xref: /freebsd/sys/net80211/ieee80211_ioctl.c (revision 262e143bd46171a6415a5b28af260a5efa2a3db8)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 /*
37  * IEEE 802.11 ioctl support (FreeBSD-specific)
38  */
39 
40 #include "opt_inet.h"
41 #include "opt_ipx.h"
42 
43 #include <sys/endian.h>
44 #include <sys/param.h>
45 #include <sys/kernel.h>
46 #include <sys/socket.h>
47 #include <sys/sockio.h>
48 #include <sys/systm.h>
49 
50 #include <net/if.h>
51 #include <net/if_dl.h>
52 #include <net/if_media.h>
53 #include <net/ethernet.h>
54 
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <netinet/if_ether.h>
58 #endif
59 
60 #ifdef IPX
61 #include <netipx/ipx.h>
62 #include <netipx/ipx_if.h>
63 #endif
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_ioctl.h>
67 
68 #include <dev/wi/if_wavelan_ieee.h>
69 
70 #define	IS_UP(_ic) \
71 	(((_ic)->ic_ifp->if_flags & IFF_UP) &&			\
72 	    ((_ic)->ic_ifp->if_drv_flags & IFF_DRV_RUNNING))
73 #define	IS_UP_AUTO(_ic) \
74 	(IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
75 
76 /*
77  * XXX
78  * Wireless LAN specific configuration interface, which is compatible
79  * with wicontrol(8).
80  */
81 
82 struct wi_read_ap_args {
83 	int	i;		/* result count */
84 	struct wi_apinfo *ap;	/* current entry in result buffer */
85 	caddr_t	max;		/* result buffer bound */
86 };
87 
88 static void
89 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
90 {
91 	struct ieee80211com *ic = ni->ni_ic;
92 	struct wi_read_ap_args *sa = arg;
93 	struct wi_apinfo *ap = sa->ap;
94 	struct ieee80211_rateset *rs;
95 	int j;
96 
97 	if ((caddr_t)(ap + 1) > sa->max)
98 		return;
99 	memset(ap, 0, sizeof(struct wi_apinfo));
100 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
101 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
102 		ap->namelen = ic->ic_des_esslen;
103 		if (ic->ic_des_esslen)
104 			memcpy(ap->name, ic->ic_des_essid,
105 			    ic->ic_des_esslen);
106 	} else {
107 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
108 		ap->namelen = ni->ni_esslen;
109 		if (ni->ni_esslen)
110 			memcpy(ap->name, ni->ni_essid,
111 			    ni->ni_esslen);
112 	}
113 	ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
114 	ap->signal = ic->ic_node_getrssi(ni);
115 	ap->capinfo = ni->ni_capinfo;
116 	ap->interval = ni->ni_intval;
117 	rs = &ni->ni_rates;
118 	for (j = 0; j < rs->rs_nrates; j++) {
119 		if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
120 			ap->rate = (rs->rs_rates[j] &
121 			    IEEE80211_RATE_VAL) * 5; /* XXX */
122 		}
123 	}
124 	sa->i++;
125 	sa->ap++;
126 }
127 
128 struct wi_read_prism2_args {
129 	int	i;		/* result count */
130 	struct wi_scan_res *res;/* current entry in result buffer */
131 	caddr_t	max;		/* result buffer bound */
132 };
133 
134 static void
135 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
136 {
137 	struct ieee80211com *ic = ni->ni_ic;
138 	struct wi_read_prism2_args *sa = arg;
139 	struct wi_scan_res *res = sa->res;
140 
141 	if ((caddr_t)(res + 1) > sa->max)
142 		return;
143 	res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
144 	res->wi_noise = 0;
145 	res->wi_signal = ic->ic_node_getrssi(ni);
146 	IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
147 	res->wi_interval = ni->ni_intval;
148 	res->wi_capinfo = ni->ni_capinfo;
149 	res->wi_ssid_len = ni->ni_esslen;
150 	memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
151 	/* NB: assumes wi_srates holds <= ni->ni_rates */
152 	memcpy(res->wi_srates, ni->ni_rates.rs_rates,
153 		sizeof(res->wi_srates));
154 	if (ni->ni_rates.rs_nrates < 10)
155 		res->wi_srates[ni->ni_rates.rs_nrates] = 0;
156 	res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
157 	res->wi_rsvd = 0;
158 
159 	sa->i++;
160 	sa->res++;
161 }
162 
163 struct wi_read_sigcache_args {
164 	int	i;		/* result count */
165 	struct wi_sigcache *wsc;/* current entry in result buffer */
166 	caddr_t	max;		/* result buffer bound */
167 };
168 
169 static void
170 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
171 {
172 	struct ieee80211com *ic = ni->ni_ic;
173 	struct wi_read_sigcache_args *sa = arg;
174 	struct wi_sigcache *wsc = sa->wsc;
175 
176 	if ((caddr_t)(wsc + 1) > sa->max)
177 		return;
178 	memset(wsc, 0, sizeof(struct wi_sigcache));
179 	IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
180 	wsc->signal = ic->ic_node_getrssi(ni);
181 
182 	sa->wsc++;
183 	sa->i++;
184 }
185 
186 int
187 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, caddr_t data)
188 {
189 	struct ifnet *ifp = ic->ic_ifp;
190 	int i, j, error;
191 	struct ifreq *ifr = (struct ifreq *)data;
192 	struct wi_req wreq;
193 	struct wi_ltv_keys *keys;
194 
195 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
196 	if (error)
197 		return error;
198 	wreq.wi_len = 0;
199 	switch (wreq.wi_type) {
200 	case WI_RID_SERIALNO:
201 		/* nothing appropriate */
202 		break;
203 	case WI_RID_NODENAME:
204 		strcpy((char *)&wreq.wi_val[1], hostname);
205 		wreq.wi_val[0] = htole16(strlen(hostname));
206 		wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
207 		break;
208 	case WI_RID_CURRENT_SSID:
209 		if (ic->ic_state != IEEE80211_S_RUN) {
210 			wreq.wi_val[0] = 0;
211 			wreq.wi_len = 1;
212 			break;
213 		}
214 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
215 		memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
216 		    ic->ic_bss->ni_esslen);
217 		wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
218 		break;
219 	case WI_RID_OWN_SSID:
220 	case WI_RID_DESIRED_SSID:
221 		wreq.wi_val[0] = htole16(ic->ic_des_esslen);
222 		memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
223 		wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
224 		break;
225 	case WI_RID_CURRENT_BSSID:
226 		if (ic->ic_state == IEEE80211_S_RUN)
227 			IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
228 		else
229 			memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
230 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
231 		break;
232 	case WI_RID_CHANNEL_LIST:
233 		memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
234 		/*
235 		 * Since channel 0 is not available for DS, channel 1
236 		 * is assigned to LSB on WaveLAN.
237 		 */
238 		if (ic->ic_phytype == IEEE80211_T_DS)
239 			i = 1;
240 		else
241 			i = 0;
242 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
243 			if (isset(ic->ic_chan_active, i)) {
244 				setbit((u_int8_t *)wreq.wi_val, j);
245 				wreq.wi_len = j / 16 + 1;
246 			}
247 		break;
248 	case WI_RID_OWN_CHNL:
249 		wreq.wi_val[0] = htole16(
250 			ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
251 		wreq.wi_len = 1;
252 		break;
253 	case WI_RID_CURRENT_CHAN:
254 		wreq.wi_val[0] = htole16(
255 			ieee80211_chan2ieee(ic, ic->ic_curchan));
256 		wreq.wi_len = 1;
257 		break;
258 	case WI_RID_COMMS_QUALITY:
259 		wreq.wi_val[0] = 0;				/* quality */
260 		wreq.wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
261 		wreq.wi_val[2] = 0;				/* noise */
262 		wreq.wi_len = 3;
263 		break;
264 	case WI_RID_PROMISC:
265 		wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
266 		wreq.wi_len = 1;
267 		break;
268 	case WI_RID_PORTTYPE:
269 		wreq.wi_val[0] = htole16(ic->ic_opmode);
270 		wreq.wi_len = 1;
271 		break;
272 	case WI_RID_MAC_NODE:
273 		IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
274 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
275 		break;
276 	case WI_RID_TX_RATE:
277 		if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
278 			wreq.wi_val[0] = 0;	/* auto */
279 		else
280 			wreq.wi_val[0] = htole16(
281 			    (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
282 			    IEEE80211_RATE_VAL) / 2);
283 		wreq.wi_len = 1;
284 		break;
285 	case WI_RID_CUR_TX_RATE:
286 		wreq.wi_val[0] = htole16(
287 		    (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
288 		    IEEE80211_RATE_VAL) / 2);
289 		wreq.wi_len = 1;
290 		break;
291 	case WI_RID_RTS_THRESH:
292 		wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
293 		wreq.wi_len = 1;
294 		break;
295 	case WI_RID_CREATE_IBSS:
296 		wreq.wi_val[0] =
297 		    htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
298 		wreq.wi_len = 1;
299 		break;
300 	case WI_RID_MICROWAVE_OVEN:
301 		wreq.wi_val[0] = 0;	/* no ... not supported */
302 		wreq.wi_len = 1;
303 		break;
304 	case WI_RID_ROAMING_MODE:
305 		wreq.wi_val[0] = htole16(ic->ic_roaming);	/* XXX map */
306 		wreq.wi_len = 1;
307 		break;
308 	case WI_RID_SYSTEM_SCALE:
309 		wreq.wi_val[0] = htole16(1);	/* low density ... not supp */
310 		wreq.wi_len = 1;
311 		break;
312 	case WI_RID_PM_ENABLED:
313 		wreq.wi_val[0] =
314 		    htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
315 		wreq.wi_len = 1;
316 		break;
317 	case WI_RID_MAX_SLEEP:
318 		wreq.wi_val[0] = htole16(ic->ic_lintval);
319 		wreq.wi_len = 1;
320 		break;
321 	case WI_RID_CUR_BEACON_INT:
322 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
323 		wreq.wi_len = 1;
324 		break;
325 	case WI_RID_WEP_AVAIL:
326 		wreq.wi_val[0] = htole16(1);	/* always available */
327 		wreq.wi_len = 1;
328 		break;
329 	case WI_RID_CNFAUTHMODE:
330 		wreq.wi_val[0] = htole16(1);	/* TODO: open system only */
331 		wreq.wi_len = 1;
332 		break;
333 	case WI_RID_ENCRYPTION:
334 		wreq.wi_val[0] =
335 		    htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
336 		wreq.wi_len = 1;
337 		break;
338 	case WI_RID_TX_CRYPT_KEY:
339 		wreq.wi_val[0] = htole16(ic->ic_def_txkey);
340 		wreq.wi_len = 1;
341 		break;
342 	case WI_RID_DEFLT_CRYPT_KEYS:
343 		keys = (struct wi_ltv_keys *)&wreq;
344 		/* do not show keys to non-root user */
345 		error = suser(curthread);
346 		if (error) {
347 			memset(keys, 0, sizeof(*keys));
348 			error = 0;
349 			break;
350 		}
351 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
352 			keys->wi_keys[i].wi_keylen =
353 			    htole16(ic->ic_nw_keys[i].wk_keylen);
354 			memcpy(keys->wi_keys[i].wi_keydat,
355 			    ic->ic_nw_keys[i].wk_key,
356 			    ic->ic_nw_keys[i].wk_keylen);
357 		}
358 		wreq.wi_len = sizeof(*keys) / 2;
359 		break;
360 	case WI_RID_MAX_DATALEN:
361 		wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
362 		wreq.wi_len = 1;
363 		break;
364 	case WI_RID_IFACE_STATS:
365 		/* XXX: should be implemented in lower drivers */
366 		break;
367 	case WI_RID_READ_APS:
368 		/*
369 		 * Don't return results until active scan completes.
370 		 */
371 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
372 			struct wi_read_ap_args args;
373 
374 			args.i = 0;
375 			args.ap = (void *)((char *)wreq.wi_val + sizeof(i));
376 			args.max = (void *)(&wreq + 1);
377 			ieee80211_iterate_nodes(&ic->ic_scan,
378 				wi_read_ap_result, &args);
379 			memcpy(wreq.wi_val, &args.i, sizeof(args.i));
380 			wreq.wi_len = (sizeof(int) +
381 				sizeof(struct wi_apinfo) * args.i) / 2;
382 		} else
383 			error = EINPROGRESS;
384 		break;
385 	case WI_RID_PRISM2:
386 		/* NB: we lie so WI_RID_SCAN_RES can include rates */
387 		wreq.wi_val[0] = 1;
388 		wreq.wi_len = sizeof(u_int16_t) / 2;
389 		break;
390 	case WI_RID_SCAN_RES:			/* compatibility interface */
391 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
392 			struct wi_read_prism2_args args;
393 			struct wi_scan_p2_hdr *p2;
394 
395 			/* NB: use Prism2 format so we can include rate info */
396 			p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
397 			args.i = 0;
398 			args.res = (void *)&p2[1];
399 			args.max = (void *)(&wreq + 1);
400 			ieee80211_iterate_nodes(&ic->ic_scan,
401 				wi_read_prism2_result, &args);
402 			p2->wi_rsvd = 0;
403 			p2->wi_reason = args.i;
404 			wreq.wi_len = (sizeof(*p2) +
405 				sizeof(struct wi_scan_res) * args.i) / 2;
406 		} else
407 			error = EINPROGRESS;
408 		break;
409 	case WI_RID_READ_CACHE: {
410 		struct wi_read_sigcache_args args;
411 		args.i = 0;
412 		args.wsc = (struct wi_sigcache *) wreq.wi_val;
413 		args.max = (void *)(&wreq + 1);
414 		ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
415 		wreq.wi_len = sizeof(struct wi_sigcache) * args.i / 2;
416 		break;
417 	}
418 	default:
419 		error = EINVAL;
420 		break;
421 	}
422 	if (error == 0) {
423 		wreq.wi_len++;
424 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
425 	}
426 	return error;
427 }
428 
429 static int
430 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
431 {
432 #define	IEEERATE(_ic,_m,_i) \
433 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
434 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
435 	for (i = 0; i < nrates; i++)
436 		if (IEEERATE(ic, mode, i) == rate)
437 			return i;
438 	return -1;
439 #undef IEEERATE
440 }
441 
442 /*
443  * Prepare to do a user-initiated scan for AP's.  If no
444  * current/default channel is setup or the current channel
445  * is invalid then pick the first available channel from
446  * the active list as the place to start the scan.
447  */
448 static int
449 ieee80211_setupscan(struct ieee80211com *ic, const u_int8_t chanlist[])
450 {
451 
452 	/*
453 	 * XXX don't permit a scan to be started unless we
454 	 * know the device is ready.  For the moment this means
455 	 * the device is marked up as this is the required to
456 	 * initialize the hardware.  It would be better to permit
457 	 * scanning prior to being up but that'll require some
458 	 * changes to the infrastructure.
459 	 */
460 	if (!IS_UP(ic))
461 		return EINVAL;
462 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
463 	/*
464 	 * We force the state to INIT before calling ieee80211_new_state
465 	 * to get ieee80211_begin_scan called.  We really want to scan w/o
466 	 * altering the current state but that's not possible right now.
467 	 */
468 	/* XXX handle proberequest case */
469 	ic->ic_state = IEEE80211_S_INIT;	/* XXX bypass state machine */
470 	return 0;
471 }
472 
473 int
474 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, caddr_t data)
475 {
476 	struct ifnet *ifp = ic->ic_ifp;
477 	int i, j, len, error, rate;
478 	struct ifreq *ifr = (struct ifreq *)data;
479 	struct wi_ltv_keys *keys;
480 	struct wi_req wreq;
481 	u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
482 
483 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
484 	if (error)
485 		return error;
486 	len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
487 	switch (wreq.wi_type) {
488 	case WI_RID_SERIALNO:
489 	case WI_RID_NODENAME:
490 		return EPERM;
491 	case WI_RID_CURRENT_SSID:
492 		return EPERM;
493 	case WI_RID_OWN_SSID:
494 	case WI_RID_DESIRED_SSID:
495 		if (le16toh(wreq.wi_val[0]) * 2 > len ||
496 		    le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
497 			error = ENOSPC;
498 			break;
499 		}
500 		memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
501 		ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
502 		memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
503 		error = ENETRESET;
504 		break;
505 	case WI_RID_CURRENT_BSSID:
506 		return EPERM;
507 	case WI_RID_OWN_CHNL:
508 		if (len != 2)
509 			return EINVAL;
510 		i = le16toh(wreq.wi_val[0]);
511 		if (i < 0 ||
512 		    i > IEEE80211_CHAN_MAX ||
513 		    isclr(ic->ic_chan_active, i))
514 			return EINVAL;
515 		ic->ic_ibss_chan = &ic->ic_channels[i];
516 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
517 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
518 		else
519 			error = ENETRESET;
520 		break;
521 	case WI_RID_CURRENT_CHAN:
522 		return EPERM;
523 	case WI_RID_COMMS_QUALITY:
524 		return EPERM;
525 	case WI_RID_PROMISC:
526 		if (len != 2)
527 			return EINVAL;
528 		if (ifp->if_flags & IFF_PROMISC) {
529 			if (wreq.wi_val[0] == 0) {
530 				ifp->if_flags &= ~IFF_PROMISC;
531 				error = ENETRESET;
532 			}
533 		} else {
534 			if (wreq.wi_val[0] != 0) {
535 				ifp->if_flags |= IFF_PROMISC;
536 				error = ENETRESET;
537 			}
538 		}
539 		break;
540 	case WI_RID_PORTTYPE:
541 		if (len != 2)
542 			return EINVAL;
543 		switch (le16toh(wreq.wi_val[0])) {
544 		case IEEE80211_M_STA:
545 			break;
546 		case IEEE80211_M_IBSS:
547 			if (!(ic->ic_caps & IEEE80211_C_IBSS))
548 				return EINVAL;
549 			break;
550 		case IEEE80211_M_AHDEMO:
551 			if (ic->ic_phytype != IEEE80211_T_DS ||
552 			    !(ic->ic_caps & IEEE80211_C_AHDEMO))
553 				return EINVAL;
554 			break;
555 		case IEEE80211_M_HOSTAP:
556 			if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
557 				return EINVAL;
558 			break;
559 		default:
560 			return EINVAL;
561 		}
562 		if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
563 			ic->ic_opmode = le16toh(wreq.wi_val[0]);
564 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
565 		}
566 		break;
567 #if 0
568 	case WI_RID_MAC_NODE:
569 		if (len != IEEE80211_ADDR_LEN)
570 			return EINVAL;
571 		IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
572 		/* if_init will copy lladdr into ic_myaddr */
573 		error = ENETRESET;
574 		break;
575 #endif
576 	case WI_RID_TX_RATE:
577 		if (len != 2)
578 			return EINVAL;
579 		if (wreq.wi_val[0] == 0) {
580 			/* auto */
581 			ic->ic_fixed_rate = IEEE80211_FIXED_RATE_NONE;
582 			break;
583 		}
584 		rate = 2 * le16toh(wreq.wi_val[0]);
585 		if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
586 			/*
587 			 * In autoselect mode search for the rate.  We take
588 			 * the first instance which may not be right, but we
589 			 * are limited by the interface.  Note that we also
590 			 * lock the mode to insure the rate is meaningful
591 			 * when it is used.
592 			 */
593 			for (j = IEEE80211_MODE_11A;
594 			     j < IEEE80211_MODE_MAX; j++) {
595 				if ((ic->ic_modecaps & (1<<j)) == 0)
596 					continue;
597 				i = findrate(ic, j, rate);
598 				if (i != -1) {
599 					/* lock mode too */
600 					ic->ic_curmode = j;
601 					goto setrate;
602 				}
603 			}
604 		} else {
605 			i = findrate(ic, ic->ic_curmode, rate);
606 			if (i != -1)
607 				goto setrate;
608 		}
609 		return EINVAL;
610 	setrate:
611 		ic->ic_fixed_rate = i;
612 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
613 		break;
614 	case WI_RID_CUR_TX_RATE:
615 		return EPERM;
616 	case WI_RID_RTS_THRESH:
617 		if (len != 2)
618 			return EINVAL;
619 		if (le16toh(wreq.wi_val[0]) != IEEE80211_MAX_LEN)
620 			return EINVAL;		/* TODO: RTS */
621 		break;
622 	case WI_RID_CREATE_IBSS:
623 		if (len != 2)
624 			return EINVAL;
625 		if (wreq.wi_val[0] != 0) {
626 			if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
627 				return EINVAL;
628 			if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
629 				ic->ic_flags |= IEEE80211_F_IBSSON;
630 				if (ic->ic_opmode == IEEE80211_M_IBSS &&
631 				    ic->ic_state == IEEE80211_S_SCAN)
632 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
633 			}
634 		} else {
635 			if (ic->ic_flags & IEEE80211_F_IBSSON) {
636 				ic->ic_flags &= ~IEEE80211_F_IBSSON;
637 				if (ic->ic_flags & IEEE80211_F_SIBSS) {
638 					ic->ic_flags &= ~IEEE80211_F_SIBSS;
639 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
640 				}
641 			}
642 		}
643 		break;
644 	case WI_RID_MICROWAVE_OVEN:
645 		if (len != 2)
646 			return EINVAL;
647 		if (wreq.wi_val[0] != 0)
648 			return EINVAL;		/* not supported */
649 		break;
650 	case WI_RID_ROAMING_MODE:
651 		if (len != 2)
652 			return EINVAL;
653 		i = le16toh(wreq.wi_val[0]);
654 		if (i > IEEE80211_ROAMING_MANUAL)
655 			return EINVAL;		/* not supported */
656 		ic->ic_roaming = i;
657 		break;
658 	case WI_RID_SYSTEM_SCALE:
659 		if (len != 2)
660 			return EINVAL;
661 		if (le16toh(wreq.wi_val[0]) != 1)
662 			return EINVAL;		/* not supported */
663 		break;
664 	case WI_RID_PM_ENABLED:
665 		if (len != 2)
666 			return EINVAL;
667 		if (wreq.wi_val[0] != 0) {
668 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
669 				return EINVAL;
670 			if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
671 				ic->ic_flags |= IEEE80211_F_PMGTON;
672 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
673 			}
674 		} else {
675 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
676 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
677 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
678 			}
679 		}
680 		break;
681 	case WI_RID_MAX_SLEEP:
682 		if (len != 2)
683 			return EINVAL;
684 		ic->ic_lintval = le16toh(wreq.wi_val[0]);
685 		if (ic->ic_flags & IEEE80211_F_PMGTON)
686 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
687 		break;
688 	case WI_RID_CUR_BEACON_INT:
689 		return EPERM;
690 	case WI_RID_WEP_AVAIL:
691 		return EPERM;
692 	case WI_RID_CNFAUTHMODE:
693 		if (len != 2)
694 			return EINVAL;
695 		i = le16toh(wreq.wi_val[0]);
696 		if (i > IEEE80211_AUTH_WPA)
697 			return EINVAL;
698 		ic->ic_bss->ni_authmode = i;		/* XXX ENETRESET? */
699 		error = ENETRESET;
700 		break;
701 	case WI_RID_ENCRYPTION:
702 		if (len != 2)
703 			return EINVAL;
704 		if (wreq.wi_val[0] != 0) {
705 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
706 				return EINVAL;
707 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
708 				ic->ic_flags |= IEEE80211_F_PRIVACY;
709 				error = ENETRESET;
710 			}
711 		} else {
712 			if (ic->ic_flags & IEEE80211_F_PRIVACY) {
713 				ic->ic_flags &= ~IEEE80211_F_PRIVACY;
714 				error = ENETRESET;
715 			}
716 		}
717 		break;
718 	case WI_RID_TX_CRYPT_KEY:
719 		if (len != 2)
720 			return EINVAL;
721 		i = le16toh(wreq.wi_val[0]);
722 		if (i >= IEEE80211_WEP_NKID)
723 			return EINVAL;
724 		ic->ic_def_txkey = i;
725 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
726 		break;
727 	case WI_RID_DEFLT_CRYPT_KEYS:
728 		if (len != sizeof(struct wi_ltv_keys))
729 			return EINVAL;
730 		keys = (struct wi_ltv_keys *)&wreq;
731 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
732 			len = le16toh(keys->wi_keys[i].wi_keylen);
733 			if (len != 0 && len < IEEE80211_WEP_KEYLEN)
734 				return EINVAL;
735 			if (len > IEEE80211_KEYBUF_SIZE)
736 				return EINVAL;
737 		}
738 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
739 			struct ieee80211_key *k = &ic->ic_nw_keys[i];
740 
741 			len = le16toh(keys->wi_keys[i].wi_keylen);
742 			k->wk_keylen = len;
743 			k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
744 			memset(k->wk_key, 0, sizeof(k->wk_key));
745 			memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
746 #if 0
747 			k->wk_type = IEEE80211_CIPHER_WEP;
748 #endif
749 		}
750 		error = ENETRESET;
751 		break;
752 	case WI_RID_MAX_DATALEN:
753 		if (len != 2)
754 			return EINVAL;
755 		len = le16toh(wreq.wi_val[0]);
756 		if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
757 			return EINVAL;
758 		ic->ic_fragthreshold = len;
759 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
760 		break;
761 	case WI_RID_IFACE_STATS:
762 		error = EPERM;
763 		break;
764 	case WI_RID_SCAN_REQ:			/* XXX wicontrol */
765 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
766 			break;
767 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
768 		if (error == 0)
769 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
770 		break;
771 	case WI_RID_SCAN_APS:
772 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
773 			break;
774 		len--;			/* XXX: tx rate? */
775 		/* FALLTHRU */
776 	case WI_RID_CHANNEL_LIST:
777 		memset(chanlist, 0, sizeof(chanlist));
778 		/*
779 		 * Since channel 0 is not available for DS, channel 1
780 		 * is assigned to LSB on WaveLAN.
781 		 */
782 		if (ic->ic_phytype == IEEE80211_T_DS)
783 			i = 1;
784 		else
785 			i = 0;
786 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
787 			if ((j / 8) >= len)
788 				break;
789 			if (isclr((u_int8_t *)wreq.wi_val, j))
790 				continue;
791 			if (isclr(ic->ic_chan_active, i)) {
792 				if (wreq.wi_type != WI_RID_CHANNEL_LIST)
793 					continue;
794 				if (isclr(ic->ic_chan_avail, i))
795 					return EPERM;
796 			}
797 			setbit(chanlist, i);
798 		}
799 		error = ieee80211_setupscan(ic, chanlist);
800 		if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
801 			/* NB: ignore error from ieee80211_setupscan */
802 			error = ENETRESET;
803 		} else if (error == 0)
804 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
805 		break;
806 	default:
807 		error = EINVAL;
808 		break;
809 	}
810 	if (error == ENETRESET && !IS_UP_AUTO(ic))
811 		error = 0;
812 	return error;
813 }
814 
815 static int
816 cap2cipher(int flag)
817 {
818 	switch (flag) {
819 	case IEEE80211_C_WEP:		return IEEE80211_CIPHER_WEP;
820 	case IEEE80211_C_AES:		return IEEE80211_CIPHER_AES_OCB;
821 	case IEEE80211_C_AES_CCM:	return IEEE80211_CIPHER_AES_CCM;
822 	case IEEE80211_C_CKIP:		return IEEE80211_CIPHER_CKIP;
823 	case IEEE80211_C_TKIP:		return IEEE80211_CIPHER_TKIP;
824 	}
825 	return -1;
826 }
827 
828 static int
829 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq)
830 {
831 	struct ieee80211_node *ni;
832 	struct ieee80211req_key ik;
833 	struct ieee80211_key *wk;
834 	const struct ieee80211_cipher *cip;
835 	u_int kid;
836 	int error;
837 
838 	if (ireq->i_len != sizeof(ik))
839 		return EINVAL;
840 	error = copyin(ireq->i_data, &ik, sizeof(ik));
841 	if (error)
842 		return error;
843 	kid = ik.ik_keyix;
844 	if (kid == IEEE80211_KEYIX_NONE) {
845 		ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
846 		if (ni == NULL)
847 			return EINVAL;		/* XXX */
848 		wk = &ni->ni_ucastkey;
849 	} else {
850 		if (kid >= IEEE80211_WEP_NKID)
851 			return EINVAL;
852 		wk = &ic->ic_nw_keys[kid];
853 		IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
854 		ni = NULL;
855 	}
856 	cip = wk->wk_cipher;
857 	ik.ik_type = cip->ic_cipher;
858 	ik.ik_keylen = wk->wk_keylen;
859 	ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
860 	if (wk->wk_keyix == ic->ic_def_txkey)
861 		ik.ik_flags |= IEEE80211_KEY_DEFAULT;
862 	if (suser(curthread) == 0) {
863 		/* NB: only root can read key data */
864 		ik.ik_keyrsc = wk->wk_keyrsc;
865 		ik.ik_keytsc = wk->wk_keytsc;
866 		memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
867 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
868 			memcpy(ik.ik_keydata+wk->wk_keylen,
869 				wk->wk_key + IEEE80211_KEYBUF_SIZE,
870 				IEEE80211_MICBUF_SIZE);
871 			ik.ik_keylen += IEEE80211_MICBUF_SIZE;
872 		}
873 	} else {
874 		ik.ik_keyrsc = 0;
875 		ik.ik_keytsc = 0;
876 		memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
877 	}
878 	if (ni != NULL)
879 		ieee80211_free_node(ni);
880 	return copyout(&ik, ireq->i_data, sizeof(ik));
881 }
882 
883 static int
884 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
885 {
886 
887 	if (sizeof(ic->ic_chan_active) > ireq->i_len)
888 		ireq->i_len = sizeof(ic->ic_chan_active);
889 	return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
890 }
891 
892 static int
893 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
894 {
895 	struct ieee80211req_chaninfo chans;	/* XXX off stack? */
896 	int i, space;
897 
898 	/*
899 	 * Since channel 0 is not available for DS, channel 1
900 	 * is assigned to LSB on WaveLAN.
901 	 */
902 	if (ic->ic_phytype == IEEE80211_T_DS)
903 		i = 1;
904 	else
905 		i = 0;
906 	memset(&chans, 0, sizeof(chans));
907 	for (; i <= IEEE80211_CHAN_MAX; i++)
908 		if (isset(ic->ic_chan_avail, i)) {
909 			struct ieee80211_channel *c = &ic->ic_channels[i];
910 			chans.ic_chans[chans.ic_nchans].ic_freq = c->ic_freq;
911 			chans.ic_chans[chans.ic_nchans].ic_flags = c->ic_flags;
912 			chans.ic_nchans++;
913 		}
914 	space = __offsetof(struct ieee80211req_chaninfo,
915 			ic_chans[chans.ic_nchans]);
916 	if (space > ireq->i_len)
917 		space = ireq->i_len;
918 	return copyout(&chans, ireq->i_data, space);
919 }
920 
921 static int
922 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
923 {
924 	struct ieee80211_node *ni;
925 	struct ieee80211req_wpaie wpaie;
926 	int error;
927 
928 	if (ireq->i_len < IEEE80211_ADDR_LEN)
929 		return EINVAL;
930 	error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
931 	if (error != 0)
932 		return error;
933 	ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
934 	if (ni == NULL)
935 		return EINVAL;		/* XXX */
936 	memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
937 	if (ni->ni_wpa_ie != NULL) {
938 		int ielen = ni->ni_wpa_ie[1] + 2;
939 		if (ielen > sizeof(wpaie.wpa_ie))
940 			ielen = sizeof(wpaie.wpa_ie);
941 		memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
942 	}
943 	ieee80211_free_node(ni);
944 	if (ireq->i_len > sizeof(wpaie))
945 		ireq->i_len = sizeof(wpaie);
946 	return copyout(&wpaie, ireq->i_data, ireq->i_len);
947 }
948 
949 static int
950 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
951 {
952 	struct ieee80211_node *ni;
953 	u_int8_t macaddr[IEEE80211_ADDR_LEN];
954 	const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
955 	int error;
956 
957 	if (ireq->i_len < off)
958 		return EINVAL;
959 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
960 	if (error != 0)
961 		return error;
962 	ni = ieee80211_find_node(&ic->ic_sta, macaddr);
963 	if (ni == NULL)
964 		return EINVAL;		/* XXX */
965 	if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
966 		ireq->i_len = sizeof(struct ieee80211req_sta_stats);
967 	/* NB: copy out only the statistics */
968 	error = copyout(&ni->ni_stats, (u_int8_t *) ireq->i_data + off,
969 			ireq->i_len - off);
970 	ieee80211_free_node(ni);
971 	return error;
972 }
973 
974 static void
975 get_scan_result(struct ieee80211req_scan_result *sr,
976 	const struct ieee80211_node *ni)
977 {
978 	struct ieee80211com *ic = ni->ni_ic;
979 
980 	memset(sr, 0, sizeof(*sr));
981 	sr->isr_ssid_len = ni->ni_esslen;
982 	if (ni->ni_wpa_ie != NULL)
983 		sr->isr_ie_len += 2+ni->ni_wpa_ie[1];
984 	if (ni->ni_wme_ie != NULL)
985 		sr->isr_ie_len += 2+ni->ni_wme_ie[1];
986 	sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
987 	sr->isr_len = roundup(sr->isr_len, sizeof(u_int32_t));
988 	if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
989 		sr->isr_freq = ni->ni_chan->ic_freq;
990 		sr->isr_flags = ni->ni_chan->ic_flags;
991 	}
992 	sr->isr_rssi = ic->ic_node_getrssi(ni);
993 	sr->isr_intval = ni->ni_intval;
994 	sr->isr_capinfo = ni->ni_capinfo;
995 	sr->isr_erp = ni->ni_erp;
996 	IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
997 	sr->isr_nrates = ni->ni_rates.rs_nrates;
998 	if (sr->isr_nrates > 15)
999 		sr->isr_nrates = 15;
1000 	memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
1001 }
1002 
1003 static int
1004 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
1005 {
1006 	union {
1007 		struct ieee80211req_scan_result res;
1008 		char data[512];		/* XXX shrink? */
1009 	} u;
1010 	struct ieee80211req_scan_result *sr = &u.res;
1011 	struct ieee80211_node_table *nt;
1012 	struct ieee80211_node *ni;
1013 	int error, space;
1014 	u_int8_t *p, *cp;
1015 
1016 	p = ireq->i_data;
1017 	space = ireq->i_len;
1018 	error = 0;
1019 	/* XXX locking */
1020 	nt =  &ic->ic_scan;
1021 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1022 		/* NB: skip pre-scan node state */
1023 		if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1024 			continue;
1025 		get_scan_result(sr, ni);
1026 		if (sr->isr_len > sizeof(u))
1027 			continue;		/* XXX */
1028 		if (space < sr->isr_len)
1029 			break;
1030 		cp = (u_int8_t *)(sr+1);
1031 		memcpy(cp, ni->ni_essid, ni->ni_esslen);
1032 		cp += ni->ni_esslen;
1033 		if (ni->ni_wpa_ie != NULL) {
1034 			memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1035 			cp += 2+ni->ni_wpa_ie[1];
1036 		}
1037 		if (ni->ni_wme_ie != NULL) {
1038 			memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1039 			cp += 2+ni->ni_wme_ie[1];
1040 		}
1041 		error = copyout(sr, p, sr->isr_len);
1042 		if (error)
1043 			break;
1044 		p += sr->isr_len;
1045 		space -= sr->isr_len;
1046 	}
1047 	ireq->i_len -= space;
1048 	return error;
1049 }
1050 
1051 struct stainforeq {
1052 	struct ieee80211com *ic;
1053 	struct ieee80211req_sta_info *si;
1054 	size_t	space;
1055 };
1056 
1057 static size_t
1058 sta_space(const struct ieee80211_node *ni, size_t *ielen)
1059 {
1060 	*ielen = 0;
1061 	if (ni->ni_wpa_ie != NULL)
1062 		*ielen += 2+ni->ni_wpa_ie[1];
1063 	if (ni->ni_wme_ie != NULL)
1064 		*ielen += 2+ni->ni_wme_ie[1];
1065 	return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
1066 		      sizeof(u_int32_t));
1067 }
1068 
1069 static void
1070 get_sta_space(void *arg, struct ieee80211_node *ni)
1071 {
1072 	struct stainforeq *req = arg;
1073 	struct ieee80211com *ic = ni->ni_ic;
1074 	size_t ielen;
1075 
1076 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1077 	    ni->ni_associd == 0)	/* only associated stations */
1078 		return;
1079 	req->space += sta_space(ni, &ielen);
1080 }
1081 
1082 static void
1083 get_sta_info(void *arg, struct ieee80211_node *ni)
1084 {
1085 	struct stainforeq *req = arg;
1086 	struct ieee80211com *ic = ni->ni_ic;
1087 	struct ieee80211req_sta_info *si;
1088 	size_t ielen, len;
1089 	u_int8_t *cp;
1090 
1091 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1092 	    ni->ni_associd == 0)	/* only associated stations */
1093 		return;
1094 	if (ni->ni_chan == IEEE80211_CHAN_ANYC)	/* XXX bogus entry */
1095 		return;
1096 	len = sta_space(ni, &ielen);
1097 	if (len > req->space)
1098 		return;
1099 	si = req->si;
1100 	si->isi_len = len;
1101 	si->isi_ie_len = ielen;
1102 	si->isi_freq = ni->ni_chan->ic_freq;
1103 	si->isi_flags = ni->ni_chan->ic_flags;
1104 	si->isi_state = ni->ni_flags;
1105 	si->isi_authmode = ni->ni_authmode;
1106 	si->isi_rssi = ic->ic_node_getrssi(ni);
1107 	si->isi_capinfo = ni->ni_capinfo;
1108 	si->isi_erp = ni->ni_erp;
1109 	IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
1110 	si->isi_nrates = ni->ni_rates.rs_nrates;
1111 	if (si->isi_nrates > 15)
1112 		si->isi_nrates = 15;
1113 	memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
1114 	si->isi_txrate = ni->ni_txrate;
1115 	si->isi_associd = ni->ni_associd;
1116 	si->isi_txpower = ni->ni_txpower;
1117 	si->isi_vlan = ni->ni_vlan;
1118 	if (ni->ni_flags & IEEE80211_NODE_QOS) {
1119 		memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
1120 		memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
1121 	} else {
1122 		si->isi_txseqs[0] = ni->ni_txseqs[0];
1123 		si->isi_rxseqs[0] = ni->ni_rxseqs[0];
1124 	}
1125 	/* NB: leave all cases in case we relax ni_associd == 0 check */
1126 	if (ieee80211_node_is_authorized(ni))
1127 		si->isi_inact = ic->ic_inact_run;
1128 	else if (ni->ni_associd != 0)
1129 		si->isi_inact = ic->ic_inact_auth;
1130 	else
1131 		si->isi_inact = ic->ic_inact_init;
1132 	si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
1133 
1134 	cp = (u_int8_t *)(si+1);
1135 	if (ni->ni_wpa_ie != NULL) {
1136 		memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1137 		cp += 2+ni->ni_wpa_ie[1];
1138 	}
1139 	if (ni->ni_wme_ie != NULL) {
1140 		memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1141 		cp += 2+ni->ni_wme_ie[1];
1142 	}
1143 
1144 	req->si = (struct ieee80211req_sta_info *)(((u_int8_t *)si) + len);
1145 	req->space -= len;
1146 }
1147 
1148 static int
1149 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
1150 {
1151 	struct stainforeq req;
1152 	int error;
1153 
1154 	if (ireq->i_len < sizeof(struct stainforeq))
1155 		return EFAULT;
1156 
1157 	error = 0;
1158 	req.space = 0;
1159 	ieee80211_iterate_nodes(&ic->ic_sta, get_sta_space, &req);
1160 	if (req.space > ireq->i_len)
1161 		req.space = ireq->i_len;
1162 	if (req.space > 0) {
1163 		size_t space;
1164 		void *p;
1165 
1166 		space = req.space;
1167 		/* XXX M_WAITOK after driver lock released */
1168 		MALLOC(p, void *, space, M_TEMP, M_NOWAIT);
1169 		if (p == NULL)
1170 			return ENOMEM;
1171 		req.si = p;
1172 		ieee80211_iterate_nodes(&ic->ic_sta, get_sta_info, &req);
1173 		ireq->i_len = space - req.space;
1174 		error = copyout(p, ireq->i_data, ireq->i_len);
1175 		FREE(p, M_TEMP);
1176 	} else
1177 		ireq->i_len = 0;
1178 
1179 	return error;
1180 }
1181 
1182 static int
1183 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1184 {
1185 	struct ieee80211_node *ni;
1186 	struct ieee80211req_sta_txpow txpow;
1187 	int error;
1188 
1189 	if (ireq->i_len != sizeof(txpow))
1190 		return EINVAL;
1191 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1192 	if (error != 0)
1193 		return error;
1194 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1195 	if (ni == NULL)
1196 		return EINVAL;		/* XXX */
1197 	txpow.it_txpow = ni->ni_txpower;
1198 	error = copyout(&txpow, ireq->i_data, sizeof(txpow));
1199 	ieee80211_free_node(ni);
1200 	return error;
1201 }
1202 
1203 static int
1204 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1205 {
1206 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1207 	struct wmeParams *wmep;
1208 	int ac;
1209 
1210 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1211 		return EINVAL;
1212 
1213 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1214 	if (ac >= WME_NUM_AC)
1215 		ac = WME_AC_BE;
1216 	if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
1217 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1218 	else
1219 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1220 	switch (ireq->i_type) {
1221 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1222 		ireq->i_val = wmep->wmep_logcwmin;
1223 		break;
1224 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1225 		ireq->i_val = wmep->wmep_logcwmax;
1226 		break;
1227 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1228 		ireq->i_val = wmep->wmep_aifsn;
1229 		break;
1230 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1231 		ireq->i_val = wmep->wmep_txopLimit;
1232 		break;
1233 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1234 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1235 		ireq->i_val = wmep->wmep_acm;
1236 		break;
1237 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1238 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1239 		ireq->i_val = !wmep->wmep_noackPolicy;
1240 		break;
1241 	}
1242 	return 0;
1243 }
1244 
1245 static int
1246 ieee80211_ioctl_getmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1247 {
1248 	const struct ieee80211_aclator *acl = ic->ic_acl;
1249 
1250 	return (acl == NULL ? EINVAL : acl->iac_getioctl(ic, ireq));
1251 }
1252 
1253 /*
1254  * When building the kernel with -O2 on the i386 architecture, gcc
1255  * seems to want to inline this function into ieee80211_ioctl()
1256  * (which is the only routine that calls it). When this happens,
1257  * ieee80211_ioctl() ends up consuming an additional 2K of stack
1258  * space. (Exactly why it needs so much is unclear.) The problem
1259  * is that it's possible for ieee80211_ioctl() to invoke other
1260  * routines (including driver init functions) which could then find
1261  * themselves perilously close to exhausting the stack.
1262  *
1263  * To avoid this, we deliberately prevent gcc from inlining this
1264  * routine. Another way to avoid this is to use less agressive
1265  * optimization when compiling this file (i.e. -O instead of -O2)
1266  * but special-casing the compilation of this one module in the
1267  * build system would be awkward.
1268  */
1269 #ifdef __GNUC__
1270 __attribute__ ((noinline))
1271 #endif
1272 static int
1273 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1274 {
1275 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1276 	int error = 0;
1277 	u_int kid, len, m;
1278 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1279 	char tmpssid[IEEE80211_NWID_LEN];
1280 
1281 	switch (ireq->i_type) {
1282 	case IEEE80211_IOC_SSID:
1283 		switch (ic->ic_state) {
1284 		case IEEE80211_S_INIT:
1285 		case IEEE80211_S_SCAN:
1286 			ireq->i_len = ic->ic_des_esslen;
1287 			memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
1288 			break;
1289 		default:
1290 			ireq->i_len = ic->ic_bss->ni_esslen;
1291 			memcpy(tmpssid, ic->ic_bss->ni_essid,
1292 				ireq->i_len);
1293 			break;
1294 		}
1295 		error = copyout(tmpssid, ireq->i_data, ireq->i_len);
1296 		break;
1297 	case IEEE80211_IOC_NUMSSIDS:
1298 		ireq->i_val = 1;
1299 		break;
1300 	case IEEE80211_IOC_WEP:
1301 		if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
1302 			ireq->i_val = IEEE80211_WEP_OFF;
1303 		else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
1304 			ireq->i_val = IEEE80211_WEP_ON;
1305 		else
1306 			ireq->i_val = IEEE80211_WEP_MIXED;
1307 		break;
1308 	case IEEE80211_IOC_WEPKEY:
1309 		kid = (u_int) ireq->i_val;
1310 		if (kid >= IEEE80211_WEP_NKID)
1311 			return EINVAL;
1312 		len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
1313 		/* NB: only root can read WEP keys */
1314 		if (suser(curthread) == 0) {
1315 			bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
1316 		} else {
1317 			bzero(tmpkey, len);
1318 		}
1319 		ireq->i_len = len;
1320 		error = copyout(tmpkey, ireq->i_data, len);
1321 		break;
1322 	case IEEE80211_IOC_NUMWEPKEYS:
1323 		ireq->i_val = IEEE80211_WEP_NKID;
1324 		break;
1325 	case IEEE80211_IOC_WEPTXKEY:
1326 		ireq->i_val = ic->ic_def_txkey;
1327 		break;
1328 	case IEEE80211_IOC_AUTHMODE:
1329 		if (ic->ic_flags & IEEE80211_F_WPA)
1330 			ireq->i_val = IEEE80211_AUTH_WPA;
1331 		else
1332 			ireq->i_val = ic->ic_bss->ni_authmode;
1333 		break;
1334 	case IEEE80211_IOC_CHANNEL:
1335 		ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
1336 		break;
1337 	case IEEE80211_IOC_POWERSAVE:
1338 		if (ic->ic_flags & IEEE80211_F_PMGTON)
1339 			ireq->i_val = IEEE80211_POWERSAVE_ON;
1340 		else
1341 			ireq->i_val = IEEE80211_POWERSAVE_OFF;
1342 		break;
1343 	case IEEE80211_IOC_POWERSAVESLEEP:
1344 		ireq->i_val = ic->ic_lintval;
1345 		break;
1346 	case IEEE80211_IOC_RTSTHRESHOLD:
1347 		ireq->i_val = ic->ic_rtsthreshold;
1348 		break;
1349 	case IEEE80211_IOC_PROTMODE:
1350 		ireq->i_val = ic->ic_protmode;
1351 		break;
1352 	case IEEE80211_IOC_TXPOWER:
1353 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
1354 			return EINVAL;
1355 		ireq->i_val = ic->ic_txpowlimit;
1356 		break;
1357 	case IEEE80211_IOC_MCASTCIPHER:
1358 		ireq->i_val = rsn->rsn_mcastcipher;
1359 		break;
1360 	case IEEE80211_IOC_MCASTKEYLEN:
1361 		ireq->i_val = rsn->rsn_mcastkeylen;
1362 		break;
1363 	case IEEE80211_IOC_UCASTCIPHERS:
1364 		ireq->i_val = 0;
1365 		for (m = 0x1; m != 0; m <<= 1)
1366 			if (rsn->rsn_ucastcipherset & m)
1367 				ireq->i_val |= 1<<cap2cipher(m);
1368 		break;
1369 	case IEEE80211_IOC_UCASTCIPHER:
1370 		ireq->i_val = rsn->rsn_ucastcipher;
1371 		break;
1372 	case IEEE80211_IOC_UCASTKEYLEN:
1373 		ireq->i_val = rsn->rsn_ucastkeylen;
1374 		break;
1375 	case IEEE80211_IOC_KEYMGTALGS:
1376 		ireq->i_val = rsn->rsn_keymgmtset;
1377 		break;
1378 	case IEEE80211_IOC_RSNCAPS:
1379 		ireq->i_val = rsn->rsn_caps;
1380 		break;
1381 	case IEEE80211_IOC_WPA:
1382 		switch (ic->ic_flags & IEEE80211_F_WPA) {
1383 		case IEEE80211_F_WPA1:
1384 			ireq->i_val = 1;
1385 			break;
1386 		case IEEE80211_F_WPA2:
1387 			ireq->i_val = 2;
1388 			break;
1389 		case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
1390 			ireq->i_val = 3;
1391 			break;
1392 		default:
1393 			ireq->i_val = 0;
1394 			break;
1395 		}
1396 		break;
1397 	case IEEE80211_IOC_CHANLIST:
1398 		error = ieee80211_ioctl_getchanlist(ic, ireq);
1399 		break;
1400 	case IEEE80211_IOC_ROAMING:
1401 		ireq->i_val = ic->ic_roaming;
1402 		break;
1403 	case IEEE80211_IOC_PRIVACY:
1404 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
1405 		break;
1406 	case IEEE80211_IOC_DROPUNENCRYPTED:
1407 		ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
1408 		break;
1409 	case IEEE80211_IOC_COUNTERMEASURES:
1410 		ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
1411 		break;
1412 	case IEEE80211_IOC_DRIVER_CAPS:
1413 		ireq->i_val = ic->ic_caps>>16;
1414 		ireq->i_len = ic->ic_caps&0xffff;
1415 		break;
1416 	case IEEE80211_IOC_WME:
1417 		ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
1418 		break;
1419 	case IEEE80211_IOC_HIDESSID:
1420 		ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
1421 		break;
1422 	case IEEE80211_IOC_APBRIDGE:
1423 		ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
1424 		break;
1425 	case IEEE80211_IOC_OPTIE:
1426 		if (ic->ic_opt_ie == NULL)
1427 			return EINVAL;
1428 		/* NB: truncate, caller can check length */
1429 		if (ireq->i_len > ic->ic_opt_ie_len)
1430 			ireq->i_len = ic->ic_opt_ie_len;
1431 		error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
1432 		break;
1433 	case IEEE80211_IOC_WPAKEY:
1434 		error = ieee80211_ioctl_getkey(ic, ireq);
1435 		break;
1436 	case IEEE80211_IOC_CHANINFO:
1437 		error = ieee80211_ioctl_getchaninfo(ic, ireq);
1438 		break;
1439 	case IEEE80211_IOC_BSSID:
1440 		if (ireq->i_len != IEEE80211_ADDR_LEN)
1441 			return EINVAL;
1442 		error = copyout(ic->ic_state == IEEE80211_S_RUN ?
1443 					ic->ic_bss->ni_bssid :
1444 					ic->ic_des_bssid,
1445 				ireq->i_data, ireq->i_len);
1446 		break;
1447 	case IEEE80211_IOC_WPAIE:
1448 		error = ieee80211_ioctl_getwpaie(ic, ireq);
1449 		break;
1450 	case IEEE80211_IOC_SCAN_RESULTS:
1451 		error = ieee80211_ioctl_getscanresults(ic, ireq);
1452 		break;
1453 	case IEEE80211_IOC_STA_STATS:
1454 		error = ieee80211_ioctl_getstastats(ic, ireq);
1455 		break;
1456 	case IEEE80211_IOC_TXPOWMAX:
1457 		ireq->i_val = ic->ic_bss->ni_txpower;
1458 		break;
1459 	case IEEE80211_IOC_STA_TXPOW:
1460 		error = ieee80211_ioctl_getstatxpow(ic, ireq);
1461 		break;
1462 	case IEEE80211_IOC_STA_INFO:
1463 		error = ieee80211_ioctl_getstainfo(ic, ireq);
1464 		break;
1465 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1466 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1467 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1468 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1469 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1470 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
1471 		error = ieee80211_ioctl_getwmeparam(ic, ireq);
1472 		break;
1473 	case IEEE80211_IOC_DTIM_PERIOD:
1474 		ireq->i_val = ic->ic_dtim_period;
1475 		break;
1476 	case IEEE80211_IOC_BEACON_INTERVAL:
1477 		/* NB: get from ic_bss for station mode */
1478 		ireq->i_val = ic->ic_bss->ni_intval;
1479 		break;
1480 	case IEEE80211_IOC_PUREG:
1481 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PUREG) != 0;
1482 		break;
1483 	case IEEE80211_IOC_FRAGTHRESHOLD:
1484 		ireq->i_val = ic->ic_fragthreshold;
1485 		break;
1486 	case IEEE80211_IOC_MACCMD:
1487 		error = ieee80211_ioctl_getmaccmd(ic, ireq);
1488 		break;
1489 	default:
1490 		error = EINVAL;
1491 		break;
1492 	}
1493 	return error;
1494 }
1495 
1496 static int
1497 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
1498 {
1499 	int error;
1500 	void *ie;
1501 
1502 	/*
1503 	 * NB: Doing this for ap operation could be useful (e.g. for
1504 	 *     WPA and/or WME) except that it typically is worthless
1505 	 *     without being able to intervene when processing
1506 	 *     association response frames--so disallow it for now.
1507 	 */
1508 	if (ic->ic_opmode != IEEE80211_M_STA)
1509 		return EINVAL;
1510 	if (ireq->i_len > IEEE80211_MAX_OPT_IE)
1511 		return EINVAL;
1512 	/* NB: data.length is validated by the wireless extensions code */
1513 	MALLOC(ie, void *, ireq->i_len, M_DEVBUF, M_WAITOK);
1514 	if (ie == NULL)
1515 		return ENOMEM;
1516 	error = copyin(ireq->i_data, ie, ireq->i_len);
1517 	/* XXX sanity check data? */
1518 	if (ic->ic_opt_ie != NULL)
1519 		FREE(ic->ic_opt_ie, M_DEVBUF);
1520 	ic->ic_opt_ie = ie;
1521 	ic->ic_opt_ie_len = ireq->i_len;
1522 	return 0;
1523 }
1524 
1525 static int
1526 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1527 {
1528 	struct ieee80211req_key ik;
1529 	struct ieee80211_node *ni;
1530 	struct ieee80211_key *wk;
1531 	u_int16_t kid;
1532 	int error;
1533 
1534 	if (ireq->i_len != sizeof(ik))
1535 		return EINVAL;
1536 	error = copyin(ireq->i_data, &ik, sizeof(ik));
1537 	if (error)
1538 		return error;
1539 	/* NB: cipher support is verified by ieee80211_crypt_newkey */
1540 	/* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1541 	if (ik.ik_keylen > sizeof(ik.ik_keydata))
1542 		return E2BIG;
1543 	kid = ik.ik_keyix;
1544 	if (kid == IEEE80211_KEYIX_NONE) {
1545 		/* XXX unicast keys currently must be tx/rx */
1546 		if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1547 			return EINVAL;
1548 		if (ic->ic_opmode == IEEE80211_M_STA) {
1549 			ni = ieee80211_ref_node(ic->ic_bss);
1550 			if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
1551 				ieee80211_free_node(ni);
1552 				return EADDRNOTAVAIL;
1553 			}
1554 		} else {
1555 			ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
1556 			if (ni == NULL)
1557 				return ENOENT;
1558 		}
1559 		wk = &ni->ni_ucastkey;
1560 	} else {
1561 		if (kid >= IEEE80211_WEP_NKID)
1562 			return EINVAL;
1563 		wk = &ic->ic_nw_keys[kid];
1564 		ni = NULL;
1565 	}
1566 	error = 0;
1567 	ieee80211_key_update_begin(ic);
1568 	if (ieee80211_crypto_newkey(ic, ik.ik_type, ik.ik_flags, wk)) {
1569 		wk->wk_keylen = ik.ik_keylen;
1570 		/* NB: MIC presence is implied by cipher type */
1571 		if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1572 			wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1573 		wk->wk_keyrsc = ik.ik_keyrsc;
1574 		wk->wk_keytsc = 0;			/* new key, reset */
1575 		memset(wk->wk_key, 0, sizeof(wk->wk_key));
1576 		memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1577 		if (!ieee80211_crypto_setkey(ic, wk,
1578 		    ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
1579 			error = EIO;
1580 		else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1581 			ic->ic_def_txkey = kid;
1582 	} else
1583 		error = ENXIO;
1584 	ieee80211_key_update_end(ic);
1585 	if (ni != NULL)
1586 		ieee80211_free_node(ni);
1587 	return error;
1588 }
1589 
1590 static int
1591 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1592 {
1593 	struct ieee80211req_del_key dk;
1594 	int kid, error;
1595 
1596 	if (ireq->i_len != sizeof(dk))
1597 		return EINVAL;
1598 	error = copyin(ireq->i_data, &dk, sizeof(dk));
1599 	if (error)
1600 		return error;
1601 	kid = dk.idk_keyix;
1602 	/* XXX u_int8_t -> u_int16_t */
1603 	if (dk.idk_keyix == (u_int8_t) IEEE80211_KEYIX_NONE) {
1604 		struct ieee80211_node *ni;
1605 
1606 		if (ic->ic_opmode == IEEE80211_M_STA) {
1607 			ni = ieee80211_ref_node(ic->ic_bss);
1608 			if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
1609 				ieee80211_free_node(ni);
1610 				return EADDRNOTAVAIL;
1611 			}
1612 		} else {
1613 			ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
1614 			if (ni == NULL)
1615 				return ENOENT;
1616 		}
1617 		/* XXX error return */
1618 		ieee80211_node_delucastkey(ni);
1619 		ieee80211_free_node(ni);
1620 	} else {
1621 		if (kid >= IEEE80211_WEP_NKID)
1622 			return EINVAL;
1623 		/* XXX error return */
1624 		ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
1625 	}
1626 	return 0;
1627 }
1628 
1629 static void
1630 domlme(void *arg, struct ieee80211_node *ni)
1631 {
1632 	struct ieee80211com *ic = ni->ni_ic;
1633 	struct ieee80211req_mlme *mlme = arg;
1634 
1635 	if (ni->ni_associd != 0) {
1636 		IEEE80211_SEND_MGMT(ic, ni,
1637 			mlme->im_op == IEEE80211_MLME_DEAUTH ?
1638 				IEEE80211_FC0_SUBTYPE_DEAUTH :
1639 				IEEE80211_FC0_SUBTYPE_DISASSOC,
1640 			mlme->im_reason);
1641 	}
1642 	ieee80211_node_leave(ic, ni);
1643 }
1644 
1645 static int
1646 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
1647 {
1648 	struct ieee80211req_mlme mlme;
1649 	struct ieee80211_node *ni;
1650 	int error;
1651 
1652 	if (ireq->i_len != sizeof(mlme))
1653 		return EINVAL;
1654 	error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1655 	if (error)
1656 		return error;
1657 	switch (mlme.im_op) {
1658 	case IEEE80211_MLME_ASSOC:
1659 		if (ic->ic_opmode != IEEE80211_M_STA)
1660 			return EINVAL;
1661 		/* XXX must be in S_SCAN state? */
1662 
1663 		if (mlme.im_ssid_len != 0) {
1664 			/*
1665 			 * Desired ssid specified; must match both bssid and
1666 			 * ssid to distinguish ap advertising multiple ssid's.
1667 			 */
1668 			ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
1669 				mlme.im_macaddr,
1670 				mlme.im_ssid_len, mlme.im_ssid);
1671 		} else {
1672 			/*
1673 			 * Normal case; just match bssid.
1674 			 */
1675 			ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
1676 		}
1677 		if (ni == NULL)
1678 			return EINVAL;
1679 		if (!ieee80211_sta_join(ic, ni)) {
1680 			ieee80211_free_node(ni);
1681 			return EINVAL;
1682 		}
1683 		break;
1684 	case IEEE80211_MLME_DISASSOC:
1685 	case IEEE80211_MLME_DEAUTH:
1686 		switch (ic->ic_opmode) {
1687 		case IEEE80211_M_STA:
1688 			/* XXX not quite right */
1689 			ieee80211_new_state(ic, IEEE80211_S_INIT,
1690 				mlme.im_reason);
1691 			break;
1692 		case IEEE80211_M_HOSTAP:
1693 			/* NB: the broadcast address means do 'em all */
1694 			if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
1695 				if ((ni = ieee80211_find_node(&ic->ic_sta,
1696 						mlme.im_macaddr)) == NULL)
1697 					return EINVAL;
1698 				domlme(&mlme, ni);
1699 				ieee80211_free_node(ni);
1700 			} else {
1701 				ieee80211_iterate_nodes(&ic->ic_sta,
1702 						domlme, &mlme);
1703 			}
1704 			break;
1705 		default:
1706 			return EINVAL;
1707 		}
1708 		break;
1709 	case IEEE80211_MLME_AUTHORIZE:
1710 	case IEEE80211_MLME_UNAUTHORIZE:
1711 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1712 			return EINVAL;
1713 		ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
1714 		if (ni == NULL)
1715 			return EINVAL;
1716 		if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
1717 			ieee80211_node_authorize(ni);
1718 		else
1719 			ieee80211_node_unauthorize(ni);
1720 		ieee80211_free_node(ni);
1721 		break;
1722 	default:
1723 		return EINVAL;
1724 	}
1725 	return 0;
1726 }
1727 
1728 static int
1729 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
1730 {
1731 	u_int8_t mac[IEEE80211_ADDR_LEN];
1732 	const struct ieee80211_aclator *acl = ic->ic_acl;
1733 	int error;
1734 
1735 	if (ireq->i_len != sizeof(mac))
1736 		return EINVAL;
1737 	error = copyin(ireq->i_data, mac, ireq->i_len);
1738 	if (error)
1739 		return error;
1740 	if (acl == NULL) {
1741 		acl = ieee80211_aclator_get("mac");
1742 		if (acl == NULL || !acl->iac_attach(ic))
1743 			return EINVAL;
1744 		ic->ic_acl = acl;
1745 	}
1746 	if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1747 		acl->iac_add(ic, mac);
1748 	else
1749 		acl->iac_remove(ic, mac);
1750 	return 0;
1751 }
1752 
1753 static int
1754 ieee80211_ioctl_setmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1755 {
1756 	const struct ieee80211_aclator *acl = ic->ic_acl;
1757 
1758 	switch (ireq->i_val) {
1759 	case IEEE80211_MACCMD_POLICY_OPEN:
1760 	case IEEE80211_MACCMD_POLICY_ALLOW:
1761 	case IEEE80211_MACCMD_POLICY_DENY:
1762 		if (acl == NULL) {
1763 			acl = ieee80211_aclator_get("mac");
1764 			if (acl == NULL || !acl->iac_attach(ic))
1765 				return EINVAL;
1766 			ic->ic_acl = acl;
1767 		}
1768 		acl->iac_setpolicy(ic, ireq->i_val);
1769 		break;
1770 	case IEEE80211_MACCMD_FLUSH:
1771 		if (acl != NULL)
1772 			acl->iac_flush(ic);
1773 		/* NB: silently ignore when not in use */
1774 		break;
1775 	case IEEE80211_MACCMD_DETACH:
1776 		if (acl != NULL) {
1777 			ic->ic_acl = NULL;
1778 			acl->iac_detach(ic);
1779 		}
1780 		break;
1781 	default:
1782 		if (acl == NULL)
1783 			return EINVAL;
1784 		else
1785 			return acl->iac_setioctl(ic, ireq);
1786 	}
1787 	return 0;
1788 }
1789 
1790 static int
1791 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
1792 {
1793 	struct ieee80211req_chanlist list;
1794 	u_char chanlist[IEEE80211_CHAN_BYTES];
1795 	int i, j, error;
1796 
1797 	if (ireq->i_len != sizeof(list))
1798 		return EINVAL;
1799 	error = copyin(ireq->i_data, &list, sizeof(list));
1800 	if (error)
1801 		return error;
1802 	memset(chanlist, 0, sizeof(chanlist));
1803 	/*
1804 	 * Since channel 0 is not available for DS, channel 1
1805 	 * is assigned to LSB on WaveLAN.
1806 	 */
1807 	if (ic->ic_phytype == IEEE80211_T_DS)
1808 		i = 1;
1809 	else
1810 		i = 0;
1811 	for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
1812 		/*
1813 		 * NB: silently discard unavailable channels so users
1814 		 *     can specify 1-255 to get all available channels.
1815 		 */
1816 		if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
1817 			setbit(chanlist, i);
1818 	}
1819 	if (ic->ic_ibss_chan == NULL ||
1820 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1821 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1822 			if (isset(chanlist, i)) {
1823 				ic->ic_ibss_chan = &ic->ic_channels[i];
1824 				goto found;
1825 			}
1826 		return EINVAL;			/* no active channels */
1827 found:
1828 		;
1829 	}
1830 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
1831 	return IS_UP_AUTO(ic) ? ENETRESET : 0;
1832 }
1833 
1834 static int
1835 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1836 {
1837 	struct ieee80211_node *ni;
1838 	struct ieee80211req_sta_txpow txpow;
1839 	int error;
1840 
1841 	if (ireq->i_len != sizeof(txpow))
1842 		return EINVAL;
1843 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1844 	if (error != 0)
1845 		return error;
1846 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1847 	if (ni == NULL)
1848 		return EINVAL;		/* XXX */
1849 	ni->ni_txpower = txpow.it_txpow;
1850 	ieee80211_free_node(ni);
1851 	return error;
1852 }
1853 
1854 static int
1855 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1856 {
1857 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1858 	struct wmeParams *wmep, *chanp;
1859 	int isbss, ac;
1860 
1861 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1862 		return EINVAL;
1863 
1864 	isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1865 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1866 	if (ac >= WME_NUM_AC)
1867 		ac = WME_AC_BE;
1868 	if (isbss) {
1869 		chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1870 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1871 	} else {
1872 		chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1873 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1874 	}
1875 	switch (ireq->i_type) {
1876 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1877 		if (isbss) {
1878 			wmep->wmep_logcwmin = ireq->i_val;
1879 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1880 				chanp->wmep_logcwmin = ireq->i_val;
1881 		} else {
1882 			wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1883 				ireq->i_val;
1884 		}
1885 		break;
1886 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1887 		if (isbss) {
1888 			wmep->wmep_logcwmax = ireq->i_val;
1889 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1890 				chanp->wmep_logcwmax = ireq->i_val;
1891 		} else {
1892 			wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1893 				ireq->i_val;
1894 		}
1895 		break;
1896 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1897 		if (isbss) {
1898 			wmep->wmep_aifsn = ireq->i_val;
1899 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1900 				chanp->wmep_aifsn = ireq->i_val;
1901 		} else {
1902 			wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
1903 		}
1904 		break;
1905 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1906 		if (isbss) {
1907 			wmep->wmep_txopLimit = ireq->i_val;
1908 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1909 				chanp->wmep_txopLimit = ireq->i_val;
1910 		} else {
1911 			wmep->wmep_txopLimit = chanp->wmep_txopLimit =
1912 				ireq->i_val;
1913 		}
1914 		break;
1915 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1916 		wmep->wmep_acm = ireq->i_val;
1917 		if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1918 			chanp->wmep_acm = ireq->i_val;
1919 		break;
1920 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1921 		wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1922 			(ireq->i_val) == 0;
1923 		break;
1924 	}
1925 	ieee80211_wme_updateparams(ic);
1926 	return 0;
1927 }
1928 
1929 static int
1930 cipher2cap(int cipher)
1931 {
1932 	switch (cipher) {
1933 	case IEEE80211_CIPHER_WEP:	return IEEE80211_C_WEP;
1934 	case IEEE80211_CIPHER_AES_OCB:	return IEEE80211_C_AES;
1935 	case IEEE80211_CIPHER_AES_CCM:	return IEEE80211_C_AES_CCM;
1936 	case IEEE80211_CIPHER_CKIP:	return IEEE80211_C_CKIP;
1937 	case IEEE80211_CIPHER_TKIP:	return IEEE80211_C_TKIP;
1938 	}
1939 	return 0;
1940 }
1941 
1942 static int
1943 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1944 {
1945 	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
1946 	struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1947 	int error;
1948 	const struct ieee80211_authenticator *auth;
1949 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1950 	char tmpssid[IEEE80211_NWID_LEN];
1951 	u_int8_t tmpbssid[IEEE80211_ADDR_LEN];
1952 	struct ieee80211_key *k;
1953 	int j, caps;
1954 	u_int kid;
1955 
1956 	error = 0;
1957 	switch (ireq->i_type) {
1958 	case IEEE80211_IOC_SSID:
1959 		if (ireq->i_val != 0 ||
1960 		    ireq->i_len > IEEE80211_NWID_LEN)
1961 			return EINVAL;
1962 		error = copyin(ireq->i_data, tmpssid, ireq->i_len);
1963 		if (error)
1964 			break;
1965 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
1966 		ic->ic_des_esslen = ireq->i_len;
1967 		memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
1968 		error = ENETRESET;
1969 		break;
1970 	case IEEE80211_IOC_WEP:
1971 		switch (ireq->i_val) {
1972 		case IEEE80211_WEP_OFF:
1973 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
1974 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1975 			break;
1976 		case IEEE80211_WEP_ON:
1977 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1978 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
1979 			break;
1980 		case IEEE80211_WEP_MIXED:
1981 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1982 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1983 			break;
1984 		}
1985 		error = ENETRESET;
1986 		break;
1987 	case IEEE80211_IOC_WEPKEY:
1988 		kid = (u_int) ireq->i_val;
1989 		if (kid >= IEEE80211_WEP_NKID)
1990 			return EINVAL;
1991 		k = &ic->ic_nw_keys[kid];
1992 		if (ireq->i_len == 0) {
1993 			/* zero-len =>'s delete any existing key */
1994 			(void) ieee80211_crypto_delkey(ic, k);
1995 			break;
1996 		}
1997 		if (ireq->i_len > sizeof(tmpkey))
1998 			return EINVAL;
1999 		memset(tmpkey, 0, sizeof(tmpkey));
2000 		error = copyin(ireq->i_data, tmpkey, ireq->i_len);
2001 		if (error)
2002 			break;
2003 		ieee80211_key_update_begin(ic);
2004 		k->wk_keyix = kid;	/* NB: force fixed key id */
2005 		if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
2006 		    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2007 			k->wk_keylen = ireq->i_len;
2008 			memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
2009 			if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
2010 				error = EINVAL;
2011 		} else
2012 			error = EINVAL;
2013 		ieee80211_key_update_end(ic);
2014 		if (!error)			/* NB: for compatibility */
2015 			error = ENETRESET;
2016 		break;
2017 	case IEEE80211_IOC_WEPTXKEY:
2018 		kid = (u_int) ireq->i_val;
2019 		if (kid >= IEEE80211_WEP_NKID &&
2020 		    (u_int16_t) kid != IEEE80211_KEYIX_NONE)
2021 			return EINVAL;
2022 		ic->ic_def_txkey = kid;
2023 		error = ENETRESET;	/* push to hardware */
2024 		break;
2025 	case IEEE80211_IOC_AUTHMODE:
2026 		switch (ireq->i_val) {
2027 		case IEEE80211_AUTH_WPA:
2028 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2029 		case IEEE80211_AUTH_OPEN:	/* open */
2030 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2031 		case IEEE80211_AUTH_AUTO:	/* auto */
2032 			auth = ieee80211_authenticator_get(ireq->i_val);
2033 			if (auth == NULL)
2034 				return EINVAL;
2035 			break;
2036 		default:
2037 			return EINVAL;
2038 		}
2039 		switch (ireq->i_val) {
2040 		case IEEE80211_AUTH_WPA:	/* WPA w/ 802.1x */
2041 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2042 			ireq->i_val = IEEE80211_AUTH_8021X;
2043 			break;
2044 		case IEEE80211_AUTH_OPEN:	/* open */
2045 			ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2046 			break;
2047 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2048 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2049 			ic->ic_flags &= ~IEEE80211_F_WPA;
2050 			/* both require a key so mark the PRIVACY capability */
2051 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2052 			break;
2053 		case IEEE80211_AUTH_AUTO:	/* auto */
2054 			ic->ic_flags &= ~IEEE80211_F_WPA;
2055 			/* XXX PRIVACY handling? */
2056 			/* XXX what's the right way to do this? */
2057 			break;
2058 		}
2059 		/* NB: authenticator attach/detach happens on state change */
2060 		ic->ic_bss->ni_authmode = ireq->i_val;
2061 		/* XXX mixed/mode/usage? */
2062 		ic->ic_auth = auth;
2063 		error = ENETRESET;
2064 		break;
2065 	case IEEE80211_IOC_CHANNEL:
2066 		/* XXX 0xffff overflows 16-bit signed */
2067 		if (ireq->i_val == 0 ||
2068 		    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
2069 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2070 		else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
2071 		    isclr(ic->ic_chan_active, ireq->i_val)) {
2072 			return EINVAL;
2073 		} else
2074 			ic->ic_ibss_chan = ic->ic_des_chan =
2075 				&ic->ic_channels[ireq->i_val];
2076 		switch (ic->ic_state) {
2077 		case IEEE80211_S_INIT:
2078 		case IEEE80211_S_SCAN:
2079 			error = ENETRESET;
2080 			break;
2081 		default:
2082 			/*
2083 			 * If the desired channel has changed (to something
2084 			 * other than any) and we're not already scanning,
2085 			 * then kick the state machine.
2086 			 */
2087 			if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2088 			    ic->ic_bss->ni_chan != ic->ic_des_chan &&
2089 			    (ic->ic_flags & IEEE80211_F_SCAN) == 0)
2090 				error = ENETRESET;
2091 			break;
2092 		}
2093 		if (error == ENETRESET &&
2094 			ic->ic_opmode == IEEE80211_M_MONITOR) {
2095 			if (IS_UP(ic)) {
2096 				/*
2097 				 * Monitor mode can switch directly.
2098 				 */
2099 				if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
2100 					ic->ic_curchan = ic->ic_des_chan;
2101 				error = ic->ic_reset(ic->ic_ifp);
2102 			} else
2103 				error = 0;
2104 		}
2105 		break;
2106 	case IEEE80211_IOC_POWERSAVE:
2107 		switch (ireq->i_val) {
2108 		case IEEE80211_POWERSAVE_OFF:
2109 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
2110 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
2111 				error = ENETRESET;
2112 			}
2113 			break;
2114 		case IEEE80211_POWERSAVE_ON:
2115 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2116 				error = EINVAL;
2117 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2118 				ic->ic_flags |= IEEE80211_F_PMGTON;
2119 				error = ENETRESET;
2120 			}
2121 			break;
2122 		default:
2123 			error = EINVAL;
2124 			break;
2125 		}
2126 		break;
2127 	case IEEE80211_IOC_POWERSAVESLEEP:
2128 		if (ireq->i_val < 0)
2129 			return EINVAL;
2130 		ic->ic_lintval = ireq->i_val;
2131 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2132 		break;
2133 	case IEEE80211_IOC_RTSTHRESHOLD:
2134 		if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
2135 		      ireq->i_val <= IEEE80211_RTS_MAX))
2136 			return EINVAL;
2137 		ic->ic_rtsthreshold = ireq->i_val;
2138 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2139 		break;
2140 	case IEEE80211_IOC_PROTMODE:
2141 		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2142 			return EINVAL;
2143 		ic->ic_protmode = ireq->i_val;
2144 		/* NB: if not operating in 11g this can wait */
2145 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2146 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2147 		break;
2148 	case IEEE80211_IOC_TXPOWER:
2149 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2150 			return EINVAL;
2151 		if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
2152 		      ireq->i_val < IEEE80211_TXPOWER_MAX))
2153 			return EINVAL;
2154 		ic->ic_txpowlimit = ireq->i_val;
2155 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2156 		break;
2157 	case IEEE80211_IOC_ROAMING:
2158 		if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2159 		    ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2160 			return EINVAL;
2161 		ic->ic_roaming = ireq->i_val;
2162 		/* XXXX reset? */
2163 		break;
2164 	case IEEE80211_IOC_PRIVACY:
2165 		if (ireq->i_val) {
2166 			/* XXX check for key state? */
2167 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2168 		} else
2169 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2170 		break;
2171 	case IEEE80211_IOC_DROPUNENCRYPTED:
2172 		if (ireq->i_val)
2173 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
2174 		else
2175 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2176 		break;
2177 	case IEEE80211_IOC_WPAKEY:
2178 		error = ieee80211_ioctl_setkey(ic, ireq);
2179 		break;
2180 	case IEEE80211_IOC_DELKEY:
2181 		error = ieee80211_ioctl_delkey(ic, ireq);
2182 		break;
2183 	case IEEE80211_IOC_MLME:
2184 		error = ieee80211_ioctl_setmlme(ic, ireq);
2185 		break;
2186 	case IEEE80211_IOC_OPTIE:
2187 		error = ieee80211_ioctl_setoptie(ic, ireq);
2188 		break;
2189 	case IEEE80211_IOC_COUNTERMEASURES:
2190 		if (ireq->i_val) {
2191 			if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
2192 				return EINVAL;
2193 			ic->ic_flags |= IEEE80211_F_COUNTERM;
2194 		} else
2195 			ic->ic_flags &= ~IEEE80211_F_COUNTERM;
2196 		break;
2197 	case IEEE80211_IOC_WPA:
2198 		if (ireq->i_val > 3)
2199 			return EINVAL;
2200 		/* XXX verify ciphers available */
2201 		ic->ic_flags &= ~IEEE80211_F_WPA;
2202 		switch (ireq->i_val) {
2203 		case 1:
2204 			ic->ic_flags |= IEEE80211_F_WPA1;
2205 			break;
2206 		case 2:
2207 			ic->ic_flags |= IEEE80211_F_WPA2;
2208 			break;
2209 		case 3:
2210 			ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2211 			break;
2212 		}
2213 		error = ENETRESET;		/* XXX? */
2214 		break;
2215 	case IEEE80211_IOC_WME:
2216 		if (ireq->i_val) {
2217 			if ((ic->ic_caps & IEEE80211_C_WME) == 0)
2218 				return EINVAL;
2219 			ic->ic_flags |= IEEE80211_F_WME;
2220 		} else
2221 			ic->ic_flags &= ~IEEE80211_F_WME;
2222 		error = ENETRESET;		/* XXX maybe not for station? */
2223 		break;
2224 	case IEEE80211_IOC_HIDESSID:
2225 		if (ireq->i_val)
2226 			ic->ic_flags |= IEEE80211_F_HIDESSID;
2227 		else
2228 			ic->ic_flags &= ~IEEE80211_F_HIDESSID;
2229 		error = ENETRESET;
2230 		break;
2231 	case IEEE80211_IOC_APBRIDGE:
2232 		if (ireq->i_val == 0)
2233 			ic->ic_flags |= IEEE80211_F_NOBRIDGE;
2234 		else
2235 			ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
2236 		break;
2237 	case IEEE80211_IOC_MCASTCIPHER:
2238 		if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
2239 		    !ieee80211_crypto_available(ireq->i_val))
2240 			return EINVAL;
2241 		rsn->rsn_mcastcipher = ireq->i_val;
2242 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2243 		break;
2244 	case IEEE80211_IOC_MCASTKEYLEN:
2245 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2246 			return EINVAL;
2247 		/* XXX no way to verify driver capability */
2248 		rsn->rsn_mcastkeylen = ireq->i_val;
2249 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2250 		break;
2251 	case IEEE80211_IOC_UCASTCIPHERS:
2252 		/*
2253 		 * Convert user-specified cipher set to the set
2254 		 * we can support (via hardware or software).
2255 		 * NB: this logic intentionally ignores unknown and
2256 		 * unsupported ciphers so folks can specify 0xff or
2257 		 * similar and get all available ciphers.
2258 		 */
2259 		caps = 0;
2260 		for (j = 1; j < 32; j++)	/* NB: skip WEP */
2261 			if ((ireq->i_val & (1<<j)) &&
2262 			    ((ic->ic_caps & cipher2cap(j)) ||
2263 			     ieee80211_crypto_available(j)))
2264 				caps |= 1<<j;
2265 		if (caps == 0)			/* nothing available */
2266 			return EINVAL;
2267 		/* XXX verify ciphers ok for unicast use? */
2268 		/* XXX disallow if running as it'll have no effect */
2269 		rsn->rsn_ucastcipherset = caps;
2270 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2271 		break;
2272 	case IEEE80211_IOC_UCASTCIPHER:
2273 		if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
2274 			return EINVAL;
2275 		rsn->rsn_ucastcipher = ireq->i_val;
2276 		break;
2277 	case IEEE80211_IOC_UCASTKEYLEN:
2278 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2279 			return EINVAL;
2280 		/* XXX no way to verify driver capability */
2281 		rsn->rsn_ucastkeylen = ireq->i_val;
2282 		break;
2283 	case IEEE80211_IOC_DRIVER_CAPS:
2284 		/* NB: for testing */
2285 		ic->ic_caps = (((u_int16_t) ireq->i_val) << 16) |
2286 			       ((u_int16_t) ireq->i_len);
2287 		break;
2288 	case IEEE80211_IOC_KEYMGTALGS:
2289 		/* XXX check */
2290 		rsn->rsn_keymgmtset = ireq->i_val;
2291 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2292 		break;
2293 	case IEEE80211_IOC_RSNCAPS:
2294 		/* XXX check */
2295 		rsn->rsn_caps = ireq->i_val;
2296 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2297 		break;
2298 	case IEEE80211_IOC_BSSID:
2299 		/* NB: should only be set when in STA mode */
2300 		if (ic->ic_opmode != IEEE80211_M_STA)
2301 			return EINVAL;
2302 		if (ireq->i_len != sizeof(tmpbssid))
2303 			return EINVAL;
2304 		error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2305 		if (error)
2306 			break;
2307 		IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
2308 		if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2309 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2310 		else
2311 			ic->ic_flags |= IEEE80211_F_DESBSSID;
2312 		error = ENETRESET;
2313 		break;
2314 	case IEEE80211_IOC_CHANLIST:
2315 		error = ieee80211_ioctl_setchanlist(ic, ireq);
2316 		break;
2317 	case IEEE80211_IOC_SCAN_REQ:
2318 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)	/* XXX ignore */
2319 			break;
2320 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
2321 		if (error == 0)		/* XXX background scan */
2322 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2323 		break;
2324 	case IEEE80211_IOC_ADDMAC:
2325 	case IEEE80211_IOC_DELMAC:
2326 		error = ieee80211_ioctl_macmac(ic, ireq);
2327 		break;
2328 	case IEEE80211_IOC_MACCMD:
2329 		error = ieee80211_ioctl_setmaccmd(ic, ireq);
2330 		break;
2331 	case IEEE80211_IOC_STA_TXPOW:
2332 		error = ieee80211_ioctl_setstatxpow(ic, ireq);
2333 		break;
2334 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
2335 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
2336 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
2337 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
2338 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
2339 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
2340 		error = ieee80211_ioctl_setwmeparam(ic, ireq);
2341 		break;
2342 	case IEEE80211_IOC_DTIM_PERIOD:
2343 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2344 		    ic->ic_opmode != IEEE80211_M_IBSS)
2345 			return EINVAL;
2346 		if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2347 		    ireq->i_val <= IEEE80211_DTIM_MAX) {
2348 			ic->ic_dtim_period = ireq->i_val;
2349 			error = ENETRESET;		/* requires restart */
2350 		} else
2351 			error = EINVAL;
2352 		break;
2353 	case IEEE80211_IOC_BEACON_INTERVAL:
2354 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2355 		    ic->ic_opmode != IEEE80211_M_IBSS)
2356 			return EINVAL;
2357 		if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2358 		    ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2359 			ic->ic_bintval = ireq->i_val;
2360 			error = ENETRESET;		/* requires restart */
2361 		} else
2362 			error = EINVAL;
2363 		break;
2364 	case IEEE80211_IOC_PUREG:
2365 		if (ireq->i_val)
2366 			ic->ic_flags |= IEEE80211_F_PUREG;
2367 		else
2368 			ic->ic_flags &= ~IEEE80211_F_PUREG;
2369 		/* NB: reset only if we're operating on an 11g channel */
2370 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2371 			error = ENETRESET;
2372 		break;
2373 	case IEEE80211_IOC_FRAGTHRESHOLD:
2374 		if ((ic->ic_caps & IEEE80211_C_TXFRAG) == 0 &&
2375 		    ireq->i_val != IEEE80211_FRAG_MAX)
2376 			return EINVAL;
2377 		if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
2378 		      ireq->i_val <= IEEE80211_FRAG_MAX))
2379 			return EINVAL;
2380 		ic->ic_fragthreshold = ireq->i_val;
2381 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2382 		break;
2383 	default:
2384 		error = EINVAL;
2385 		break;
2386 	}
2387 	if (error == ENETRESET && !IS_UP_AUTO(ic))
2388 		error = 0;
2389 	return error;
2390 }
2391 
2392 int
2393 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, caddr_t data)
2394 {
2395 	struct ifnet *ifp = ic->ic_ifp;
2396 	int error = 0;
2397 	struct ifreq *ifr;
2398 	struct ifaddr *ifa;			/* XXX */
2399 
2400 	switch (cmd) {
2401 	case SIOCSIFMEDIA:
2402 	case SIOCGIFMEDIA:
2403 		error = ifmedia_ioctl(ifp, (struct ifreq *) data,
2404 				&ic->ic_media, cmd);
2405 		break;
2406 	case SIOCG80211:
2407 		error = ieee80211_ioctl_get80211(ic, cmd,
2408 				(struct ieee80211req *) data);
2409 		break;
2410 	case SIOCS80211:
2411 		error = suser(curthread);
2412 		if (error == 0)
2413 			error = ieee80211_ioctl_set80211(ic, cmd,
2414 					(struct ieee80211req *) data);
2415 		break;
2416 	case SIOCGIFGENERIC:
2417 		error = ieee80211_cfgget(ic, cmd, data);
2418 		break;
2419 	case SIOCSIFGENERIC:
2420 		error = suser(curthread);
2421 		if (error)
2422 			break;
2423 		error = ieee80211_cfgset(ic, cmd, data);
2424 		break;
2425 	case SIOCG80211STATS:
2426 		ifr = (struct ifreq *)data;
2427 		copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
2428 		break;
2429 	case SIOCSIFMTU:
2430 		ifr = (struct ifreq *)data;
2431 		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2432 		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2433 			error = EINVAL;
2434 		else
2435 			ifp->if_mtu = ifr->ifr_mtu;
2436 		break;
2437 	case SIOCSIFADDR:
2438 		/*
2439 		 * XXX Handle this directly so we can supress if_init calls.
2440 		 * XXX This should be done in ether_ioctl but for the moment
2441 		 * XXX there are too many other parts of the system that
2442 		 * XXX set IFF_UP and so supress if_init being called when
2443 		 * XXX it should be.
2444 		 */
2445 		ifa = (struct ifaddr *) data;
2446 		switch (ifa->ifa_addr->sa_family) {
2447 #ifdef INET
2448 		case AF_INET:
2449 			if ((ifp->if_flags & IFF_UP) == 0) {
2450 				ifp->if_flags |= IFF_UP;
2451 				ifp->if_init(ifp->if_softc);
2452 			}
2453 			arp_ifinit(ifp, ifa);
2454 			break;
2455 #endif
2456 #ifdef IPX
2457 		/*
2458 		 * XXX - This code is probably wrong,
2459 		 *	 but has been copied many times.
2460 		 */
2461 		case AF_IPX: {
2462 			struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
2463 
2464 			if (ipx_nullhost(*ina))
2465 				ina->x_host = *(union ipx_host *)
2466 				    IF_LLADDR(ifp);
2467 			else
2468 				bcopy((caddr_t) ina->x_host.c_host,
2469 				      (caddr_t) IF_LLADDR(ifp),
2470 				      ETHER_ADDR_LEN);
2471 			/* fall thru... */
2472 		}
2473 #endif
2474 		default:
2475 			if ((ifp->if_flags & IFF_UP) == 0) {
2476 				ifp->if_flags |= IFF_UP;
2477 				ifp->if_init(ifp->if_softc);
2478 			}
2479 			break;
2480 		}
2481 		break;
2482 	default:
2483 		error = ether_ioctl(ifp, cmd, data);
2484 		break;
2485 	}
2486 	return error;
2487 }
2488