[PATCH v6 7/7] security: kernel_pinctrl: fixup pinctrl in kernel dts

[Ahmad Fatoum]

On 3/24/26 10:52 AM, Fabian Pflug wrote:
> Going through the kernel dts and replacing
> barebox,policy-<active_policy>-<name> with <name> and <name> with
> old_<name> if a policy pinctrl has ben found in order to change pinctrl

been

> not only for barebox, but also for kernel when booting with security
> profiles.
> 
> Signed-off-by: Fabian Pflug <f.pflug at pengutronix.de>
> ---
>  security/Makefile         |  1 +
>  security/kernel_pinctrl.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 68 insertions(+)
> 
> diff --git a/security/Makefile b/security/Makefile
> index 1096cbfb9b..2e8cdfe7c2 100644
> --- a/security/Makefile
> +++ b/security/Makefile
> @@ -2,6 +2,7 @@
>  
>  obj-$(CONFIG_SECURITY_POLICY)		+= policy.o
>  obj-$(CONFIG_SECURITY_POLICY_NAMES)	+= sconfig_names.o
> +obj-$(CONFIG_SECURITY_POLICY_PINCTRL)	+= kernel_pinctrl.o
>  obj-$(CONFIG_CRYPTO_KEYSTORE)	+= keystore.o
>  obj-$(CONFIG_JWT)		+= jwt.o
>  obj-pbl-$(CONFIG_HAVE_OPTEE)	+= optee.o
> diff --git a/security/kernel_pinctrl.c b/security/kernel_pinctrl.c
> new file mode 100644
> index 0000000000..f02acdfd55
> --- /dev/null
> +++ b/security/kernel_pinctrl.c
> @@ -0,0 +1,67 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +
> +#include <common.h>
> +#include <linux/printk.h>
> +#include <pinctrl.h>
> +#include <security/policy.h>
> +#include <security/config.h>
> +
> +/* Maximun number of names to be available in pinctrl-names. Best guess.*/

Maximum

> +#define MAX_NAMES	10
> +
> +
> +/**
> + * Replace 'default' with 'old_default' and 'barebox,policy-<active_policy>-default'
> + * with 'default', if both are found in pinctrl.
> + * Same for every other name, that starts with barebox,policy-<active_policy>- and
> + * has another name without the prefix.
> + */
> +static int kernel_of_fixup_pinctrl(struct device_node *root, void *unused)
> +{
> +	char *basename;
> +	int base_len;
> +	struct device_node *node;
> +	const struct security_policy *active_policy = security_policy_get_active();
> +
> +	if (!active_policy || !active_policy->name)
> +		return -EINVAL;
> +	basename = basprintf("barebox,policy-%s-", active_policy->name);
> +	base_len = strlen(basename);
> +
> +	list_for_each_entry(node, &root->list, list) {
> +		const char *names[MAX_NAMES];
> +		int num_read;
> +		bool changed = false;
> +
> +		num_read = of_property_read_string_array(node, "pinctrl-names", names, MAX_NAMES);

I haven't seen a device with 10 pincontrol groups, but it would be good
to emit a warning message here if it happens.

You can use of_property_count_strings() to count the strings.

> +
> +		for (int i = 0; i < num_read; i++) {
> +			if (strncmp(basename, names[i], base_len) == 0) {
> +				const char *name = names[i] + base_len;
> +
> +				for (int ii = 0; ii < num_read; ii++) {
> +					if (strcmp(name, names[ii]) == 0) {
> +						/* this never gets freed,
> +						 * but we are starting the kernel,
> +						 * so there should be no problem.
> +						 */
> +						names[ii] = basprintf("old_%s", name);
> +						names[i] = name;
> +						changed = true;
> +						break;
> +					}
> +				}
> +			}
> +		}
> +		if (changed)
> +			of_property_write_string_array(node, "pinctrl-names", names, num_read);
> +	}
> +	free(basename);
> +	return 0;
> +}
> +
> +static int policy_console_pinctrl_init(void)

Misleading name

> +{
> +	return of_register_fixup(kernel_of_fixup_pinctrl, NULL);
> +}
> +late_initcall(policy_console_pinctrl_init);
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |