1 /*
2 * This file implement the Wireless Extensions priv API.
3 *
4 * Authors : Jean Tourrilhes - HPL - <jt@hpl.hp.com>
5 * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
6 * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
7 *
8 * (As all part of the Linux kernel, this file is GPL)
9 */
10 #include <linux/slab.h>
11 #include <linux/wireless.h>
12 #include <linux/netdevice.h>
13 #include <net/iw_handler.h>
14 #include <net/wext.h>
15
16 int iw_handler_get_private(struct net_device * dev,
17 struct iw_request_info * info,
18 union iwreq_data * wrqu,
19 char * extra)
20 {
21 /* Check if the driver has something to export */
22 if ((dev->wireless_handlers->num_private_args == 0) ||
23 (dev->wireless_handlers->private_args == NULL))
24 return -EOPNOTSUPP;
25
26 /* Check if there is enough buffer up there */
27 if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
28 /* User space can't know in advance how large the buffer
29 * needs to be. Give it a hint, so that we can support
30 * any size buffer we want somewhat efficiently... */
31 wrqu->data.length = dev->wireless_handlers->num_private_args;
32 return -E2BIG;
33 }
34
35 /* Set the number of available ioctls. */
36 wrqu->data.length = dev->wireless_handlers->num_private_args;
37
38 /* Copy structure to the user buffer. */
39 memcpy(extra, dev->wireless_handlers->private_args,
40 sizeof(struct iw_priv_args) * wrqu->data.length);
41
42 return 0;
43 }
44
45 /* Size (in bytes) of the various private data types */
46 static const char iw_priv_type_size[] = {
47 0, /* IW_PRIV_TYPE_NONE */
48 1, /* IW_PRIV_TYPE_BYTE */
49 1, /* IW_PRIV_TYPE_CHAR */
50 0, /* Not defined */
51 sizeof(__u32), /* IW_PRIV_TYPE_INT */
52 sizeof(struct iw_freq), /* IW_PRIV_TYPE_FLOAT */
53 sizeof(struct sockaddr), /* IW_PRIV_TYPE_ADDR */
54 0, /* Not defined */
55 };
56
57 static int get_priv_size(__u16 args)
58 {
59 int num = args & IW_PRIV_SIZE_MASK;
60 int type = (args & IW_PRIV_TYPE_MASK) >> 12;
61
62 return num * iw_priv_type_size[type];
63 }
64
65 static int adjust_priv_size(__u16 args, struct iw_point *iwp)
66 {
67 int num = iwp->length;
68 int max = args & IW_PRIV_SIZE_MASK;
69 int type = (args & IW_PRIV_TYPE_MASK) >> 12;
70
71 /* Make sure the driver doesn't goof up */
72 if (max < num)
73 num = max;
74
75 return num * iw_priv_type_size[type];
76 }
77
78 /*
79 * Wrapper to call a private Wireless Extension handler.
80 * We do various checks and also take care of moving data between
81 * user space and kernel space.
82 * It's not as nice and slimline as the standard wrapper. The cause
83 * is struct iw_priv_args, which was not really designed for the
84 * job we are going here.
85 *
86 * IMPORTANT : This function prevent to set and get data on the same
87 * IOCTL and enforce the SET/GET convention. Not doing it would be
88 * far too hairy...
89 * If you need to set and get data at the same time, please don't use
90 * a iw_handler but process it in your ioctl handler (i.e. use the
91 * old driver API).
92 */
93 static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
94 const struct iw_priv_args **descrp)
95 {
96 const struct iw_priv_args *descr;
97 int i, extra_size;
98
99 descr = NULL;
100 for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
101 if (cmd == dev->wireless_handlers->private_args[i].cmd) {
102 descr = &dev->wireless_handlers->private_args[i];
103 break;
104 }
105 }
106
107 extra_size = 0;
108 if (descr) {
109 if (IW_IS_SET(cmd)) {
110 int offset = 0; /* For sub-ioctls */
111 /* Check for sub-ioctl handler */
112 if (descr->name[0] == '\0')
113 /* Reserve one int for sub-ioctl index */
114 offset = sizeof(__u32);
115
116 /* Size of set arguments */
117 extra_size = get_priv_size(descr->set_args);
118
119 /* Does it fits in iwr ? */
120 if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
121 ((extra_size + offset) <= IFNAMSIZ))
122 extra_size = 0;
123 } else {
124 /* Size of get arguments */
125 extra_size = get_priv_size(descr->get_args);
126
127 /* Does it fits in iwr ? */
128 if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
129 (extra_size <= IFNAMSIZ))
130 extra_size = 0;
131 }
132 }
133 *descrp = descr;
134 return extra_size;
135 }
136
137 static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
138 const struct iw_priv_args *descr,
139 iw_handler handler, struct net_device *dev,
140 struct iw_request_info *info, int extra_size)
141 {
142 char *extra;
143 int err;
144
145 /* Check what user space is giving us */
146 if (IW_IS_SET(cmd)) {
147 if (!iwp->pointer && iwp->length != 0)
148 return -EFAULT;
149
150 if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
151 return -E2BIG;
152 } else if (!iwp->pointer)
153 return -EFAULT;
154
155 extra = kzalloc(extra_size, GFP_KERNEL);
156 if (!extra)
157 return -ENOMEM;
158
159 /* If it is a SET, get all the extra data in here */
160 if (IW_IS_SET(cmd) && (iwp->length != 0)) {
161 if (copy_from_user(extra, iwp->pointer, extra_size)) {
162 err = -EFAULT;
163 goto out;
164 }
165 }
166
167 /* Call the handler */
168 err = handler(dev, info, (union iwreq_data *) iwp, extra);
169
170 /* If we have something to return to the user */
171 if (!err && IW_IS_GET(cmd)) {
172 /* Adjust for the actual length if it's variable,
173 * avoid leaking kernel bits outside.
174 */
175 if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
176 extra_size = adjust_priv_size(descr->get_args, iwp);
177
178 if (copy_to_user(iwp->pointer, extra, extra_size))
179 err = -EFAULT;
180 }
181
182 out:
183 kfree(extra);
184 return err;
185 }
186
187 int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
188 unsigned int cmd, struct iw_request_info *info,
189 iw_handler handler)
190 {
191 int extra_size = 0, ret = -EINVAL;
192 const struct iw_priv_args *descr;
193
194 extra_size = get_priv_descr_and_size(dev, cmd, &descr);
195
196 /* Check if we have a pointer to user space data or not. */
197 if (extra_size == 0) {
198 /* No extra arguments. Trivial to handle */
199 ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
200 } else {
201 ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
202 handler, dev, info, extra_size);
203 }
204
205 /* Call commit handler if needed and defined */
206 if (ret == -EIWCOMMIT)
207 ret = call_commit_handler(dev);
208
209 return ret;
210 }
211
212 #ifdef CONFIG_COMPAT
213 int compat_private_call(struct net_device *dev, struct iwreq *iwr,
214 unsigned int cmd, struct iw_request_info *info,
215 iw_handler handler)
216 {
217 const struct iw_priv_args *descr;
218 int ret, extra_size;
219
220 extra_size = get_priv_descr_and_size(dev, cmd, &descr);
221
222 /* Check if we have a pointer to user space data or not. */
223 if (extra_size == 0) {
224 /* No extra arguments. Trivial to handle */
225 ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
226 } else {
227 struct compat_iw_point *iwp_compat;
228 struct iw_point iwp;
229
230 iwp_compat = (struct compat_iw_point *) &iwr->u.data;
231 iwp.pointer = compat_ptr(iwp_compat->pointer);
232 iwp.length = iwp_compat->length;
233 iwp.flags = iwp_compat->flags;
234
235 ret = ioctl_private_iw_point(&iwp, cmd, descr,
236 handler, dev, info, extra_size);
237
238 iwp_compat->pointer = ptr_to_compat(iwp.pointer);
239 iwp_compat->length = iwp.length;
240 iwp_compat->flags = iwp.flags;
241 }
242
243 /* Call commit handler if needed and defined */
244 if (ret == -EIWCOMMIT)
245 ret = call_commit_handler(dev);
246
247 return ret;
248 }
249 #endif
250
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.