xref: /freebsd/sys/net80211/ieee80211_ioctl.c (revision 39beb93c3f8bdbf72a61fda42300b5ebed7390c8)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 /*
31  * IEEE 802.11 ioctl support (FreeBSD-specific)
32  */
33 
34 #include "opt_inet.h"
35 #include "opt_ipx.h"
36 #include "opt_wlan.h"
37 
38 #include <sys/endian.h>
39 #include <sys/param.h>
40 #include <sys/kernel.h>
41 #include <sys/priv.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 #include <sys/systm.h>
45 #include <sys/taskqueue.h>
46 
47 #include <net/if.h>
48 #include <net/if_dl.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51 
52 #ifdef INET
53 #include <netinet/in.h>
54 #include <netinet/if_ether.h>
55 #endif
56 
57 #ifdef IPX
58 #include <netipx/ipx.h>
59 #include <netipx/ipx_if.h>
60 #endif
61 
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_ioctl.h>
64 #include <net80211/ieee80211_regdomain.h>
65 #include <net80211/ieee80211_input.h>
66 #ifdef IEEE80211_SUPPORT_TDMA
67 #include <net80211/ieee80211_tdma.h>
68 #endif
69 
70 #define	IS_UP_AUTO(_vap) \
71 	(IFNET_IS_UP_RUNNING(vap->iv_ifp) && \
72 	 (_vap)->iv_roaming == IEEE80211_ROAMING_AUTO)
73 
74 static const uint8_t zerobssid[IEEE80211_ADDR_LEN];
75 static struct ieee80211_channel *findchannel(struct ieee80211com *,
76 		int ieee, int mode);
77 
78 static __noinline int
79 ieee80211_ioctl_getkey(struct ieee80211vap *vap, struct ieee80211req *ireq)
80 {
81 	struct ieee80211com *ic = vap->iv_ic;
82 	struct ieee80211_node *ni;
83 	struct ieee80211req_key ik;
84 	struct ieee80211_key *wk;
85 	const struct ieee80211_cipher *cip;
86 	u_int kid;
87 	int error;
88 
89 	if (ireq->i_len != sizeof(ik))
90 		return EINVAL;
91 	error = copyin(ireq->i_data, &ik, sizeof(ik));
92 	if (error)
93 		return error;
94 	kid = ik.ik_keyix;
95 	if (kid == IEEE80211_KEYIX_NONE) {
96 		ni = ieee80211_find_vap_node(&ic->ic_sta, vap, ik.ik_macaddr);
97 		if (ni == NULL)
98 			return ENOENT;
99 		wk = &ni->ni_ucastkey;
100 	} else {
101 		if (kid >= IEEE80211_WEP_NKID)
102 			return EINVAL;
103 		wk = &vap->iv_nw_keys[kid];
104 		IEEE80211_ADDR_COPY(&ik.ik_macaddr, vap->iv_bss->ni_macaddr);
105 		ni = NULL;
106 	}
107 	cip = wk->wk_cipher;
108 	ik.ik_type = cip->ic_cipher;
109 	ik.ik_keylen = wk->wk_keylen;
110 	ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
111 	if (wk->wk_keyix == vap->iv_def_txkey)
112 		ik.ik_flags |= IEEE80211_KEY_DEFAULT;
113 	if (priv_check(curthread, PRIV_NET80211_GETKEY) == 0) {
114 		/* NB: only root can read key data */
115 		ik.ik_keyrsc = wk->wk_keyrsc[IEEE80211_NONQOS_TID];
116 		ik.ik_keytsc = wk->wk_keytsc;
117 		memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
118 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
119 			memcpy(ik.ik_keydata+wk->wk_keylen,
120 				wk->wk_key + IEEE80211_KEYBUF_SIZE,
121 				IEEE80211_MICBUF_SIZE);
122 			ik.ik_keylen += IEEE80211_MICBUF_SIZE;
123 		}
124 	} else {
125 		ik.ik_keyrsc = 0;
126 		ik.ik_keytsc = 0;
127 		memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
128 	}
129 	if (ni != NULL)
130 		ieee80211_free_node(ni);
131 	return copyout(&ik, ireq->i_data, sizeof(ik));
132 }
133 
134 static __noinline int
135 ieee80211_ioctl_getchanlist(struct ieee80211vap *vap, struct ieee80211req *ireq)
136 {
137 	struct ieee80211com *ic = vap->iv_ic;
138 
139 	if (sizeof(ic->ic_chan_active) < ireq->i_len)
140 		ireq->i_len = sizeof(ic->ic_chan_active);
141 	return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
142 }
143 
144 static __noinline int
145 ieee80211_ioctl_getchaninfo(struct ieee80211vap *vap, struct ieee80211req *ireq)
146 {
147 	struct ieee80211com *ic = vap->iv_ic;
148 	int space;
149 
150 	space = __offsetof(struct ieee80211req_chaninfo,
151 			ic_chans[ic->ic_nchans]);
152 	if (space > ireq->i_len)
153 		space = ireq->i_len;
154 	/* XXX assumes compatible layout */
155 	return copyout(&ic->ic_nchans, ireq->i_data, space);
156 }
157 
158 static __noinline int
159 ieee80211_ioctl_getwpaie(struct ieee80211vap *vap,
160 	struct ieee80211req *ireq, int req)
161 {
162 	struct ieee80211_node *ni;
163 	struct ieee80211req_wpaie2 wpaie;
164 	int error;
165 
166 	if (ireq->i_len < IEEE80211_ADDR_LEN)
167 		return EINVAL;
168 	error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
169 	if (error != 0)
170 		return error;
171 	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, wpaie.wpa_macaddr);
172 	if (ni == NULL)
173 		return ENOENT;
174 	memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
175 	if (ni->ni_ies.wpa_ie != NULL) {
176 		int ielen = ni->ni_ies.wpa_ie[1] + 2;
177 		if (ielen > sizeof(wpaie.wpa_ie))
178 			ielen = sizeof(wpaie.wpa_ie);
179 		memcpy(wpaie.wpa_ie, ni->ni_ies.wpa_ie, ielen);
180 	}
181 	if (req == IEEE80211_IOC_WPAIE2) {
182 		memset(wpaie.rsn_ie, 0, sizeof(wpaie.rsn_ie));
183 		if (ni->ni_ies.rsn_ie != NULL) {
184 			int ielen = ni->ni_ies.rsn_ie[1] + 2;
185 			if (ielen > sizeof(wpaie.rsn_ie))
186 				ielen = sizeof(wpaie.rsn_ie);
187 			memcpy(wpaie.rsn_ie, ni->ni_ies.rsn_ie, ielen);
188 		}
189 		if (ireq->i_len > sizeof(struct ieee80211req_wpaie2))
190 			ireq->i_len = sizeof(struct ieee80211req_wpaie2);
191 	} else {
192 		/* compatibility op, may overwrite wpa ie */
193 		/* XXX check ic_flags? */
194 		if (ni->ni_ies.rsn_ie != NULL) {
195 			int ielen = ni->ni_ies.rsn_ie[1] + 2;
196 			if (ielen > sizeof(wpaie.wpa_ie))
197 				ielen = sizeof(wpaie.wpa_ie);
198 			memcpy(wpaie.wpa_ie, ni->ni_ies.rsn_ie, ielen);
199 		}
200 		if (ireq->i_len > sizeof(struct ieee80211req_wpaie))
201 			ireq->i_len = sizeof(struct ieee80211req_wpaie);
202 	}
203 	ieee80211_free_node(ni);
204 	return copyout(&wpaie, ireq->i_data, ireq->i_len);
205 }
206 
207 static __noinline int
208 ieee80211_ioctl_getstastats(struct ieee80211vap *vap, struct ieee80211req *ireq)
209 {
210 	struct ieee80211_node *ni;
211 	uint8_t macaddr[IEEE80211_ADDR_LEN];
212 	const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
213 	int error;
214 
215 	if (ireq->i_len < off)
216 		return EINVAL;
217 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
218 	if (error != 0)
219 		return error;
220 	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
221 	if (ni == NULL)
222 		return ENOENT;
223 	if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
224 		ireq->i_len = sizeof(struct ieee80211req_sta_stats);
225 	/* NB: copy out only the statistics */
226 	error = copyout(&ni->ni_stats, (uint8_t *) ireq->i_data + off,
227 			ireq->i_len - off);
228 	ieee80211_free_node(ni);
229 	return error;
230 }
231 
232 struct scanreq {
233 	struct ieee80211req_scan_result *sr;
234 	size_t space;
235 };
236 
237 static size_t
238 scan_space(const struct ieee80211_scan_entry *se, int *ielen)
239 {
240 	size_t len;
241 
242 	*ielen = se->se_ies.len;
243 	/*
244 	 * NB: ie's can be no more than 255 bytes and the max 802.11
245 	 * packet is <3Kbytes so we are sure this doesn't overflow
246 	 * 16-bits; if this is a concern we can drop the ie's.
247 	 */
248 	len = sizeof(struct ieee80211req_scan_result) + se->se_ssid[1] + *ielen;
249 	return roundup(len, sizeof(uint32_t));
250 }
251 
252 static void
253 get_scan_space(void *arg, const struct ieee80211_scan_entry *se)
254 {
255 	struct scanreq *req = arg;
256 	int ielen;
257 
258 	req->space += scan_space(se, &ielen);
259 }
260 
261 static __noinline void
262 get_scan_result(void *arg, const struct ieee80211_scan_entry *se)
263 {
264 	struct scanreq *req = arg;
265 	struct ieee80211req_scan_result *sr;
266 	int ielen, len, nr, nxr;
267 	uint8_t *cp;
268 
269 	len = scan_space(se, &ielen);
270 	if (len > req->space)
271 		return;
272 
273 	sr = req->sr;
274 	KASSERT(len <= 65535 && ielen <= 65535,
275 	    ("len %u ssid %u ie %u", len, se->se_ssid[1], ielen));
276 	sr->isr_len = len;
277 	sr->isr_ie_off = sizeof(struct ieee80211req_scan_result);
278 	sr->isr_ie_len = ielen;
279 	sr->isr_freq = se->se_chan->ic_freq;
280 	sr->isr_flags = se->se_chan->ic_flags;
281 	sr->isr_rssi = se->se_rssi;
282 	sr->isr_noise = se->se_noise;
283 	sr->isr_intval = se->se_intval;
284 	sr->isr_capinfo = se->se_capinfo;
285 	sr->isr_erp = se->se_erp;
286 	IEEE80211_ADDR_COPY(sr->isr_bssid, se->se_bssid);
287 	nr = min(se->se_rates[1], IEEE80211_RATE_MAXSIZE);
288 	memcpy(sr->isr_rates, se->se_rates+2, nr);
289 	nxr = min(se->se_xrates[1], IEEE80211_RATE_MAXSIZE - nr);
290 	memcpy(sr->isr_rates+nr, se->se_xrates+2, nxr);
291 	sr->isr_nrates = nr + nxr;
292 
293 	sr->isr_ssid_len = se->se_ssid[1];
294 	cp = ((uint8_t *)sr) + sr->isr_ie_off;
295 	memcpy(cp, se->se_ssid+2, sr->isr_ssid_len);
296 
297 	if (ielen) {
298 		cp += sr->isr_ssid_len;
299 		memcpy(cp, se->se_ies.data, ielen);
300 	}
301 
302 	req->space -= len;
303 	req->sr = (struct ieee80211req_scan_result *)(((uint8_t *)sr) + len);
304 }
305 
306 static __noinline int
307 ieee80211_ioctl_getscanresults(struct ieee80211vap *vap,
308 	struct ieee80211req *ireq)
309 {
310 	struct scanreq req;
311 	int error;
312 
313 	if (ireq->i_len < sizeof(struct scanreq))
314 		return EFAULT;
315 
316 	error = 0;
317 	req.space = 0;
318 	ieee80211_scan_iterate(vap, get_scan_space, &req);
319 	if (req.space > ireq->i_len)
320 		req.space = ireq->i_len;
321 	if (req.space > 0) {
322 		size_t space;
323 		void *p;
324 
325 		space = req.space;
326 		/* XXX M_WAITOK after driver lock released */
327 		p = malloc(space, M_TEMP, M_NOWAIT | M_ZERO);
328 		if (p == NULL)
329 			return ENOMEM;
330 		req.sr = p;
331 		ieee80211_scan_iterate(vap, get_scan_result, &req);
332 		ireq->i_len = space - req.space;
333 		error = copyout(p, ireq->i_data, ireq->i_len);
334 		free(p, M_TEMP);
335 	} else
336 		ireq->i_len = 0;
337 
338 	return error;
339 }
340 
341 struct stainforeq {
342 	struct ieee80211vap *vap;
343 	struct ieee80211req_sta_info *si;
344 	size_t	space;
345 };
346 
347 static size_t
348 sta_space(const struct ieee80211_node *ni, size_t *ielen)
349 {
350 	*ielen = ni->ni_ies.len;
351 	return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
352 		      sizeof(uint32_t));
353 }
354 
355 static void
356 get_sta_space(void *arg, struct ieee80211_node *ni)
357 {
358 	struct stainforeq *req = arg;
359 	size_t ielen;
360 
361 	if (req->vap != ni->ni_vap)
362 		return;
363 	if (ni->ni_vap->iv_opmode == IEEE80211_M_HOSTAP &&
364 	    ni->ni_associd == 0)	/* only associated stations */
365 		return;
366 	req->space += sta_space(ni, &ielen);
367 }
368 
369 static __noinline void
370 get_sta_info(void *arg, struct ieee80211_node *ni)
371 {
372 	struct stainforeq *req = arg;
373 	struct ieee80211vap *vap = ni->ni_vap;
374 	struct ieee80211req_sta_info *si;
375 	size_t ielen, len;
376 	uint8_t *cp;
377 
378 	if (req->vap != ni->ni_vap)
379 		return;
380 	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
381 	    ni->ni_associd == 0)	/* only associated stations */
382 		return;
383 	if (ni->ni_chan == IEEE80211_CHAN_ANYC)	/* XXX bogus entry */
384 		return;
385 	len = sta_space(ni, &ielen);
386 	if (len > req->space)
387 		return;
388 	si = req->si;
389 	si->isi_len = len;
390 	si->isi_ie_off = sizeof(struct ieee80211req_sta_info);
391 	si->isi_ie_len = ielen;
392 	si->isi_freq = ni->ni_chan->ic_freq;
393 	si->isi_flags = ni->ni_chan->ic_flags;
394 	si->isi_state = ni->ni_flags;
395 	si->isi_authmode = ni->ni_authmode;
396 	vap->iv_ic->ic_node_getsignal(ni, &si->isi_rssi, &si->isi_noise);
397 	vap->iv_ic->ic_node_getmimoinfo(ni, &si->isi_mimo);
398 	si->isi_capinfo = ni->ni_capinfo;
399 	si->isi_erp = ni->ni_erp;
400 	IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
401 	si->isi_nrates = ni->ni_rates.rs_nrates;
402 	if (si->isi_nrates > 15)
403 		si->isi_nrates = 15;
404 	memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
405 	si->isi_txrate = ni->ni_txrate;
406 	if (si->isi_txrate & IEEE80211_RATE_MCS) {
407 		const struct ieee80211_mcs_rates *mcs =
408 		    &ieee80211_htrates[ni->ni_txrate &~ IEEE80211_RATE_MCS];
409 		if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
410 			if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40)
411 				si->isi_txmbps = mcs->ht40_rate_800ns;
412 			else
413 				si->isi_txmbps = mcs->ht40_rate_400ns;
414 		} else {
415 			if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20)
416 				si->isi_txmbps = mcs->ht20_rate_800ns;
417 			else
418 				si->isi_txmbps = mcs->ht20_rate_400ns;
419 		}
420 	} else
421 		si->isi_txmbps = si->isi_txrate;
422 	si->isi_associd = ni->ni_associd;
423 	si->isi_txpower = ni->ni_txpower;
424 	si->isi_vlan = ni->ni_vlan;
425 	if (ni->ni_flags & IEEE80211_NODE_QOS) {
426 		memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
427 		memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
428 	} else {
429 		si->isi_txseqs[0] = ni->ni_txseqs[IEEE80211_NONQOS_TID];
430 		si->isi_rxseqs[0] = ni->ni_rxseqs[IEEE80211_NONQOS_TID];
431 	}
432 	/* NB: leave all cases in case we relax ni_associd == 0 check */
433 	if (ieee80211_node_is_authorized(ni))
434 		si->isi_inact = vap->iv_inact_run;
435 	else if (ni->ni_associd != 0 ||
436 	    (vap->iv_opmode == IEEE80211_M_WDS &&
437 	     (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY)))
438 		si->isi_inact = vap->iv_inact_auth;
439 	else
440 		si->isi_inact = vap->iv_inact_init;
441 	si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
442 
443 	if (ielen) {
444 		cp = ((uint8_t *)si) + si->isi_ie_off;
445 		memcpy(cp, ni->ni_ies.data, ielen);
446 	}
447 
448 	req->si = (struct ieee80211req_sta_info *)(((uint8_t *)si) + len);
449 	req->space -= len;
450 }
451 
452 static __noinline int
453 getstainfo_common(struct ieee80211vap *vap, struct ieee80211req *ireq,
454 	struct ieee80211_node *ni, int off)
455 {
456 	struct ieee80211com *ic = vap->iv_ic;
457 	struct stainforeq req;
458 	size_t space;
459 	void *p;
460 	int error;
461 
462 	error = 0;
463 	req.space = 0;
464 	req.vap = vap;
465 	if (ni == NULL)
466 		ieee80211_iterate_nodes(&ic->ic_sta, get_sta_space, &req);
467 	else
468 		get_sta_space(&req, ni);
469 	if (req.space > ireq->i_len)
470 		req.space = ireq->i_len;
471 	if (req.space > 0) {
472 		space = req.space;
473 		/* XXX M_WAITOK after driver lock released */
474 		p = malloc(space, M_TEMP, M_NOWAIT | M_ZERO);
475 		if (p == NULL) {
476 			error = ENOMEM;
477 			goto bad;
478 		}
479 		req.si = p;
480 		if (ni == NULL)
481 			ieee80211_iterate_nodes(&ic->ic_sta, get_sta_info, &req);
482 		else
483 			get_sta_info(&req, ni);
484 		ireq->i_len = space - req.space;
485 		error = copyout(p, (uint8_t *) ireq->i_data+off, ireq->i_len);
486 		free(p, M_TEMP);
487 	} else
488 		ireq->i_len = 0;
489 bad:
490 	if (ni != NULL)
491 		ieee80211_free_node(ni);
492 	return error;
493 }
494 
495 static __noinline int
496 ieee80211_ioctl_getstainfo(struct ieee80211vap *vap, struct ieee80211req *ireq)
497 {
498 	uint8_t macaddr[IEEE80211_ADDR_LEN];
499 	const int off = __offsetof(struct ieee80211req_sta_req, info);
500 	struct ieee80211_node *ni;
501 	int error;
502 
503 	if (ireq->i_len < sizeof(struct ieee80211req_sta_req))
504 		return EFAULT;
505 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
506 	if (error != 0)
507 		return error;
508 	if (IEEE80211_ADDR_EQ(macaddr, vap->iv_ifp->if_broadcastaddr)) {
509 		ni = NULL;
510 	} else {
511 		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
512 		if (ni == NULL)
513 			return ENOENT;
514 	}
515 	return getstainfo_common(vap, ireq, ni, off);
516 }
517 
518 static __noinline int
519 ieee80211_ioctl_getstatxpow(struct ieee80211vap *vap, struct ieee80211req *ireq)
520 {
521 	struct ieee80211_node *ni;
522 	struct ieee80211req_sta_txpow txpow;
523 	int error;
524 
525 	if (ireq->i_len != sizeof(txpow))
526 		return EINVAL;
527 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
528 	if (error != 0)
529 		return error;
530 	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, txpow.it_macaddr);
531 	if (ni == NULL)
532 		return ENOENT;
533 	txpow.it_txpow = ni->ni_txpower;
534 	error = copyout(&txpow, ireq->i_data, sizeof(txpow));
535 	ieee80211_free_node(ni);
536 	return error;
537 }
538 
539 static __noinline int
540 ieee80211_ioctl_getwmeparam(struct ieee80211vap *vap, struct ieee80211req *ireq)
541 {
542 	struct ieee80211com *ic = vap->iv_ic;
543 	struct ieee80211_wme_state *wme = &ic->ic_wme;
544 	struct wmeParams *wmep;
545 	int ac;
546 
547 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
548 		return EINVAL;
549 
550 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
551 	if (ac >= WME_NUM_AC)
552 		ac = WME_AC_BE;
553 	if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
554 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
555 	else
556 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
557 	switch (ireq->i_type) {
558 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
559 		ireq->i_val = wmep->wmep_logcwmin;
560 		break;
561 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
562 		ireq->i_val = wmep->wmep_logcwmax;
563 		break;
564 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
565 		ireq->i_val = wmep->wmep_aifsn;
566 		break;
567 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
568 		ireq->i_val = wmep->wmep_txopLimit;
569 		break;
570 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
571 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
572 		ireq->i_val = wmep->wmep_acm;
573 		break;
574 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
575 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
576 		ireq->i_val = !wmep->wmep_noackPolicy;
577 		break;
578 	}
579 	return 0;
580 }
581 
582 static __noinline int
583 ieee80211_ioctl_getmaccmd(struct ieee80211vap *vap, struct ieee80211req *ireq)
584 {
585 	const struct ieee80211_aclator *acl = vap->iv_acl;
586 
587 	return (acl == NULL ? EINVAL : acl->iac_getioctl(vap, ireq));
588 }
589 
590 /*
591  * Return the current ``state'' of an Atheros capbility.
592  * If associated in station mode report the negotiated
593  * setting. Otherwise report the current setting.
594  */
595 static int
596 getathcap(struct ieee80211vap *vap, int cap)
597 {
598 	if (vap->iv_opmode == IEEE80211_M_STA &&
599 	    vap->iv_state == IEEE80211_S_RUN)
600 		return IEEE80211_ATH_CAP(vap, vap->iv_bss, cap) != 0;
601 	else
602 		return (vap->iv_flags & cap) != 0;
603 }
604 
605 static __noinline int
606 ieee80211_ioctl_getcurchan(struct ieee80211vap *vap, struct ieee80211req *ireq)
607 {
608 	struct ieee80211com *ic = vap->iv_ic;
609 	struct ieee80211_channel *c;
610 
611 	if (ireq->i_len != sizeof(struct ieee80211_channel))
612 		return EINVAL;
613 	/*
614 	 * vap's may have different operating channels when HT is
615 	 * in use.  When in RUN state report the vap-specific channel.
616 	 * Otherwise return curchan.
617 	 */
618 	if (vap->iv_state == IEEE80211_S_RUN)
619 		c = vap->iv_bss->ni_chan;
620 	else
621 		c = ic->ic_curchan;
622 	return copyout(c, ireq->i_data, sizeof(*c));
623 }
624 
625 static int
626 getappie(const struct ieee80211_appie *aie, struct ieee80211req *ireq)
627 {
628 	if (aie == NULL)
629 		return EINVAL;
630 	/* NB: truncate, caller can check length */
631 	if (ireq->i_len > aie->ie_len)
632 		ireq->i_len = aie->ie_len;
633 	return copyout(aie->ie_data, ireq->i_data, ireq->i_len);
634 }
635 
636 static int
637 ieee80211_ioctl_getappie(struct ieee80211vap *vap, struct ieee80211req *ireq)
638 {
639 	uint8_t fc0;
640 
641 	fc0 = ireq->i_val & 0xff;
642 	if ((fc0 & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
643 		return EINVAL;
644 	/* NB: could check iv_opmode and reject but hardly worth the effort */
645 	switch (fc0 & IEEE80211_FC0_SUBTYPE_MASK) {
646 	case IEEE80211_FC0_SUBTYPE_BEACON:
647 		return getappie(vap->iv_appie_beacon, ireq);
648 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
649 		return getappie(vap->iv_appie_proberesp, ireq);
650 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
651 		return getappie(vap->iv_appie_assocresp, ireq);
652 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
653 		return getappie(vap->iv_appie_probereq, ireq);
654 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
655 		return getappie(vap->iv_appie_assocreq, ireq);
656 	case IEEE80211_FC0_SUBTYPE_BEACON|IEEE80211_FC0_SUBTYPE_PROBE_RESP:
657 		return getappie(vap->iv_appie_wpa, ireq);
658 	}
659 	return EINVAL;
660 }
661 
662 static __noinline int
663 ieee80211_ioctl_getregdomain(struct ieee80211vap *vap,
664 	const struct ieee80211req *ireq)
665 {
666 	struct ieee80211com *ic = vap->iv_ic;
667 
668 	if (ireq->i_len != sizeof(ic->ic_regdomain))
669 		return EINVAL;
670 	return copyout(&ic->ic_regdomain, ireq->i_data,
671 	    sizeof(ic->ic_regdomain));
672 }
673 
674 static __noinline int
675 ieee80211_ioctl_getroam(struct ieee80211vap *vap,
676 	const struct ieee80211req *ireq)
677 {
678 	size_t len = ireq->i_len;
679 	/* NB: accept short requests for backwards compat */
680 	if (len > sizeof(vap->iv_roamparms))
681 		len = sizeof(vap->iv_roamparms);
682 	return copyout(vap->iv_roamparms, ireq->i_data, len);
683 }
684 
685 static __noinline int
686 ieee80211_ioctl_gettxparams(struct ieee80211vap *vap,
687 	const struct ieee80211req *ireq)
688 {
689 	size_t len = ireq->i_len;
690 	/* NB: accept short requests for backwards compat */
691 	if (len > sizeof(vap->iv_txparms))
692 		len = sizeof(vap->iv_txparms);
693 	return copyout(vap->iv_txparms, ireq->i_data, len);
694 }
695 
696 static __noinline int
697 ieee80211_ioctl_getdevcaps(struct ieee80211com *ic,
698 	const struct ieee80211req *ireq)
699 {
700 	struct ieee80211_devcaps_req *dc;
701 	struct ieee80211req_chaninfo *ci;
702 	int maxchans, error;
703 
704 	maxchans = 1 + ((ireq->i_len - sizeof(struct ieee80211_devcaps_req)) /
705 	    sizeof(struct ieee80211_channel));
706 	/* NB: require 1 so we know ic_nchans is accessible */
707 	if (maxchans < 1)
708 		return EINVAL;
709 	/* constrain max request size, 2K channels is ~24Kbytes */
710 	if (maxchans > 2048)
711 		maxchans = 2048;
712 	dc = (struct ieee80211_devcaps_req *)
713 	    malloc(IEEE80211_DEVCAPS_SIZE(maxchans), M_TEMP, M_NOWAIT | M_ZERO);
714 	if (dc == NULL)
715 		return ENOMEM;
716 	dc->dc_drivercaps = ic->ic_caps;
717 	dc->dc_cryptocaps = ic->ic_cryptocaps;
718 	dc->dc_htcaps = ic->ic_htcaps;
719 	ci = &dc->dc_chaninfo;
720 	ic->ic_getradiocaps(ic, maxchans, &ci->ic_nchans, ci->ic_chans);
721 	KASSERT(ci->ic_nchans <= maxchans,
722 	    ("nchans %d maxchans %d", ci->ic_nchans, maxchans));
723 	ieee80211_sort_channels(ci->ic_chans, ci->ic_nchans);
724 	error = copyout(dc, ireq->i_data, IEEE80211_DEVCAPS_SPACE(dc));
725 	free(dc, M_TEMP);
726 	return error;
727 }
728 
729 static __noinline int
730 ieee80211_ioctl_getstavlan(struct ieee80211vap *vap, struct ieee80211req *ireq)
731 {
732 	struct ieee80211_node *ni;
733 	struct ieee80211req_sta_vlan vlan;
734 	int error;
735 
736 	if (ireq->i_len != sizeof(vlan))
737 		return EINVAL;
738 	error = copyin(ireq->i_data, &vlan, sizeof(vlan));
739 	if (error != 0)
740 		return error;
741 	if (!IEEE80211_ADDR_EQ(vlan.sv_macaddr, zerobssid)) {
742 		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
743 		    vlan.sv_macaddr);
744 		if (ni == NULL)
745 			return ENOENT;
746 	} else
747 		ni = ieee80211_ref_node(vap->iv_bss);
748 	vlan.sv_vlan = ni->ni_vlan;
749 	error = copyout(&vlan, ireq->i_data, sizeof(vlan));
750 	ieee80211_free_node(ni);
751 	return error;
752 }
753 
754 /*
755  * When building the kernel with -O2 on the i386 architecture, gcc
756  * seems to want to inline this function into ieee80211_ioctl()
757  * (which is the only routine that calls it). When this happens,
758  * ieee80211_ioctl() ends up consuming an additional 2K of stack
759  * space. (Exactly why it needs so much is unclear.) The problem
760  * is that it's possible for ieee80211_ioctl() to invoke other
761  * routines (including driver init functions) which could then find
762  * themselves perilously close to exhausting the stack.
763  *
764  * To avoid this, we deliberately prevent gcc from inlining this
765  * routine. Another way to avoid this is to use less agressive
766  * optimization when compiling this file (i.e. -O instead of -O2)
767  * but special-casing the compilation of this one module in the
768  * build system would be awkward.
769  */
770 static __noinline int
771 ieee80211_ioctl_get80211(struct ieee80211vap *vap, u_long cmd,
772     struct ieee80211req *ireq)
773 {
774 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
775 	struct ieee80211com *ic = vap->iv_ic;
776 	u_int kid, len;
777 	uint8_t tmpkey[IEEE80211_KEYBUF_SIZE];
778 	char tmpssid[IEEE80211_NWID_LEN];
779 	int error = 0;
780 
781 	switch (ireq->i_type) {
782 	case IEEE80211_IOC_SSID:
783 		switch (vap->iv_state) {
784 		case IEEE80211_S_INIT:
785 		case IEEE80211_S_SCAN:
786 			ireq->i_len = vap->iv_des_ssid[0].len;
787 			memcpy(tmpssid, vap->iv_des_ssid[0].ssid, ireq->i_len);
788 			break;
789 		default:
790 			ireq->i_len = vap->iv_bss->ni_esslen;
791 			memcpy(tmpssid, vap->iv_bss->ni_essid, ireq->i_len);
792 			break;
793 		}
794 		error = copyout(tmpssid, ireq->i_data, ireq->i_len);
795 		break;
796 	case IEEE80211_IOC_NUMSSIDS:
797 		ireq->i_val = 1;
798 		break;
799 	case IEEE80211_IOC_WEP:
800 		if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0)
801 			ireq->i_val = IEEE80211_WEP_OFF;
802 		else if (vap->iv_flags & IEEE80211_F_DROPUNENC)
803 			ireq->i_val = IEEE80211_WEP_ON;
804 		else
805 			ireq->i_val = IEEE80211_WEP_MIXED;
806 		break;
807 	case IEEE80211_IOC_WEPKEY:
808 		kid = (u_int) ireq->i_val;
809 		if (kid >= IEEE80211_WEP_NKID)
810 			return EINVAL;
811 		len = (u_int) vap->iv_nw_keys[kid].wk_keylen;
812 		/* NB: only root can read WEP keys */
813 		if (priv_check(curthread, PRIV_NET80211_GETKEY) == 0) {
814 			bcopy(vap->iv_nw_keys[kid].wk_key, tmpkey, len);
815 		} else {
816 			bzero(tmpkey, len);
817 		}
818 		ireq->i_len = len;
819 		error = copyout(tmpkey, ireq->i_data, len);
820 		break;
821 	case IEEE80211_IOC_NUMWEPKEYS:
822 		ireq->i_val = IEEE80211_WEP_NKID;
823 		break;
824 	case IEEE80211_IOC_WEPTXKEY:
825 		ireq->i_val = vap->iv_def_txkey;
826 		break;
827 	case IEEE80211_IOC_AUTHMODE:
828 		if (vap->iv_flags & IEEE80211_F_WPA)
829 			ireq->i_val = IEEE80211_AUTH_WPA;
830 		else
831 			ireq->i_val = vap->iv_bss->ni_authmode;
832 		break;
833 	case IEEE80211_IOC_CHANNEL:
834 		ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
835 		break;
836 	case IEEE80211_IOC_POWERSAVE:
837 		if (vap->iv_flags & IEEE80211_F_PMGTON)
838 			ireq->i_val = IEEE80211_POWERSAVE_ON;
839 		else
840 			ireq->i_val = IEEE80211_POWERSAVE_OFF;
841 		break;
842 	case IEEE80211_IOC_POWERSAVESLEEP:
843 		ireq->i_val = ic->ic_lintval;
844 		break;
845 	case IEEE80211_IOC_RTSTHRESHOLD:
846 		ireq->i_val = vap->iv_rtsthreshold;
847 		break;
848 	case IEEE80211_IOC_PROTMODE:
849 		ireq->i_val = ic->ic_protmode;
850 		break;
851 	case IEEE80211_IOC_TXPOWER:
852 		/*
853 		 * Tx power limit is the min of max regulatory
854 		 * power, any user-set limit, and the max the
855 		 * radio can do.
856 		 */
857 		ireq->i_val = 2*ic->ic_curchan->ic_maxregpower;
858 		if (ireq->i_val > ic->ic_txpowlimit)
859 			ireq->i_val = ic->ic_txpowlimit;
860 		if (ireq->i_val > ic->ic_curchan->ic_maxpower)
861 			ireq->i_val = ic->ic_curchan->ic_maxpower;
862 		break;
863 	case IEEE80211_IOC_WPA:
864 		switch (vap->iv_flags & IEEE80211_F_WPA) {
865 		case IEEE80211_F_WPA1:
866 			ireq->i_val = 1;
867 			break;
868 		case IEEE80211_F_WPA2:
869 			ireq->i_val = 2;
870 			break;
871 		case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
872 			ireq->i_val = 3;
873 			break;
874 		default:
875 			ireq->i_val = 0;
876 			break;
877 		}
878 		break;
879 	case IEEE80211_IOC_CHANLIST:
880 		error = ieee80211_ioctl_getchanlist(vap, ireq);
881 		break;
882 	case IEEE80211_IOC_ROAMING:
883 		ireq->i_val = vap->iv_roaming;
884 		break;
885 	case IEEE80211_IOC_PRIVACY:
886 		ireq->i_val = (vap->iv_flags & IEEE80211_F_PRIVACY) != 0;
887 		break;
888 	case IEEE80211_IOC_DROPUNENCRYPTED:
889 		ireq->i_val = (vap->iv_flags & IEEE80211_F_DROPUNENC) != 0;
890 		break;
891 	case IEEE80211_IOC_COUNTERMEASURES:
892 		ireq->i_val = (vap->iv_flags & IEEE80211_F_COUNTERM) != 0;
893 		break;
894 	case IEEE80211_IOC_WME:
895 		ireq->i_val = (vap->iv_flags & IEEE80211_F_WME) != 0;
896 		break;
897 	case IEEE80211_IOC_HIDESSID:
898 		ireq->i_val = (vap->iv_flags & IEEE80211_F_HIDESSID) != 0;
899 		break;
900 	case IEEE80211_IOC_APBRIDGE:
901 		ireq->i_val = (vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0;
902 		break;
903 	case IEEE80211_IOC_WPAKEY:
904 		error = ieee80211_ioctl_getkey(vap, ireq);
905 		break;
906 	case IEEE80211_IOC_CHANINFO:
907 		error = ieee80211_ioctl_getchaninfo(vap, ireq);
908 		break;
909 	case IEEE80211_IOC_BSSID:
910 		if (ireq->i_len != IEEE80211_ADDR_LEN)
911 			return EINVAL;
912 		error = copyout(vap->iv_state == IEEE80211_S_RUN ?
913 					vap->iv_bss->ni_bssid :
914 					vap->iv_des_bssid,
915 				ireq->i_data, ireq->i_len);
916 		break;
917 	case IEEE80211_IOC_WPAIE:
918 		error = ieee80211_ioctl_getwpaie(vap, ireq, ireq->i_type);
919 		break;
920 	case IEEE80211_IOC_WPAIE2:
921 		error = ieee80211_ioctl_getwpaie(vap, ireq, ireq->i_type);
922 		break;
923 	case IEEE80211_IOC_SCAN_RESULTS:
924 		error = ieee80211_ioctl_getscanresults(vap, ireq);
925 		break;
926 	case IEEE80211_IOC_STA_STATS:
927 		error = ieee80211_ioctl_getstastats(vap, ireq);
928 		break;
929 	case IEEE80211_IOC_TXPOWMAX:
930 		ireq->i_val = vap->iv_bss->ni_txpower;
931 		break;
932 	case IEEE80211_IOC_STA_TXPOW:
933 		error = ieee80211_ioctl_getstatxpow(vap, ireq);
934 		break;
935 	case IEEE80211_IOC_STA_INFO:
936 		error = ieee80211_ioctl_getstainfo(vap, ireq);
937 		break;
938 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
939 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
940 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
941 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
942 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
943 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
944 		error = ieee80211_ioctl_getwmeparam(vap, ireq);
945 		break;
946 	case IEEE80211_IOC_DTIM_PERIOD:
947 		ireq->i_val = vap->iv_dtim_period;
948 		break;
949 	case IEEE80211_IOC_BEACON_INTERVAL:
950 		/* NB: get from ic_bss for station mode */
951 		ireq->i_val = vap->iv_bss->ni_intval;
952 		break;
953 	case IEEE80211_IOC_PUREG:
954 		ireq->i_val = (vap->iv_flags & IEEE80211_F_PUREG) != 0;
955 		break;
956 	case IEEE80211_IOC_FF:
957 		ireq->i_val = getathcap(vap, IEEE80211_F_FF);
958 		break;
959 	case IEEE80211_IOC_TURBOP:
960 		ireq->i_val = getathcap(vap, IEEE80211_F_TURBOP);
961 		break;
962 	case IEEE80211_IOC_BGSCAN:
963 		ireq->i_val = (vap->iv_flags & IEEE80211_F_BGSCAN) != 0;
964 		break;
965 	case IEEE80211_IOC_BGSCAN_IDLE:
966 		ireq->i_val = vap->iv_bgscanidle*hz/1000;	/* ms */
967 		break;
968 	case IEEE80211_IOC_BGSCAN_INTERVAL:
969 		ireq->i_val = vap->iv_bgscanintvl/hz;		/* seconds */
970 		break;
971 	case IEEE80211_IOC_SCANVALID:
972 		ireq->i_val = vap->iv_scanvalid/hz;		/* seconds */
973 		break;
974 	case IEEE80211_IOC_FRAGTHRESHOLD:
975 		ireq->i_val = vap->iv_fragthreshold;
976 		break;
977 	case IEEE80211_IOC_MACCMD:
978 		error = ieee80211_ioctl_getmaccmd(vap, ireq);
979 		break;
980 	case IEEE80211_IOC_BURST:
981 		ireq->i_val = (vap->iv_flags & IEEE80211_F_BURST) != 0;
982 		break;
983 	case IEEE80211_IOC_BMISSTHRESHOLD:
984 		ireq->i_val = vap->iv_bmissthreshold;
985 		break;
986 	case IEEE80211_IOC_CURCHAN:
987 		error = ieee80211_ioctl_getcurchan(vap, ireq);
988 		break;
989 	case IEEE80211_IOC_SHORTGI:
990 		ireq->i_val = 0;
991 		if (vap->iv_flags_ext & IEEE80211_FEXT_SHORTGI20)
992 			ireq->i_val |= IEEE80211_HTCAP_SHORTGI20;
993 		if (vap->iv_flags_ext & IEEE80211_FEXT_SHORTGI40)
994 			ireq->i_val |= IEEE80211_HTCAP_SHORTGI40;
995 		break;
996 	case IEEE80211_IOC_AMPDU:
997 		ireq->i_val = 0;
998 		if (vap->iv_flags_ext & IEEE80211_FEXT_AMPDU_TX)
999 			ireq->i_val |= 1;
1000 		if (vap->iv_flags_ext & IEEE80211_FEXT_AMPDU_RX)
1001 			ireq->i_val |= 2;
1002 		break;
1003 	case IEEE80211_IOC_AMPDU_LIMIT:
1004 		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
1005 			ireq->i_val = vap->iv_ampdu_rxmax;
1006 		else if (vap->iv_state == IEEE80211_S_RUN)
1007 			ireq->i_val = MS(vap->iv_bss->ni_htparam,
1008 			    IEEE80211_HTCAP_MAXRXAMPDU);
1009 		else
1010 			ireq->i_val = vap->iv_ampdu_limit;
1011 		break;
1012 	case IEEE80211_IOC_AMPDU_DENSITY:
1013 		if (vap->iv_opmode == IEEE80211_M_STA &&
1014 		    vap->iv_state == IEEE80211_S_RUN)
1015 			ireq->i_val = MS(vap->iv_bss->ni_htparam,
1016 			    IEEE80211_HTCAP_MPDUDENSITY);
1017 		else
1018 			ireq->i_val = vap->iv_ampdu_density;
1019 		break;
1020 	case IEEE80211_IOC_AMSDU:
1021 		ireq->i_val = 0;
1022 		if (vap->iv_flags_ext & IEEE80211_FEXT_AMSDU_TX)
1023 			ireq->i_val |= 1;
1024 		if (vap->iv_flags_ext & IEEE80211_FEXT_AMSDU_RX)
1025 			ireq->i_val |= 2;
1026 		break;
1027 	case IEEE80211_IOC_AMSDU_LIMIT:
1028 		ireq->i_val = vap->iv_amsdu_limit;	/* XXX truncation? */
1029 		break;
1030 	case IEEE80211_IOC_PUREN:
1031 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_PUREN) != 0;
1032 		break;
1033 	case IEEE80211_IOC_DOTH:
1034 		ireq->i_val = (vap->iv_flags & IEEE80211_F_DOTH) != 0;
1035 		break;
1036 	case IEEE80211_IOC_REGDOMAIN:
1037 		error = ieee80211_ioctl_getregdomain(vap, ireq);
1038 		break;
1039 	case IEEE80211_IOC_ROAM:
1040 		error = ieee80211_ioctl_getroam(vap, ireq);
1041 		break;
1042 	case IEEE80211_IOC_TXPARAMS:
1043 		error = ieee80211_ioctl_gettxparams(vap, ireq);
1044 		break;
1045 	case IEEE80211_IOC_HTCOMPAT:
1046 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_HTCOMPAT) != 0;
1047 		break;
1048 	case IEEE80211_IOC_DWDS:
1049 		ireq->i_val = (vap->iv_flags & IEEE80211_F_DWDS) != 0;
1050 		break;
1051 	case IEEE80211_IOC_INACTIVITY:
1052 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_INACT) != 0;
1053 		break;
1054 	case IEEE80211_IOC_APPIE:
1055 		error = ieee80211_ioctl_getappie(vap, ireq);
1056 		break;
1057 	case IEEE80211_IOC_WPS:
1058 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_WPS) != 0;
1059 		break;
1060 	case IEEE80211_IOC_TSN:
1061 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_TSN) != 0;
1062 		break;
1063 	case IEEE80211_IOC_DFS:
1064 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_DFS) != 0;
1065 		break;
1066 	case IEEE80211_IOC_DOTD:
1067 		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_DOTD) != 0;
1068 		break;
1069 	case IEEE80211_IOC_DEVCAPS:
1070 		error = ieee80211_ioctl_getdevcaps(ic, ireq);
1071 		break;
1072 	case IEEE80211_IOC_HTPROTMODE:
1073 		ireq->i_val = ic->ic_htprotmode;
1074 		break;
1075 	case IEEE80211_IOC_HTCONF:
1076 		if (vap->iv_flags_ext & IEEE80211_FEXT_HT) {
1077 			ireq->i_val = 1;
1078 			if (vap->iv_flags_ext & IEEE80211_FEXT_USEHT40)
1079 				ireq->i_val |= 2;
1080 		} else
1081 			ireq->i_val = 0;
1082 		break;
1083 	case IEEE80211_IOC_STA_VLAN:
1084 		error = ieee80211_ioctl_getstavlan(vap, ireq);
1085 		break;
1086 	case IEEE80211_IOC_SMPS:
1087 		if (vap->iv_opmode == IEEE80211_M_STA &&
1088 		    vap->iv_state == IEEE80211_S_RUN) {
1089 			if (vap->iv_bss->ni_flags & IEEE80211_NODE_MIMO_RTS)
1090 				ireq->i_val = IEEE80211_HTCAP_SMPS_DYNAMIC;
1091 			else if (vap->iv_bss->ni_flags & IEEE80211_NODE_MIMO_PS)
1092 				ireq->i_val = IEEE80211_HTCAP_SMPS_ENA;
1093 			else
1094 				ireq->i_val = IEEE80211_HTCAP_SMPS_OFF;
1095 		} else
1096 			ireq->i_val = vap->iv_htcaps & IEEE80211_HTCAP_SMPS;
1097 		break;
1098 	case IEEE80211_IOC_RIFS:
1099 		if (vap->iv_opmode == IEEE80211_M_STA &&
1100 		    vap->iv_state == IEEE80211_S_RUN)
1101 			ireq->i_val =
1102 			    (vap->iv_bss->ni_flags & IEEE80211_NODE_RIFS) != 0;
1103 		else
1104 			ireq->i_val =
1105 			    (vap->iv_flags_ext & IEEE80211_FEXT_RIFS) != 0;
1106 		break;
1107 #ifdef IEEE80211_SUPPORT_TDMA
1108 	case IEEE80211_IOC_TDMA_SLOT:
1109 	case IEEE80211_IOC_TDMA_SLOTCNT:
1110 	case IEEE80211_IOC_TDMA_SLOTLEN:
1111 	case IEEE80211_IOC_TDMA_BINTERVAL:
1112 		error = ieee80211_tdma_ioctl_get80211(vap, ireq);
1113 		break;
1114 #endif
1115 	default:
1116 		error = EINVAL;
1117 		break;
1118 	}
1119 	return error;
1120 #undef MS
1121 }
1122 
1123 static __noinline int
1124 ieee80211_ioctl_setkey(struct ieee80211vap *vap, struct ieee80211req *ireq)
1125 {
1126 	struct ieee80211req_key ik;
1127 	struct ieee80211_node *ni;
1128 	struct ieee80211_key *wk;
1129 	uint16_t kid;
1130 	int error, i;
1131 
1132 	if (ireq->i_len != sizeof(ik))
1133 		return EINVAL;
1134 	error = copyin(ireq->i_data, &ik, sizeof(ik));
1135 	if (error)
1136 		return error;
1137 	/* NB: cipher support is verified by ieee80211_crypt_newkey */
1138 	/* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1139 	if (ik.ik_keylen > sizeof(ik.ik_keydata))
1140 		return E2BIG;
1141 	kid = ik.ik_keyix;
1142 	if (kid == IEEE80211_KEYIX_NONE) {
1143 		/* XXX unicast keys currently must be tx/rx */
1144 		if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1145 			return EINVAL;
1146 		if (vap->iv_opmode == IEEE80211_M_STA) {
1147 			ni = ieee80211_ref_node(vap->iv_bss);
1148 			if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
1149 				ieee80211_free_node(ni);
1150 				return EADDRNOTAVAIL;
1151 			}
1152 		} else {
1153 			ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
1154 				ik.ik_macaddr);
1155 			if (ni == NULL)
1156 				return ENOENT;
1157 		}
1158 		wk = &ni->ni_ucastkey;
1159 	} else {
1160 		if (kid >= IEEE80211_WEP_NKID)
1161 			return EINVAL;
1162 		wk = &vap->iv_nw_keys[kid];
1163 		/*
1164 		 * Global slots start off w/o any assigned key index.
1165 		 * Force one here for consistency with IEEE80211_IOC_WEPKEY.
1166 		 */
1167 		if (wk->wk_keyix == IEEE80211_KEYIX_NONE)
1168 			wk->wk_keyix = kid;
1169 		ni = NULL;
1170 	}
1171 	error = 0;
1172 	ieee80211_key_update_begin(vap);
1173 	if (ieee80211_crypto_newkey(vap, ik.ik_type, ik.ik_flags, wk)) {
1174 		wk->wk_keylen = ik.ik_keylen;
1175 		/* NB: MIC presence is implied by cipher type */
1176 		if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1177 			wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1178 		for (i = 0; i < IEEE80211_TID_SIZE; i++)
1179 			wk->wk_keyrsc[i] = ik.ik_keyrsc;
1180 		wk->wk_keytsc = 0;			/* new key, reset */
1181 		memset(wk->wk_key, 0, sizeof(wk->wk_key));
1182 		memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1183 		IEEE80211_ADDR_COPY(wk->wk_macaddr,
1184 		    ni != NULL ?  ni->ni_macaddr : ik.ik_macaddr);
1185 		if (!ieee80211_crypto_setkey(vap, wk))
1186 			error = EIO;
1187 		else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1188 			vap->iv_def_txkey = kid;
1189 	} else
1190 		error = ENXIO;
1191 	ieee80211_key_update_end(vap);
1192 	if (ni != NULL)
1193 		ieee80211_free_node(ni);
1194 	return error;
1195 }
1196 
1197 static __noinline int
1198 ieee80211_ioctl_delkey(struct ieee80211vap *vap, struct ieee80211req *ireq)
1199 {
1200 	struct ieee80211req_del_key dk;
1201 	int kid, error;
1202 
1203 	if (ireq->i_len != sizeof(dk))
1204 		return EINVAL;
1205 	error = copyin(ireq->i_data, &dk, sizeof(dk));
1206 	if (error)
1207 		return error;
1208 	kid = dk.idk_keyix;
1209 	/* XXX uint8_t -> uint16_t */
1210 	if (dk.idk_keyix == (uint8_t) IEEE80211_KEYIX_NONE) {
1211 		struct ieee80211_node *ni;
1212 
1213 		if (vap->iv_opmode == IEEE80211_M_STA) {
1214 			ni = ieee80211_ref_node(vap->iv_bss);
1215 			if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
1216 				ieee80211_free_node(ni);
1217 				return EADDRNOTAVAIL;
1218 			}
1219 		} else {
1220 			ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
1221 				dk.idk_macaddr);
1222 			if (ni == NULL)
1223 				return ENOENT;
1224 		}
1225 		/* XXX error return */
1226 		ieee80211_node_delucastkey(ni);
1227 		ieee80211_free_node(ni);
1228 	} else {
1229 		if (kid >= IEEE80211_WEP_NKID)
1230 			return EINVAL;
1231 		/* XXX error return */
1232 		ieee80211_crypto_delkey(vap, &vap->iv_nw_keys[kid]);
1233 	}
1234 	return 0;
1235 }
1236 
1237 struct mlmeop {
1238 	struct ieee80211vap *vap;
1239 	int	op;
1240 	int	reason;
1241 };
1242 
1243 static void
1244 mlmedebug(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
1245 	int op, int reason)
1246 {
1247 #ifdef IEEE80211_DEBUG
1248 	static const struct {
1249 		int mask;
1250 		const char *opstr;
1251 	} ops[] = {
1252 		{ 0, "op#0" },
1253 		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1254 		  IEEE80211_MSG_ASSOC, "assoc" },
1255 		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1256 		  IEEE80211_MSG_ASSOC, "disassoc" },
1257 		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1258 		  IEEE80211_MSG_AUTH, "deauth" },
1259 		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1260 		  IEEE80211_MSG_AUTH, "authorize" },
1261 		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1262 		  IEEE80211_MSG_AUTH, "unauthorize" },
1263 	};
1264 
1265 	if (op == IEEE80211_MLME_AUTH) {
1266 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_IOCTL |
1267 		    IEEE80211_MSG_STATE | IEEE80211_MSG_AUTH, mac,
1268 		    "station authenticate %s via MLME (reason %d)",
1269 		    reason == IEEE80211_STATUS_SUCCESS ? "ACCEPT" : "REJECT",
1270 		    reason);
1271 	} else if (!(IEEE80211_MLME_ASSOC <= op && op <= IEEE80211_MLME_AUTH)) {
1272 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, mac,
1273 		    "unknown MLME request %d (reason %d)", op, reason);
1274 	} else if (reason == IEEE80211_STATUS_SUCCESS) {
1275 		IEEE80211_NOTE_MAC(vap, ops[op].mask, mac,
1276 		    "station %s via MLME", ops[op].opstr);
1277 	} else {
1278 		IEEE80211_NOTE_MAC(vap, ops[op].mask, mac,
1279 		    "station %s via MLME (reason %d)", ops[op].opstr, reason);
1280 	}
1281 #endif /* IEEE80211_DEBUG */
1282 }
1283 
1284 static void
1285 domlme(void *arg, struct ieee80211_node *ni)
1286 {
1287 	struct mlmeop *mop = arg;
1288 	struct ieee80211vap *vap = ni->ni_vap;
1289 
1290 	if (vap != mop->vap)
1291 		return;
1292 	/*
1293 	 * NB: if ni_associd is zero then the node is already cleaned
1294 	 * up and we don't need to do this (we're safely holding a
1295 	 * reference but should otherwise not modify it's state).
1296 	 */
1297 	if (ni->ni_associd == 0)
1298 		return;
1299 	mlmedebug(vap, ni->ni_macaddr, mop->op, mop->reason);
1300 	if (mop->op == IEEE80211_MLME_DEAUTH) {
1301 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
1302 		    mop->reason);
1303 	} else {
1304 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC,
1305 		    mop->reason);
1306 	}
1307 	ieee80211_node_leave(ni);
1308 }
1309 
1310 static int
1311 setmlme_dropsta(struct ieee80211vap *vap,
1312 	const uint8_t mac[IEEE80211_ADDR_LEN], struct mlmeop *mlmeop)
1313 {
1314 	struct ieee80211com *ic = vap->iv_ic;
1315 	struct ieee80211_node_table *nt = &ic->ic_sta;
1316 	struct ieee80211_node *ni;
1317 	int error = 0;
1318 
1319 	/* NB: the broadcast address means do 'em all */
1320 	if (!IEEE80211_ADDR_EQ(mac, ic->ic_ifp->if_broadcastaddr)) {
1321 		IEEE80211_NODE_LOCK(nt);
1322 		ni = ieee80211_find_node_locked(nt, mac);
1323 		if (ni != NULL) {
1324 			domlme(mlmeop, ni);
1325 			ieee80211_free_node(ni);
1326 		} else
1327 			error = ENOENT;
1328 		IEEE80211_NODE_UNLOCK(nt);
1329 	} else {
1330 		ieee80211_iterate_nodes(nt, domlme, mlmeop);
1331 	}
1332 	return error;
1333 }
1334 
1335 static __noinline int
1336 setmlme_common(struct ieee80211vap *vap, int op,
1337 	const uint8_t mac[IEEE80211_ADDR_LEN], int reason)
1338 {
1339 	struct ieee80211com *ic = vap->iv_ic;
1340 	struct ieee80211_node_table *nt = &ic->ic_sta;
1341 	struct ieee80211_node *ni;
1342 	struct mlmeop mlmeop;
1343 	int error;
1344 
1345 	error = 0;
1346 	switch (op) {
1347 	case IEEE80211_MLME_DISASSOC:
1348 	case IEEE80211_MLME_DEAUTH:
1349 		switch (vap->iv_opmode) {
1350 		case IEEE80211_M_STA:
1351 			mlmedebug(vap, vap->iv_bss->ni_macaddr, op, reason);
1352 			/* XXX not quite right */
1353 			ieee80211_new_state(vap, IEEE80211_S_INIT, reason);
1354 			break;
1355 		case IEEE80211_M_HOSTAP:
1356 			mlmeop.vap = vap;
1357 			mlmeop.op = op;
1358 			mlmeop.reason = reason;
1359 			error = setmlme_dropsta(vap, mac, &mlmeop);
1360 			break;
1361 		case IEEE80211_M_WDS:
1362 			/* XXX user app should send raw frame? */
1363 			if (op != IEEE80211_MLME_DEAUTH) {
1364 				error = EINVAL;
1365 				break;
1366 			}
1367 #if 0
1368 			/* XXX accept any address, simplifies user code */
1369 			if (!IEEE80211_ADDR_EQ(mac, vap->iv_bss->ni_macaddr)) {
1370 				error = EINVAL;
1371 				break;
1372 			}
1373 #endif
1374 			mlmedebug(vap, vap->iv_bss->ni_macaddr, op, reason);
1375 			ni = ieee80211_ref_node(vap->iv_bss);
1376 			IEEE80211_SEND_MGMT(ni,
1377 			    IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
1378 			ieee80211_free_node(ni);
1379 			break;
1380 		default:
1381 			error = EINVAL;
1382 			break;
1383 		}
1384 		break;
1385 	case IEEE80211_MLME_AUTHORIZE:
1386 	case IEEE80211_MLME_UNAUTHORIZE:
1387 		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
1388 		    vap->iv_opmode != IEEE80211_M_WDS) {
1389 			error = EINVAL;
1390 			break;
1391 		}
1392 		IEEE80211_NODE_LOCK(nt);
1393 		ni = ieee80211_find_vap_node_locked(nt, vap, mac);
1394 		if (ni != NULL) {
1395 			mlmedebug(vap, mac, op, reason);
1396 			if (op == IEEE80211_MLME_AUTHORIZE)
1397 				ieee80211_node_authorize(ni);
1398 			else
1399 				ieee80211_node_unauthorize(ni);
1400 			ieee80211_free_node(ni);
1401 		} else
1402 			error = ENOENT;
1403 		IEEE80211_NODE_UNLOCK(nt);
1404 		break;
1405 	case IEEE80211_MLME_AUTH:
1406 		if (vap->iv_opmode != IEEE80211_M_HOSTAP) {
1407 			error = EINVAL;
1408 			break;
1409 		}
1410 		IEEE80211_NODE_LOCK(nt);
1411 		ni = ieee80211_find_vap_node_locked(nt, vap, mac);
1412 		if (ni != NULL) {
1413 			mlmedebug(vap, mac, op, reason);
1414 			if (reason == IEEE80211_STATUS_SUCCESS) {
1415 				IEEE80211_SEND_MGMT(ni,
1416 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
1417 				/*
1418 				 * For shared key auth, just continue the
1419 				 * exchange.  Otherwise when 802.1x is not in
1420 				 * use mark the port authorized at this point
1421 				 * so traffic can flow.
1422 				 */
1423 				if (ni->ni_authmode != IEEE80211_AUTH_8021X &&
1424 				    ni->ni_challenge == NULL)
1425 				      ieee80211_node_authorize(ni);
1426 			} else {
1427 				vap->iv_stats.is_rx_acl++;
1428 				ieee80211_send_error(ni, ni->ni_macaddr,
1429 				    IEEE80211_FC0_SUBTYPE_AUTH, 2|(reason<<16));
1430 				ieee80211_node_leave(ni);
1431 			}
1432 			ieee80211_free_node(ni);
1433 		} else
1434 			error = ENOENT;
1435 		IEEE80211_NODE_UNLOCK(nt);
1436 		break;
1437 	default:
1438 		error = EINVAL;
1439 		break;
1440 	}
1441 	return error;
1442 }
1443 
1444 struct scanlookup {
1445 	const uint8_t *mac;
1446 	int esslen;
1447 	const uint8_t *essid;
1448 	const struct ieee80211_scan_entry *se;
1449 };
1450 
1451 /*
1452  * Match mac address and any ssid.
1453  */
1454 static void
1455 mlmelookup(void *arg, const struct ieee80211_scan_entry *se)
1456 {
1457 	struct scanlookup *look = arg;
1458 
1459 	if (!IEEE80211_ADDR_EQ(look->mac, se->se_macaddr))
1460 		return;
1461 	if (look->esslen != 0) {
1462 		if (se->se_ssid[1] != look->esslen)
1463 			return;
1464 		if (memcmp(look->essid, se->se_ssid+2, look->esslen))
1465 			return;
1466 	}
1467 	look->se = se;
1468 }
1469 
1470 static __noinline int
1471 setmlme_assoc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
1472 	int ssid_len, const uint8_t ssid[IEEE80211_NWID_LEN])
1473 {
1474 	struct scanlookup lookup;
1475 
1476 	/* XXX ibss/ahdemo */
1477 	if (vap->iv_opmode != IEEE80211_M_STA)
1478 		return EINVAL;
1479 
1480 	/* NB: this is racey if roaming is !manual */
1481 	lookup.se = NULL;
1482 	lookup.mac = mac;
1483 	lookup.esslen = ssid_len;
1484 	lookup.essid = ssid;
1485 	ieee80211_scan_iterate(vap, mlmelookup, &lookup);
1486 	if (lookup.se == NULL)
1487 		return ENOENT;
1488 	mlmedebug(vap, mac, IEEE80211_MLME_ASSOC, 0);
1489 	if (!ieee80211_sta_join(vap, lookup.se->se_chan, lookup.se))
1490 		return EIO;		/* XXX unique but could be better */
1491 	return 0;
1492 }
1493 
1494 static __noinline int
1495 ieee80211_ioctl_setmlme(struct ieee80211vap *vap, struct ieee80211req *ireq)
1496 {
1497 	struct ieee80211req_mlme mlme;
1498 	int error;
1499 
1500 	if (ireq->i_len != sizeof(mlme))
1501 		return EINVAL;
1502 	error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1503 	if (error)
1504 		return error;
1505 	if  (mlme.im_op == IEEE80211_MLME_ASSOC)
1506 		return setmlme_assoc(vap, mlme.im_macaddr,
1507 		    vap->iv_des_ssid[0].len, vap->iv_des_ssid[0].ssid);
1508 	else
1509 		return setmlme_common(vap, mlme.im_op,
1510 		    mlme.im_macaddr, mlme.im_reason);
1511 }
1512 
1513 static __noinline int
1514 ieee80211_ioctl_macmac(struct ieee80211vap *vap, struct ieee80211req *ireq)
1515 {
1516 	uint8_t mac[IEEE80211_ADDR_LEN];
1517 	const struct ieee80211_aclator *acl = vap->iv_acl;
1518 	int error;
1519 
1520 	if (ireq->i_len != sizeof(mac))
1521 		return EINVAL;
1522 	error = copyin(ireq->i_data, mac, ireq->i_len);
1523 	if (error)
1524 		return error;
1525 	if (acl == NULL) {
1526 		acl = ieee80211_aclator_get("mac");
1527 		if (acl == NULL || !acl->iac_attach(vap))
1528 			return EINVAL;
1529 		vap->iv_acl = acl;
1530 	}
1531 	if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1532 		acl->iac_add(vap, mac);
1533 	else
1534 		acl->iac_remove(vap, mac);
1535 	return 0;
1536 }
1537 
1538 static __noinline int
1539 ieee80211_ioctl_setmaccmd(struct ieee80211vap *vap, struct ieee80211req *ireq)
1540 {
1541 	const struct ieee80211_aclator *acl = vap->iv_acl;
1542 
1543 	switch (ireq->i_val) {
1544 	case IEEE80211_MACCMD_POLICY_OPEN:
1545 	case IEEE80211_MACCMD_POLICY_ALLOW:
1546 	case IEEE80211_MACCMD_POLICY_DENY:
1547 	case IEEE80211_MACCMD_POLICY_RADIUS:
1548 		if (acl == NULL) {
1549 			acl = ieee80211_aclator_get("mac");
1550 			if (acl == NULL || !acl->iac_attach(vap))
1551 				return EINVAL;
1552 			vap->iv_acl = acl;
1553 		}
1554 		acl->iac_setpolicy(vap, ireq->i_val);
1555 		break;
1556 	case IEEE80211_MACCMD_FLUSH:
1557 		if (acl != NULL)
1558 			acl->iac_flush(vap);
1559 		/* NB: silently ignore when not in use */
1560 		break;
1561 	case IEEE80211_MACCMD_DETACH:
1562 		if (acl != NULL) {
1563 			vap->iv_acl = NULL;
1564 			acl->iac_detach(vap);
1565 		}
1566 		break;
1567 	default:
1568 		if (acl == NULL)
1569 			return EINVAL;
1570 		else
1571 			return acl->iac_setioctl(vap, ireq);
1572 	}
1573 	return 0;
1574 }
1575 
1576 static __noinline int
1577 ieee80211_ioctl_setchanlist(struct ieee80211vap *vap, struct ieee80211req *ireq)
1578 {
1579 	struct ieee80211com *ic = vap->iv_ic;
1580 	uint8_t *chanlist, *list;
1581 	int i, nchan, maxchan, error;
1582 
1583 	if (ireq->i_len > sizeof(ic->ic_chan_active))
1584 		ireq->i_len = sizeof(ic->ic_chan_active);
1585 	list = malloc(ireq->i_len + IEEE80211_CHAN_BYTES, M_TEMP,
1586 	    M_NOWAIT | M_ZERO);
1587 	if (list == NULL)
1588 		return ENOMEM;
1589 	error = copyin(ireq->i_data, list, ireq->i_len);
1590 	if (error)
1591 		return error;
1592 	nchan = 0;
1593 	chanlist = list + ireq->i_len;		/* NB: zero'd already */
1594 	maxchan = ireq->i_len * NBBY;
1595 	for (i = 0; i < ic->ic_nchans; i++) {
1596 		const struct ieee80211_channel *c = &ic->ic_channels[i];
1597 		/*
1598 		 * Calculate the intersection of the user list and the
1599 		 * available channels so users can do things like specify
1600 		 * 1-255 to get all available channels.
1601 		 */
1602 		if (c->ic_ieee < maxchan && isset(list, c->ic_ieee)) {
1603 			setbit(chanlist, c->ic_ieee);
1604 			nchan++;
1605 		}
1606 	}
1607 	if (nchan == 0)
1608 		return EINVAL;
1609 	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&	/* XXX */
1610 	    isclr(chanlist, ic->ic_bsschan->ic_ieee))
1611 		ic->ic_bsschan = IEEE80211_CHAN_ANYC;
1612 	memcpy(ic->ic_chan_active, chanlist, IEEE80211_CHAN_BYTES);
1613 	ieee80211_scan_flush(vap);
1614 	free(list, M_TEMP);
1615 	return ENETRESET;
1616 }
1617 
1618 static __noinline int
1619 ieee80211_ioctl_setstastats(struct ieee80211vap *vap, struct ieee80211req *ireq)
1620 {
1621 	struct ieee80211_node *ni;
1622 	uint8_t macaddr[IEEE80211_ADDR_LEN];
1623 	int error;
1624 
1625 	/*
1626 	 * NB: we could copyin ieee80211req_sta_stats so apps
1627 	 *     could make selective changes but that's overkill;
1628 	 *     just clear all stats for now.
1629 	 */
1630 	if (ireq->i_len < IEEE80211_ADDR_LEN)
1631 		return EINVAL;
1632 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
1633 	if (error != 0)
1634 		return error;
1635 	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
1636 	if (ni == NULL)
1637 		return ENOENT;
1638 	/* XXX require ni_vap == vap? */
1639 	memset(&ni->ni_stats, 0, sizeof(ni->ni_stats));
1640 	ieee80211_free_node(ni);
1641 	return 0;
1642 }
1643 
1644 static __noinline int
1645 ieee80211_ioctl_setstatxpow(struct ieee80211vap *vap, struct ieee80211req *ireq)
1646 {
1647 	struct ieee80211_node *ni;
1648 	struct ieee80211req_sta_txpow txpow;
1649 	int error;
1650 
1651 	if (ireq->i_len != sizeof(txpow))
1652 		return EINVAL;
1653 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1654 	if (error != 0)
1655 		return error;
1656 	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, txpow.it_macaddr);
1657 	if (ni == NULL)
1658 		return ENOENT;
1659 	ni->ni_txpower = txpow.it_txpow;
1660 	ieee80211_free_node(ni);
1661 	return error;
1662 }
1663 
1664 static __noinline int
1665 ieee80211_ioctl_setwmeparam(struct ieee80211vap *vap, struct ieee80211req *ireq)
1666 {
1667 	struct ieee80211com *ic = vap->iv_ic;
1668 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1669 	struct wmeParams *wmep, *chanp;
1670 	int isbss, ac;
1671 
1672 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1673 		return EOPNOTSUPP;
1674 
1675 	isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1676 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1677 	if (ac >= WME_NUM_AC)
1678 		ac = WME_AC_BE;
1679 	if (isbss) {
1680 		chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1681 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1682 	} else {
1683 		chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1684 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1685 	}
1686 	switch (ireq->i_type) {
1687 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1688 		if (isbss) {
1689 			wmep->wmep_logcwmin = ireq->i_val;
1690 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1691 				chanp->wmep_logcwmin = ireq->i_val;
1692 		} else {
1693 			wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1694 				ireq->i_val;
1695 		}
1696 		break;
1697 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1698 		if (isbss) {
1699 			wmep->wmep_logcwmax = ireq->i_val;
1700 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1701 				chanp->wmep_logcwmax = ireq->i_val;
1702 		} else {
1703 			wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1704 				ireq->i_val;
1705 		}
1706 		break;
1707 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1708 		if (isbss) {
1709 			wmep->wmep_aifsn = ireq->i_val;
1710 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1711 				chanp->wmep_aifsn = ireq->i_val;
1712 		} else {
1713 			wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
1714 		}
1715 		break;
1716 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1717 		if (isbss) {
1718 			wmep->wmep_txopLimit = ireq->i_val;
1719 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1720 				chanp->wmep_txopLimit = ireq->i_val;
1721 		} else {
1722 			wmep->wmep_txopLimit = chanp->wmep_txopLimit =
1723 				ireq->i_val;
1724 		}
1725 		break;
1726 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1727 		wmep->wmep_acm = ireq->i_val;
1728 		if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1729 			chanp->wmep_acm = ireq->i_val;
1730 		break;
1731 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1732 		wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1733 			(ireq->i_val) == 0;
1734 		break;
1735 	}
1736 	ieee80211_wme_updateparams(vap);
1737 	return 0;
1738 }
1739 
1740 static int
1741 find11gchannel(struct ieee80211com *ic, int start, int freq)
1742 {
1743 	const struct ieee80211_channel *c;
1744 	int i;
1745 
1746 	for (i = start+1; i < ic->ic_nchans; i++) {
1747 		c = &ic->ic_channels[i];
1748 		if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
1749 			return 1;
1750 	}
1751 	/* NB: should not be needed but in case things are mis-sorted */
1752 	for (i = 0; i < start; i++) {
1753 		c = &ic->ic_channels[i];
1754 		if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
1755 			return 1;
1756 	}
1757 	return 0;
1758 }
1759 
1760 static struct ieee80211_channel *
1761 findchannel(struct ieee80211com *ic, int ieee, int mode)
1762 {
1763 	static const u_int chanflags[IEEE80211_MODE_MAX] = {
1764 	    [IEEE80211_MODE_AUTO]	= 0,
1765 	    [IEEE80211_MODE_11A]	= IEEE80211_CHAN_A,
1766 	    [IEEE80211_MODE_11B]	= IEEE80211_CHAN_B,
1767 	    [IEEE80211_MODE_11G]	= IEEE80211_CHAN_G,
1768 	    [IEEE80211_MODE_FH]		= IEEE80211_CHAN_FHSS,
1769 	    [IEEE80211_MODE_TURBO_A]	= IEEE80211_CHAN_108A,
1770 	    [IEEE80211_MODE_TURBO_G]	= IEEE80211_CHAN_108G,
1771 	    [IEEE80211_MODE_STURBO_A]	= IEEE80211_CHAN_STURBO,
1772 	    [IEEE80211_MODE_HALF]	= IEEE80211_CHAN_HALF,
1773 	    [IEEE80211_MODE_QUARTER]	= IEEE80211_CHAN_QUARTER,
1774 	    /* NB: handled specially below */
1775 	    [IEEE80211_MODE_11NA]	= IEEE80211_CHAN_A,
1776 	    [IEEE80211_MODE_11NG]	= IEEE80211_CHAN_G,
1777 	};
1778 	u_int modeflags;
1779 	int i;
1780 
1781 	modeflags = chanflags[mode];
1782 	for (i = 0; i < ic->ic_nchans; i++) {
1783 		struct ieee80211_channel *c = &ic->ic_channels[i];
1784 
1785 		if (c->ic_ieee != ieee)
1786 			continue;
1787 		if (mode == IEEE80211_MODE_AUTO) {
1788 			/* ignore turbo channels for autoselect */
1789 			if (IEEE80211_IS_CHAN_TURBO(c))
1790 				continue;
1791 			/*
1792 			 * XXX special-case 11b/g channels so we
1793 			 *     always select the g channel if both
1794 			 *     are present.
1795 			 * XXX prefer HT to non-HT?
1796 			 */
1797 			if (!IEEE80211_IS_CHAN_B(c) ||
1798 			    !find11gchannel(ic, i, c->ic_freq))
1799 				return c;
1800 		} else {
1801 			/* must check HT specially */
1802 			if ((mode == IEEE80211_MODE_11NA ||
1803 			    mode == IEEE80211_MODE_11NG) &&
1804 			    !IEEE80211_IS_CHAN_HT(c))
1805 				continue;
1806 			if ((c->ic_flags & modeflags) == modeflags)
1807 				return c;
1808 		}
1809 	}
1810 	return NULL;
1811 }
1812 
1813 /*
1814  * Check the specified against any desired mode (aka netband).
1815  * This is only used (presently) when operating in hostap mode
1816  * to enforce consistency.
1817  */
1818 static int
1819 check_mode_consistency(const struct ieee80211_channel *c, int mode)
1820 {
1821 	KASSERT(c != IEEE80211_CHAN_ANYC, ("oops, no channel"));
1822 
1823 	switch (mode) {
1824 	case IEEE80211_MODE_11B:
1825 		return (IEEE80211_IS_CHAN_B(c));
1826 	case IEEE80211_MODE_11G:
1827 		return (IEEE80211_IS_CHAN_ANYG(c) && !IEEE80211_IS_CHAN_HT(c));
1828 	case IEEE80211_MODE_11A:
1829 		return (IEEE80211_IS_CHAN_A(c) && !IEEE80211_IS_CHAN_HT(c));
1830 	case IEEE80211_MODE_STURBO_A:
1831 		return (IEEE80211_IS_CHAN_STURBO(c));
1832 	case IEEE80211_MODE_11NA:
1833 		return (IEEE80211_IS_CHAN_HTA(c));
1834 	case IEEE80211_MODE_11NG:
1835 		return (IEEE80211_IS_CHAN_HTG(c));
1836 	}
1837 	return 1;
1838 
1839 }
1840 
1841 /*
1842  * Common code to set the current channel.  If the device
1843  * is up and running this may result in an immediate channel
1844  * change or a kick of the state machine.
1845  */
1846 static int
1847 setcurchan(struct ieee80211vap *vap, struct ieee80211_channel *c)
1848 {
1849 	struct ieee80211com *ic = vap->iv_ic;
1850 	int error;
1851 
1852 	if (c != IEEE80211_CHAN_ANYC) {
1853 		if (IEEE80211_IS_CHAN_RADAR(c))
1854 			return EBUSY;	/* XXX better code? */
1855 		if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1856 			if (IEEE80211_IS_CHAN_NOHOSTAP(c))
1857 				return EINVAL;
1858 			if (!check_mode_consistency(c, vap->iv_des_mode))
1859 				return EINVAL;
1860 		} else if (vap->iv_opmode == IEEE80211_M_IBSS) {
1861 			if (IEEE80211_IS_CHAN_NOADHOC(c))
1862 				return EINVAL;
1863 		}
1864 		if (vap->iv_state == IEEE80211_S_RUN &&
1865 		    vap->iv_bss->ni_chan == c)
1866 			return 0;	/* NB: nothing to do */
1867 	}
1868 	vap->iv_des_chan = c;
1869 
1870 	error = 0;
1871 	if (vap->iv_opmode == IEEE80211_M_MONITOR &&
1872 	    vap->iv_des_chan != IEEE80211_CHAN_ANYC) {
1873 		/*
1874 		 * Monitor mode can switch directly.
1875 		 */
1876 		if (IFNET_IS_UP_RUNNING(vap->iv_ifp)) {
1877 			/* XXX need state machine for other vap's to follow */
1878 			ieee80211_setcurchan(ic, vap->iv_des_chan);
1879 			vap->iv_bss->ni_chan = ic->ic_curchan;
1880 		} else
1881 			ic->ic_curchan = vap->iv_des_chan;
1882 	} else {
1883 		/*
1884 		 * Need to go through the state machine in case we
1885 		 * need to reassociate or the like.  The state machine
1886 		 * will pickup the desired channel and avoid scanning.
1887 		 */
1888 		if (IS_UP_AUTO(vap))
1889 			ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
1890 		else if (vap->iv_des_chan != IEEE80211_CHAN_ANYC) {
1891 			/*
1892 			 * When not up+running and a real channel has
1893 			 * been specified fix the current channel so
1894 			 * there is immediate feedback; e.g. via ifconfig.
1895 			 */
1896 			ic->ic_curchan = vap->iv_des_chan;
1897 		}
1898 	}
1899 	return error;
1900 }
1901 
1902 /*
1903  * Old api for setting the current channel; this is
1904  * deprecated because channel numbers are ambiguous.
1905  */
1906 static __noinline int
1907 ieee80211_ioctl_setchannel(struct ieee80211vap *vap,
1908 	const struct ieee80211req *ireq)
1909 {
1910 	struct ieee80211com *ic = vap->iv_ic;
1911 	struct ieee80211_channel *c;
1912 
1913 	/* XXX 0xffff overflows 16-bit signed */
1914 	if (ireq->i_val == 0 ||
1915 	    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY) {
1916 		c = IEEE80211_CHAN_ANYC;
1917 	} else {
1918 		struct ieee80211_channel *c2;
1919 
1920 		c = findchannel(ic, ireq->i_val, vap->iv_des_mode);
1921 		if (c == NULL) {
1922 			c = findchannel(ic, ireq->i_val,
1923 				IEEE80211_MODE_AUTO);
1924 			if (c == NULL)
1925 				return EINVAL;
1926 		}
1927 		/*
1928 		 * Fine tune channel selection based on desired mode:
1929 		 *   if 11b is requested, find the 11b version of any
1930 		 *      11g channel returned,
1931 		 *   if static turbo, find the turbo version of any
1932 		 *	11a channel return,
1933 		 *   if 11na is requested, find the ht version of any
1934 		 *      11a channel returned,
1935 		 *   if 11ng is requested, find the ht version of any
1936 		 *      11g channel returned,
1937 		 *   otherwise we should be ok with what we've got.
1938 		 */
1939 		switch (vap->iv_des_mode) {
1940 		case IEEE80211_MODE_11B:
1941 			if (IEEE80211_IS_CHAN_ANYG(c)) {
1942 				c2 = findchannel(ic, ireq->i_val,
1943 					IEEE80211_MODE_11B);
1944 				/* NB: should not happen, =>'s 11g w/o 11b */
1945 				if (c2 != NULL)
1946 					c = c2;
1947 			}
1948 			break;
1949 		case IEEE80211_MODE_TURBO_A:
1950 			if (IEEE80211_IS_CHAN_A(c)) {
1951 				c2 = findchannel(ic, ireq->i_val,
1952 					IEEE80211_MODE_TURBO_A);
1953 				if (c2 != NULL)
1954 					c = c2;
1955 			}
1956 			break;
1957 		case IEEE80211_MODE_11NA:
1958 			if (IEEE80211_IS_CHAN_A(c)) {
1959 				c2 = findchannel(ic, ireq->i_val,
1960 					IEEE80211_MODE_11NA);
1961 				if (c2 != NULL)
1962 					c = c2;
1963 			}
1964 			break;
1965 		case IEEE80211_MODE_11NG:
1966 			if (IEEE80211_IS_CHAN_ANYG(c)) {
1967 				c2 = findchannel(ic, ireq->i_val,
1968 					IEEE80211_MODE_11NG);
1969 				if (c2 != NULL)
1970 					c = c2;
1971 			}
1972 			break;
1973 		default:		/* NB: no static turboG */
1974 			break;
1975 		}
1976 	}
1977 	return setcurchan(vap, c);
1978 }
1979 
1980 /*
1981  * New/current api for setting the current channel; a complete
1982  * channel description is provide so there is no ambiguity in
1983  * identifying the channel.
1984  */
1985 static __noinline int
1986 ieee80211_ioctl_setcurchan(struct ieee80211vap *vap,
1987 	const struct ieee80211req *ireq)
1988 {
1989 	struct ieee80211com *ic = vap->iv_ic;
1990 	struct ieee80211_channel chan, *c;
1991 	int error;
1992 
1993 	if (ireq->i_len != sizeof(chan))
1994 		return EINVAL;
1995 	error = copyin(ireq->i_data, &chan, sizeof(chan));
1996 	if (error != 0)
1997 		return error;
1998 	/* XXX 0xffff overflows 16-bit signed */
1999 	if (chan.ic_freq == 0 || chan.ic_freq == IEEE80211_CHAN_ANY) {
2000 		c = IEEE80211_CHAN_ANYC;
2001 	} else {
2002 		c = ieee80211_find_channel(ic, chan.ic_freq, chan.ic_flags);
2003 		if (c == NULL)
2004 			return EINVAL;
2005 	}
2006 	return setcurchan(vap, c);
2007 }
2008 
2009 static __noinline int
2010 ieee80211_ioctl_setregdomain(struct ieee80211vap *vap,
2011 	const struct ieee80211req *ireq)
2012 {
2013 	struct ieee80211_regdomain_req *reg;
2014 	int nchans, error;
2015 
2016 	nchans = 1 + ((ireq->i_len - sizeof(struct ieee80211_regdomain_req)) /
2017 	    sizeof(struct ieee80211_channel));
2018 	if (!(1 <= nchans && nchans <= IEEE80211_CHAN_MAX)) {
2019 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_IOCTL,
2020 		    "%s: bad # chans, i_len %d nchans %d\n", __func__,
2021 		    ireq->i_len, nchans);
2022 		return EINVAL;
2023 	}
2024 	reg = (struct ieee80211_regdomain_req *)
2025 	    malloc(IEEE80211_REGDOMAIN_SIZE(nchans), M_TEMP, M_NOWAIT);
2026 	if (reg == NULL) {
2027 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_IOCTL,
2028 		    "%s: no memory, nchans %d\n", __func__, nchans);
2029 		return ENOMEM;
2030 	}
2031 	error = copyin(ireq->i_data, reg, IEEE80211_REGDOMAIN_SIZE(nchans));
2032 	if (error == 0) {
2033 		/* NB: validate inline channel count against storage size */
2034 		if (reg->chaninfo.ic_nchans != nchans) {
2035 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_IOCTL,
2036 			    "%s: chan cnt mismatch, %d != %d\n", __func__,
2037 				reg->chaninfo.ic_nchans, nchans);
2038 			error = EINVAL;
2039 		} else
2040 			error = ieee80211_setregdomain(vap, reg);
2041 	}
2042 	free(reg, M_TEMP);
2043 
2044 	return (error == 0 ? ENETRESET : error);
2045 }
2046 
2047 static int
2048 ieee80211_ioctl_setroam(struct ieee80211vap *vap,
2049 	const struct ieee80211req *ireq)
2050 {
2051 	if (ireq->i_len != sizeof(vap->iv_roamparms))
2052 		return EINVAL;
2053 	/* XXX validate params */
2054 	/* XXX? ENETRESET to push to device? */
2055 	return copyin(ireq->i_data, vap->iv_roamparms,
2056 	    sizeof(vap->iv_roamparms));
2057 }
2058 
2059 static int
2060 checkrate(const struct ieee80211_rateset *rs, int rate)
2061 {
2062 	int i;
2063 
2064 	if (rate == IEEE80211_FIXED_RATE_NONE)
2065 		return 1;
2066 	for (i = 0; i < rs->rs_nrates; i++)
2067 		if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == rate)
2068 			return 1;
2069 	return 0;
2070 }
2071 
2072 static int
2073 checkmcs(int mcs)
2074 {
2075 	if (mcs == IEEE80211_FIXED_RATE_NONE)
2076 		return 1;
2077 	if ((mcs & IEEE80211_RATE_MCS) == 0)	/* MCS always have 0x80 set */
2078 		return 0;
2079 	return (mcs & 0x7f) <= 15;	/* XXX could search ht rate set */
2080 }
2081 
2082 static __noinline int
2083 ieee80211_ioctl_settxparams(struct ieee80211vap *vap,
2084 	const struct ieee80211req *ireq)
2085 {
2086 	struct ieee80211com *ic = vap->iv_ic;
2087 	struct ieee80211_txparams_req parms;	/* XXX stack use? */
2088 	struct ieee80211_txparam *src, *dst;
2089 	const struct ieee80211_rateset *rs;
2090 	int error, mode, changed, is11n, nmodes;
2091 
2092 	/* NB: accept short requests for backwards compat */
2093 	if (ireq->i_len > sizeof(parms))
2094 		return EINVAL;
2095 	error = copyin(ireq->i_data, &parms, ireq->i_len);
2096 	if (error != 0)
2097 		return error;
2098 	nmodes = ireq->i_len / sizeof(struct ieee80211_txparam);
2099 	changed = 0;
2100 	/* validate parameters and check if anything changed */
2101 	for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
2102 		if (isclr(ic->ic_modecaps, mode))
2103 			continue;
2104 		src = &parms.params[mode];
2105 		dst = &vap->iv_txparms[mode];
2106 		rs = &ic->ic_sup_rates[mode];	/* NB: 11n maps to legacy */
2107 		is11n = (mode == IEEE80211_MODE_11NA ||
2108 			 mode == IEEE80211_MODE_11NG);
2109 		if (src->ucastrate != dst->ucastrate) {
2110 			if (!checkrate(rs, src->ucastrate) &&
2111 			    (!is11n || !checkmcs(src->ucastrate)))
2112 				return EINVAL;
2113 			changed++;
2114 		}
2115 		if (src->mcastrate != dst->mcastrate) {
2116 			if (!checkrate(rs, src->mcastrate) &&
2117 			    (!is11n || !checkmcs(src->mcastrate)))
2118 				return EINVAL;
2119 			changed++;
2120 		}
2121 		if (src->mgmtrate != dst->mgmtrate) {
2122 			if (!checkrate(rs, src->mgmtrate) &&
2123 			    (!is11n || !checkmcs(src->mgmtrate)))
2124 				return EINVAL;
2125 			changed++;
2126 		}
2127 		if (src->maxretry != dst->maxretry)	/* NB: no bounds */
2128 			changed++;
2129 	}
2130 	if (changed) {
2131 		/*
2132 		 * Copy new parameters in place and notify the
2133 		 * driver so it can push state to the device.
2134 		 */
2135 		for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
2136 			if (isset(ic->ic_modecaps, mode))
2137 				vap->iv_txparms[mode] = parms.params[mode];
2138 		}
2139 		/* XXX could be more intelligent,
2140 		   e.g. don't reset if setting not being used */
2141 		return ENETRESET;
2142 	}
2143 	return 0;
2144 }
2145 
2146 /*
2147  * Application Information Element support.
2148  */
2149 static int
2150 setappie(struct ieee80211_appie **aie, const struct ieee80211req *ireq)
2151 {
2152 	struct ieee80211_appie *app = *aie;
2153 	struct ieee80211_appie *napp;
2154 	int error;
2155 
2156 	if (ireq->i_len == 0) {		/* delete any existing ie */
2157 		if (app != NULL) {
2158 			*aie = NULL;	/* XXX racey */
2159 			free(app, M_80211_NODE_IE);
2160 		}
2161 		return 0;
2162 	}
2163 	if (!(2 <= ireq->i_len && ireq->i_len <= IEEE80211_MAX_APPIE))
2164 		return EINVAL;
2165 	/*
2166 	 * Allocate a new appie structure and copy in the user data.
2167 	 * When done swap in the new structure.  Note that we do not
2168 	 * guard against users holding a ref to the old structure;
2169 	 * this must be handled outside this code.
2170 	 *
2171 	 * XXX bad bad bad
2172 	 */
2173 	napp = (struct ieee80211_appie *) malloc(
2174 	    sizeof(struct ieee80211_appie) + ireq->i_len, M_80211_NODE_IE, M_NOWAIT);
2175 	if (napp == NULL)
2176 		return ENOMEM;
2177 	/* XXX holding ic lock */
2178 	error = copyin(ireq->i_data, napp->ie_data, ireq->i_len);
2179 	if (error) {
2180 		free(napp, M_80211_NODE_IE);
2181 		return error;
2182 	}
2183 	napp->ie_len = ireq->i_len;
2184 	*aie = napp;
2185 	if (app != NULL)
2186 		free(app, M_80211_NODE_IE);
2187 	return 0;
2188 }
2189 
2190 static void
2191 setwparsnie(struct ieee80211vap *vap, uint8_t *ie, int space)
2192 {
2193 	/* validate data is present as best we can */
2194 	if (space == 0 || 2+ie[1] > space)
2195 		return;
2196 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
2197 		vap->iv_wpa_ie = ie;
2198 	else if (ie[0] == IEEE80211_ELEMID_RSN)
2199 		vap->iv_rsn_ie = ie;
2200 }
2201 
2202 static __noinline int
2203 ieee80211_ioctl_setappie_locked(struct ieee80211vap *vap,
2204 	const struct ieee80211req *ireq, int fc0)
2205 {
2206 	int error;
2207 
2208 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
2209 
2210 	switch (fc0 & IEEE80211_FC0_SUBTYPE_MASK) {
2211 	case IEEE80211_FC0_SUBTYPE_BEACON:
2212 		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
2213 		    vap->iv_opmode != IEEE80211_M_IBSS) {
2214 			error = EINVAL;
2215 			break;
2216 		}
2217 		error = setappie(&vap->iv_appie_beacon, ireq);
2218 		if (error == 0)
2219 			ieee80211_beacon_notify(vap, IEEE80211_BEACON_APPIE);
2220 		break;
2221 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2222 		error = setappie(&vap->iv_appie_proberesp, ireq);
2223 		break;
2224 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2225 		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2226 			error = setappie(&vap->iv_appie_assocresp, ireq);
2227 		else
2228 			error = EINVAL;
2229 		break;
2230 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2231 		error = setappie(&vap->iv_appie_probereq, ireq);
2232 		break;
2233 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2234 		if (vap->iv_opmode == IEEE80211_M_STA)
2235 			error = setappie(&vap->iv_appie_assocreq, ireq);
2236 		else
2237 			error = EINVAL;
2238 		break;
2239 	case (IEEE80211_APPIE_WPA & IEEE80211_FC0_SUBTYPE_MASK):
2240 		error = setappie(&vap->iv_appie_wpa, ireq);
2241 		if (error == 0) {
2242 			/*
2243 			 * Must split single blob of data into separate
2244 			 * WPA and RSN ie's because they go in different
2245 			 * locations in the mgt frames.
2246 			 * XXX use IEEE80211_IOC_WPA2 so user code does split
2247 			 */
2248 			vap->iv_wpa_ie = NULL;
2249 			vap->iv_rsn_ie = NULL;
2250 			if (vap->iv_appie_wpa != NULL) {
2251 				struct ieee80211_appie *appie =
2252 				    vap->iv_appie_wpa;
2253 				uint8_t *data = appie->ie_data;
2254 
2255 				/* XXX ie length validate is painful, cheat */
2256 				setwparsnie(vap, data, appie->ie_len);
2257 				setwparsnie(vap, data + 2 + data[1],
2258 				    appie->ie_len - (2 + data[1]));
2259 			}
2260 			if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2261 			    vap->iv_opmode == IEEE80211_M_IBSS) {
2262 				/*
2263 				 * Must rebuild beacon frame as the update
2264 				 * mechanism doesn't handle WPA/RSN ie's.
2265 				 * Could extend it but it doesn't normally
2266 				 * change; this is just to deal with hostapd
2267 				 * plumbing the ie after the interface is up.
2268 				 */
2269 				error = ENETRESET;
2270 			}
2271 		}
2272 		break;
2273 	default:
2274 		error = EINVAL;
2275 		break;
2276 	}
2277 	return error;
2278 }
2279 
2280 static __noinline int
2281 ieee80211_ioctl_setappie(struct ieee80211vap *vap,
2282 	const struct ieee80211req *ireq)
2283 {
2284 	struct ieee80211com *ic = vap->iv_ic;
2285 	int error;
2286 	uint8_t fc0;
2287 
2288 	fc0 = ireq->i_val & 0xff;
2289 	if ((fc0 & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
2290 		return EINVAL;
2291 	/* NB: could check iv_opmode and reject but hardly worth the effort */
2292 	IEEE80211_LOCK(ic);
2293 	error = ieee80211_ioctl_setappie_locked(vap, ireq, fc0);
2294 	IEEE80211_UNLOCK(ic);
2295 	return error;
2296 }
2297 
2298 static __noinline int
2299 ieee80211_ioctl_chanswitch(struct ieee80211vap *vap, struct ieee80211req *ireq)
2300 {
2301 	struct ieee80211com *ic = vap->iv_ic;
2302 	struct ieee80211_chanswitch_req csr;
2303 	struct ieee80211_channel *c;
2304 	int error;
2305 
2306 	if (ireq->i_len != sizeof(csr))
2307 		return EINVAL;
2308 	error = copyin(ireq->i_data, &csr, sizeof(csr));
2309 	if (error != 0)
2310 		return error;
2311 	if ((vap->iv_flags & IEEE80211_F_DOTH) == 0)
2312 		return EINVAL;
2313 	c = ieee80211_find_channel(ic,
2314 	    csr.csa_chan.ic_freq, csr.csa_chan.ic_flags);
2315 	if (c == NULL)
2316 		return ENOENT;
2317 	IEEE80211_LOCK(ic);
2318 	if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0)
2319 		ieee80211_csa_startswitch(ic, c, csr.csa_mode, csr.csa_count);
2320 	else
2321 		error = EBUSY;
2322 	IEEE80211_UNLOCK(ic);
2323 	return error;
2324 }
2325 
2326 static __noinline int
2327 ieee80211_ioctl_scanreq(struct ieee80211vap *vap, struct ieee80211req *ireq)
2328 {
2329 #define	IEEE80211_IOC_SCAN_FLAGS \
2330 	(IEEE80211_IOC_SCAN_NOPICK | IEEE80211_IOC_SCAN_ACTIVE | \
2331 	 IEEE80211_IOC_SCAN_PICK1ST | IEEE80211_IOC_SCAN_BGSCAN | \
2332 	 IEEE80211_IOC_SCAN_ONCE | IEEE80211_IOC_SCAN_NOBCAST | \
2333 	 IEEE80211_IOC_SCAN_NOJOIN | IEEE80211_IOC_SCAN_FLUSH | \
2334 	 IEEE80211_IOC_SCAN_CHECK)
2335 	struct ieee80211com *ic = vap->iv_ic;
2336 	struct ieee80211_scan_req sr;		/* XXX off stack? */
2337 	int error, i;
2338 
2339 	/* NB: parent must be running */
2340 	if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2341 		return ENXIO;
2342 
2343 	if (ireq->i_len != sizeof(sr))
2344 		return EINVAL;
2345 	error = copyin(ireq->i_data, &sr, sizeof(sr));
2346 	if (error != 0)
2347 		return error;
2348 	/* convert duration */
2349 	if (sr.sr_duration == IEEE80211_IOC_SCAN_FOREVER)
2350 		sr.sr_duration = IEEE80211_SCAN_FOREVER;
2351 	else {
2352 		if (sr.sr_duration < IEEE80211_IOC_SCAN_DURATION_MIN ||
2353 		    sr.sr_duration > IEEE80211_IOC_SCAN_DURATION_MAX)
2354 			return EINVAL;
2355 		sr.sr_duration = msecs_to_ticks(sr.sr_duration);
2356 		if (sr.sr_duration < 1)
2357 			sr.sr_duration = 1;
2358 	}
2359 	/* convert min/max channel dwell */
2360 	if (sr.sr_mindwell != 0) {
2361 		sr.sr_mindwell = msecs_to_ticks(sr.sr_mindwell);
2362 		if (sr.sr_mindwell < 1)
2363 			sr.sr_mindwell = 1;
2364 	}
2365 	if (sr.sr_maxdwell != 0) {
2366 		sr.sr_maxdwell = msecs_to_ticks(sr.sr_maxdwell);
2367 		if (sr.sr_maxdwell < 1)
2368 			sr.sr_maxdwell = 1;
2369 	}
2370 	/* NB: silently reduce ssid count to what is supported */
2371 	if (sr.sr_nssid > IEEE80211_SCAN_MAX_SSID)
2372 		sr.sr_nssid = IEEE80211_SCAN_MAX_SSID;
2373 	for (i = 0; i < sr.sr_nssid; i++)
2374 		if (sr.sr_ssid[i].len > IEEE80211_NWID_LEN)
2375 			return EINVAL;
2376 	/* cleanse flags just in case, could reject if invalid flags */
2377 	sr.sr_flags &= IEEE80211_IOC_SCAN_FLAGS;
2378 	/*
2379 	 * Add an implicit NOPICK if the vap is not marked UP.  This
2380 	 * allows applications to scan without joining a bss (or picking
2381 	 * a channel and setting up a bss) and without forcing manual
2382 	 * roaming mode--you just need to mark the parent device UP.
2383 	 */
2384 	if ((vap->iv_ifp->if_flags & IFF_UP) == 0)
2385 		sr.sr_flags |= IEEE80211_IOC_SCAN_NOPICK;
2386 
2387 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
2388 	    "%s: flags 0x%x%s duration 0x%x mindwell %u maxdwell %u nssid %d\n",
2389 	    __func__, sr.sr_flags,
2390 	    (vap->iv_ifp->if_flags & IFF_UP) == 0 ? " (!IFF_UP)" : "",
2391 	    sr.sr_duration, sr.sr_mindwell, sr.sr_maxdwell, sr.sr_nssid);
2392 	/*
2393 	 * If we are in INIT state then the driver has never had a chance
2394 	 * to setup hardware state to do a scan; we must use the state
2395 	 * machine to get us up to the SCAN state but once we reach SCAN
2396 	 * state we then want to use the supplied params.  Stash the
2397 	 * parameters in the vap and mark IEEE80211_FEXT_SCANREQ; the
2398 	 * state machines will recognize this and use the stashed params
2399 	 * to issue the scan request.
2400 	 *
2401 	 * Otherwise just invoke the scan machinery directly.
2402 	 */
2403 	IEEE80211_LOCK(ic);
2404 	if (vap->iv_state == IEEE80211_S_INIT) {
2405 		/* NB: clobbers previous settings */
2406 		vap->iv_scanreq_flags = sr.sr_flags;
2407 		vap->iv_scanreq_duration = sr.sr_duration;
2408 		vap->iv_scanreq_nssid = sr.sr_nssid;
2409 		for (i = 0; i < sr.sr_nssid; i++) {
2410 			vap->iv_scanreq_ssid[i].len = sr.sr_ssid[i].len;
2411 			memcpy(vap->iv_scanreq_ssid[i].ssid, sr.sr_ssid[i].ssid,
2412 			    sr.sr_ssid[i].len);
2413 		}
2414 		vap->iv_flags_ext |= IEEE80211_FEXT_SCANREQ;
2415 		IEEE80211_UNLOCK(ic);
2416 		ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
2417 	} else {
2418 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
2419 		IEEE80211_UNLOCK(ic);
2420 		/* XXX neeed error return codes */
2421 		if (sr.sr_flags & IEEE80211_IOC_SCAN_CHECK) {
2422 			(void) ieee80211_check_scan(vap, sr.sr_flags,
2423 			    sr.sr_duration, sr.sr_mindwell, sr.sr_maxdwell,
2424 			    sr.sr_nssid,
2425 			    /* NB: cheat, we assume structures are compatible */
2426 			    (const struct ieee80211_scan_ssid *) &sr.sr_ssid[0]);
2427 		} else {
2428 			(void) ieee80211_start_scan(vap, sr.sr_flags,
2429 			    sr.sr_duration, sr.sr_mindwell, sr.sr_maxdwell,
2430 			    sr.sr_nssid,
2431 			    /* NB: cheat, we assume structures are compatible */
2432 			    (const struct ieee80211_scan_ssid *) &sr.sr_ssid[0]);
2433 		}
2434 	}
2435 	return error;
2436 #undef IEEE80211_IOC_SCAN_FLAGS
2437 }
2438 
2439 static __noinline int
2440 ieee80211_ioctl_setstavlan(struct ieee80211vap *vap, struct ieee80211req *ireq)
2441 {
2442 	struct ieee80211_node *ni;
2443 	struct ieee80211req_sta_vlan vlan;
2444 	int error;
2445 
2446 	if (ireq->i_len != sizeof(vlan))
2447 		return EINVAL;
2448 	error = copyin(ireq->i_data, &vlan, sizeof(vlan));
2449 	if (error != 0)
2450 		return error;
2451 	if (!IEEE80211_ADDR_EQ(vlan.sv_macaddr, zerobssid)) {
2452 		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
2453 		    vlan.sv_macaddr);
2454 		if (ni == NULL)
2455 			return ENOENT;
2456 	} else
2457 		ni = ieee80211_ref_node(vap->iv_bss);
2458 	ni->ni_vlan = vlan.sv_vlan;
2459 	ieee80211_free_node(ni);
2460 	return error;
2461 }
2462 
2463 static int
2464 isvap11g(const struct ieee80211vap *vap)
2465 {
2466 	const struct ieee80211_node *bss = vap->iv_bss;
2467 	return bss->ni_chan != IEEE80211_CHAN_ANYC &&
2468 	    IEEE80211_IS_CHAN_ANYG(bss->ni_chan);
2469 }
2470 
2471 static int
2472 isvapht(const struct ieee80211vap *vap)
2473 {
2474 	const struct ieee80211_node *bss = vap->iv_bss;
2475 	return bss->ni_chan != IEEE80211_CHAN_ANYC &&
2476 	    IEEE80211_IS_CHAN_HT(bss->ni_chan);
2477 }
2478 
2479 static __noinline int
2480 ieee80211_ioctl_set80211(struct ieee80211vap *vap, u_long cmd, struct ieee80211req *ireq)
2481 {
2482 	struct ieee80211com *ic = vap->iv_ic;
2483 	int error;
2484 	const struct ieee80211_authenticator *auth;
2485 	uint8_t tmpkey[IEEE80211_KEYBUF_SIZE];
2486 	char tmpssid[IEEE80211_NWID_LEN];
2487 	uint8_t tmpbssid[IEEE80211_ADDR_LEN];
2488 	struct ieee80211_key *k;
2489 	u_int kid;
2490 	uint32_t flags;
2491 
2492 	error = 0;
2493 	switch (ireq->i_type) {
2494 	case IEEE80211_IOC_SSID:
2495 		if (ireq->i_val != 0 ||
2496 		    ireq->i_len > IEEE80211_NWID_LEN)
2497 			return EINVAL;
2498 		error = copyin(ireq->i_data, tmpssid, ireq->i_len);
2499 		if (error)
2500 			break;
2501 		memset(vap->iv_des_ssid[0].ssid, 0, IEEE80211_NWID_LEN);
2502 		vap->iv_des_ssid[0].len = ireq->i_len;
2503 		memcpy(vap->iv_des_ssid[0].ssid, tmpssid, ireq->i_len);
2504 		vap->iv_des_nssid = (ireq->i_len > 0);
2505 		error = ENETRESET;
2506 		break;
2507 	case IEEE80211_IOC_WEP:
2508 		switch (ireq->i_val) {
2509 		case IEEE80211_WEP_OFF:
2510 			vap->iv_flags &= ~IEEE80211_F_PRIVACY;
2511 			vap->iv_flags &= ~IEEE80211_F_DROPUNENC;
2512 			break;
2513 		case IEEE80211_WEP_ON:
2514 			vap->iv_flags |= IEEE80211_F_PRIVACY;
2515 			vap->iv_flags |= IEEE80211_F_DROPUNENC;
2516 			break;
2517 		case IEEE80211_WEP_MIXED:
2518 			vap->iv_flags |= IEEE80211_F_PRIVACY;
2519 			vap->iv_flags &= ~IEEE80211_F_DROPUNENC;
2520 			break;
2521 		}
2522 		error = ENETRESET;
2523 		break;
2524 	case IEEE80211_IOC_WEPKEY:
2525 		kid = (u_int) ireq->i_val;
2526 		if (kid >= IEEE80211_WEP_NKID)
2527 			return EINVAL;
2528 		k = &vap->iv_nw_keys[kid];
2529 		if (ireq->i_len == 0) {
2530 			/* zero-len =>'s delete any existing key */
2531 			(void) ieee80211_crypto_delkey(vap, k);
2532 			break;
2533 		}
2534 		if (ireq->i_len > sizeof(tmpkey))
2535 			return EINVAL;
2536 		memset(tmpkey, 0, sizeof(tmpkey));
2537 		error = copyin(ireq->i_data, tmpkey, ireq->i_len);
2538 		if (error)
2539 			break;
2540 		ieee80211_key_update_begin(vap);
2541 		k->wk_keyix = kid;	/* NB: force fixed key id */
2542 		if (ieee80211_crypto_newkey(vap, IEEE80211_CIPHER_WEP,
2543 		    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2544 			k->wk_keylen = ireq->i_len;
2545 			memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
2546 			IEEE80211_ADDR_COPY(k->wk_macaddr, vap->iv_myaddr);
2547 			if  (!ieee80211_crypto_setkey(vap, k))
2548 				error = EINVAL;
2549 		} else
2550 			error = EINVAL;
2551 		ieee80211_key_update_end(vap);
2552 		break;
2553 	case IEEE80211_IOC_WEPTXKEY:
2554 		kid = (u_int) ireq->i_val;
2555 		if (kid >= IEEE80211_WEP_NKID &&
2556 		    (uint16_t) kid != IEEE80211_KEYIX_NONE)
2557 			return EINVAL;
2558 		vap->iv_def_txkey = kid;
2559 		break;
2560 	case IEEE80211_IOC_AUTHMODE:
2561 		switch (ireq->i_val) {
2562 		case IEEE80211_AUTH_WPA:
2563 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2564 		case IEEE80211_AUTH_OPEN:	/* open */
2565 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2566 		case IEEE80211_AUTH_AUTO:	/* auto */
2567 			auth = ieee80211_authenticator_get(ireq->i_val);
2568 			if (auth == NULL)
2569 				return EINVAL;
2570 			break;
2571 		default:
2572 			return EINVAL;
2573 		}
2574 		switch (ireq->i_val) {
2575 		case IEEE80211_AUTH_WPA:	/* WPA w/ 802.1x */
2576 			vap->iv_flags |= IEEE80211_F_PRIVACY;
2577 			ireq->i_val = IEEE80211_AUTH_8021X;
2578 			break;
2579 		case IEEE80211_AUTH_OPEN:	/* open */
2580 			vap->iv_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2581 			break;
2582 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2583 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2584 			vap->iv_flags &= ~IEEE80211_F_WPA;
2585 			/* both require a key so mark the PRIVACY capability */
2586 			vap->iv_flags |= IEEE80211_F_PRIVACY;
2587 			break;
2588 		case IEEE80211_AUTH_AUTO:	/* auto */
2589 			vap->iv_flags &= ~IEEE80211_F_WPA;
2590 			/* XXX PRIVACY handling? */
2591 			/* XXX what's the right way to do this? */
2592 			break;
2593 		}
2594 		/* NB: authenticator attach/detach happens on state change */
2595 		vap->iv_bss->ni_authmode = ireq->i_val;
2596 		/* XXX mixed/mode/usage? */
2597 		vap->iv_auth = auth;
2598 		error = ENETRESET;
2599 		break;
2600 	case IEEE80211_IOC_CHANNEL:
2601 		error = ieee80211_ioctl_setchannel(vap, ireq);
2602 		break;
2603 	case IEEE80211_IOC_POWERSAVE:
2604 		switch (ireq->i_val) {
2605 		case IEEE80211_POWERSAVE_OFF:
2606 			if (vap->iv_flags & IEEE80211_F_PMGTON) {
2607 				ieee80211_syncflag(vap, -IEEE80211_F_PMGTON);
2608 				error = ERESTART;
2609 			}
2610 			break;
2611 		case IEEE80211_POWERSAVE_ON:
2612 			if ((vap->iv_caps & IEEE80211_C_PMGT) == 0)
2613 				error = EOPNOTSUPP;
2614 			else if ((vap->iv_flags & IEEE80211_F_PMGTON) == 0) {
2615 				ieee80211_syncflag(vap, IEEE80211_F_PMGTON);
2616 				error = ERESTART;
2617 			}
2618 			break;
2619 		default:
2620 			error = EINVAL;
2621 			break;
2622 		}
2623 		break;
2624 	case IEEE80211_IOC_POWERSAVESLEEP:
2625 		if (ireq->i_val < 0)
2626 			return EINVAL;
2627 		ic->ic_lintval = ireq->i_val;
2628 		error = ERESTART;
2629 		break;
2630 	case IEEE80211_IOC_RTSTHRESHOLD:
2631 		if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
2632 		      ireq->i_val <= IEEE80211_RTS_MAX))
2633 			return EINVAL;
2634 		vap->iv_rtsthreshold = ireq->i_val;
2635 		error = ERESTART;
2636 		break;
2637 	case IEEE80211_IOC_PROTMODE:
2638 		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2639 			return EINVAL;
2640 		ic->ic_protmode = ireq->i_val;
2641 		/* NB: if not operating in 11g this can wait */
2642 		if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
2643 		    IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan))
2644 			error = ERESTART;
2645 		break;
2646 	case IEEE80211_IOC_TXPOWER:
2647 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2648 			return EOPNOTSUPP;
2649 		if (!(IEEE80211_TXPOWER_MIN <= ireq->i_val &&
2650 		      ireq->i_val <= IEEE80211_TXPOWER_MAX))
2651 			return EINVAL;
2652 		ic->ic_txpowlimit = ireq->i_val;
2653 		error = ERESTART;
2654 		break;
2655 	case IEEE80211_IOC_ROAMING:
2656 		if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2657 		    ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2658 			return EINVAL;
2659 		vap->iv_roaming = ireq->i_val;
2660 		/* XXXX reset? */
2661 		break;
2662 	case IEEE80211_IOC_PRIVACY:
2663 		if (ireq->i_val) {
2664 			/* XXX check for key state? */
2665 			vap->iv_flags |= IEEE80211_F_PRIVACY;
2666 		} else
2667 			vap->iv_flags &= ~IEEE80211_F_PRIVACY;
2668 		/* XXX ERESTART? */
2669 		break;
2670 	case IEEE80211_IOC_DROPUNENCRYPTED:
2671 		if (ireq->i_val)
2672 			vap->iv_flags |= IEEE80211_F_DROPUNENC;
2673 		else
2674 			vap->iv_flags &= ~IEEE80211_F_DROPUNENC;
2675 		/* XXX ERESTART? */
2676 		break;
2677 	case IEEE80211_IOC_WPAKEY:
2678 		error = ieee80211_ioctl_setkey(vap, ireq);
2679 		break;
2680 	case IEEE80211_IOC_DELKEY:
2681 		error = ieee80211_ioctl_delkey(vap, ireq);
2682 		break;
2683 	case IEEE80211_IOC_MLME:
2684 		error = ieee80211_ioctl_setmlme(vap, ireq);
2685 		break;
2686 	case IEEE80211_IOC_COUNTERMEASURES:
2687 		if (ireq->i_val) {
2688 			if ((vap->iv_flags & IEEE80211_F_WPA) == 0)
2689 				return EOPNOTSUPP;
2690 			vap->iv_flags |= IEEE80211_F_COUNTERM;
2691 		} else
2692 			vap->iv_flags &= ~IEEE80211_F_COUNTERM;
2693 		/* XXX ERESTART? */
2694 		break;
2695 	case IEEE80211_IOC_WPA:
2696 		if (ireq->i_val > 3)
2697 			return EINVAL;
2698 		/* XXX verify ciphers available */
2699 		flags = vap->iv_flags & ~IEEE80211_F_WPA;
2700 		switch (ireq->i_val) {
2701 		case 1:
2702 			if (!(vap->iv_caps & IEEE80211_C_WPA1))
2703 				return EOPNOTSUPP;
2704 			flags |= IEEE80211_F_WPA1;
2705 			break;
2706 		case 2:
2707 			if (!(vap->iv_caps & IEEE80211_C_WPA2))
2708 				return EOPNOTSUPP;
2709 			flags |= IEEE80211_F_WPA2;
2710 			break;
2711 		case 3:
2712 			if ((vap->iv_caps & IEEE80211_C_WPA) != IEEE80211_C_WPA)
2713 				return EOPNOTSUPP;
2714 			flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2715 			break;
2716 		default:	/*  Can't set any -> error */
2717 			return EOPNOTSUPP;
2718 		}
2719 		vap->iv_flags = flags;
2720 		error = ERESTART;	/* NB: can change beacon frame */
2721 		break;
2722 	case IEEE80211_IOC_WME:
2723 		if (ireq->i_val) {
2724 			if ((vap->iv_caps & IEEE80211_C_WME) == 0)
2725 				return EOPNOTSUPP;
2726 			ieee80211_syncflag(vap, IEEE80211_F_WME);
2727 		} else
2728 			ieee80211_syncflag(vap, -IEEE80211_F_WME);
2729 		error = ERESTART;	/* NB: can change beacon frame */
2730 		break;
2731 	case IEEE80211_IOC_HIDESSID:
2732 		if (ireq->i_val)
2733 			vap->iv_flags |= IEEE80211_F_HIDESSID;
2734 		else
2735 			vap->iv_flags &= ~IEEE80211_F_HIDESSID;
2736 		error = ERESTART;		/* XXX ENETRESET? */
2737 		break;
2738 	case IEEE80211_IOC_APBRIDGE:
2739 		if (ireq->i_val == 0)
2740 			vap->iv_flags |= IEEE80211_F_NOBRIDGE;
2741 		else
2742 			vap->iv_flags &= ~IEEE80211_F_NOBRIDGE;
2743 		break;
2744 	case IEEE80211_IOC_BSSID:
2745 		if (ireq->i_len != sizeof(tmpbssid))
2746 			return EINVAL;
2747 		error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2748 		if (error)
2749 			break;
2750 		IEEE80211_ADDR_COPY(vap->iv_des_bssid, tmpbssid);
2751 		if (IEEE80211_ADDR_EQ(vap->iv_des_bssid, zerobssid))
2752 			vap->iv_flags &= ~IEEE80211_F_DESBSSID;
2753 		else
2754 			vap->iv_flags |= IEEE80211_F_DESBSSID;
2755 		error = ENETRESET;
2756 		break;
2757 	case IEEE80211_IOC_CHANLIST:
2758 		error = ieee80211_ioctl_setchanlist(vap, ireq);
2759 		break;
2760 #define	OLD_IEEE80211_IOC_SCAN_REQ	23
2761 #ifdef OLD_IEEE80211_IOC_SCAN_REQ
2762 	case OLD_IEEE80211_IOC_SCAN_REQ:
2763 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
2764 			"%s: active scan request\n", __func__);
2765 		/*
2766 		 * If we are in INIT state then the driver has never
2767 		 * had a chance to setup hardware state to do a scan;
2768 		 * use the state machine to get us up the SCAN state.
2769 		 * Otherwise just invoke the scan machinery to start
2770 		 * a one-time scan.
2771 		 */
2772 		if (vap->iv_state == IEEE80211_S_INIT)
2773 			ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
2774 		else
2775 			(void) ieee80211_start_scan(vap,
2776 				IEEE80211_SCAN_ACTIVE |
2777 				IEEE80211_SCAN_NOPICK |
2778 				IEEE80211_SCAN_ONCE,
2779 				IEEE80211_SCAN_FOREVER, 0, 0,
2780 				/* XXX use ioctl params */
2781 				vap->iv_des_nssid, vap->iv_des_ssid);
2782 		break;
2783 #endif /* OLD_IEEE80211_IOC_SCAN_REQ */
2784 	case IEEE80211_IOC_SCAN_REQ:
2785 		error = ieee80211_ioctl_scanreq(vap, ireq);
2786 		break;
2787 	case IEEE80211_IOC_SCAN_CANCEL:
2788 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
2789 		    "%s: cancel scan\n", __func__);
2790 		ieee80211_cancel_scan(vap);
2791 		break;
2792 	case IEEE80211_IOC_HTCONF:
2793 		if (ireq->i_val & 1)
2794 			ieee80211_syncflag_ext(vap, IEEE80211_FEXT_HT);
2795 		else
2796 			ieee80211_syncflag_ext(vap, -IEEE80211_FEXT_HT);
2797 		if (ireq->i_val & 2)
2798 			ieee80211_syncflag_ext(vap, IEEE80211_FEXT_USEHT40);
2799 		else
2800 			ieee80211_syncflag_ext(vap, -IEEE80211_FEXT_USEHT40);
2801 		error = ENETRESET;
2802 		break;
2803 	case IEEE80211_IOC_ADDMAC:
2804 	case IEEE80211_IOC_DELMAC:
2805 		error = ieee80211_ioctl_macmac(vap, ireq);
2806 		break;
2807 	case IEEE80211_IOC_MACCMD:
2808 		error = ieee80211_ioctl_setmaccmd(vap, ireq);
2809 		break;
2810 	case IEEE80211_IOC_STA_STATS:
2811 		error = ieee80211_ioctl_setstastats(vap, ireq);
2812 		break;
2813 	case IEEE80211_IOC_STA_TXPOW:
2814 		error = ieee80211_ioctl_setstatxpow(vap, ireq);
2815 		break;
2816 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
2817 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
2818 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
2819 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
2820 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
2821 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
2822 		error = ieee80211_ioctl_setwmeparam(vap, ireq);
2823 		break;
2824 	case IEEE80211_IOC_DTIM_PERIOD:
2825 		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
2826 		    vap->iv_opmode != IEEE80211_M_IBSS)
2827 			return EINVAL;
2828 		if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2829 		    ireq->i_val <= IEEE80211_DTIM_MAX) {
2830 			vap->iv_dtim_period = ireq->i_val;
2831 			error = ENETRESET;		/* requires restart */
2832 		} else
2833 			error = EINVAL;
2834 		break;
2835 	case IEEE80211_IOC_BEACON_INTERVAL:
2836 		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
2837 		    vap->iv_opmode != IEEE80211_M_IBSS)
2838 			return EINVAL;
2839 		if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2840 		    ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2841 			ic->ic_bintval = ireq->i_val;
2842 			error = ENETRESET;		/* requires restart */
2843 		} else
2844 			error = EINVAL;
2845 		break;
2846 	case IEEE80211_IOC_PUREG:
2847 		if (ireq->i_val)
2848 			vap->iv_flags |= IEEE80211_F_PUREG;
2849 		else
2850 			vap->iv_flags &= ~IEEE80211_F_PUREG;
2851 		/* NB: reset only if we're operating on an 11g channel */
2852 		if (isvap11g(vap))
2853 			error = ENETRESET;
2854 		break;
2855 	case IEEE80211_IOC_FF:
2856 		if (ireq->i_val) {
2857 			if ((vap->iv_caps & IEEE80211_C_FF) == 0)
2858 				return EOPNOTSUPP;
2859 			vap->iv_flags |= IEEE80211_F_FF;
2860 		} else
2861 			vap->iv_flags &= ~IEEE80211_F_FF;
2862 		error = ERESTART;
2863 		break;
2864 	case IEEE80211_IOC_TURBOP:
2865 		if (ireq->i_val) {
2866 			if ((vap->iv_caps & IEEE80211_C_TURBOP) == 0)
2867 				return EOPNOTSUPP;
2868 			vap->iv_flags |= IEEE80211_F_TURBOP;
2869 		} else
2870 			vap->iv_flags &= ~IEEE80211_F_TURBOP;
2871 		error = ENETRESET;
2872 		break;
2873 	case IEEE80211_IOC_BGSCAN:
2874 		if (ireq->i_val) {
2875 			if ((vap->iv_caps & IEEE80211_C_BGSCAN) == 0)
2876 				return EOPNOTSUPP;
2877 			vap->iv_flags |= IEEE80211_F_BGSCAN;
2878 		} else
2879 			vap->iv_flags &= ~IEEE80211_F_BGSCAN;
2880 		break;
2881 	case IEEE80211_IOC_BGSCAN_IDLE:
2882 		if (ireq->i_val >= IEEE80211_BGSCAN_IDLE_MIN)
2883 			vap->iv_bgscanidle = ireq->i_val*hz/1000;
2884 		else
2885 			error = EINVAL;
2886 		break;
2887 	case IEEE80211_IOC_BGSCAN_INTERVAL:
2888 		if (ireq->i_val >= IEEE80211_BGSCAN_INTVAL_MIN)
2889 			vap->iv_bgscanintvl = ireq->i_val*hz;
2890 		else
2891 			error = EINVAL;
2892 		break;
2893 	case IEEE80211_IOC_SCANVALID:
2894 		if (ireq->i_val >= IEEE80211_SCAN_VALID_MIN)
2895 			vap->iv_scanvalid = ireq->i_val*hz;
2896 		else
2897 			error = EINVAL;
2898 		break;
2899 	case IEEE80211_IOC_FRAGTHRESHOLD:
2900 		if ((vap->iv_caps & IEEE80211_C_TXFRAG) == 0 &&
2901 		    ireq->i_val != IEEE80211_FRAG_MAX)
2902 			return EOPNOTSUPP;
2903 		if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
2904 		      ireq->i_val <= IEEE80211_FRAG_MAX))
2905 			return EINVAL;
2906 		vap->iv_fragthreshold = ireq->i_val;
2907 		error = ERESTART;
2908 		break;
2909 	case IEEE80211_IOC_BURST:
2910 		if (ireq->i_val) {
2911 			if ((vap->iv_caps & IEEE80211_C_BURST) == 0)
2912 				return EOPNOTSUPP;
2913 			ieee80211_syncflag(vap, IEEE80211_F_BURST);
2914 		} else
2915 			ieee80211_syncflag(vap, -IEEE80211_F_BURST);
2916 		error = ERESTART;
2917 		break;
2918 	case IEEE80211_IOC_BMISSTHRESHOLD:
2919 		if (!(IEEE80211_HWBMISS_MIN <= ireq->i_val &&
2920 		      ireq->i_val <= IEEE80211_HWBMISS_MAX))
2921 			return EINVAL;
2922 		vap->iv_bmissthreshold = ireq->i_val;
2923 		error = ERESTART;
2924 		break;
2925 	case IEEE80211_IOC_CURCHAN:
2926 		error = ieee80211_ioctl_setcurchan(vap, ireq);
2927 		break;
2928 	case IEEE80211_IOC_SHORTGI:
2929 		if (ireq->i_val) {
2930 #define	IEEE80211_HTCAP_SHORTGI \
2931 	(IEEE80211_HTCAP_SHORTGI20 | IEEE80211_HTCAP_SHORTGI40)
2932 			if (((ireq->i_val ^ vap->iv_htcaps) & IEEE80211_HTCAP_SHORTGI) != 0)
2933 				return EINVAL;
2934 			if (ireq->i_val & IEEE80211_HTCAP_SHORTGI20)
2935 				vap->iv_flags_ext |= IEEE80211_FEXT_SHORTGI20;
2936 			if (ireq->i_val & IEEE80211_HTCAP_SHORTGI40)
2937 				vap->iv_flags_ext |= IEEE80211_FEXT_SHORTGI40;
2938 #undef IEEE80211_HTCAP_SHORTGI
2939 		} else
2940 			vap->iv_flags_ext &=
2941 			    ~(IEEE80211_FEXT_SHORTGI20 | IEEE80211_FEXT_SHORTGI40);
2942 		error = ERESTART;
2943 		break;
2944 	case IEEE80211_IOC_AMPDU:
2945 		if (ireq->i_val && (vap->iv_htcaps & IEEE80211_HTC_AMPDU) == 0)
2946 			return EINVAL;
2947 		if (ireq->i_val & 1)
2948 			vap->iv_flags_ext |= IEEE80211_FEXT_AMPDU_TX;
2949 		else
2950 			vap->iv_flags_ext &= ~IEEE80211_FEXT_AMPDU_TX;
2951 		if (ireq->i_val & 2)
2952 			vap->iv_flags_ext |= IEEE80211_FEXT_AMPDU_RX;
2953 		else
2954 			vap->iv_flags_ext &= ~IEEE80211_FEXT_AMPDU_RX;
2955 		/* NB: reset only if we're operating on an 11n channel */
2956 		if (isvapht(vap))
2957 			error = ERESTART;
2958 		break;
2959 	case IEEE80211_IOC_AMPDU_LIMIT:
2960 		if (!(IEEE80211_HTCAP_MAXRXAMPDU_8K <= ireq->i_val &&
2961 		      ireq->i_val <= IEEE80211_HTCAP_MAXRXAMPDU_64K))
2962 			return EINVAL;
2963 		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2964 			vap->iv_ampdu_rxmax = ireq->i_val;
2965 		else
2966 			vap->iv_ampdu_limit = ireq->i_val;
2967 		error = ERESTART;
2968 		break;
2969 	case IEEE80211_IOC_AMPDU_DENSITY:
2970 		if (!(IEEE80211_HTCAP_MPDUDENSITY_NA <= ireq->i_val &&
2971 		      ireq->i_val <= IEEE80211_HTCAP_MPDUDENSITY_16))
2972 			return EINVAL;
2973 		vap->iv_ampdu_density = ireq->i_val;
2974 		error = ERESTART;
2975 		break;
2976 	case IEEE80211_IOC_AMSDU:
2977 		if (ireq->i_val && (vap->iv_htcaps & IEEE80211_HTC_AMSDU) == 0)
2978 			return EINVAL;
2979 		if (ireq->i_val & 1)
2980 			vap->iv_flags_ext |= IEEE80211_FEXT_AMSDU_TX;
2981 		else
2982 			vap->iv_flags_ext &= ~IEEE80211_FEXT_AMSDU_TX;
2983 		if (ireq->i_val & 2)
2984 			vap->iv_flags_ext |= IEEE80211_FEXT_AMSDU_RX;
2985 		else
2986 			vap->iv_flags_ext &= ~IEEE80211_FEXT_AMSDU_RX;
2987 		/* NB: reset only if we're operating on an 11n channel */
2988 		if (isvapht(vap))
2989 			error = ERESTART;
2990 		break;
2991 	case IEEE80211_IOC_AMSDU_LIMIT:
2992 		/* XXX validate */
2993 		vap->iv_amsdu_limit = ireq->i_val;	/* XXX truncation? */
2994 		break;
2995 	case IEEE80211_IOC_PUREN:
2996 		if (ireq->i_val) {
2997 			if ((vap->iv_flags_ext & IEEE80211_FEXT_HT) == 0)
2998 				return EINVAL;
2999 			vap->iv_flags_ext |= IEEE80211_FEXT_PUREN;
3000 		} else
3001 			vap->iv_flags_ext &= ~IEEE80211_FEXT_PUREN;
3002 		/* NB: reset only if we're operating on an 11n channel */
3003 		if (isvapht(vap))
3004 			error = ERESTART;
3005 		break;
3006 	case IEEE80211_IOC_DOTH:
3007 		if (ireq->i_val) {
3008 #if 0
3009 			/* XXX no capability */
3010 			if ((vap->iv_caps & IEEE80211_C_DOTH) == 0)
3011 				return EOPNOTSUPP;
3012 #endif
3013 			vap->iv_flags |= IEEE80211_F_DOTH;
3014 		} else
3015 			vap->iv_flags &= ~IEEE80211_F_DOTH;
3016 		error = ENETRESET;
3017 		break;
3018 	case IEEE80211_IOC_REGDOMAIN:
3019 		error = ieee80211_ioctl_setregdomain(vap, ireq);
3020 		break;
3021 	case IEEE80211_IOC_ROAM:
3022 		error = ieee80211_ioctl_setroam(vap, ireq);
3023 		break;
3024 	case IEEE80211_IOC_TXPARAMS:
3025 		error = ieee80211_ioctl_settxparams(vap, ireq);
3026 		break;
3027 	case IEEE80211_IOC_HTCOMPAT:
3028 		if (ireq->i_val) {
3029 			if ((vap->iv_flags_ext & IEEE80211_FEXT_HT) == 0)
3030 				return EOPNOTSUPP;
3031 			vap->iv_flags_ext |= IEEE80211_FEXT_HTCOMPAT;
3032 		} else
3033 			vap->iv_flags_ext &= ~IEEE80211_FEXT_HTCOMPAT;
3034 		/* NB: reset only if we're operating on an 11n channel */
3035 		if (isvapht(vap))
3036 			error = ERESTART;
3037 		break;
3038 	case IEEE80211_IOC_DWDS:
3039 		if (ireq->i_val) {
3040 			/* NB: DWDS only makes sense for WDS-capable devices */
3041 			if ((ic->ic_caps & IEEE80211_C_WDS) == 0)
3042 				return EOPNOTSUPP;
3043 			/* NB: DWDS is used only with ap+sta vaps */
3044 			if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
3045 			    vap->iv_opmode != IEEE80211_M_STA)
3046 				return EINVAL;
3047 			vap->iv_flags |= IEEE80211_F_DWDS;
3048 		} else
3049 			vap->iv_flags &= ~IEEE80211_F_DWDS;
3050 		break;
3051 	case IEEE80211_IOC_INACTIVITY:
3052 		if (ireq->i_val)
3053 			vap->iv_flags_ext |= IEEE80211_FEXT_INACT;
3054 		else
3055 			vap->iv_flags_ext &= ~IEEE80211_FEXT_INACT;
3056 		break;
3057 	case IEEE80211_IOC_APPIE:
3058 		error = ieee80211_ioctl_setappie(vap, ireq);
3059 		break;
3060 	case IEEE80211_IOC_WPS:
3061 		if (ireq->i_val) {
3062 			if ((vap->iv_caps & IEEE80211_C_WPA) == 0)
3063 				return EOPNOTSUPP;
3064 			vap->iv_flags_ext |= IEEE80211_FEXT_WPS;
3065 		} else
3066 			vap->iv_flags_ext &= ~IEEE80211_FEXT_WPS;
3067 		break;
3068 	case IEEE80211_IOC_TSN:
3069 		if (ireq->i_val) {
3070 			if ((vap->iv_caps & IEEE80211_C_WPA) == 0)
3071 				return EOPNOTSUPP;
3072 			vap->iv_flags_ext |= IEEE80211_FEXT_TSN;
3073 		} else
3074 			vap->iv_flags_ext &= ~IEEE80211_FEXT_TSN;
3075 		break;
3076 	case IEEE80211_IOC_CHANSWITCH:
3077 		error = ieee80211_ioctl_chanswitch(vap, ireq);
3078 		break;
3079 	case IEEE80211_IOC_DFS:
3080 		if (ireq->i_val) {
3081 			if ((vap->iv_caps & IEEE80211_C_DFS) == 0)
3082 				return EOPNOTSUPP;
3083 			/* NB: DFS requires 11h support */
3084 			if ((vap->iv_flags & IEEE80211_F_DOTH) == 0)
3085 				return EINVAL;
3086 			vap->iv_flags_ext |= IEEE80211_FEXT_DFS;
3087 		} else
3088 			vap->iv_flags_ext &= ~IEEE80211_FEXT_DFS;
3089 		break;
3090 	case IEEE80211_IOC_DOTD:
3091 		if (ireq->i_val)
3092 			vap->iv_flags_ext |= IEEE80211_FEXT_DOTD;
3093 		else
3094 			vap->iv_flags_ext &= ~IEEE80211_FEXT_DOTD;
3095 		if (vap->iv_opmode == IEEE80211_M_STA)
3096 			error = ENETRESET;
3097 		break;
3098 	case IEEE80211_IOC_HTPROTMODE:
3099 		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
3100 			return EINVAL;
3101 		ic->ic_htprotmode = ireq->i_val ?
3102 		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_NONE;
3103 		/* NB: if not operating in 11n this can wait */
3104 		if (isvapht(vap))
3105 			error = ERESTART;
3106 		break;
3107 	case IEEE80211_IOC_STA_VLAN:
3108 		error = ieee80211_ioctl_setstavlan(vap, ireq);
3109 		break;
3110 	case IEEE80211_IOC_SMPS:
3111 		if ((ireq->i_val &~ IEEE80211_HTCAP_SMPS) != 0 ||
3112 		    ireq->i_val == 0x0008)	/* value of 2 is reserved */
3113 			return EINVAL;
3114 		if (ireq->i_val != IEEE80211_HTCAP_SMPS_OFF &&
3115 		    (vap->iv_htcaps & IEEE80211_HTC_SMPS) == 0)
3116 			return EOPNOTSUPP;
3117 		vap->iv_htcaps = (vap->iv_htcaps &~ IEEE80211_HTCAP_SMPS) |
3118 			ireq->i_val;
3119 		/* NB: if not operating in 11n this can wait */
3120 		if (isvapht(vap))
3121 			error = ERESTART;
3122 		break;
3123 	case IEEE80211_IOC_RIFS:
3124 		if (ireq->i_val != 0) {
3125 			if ((vap->iv_htcaps & IEEE80211_HTC_RIFS) == 0)
3126 				return EOPNOTSUPP;
3127 			vap->iv_flags_ext |= IEEE80211_FEXT_RIFS;
3128 		} else
3129 			vap->iv_flags_ext &= ~IEEE80211_FEXT_RIFS;
3130 		/* NB: if not operating in 11n this can wait */
3131 		if (isvapht(vap))
3132 			error = ERESTART;
3133 		break;
3134 #ifdef IEEE80211_SUPPORT_TDMA
3135 	case IEEE80211_IOC_TDMA_SLOT:
3136 	case IEEE80211_IOC_TDMA_SLOTCNT:
3137 	case IEEE80211_IOC_TDMA_SLOTLEN:
3138 	case IEEE80211_IOC_TDMA_BINTERVAL:
3139 		error = ieee80211_tdma_ioctl_set80211(vap, ireq);
3140 		break;
3141 #endif
3142 	default:
3143 		error = EINVAL;
3144 		break;
3145 	}
3146 	/*
3147 	 * The convention is that ENETRESET means an operation
3148 	 * requires a complete re-initialization of the device (e.g.
3149 	 * changing something that affects the association state).
3150 	 * ERESTART means the request may be handled with only a
3151 	 * reload of the hardware state.  We hand ERESTART requests
3152 	 * to the iv_reset callback so the driver can decide.  If
3153 	 * a device does not fillin iv_reset then it defaults to one
3154 	 * that returns ENETRESET.  Otherwise a driver may return
3155 	 * ENETRESET (in which case a full reset will be done) or
3156 	 * 0 to mean there's no need to do anything (e.g. when the
3157 	 * change has no effect on the driver/device).
3158 	 */
3159 	if (error == ERESTART)
3160 		error = IFNET_IS_UP_RUNNING(vap->iv_ifp) ?
3161 		    vap->iv_reset(vap, ireq->i_type) : 0;
3162 	if (error == ENETRESET) {
3163 		/* XXX need to re-think AUTO handling */
3164 		if (IS_UP_AUTO(vap))
3165 			ieee80211_init(vap);
3166 		error = 0;
3167 	}
3168 	return error;
3169 }
3170 
3171 /*
3172  * Rebuild the parent's multicast address list after an add/del
3173  * of a multicast address for a vap.  We have no way to tell
3174  * what happened above to optimize the work so we purge the entire
3175  * list and rebuild from scratch.  This is way expensive.
3176  * Note also the half-baked workaround for if_addmulti calling
3177  * back to the parent device; there's no way to insert mcast
3178  * entries quietly and/or cheaply.
3179  */
3180 static void
3181 ieee80211_ioctl_updatemulti(struct ieee80211com *ic)
3182 {
3183 	struct ifnet *parent = ic->ic_ifp;
3184 	struct ieee80211vap *vap;
3185 	void *ioctl;
3186 
3187 	IEEE80211_LOCK(ic);
3188 	if_purgemaddrs(parent);
3189 	ioctl = parent->if_ioctl;	/* XXX WAR if_allmulti */
3190 	parent->if_ioctl = NULL;
3191 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
3192 		struct ifnet *ifp = vap->iv_ifp;
3193 		struct ifmultiaddr *ifma;
3194 
3195 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link)
3196 			(void) if_addmulti(parent, ifma->ifma_addr, NULL);
3197 	}
3198 	parent->if_ioctl = ioctl;
3199 
3200 	ic->ic_update_mcast(ic->ic_ifp);
3201 	IEEE80211_UNLOCK(ic);
3202 }
3203 
3204 int
3205 ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
3206 {
3207 	struct ieee80211vap *vap;
3208 	struct ieee80211com *ic;
3209 	int error = 0;
3210 	struct ifreq *ifr;
3211 	struct ifaddr *ifa;			/* XXX */
3212 
3213 	vap = ifp->if_softc;
3214 	if (vap == NULL) {
3215 		/*
3216 		 * During detach we clear the backpointer in the softc
3217 		 * so any ioctl request through the ifnet that arrives
3218 		 * before teardown is ignored/rejected.  In particular
3219 		 * this hack handles destroying a vap used by an app
3220 		 * like wpa_supplicant that will respond to the vap
3221 		 * being forced into INIT state by immediately trying
3222 		 * to force it back up.  We can yank this hack if/when
3223 		 * we can destroy the ifnet before cleaning up vap state.
3224 		 */
3225 		return ENXIO;
3226 	}
3227 	switch (cmd) {
3228 	case SIOCSIFFLAGS:
3229 		ic = vap->iv_ic;
3230 		IEEE80211_LOCK(ic);
3231 		ieee80211_syncifflag_locked(ic, IFF_PROMISC);
3232 		ieee80211_syncifflag_locked(ic, IFF_ALLMULTI);
3233 		if (ifp->if_flags & IFF_UP) {
3234 			/*
3235 			 * Bring ourself up unless we're already operational.
3236 			 * If we're the first vap and the parent is not up
3237 			 * then it will automatically be brought up as a
3238 			 * side-effect of bringing ourself up.
3239 			 */
3240 			if (vap->iv_state == IEEE80211_S_INIT)
3241 				ieee80211_start_locked(vap);
3242 		} else if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
3243 			/*
3244 			 * Stop ourself.  If we are the last vap to be
3245 			 * marked down the parent will also be taken down.
3246 			 */
3247 			ieee80211_stop_locked(vap);
3248 		}
3249 		IEEE80211_UNLOCK(ic);
3250 		/* Wait for parent ioctl handler if it was queued */
3251 		ieee80211_waitfor_parent(ic);
3252 		break;
3253 	case SIOCADDMULTI:
3254 	case SIOCDELMULTI:
3255 		ieee80211_ioctl_updatemulti(vap->iv_ic);
3256 		break;
3257 	case SIOCSIFMEDIA:
3258 	case SIOCGIFMEDIA:
3259 		ifr = (struct ifreq *)data;
3260 		error = ifmedia_ioctl(ifp, ifr, &vap->iv_media, cmd);
3261 		break;
3262 	case SIOCG80211:
3263 		error = ieee80211_ioctl_get80211(vap, cmd,
3264 				(struct ieee80211req *) data);
3265 		break;
3266 	case SIOCS80211:
3267 		error = priv_check(curthread, PRIV_NET80211_MANAGE);
3268 		if (error == 0)
3269 			error = ieee80211_ioctl_set80211(vap, cmd,
3270 					(struct ieee80211req *) data);
3271 		break;
3272 	case SIOCG80211STATS:
3273 		ifr = (struct ifreq *)data;
3274 		copyout(&vap->iv_stats, ifr->ifr_data, sizeof (vap->iv_stats));
3275 		break;
3276 	case SIOCSIFMTU:
3277 		ifr = (struct ifreq *)data;
3278 		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
3279 		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
3280 			error = EINVAL;
3281 		else
3282 			ifp->if_mtu = ifr->ifr_mtu;
3283 		break;
3284 	case SIOCSIFADDR:
3285 		/*
3286 		 * XXX Handle this directly so we can supress if_init calls.
3287 		 * XXX This should be done in ether_ioctl but for the moment
3288 		 * XXX there are too many other parts of the system that
3289 		 * XXX set IFF_UP and so supress if_init being called when
3290 		 * XXX it should be.
3291 		 */
3292 		ifa = (struct ifaddr *) data;
3293 		switch (ifa->ifa_addr->sa_family) {
3294 #ifdef INET
3295 		case AF_INET:
3296 			if ((ifp->if_flags & IFF_UP) == 0) {
3297 				ifp->if_flags |= IFF_UP;
3298 				ifp->if_init(ifp->if_softc);
3299 			}
3300 			arp_ifinit(ifp, ifa);
3301 			break;
3302 #endif
3303 #ifdef IPX
3304 		/*
3305 		 * XXX - This code is probably wrong,
3306 		 *	 but has been copied many times.
3307 		 */
3308 		case AF_IPX: {
3309 			struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
3310 
3311 			if (ipx_nullhost(*ina))
3312 				ina->x_host = *(union ipx_host *)
3313 				    IF_LLADDR(ifp);
3314 			else
3315 				bcopy((caddr_t) ina->x_host.c_host,
3316 				      (caddr_t) IF_LLADDR(ifp),
3317 				      ETHER_ADDR_LEN);
3318 			/* fall thru... */
3319 		}
3320 #endif
3321 		default:
3322 			if ((ifp->if_flags & IFF_UP) == 0) {
3323 				ifp->if_flags |= IFF_UP;
3324 				ifp->if_init(ifp->if_softc);
3325 			}
3326 			break;
3327 		}
3328 		break;
3329 	/* Pass NDIS ioctls up to the driver */
3330 	case SIOCGDRVSPEC:
3331 	case SIOCSDRVSPEC:
3332 	case SIOCGPRIVATE_0: {
3333 		struct ifnet *parent = vap->iv_ic->ic_ifp;
3334 		error = parent->if_ioctl(parent, cmd, data);
3335 		break;
3336 	}
3337 	default:
3338 		error = ether_ioctl(ifp, cmd, data);
3339 		break;
3340 	}
3341 	return error;
3342 }
3343