use the gpio-aggregator interface

[Dimitri John Ledkov]

gpio-aggregator interface

https://www.kernel.org/doc/html/latest/admin-guide/gpio/gpio-aggregator.html

to allow apparmor mediation, of specific pins only, we could use gpio-aggregator.

1) Load gpio-aggregator
2) create a new aggregator device of desired chips and lines (can be multiple chips, and multiple lines)
3) allow access to the just created aggregated /dev/gpiochipN device which contains (renumbered) desired lines

this would enable mediation to application that want to use v2 API, without using sysfs API, and still have granular access to pins.

Reference https://lore.kernel.org/all/ZCQir3oDPBGLfQfs@sol/

Example:

# gpiodetect
gpiochip0 [f100000.pinctrl] (230 lines)
gpiochip1 [c440000.spmi:pmic@1:gpio@8800] (10 lines)
gpiochip2 [c440000.spmi:pmic@2:gpio@8800] (9 lines)
gpiochip3 [c440000.spmi:pmic@3:gpio@8800] (10 lines)
gpiochip4 [c440000.spmi:pmic@4:gpio@8800] (4 lines)
gpiochip5 [33c0000.pinctrl] (19 lines)

$ modprobe gpio-aggregator
# cd /sys/bus/platform/drivers/gpio-aggregator

# create a new aggregator with 6 lines from one chip
# (allocated gpiochip6 called gpio-aggregator.0)
$ echo 33c0000.pinctrl 0-5 > new_device

# creat another aggregator with 3 lines from one chip
# (allocated gpiochip7 called gpio-aggregator.1)
$ echo 33c0000.pinctrl 10-12 > new_device

# create a new aggregator with 1 line from two chips
# (allocated gpiochip8 called gpio-aggregator.2)
$ echo 33c0000.pinctrl 14 f100000.pinctrl 1 > new_device

# gpiodetect
gpiochip0 [f100000.pinctrl] (230 lines)
gpiochip1 [c440000.spmi:pmic@1:gpio@8800] (10 lines)
gpiochip2 [c440000.spmi:pmic@2:gpio@8800] (9 lines)
gpiochip3 [c440000.spmi:pmic@3:gpio@8800] (10 lines)
gpiochip4 [c440000.spmi:pmic@4:gpio@8800] (4 lines)
gpiochip5 [33c0000.pinctrl] (19 lines)
gpiochip6 [gpio-aggregator.0] (6 lines)
gpiochip7 [gpio-aggregator.1] (3 lines)
gpiochip8 [gpio-aggregator.2] (2 lines)

# gpioinfo 33c0000.pinctrl
gpiochip5 - 19 lines:
 line 0: unnamed "gpio-aggregator.0" input active-high [used]
 line 1: unnamed "gpio-aggregator.0" input active-high [used]
 line 2: unnamed "gpio-aggregator.0" input active-high [used]
 line 3: unnamed "gpio-aggregator.0" input active-high [used]
 line 4: unnamed "gpio-aggregator.0" input active-high [used]
 line 5: unnamed "gpio-aggregator.0" input active-high [used]
 line 6: unnamed unused input active-high
 line 7: unnamed unused input active-high
 line 8: unnamed unused input active-high
 line 9: unnamed unused input active-high
 line 10: unnamed "gpio-aggregator.1" input active-high [used]
 line 11: unnamed "gpio-aggregator.1" input active-high [used]
 line 12: unnamed "gpio-aggregator.1" input active-high [used]
 line 13: unnamed unused input active-high
 line 14: unnamed "gpio-aggregator.2" input active-high [used]
 line 15: unnamed unused input active-high
 line 16: unnamed unused input active-high
 line 17: unnamed unused input active-high
 line 18: unnamed unused input active-high

# gpioinfo gpio-aggregator.2
gpiochip8 - 2 lines:
 line 0: unnamed unused input active-high
 line 1: unnamed unused input active-high

Apparmor access to /dev/gpiochip8 thus gives access to just the requested pins "33c0000.pinctrl 14 f100000.pinctrl 1"