userspace: easy checking for specific driver
In general driver system calls are implemented at a subsystem layer. However, some drivers may have capabilities specific to the hardware not covered by the subsystem API. Such drivers may want to define their own system calls. This macro makes it simple to validate in the driver-specific system call handlers that not only does the untrusted device pointer correspond to the expected subsystem, initialization state, and caller permissions, but also that the device object is an instance of a specific driver (and not just any driver in that subsystem). Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
This commit is contained in:
parent
a4605ebaad
commit
74f114caef
2 changed files with 35 additions and 0 deletions
|
@ -299,6 +299,14 @@ Several macros exist to validate arguments:
|
|||
instance, to validate the GPIO driver, one could use the
|
||||
:c:macro:`Z_SYSCALL_DRIVER_GPIO()` macro.
|
||||
|
||||
* :c:macro:`Z_SYSCALL_SPECIFIC_DRIVER()` is a runtime check to verify that
|
||||
a provided pointer is a valid instance of a specific device driver, that
|
||||
the calling thread has permissions on it, and that the driver has been
|
||||
initialized. It does this by checking the init function pointer that
|
||||
is stored within the driver instance and ensuring that it matches the
|
||||
provided value, which should be the address of the specific driver's
|
||||
init function.
|
||||
|
||||
If any check fails, the macros will return a nonzero value. The macro
|
||||
:c:macro:`Z_OOPS()` can be used to induce a kernel oops which will kill the
|
||||
calling thread. This is done instead of returning some error condition to
|
||||
|
|
|
@ -434,6 +434,33 @@ static inline int _obj_validation_check(struct _k_object *ko,
|
|||
# op, __device__); \
|
||||
})
|
||||
|
||||
/**
|
||||
* @brief Runtime check that device object is of a specific driver type
|
||||
*
|
||||
* Checks that the driver object passed in is initialized, the caller has
|
||||
* correct permissions, and that it belongs to the specified driver
|
||||
* subsystems. Additionally, all devices store a function pointer to the
|
||||
* driver's init function. If this doesn't match the value provided, the
|
||||
* check will fail.
|
||||
*
|
||||
* This provides an easy way to determine if a device object not only
|
||||
* belongs to a particular subsystem, but is of a specific device driver
|
||||
* implementation. Useful for defining out-of-subsystem system calls
|
||||
* which are implemented for only one driver.
|
||||
*
|
||||
* @param _device Untrusted device pointer
|
||||
* @param _dtype Expected kernel object type for the provided device pointer
|
||||
* @param _init_fn Expected init function memory address
|
||||
* @return 0 on success, nonzero on failure
|
||||
*/
|
||||
#define Z_SYSCALL_SPECIFIC_DRIVER(_device, _dtype, _init_fn) \
|
||||
({ \
|
||||
struct device *_dev = (struct device *)_device; \
|
||||
Z_SYSCALL_OBJ(_dev, _dtype) || \
|
||||
Z_SYSCALL_VERIFY_MSG(_dev->config->init == _init_fn, \
|
||||
"init function mismatch"); \
|
||||
})
|
||||
|
||||
/**
|
||||
* @brief Runtime check kernel object pointer for non-init functions
|
||||
*
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue