?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260721054506.11871-1-atharvatiwarilinuxdev@gmail.com?part=1
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI
2026-07-21 5:45 ` [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI Atharva Tiwari
@ 2026-07-21 5:58 ` sashiko-bot
0 siblings, 0 replies; 6+ messages in thread
From: sashiko-bot @ 2026-07-21 5:58 UTC (permalink / raw)
To: Atharva Tiwari; +Cc: linux-pci
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
New issues:
- [High] Undeclared identifier 'has_apple_t2_chip' when CONFIG_X86 is disabled, causing compilation failure.
- [High] Implicit declaration of 'acpi_device_bid' when CONFIG_ACPI is disabled.
- [Low] Tautological NULL check on array address triggers a -Waddress compiler warning.
Pre-existing issues:
- [High] Preexisting lockless traversal of PCI bridge lists leading to potential Use-After-Free during concurrent hotplug.
--
--- Patch [2]: [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI ---
commit 5087a210c6d3fe9227441543aeb910ee2d98e69e
Author: Andre Eikmeyer <andre@negmaster.com>
thunderbolt: Add device links for Apple T2 NHI
This commit adds support for creating device links on Apple T2 Macs.
It finds root ports named TRP0, TRP1, etc. in ACPI and creates device links
back to the NHI so that PCIe tunnels can be re-established after sleep.
> diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
> --- a/drivers/thunderbolt/tb.c
> +++ b/drivers/thunderbolt/tb.c
> @@ -3305,11 +3306,59 @@ static const struct tb_cm_ops tb_cm_ops = {
> static bool tb_apple_add_links(struct tb_nhi *nhi)
> {
> struct pci_dev *upstream, *pdev;
> - bool ret;
> + bool ret = false;
>
> if (!x86_apple_machine)
> return false;
>
> + /* On T2 Macs. the root ports are stored in ACPI as TRP0,
> + * TRP1, etc. Find them and create device links
> + * so that PCIe tunnels can be re-established after
> + * sleep.
> + */
> + if (has_apple_t2_chip) {
[Severity: High]
Will this fail to compile when CONFIG_X86 is disabled?
It looks like the fallback macro in include/linux/platform_data/x86/apple.h
was named has_t2_chip instead of has_apple_t2_chip. This would leave the
symbol undeclared for non-x86 architectures, potentially breaking the build
for Apple Silicon hardware.
> + struct acpi_device *adev;
> + unsigned int slot, func;
> + const struct device_link *link;
> + const char *bid;
> +
> + for (slot = 0; slot < 32; slot++) {
> + for (func = 0; func < 8; func++) {
> + pdev = pci_get_slot(nhi->pdev->bus, PCI_DEVFN(slot, func));
> + if (!pdev)
> + continue;
> +
> + if (!pci_is_pcie(pdev) || pci_pcie_type(pdev) !=
> + PCI_EXP_TYPE_ROOT_PORT)
> + goto put_pdev;
> +
> + adev = ACPI_COMPANION(&pdev->dev);
> + if (!adev)
> + goto put_pdev;
> +
> + bid = acpi_device_bid(adev);
[Severity: High]
Does this cause an implicit declaration build failure when CONFIG_ACPI
is disabled?
The acpi_device_bid() macro is provided by acpi/acpi_bus.h which is only
included when CONFIG_ACPI is enabled, and there doesn't appear to be a stub
fallback definition for the !CONFIG_ACPI case.
> + if (!bid || strncmp(bid, "TRP", 3) != 0)
[Severity: Low]
Is the !bid condition check necessary here?
Since acpi_device_bid() expands to adev->pnp.bus_id, which is an inline
character array of fixed size, it decays into a pointer to its first element
and can never evaluate to NULL. This might trigger a -Waddress compiler
warning.
> + goto put_pdev;
> +
> + link = device_link_add(&pdev->dev, &nhi->pdev->dev,
[ ... ]
> /*
> * For each hotplug downstream port, create add device link
> * back to NHI so that PCIe tunnels can be re-established after
> * sleep.
> */
> ret = false;
> for_each_pci_bridge(pdev, upstream->subordinate) {
[Severity: High]
This is a pre-existing issue, but does this loop risk a use-after-free
during concurrent PCIe hotplug events?
In the legacy execution path for non-T2 Macs, the for_each_pci_bridge()
macro iterates over downstream devices locklessly, without holding the
pci_bus_sem read lock. If a concurrent hotplug event adds or removes
devices while this list iteration is in progress, it could read freed
memory.
> const struct device_link *link;
>
> if (!pci_is_pcie(pdev))
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260721054506.11871-1-atharvatiwarilinuxdev@gmail.com?part=2
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip
2026-07-21 5:45 ` [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip Atharva Tiwari
2026-07-21 5:57 ` sashiko-bot
@ 2026-07-21 10:56 ` Jarkko Sakkinen
1 sibling, 0 replies; 6+ messages in thread
From: Jarkko Sakkinen @ 2026-07-21 10:56 UTC (permalink / raw)
To: Atharva Tiwari
Cc: Bjorn Helgaas, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Andreas Noever, Mika Westerberg,
Yehezkel Bernat, Hans de Goede, Ilpo Järvinen, Mimi Zohar,
Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Paul Moore,
James Morris, Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
On Tue, Jul 21, 2026 at 01:45:01AM -0400, Atharva Tiwari wrote:
> Add a flag to detect Apple T2 chips on Intel Macs.
> Cache the result to avoid repeated checks. That will
> be used in upcoming patches.
>
> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
> ---
> arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
> include/linux/platform_data/x86/apple.h | 5 +
> security/integrity/platform_certs/load_uefi.c | 38 ++-----
> 3 files changed, 118 insertions(+), 30 deletions(-)
>
> diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
> index a92f18db9610..74b29738d404 100644
> --- a/arch/x86/kernel/quirks.c
> +++ b/arch/x86/kernel/quirks.c
> @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
> bool x86_apple_machine;
> EXPORT_SYMBOL(x86_apple_machine);
>
> +bool has_apple_t2_chip;
> +EXPORT_SYMBOL(has_apple_t2_chip);
> +
> +static const struct dmi_system_id apple_t2_devices[] = {
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
> + },
> + },
> + { }
> +};
> +
> void __init early_platform_quirks(void)
> {
> x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
> dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
> +
> + has_apple_t2_chip = dmi_check_system(apple_t2_devices);
> }
> diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
> index 079e816c3c21..50bbcc5134fc 100644
> --- a/include/linux/platform_data/x86/apple.h
> +++ b/include/linux/platform_data/x86/apple.h
> @@ -6,8 +6,13 @@
> * x86_apple_machine - whether the machine is an x86 Apple Macintosh
> */
> extern bool x86_apple_machine;
> +/**
> + * has_apple_t2_chip - whether the machine has the Apple T2 chip
> + */
> +extern bool has_apple_t2_chip;
> #else
> #define x86_apple_machine false
> +#define has_t2_chip false
> #endif
>
> #endif
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index c0d6948446c3..b4096d4c828d 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -3,42 +3,16 @@
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <linux/cred.h>
> -#include <linux/dmi.h>
> #include <linux/err.h>
> #include <linux/efi.h>
> #include <linux/slab.h>
> #include <linux/ima.h>
> +#include <linux/platform_data/x86/apple.h>
> #include <keys/asymmetric-type.h>
> #include <keys/system_keyring.h>
> #include "../integrity.h"
> #include "keyring_handler.h"
>
> -/*
> - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> - * certificates causes occurrence of a page fault in Apple's firmware and
> - * a crash disabling EFI runtime services. The following quirk skips reading
> - * these variables.
> - */
> -static const struct dmi_system_id uefi_skip_cert[] = {
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
> - { }
> -};
> -
> /*
> * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
> * it does.
> @@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
> unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
> efi_status_t status;
> int rc = 0;
> - const struct dmi_system_id *dmi_id;
>
> - dmi_id = dmi_first_match(uefi_skip_cert);
> - if (dmi_id) {
> + /*
> + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> + * certificates causes occurrence of a page fault in Apple's firmware and
> + * a crash disabling EFI runtime services. The following quirk skips reading
> + * these variables.
> + */
> + if (has_apple_t2_chip) {
> pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
> return false;
> }
> --
> 2.43.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-07-21 10:56 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-21 5:45 [PATCH v2 0/2] Add Apple T2 NHI device links Atharva Tiwari
2026-07-21 5:45 ` [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip Atharva Tiwari
2026-07-21 5:57 ` sashiko-bot
2026-07-21 10:56 ` Jarkko Sakkinen
2026-07-21 5:45 ` [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI Atharva Tiwari
2026-07-21 5:58 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox