xref: /freebsd/sys/net80211/ieee80211_ioctl.c (revision 2bc6540439d0932b38067c9cc321fa0e2a61f264)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 /*
37  * IEEE 802.11 ioctl support (FreeBSD-specific)
38  */
39 
40 #include "opt_inet.h"
41 #include "opt_ipx.h"
42 
43 #include <sys/endian.h>
44 #include <sys/param.h>
45 #include <sys/kernel.h>
46 #include <sys/socket.h>
47 #include <sys/sockio.h>
48 #include <sys/systm.h>
49 
50 #include <net/if.h>
51 #include <net/if_dl.h>
52 #include <net/if_media.h>
53 #include <net/ethernet.h>
54 
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <netinet/if_ether.h>
58 #endif
59 
60 #ifdef IPX
61 #include <netipx/ipx.h>
62 #include <netipx/ipx_if.h>
63 #endif
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_ioctl.h>
67 
68 #include <dev/wi/if_wavelan_ieee.h>
69 
70 #define	IS_UP(_ic) \
71 	(((_ic)->ic_ifp->if_flags & IFF_UP) &&			\
72 	    ((_ic)->ic_ifp->if_drv_flags & IFF_DRV_RUNNING))
73 #define	IS_UP_AUTO(_ic) \
74 	(IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
75 
76 /*
77  * XXX
78  * Wireless LAN specific configuration interface, which is compatible
79  * with wicontrol(8).
80  */
81 
82 struct wi_read_ap_args {
83 	int	i;		/* result count */
84 	struct wi_apinfo *ap;	/* current entry in result buffer */
85 	caddr_t	max;		/* result buffer bound */
86 };
87 
88 static void
89 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
90 {
91 	struct ieee80211com *ic = ni->ni_ic;
92 	struct wi_read_ap_args *sa = arg;
93 	struct wi_apinfo *ap = sa->ap;
94 	struct ieee80211_rateset *rs;
95 	int j;
96 
97 	if ((caddr_t)(ap + 1) > sa->max)
98 		return;
99 	memset(ap, 0, sizeof(struct wi_apinfo));
100 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
101 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
102 		ap->namelen = ic->ic_des_esslen;
103 		if (ic->ic_des_esslen)
104 			memcpy(ap->name, ic->ic_des_essid,
105 			    ic->ic_des_esslen);
106 	} else {
107 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
108 		ap->namelen = ni->ni_esslen;
109 		if (ni->ni_esslen)
110 			memcpy(ap->name, ni->ni_essid,
111 			    ni->ni_esslen);
112 	}
113 	ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
114 	ap->signal = ic->ic_node_getrssi(ni);
115 	ap->capinfo = ni->ni_capinfo;
116 	ap->interval = ni->ni_intval;
117 	rs = &ni->ni_rates;
118 	for (j = 0; j < rs->rs_nrates; j++) {
119 		if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
120 			ap->rate = (rs->rs_rates[j] &
121 			    IEEE80211_RATE_VAL) * 5; /* XXX */
122 		}
123 	}
124 	sa->i++;
125 	sa->ap++;
126 }
127 
128 struct wi_read_prism2_args {
129 	int	i;		/* result count */
130 	struct wi_scan_res *res;/* current entry in result buffer */
131 	caddr_t	max;		/* result buffer bound */
132 };
133 
134 static void
135 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
136 {
137 	struct ieee80211com *ic = ni->ni_ic;
138 	struct wi_read_prism2_args *sa = arg;
139 	struct wi_scan_res *res = sa->res;
140 
141 	if ((caddr_t)(res + 1) > sa->max)
142 		return;
143 	res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
144 	res->wi_noise = 0;
145 	res->wi_signal = ic->ic_node_getrssi(ni);
146 	IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
147 	res->wi_interval = ni->ni_intval;
148 	res->wi_capinfo = ni->ni_capinfo;
149 	res->wi_ssid_len = ni->ni_esslen;
150 	memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
151 	/* NB: assumes wi_srates holds <= ni->ni_rates */
152 	memcpy(res->wi_srates, ni->ni_rates.rs_rates,
153 		sizeof(res->wi_srates));
154 	if (ni->ni_rates.rs_nrates < 10)
155 		res->wi_srates[ni->ni_rates.rs_nrates] = 0;
156 	res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
157 	res->wi_rsvd = 0;
158 
159 	sa->i++;
160 	sa->res++;
161 }
162 
163 struct wi_read_sigcache_args {
164 	int	i;		/* result count */
165 	struct wi_sigcache *wsc;/* current entry in result buffer */
166 	caddr_t	max;		/* result buffer bound */
167 };
168 
169 static void
170 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
171 {
172 	struct ieee80211com *ic = ni->ni_ic;
173 	struct wi_read_sigcache_args *sa = arg;
174 	struct wi_sigcache *wsc = sa->wsc;
175 
176 	if ((caddr_t)(wsc + 1) > sa->max)
177 		return;
178 	memset(wsc, 0, sizeof(struct wi_sigcache));
179 	IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
180 	wsc->signal = ic->ic_node_getrssi(ni);
181 
182 	sa->wsc++;
183 	sa->i++;
184 }
185 
186 int
187 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, caddr_t data)
188 {
189 	struct ifnet *ifp = ic->ic_ifp;
190 	int i, j, error;
191 	struct ifreq *ifr = (struct ifreq *)data;
192 	struct wi_req wreq;
193 	struct wi_ltv_keys *keys;
194 
195 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
196 	if (error)
197 		return error;
198 	wreq.wi_len = 0;
199 	switch (wreq.wi_type) {
200 	case WI_RID_SERIALNO:
201 		/* nothing appropriate */
202 		break;
203 	case WI_RID_NODENAME:
204 		strcpy((char *)&wreq.wi_val[1], hostname);
205 		wreq.wi_val[0] = htole16(strlen(hostname));
206 		wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
207 		break;
208 	case WI_RID_CURRENT_SSID:
209 		if (ic->ic_state != IEEE80211_S_RUN) {
210 			wreq.wi_val[0] = 0;
211 			wreq.wi_len = 1;
212 			break;
213 		}
214 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
215 		memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
216 		    ic->ic_bss->ni_esslen);
217 		wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
218 		break;
219 	case WI_RID_OWN_SSID:
220 	case WI_RID_DESIRED_SSID:
221 		wreq.wi_val[0] = htole16(ic->ic_des_esslen);
222 		memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
223 		wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
224 		break;
225 	case WI_RID_CURRENT_BSSID:
226 		if (ic->ic_state == IEEE80211_S_RUN)
227 			IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
228 		else
229 			memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
230 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
231 		break;
232 	case WI_RID_CHANNEL_LIST:
233 		memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
234 		/*
235 		 * Since channel 0 is not available for DS, channel 1
236 		 * is assigned to LSB on WaveLAN.
237 		 */
238 		if (ic->ic_phytype == IEEE80211_T_DS)
239 			i = 1;
240 		else
241 			i = 0;
242 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
243 			if (isset(ic->ic_chan_active, i)) {
244 				setbit((u_int8_t *)wreq.wi_val, j);
245 				wreq.wi_len = j / 16 + 1;
246 			}
247 		break;
248 	case WI_RID_OWN_CHNL:
249 		wreq.wi_val[0] = htole16(
250 			ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
251 		wreq.wi_len = 1;
252 		break;
253 	case WI_RID_CURRENT_CHAN:
254 		wreq.wi_val[0] = htole16(
255 			ieee80211_chan2ieee(ic, ic->ic_curchan));
256 		wreq.wi_len = 1;
257 		break;
258 	case WI_RID_COMMS_QUALITY:
259 		wreq.wi_val[0] = 0;				/* quality */
260 		wreq.wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
261 		wreq.wi_val[2] = 0;				/* noise */
262 		wreq.wi_len = 3;
263 		break;
264 	case WI_RID_PROMISC:
265 		wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
266 		wreq.wi_len = 1;
267 		break;
268 	case WI_RID_PORTTYPE:
269 		wreq.wi_val[0] = htole16(ic->ic_opmode);
270 		wreq.wi_len = 1;
271 		break;
272 	case WI_RID_MAC_NODE:
273 		IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
274 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
275 		break;
276 	case WI_RID_TX_RATE:
277 		if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
278 			wreq.wi_val[0] = 0;	/* auto */
279 		else
280 			wreq.wi_val[0] = htole16(
281 			    (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
282 			    IEEE80211_RATE_VAL) / 2);
283 		wreq.wi_len = 1;
284 		break;
285 	case WI_RID_CUR_TX_RATE:
286 		wreq.wi_val[0] = htole16(
287 		    (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
288 		    IEEE80211_RATE_VAL) / 2);
289 		wreq.wi_len = 1;
290 		break;
291 	case WI_RID_RTS_THRESH:
292 		wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
293 		wreq.wi_len = 1;
294 		break;
295 	case WI_RID_CREATE_IBSS:
296 		wreq.wi_val[0] =
297 		    htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
298 		wreq.wi_len = 1;
299 		break;
300 	case WI_RID_MICROWAVE_OVEN:
301 		wreq.wi_val[0] = 0;	/* no ... not supported */
302 		wreq.wi_len = 1;
303 		break;
304 	case WI_RID_ROAMING_MODE:
305 		wreq.wi_val[0] = htole16(ic->ic_roaming);	/* XXX map */
306 		wreq.wi_len = 1;
307 		break;
308 	case WI_RID_SYSTEM_SCALE:
309 		wreq.wi_val[0] = htole16(1);	/* low density ... not supp */
310 		wreq.wi_len = 1;
311 		break;
312 	case WI_RID_PM_ENABLED:
313 		wreq.wi_val[0] =
314 		    htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
315 		wreq.wi_len = 1;
316 		break;
317 	case WI_RID_MAX_SLEEP:
318 		wreq.wi_val[0] = htole16(ic->ic_lintval);
319 		wreq.wi_len = 1;
320 		break;
321 	case WI_RID_CUR_BEACON_INT:
322 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
323 		wreq.wi_len = 1;
324 		break;
325 	case WI_RID_WEP_AVAIL:
326 		wreq.wi_val[0] = htole16(1);	/* always available */
327 		wreq.wi_len = 1;
328 		break;
329 	case WI_RID_CNFAUTHMODE:
330 		wreq.wi_val[0] = htole16(1);	/* TODO: open system only */
331 		wreq.wi_len = 1;
332 		break;
333 	case WI_RID_ENCRYPTION:
334 		wreq.wi_val[0] =
335 		    htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
336 		wreq.wi_len = 1;
337 		break;
338 	case WI_RID_TX_CRYPT_KEY:
339 		wreq.wi_val[0] = htole16(ic->ic_def_txkey);
340 		wreq.wi_len = 1;
341 		break;
342 	case WI_RID_DEFLT_CRYPT_KEYS:
343 		keys = (struct wi_ltv_keys *)&wreq;
344 		/* do not show keys to non-root user */
345 		error = suser(curthread);
346 		if (error) {
347 			memset(keys, 0, sizeof(*keys));
348 			error = 0;
349 			break;
350 		}
351 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
352 			keys->wi_keys[i].wi_keylen =
353 			    htole16(ic->ic_nw_keys[i].wk_keylen);
354 			memcpy(keys->wi_keys[i].wi_keydat,
355 			    ic->ic_nw_keys[i].wk_key,
356 			    ic->ic_nw_keys[i].wk_keylen);
357 		}
358 		wreq.wi_len = sizeof(*keys) / 2;
359 		break;
360 	case WI_RID_MAX_DATALEN:
361 		wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
362 		wreq.wi_len = 1;
363 		break;
364 	case WI_RID_IFACE_STATS:
365 		/* XXX: should be implemented in lower drivers */
366 		break;
367 	case WI_RID_READ_APS:
368 		/*
369 		 * Don't return results until active scan completes.
370 		 */
371 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
372 			struct wi_read_ap_args args;
373 
374 			args.i = 0;
375 			args.ap = (void *)((char *)wreq.wi_val + sizeof(i));
376 			args.max = (void *)(&wreq + 1);
377 			ieee80211_iterate_nodes(&ic->ic_scan,
378 				wi_read_ap_result, &args);
379 			memcpy(wreq.wi_val, &args.i, sizeof(args.i));
380 			wreq.wi_len = (sizeof(int) +
381 				sizeof(struct wi_apinfo) * args.i) / 2;
382 		} else
383 			error = EINPROGRESS;
384 		break;
385 	case WI_RID_PRISM2:
386 		/* NB: we lie so WI_RID_SCAN_RES can include rates */
387 		wreq.wi_val[0] = 1;
388 		wreq.wi_len = sizeof(u_int16_t) / 2;
389 		break;
390 	case WI_RID_SCAN_RES:			/* compatibility interface */
391 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
392 			struct wi_read_prism2_args args;
393 			struct wi_scan_p2_hdr *p2;
394 
395 			/* NB: use Prism2 format so we can include rate info */
396 			p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
397 			args.i = 0;
398 			args.res = (void *)&p2[1];
399 			args.max = (void *)(&wreq + 1);
400 			ieee80211_iterate_nodes(&ic->ic_scan,
401 				wi_read_prism2_result, &args);
402 			p2->wi_rsvd = 0;
403 			p2->wi_reason = args.i;
404 			wreq.wi_len = (sizeof(*p2) +
405 				sizeof(struct wi_scan_res) * args.i) / 2;
406 		} else
407 			error = EINPROGRESS;
408 		break;
409 	case WI_RID_READ_CACHE: {
410 		struct wi_read_sigcache_args args;
411 		args.i = 0;
412 		args.wsc = (struct wi_sigcache *) wreq.wi_val;
413 		args.max = (void *)(&wreq + 1);
414 		ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
415 		wreq.wi_len = sizeof(struct wi_sigcache) * args.i / 2;
416 		break;
417 	}
418 	default:
419 		error = EINVAL;
420 		break;
421 	}
422 	if (error == 0) {
423 		wreq.wi_len++;
424 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
425 	}
426 	return error;
427 }
428 
429 static int
430 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
431 {
432 #define	IEEERATE(_ic,_m,_i) \
433 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
434 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
435 	for (i = 0; i < nrates; i++)
436 		if (IEEERATE(ic, mode, i) == rate)
437 			return i;
438 	return -1;
439 #undef IEEERATE
440 }
441 
442 /*
443  * Prepare to do a user-initiated scan for AP's.  If no
444  * current/default channel is setup or the current channel
445  * is invalid then pick the first available channel from
446  * the active list as the place to start the scan.
447  */
448 static int
449 ieee80211_setupscan(struct ieee80211com *ic, const u_int8_t chanlist[])
450 {
451 
452 	/*
453 	 * XXX don't permit a scan to be started unless we
454 	 * know the device is ready.  For the moment this means
455 	 * the device is marked up as this is the required to
456 	 * initialize the hardware.  It would be better to permit
457 	 * scanning prior to being up but that'll require some
458 	 * changes to the infrastructure.
459 	 */
460 	if (!IS_UP(ic))
461 		return EINVAL;
462 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
463 	/*
464 	 * We force the state to INIT before calling ieee80211_new_state
465 	 * to get ieee80211_begin_scan called.  We really want to scan w/o
466 	 * altering the current state but that's not possible right now.
467 	 */
468 	/* XXX handle proberequest case */
469 	ic->ic_state = IEEE80211_S_INIT;	/* XXX bypass state machine */
470 	return 0;
471 }
472 
473 int
474 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, caddr_t data)
475 {
476 	struct ifnet *ifp = ic->ic_ifp;
477 	int i, j, len, error, rate;
478 	struct ifreq *ifr = (struct ifreq *)data;
479 	struct wi_ltv_keys *keys;
480 	struct wi_req wreq;
481 	u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
482 
483 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
484 	if (error)
485 		return error;
486 	len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
487 	switch (wreq.wi_type) {
488 	case WI_RID_SERIALNO:
489 	case WI_RID_NODENAME:
490 		return EPERM;
491 	case WI_RID_CURRENT_SSID:
492 		return EPERM;
493 	case WI_RID_OWN_SSID:
494 	case WI_RID_DESIRED_SSID:
495 		if (le16toh(wreq.wi_val[0]) * 2 > len ||
496 		    le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
497 			error = ENOSPC;
498 			break;
499 		}
500 		memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
501 		ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
502 		memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
503 		error = ENETRESET;
504 		break;
505 	case WI_RID_CURRENT_BSSID:
506 		return EPERM;
507 	case WI_RID_OWN_CHNL:
508 		if (len != 2)
509 			return EINVAL;
510 		i = le16toh(wreq.wi_val[0]);
511 		if (i < 0 ||
512 		    i > IEEE80211_CHAN_MAX ||
513 		    isclr(ic->ic_chan_active, i))
514 			return EINVAL;
515 		ic->ic_ibss_chan = &ic->ic_channels[i];
516 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
517 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
518 		else
519 			error = ENETRESET;
520 		break;
521 	case WI_RID_CURRENT_CHAN:
522 		return EPERM;
523 	case WI_RID_COMMS_QUALITY:
524 		return EPERM;
525 	case WI_RID_PROMISC:
526 		if (len != 2)
527 			return EINVAL;
528 		if (ifp->if_flags & IFF_PROMISC) {
529 			if (wreq.wi_val[0] == 0) {
530 				ifp->if_flags &= ~IFF_PROMISC;
531 				error = ENETRESET;
532 			}
533 		} else {
534 			if (wreq.wi_val[0] != 0) {
535 				ifp->if_flags |= IFF_PROMISC;
536 				error = ENETRESET;
537 			}
538 		}
539 		break;
540 	case WI_RID_PORTTYPE:
541 		if (len != 2)
542 			return EINVAL;
543 		switch (le16toh(wreq.wi_val[0])) {
544 		case IEEE80211_M_STA:
545 			break;
546 		case IEEE80211_M_IBSS:
547 			if (!(ic->ic_caps & IEEE80211_C_IBSS))
548 				return EINVAL;
549 			break;
550 		case IEEE80211_M_AHDEMO:
551 			if (ic->ic_phytype != IEEE80211_T_DS ||
552 			    !(ic->ic_caps & IEEE80211_C_AHDEMO))
553 				return EINVAL;
554 			break;
555 		case IEEE80211_M_HOSTAP:
556 			if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
557 				return EINVAL;
558 			break;
559 		default:
560 			return EINVAL;
561 		}
562 		if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
563 			ic->ic_opmode = le16toh(wreq.wi_val[0]);
564 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
565 		}
566 		break;
567 #if 0
568 	case WI_RID_MAC_NODE:
569 		if (len != IEEE80211_ADDR_LEN)
570 			return EINVAL;
571 		IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
572 		/* if_init will copy lladdr into ic_myaddr */
573 		error = ENETRESET;
574 		break;
575 #endif
576 	case WI_RID_TX_RATE:
577 		if (len != 2)
578 			return EINVAL;
579 		if (wreq.wi_val[0] == 0) {
580 			/* auto */
581 			ic->ic_fixed_rate = IEEE80211_FIXED_RATE_NONE;
582 			break;
583 		}
584 		rate = 2 * le16toh(wreq.wi_val[0]);
585 		if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
586 			/*
587 			 * In autoselect mode search for the rate.  We take
588 			 * the first instance which may not be right, but we
589 			 * are limited by the interface.  Note that we also
590 			 * lock the mode to insure the rate is meaningful
591 			 * when it is used.
592 			 */
593 			for (j = IEEE80211_MODE_11A;
594 			     j < IEEE80211_MODE_MAX; j++) {
595 				if ((ic->ic_modecaps & (1<<j)) == 0)
596 					continue;
597 				i = findrate(ic, j, rate);
598 				if (i != -1) {
599 					/* lock mode too */
600 					ic->ic_curmode = j;
601 					goto setrate;
602 				}
603 			}
604 		} else {
605 			i = findrate(ic, ic->ic_curmode, rate);
606 			if (i != -1)
607 				goto setrate;
608 		}
609 		return EINVAL;
610 	setrate:
611 		ic->ic_fixed_rate = i;
612 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
613 		break;
614 	case WI_RID_CUR_TX_RATE:
615 		return EPERM;
616 	case WI_RID_RTS_THRESH:
617 		if (len != 2)
618 			return EINVAL;
619 		if (le16toh(wreq.wi_val[0]) != IEEE80211_MAX_LEN)
620 			return EINVAL;		/* TODO: RTS */
621 		break;
622 	case WI_RID_CREATE_IBSS:
623 		if (len != 2)
624 			return EINVAL;
625 		if (wreq.wi_val[0] != 0) {
626 			if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
627 				return EINVAL;
628 			if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
629 				ic->ic_flags |= IEEE80211_F_IBSSON;
630 				if (ic->ic_opmode == IEEE80211_M_IBSS &&
631 				    ic->ic_state == IEEE80211_S_SCAN)
632 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
633 			}
634 		} else {
635 			if (ic->ic_flags & IEEE80211_F_IBSSON) {
636 				ic->ic_flags &= ~IEEE80211_F_IBSSON;
637 				if (ic->ic_flags & IEEE80211_F_SIBSS) {
638 					ic->ic_flags &= ~IEEE80211_F_SIBSS;
639 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
640 				}
641 			}
642 		}
643 		break;
644 	case WI_RID_MICROWAVE_OVEN:
645 		if (len != 2)
646 			return EINVAL;
647 		if (wreq.wi_val[0] != 0)
648 			return EINVAL;		/* not supported */
649 		break;
650 	case WI_RID_ROAMING_MODE:
651 		if (len != 2)
652 			return EINVAL;
653 		i = le16toh(wreq.wi_val[0]);
654 		if (i > IEEE80211_ROAMING_MANUAL)
655 			return EINVAL;		/* not supported */
656 		ic->ic_roaming = i;
657 		break;
658 	case WI_RID_SYSTEM_SCALE:
659 		if (len != 2)
660 			return EINVAL;
661 		if (le16toh(wreq.wi_val[0]) != 1)
662 			return EINVAL;		/* not supported */
663 		break;
664 	case WI_RID_PM_ENABLED:
665 		if (len != 2)
666 			return EINVAL;
667 		if (wreq.wi_val[0] != 0) {
668 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
669 				return EINVAL;
670 			if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
671 				ic->ic_flags |= IEEE80211_F_PMGTON;
672 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
673 			}
674 		} else {
675 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
676 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
677 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
678 			}
679 		}
680 		break;
681 	case WI_RID_MAX_SLEEP:
682 		if (len != 2)
683 			return EINVAL;
684 		ic->ic_lintval = le16toh(wreq.wi_val[0]);
685 		if (ic->ic_flags & IEEE80211_F_PMGTON)
686 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
687 		break;
688 	case WI_RID_CUR_BEACON_INT:
689 		return EPERM;
690 	case WI_RID_WEP_AVAIL:
691 		return EPERM;
692 	case WI_RID_CNFAUTHMODE:
693 		if (len != 2)
694 			return EINVAL;
695 		i = le16toh(wreq.wi_val[0]);
696 		if (i > IEEE80211_AUTH_WPA)
697 			return EINVAL;
698 		ic->ic_bss->ni_authmode = i;		/* XXX ENETRESET? */
699 		error = ENETRESET;
700 		break;
701 	case WI_RID_ENCRYPTION:
702 		if (len != 2)
703 			return EINVAL;
704 		if (wreq.wi_val[0] != 0) {
705 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
706 				return EINVAL;
707 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
708 				ic->ic_flags |= IEEE80211_F_PRIVACY;
709 				error = ENETRESET;
710 			}
711 		} else {
712 			if (ic->ic_flags & IEEE80211_F_PRIVACY) {
713 				ic->ic_flags &= ~IEEE80211_F_PRIVACY;
714 				error = ENETRESET;
715 			}
716 		}
717 		break;
718 	case WI_RID_TX_CRYPT_KEY:
719 		if (len != 2)
720 			return EINVAL;
721 		i = le16toh(wreq.wi_val[0]);
722 		if (i >= IEEE80211_WEP_NKID)
723 			return EINVAL;
724 		ic->ic_def_txkey = i;
725 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
726 		break;
727 	case WI_RID_DEFLT_CRYPT_KEYS:
728 		if (len != sizeof(struct wi_ltv_keys))
729 			return EINVAL;
730 		keys = (struct wi_ltv_keys *)&wreq;
731 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
732 			len = le16toh(keys->wi_keys[i].wi_keylen);
733 			if (len != 0 && len < IEEE80211_WEP_KEYLEN)
734 				return EINVAL;
735 			if (len > IEEE80211_KEYBUF_SIZE)
736 				return EINVAL;
737 		}
738 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
739 			struct ieee80211_key *k = &ic->ic_nw_keys[i];
740 
741 			len = le16toh(keys->wi_keys[i].wi_keylen);
742 			k->wk_keylen = len;
743 			k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
744 			memset(k->wk_key, 0, sizeof(k->wk_key));
745 			memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
746 #if 0
747 			k->wk_type = IEEE80211_CIPHER_WEP;
748 #endif
749 		}
750 		error = ENETRESET;
751 		break;
752 	case WI_RID_MAX_DATALEN:
753 		if (len != 2)
754 			return EINVAL;
755 		len = le16toh(wreq.wi_val[0]);
756 		if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
757 			return EINVAL;
758 		ic->ic_fragthreshold = len;
759 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
760 		break;
761 	case WI_RID_IFACE_STATS:
762 		error = EPERM;
763 		break;
764 	case WI_RID_SCAN_REQ:			/* XXX wicontrol */
765 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
766 			break;
767 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
768 		if (error == 0)
769 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
770 		break;
771 	case WI_RID_SCAN_APS:
772 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
773 			break;
774 		len--;			/* XXX: tx rate? */
775 		/* FALLTHRU */
776 	case WI_RID_CHANNEL_LIST:
777 		memset(chanlist, 0, sizeof(chanlist));
778 		/*
779 		 * Since channel 0 is not available for DS, channel 1
780 		 * is assigned to LSB on WaveLAN.
781 		 */
782 		if (ic->ic_phytype == IEEE80211_T_DS)
783 			i = 1;
784 		else
785 			i = 0;
786 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
787 			if ((j / 8) >= len)
788 				break;
789 			if (isclr((u_int8_t *)wreq.wi_val, j))
790 				continue;
791 			if (isclr(ic->ic_chan_active, i)) {
792 				if (wreq.wi_type != WI_RID_CHANNEL_LIST)
793 					continue;
794 				if (isclr(ic->ic_chan_avail, i))
795 					return EPERM;
796 			}
797 			setbit(chanlist, i);
798 		}
799 		error = ieee80211_setupscan(ic, chanlist);
800 		if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
801 			/* NB: ignore error from ieee80211_setupscan */
802 			error = ENETRESET;
803 		} else if (error == 0)
804 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
805 		break;
806 	default:
807 		error = EINVAL;
808 		break;
809 	}
810 	if (error == ENETRESET && !IS_UP_AUTO(ic))
811 		error = 0;
812 	return error;
813 }
814 
815 static int
816 cap2cipher(int flag)
817 {
818 	switch (flag) {
819 	case IEEE80211_C_WEP:		return IEEE80211_CIPHER_WEP;
820 	case IEEE80211_C_AES:		return IEEE80211_CIPHER_AES_OCB;
821 	case IEEE80211_C_AES_CCM:	return IEEE80211_CIPHER_AES_CCM;
822 	case IEEE80211_C_CKIP:		return IEEE80211_CIPHER_CKIP;
823 	case IEEE80211_C_TKIP:		return IEEE80211_CIPHER_TKIP;
824 	}
825 	return -1;
826 }
827 
828 static int
829 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq)
830 {
831 	struct ieee80211_node *ni;
832 	struct ieee80211req_key ik;
833 	struct ieee80211_key *wk;
834 	const struct ieee80211_cipher *cip;
835 	u_int kid;
836 	int error;
837 
838 	if (ireq->i_len != sizeof(ik))
839 		return EINVAL;
840 	error = copyin(ireq->i_data, &ik, sizeof(ik));
841 	if (error)
842 		return error;
843 	kid = ik.ik_keyix;
844 	if (kid == IEEE80211_KEYIX_NONE) {
845 		ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
846 		if (ni == NULL)
847 			return EINVAL;		/* XXX */
848 		wk = &ni->ni_ucastkey;
849 	} else {
850 		if (kid >= IEEE80211_WEP_NKID)
851 			return EINVAL;
852 		wk = &ic->ic_nw_keys[kid];
853 		IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
854 		ni = NULL;
855 	}
856 	cip = wk->wk_cipher;
857 	ik.ik_type = cip->ic_cipher;
858 	ik.ik_keylen = wk->wk_keylen;
859 	ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
860 	if (wk->wk_keyix == ic->ic_def_txkey)
861 		ik.ik_flags |= IEEE80211_KEY_DEFAULT;
862 	if (suser(curthread) == 0) {
863 		/* NB: only root can read key data */
864 		ik.ik_keyrsc = wk->wk_keyrsc;
865 		ik.ik_keytsc = wk->wk_keytsc;
866 		memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
867 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
868 			memcpy(ik.ik_keydata+wk->wk_keylen,
869 				wk->wk_key + IEEE80211_KEYBUF_SIZE,
870 				IEEE80211_MICBUF_SIZE);
871 			ik.ik_keylen += IEEE80211_MICBUF_SIZE;
872 		}
873 	} else {
874 		ik.ik_keyrsc = 0;
875 		ik.ik_keytsc = 0;
876 		memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
877 	}
878 	if (ni != NULL)
879 		ieee80211_free_node(ni);
880 	return copyout(&ik, ireq->i_data, sizeof(ik));
881 }
882 
883 static int
884 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
885 {
886 
887 	if (sizeof(ic->ic_chan_active) < ireq->i_len)
888 		ireq->i_len = sizeof(ic->ic_chan_active);
889 	return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
890 }
891 
892 static int
893 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
894 {
895 	struct ieee80211req_chaninfo chans;	/* XXX off stack? */
896 	int i, space;
897 
898 	/*
899 	 * Since channel 0 is not available for DS, channel 1
900 	 * is assigned to LSB on WaveLAN.
901 	 */
902 	if (ic->ic_phytype == IEEE80211_T_DS)
903 		i = 1;
904 	else
905 		i = 0;
906 	memset(&chans, 0, sizeof(chans));
907 	for (; i <= IEEE80211_CHAN_MAX; i++)
908 		if (isset(ic->ic_chan_avail, i)) {
909 			struct ieee80211_channel *c = &ic->ic_channels[i];
910 			chans.ic_chans[chans.ic_nchans].ic_freq = c->ic_freq;
911 			chans.ic_chans[chans.ic_nchans].ic_flags = c->ic_flags;
912 			chans.ic_nchans++;
913 		}
914 	space = __offsetof(struct ieee80211req_chaninfo,
915 			ic_chans[chans.ic_nchans]);
916 	if (space > ireq->i_len)
917 		space = ireq->i_len;
918 	return copyout(&chans, ireq->i_data, space);
919 }
920 
921 static int
922 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
923 {
924 	struct ieee80211_node *ni;
925 	struct ieee80211req_wpaie wpaie;
926 	int error;
927 
928 	if (ireq->i_len < IEEE80211_ADDR_LEN)
929 		return EINVAL;
930 	error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
931 	if (error != 0)
932 		return error;
933 	ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
934 	if (ni == NULL)
935 		return EINVAL;		/* XXX */
936 	memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
937 	if (ni->ni_wpa_ie != NULL) {
938 		int ielen = ni->ni_wpa_ie[1] + 2;
939 		if (ielen > sizeof(wpaie.wpa_ie))
940 			ielen = sizeof(wpaie.wpa_ie);
941 		memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
942 	}
943 	ieee80211_free_node(ni);
944 	if (ireq->i_len > sizeof(wpaie))
945 		ireq->i_len = sizeof(wpaie);
946 	return copyout(&wpaie, ireq->i_data, ireq->i_len);
947 }
948 
949 static int
950 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
951 {
952 	struct ieee80211_node *ni;
953 	u_int8_t macaddr[IEEE80211_ADDR_LEN];
954 	const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
955 	int error;
956 
957 	if (ireq->i_len < off)
958 		return EINVAL;
959 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
960 	if (error != 0)
961 		return error;
962 	ni = ieee80211_find_node(&ic->ic_sta, macaddr);
963 	if (ni == NULL)
964 		return EINVAL;		/* XXX */
965 	if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
966 		ireq->i_len = sizeof(struct ieee80211req_sta_stats);
967 	/* NB: copy out only the statistics */
968 	error = copyout(&ni->ni_stats, (u_int8_t *) ireq->i_data + off,
969 			ireq->i_len - off);
970 	ieee80211_free_node(ni);
971 	return error;
972 }
973 
974 static void
975 get_scan_result(struct ieee80211req_scan_result *sr,
976 	const struct ieee80211_node *ni)
977 {
978 	struct ieee80211com *ic = ni->ni_ic;
979 
980 	memset(sr, 0, sizeof(*sr));
981 	sr->isr_ssid_len = ni->ni_esslen;
982 	if (ni->ni_wpa_ie != NULL)
983 		sr->isr_ie_len += 2+ni->ni_wpa_ie[1];
984 	if (ni->ni_wme_ie != NULL)
985 		sr->isr_ie_len += 2+ni->ni_wme_ie[1];
986 	sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
987 	sr->isr_len = roundup(sr->isr_len, sizeof(u_int32_t));
988 	if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
989 		sr->isr_freq = ni->ni_chan->ic_freq;
990 		sr->isr_flags = ni->ni_chan->ic_flags;
991 	}
992 	sr->isr_rssi = ic->ic_node_getrssi(ni);
993 	sr->isr_intval = ni->ni_intval;
994 	sr->isr_capinfo = ni->ni_capinfo;
995 	sr->isr_erp = ni->ni_erp;
996 	IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
997 	sr->isr_nrates = ni->ni_rates.rs_nrates;
998 	if (sr->isr_nrates > 15)
999 		sr->isr_nrates = 15;
1000 	memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
1001 }
1002 
1003 static int
1004 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
1005 {
1006 	union {
1007 		struct ieee80211req_scan_result res;
1008 		char data[512];		/* XXX shrink? */
1009 	} u;
1010 	struct ieee80211req_scan_result *sr = &u.res;
1011 	struct ieee80211_node_table *nt;
1012 	struct ieee80211_node *ni;
1013 	int error, space;
1014 	u_int8_t *p, *cp;
1015 
1016 	p = ireq->i_data;
1017 	space = ireq->i_len;
1018 	error = 0;
1019 	/* XXX locking */
1020 	nt =  &ic->ic_scan;
1021 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1022 		/* NB: skip pre-scan node state */
1023 		if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1024 			continue;
1025 		get_scan_result(sr, ni);
1026 		if (sr->isr_len > sizeof(u))
1027 			continue;		/* XXX */
1028 		if (space < sr->isr_len)
1029 			break;
1030 		cp = (u_int8_t *)(sr+1);
1031 		memcpy(cp, ni->ni_essid, ni->ni_esslen);
1032 		cp += ni->ni_esslen;
1033 		if (ni->ni_wpa_ie != NULL) {
1034 			memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1035 			cp += 2+ni->ni_wpa_ie[1];
1036 		}
1037 		if (ni->ni_wme_ie != NULL) {
1038 			memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1039 			cp += 2+ni->ni_wme_ie[1];
1040 		}
1041 		error = copyout(sr, p, sr->isr_len);
1042 		if (error)
1043 			break;
1044 		p += sr->isr_len;
1045 		space -= sr->isr_len;
1046 	}
1047 	ireq->i_len -= space;
1048 	return error;
1049 }
1050 
1051 struct stainforeq {
1052 	struct ieee80211com *ic;
1053 	struct ieee80211req_sta_info *si;
1054 	size_t	space;
1055 };
1056 
1057 static size_t
1058 sta_space(const struct ieee80211_node *ni, size_t *ielen)
1059 {
1060 	*ielen = 0;
1061 	if (ni->ni_wpa_ie != NULL)
1062 		*ielen += 2+ni->ni_wpa_ie[1];
1063 	if (ni->ni_wme_ie != NULL)
1064 		*ielen += 2+ni->ni_wme_ie[1];
1065 	return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
1066 		      sizeof(u_int32_t));
1067 }
1068 
1069 static void
1070 get_sta_space(void *arg, struct ieee80211_node *ni)
1071 {
1072 	struct stainforeq *req = arg;
1073 	struct ieee80211com *ic = ni->ni_ic;
1074 	size_t ielen;
1075 
1076 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1077 	    ni->ni_associd == 0)	/* only associated stations */
1078 		return;
1079 	req->space += sta_space(ni, &ielen);
1080 }
1081 
1082 static void
1083 get_sta_info(void *arg, struct ieee80211_node *ni)
1084 {
1085 	struct stainforeq *req = arg;
1086 	struct ieee80211com *ic = ni->ni_ic;
1087 	struct ieee80211req_sta_info *si;
1088 	size_t ielen, len;
1089 	u_int8_t *cp;
1090 
1091 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1092 	    ni->ni_associd == 0)	/* only associated stations */
1093 		return;
1094 	if (ni->ni_chan == IEEE80211_CHAN_ANYC)	/* XXX bogus entry */
1095 		return;
1096 	len = sta_space(ni, &ielen);
1097 	if (len > req->space)
1098 		return;
1099 	si = req->si;
1100 	si->isi_len = len;
1101 	si->isi_ie_len = ielen;
1102 	si->isi_freq = ni->ni_chan->ic_freq;
1103 	si->isi_flags = ni->ni_chan->ic_flags;
1104 	si->isi_state = ni->ni_flags;
1105 	si->isi_authmode = ni->ni_authmode;
1106 	si->isi_rssi = ic->ic_node_getrssi(ni);
1107 	si->isi_capinfo = ni->ni_capinfo;
1108 	si->isi_erp = ni->ni_erp;
1109 	IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
1110 	si->isi_nrates = ni->ni_rates.rs_nrates;
1111 	if (si->isi_nrates > 15)
1112 		si->isi_nrates = 15;
1113 	memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
1114 	si->isi_txrate = ni->ni_txrate;
1115 	si->isi_associd = ni->ni_associd;
1116 	si->isi_txpower = ni->ni_txpower;
1117 	si->isi_vlan = ni->ni_vlan;
1118 	if (ni->ni_flags & IEEE80211_NODE_QOS) {
1119 		memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
1120 		memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
1121 	} else {
1122 		si->isi_txseqs[0] = ni->ni_txseqs[0];
1123 		si->isi_rxseqs[0] = ni->ni_rxseqs[0];
1124 	}
1125 	/* NB: leave all cases in case we relax ni_associd == 0 check */
1126 	if (ieee80211_node_is_authorized(ni))
1127 		si->isi_inact = ic->ic_inact_run;
1128 	else if (ni->ni_associd != 0)
1129 		si->isi_inact = ic->ic_inact_auth;
1130 	else
1131 		si->isi_inact = ic->ic_inact_init;
1132 	si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
1133 
1134 	cp = (u_int8_t *)(si+1);
1135 	if (ni->ni_wpa_ie != NULL) {
1136 		memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1137 		cp += 2+ni->ni_wpa_ie[1];
1138 	}
1139 	if (ni->ni_wme_ie != NULL) {
1140 		memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1141 		cp += 2+ni->ni_wme_ie[1];
1142 	}
1143 
1144 	req->si = (struct ieee80211req_sta_info *)(((u_int8_t *)si) + len);
1145 	req->space -= len;
1146 }
1147 
1148 static int
1149 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
1150 {
1151 	struct stainforeq req;
1152 	int error;
1153 
1154 	if (ireq->i_len < sizeof(struct stainforeq))
1155 		return EFAULT;
1156 
1157 	error = 0;
1158 	req.space = 0;
1159 	ieee80211_iterate_nodes(&ic->ic_sta, get_sta_space, &req);
1160 	if (req.space > ireq->i_len)
1161 		req.space = ireq->i_len;
1162 	if (req.space > 0) {
1163 		size_t space;
1164 		void *p;
1165 
1166 		space = req.space;
1167 		/* XXX M_WAITOK after driver lock released */
1168 		MALLOC(p, void *, space, M_TEMP, M_NOWAIT);
1169 		if (p == NULL)
1170 			return ENOMEM;
1171 		req.si = p;
1172 		ieee80211_iterate_nodes(&ic->ic_sta, get_sta_info, &req);
1173 		ireq->i_len = space - req.space;
1174 		error = copyout(p, ireq->i_data, ireq->i_len);
1175 		FREE(p, M_TEMP);
1176 	} else
1177 		ireq->i_len = 0;
1178 
1179 	return error;
1180 }
1181 
1182 static int
1183 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1184 {
1185 	struct ieee80211_node *ni;
1186 	struct ieee80211req_sta_txpow txpow;
1187 	int error;
1188 
1189 	if (ireq->i_len != sizeof(txpow))
1190 		return EINVAL;
1191 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1192 	if (error != 0)
1193 		return error;
1194 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1195 	if (ni == NULL)
1196 		return EINVAL;		/* XXX */
1197 	txpow.it_txpow = ni->ni_txpower;
1198 	error = copyout(&txpow, ireq->i_data, sizeof(txpow));
1199 	ieee80211_free_node(ni);
1200 	return error;
1201 }
1202 
1203 static int
1204 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1205 {
1206 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1207 	struct wmeParams *wmep;
1208 	int ac;
1209 
1210 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1211 		return EINVAL;
1212 
1213 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1214 	if (ac >= WME_NUM_AC)
1215 		ac = WME_AC_BE;
1216 	if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
1217 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1218 	else
1219 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1220 	switch (ireq->i_type) {
1221 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1222 		ireq->i_val = wmep->wmep_logcwmin;
1223 		break;
1224 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1225 		ireq->i_val = wmep->wmep_logcwmax;
1226 		break;
1227 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1228 		ireq->i_val = wmep->wmep_aifsn;
1229 		break;
1230 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1231 		ireq->i_val = wmep->wmep_txopLimit;
1232 		break;
1233 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1234 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1235 		ireq->i_val = wmep->wmep_acm;
1236 		break;
1237 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1238 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1239 		ireq->i_val = !wmep->wmep_noackPolicy;
1240 		break;
1241 	}
1242 	return 0;
1243 }
1244 
1245 static int
1246 ieee80211_ioctl_getmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1247 {
1248 	const struct ieee80211_aclator *acl = ic->ic_acl;
1249 
1250 	return (acl == NULL ? EINVAL : acl->iac_getioctl(ic, ireq));
1251 }
1252 
1253 /*
1254  * When building the kernel with -O2 on the i386 architecture, gcc
1255  * seems to want to inline this function into ieee80211_ioctl()
1256  * (which is the only routine that calls it). When this happens,
1257  * ieee80211_ioctl() ends up consuming an additional 2K of stack
1258  * space. (Exactly why it needs so much is unclear.) The problem
1259  * is that it's possible for ieee80211_ioctl() to invoke other
1260  * routines (including driver init functions) which could then find
1261  * themselves perilously close to exhausting the stack.
1262  *
1263  * To avoid this, we deliberately prevent gcc from inlining this
1264  * routine. Another way to avoid this is to use less agressive
1265  * optimization when compiling this file (i.e. -O instead of -O2)
1266  * but special-casing the compilation of this one module in the
1267  * build system would be awkward.
1268  */
1269 #ifdef __GNUC__
1270 __attribute__ ((noinline))
1271 #endif
1272 static int
1273 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1274 {
1275 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1276 	int error = 0;
1277 	u_int kid, len, m;
1278 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1279 	char tmpssid[IEEE80211_NWID_LEN];
1280 
1281 	switch (ireq->i_type) {
1282 	case IEEE80211_IOC_SSID:
1283 		switch (ic->ic_state) {
1284 		case IEEE80211_S_INIT:
1285 		case IEEE80211_S_SCAN:
1286 			ireq->i_len = ic->ic_des_esslen;
1287 			memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
1288 			break;
1289 		default:
1290 			ireq->i_len = ic->ic_bss->ni_esslen;
1291 			memcpy(tmpssid, ic->ic_bss->ni_essid,
1292 				ireq->i_len);
1293 			break;
1294 		}
1295 		error = copyout(tmpssid, ireq->i_data, ireq->i_len);
1296 		break;
1297 	case IEEE80211_IOC_NUMSSIDS:
1298 		ireq->i_val = 1;
1299 		break;
1300 	case IEEE80211_IOC_WEP:
1301 		if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
1302 			ireq->i_val = IEEE80211_WEP_OFF;
1303 		else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
1304 			ireq->i_val = IEEE80211_WEP_ON;
1305 		else
1306 			ireq->i_val = IEEE80211_WEP_MIXED;
1307 		break;
1308 	case IEEE80211_IOC_WEPKEY:
1309 		kid = (u_int) ireq->i_val;
1310 		if (kid >= IEEE80211_WEP_NKID)
1311 			return EINVAL;
1312 		len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
1313 		/* NB: only root can read WEP keys */
1314 		if (suser(curthread) == 0) {
1315 			bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
1316 		} else {
1317 			bzero(tmpkey, len);
1318 		}
1319 		ireq->i_len = len;
1320 		error = copyout(tmpkey, ireq->i_data, len);
1321 		break;
1322 	case IEEE80211_IOC_NUMWEPKEYS:
1323 		ireq->i_val = IEEE80211_WEP_NKID;
1324 		break;
1325 	case IEEE80211_IOC_WEPTXKEY:
1326 		ireq->i_val = ic->ic_def_txkey;
1327 		break;
1328 	case IEEE80211_IOC_AUTHMODE:
1329 		if (ic->ic_flags & IEEE80211_F_WPA)
1330 			ireq->i_val = IEEE80211_AUTH_WPA;
1331 		else
1332 			ireq->i_val = ic->ic_bss->ni_authmode;
1333 		break;
1334 	case IEEE80211_IOC_CHANNEL:
1335 		ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
1336 		break;
1337 	case IEEE80211_IOC_POWERSAVE:
1338 		if (ic->ic_flags & IEEE80211_F_PMGTON)
1339 			ireq->i_val = IEEE80211_POWERSAVE_ON;
1340 		else
1341 			ireq->i_val = IEEE80211_POWERSAVE_OFF;
1342 		break;
1343 	case IEEE80211_IOC_POWERSAVESLEEP:
1344 		ireq->i_val = ic->ic_lintval;
1345 		break;
1346 	case IEEE80211_IOC_RTSTHRESHOLD:
1347 		ireq->i_val = ic->ic_rtsthreshold;
1348 		break;
1349 	case IEEE80211_IOC_PROTMODE:
1350 		ireq->i_val = ic->ic_protmode;
1351 		break;
1352 	case IEEE80211_IOC_TXPOWER:
1353 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
1354 			return EINVAL;
1355 		ireq->i_val = ic->ic_txpowlimit;
1356 		break;
1357 	case IEEE80211_IOC_MCASTCIPHER:
1358 		ireq->i_val = rsn->rsn_mcastcipher;
1359 		break;
1360 	case IEEE80211_IOC_MCASTKEYLEN:
1361 		ireq->i_val = rsn->rsn_mcastkeylen;
1362 		break;
1363 	case IEEE80211_IOC_UCASTCIPHERS:
1364 		ireq->i_val = 0;
1365 		for (m = 0x1; m != 0; m <<= 1)
1366 			if (rsn->rsn_ucastcipherset & m)
1367 				ireq->i_val |= 1<<cap2cipher(m);
1368 		break;
1369 	case IEEE80211_IOC_UCASTCIPHER:
1370 		ireq->i_val = rsn->rsn_ucastcipher;
1371 		break;
1372 	case IEEE80211_IOC_UCASTKEYLEN:
1373 		ireq->i_val = rsn->rsn_ucastkeylen;
1374 		break;
1375 	case IEEE80211_IOC_KEYMGTALGS:
1376 		ireq->i_val = rsn->rsn_keymgmtset;
1377 		break;
1378 	case IEEE80211_IOC_RSNCAPS:
1379 		ireq->i_val = rsn->rsn_caps;
1380 		break;
1381 	case IEEE80211_IOC_WPA:
1382 		switch (ic->ic_flags & IEEE80211_F_WPA) {
1383 		case IEEE80211_F_WPA1:
1384 			ireq->i_val = 1;
1385 			break;
1386 		case IEEE80211_F_WPA2:
1387 			ireq->i_val = 2;
1388 			break;
1389 		case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
1390 			ireq->i_val = 3;
1391 			break;
1392 		default:
1393 			ireq->i_val = 0;
1394 			break;
1395 		}
1396 		break;
1397 	case IEEE80211_IOC_CHANLIST:
1398 		error = ieee80211_ioctl_getchanlist(ic, ireq);
1399 		break;
1400 	case IEEE80211_IOC_ROAMING:
1401 		ireq->i_val = ic->ic_roaming;
1402 		break;
1403 	case IEEE80211_IOC_PRIVACY:
1404 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
1405 		break;
1406 	case IEEE80211_IOC_DROPUNENCRYPTED:
1407 		ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
1408 		break;
1409 	case IEEE80211_IOC_COUNTERMEASURES:
1410 		ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
1411 		break;
1412 	case IEEE80211_IOC_DRIVER_CAPS:
1413 		ireq->i_val = ic->ic_caps>>16;
1414 		ireq->i_len = ic->ic_caps&0xffff;
1415 		break;
1416 	case IEEE80211_IOC_WME:
1417 		ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
1418 		break;
1419 	case IEEE80211_IOC_HIDESSID:
1420 		ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
1421 		break;
1422 	case IEEE80211_IOC_APBRIDGE:
1423 		ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
1424 		break;
1425 	case IEEE80211_IOC_OPTIE:
1426 		if (ic->ic_opt_ie == NULL)
1427 			return EINVAL;
1428 		/* NB: truncate, caller can check length */
1429 		if (ireq->i_len > ic->ic_opt_ie_len)
1430 			ireq->i_len = ic->ic_opt_ie_len;
1431 		error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
1432 		break;
1433 	case IEEE80211_IOC_WPAKEY:
1434 		error = ieee80211_ioctl_getkey(ic, ireq);
1435 		break;
1436 	case IEEE80211_IOC_CHANINFO:
1437 		error = ieee80211_ioctl_getchaninfo(ic, ireq);
1438 		break;
1439 	case IEEE80211_IOC_BSSID:
1440 		if (ireq->i_len != IEEE80211_ADDR_LEN)
1441 			return EINVAL;
1442 		error = copyout(ic->ic_state == IEEE80211_S_RUN ?
1443 					ic->ic_bss->ni_bssid :
1444 					ic->ic_des_bssid,
1445 				ireq->i_data, ireq->i_len);
1446 		break;
1447 	case IEEE80211_IOC_WPAIE:
1448 		error = ieee80211_ioctl_getwpaie(ic, ireq);
1449 		break;
1450 	case IEEE80211_IOC_SCAN_RESULTS:
1451 		error = ieee80211_ioctl_getscanresults(ic, ireq);
1452 		break;
1453 	case IEEE80211_IOC_STA_STATS:
1454 		error = ieee80211_ioctl_getstastats(ic, ireq);
1455 		break;
1456 	case IEEE80211_IOC_TXPOWMAX:
1457 		ireq->i_val = ic->ic_bss->ni_txpower;
1458 		break;
1459 	case IEEE80211_IOC_STA_TXPOW:
1460 		error = ieee80211_ioctl_getstatxpow(ic, ireq);
1461 		break;
1462 	case IEEE80211_IOC_STA_INFO:
1463 		error = ieee80211_ioctl_getstainfo(ic, ireq);
1464 		break;
1465 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1466 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1467 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1468 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1469 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1470 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
1471 		error = ieee80211_ioctl_getwmeparam(ic, ireq);
1472 		break;
1473 	case IEEE80211_IOC_DTIM_PERIOD:
1474 		ireq->i_val = ic->ic_dtim_period;
1475 		break;
1476 	case IEEE80211_IOC_BEACON_INTERVAL:
1477 		/* NB: get from ic_bss for station mode */
1478 		ireq->i_val = ic->ic_bss->ni_intval;
1479 		break;
1480 	case IEEE80211_IOC_PUREG:
1481 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PUREG) != 0;
1482 		break;
1483 	case IEEE80211_IOC_MCAST_RATE:
1484 		ireq->i_val = ic->ic_mcast_rate;
1485 		break;
1486 	case IEEE80211_IOC_FRAGTHRESHOLD:
1487 		ireq->i_val = ic->ic_fragthreshold;
1488 		break;
1489 	case IEEE80211_IOC_MACCMD:
1490 		error = ieee80211_ioctl_getmaccmd(ic, ireq);
1491 		break;
1492 	case IEEE80211_IOC_BURST:
1493 		ireq->i_val = (ic->ic_flags & IEEE80211_F_BURST) != 0;
1494 		break;
1495 	default:
1496 		error = EINVAL;
1497 		break;
1498 	}
1499 	return error;
1500 }
1501 
1502 static int
1503 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
1504 {
1505 	int error;
1506 	void *ie;
1507 
1508 	/*
1509 	 * NB: Doing this for ap operation could be useful (e.g. for
1510 	 *     WPA and/or WME) except that it typically is worthless
1511 	 *     without being able to intervene when processing
1512 	 *     association response frames--so disallow it for now.
1513 	 */
1514 	if (ic->ic_opmode != IEEE80211_M_STA)
1515 		return EINVAL;
1516 	if (ireq->i_len > IEEE80211_MAX_OPT_IE)
1517 		return EINVAL;
1518 	MALLOC(ie, void *, ireq->i_len, M_DEVBUF, M_NOWAIT);
1519 	if (ie == NULL)
1520 		return ENOMEM;
1521 	error = copyin(ireq->i_data, ie, ireq->i_len);
1522 	/* XXX sanity check data? */
1523 	if (ic->ic_opt_ie != NULL)
1524 		FREE(ic->ic_opt_ie, M_DEVBUF);
1525 	ic->ic_opt_ie = ie;
1526 	ic->ic_opt_ie_len = ireq->i_len;
1527 	return 0;
1528 }
1529 
1530 static int
1531 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1532 {
1533 	struct ieee80211req_key ik;
1534 	struct ieee80211_node *ni;
1535 	struct ieee80211_key *wk;
1536 	u_int16_t kid;
1537 	int error;
1538 
1539 	if (ireq->i_len != sizeof(ik))
1540 		return EINVAL;
1541 	error = copyin(ireq->i_data, &ik, sizeof(ik));
1542 	if (error)
1543 		return error;
1544 	/* NB: cipher support is verified by ieee80211_crypt_newkey */
1545 	/* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1546 	if (ik.ik_keylen > sizeof(ik.ik_keydata))
1547 		return E2BIG;
1548 	kid = ik.ik_keyix;
1549 	if (kid == IEEE80211_KEYIX_NONE) {
1550 		/* XXX unicast keys currently must be tx/rx */
1551 		if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1552 			return EINVAL;
1553 		if (ic->ic_opmode == IEEE80211_M_STA) {
1554 			ni = ieee80211_ref_node(ic->ic_bss);
1555 			if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
1556 				ieee80211_free_node(ni);
1557 				return EADDRNOTAVAIL;
1558 			}
1559 		} else {
1560 			ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
1561 			if (ni == NULL)
1562 				return ENOENT;
1563 		}
1564 		wk = &ni->ni_ucastkey;
1565 	} else {
1566 		if (kid >= IEEE80211_WEP_NKID)
1567 			return EINVAL;
1568 		wk = &ic->ic_nw_keys[kid];
1569 		ni = NULL;
1570 	}
1571 	error = 0;
1572 	ieee80211_key_update_begin(ic);
1573 	if (ieee80211_crypto_newkey(ic, ik.ik_type, ik.ik_flags, wk)) {
1574 		wk->wk_keylen = ik.ik_keylen;
1575 		/* NB: MIC presence is implied by cipher type */
1576 		if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1577 			wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1578 		wk->wk_keyrsc = ik.ik_keyrsc;
1579 		wk->wk_keytsc = 0;			/* new key, reset */
1580 		memset(wk->wk_key, 0, sizeof(wk->wk_key));
1581 		memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1582 		if (!ieee80211_crypto_setkey(ic, wk,
1583 		    ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
1584 			error = EIO;
1585 		else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1586 			ic->ic_def_txkey = kid;
1587 	} else
1588 		error = ENXIO;
1589 	ieee80211_key_update_end(ic);
1590 	if (ni != NULL)
1591 		ieee80211_free_node(ni);
1592 	return error;
1593 }
1594 
1595 static int
1596 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1597 {
1598 	struct ieee80211req_del_key dk;
1599 	int kid, error;
1600 
1601 	if (ireq->i_len != sizeof(dk))
1602 		return EINVAL;
1603 	error = copyin(ireq->i_data, &dk, sizeof(dk));
1604 	if (error)
1605 		return error;
1606 	kid = dk.idk_keyix;
1607 	/* XXX u_int8_t -> u_int16_t */
1608 	if (dk.idk_keyix == (u_int8_t) IEEE80211_KEYIX_NONE) {
1609 		struct ieee80211_node *ni;
1610 
1611 		if (ic->ic_opmode == IEEE80211_M_STA) {
1612 			ni = ieee80211_ref_node(ic->ic_bss);
1613 			if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
1614 				ieee80211_free_node(ni);
1615 				return EADDRNOTAVAIL;
1616 			}
1617 		} else {
1618 			ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
1619 			if (ni == NULL)
1620 				return ENOENT;
1621 		}
1622 		/* XXX error return */
1623 		ieee80211_node_delucastkey(ni);
1624 		ieee80211_free_node(ni);
1625 	} else {
1626 		if (kid >= IEEE80211_WEP_NKID)
1627 			return EINVAL;
1628 		/* XXX error return */
1629 		ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
1630 	}
1631 	return 0;
1632 }
1633 
1634 static void
1635 domlme(void *arg, struct ieee80211_node *ni)
1636 {
1637 	struct ieee80211com *ic = ni->ni_ic;
1638 	struct ieee80211req_mlme *mlme = arg;
1639 
1640 	if (ni->ni_associd != 0) {
1641 		IEEE80211_SEND_MGMT(ic, ni,
1642 			mlme->im_op == IEEE80211_MLME_DEAUTH ?
1643 				IEEE80211_FC0_SUBTYPE_DEAUTH :
1644 				IEEE80211_FC0_SUBTYPE_DISASSOC,
1645 			mlme->im_reason);
1646 	}
1647 	ieee80211_node_leave(ic, ni);
1648 }
1649 
1650 static int
1651 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
1652 {
1653 	struct ieee80211req_mlme mlme;
1654 	struct ieee80211_node *ni;
1655 	int error;
1656 
1657 	if (ireq->i_len != sizeof(mlme))
1658 		return EINVAL;
1659 	error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1660 	if (error)
1661 		return error;
1662 	switch (mlme.im_op) {
1663 	case IEEE80211_MLME_ASSOC:
1664 		if (ic->ic_opmode != IEEE80211_M_STA)
1665 			return EINVAL;
1666 		/* XXX must be in S_SCAN state? */
1667 
1668 		if (mlme.im_ssid_len != 0) {
1669 			/*
1670 			 * Desired ssid specified; must match both bssid and
1671 			 * ssid to distinguish ap advertising multiple ssid's.
1672 			 */
1673 			ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
1674 				mlme.im_macaddr,
1675 				mlme.im_ssid_len, mlme.im_ssid);
1676 		} else {
1677 			/*
1678 			 * Normal case; just match bssid.
1679 			 */
1680 			ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
1681 		}
1682 		if (ni == NULL)
1683 			return EINVAL;
1684 		if (!ieee80211_sta_join(ic, ni)) {
1685 			ieee80211_free_node(ni);
1686 			return EINVAL;
1687 		}
1688 		break;
1689 	case IEEE80211_MLME_DISASSOC:
1690 	case IEEE80211_MLME_DEAUTH:
1691 		switch (ic->ic_opmode) {
1692 		case IEEE80211_M_STA:
1693 			/* XXX not quite right */
1694 			ieee80211_new_state(ic, IEEE80211_S_INIT,
1695 				mlme.im_reason);
1696 			break;
1697 		case IEEE80211_M_HOSTAP:
1698 			/* NB: the broadcast address means do 'em all */
1699 			if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
1700 				if ((ni = ieee80211_find_node(&ic->ic_sta,
1701 						mlme.im_macaddr)) == NULL)
1702 					return EINVAL;
1703 				domlme(&mlme, ni);
1704 				ieee80211_free_node(ni);
1705 			} else {
1706 				ieee80211_iterate_nodes(&ic->ic_sta,
1707 						domlme, &mlme);
1708 			}
1709 			break;
1710 		default:
1711 			return EINVAL;
1712 		}
1713 		break;
1714 	case IEEE80211_MLME_AUTHORIZE:
1715 	case IEEE80211_MLME_UNAUTHORIZE:
1716 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1717 			return EINVAL;
1718 		ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
1719 		if (ni == NULL)
1720 			return EINVAL;
1721 		if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
1722 			ieee80211_node_authorize(ni);
1723 		else
1724 			ieee80211_node_unauthorize(ni);
1725 		ieee80211_free_node(ni);
1726 		break;
1727 	default:
1728 		return EINVAL;
1729 	}
1730 	return 0;
1731 }
1732 
1733 static int
1734 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
1735 {
1736 	u_int8_t mac[IEEE80211_ADDR_LEN];
1737 	const struct ieee80211_aclator *acl = ic->ic_acl;
1738 	int error;
1739 
1740 	if (ireq->i_len != sizeof(mac))
1741 		return EINVAL;
1742 	error = copyin(ireq->i_data, mac, ireq->i_len);
1743 	if (error)
1744 		return error;
1745 	if (acl == NULL) {
1746 		acl = ieee80211_aclator_get("mac");
1747 		if (acl == NULL || !acl->iac_attach(ic))
1748 			return EINVAL;
1749 		ic->ic_acl = acl;
1750 	}
1751 	if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1752 		acl->iac_add(ic, mac);
1753 	else
1754 		acl->iac_remove(ic, mac);
1755 	return 0;
1756 }
1757 
1758 static int
1759 ieee80211_ioctl_setmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1760 {
1761 	const struct ieee80211_aclator *acl = ic->ic_acl;
1762 
1763 	switch (ireq->i_val) {
1764 	case IEEE80211_MACCMD_POLICY_OPEN:
1765 	case IEEE80211_MACCMD_POLICY_ALLOW:
1766 	case IEEE80211_MACCMD_POLICY_DENY:
1767 		if (acl == NULL) {
1768 			acl = ieee80211_aclator_get("mac");
1769 			if (acl == NULL || !acl->iac_attach(ic))
1770 				return EINVAL;
1771 			ic->ic_acl = acl;
1772 		}
1773 		acl->iac_setpolicy(ic, ireq->i_val);
1774 		break;
1775 	case IEEE80211_MACCMD_FLUSH:
1776 		if (acl != NULL)
1777 			acl->iac_flush(ic);
1778 		/* NB: silently ignore when not in use */
1779 		break;
1780 	case IEEE80211_MACCMD_DETACH:
1781 		if (acl != NULL) {
1782 			ic->ic_acl = NULL;
1783 			acl->iac_detach(ic);
1784 		}
1785 		break;
1786 	default:
1787 		if (acl == NULL)
1788 			return EINVAL;
1789 		else
1790 			return acl->iac_setioctl(ic, ireq);
1791 	}
1792 	return 0;
1793 }
1794 
1795 static int
1796 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
1797 {
1798 	struct ieee80211req_chanlist list;
1799 	u_char chanlist[IEEE80211_CHAN_BYTES];
1800 	int i, j, error;
1801 
1802 	if (ireq->i_len != sizeof(list))
1803 		return EINVAL;
1804 	error = copyin(ireq->i_data, &list, sizeof(list));
1805 	if (error)
1806 		return error;
1807 	memset(chanlist, 0, sizeof(chanlist));
1808 	/*
1809 	 * Since channel 0 is not available for DS, channel 1
1810 	 * is assigned to LSB on WaveLAN.
1811 	 */
1812 	if (ic->ic_phytype == IEEE80211_T_DS)
1813 		i = 1;
1814 	else
1815 		i = 0;
1816 	for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
1817 		/*
1818 		 * NB: silently discard unavailable channels so users
1819 		 *     can specify 1-255 to get all available channels.
1820 		 */
1821 		if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
1822 			setbit(chanlist, i);
1823 	}
1824 	if (ic->ic_ibss_chan == NULL ||
1825 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1826 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1827 			if (isset(chanlist, i)) {
1828 				ic->ic_ibss_chan = &ic->ic_channels[i];
1829 				goto found;
1830 			}
1831 		return EINVAL;			/* no active channels */
1832 found:
1833 		;
1834 	}
1835 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
1836 	return IS_UP_AUTO(ic) ? ENETRESET : 0;
1837 }
1838 
1839 static int
1840 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1841 {
1842 	struct ieee80211_node *ni;
1843 	struct ieee80211req_sta_txpow txpow;
1844 	int error;
1845 
1846 	if (ireq->i_len != sizeof(txpow))
1847 		return EINVAL;
1848 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1849 	if (error != 0)
1850 		return error;
1851 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1852 	if (ni == NULL)
1853 		return EINVAL;		/* XXX */
1854 	ni->ni_txpower = txpow.it_txpow;
1855 	ieee80211_free_node(ni);
1856 	return error;
1857 }
1858 
1859 static int
1860 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1861 {
1862 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1863 	struct wmeParams *wmep, *chanp;
1864 	int isbss, ac;
1865 
1866 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1867 		return EINVAL;
1868 
1869 	isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1870 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1871 	if (ac >= WME_NUM_AC)
1872 		ac = WME_AC_BE;
1873 	if (isbss) {
1874 		chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1875 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1876 	} else {
1877 		chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1878 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1879 	}
1880 	switch (ireq->i_type) {
1881 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1882 		if (isbss) {
1883 			wmep->wmep_logcwmin = ireq->i_val;
1884 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1885 				chanp->wmep_logcwmin = ireq->i_val;
1886 		} else {
1887 			wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1888 				ireq->i_val;
1889 		}
1890 		break;
1891 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1892 		if (isbss) {
1893 			wmep->wmep_logcwmax = ireq->i_val;
1894 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1895 				chanp->wmep_logcwmax = ireq->i_val;
1896 		} else {
1897 			wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1898 				ireq->i_val;
1899 		}
1900 		break;
1901 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1902 		if (isbss) {
1903 			wmep->wmep_aifsn = ireq->i_val;
1904 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1905 				chanp->wmep_aifsn = ireq->i_val;
1906 		} else {
1907 			wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
1908 		}
1909 		break;
1910 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1911 		if (isbss) {
1912 			wmep->wmep_txopLimit = ireq->i_val;
1913 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1914 				chanp->wmep_txopLimit = ireq->i_val;
1915 		} else {
1916 			wmep->wmep_txopLimit = chanp->wmep_txopLimit =
1917 				ireq->i_val;
1918 		}
1919 		break;
1920 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1921 		wmep->wmep_acm = ireq->i_val;
1922 		if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1923 			chanp->wmep_acm = ireq->i_val;
1924 		break;
1925 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1926 		wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1927 			(ireq->i_val) == 0;
1928 		break;
1929 	}
1930 	ieee80211_wme_updateparams(ic);
1931 	return 0;
1932 }
1933 
1934 static int
1935 cipher2cap(int cipher)
1936 {
1937 	switch (cipher) {
1938 	case IEEE80211_CIPHER_WEP:	return IEEE80211_C_WEP;
1939 	case IEEE80211_CIPHER_AES_OCB:	return IEEE80211_C_AES;
1940 	case IEEE80211_CIPHER_AES_CCM:	return IEEE80211_C_AES_CCM;
1941 	case IEEE80211_CIPHER_CKIP:	return IEEE80211_C_CKIP;
1942 	case IEEE80211_CIPHER_TKIP:	return IEEE80211_C_TKIP;
1943 	}
1944 	return 0;
1945 }
1946 
1947 static int
1948 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1949 {
1950 	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
1951 	struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1952 	int error;
1953 	const struct ieee80211_authenticator *auth;
1954 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1955 	char tmpssid[IEEE80211_NWID_LEN];
1956 	u_int8_t tmpbssid[IEEE80211_ADDR_LEN];
1957 	struct ieee80211_key *k;
1958 	int j, caps;
1959 	u_int kid;
1960 
1961 	error = 0;
1962 	switch (ireq->i_type) {
1963 	case IEEE80211_IOC_SSID:
1964 		if (ireq->i_val != 0 ||
1965 		    ireq->i_len > IEEE80211_NWID_LEN)
1966 			return EINVAL;
1967 		error = copyin(ireq->i_data, tmpssid, ireq->i_len);
1968 		if (error)
1969 			break;
1970 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
1971 		ic->ic_des_esslen = ireq->i_len;
1972 		memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
1973 		error = ENETRESET;
1974 		break;
1975 	case IEEE80211_IOC_WEP:
1976 		switch (ireq->i_val) {
1977 		case IEEE80211_WEP_OFF:
1978 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
1979 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1980 			break;
1981 		case IEEE80211_WEP_ON:
1982 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1983 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
1984 			break;
1985 		case IEEE80211_WEP_MIXED:
1986 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1987 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1988 			break;
1989 		}
1990 		error = ENETRESET;
1991 		break;
1992 	case IEEE80211_IOC_WEPKEY:
1993 		kid = (u_int) ireq->i_val;
1994 		if (kid >= IEEE80211_WEP_NKID)
1995 			return EINVAL;
1996 		k = &ic->ic_nw_keys[kid];
1997 		if (ireq->i_len == 0) {
1998 			/* zero-len =>'s delete any existing key */
1999 			(void) ieee80211_crypto_delkey(ic, k);
2000 			break;
2001 		}
2002 		if (ireq->i_len > sizeof(tmpkey))
2003 			return EINVAL;
2004 		memset(tmpkey, 0, sizeof(tmpkey));
2005 		error = copyin(ireq->i_data, tmpkey, ireq->i_len);
2006 		if (error)
2007 			break;
2008 		ieee80211_key_update_begin(ic);
2009 		k->wk_keyix = kid;	/* NB: force fixed key id */
2010 		if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
2011 		    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2012 			k->wk_keylen = ireq->i_len;
2013 			memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
2014 			if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
2015 				error = EINVAL;
2016 		} else
2017 			error = EINVAL;
2018 		ieee80211_key_update_end(ic);
2019 		if (!error)			/* NB: for compatibility */
2020 			error = ENETRESET;
2021 		break;
2022 	case IEEE80211_IOC_WEPTXKEY:
2023 		kid = (u_int) ireq->i_val;
2024 		if (kid >= IEEE80211_WEP_NKID &&
2025 		    (u_int16_t) kid != IEEE80211_KEYIX_NONE)
2026 			return EINVAL;
2027 		ic->ic_def_txkey = kid;
2028 		error = ENETRESET;	/* push to hardware */
2029 		break;
2030 	case IEEE80211_IOC_AUTHMODE:
2031 		switch (ireq->i_val) {
2032 		case IEEE80211_AUTH_WPA:
2033 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2034 		case IEEE80211_AUTH_OPEN:	/* open */
2035 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2036 		case IEEE80211_AUTH_AUTO:	/* auto */
2037 			auth = ieee80211_authenticator_get(ireq->i_val);
2038 			if (auth == NULL)
2039 				return EINVAL;
2040 			break;
2041 		default:
2042 			return EINVAL;
2043 		}
2044 		switch (ireq->i_val) {
2045 		case IEEE80211_AUTH_WPA:	/* WPA w/ 802.1x */
2046 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2047 			ireq->i_val = IEEE80211_AUTH_8021X;
2048 			break;
2049 		case IEEE80211_AUTH_OPEN:	/* open */
2050 			ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2051 			break;
2052 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2053 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2054 			ic->ic_flags &= ~IEEE80211_F_WPA;
2055 			/* both require a key so mark the PRIVACY capability */
2056 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2057 			break;
2058 		case IEEE80211_AUTH_AUTO:	/* auto */
2059 			ic->ic_flags &= ~IEEE80211_F_WPA;
2060 			/* XXX PRIVACY handling? */
2061 			/* XXX what's the right way to do this? */
2062 			break;
2063 		}
2064 		/* NB: authenticator attach/detach happens on state change */
2065 		ic->ic_bss->ni_authmode = ireq->i_val;
2066 		/* XXX mixed/mode/usage? */
2067 		ic->ic_auth = auth;
2068 		error = ENETRESET;
2069 		break;
2070 	case IEEE80211_IOC_CHANNEL:
2071 		/* XXX 0xffff overflows 16-bit signed */
2072 		if (ireq->i_val == 0 ||
2073 		    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
2074 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2075 		else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
2076 		    isclr(ic->ic_chan_active, ireq->i_val)) {
2077 			return EINVAL;
2078 		} else
2079 			ic->ic_ibss_chan = ic->ic_des_chan =
2080 				&ic->ic_channels[ireq->i_val];
2081 		switch (ic->ic_state) {
2082 		case IEEE80211_S_INIT:
2083 		case IEEE80211_S_SCAN:
2084 			error = ENETRESET;
2085 			break;
2086 		default:
2087 			/*
2088 			 * If the desired channel has changed (to something
2089 			 * other than any) and we're not already scanning,
2090 			 * then kick the state machine.
2091 			 */
2092 			if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2093 			    ic->ic_bss->ni_chan != ic->ic_des_chan &&
2094 			    (ic->ic_flags & IEEE80211_F_SCAN) == 0)
2095 				error = ENETRESET;
2096 			break;
2097 		}
2098 		if (error == ENETRESET &&
2099 			ic->ic_opmode == IEEE80211_M_MONITOR) {
2100 			if (IS_UP(ic)) {
2101 				/*
2102 				 * Monitor mode can switch directly.
2103 				 */
2104 				if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
2105 					ic->ic_curchan = ic->ic_des_chan;
2106 				error = ic->ic_reset(ic->ic_ifp);
2107 			} else
2108 				error = 0;
2109 		}
2110 		break;
2111 	case IEEE80211_IOC_POWERSAVE:
2112 		switch (ireq->i_val) {
2113 		case IEEE80211_POWERSAVE_OFF:
2114 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
2115 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
2116 				error = ENETRESET;
2117 			}
2118 			break;
2119 		case IEEE80211_POWERSAVE_ON:
2120 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2121 				error = EINVAL;
2122 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2123 				ic->ic_flags |= IEEE80211_F_PMGTON;
2124 				error = ENETRESET;
2125 			}
2126 			break;
2127 		default:
2128 			error = EINVAL;
2129 			break;
2130 		}
2131 		break;
2132 	case IEEE80211_IOC_POWERSAVESLEEP:
2133 		if (ireq->i_val < 0)
2134 			return EINVAL;
2135 		ic->ic_lintval = ireq->i_val;
2136 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2137 		break;
2138 	case IEEE80211_IOC_RTSTHRESHOLD:
2139 		if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
2140 		      ireq->i_val <= IEEE80211_RTS_MAX))
2141 			return EINVAL;
2142 		ic->ic_rtsthreshold = ireq->i_val;
2143 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2144 		break;
2145 	case IEEE80211_IOC_PROTMODE:
2146 		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2147 			return EINVAL;
2148 		ic->ic_protmode = ireq->i_val;
2149 		/* NB: if not operating in 11g this can wait */
2150 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2151 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2152 		break;
2153 	case IEEE80211_IOC_TXPOWER:
2154 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2155 			return EINVAL;
2156 		if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
2157 		      ireq->i_val < IEEE80211_TXPOWER_MAX))
2158 			return EINVAL;
2159 		ic->ic_txpowlimit = ireq->i_val;
2160 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2161 		break;
2162 	case IEEE80211_IOC_ROAMING:
2163 		if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2164 		    ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2165 			return EINVAL;
2166 		ic->ic_roaming = ireq->i_val;
2167 		/* XXXX reset? */
2168 		break;
2169 	case IEEE80211_IOC_PRIVACY:
2170 		if (ireq->i_val) {
2171 			/* XXX check for key state? */
2172 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2173 		} else
2174 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2175 		break;
2176 	case IEEE80211_IOC_DROPUNENCRYPTED:
2177 		if (ireq->i_val)
2178 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
2179 		else
2180 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2181 		break;
2182 	case IEEE80211_IOC_WPAKEY:
2183 		error = ieee80211_ioctl_setkey(ic, ireq);
2184 		break;
2185 	case IEEE80211_IOC_DELKEY:
2186 		error = ieee80211_ioctl_delkey(ic, ireq);
2187 		break;
2188 	case IEEE80211_IOC_MLME:
2189 		error = ieee80211_ioctl_setmlme(ic, ireq);
2190 		break;
2191 	case IEEE80211_IOC_OPTIE:
2192 		error = ieee80211_ioctl_setoptie(ic, ireq);
2193 		break;
2194 	case IEEE80211_IOC_COUNTERMEASURES:
2195 		if (ireq->i_val) {
2196 			if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
2197 				return EINVAL;
2198 			ic->ic_flags |= IEEE80211_F_COUNTERM;
2199 		} else
2200 			ic->ic_flags &= ~IEEE80211_F_COUNTERM;
2201 		break;
2202 	case IEEE80211_IOC_WPA:
2203 		if (ireq->i_val > 3)
2204 			return EINVAL;
2205 		/* XXX verify ciphers available */
2206 		ic->ic_flags &= ~IEEE80211_F_WPA;
2207 		switch (ireq->i_val) {
2208 		case 1:
2209 			ic->ic_flags |= IEEE80211_F_WPA1;
2210 			break;
2211 		case 2:
2212 			ic->ic_flags |= IEEE80211_F_WPA2;
2213 			break;
2214 		case 3:
2215 			ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2216 			break;
2217 		}
2218 		error = ENETRESET;		/* XXX? */
2219 		break;
2220 	case IEEE80211_IOC_WME:
2221 		if (ireq->i_val) {
2222 			if ((ic->ic_caps & IEEE80211_C_WME) == 0)
2223 				return EINVAL;
2224 			ic->ic_flags |= IEEE80211_F_WME;
2225 		} else
2226 			ic->ic_flags &= ~IEEE80211_F_WME;
2227 		error = ENETRESET;		/* XXX maybe not for station? */
2228 		break;
2229 	case IEEE80211_IOC_HIDESSID:
2230 		if (ireq->i_val)
2231 			ic->ic_flags |= IEEE80211_F_HIDESSID;
2232 		else
2233 			ic->ic_flags &= ~IEEE80211_F_HIDESSID;
2234 		error = ENETRESET;
2235 		break;
2236 	case IEEE80211_IOC_APBRIDGE:
2237 		if (ireq->i_val == 0)
2238 			ic->ic_flags |= IEEE80211_F_NOBRIDGE;
2239 		else
2240 			ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
2241 		break;
2242 	case IEEE80211_IOC_MCASTCIPHER:
2243 		if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
2244 		    !ieee80211_crypto_available(ireq->i_val))
2245 			return EINVAL;
2246 		rsn->rsn_mcastcipher = ireq->i_val;
2247 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2248 		break;
2249 	case IEEE80211_IOC_MCASTKEYLEN:
2250 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2251 			return EINVAL;
2252 		/* XXX no way to verify driver capability */
2253 		rsn->rsn_mcastkeylen = ireq->i_val;
2254 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2255 		break;
2256 	case IEEE80211_IOC_UCASTCIPHERS:
2257 		/*
2258 		 * Convert user-specified cipher set to the set
2259 		 * we can support (via hardware or software).
2260 		 * NB: this logic intentionally ignores unknown and
2261 		 * unsupported ciphers so folks can specify 0xff or
2262 		 * similar and get all available ciphers.
2263 		 */
2264 		caps = 0;
2265 		for (j = 1; j < 32; j++)	/* NB: skip WEP */
2266 			if ((ireq->i_val & (1<<j)) &&
2267 			    ((ic->ic_caps & cipher2cap(j)) ||
2268 			     ieee80211_crypto_available(j)))
2269 				caps |= 1<<j;
2270 		if (caps == 0)			/* nothing available */
2271 			return EINVAL;
2272 		/* XXX verify ciphers ok for unicast use? */
2273 		/* XXX disallow if running as it'll have no effect */
2274 		rsn->rsn_ucastcipherset = caps;
2275 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2276 		break;
2277 	case IEEE80211_IOC_UCASTCIPHER:
2278 		if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
2279 			return EINVAL;
2280 		rsn->rsn_ucastcipher = ireq->i_val;
2281 		break;
2282 	case IEEE80211_IOC_UCASTKEYLEN:
2283 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2284 			return EINVAL;
2285 		/* XXX no way to verify driver capability */
2286 		rsn->rsn_ucastkeylen = ireq->i_val;
2287 		break;
2288 	case IEEE80211_IOC_DRIVER_CAPS:
2289 		/* NB: for testing */
2290 		ic->ic_caps = (((u_int16_t) ireq->i_val) << 16) |
2291 			       ((u_int16_t) ireq->i_len);
2292 		break;
2293 	case IEEE80211_IOC_KEYMGTALGS:
2294 		/* XXX check */
2295 		rsn->rsn_keymgmtset = ireq->i_val;
2296 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2297 		break;
2298 	case IEEE80211_IOC_RSNCAPS:
2299 		/* XXX check */
2300 		rsn->rsn_caps = ireq->i_val;
2301 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2302 		break;
2303 	case IEEE80211_IOC_BSSID:
2304 		if (ireq->i_len != sizeof(tmpbssid))
2305 			return EINVAL;
2306 		error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2307 		if (error)
2308 			break;
2309 		IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
2310 		if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2311 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2312 		else
2313 			ic->ic_flags |= IEEE80211_F_DESBSSID;
2314 		error = ENETRESET;
2315 		break;
2316 	case IEEE80211_IOC_CHANLIST:
2317 		error = ieee80211_ioctl_setchanlist(ic, ireq);
2318 		break;
2319 	case IEEE80211_IOC_SCAN_REQ:
2320 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)	/* XXX ignore */
2321 			break;
2322 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
2323 		if (error == 0)		/* XXX background scan */
2324 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2325 		break;
2326 	case IEEE80211_IOC_ADDMAC:
2327 	case IEEE80211_IOC_DELMAC:
2328 		error = ieee80211_ioctl_macmac(ic, ireq);
2329 		break;
2330 	case IEEE80211_IOC_MACCMD:
2331 		error = ieee80211_ioctl_setmaccmd(ic, ireq);
2332 		break;
2333 	case IEEE80211_IOC_STA_TXPOW:
2334 		error = ieee80211_ioctl_setstatxpow(ic, ireq);
2335 		break;
2336 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
2337 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
2338 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
2339 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
2340 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
2341 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
2342 		error = ieee80211_ioctl_setwmeparam(ic, ireq);
2343 		break;
2344 	case IEEE80211_IOC_DTIM_PERIOD:
2345 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2346 		    ic->ic_opmode != IEEE80211_M_IBSS)
2347 			return EINVAL;
2348 		if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2349 		    ireq->i_val <= IEEE80211_DTIM_MAX) {
2350 			ic->ic_dtim_period = ireq->i_val;
2351 			error = ENETRESET;		/* requires restart */
2352 		} else
2353 			error = EINVAL;
2354 		break;
2355 	case IEEE80211_IOC_BEACON_INTERVAL:
2356 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2357 		    ic->ic_opmode != IEEE80211_M_IBSS)
2358 			return EINVAL;
2359 		if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2360 		    ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2361 			ic->ic_bintval = ireq->i_val;
2362 			error = ENETRESET;		/* requires restart */
2363 		} else
2364 			error = EINVAL;
2365 		break;
2366 	case IEEE80211_IOC_PUREG:
2367 		if (ireq->i_val)
2368 			ic->ic_flags |= IEEE80211_F_PUREG;
2369 		else
2370 			ic->ic_flags &= ~IEEE80211_F_PUREG;
2371 		/* NB: reset only if we're operating on an 11g channel */
2372 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2373 			error = ENETRESET;
2374 		break;
2375 	case IEEE80211_IOC_MCAST_RATE:
2376 		ic->ic_mcast_rate = ireq->i_val & IEEE80211_RATE_VAL;
2377 		break;
2378 	case IEEE80211_IOC_FRAGTHRESHOLD:
2379 		if ((ic->ic_caps & IEEE80211_C_TXFRAG) == 0 &&
2380 		    ireq->i_val != IEEE80211_FRAG_MAX)
2381 			return EINVAL;
2382 		if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
2383 		      ireq->i_val <= IEEE80211_FRAG_MAX))
2384 			return EINVAL;
2385 		ic->ic_fragthreshold = ireq->i_val;
2386 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2387 		break;
2388 	case IEEE80211_IOC_BURST:
2389 		if (ireq->i_val) {
2390 			if ((ic->ic_caps & IEEE80211_C_BURST) == 0)
2391 				return EINVAL;
2392 			ic->ic_flags |= IEEE80211_F_BURST;
2393 		} else
2394 			ic->ic_flags &= ~IEEE80211_F_BURST;
2395 		error = ENETRESET;		/* XXX maybe not for station? */
2396 		break;
2397 	default:
2398 		error = EINVAL;
2399 		break;
2400 	}
2401 	if (error == ENETRESET && !IS_UP_AUTO(ic))
2402 		error = 0;
2403 	return error;
2404 }
2405 
2406 int
2407 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, caddr_t data)
2408 {
2409 	struct ifnet *ifp = ic->ic_ifp;
2410 	int error = 0;
2411 	struct ifreq *ifr;
2412 	struct ifaddr *ifa;			/* XXX */
2413 
2414 	switch (cmd) {
2415 	case SIOCSIFMEDIA:
2416 	case SIOCGIFMEDIA:
2417 		error = ifmedia_ioctl(ifp, (struct ifreq *) data,
2418 				&ic->ic_media, cmd);
2419 		break;
2420 	case SIOCG80211:
2421 		error = ieee80211_ioctl_get80211(ic, cmd,
2422 				(struct ieee80211req *) data);
2423 		break;
2424 	case SIOCS80211:
2425 		error = suser(curthread);
2426 		if (error == 0)
2427 			error = ieee80211_ioctl_set80211(ic, cmd,
2428 					(struct ieee80211req *) data);
2429 		break;
2430 	case SIOCGIFGENERIC:
2431 		error = ieee80211_cfgget(ic, cmd, data);
2432 		break;
2433 	case SIOCSIFGENERIC:
2434 		error = suser(curthread);
2435 		if (error)
2436 			break;
2437 		error = ieee80211_cfgset(ic, cmd, data);
2438 		break;
2439 	case SIOCG80211STATS:
2440 		ifr = (struct ifreq *)data;
2441 		copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
2442 		break;
2443 	case SIOCSIFMTU:
2444 		ifr = (struct ifreq *)data;
2445 		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2446 		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2447 			error = EINVAL;
2448 		else
2449 			ifp->if_mtu = ifr->ifr_mtu;
2450 		break;
2451 	case SIOCSIFADDR:
2452 		/*
2453 		 * XXX Handle this directly so we can supress if_init calls.
2454 		 * XXX This should be done in ether_ioctl but for the moment
2455 		 * XXX there are too many other parts of the system that
2456 		 * XXX set IFF_UP and so supress if_init being called when
2457 		 * XXX it should be.
2458 		 */
2459 		ifa = (struct ifaddr *) data;
2460 		switch (ifa->ifa_addr->sa_family) {
2461 #ifdef INET
2462 		case AF_INET:
2463 			if ((ifp->if_flags & IFF_UP) == 0) {
2464 				ifp->if_flags |= IFF_UP;
2465 				ifp->if_init(ifp->if_softc);
2466 			}
2467 			arp_ifinit(ifp, ifa);
2468 			break;
2469 #endif
2470 #ifdef IPX
2471 		/*
2472 		 * XXX - This code is probably wrong,
2473 		 *	 but has been copied many times.
2474 		 */
2475 		case AF_IPX: {
2476 			struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
2477 
2478 			if (ipx_nullhost(*ina))
2479 				ina->x_host = *(union ipx_host *)
2480 				    IF_LLADDR(ifp);
2481 			else
2482 				bcopy((caddr_t) ina->x_host.c_host,
2483 				      (caddr_t) IF_LLADDR(ifp),
2484 				      ETHER_ADDR_LEN);
2485 			/* fall thru... */
2486 		}
2487 #endif
2488 		default:
2489 			if ((ifp->if_flags & IFF_UP) == 0) {
2490 				ifp->if_flags |= IFF_UP;
2491 				ifp->if_init(ifp->if_softc);
2492 			}
2493 			break;
2494 		}
2495 		break;
2496 	default:
2497 		error = ether_ioctl(ifp, cmd, data);
2498 		break;
2499 	}
2500 	return error;
2501 }
2502