Here's a proposal for a whitelist to lock down the dynamic device tree. For an overlay to be accepted, all of its targets are required to be on a target node whitelist.
Currently the only way I have to get on the whitelist is calling a function to add a node. That works for fpga regions, but I think other uses will need a way of having adding specific nodes from the base device tree, such as by adding a property like 'allow-overlay;' or 'allow-overlay = "okay";' If that is acceptable, I could use some advice on where that particular code should go. Alan Alan Tull (2): of: overlay: add whitelist fpga: of region: add of-fpga-region to whitelist drivers/fpga/of-fpga-region.c | 9 ++++++ drivers/of/overlay.c | 73 +++++++++++++++++++++++++++++++++++++++++++ include/linux/of.h | 12 +++++++ 3 files changed, 94 insertions(+) -- 2.7.4
