xref: /freebsd/sys/net80211/ieee80211_ioctl.c (revision 6af83ee0d2941d18880b6aaa2b4facd1d30c6106)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 /*
37  * IEEE 802.11 ioctl support (FreeBSD-specific)
38  */
39 
40 #include "opt_inet.h"
41 #include "opt_ipx.h"
42 
43 #include <sys/endian.h>
44 #include <sys/param.h>
45 #include <sys/kernel.h>
46 #include <sys/socket.h>
47 #include <sys/sockio.h>
48 #include <sys/systm.h>
49 
50 #include <net/if.h>
51 #include <net/if_arp.h>
52 #include <net/if_media.h>
53 #include <net/ethernet.h>
54 
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <netinet/if_ether.h>
58 #endif
59 
60 #ifdef IPX
61 #include <netipx/ipx.h>
62 #include <netipx/ipx_if.h>
63 #endif
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_ioctl.h>
67 
68 #include <dev/wi/if_wavelan_ieee.h>
69 
70 #define	IS_UP(_ic) \
71 	(((_ic)->ic_ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP))
72 #define	IS_UP_AUTO(_ic) \
73 	(IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
74 
75 /*
76  * XXX
77  * Wireless LAN specific configuration interface, which is compatible
78  * with wicontrol(8).
79  */
80 
81 struct wi_read_ap_args {
82 	int	i;		/* result count */
83 	struct wi_apinfo *ap;	/* current entry in result buffer */
84 	caddr_t	max;		/* result buffer bound */
85 };
86 
87 static void
88 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
89 {
90 	struct ieee80211com *ic = ni->ni_ic;
91 	struct wi_read_ap_args *sa = arg;
92 	struct wi_apinfo *ap = sa->ap;
93 	struct ieee80211_rateset *rs;
94 	int j;
95 
96 	if ((caddr_t)(ap + 1) > sa->max)
97 		return;
98 	memset(ap, 0, sizeof(struct wi_apinfo));
99 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
100 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
101 		ap->namelen = ic->ic_des_esslen;
102 		if (ic->ic_des_esslen)
103 			memcpy(ap->name, ic->ic_des_essid,
104 			    ic->ic_des_esslen);
105 	} else {
106 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
107 		ap->namelen = ni->ni_esslen;
108 		if (ni->ni_esslen)
109 			memcpy(ap->name, ni->ni_essid,
110 			    ni->ni_esslen);
111 	}
112 	ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
113 	ap->signal = ic->ic_node_getrssi(ni);
114 	ap->capinfo = ni->ni_capinfo;
115 	ap->interval = ni->ni_intval;
116 	rs = &ni->ni_rates;
117 	for (j = 0; j < rs->rs_nrates; j++) {
118 		if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
119 			ap->rate = (rs->rs_rates[j] &
120 			    IEEE80211_RATE_VAL) * 5; /* XXX */
121 		}
122 	}
123 	sa->i++;
124 	sa->ap++;
125 }
126 
127 struct wi_read_prism2_args {
128 	int	i;		/* result count */
129 	struct wi_scan_res *res;/* current entry in result buffer */
130 	caddr_t	max;		/* result buffer bound */
131 };
132 
133 static void
134 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
135 {
136 	struct ieee80211com *ic = ni->ni_ic;
137 	struct wi_read_prism2_args *sa = arg;
138 	struct wi_scan_res *res = sa->res;
139 
140 	if ((caddr_t)(res + 1) > sa->max)
141 		return;
142 	res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
143 	res->wi_noise = 0;
144 	res->wi_signal = ic->ic_node_getrssi(ni);
145 	IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
146 	res->wi_interval = ni->ni_intval;
147 	res->wi_capinfo = ni->ni_capinfo;
148 	res->wi_ssid_len = ni->ni_esslen;
149 	memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
150 	/* NB: assumes wi_srates holds <= ni->ni_rates */
151 	memcpy(res->wi_srates, ni->ni_rates.rs_rates,
152 		sizeof(res->wi_srates));
153 	if (ni->ni_rates.rs_nrates < 10)
154 		res->wi_srates[ni->ni_rates.rs_nrates] = 0;
155 	res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
156 	res->wi_rsvd = 0;
157 
158 	sa->i++;
159 	sa->res++;
160 }
161 
162 struct wi_read_sigcache_args {
163 	int	i;		/* result count */
164 	struct wi_sigcache *wsc;/* current entry in result buffer */
165 	caddr_t	max;		/* result buffer bound */
166 };
167 
168 static void
169 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
170 {
171 	struct ieee80211com *ic = ni->ni_ic;
172 	struct wi_read_sigcache_args *sa = arg;
173 	struct wi_sigcache *wsc = sa->wsc;
174 
175 	if ((caddr_t)(wsc + 1) > sa->max)
176 		return;
177 	memset(wsc, 0, sizeof(struct wi_sigcache));
178 	IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
179 	wsc->signal = ic->ic_node_getrssi(ni);
180 
181 	sa->wsc++;
182 	sa->i++;
183 }
184 
185 int
186 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, caddr_t data)
187 {
188 	struct ifnet *ifp = ic->ic_ifp;
189 	int i, j, error;
190 	struct ifreq *ifr = (struct ifreq *)data;
191 	struct wi_req wreq;
192 	struct wi_ltv_keys *keys;
193 
194 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
195 	if (error)
196 		return error;
197 	wreq.wi_len = 0;
198 	switch (wreq.wi_type) {
199 	case WI_RID_SERIALNO:
200 		/* nothing appropriate */
201 		break;
202 	case WI_RID_NODENAME:
203 		strcpy((char *)&wreq.wi_val[1], hostname);
204 		wreq.wi_val[0] = htole16(strlen(hostname));
205 		wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
206 		break;
207 	case WI_RID_CURRENT_SSID:
208 		if (ic->ic_state != IEEE80211_S_RUN) {
209 			wreq.wi_val[0] = 0;
210 			wreq.wi_len = 1;
211 			break;
212 		}
213 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
214 		memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
215 		    ic->ic_bss->ni_esslen);
216 		wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
217 		break;
218 	case WI_RID_OWN_SSID:
219 	case WI_RID_DESIRED_SSID:
220 		wreq.wi_val[0] = htole16(ic->ic_des_esslen);
221 		memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
222 		wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
223 		break;
224 	case WI_RID_CURRENT_BSSID:
225 		if (ic->ic_state == IEEE80211_S_RUN)
226 			IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
227 		else
228 			memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
229 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
230 		break;
231 	case WI_RID_CHANNEL_LIST:
232 		memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
233 		/*
234 		 * Since channel 0 is not available for DS, channel 1
235 		 * is assigned to LSB on WaveLAN.
236 		 */
237 		if (ic->ic_phytype == IEEE80211_T_DS)
238 			i = 1;
239 		else
240 			i = 0;
241 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
242 			if (isset(ic->ic_chan_active, i)) {
243 				setbit((u_int8_t *)wreq.wi_val, j);
244 				wreq.wi_len = j / 16 + 1;
245 			}
246 		break;
247 	case WI_RID_OWN_CHNL:
248 		wreq.wi_val[0] = htole16(
249 			ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
250 		wreq.wi_len = 1;
251 		break;
252 	case WI_RID_CURRENT_CHAN:
253 		wreq.wi_val[0] = htole16(
254 			ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan));
255 		wreq.wi_len = 1;
256 		break;
257 	case WI_RID_COMMS_QUALITY:
258 		wreq.wi_val[0] = 0;				/* quality */
259 		wreq.wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
260 		wreq.wi_val[2] = 0;				/* noise */
261 		wreq.wi_len = 3;
262 		break;
263 	case WI_RID_PROMISC:
264 		wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
265 		wreq.wi_len = 1;
266 		break;
267 	case WI_RID_PORTTYPE:
268 		wreq.wi_val[0] = htole16(ic->ic_opmode);
269 		wreq.wi_len = 1;
270 		break;
271 	case WI_RID_MAC_NODE:
272 		IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
273 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
274 		break;
275 	case WI_RID_TX_RATE:
276 		if (ic->ic_fixed_rate == -1)
277 			wreq.wi_val[0] = 0;	/* auto */
278 		else
279 			wreq.wi_val[0] = htole16(
280 			    (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
281 			    IEEE80211_RATE_VAL) / 2);
282 		wreq.wi_len = 1;
283 		break;
284 	case WI_RID_CUR_TX_RATE:
285 		wreq.wi_val[0] = htole16(
286 		    (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
287 		    IEEE80211_RATE_VAL) / 2);
288 		wreq.wi_len = 1;
289 		break;
290 	case WI_RID_RTS_THRESH:
291 		wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
292 		wreq.wi_len = 1;
293 		break;
294 	case WI_RID_CREATE_IBSS:
295 		wreq.wi_val[0] =
296 		    htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
297 		wreq.wi_len = 1;
298 		break;
299 	case WI_RID_MICROWAVE_OVEN:
300 		wreq.wi_val[0] = 0;	/* no ... not supported */
301 		wreq.wi_len = 1;
302 		break;
303 	case WI_RID_ROAMING_MODE:
304 		wreq.wi_val[0] = htole16(ic->ic_roaming);	/* XXX map */
305 		wreq.wi_len = 1;
306 		break;
307 	case WI_RID_SYSTEM_SCALE:
308 		wreq.wi_val[0] = htole16(1);	/* low density ... not supp */
309 		wreq.wi_len = 1;
310 		break;
311 	case WI_RID_PM_ENABLED:
312 		wreq.wi_val[0] =
313 		    htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
314 		wreq.wi_len = 1;
315 		break;
316 	case WI_RID_MAX_SLEEP:
317 		wreq.wi_val[0] = htole16(ic->ic_lintval);
318 		wreq.wi_len = 1;
319 		break;
320 	case WI_RID_CUR_BEACON_INT:
321 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
322 		wreq.wi_len = 1;
323 		break;
324 	case WI_RID_WEP_AVAIL:
325 		wreq.wi_val[0] = htole16(1);	/* always available */
326 		wreq.wi_len = 1;
327 		break;
328 	case WI_RID_CNFAUTHMODE:
329 		wreq.wi_val[0] = htole16(1);	/* TODO: open system only */
330 		wreq.wi_len = 1;
331 		break;
332 	case WI_RID_ENCRYPTION:
333 		wreq.wi_val[0] =
334 		    htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
335 		wreq.wi_len = 1;
336 		break;
337 	case WI_RID_TX_CRYPT_KEY:
338 		wreq.wi_val[0] = htole16(ic->ic_def_txkey);
339 		wreq.wi_len = 1;
340 		break;
341 	case WI_RID_DEFLT_CRYPT_KEYS:
342 		keys = (struct wi_ltv_keys *)&wreq;
343 		/* do not show keys to non-root user */
344 		error = suser(curthread);
345 		if (error) {
346 			memset(keys, 0, sizeof(*keys));
347 			error = 0;
348 			break;
349 		}
350 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
351 			keys->wi_keys[i].wi_keylen =
352 			    htole16(ic->ic_nw_keys[i].wk_keylen);
353 			memcpy(keys->wi_keys[i].wi_keydat,
354 			    ic->ic_nw_keys[i].wk_key,
355 			    ic->ic_nw_keys[i].wk_keylen);
356 		}
357 		wreq.wi_len = sizeof(*keys) / 2;
358 		break;
359 	case WI_RID_MAX_DATALEN:
360 		wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
361 		wreq.wi_len = 1;
362 		break;
363 	case WI_RID_IFACE_STATS:
364 		/* XXX: should be implemented in lower drivers */
365 		break;
366 	case WI_RID_READ_APS:
367 		/*
368 		 * Don't return results until active scan completes.
369 		 */
370 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
371 			struct wi_read_ap_args args;
372 
373 			args.i = 0;
374 			args.ap = (void *)((char *)wreq.wi_val + sizeof(i));
375 			args.max = (void *)(&wreq + 1);
376 			ieee80211_iterate_nodes(&ic->ic_scan,
377 				wi_read_ap_result, &args);
378 			memcpy(wreq.wi_val, &args.i, sizeof(args.i));
379 			wreq.wi_len = (sizeof(int) +
380 				sizeof(struct wi_apinfo) * args.i) / 2;
381 		} else
382 			error = EINPROGRESS;
383 		break;
384 	case WI_RID_PRISM2:
385 		/* NB: we lie so WI_RID_SCAN_RES can include rates */
386 		wreq.wi_val[0] = 1;
387 		wreq.wi_len = sizeof(u_int16_t) / 2;
388 		break;
389 	case WI_RID_SCAN_RES:			/* compatibility interface */
390 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
391 			struct wi_read_prism2_args args;
392 			struct wi_scan_p2_hdr *p2;
393 
394 			/* NB: use Prism2 format so we can include rate info */
395 			p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
396 			args.i = 0;
397 			args.res = (void *)&p2[1];
398 			args.max = (void *)(&wreq + 1);
399 			ieee80211_iterate_nodes(&ic->ic_scan,
400 				wi_read_prism2_result, &args);
401 			p2->wi_rsvd = 0;
402 			p2->wi_reason = args.i;
403 			wreq.wi_len = (sizeof(*p2) +
404 				sizeof(struct wi_scan_res) * args.i) / 2;
405 		} else
406 			error = EINPROGRESS;
407 		break;
408 	case WI_RID_READ_CACHE: {
409 		struct wi_read_sigcache_args args;
410 		args.i = 0;
411 		args.wsc = (struct wi_sigcache *) wreq.wi_val;
412 		args.max = (void *)(&wreq + 1);
413 		ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
414 		wreq.wi_len = sizeof(struct wi_sigcache) * args.i / 2;
415 		break;
416 	}
417 	default:
418 		error = EINVAL;
419 		break;
420 	}
421 	if (error == 0) {
422 		wreq.wi_len++;
423 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
424 	}
425 	return error;
426 }
427 
428 static int
429 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
430 {
431 #define	IEEERATE(_ic,_m,_i) \
432 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
433 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
434 	for (i = 0; i < nrates; i++)
435 		if (IEEERATE(ic, mode, i) == rate)
436 			return i;
437 	return -1;
438 #undef IEEERATE
439 }
440 
441 /*
442  * Prepare to do a user-initiated scan for AP's.  If no
443  * current/default channel is setup or the current channel
444  * is invalid then pick the first available channel from
445  * the active list as the place to start the scan.
446  */
447 static int
448 ieee80211_setupscan(struct ieee80211com *ic, const u_int8_t chanlist[])
449 {
450 	int i;
451 
452 	/*
453 	 * XXX don't permit a scan to be started unless we
454 	 * know the device is ready.  For the moment this means
455 	 * the device is marked up as this is the required to
456 	 * initialize the hardware.  It would be better to permit
457 	 * scanning prior to being up but that'll require some
458 	 * changes to the infrastructure.
459 	 */
460 	if (!IS_UP(ic))
461 		return EINVAL;
462 	if (ic->ic_ibss_chan == NULL ||
463 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
464 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
465 			if (isset(chanlist, i)) {
466 				ic->ic_ibss_chan = &ic->ic_channels[i];
467 				goto found;
468 			}
469 		return EINVAL;			/* no active channels */
470 found:
471 		;
472 	}
473 	if (ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC ||
474 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan)))
475 		ic->ic_bss->ni_chan = ic->ic_ibss_chan;
476 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
477 	/*
478 	 * We force the state to INIT before calling ieee80211_new_state
479 	 * to get ieee80211_begin_scan called.  We really want to scan w/o
480 	 * altering the current state but that's not possible right now.
481 	 */
482 	/* XXX handle proberequest case */
483 	ic->ic_state = IEEE80211_S_INIT;	/* XXX bypass state machine */
484 	return 0;
485 }
486 
487 int
488 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, caddr_t data)
489 {
490 	struct ifnet *ifp = ic->ic_ifp;
491 	int i, j, len, error, rate;
492 	struct ifreq *ifr = (struct ifreq *)data;
493 	struct wi_ltv_keys *keys;
494 	struct wi_req wreq;
495 	u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
496 
497 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
498 	if (error)
499 		return error;
500 	len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
501 	switch (wreq.wi_type) {
502 	case WI_RID_SERIALNO:
503 	case WI_RID_NODENAME:
504 		return EPERM;
505 	case WI_RID_CURRENT_SSID:
506 		return EPERM;
507 	case WI_RID_OWN_SSID:
508 	case WI_RID_DESIRED_SSID:
509 		if (le16toh(wreq.wi_val[0]) * 2 > len ||
510 		    le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
511 			error = ENOSPC;
512 			break;
513 		}
514 		memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
515 		ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
516 		memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
517 		error = ENETRESET;
518 		break;
519 	case WI_RID_CURRENT_BSSID:
520 		return EPERM;
521 	case WI_RID_OWN_CHNL:
522 		if (len != 2)
523 			return EINVAL;
524 		i = le16toh(wreq.wi_val[0]);
525 		if (i < 0 ||
526 		    i > IEEE80211_CHAN_MAX ||
527 		    isclr(ic->ic_chan_active, i))
528 			return EINVAL;
529 		ic->ic_ibss_chan = &ic->ic_channels[i];
530 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
531 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
532 		else
533 			error = ENETRESET;
534 		break;
535 	case WI_RID_CURRENT_CHAN:
536 		return EPERM;
537 	case WI_RID_COMMS_QUALITY:
538 		return EPERM;
539 	case WI_RID_PROMISC:
540 		if (len != 2)
541 			return EINVAL;
542 		if (ifp->if_flags & IFF_PROMISC) {
543 			if (wreq.wi_val[0] == 0) {
544 				ifp->if_flags &= ~IFF_PROMISC;
545 				error = ENETRESET;
546 			}
547 		} else {
548 			if (wreq.wi_val[0] != 0) {
549 				ifp->if_flags |= IFF_PROMISC;
550 				error = ENETRESET;
551 			}
552 		}
553 		break;
554 	case WI_RID_PORTTYPE:
555 		if (len != 2)
556 			return EINVAL;
557 		switch (le16toh(wreq.wi_val[0])) {
558 		case IEEE80211_M_STA:
559 			break;
560 		case IEEE80211_M_IBSS:
561 			if (!(ic->ic_caps & IEEE80211_C_IBSS))
562 				return EINVAL;
563 			break;
564 		case IEEE80211_M_AHDEMO:
565 			if (ic->ic_phytype != IEEE80211_T_DS ||
566 			    !(ic->ic_caps & IEEE80211_C_AHDEMO))
567 				return EINVAL;
568 			break;
569 		case IEEE80211_M_HOSTAP:
570 			if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
571 				return EINVAL;
572 			break;
573 		default:
574 			return EINVAL;
575 		}
576 		if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
577 			ic->ic_opmode = le16toh(wreq.wi_val[0]);
578 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
579 		}
580 		break;
581 #if 0
582 	case WI_RID_MAC_NODE:
583 		if (len != IEEE80211_ADDR_LEN)
584 			return EINVAL;
585 		IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
586 		/* if_init will copy lladdr into ic_myaddr */
587 		error = ENETRESET;
588 		break;
589 #endif
590 	case WI_RID_TX_RATE:
591 		if (len != 2)
592 			return EINVAL;
593 		if (wreq.wi_val[0] == 0) {
594 			/* auto */
595 			ic->ic_fixed_rate = -1;
596 			break;
597 		}
598 		rate = 2 * le16toh(wreq.wi_val[0]);
599 		if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
600 			/*
601 			 * In autoselect mode search for the rate.  We take
602 			 * the first instance which may not be right, but we
603 			 * are limited by the interface.  Note that we also
604 			 * lock the mode to insure the rate is meaningful
605 			 * when it is used.
606 			 */
607 			for (j = IEEE80211_MODE_11A;
608 			     j < IEEE80211_MODE_MAX; j++) {
609 				if ((ic->ic_modecaps & (1<<j)) == 0)
610 					continue;
611 				i = findrate(ic, j, rate);
612 				if (i != -1) {
613 					/* lock mode too */
614 					ic->ic_curmode = j;
615 					goto setrate;
616 				}
617 			}
618 		} else {
619 			i = findrate(ic, ic->ic_curmode, rate);
620 			if (i != -1)
621 				goto setrate;
622 		}
623 		return EINVAL;
624 	setrate:
625 		ic->ic_fixed_rate = i;
626 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
627 		break;
628 	case WI_RID_CUR_TX_RATE:
629 		return EPERM;
630 	case WI_RID_RTS_THRESH:
631 		if (len != 2)
632 			return EINVAL;
633 		if (le16toh(wreq.wi_val[0]) != IEEE80211_MAX_LEN)
634 			return EINVAL;		/* TODO: RTS */
635 		break;
636 	case WI_RID_CREATE_IBSS:
637 		if (len != 2)
638 			return EINVAL;
639 		if (wreq.wi_val[0] != 0) {
640 			if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
641 				return EINVAL;
642 			if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
643 				ic->ic_flags |= IEEE80211_F_IBSSON;
644 				if (ic->ic_opmode == IEEE80211_M_IBSS &&
645 				    ic->ic_state == IEEE80211_S_SCAN)
646 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
647 			}
648 		} else {
649 			if (ic->ic_flags & IEEE80211_F_IBSSON) {
650 				ic->ic_flags &= ~IEEE80211_F_IBSSON;
651 				if (ic->ic_flags & IEEE80211_F_SIBSS) {
652 					ic->ic_flags &= ~IEEE80211_F_SIBSS;
653 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
654 				}
655 			}
656 		}
657 		break;
658 	case WI_RID_MICROWAVE_OVEN:
659 		if (len != 2)
660 			return EINVAL;
661 		if (wreq.wi_val[0] != 0)
662 			return EINVAL;		/* not supported */
663 		break;
664 	case WI_RID_ROAMING_MODE:
665 		if (len != 2)
666 			return EINVAL;
667 		i = le16toh(wreq.wi_val[0]);
668 		if (i > IEEE80211_ROAMING_MANUAL)
669 			return EINVAL;		/* not supported */
670 		ic->ic_roaming = i;
671 		break;
672 	case WI_RID_SYSTEM_SCALE:
673 		if (len != 2)
674 			return EINVAL;
675 		if (le16toh(wreq.wi_val[0]) != 1)
676 			return EINVAL;		/* not supported */
677 		break;
678 	case WI_RID_PM_ENABLED:
679 		if (len != 2)
680 			return EINVAL;
681 		if (wreq.wi_val[0] != 0) {
682 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
683 				return EINVAL;
684 			if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
685 				ic->ic_flags |= IEEE80211_F_PMGTON;
686 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
687 			}
688 		} else {
689 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
690 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
691 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
692 			}
693 		}
694 		break;
695 	case WI_RID_MAX_SLEEP:
696 		if (len != 2)
697 			return EINVAL;
698 		ic->ic_lintval = le16toh(wreq.wi_val[0]);
699 		if (ic->ic_flags & IEEE80211_F_PMGTON)
700 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
701 		break;
702 	case WI_RID_CUR_BEACON_INT:
703 		return EPERM;
704 	case WI_RID_WEP_AVAIL:
705 		return EPERM;
706 	case WI_RID_CNFAUTHMODE:
707 		if (len != 2)
708 			return EINVAL;
709 		i = le16toh(wreq.wi_val[0]);
710 		if (i > IEEE80211_AUTH_WPA)
711 			return EINVAL;
712 		ic->ic_bss->ni_authmode = i;		/* XXX ENETRESET? */
713 		error = ENETRESET;
714 		break;
715 	case WI_RID_ENCRYPTION:
716 		if (len != 2)
717 			return EINVAL;
718 		if (wreq.wi_val[0] != 0) {
719 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
720 				return EINVAL;
721 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
722 				ic->ic_flags |= IEEE80211_F_PRIVACY;
723 				error = ENETRESET;
724 			}
725 		} else {
726 			if (ic->ic_flags & IEEE80211_F_PRIVACY) {
727 				ic->ic_flags &= ~IEEE80211_F_PRIVACY;
728 				error = ENETRESET;
729 			}
730 		}
731 		break;
732 	case WI_RID_TX_CRYPT_KEY:
733 		if (len != 2)
734 			return EINVAL;
735 		i = le16toh(wreq.wi_val[0]);
736 		if (i >= IEEE80211_WEP_NKID)
737 			return EINVAL;
738 		ic->ic_def_txkey = i;
739 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
740 		break;
741 	case WI_RID_DEFLT_CRYPT_KEYS:
742 		if (len != sizeof(struct wi_ltv_keys))
743 			return EINVAL;
744 		keys = (struct wi_ltv_keys *)&wreq;
745 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
746 			len = le16toh(keys->wi_keys[i].wi_keylen);
747 			if (len != 0 && len < IEEE80211_WEP_KEYLEN)
748 				return EINVAL;
749 			if (len > IEEE80211_KEYBUF_SIZE)
750 				return EINVAL;
751 		}
752 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
753 			struct ieee80211_key *k = &ic->ic_nw_keys[i];
754 
755 			len = le16toh(keys->wi_keys[i].wi_keylen);
756 			k->wk_keylen = len;
757 			k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
758 			memset(k->wk_key, 0, sizeof(k->wk_key));
759 			memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
760 #if 0
761 			k->wk_type = IEEE80211_CIPHER_WEP;
762 #endif
763 		}
764 		error = ENETRESET;
765 		break;
766 	case WI_RID_MAX_DATALEN:
767 		if (len != 2)
768 			return EINVAL;
769 		len = le16toh(wreq.wi_val[0]);
770 		if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
771 			return EINVAL;
772 		ic->ic_fragthreshold = len;
773 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
774 		break;
775 	case WI_RID_IFACE_STATS:
776 		error = EPERM;
777 		break;
778 	case WI_RID_SCAN_REQ:			/* XXX wicontrol */
779 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
780 			break;
781 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
782 		if (error == 0)
783 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
784 		break;
785 	case WI_RID_SCAN_APS:
786 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
787 			break;
788 		len--;			/* XXX: tx rate? */
789 		/* FALLTHRU */
790 	case WI_RID_CHANNEL_LIST:
791 		memset(chanlist, 0, sizeof(chanlist));
792 		/*
793 		 * Since channel 0 is not available for DS, channel 1
794 		 * is assigned to LSB on WaveLAN.
795 		 */
796 		if (ic->ic_phytype == IEEE80211_T_DS)
797 			i = 1;
798 		else
799 			i = 0;
800 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
801 			if ((j / 8) >= len)
802 				break;
803 			if (isclr((u_int8_t *)wreq.wi_val, j))
804 				continue;
805 			if (isclr(ic->ic_chan_active, i)) {
806 				if (wreq.wi_type != WI_RID_CHANNEL_LIST)
807 					continue;
808 				if (isclr(ic->ic_chan_avail, i))
809 					return EPERM;
810 			}
811 			setbit(chanlist, i);
812 		}
813 		error = ieee80211_setupscan(ic, chanlist);
814 		if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
815 			/* NB: ignore error from ieee80211_setupscan */
816 			error = ENETRESET;
817 		} else if (error == 0)
818 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
819 		break;
820 	default:
821 		error = EINVAL;
822 		break;
823 	}
824 	if (error == ENETRESET && !IS_UP_AUTO(ic))
825 		error = 0;
826 	return error;
827 }
828 
829 static struct ieee80211_channel *
830 getcurchan(struct ieee80211com *ic)
831 {
832 	switch (ic->ic_state) {
833 	case IEEE80211_S_INIT:
834 	case IEEE80211_S_SCAN:
835 		return ic->ic_des_chan;
836 	default:
837 		return ic->ic_ibss_chan;
838 	}
839 }
840 
841 static int
842 cap2cipher(int flag)
843 {
844 	switch (flag) {
845 	case IEEE80211_C_WEP:		return IEEE80211_CIPHER_WEP;
846 	case IEEE80211_C_AES:		return IEEE80211_CIPHER_AES_OCB;
847 	case IEEE80211_C_AES_CCM:	return IEEE80211_CIPHER_AES_CCM;
848 	case IEEE80211_C_CKIP:		return IEEE80211_CIPHER_CKIP;
849 	case IEEE80211_C_TKIP:		return IEEE80211_CIPHER_TKIP;
850 	}
851 	return -1;
852 }
853 
854 static int
855 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq)
856 {
857 	struct ieee80211_node *ni;
858 	struct ieee80211req_key ik;
859 	struct ieee80211_key *wk;
860 	const struct ieee80211_cipher *cip;
861 	u_int kid;
862 	int error;
863 
864 	if (ireq->i_len != sizeof(ik))
865 		return EINVAL;
866 	error = copyin(ireq->i_data, &ik, sizeof(ik));
867 	if (error)
868 		return error;
869 	kid = ik.ik_keyix;
870 	if (kid == IEEE80211_KEYIX_NONE) {
871 		ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
872 		if (ni == NULL)
873 			return EINVAL;		/* XXX */
874 		wk = &ni->ni_ucastkey;
875 	} else {
876 		if (kid >= IEEE80211_WEP_NKID)
877 			return EINVAL;
878 		wk = &ic->ic_nw_keys[kid];
879 		IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
880 		ni = NULL;
881 	}
882 	cip = wk->wk_cipher;
883 	ik.ik_type = cip->ic_cipher;
884 	ik.ik_keylen = wk->wk_keylen;
885 	ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
886 	if (wk->wk_keyix == ic->ic_def_txkey)
887 		ik.ik_flags |= IEEE80211_KEY_DEFAULT;
888 	if (suser(curthread) == 0) {
889 		/* NB: only root can read key data */
890 		ik.ik_keyrsc = wk->wk_keyrsc;
891 		ik.ik_keytsc = wk->wk_keytsc;
892 		memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
893 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
894 			memcpy(ik.ik_keydata+wk->wk_keylen,
895 				wk->wk_key + IEEE80211_KEYBUF_SIZE,
896 				IEEE80211_MICBUF_SIZE);
897 			ik.ik_keylen += IEEE80211_MICBUF_SIZE;
898 		}
899 	} else {
900 		ik.ik_keyrsc = 0;
901 		ik.ik_keytsc = 0;
902 		memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
903 	}
904 	if (ni != NULL)
905 		ieee80211_free_node(ni);
906 	return copyout(&ik, ireq->i_data, sizeof(ik));
907 }
908 
909 static int
910 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
911 {
912 
913 	if (sizeof(ic->ic_chan_active) > ireq->i_len)
914 		ireq->i_len = sizeof(ic->ic_chan_active);
915 	return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
916 }
917 
918 static int
919 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
920 {
921 	struct ieee80211req_chaninfo chans;	/* XXX off stack? */
922 	int i, space;
923 
924 	/*
925 	 * Since channel 0 is not available for DS, channel 1
926 	 * is assigned to LSB on WaveLAN.
927 	 */
928 	if (ic->ic_phytype == IEEE80211_T_DS)
929 		i = 1;
930 	else
931 		i = 0;
932 	memset(&chans, 0, sizeof(chans));
933 	for (; i <= IEEE80211_CHAN_MAX; i++)
934 		if (isset(ic->ic_chan_avail, i)) {
935 			struct ieee80211_channel *c = &ic->ic_channels[i];
936 			chans.ic_chans[chans.ic_nchans].ic_freq = c->ic_freq;
937 			chans.ic_chans[chans.ic_nchans].ic_flags = c->ic_flags;
938 			chans.ic_nchans++;
939 		}
940 	space = __offsetof(struct ieee80211req_chaninfo,
941 			ic_chans[chans.ic_nchans]);
942 	if (space > ireq->i_len)
943 		space = ireq->i_len;
944 	return copyout(&chans, ireq->i_data, space);
945 }
946 
947 static int
948 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
949 {
950 	struct ieee80211_node *ni;
951 	struct ieee80211req_wpaie wpaie;
952 	int error;
953 
954 	if (ireq->i_len < IEEE80211_ADDR_LEN)
955 		return EINVAL;
956 	error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
957 	if (error != 0)
958 		return error;
959 	ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
960 	if (ni == NULL)
961 		return EINVAL;		/* XXX */
962 	memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
963 	if (ni->ni_wpa_ie != NULL) {
964 		int ielen = ni->ni_wpa_ie[1] + 2;
965 		if (ielen > sizeof(wpaie.wpa_ie))
966 			ielen = sizeof(wpaie.wpa_ie);
967 		memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
968 	}
969 	ieee80211_free_node(ni);
970 	if (ireq->i_len > sizeof(wpaie))
971 		ireq->i_len = sizeof(wpaie);
972 	return copyout(&wpaie, ireq->i_data, ireq->i_len);
973 }
974 
975 static int
976 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
977 {
978 	struct ieee80211_node *ni;
979 	u_int8_t macaddr[IEEE80211_ADDR_LEN];
980 	const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
981 	int error;
982 
983 	if (ireq->i_len < off)
984 		return EINVAL;
985 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
986 	if (error != 0)
987 		return error;
988 	ni = ieee80211_find_node(&ic->ic_sta, macaddr);
989 	if (ni == NULL)
990 		return EINVAL;		/* XXX */
991 	if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
992 		ireq->i_len = sizeof(struct ieee80211req_sta_stats);
993 	/* NB: copy out only the statistics */
994 	error = copyout(&ni->ni_stats, (u_int8_t *) ireq->i_data + off,
995 			ireq->i_len - off);
996 	ieee80211_free_node(ni);
997 	return error;
998 }
999 
1000 static void
1001 get_scan_result(struct ieee80211req_scan_result *sr,
1002 	const struct ieee80211_node *ni)
1003 {
1004 	struct ieee80211com *ic = ni->ni_ic;
1005 
1006 	memset(sr, 0, sizeof(*sr));
1007 	sr->isr_ssid_len = ni->ni_esslen;
1008 	if (ni->ni_wpa_ie != NULL)
1009 		sr->isr_ie_len += 2+ni->ni_wpa_ie[1];
1010 	if (ni->ni_wme_ie != NULL)
1011 		sr->isr_ie_len += 2+ni->ni_wme_ie[1];
1012 	sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
1013 	sr->isr_len = roundup(sr->isr_len, sizeof(u_int32_t));
1014 	if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
1015 		sr->isr_freq = ni->ni_chan->ic_freq;
1016 		sr->isr_flags = ni->ni_chan->ic_flags;
1017 	}
1018 	sr->isr_rssi = ic->ic_node_getrssi(ni);
1019 	sr->isr_intval = ni->ni_intval;
1020 	sr->isr_capinfo = ni->ni_capinfo;
1021 	sr->isr_erp = ni->ni_erp;
1022 	IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
1023 	sr->isr_nrates = ni->ni_rates.rs_nrates;
1024 	if (sr->isr_nrates > 15)
1025 		sr->isr_nrates = 15;
1026 	memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
1027 }
1028 
1029 static int
1030 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
1031 {
1032 	union {
1033 		struct ieee80211req_scan_result res;
1034 		char data[512];		/* XXX shrink? */
1035 	} u;
1036 	struct ieee80211req_scan_result *sr = &u.res;
1037 	struct ieee80211_node_table *nt;
1038 	struct ieee80211_node *ni;
1039 	int error, space;
1040 	u_int8_t *p, *cp;
1041 
1042 	p = ireq->i_data;
1043 	space = ireq->i_len;
1044 	error = 0;
1045 	/* XXX locking */
1046 	nt =  &ic->ic_scan;
1047 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1048 		/* NB: skip pre-scan node state */
1049 		if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1050 			continue;
1051 		get_scan_result(sr, ni);
1052 		if (sr->isr_len > sizeof(u))
1053 			continue;		/* XXX */
1054 		if (space < sr->isr_len)
1055 			break;
1056 		cp = (u_int8_t *)(sr+1);
1057 		memcpy(cp, ni->ni_essid, ni->ni_esslen);
1058 		cp += ni->ni_esslen;
1059 		if (ni->ni_wpa_ie != NULL) {
1060 			memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1061 			cp += 2+ni->ni_wpa_ie[1];
1062 		}
1063 		if (ni->ni_wme_ie != NULL) {
1064 			memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1065 			cp += 2+ni->ni_wme_ie[1];
1066 		}
1067 		error = copyout(sr, p, sr->isr_len);
1068 		if (error)
1069 			break;
1070 		p += sr->isr_len;
1071 		space -= sr->isr_len;
1072 	}
1073 	ireq->i_len -= space;
1074 	return error;
1075 }
1076 
1077 static void
1078 get_sta_info(struct ieee80211req_sta_info *si, const struct ieee80211_node *ni)
1079 {
1080 	struct ieee80211com *ic = ni->ni_ic;
1081 
1082 	si->isi_ie_len = 0;
1083 	if (ni->ni_wpa_ie != NULL)
1084 		si->isi_ie_len += 2+ni->ni_wpa_ie[1];
1085 	if (ni->ni_wme_ie != NULL)
1086 		si->isi_ie_len += 2+ni->ni_wme_ie[1];
1087 	si->isi_len = sizeof(*si) + si->isi_ie_len, sizeof(u_int32_t);
1088 	si->isi_len = roundup(si->isi_len, sizeof(u_int32_t));
1089 	si->isi_freq = ni->ni_chan->ic_freq;
1090 	si->isi_flags = ni->ni_chan->ic_flags;
1091 	si->isi_state = ni->ni_flags;
1092 	si->isi_authmode = ni->ni_authmode;
1093 	si->isi_rssi = ic->ic_node_getrssi(ni);
1094 	si->isi_capinfo = ni->ni_capinfo;
1095 	si->isi_erp = ni->ni_erp;
1096 	IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
1097 	si->isi_nrates = ni->ni_rates.rs_nrates;
1098 	if (si->isi_nrates > 15)
1099 		si->isi_nrates = 15;
1100 	memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
1101 	si->isi_txrate = ni->ni_txrate;
1102 	si->isi_associd = ni->ni_associd;
1103 	si->isi_txpower = ni->ni_txpower;
1104 	si->isi_vlan = ni->ni_vlan;
1105 	if (ni->ni_flags & IEEE80211_NODE_QOS) {
1106 		memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
1107 		memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
1108 	} else {
1109 		si->isi_txseqs[0] = ni->ni_txseqs[0];
1110 		si->isi_rxseqs[0] = ni->ni_rxseqs[0];
1111 	}
1112 	if (ic->ic_opmode == IEEE80211_M_IBSS || ni->ni_associd != 0)
1113 		si->isi_inact = ic->ic_inact_run;
1114 	else if (ieee80211_node_is_authorized(ni))
1115 		si->isi_inact = ic->ic_inact_auth;
1116 	else
1117 		si->isi_inact = ic->ic_inact_init;
1118 	si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
1119 }
1120 
1121 static int
1122 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
1123 {
1124 	union {
1125 		struct ieee80211req_sta_info info;
1126 		char data[512];		/* XXX shrink? */
1127 	} u;
1128 	struct ieee80211req_sta_info *si = &u.info;
1129 	struct ieee80211_node_table *nt;
1130 	struct ieee80211_node *ni;
1131 	int error, space;
1132 	u_int8_t *p, *cp;
1133 
1134 	nt = &ic->ic_sta;
1135 	p = ireq->i_data;
1136 	space = ireq->i_len;
1137 	error = 0;
1138 	/* XXX locking */
1139 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1140 		get_sta_info(si, ni);
1141 		if (si->isi_len > sizeof(u))
1142 			continue;		/* XXX */
1143 		if (space < si->isi_len)
1144 			break;
1145 		cp = (u_int8_t *)(si+1);
1146 		if (ni->ni_wpa_ie != NULL) {
1147 			memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1148 			cp += 2+ni->ni_wpa_ie[1];
1149 		}
1150 		if (ni->ni_wme_ie != NULL) {
1151 			memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1152 			cp += 2+ni->ni_wme_ie[1];
1153 		}
1154 		error = copyout(si, p, si->isi_len);
1155 		if (error)
1156 			break;
1157 		p += si->isi_len;
1158 		space -= si->isi_len;
1159 	}
1160 	ireq->i_len -= space;
1161 	return error;
1162 }
1163 
1164 static int
1165 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1166 {
1167 	struct ieee80211_node *ni;
1168 	struct ieee80211req_sta_txpow txpow;
1169 	int error;
1170 
1171 	if (ireq->i_len != sizeof(txpow))
1172 		return EINVAL;
1173 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1174 	if (error != 0)
1175 		return error;
1176 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1177 	if (ni == NULL)
1178 		return EINVAL;		/* XXX */
1179 	txpow.it_txpow = ni->ni_txpower;
1180 	error = copyout(&txpow, ireq->i_data, sizeof(txpow));
1181 	ieee80211_free_node(ni);
1182 	return error;
1183 }
1184 
1185 static int
1186 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1187 {
1188 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1189 	struct wmeParams *wmep;
1190 	int ac;
1191 
1192 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1193 		return EINVAL;
1194 
1195 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1196 	if (ac >= WME_NUM_AC)
1197 		ac = WME_AC_BE;
1198 	if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
1199 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1200 	else
1201 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1202 	switch (ireq->i_type) {
1203 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1204 		ireq->i_val = wmep->wmep_logcwmin;
1205 		break;
1206 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1207 		ireq->i_val = wmep->wmep_logcwmax;
1208 		break;
1209 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1210 		ireq->i_val = wmep->wmep_aifsn;
1211 		break;
1212 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1213 		ireq->i_val = wmep->wmep_txopLimit;
1214 		break;
1215 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1216 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1217 		ireq->i_val = wmep->wmep_acm;
1218 		break;
1219 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1220 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1221 		ireq->i_val = !wmep->wmep_noackPolicy;
1222 		break;
1223 	}
1224 	return 0;
1225 }
1226 
1227 static int
1228 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1229 {
1230 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1231 	int error = 0;
1232 	u_int kid, len, m;
1233 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1234 	char tmpssid[IEEE80211_NWID_LEN];
1235 
1236 	switch (ireq->i_type) {
1237 	case IEEE80211_IOC_SSID:
1238 		switch (ic->ic_state) {
1239 		case IEEE80211_S_INIT:
1240 		case IEEE80211_S_SCAN:
1241 			ireq->i_len = ic->ic_des_esslen;
1242 			memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
1243 			break;
1244 		default:
1245 			ireq->i_len = ic->ic_bss->ni_esslen;
1246 			memcpy(tmpssid, ic->ic_bss->ni_essid,
1247 				ireq->i_len);
1248 			break;
1249 		}
1250 		error = copyout(tmpssid, ireq->i_data, ireq->i_len);
1251 		break;
1252 	case IEEE80211_IOC_NUMSSIDS:
1253 		ireq->i_val = 1;
1254 		break;
1255 	case IEEE80211_IOC_WEP:
1256 		if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
1257 			ireq->i_val = IEEE80211_WEP_OFF;
1258 		else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
1259 			ireq->i_val = IEEE80211_WEP_ON;
1260 		else
1261 			ireq->i_val = IEEE80211_WEP_MIXED;
1262 		break;
1263 	case IEEE80211_IOC_WEPKEY:
1264 		kid = (u_int) ireq->i_val;
1265 		if (kid >= IEEE80211_WEP_NKID)
1266 			return EINVAL;
1267 		len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
1268 		/* NB: only root can read WEP keys */
1269 		if (suser(curthread) == 0) {
1270 			bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
1271 		} else {
1272 			bzero(tmpkey, len);
1273 		}
1274 		ireq->i_len = len;
1275 		error = copyout(tmpkey, ireq->i_data, len);
1276 		break;
1277 	case IEEE80211_IOC_NUMWEPKEYS:
1278 		ireq->i_val = IEEE80211_WEP_NKID;
1279 		break;
1280 	case IEEE80211_IOC_WEPTXKEY:
1281 		ireq->i_val = ic->ic_def_txkey;
1282 		break;
1283 	case IEEE80211_IOC_AUTHMODE:
1284 		if (ic->ic_flags & IEEE80211_F_WPA)
1285 			ireq->i_val = IEEE80211_AUTH_WPA;
1286 		else
1287 			ireq->i_val = ic->ic_bss->ni_authmode;
1288 		break;
1289 	case IEEE80211_IOC_CHANNEL:
1290 		ireq->i_val = ieee80211_chan2ieee(ic, getcurchan(ic));
1291 		break;
1292 	case IEEE80211_IOC_POWERSAVE:
1293 		if (ic->ic_flags & IEEE80211_F_PMGTON)
1294 			ireq->i_val = IEEE80211_POWERSAVE_ON;
1295 		else
1296 			ireq->i_val = IEEE80211_POWERSAVE_OFF;
1297 		break;
1298 	case IEEE80211_IOC_POWERSAVESLEEP:
1299 		ireq->i_val = ic->ic_lintval;
1300 		break;
1301 	case IEEE80211_IOC_RTSTHRESHOLD:
1302 		ireq->i_val = ic->ic_rtsthreshold;
1303 		break;
1304 	case IEEE80211_IOC_PROTMODE:
1305 		ireq->i_val = ic->ic_protmode;
1306 		break;
1307 	case IEEE80211_IOC_TXPOWER:
1308 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
1309 			return EINVAL;
1310 		ireq->i_val = ic->ic_txpowlimit;
1311 		break;
1312 	case IEEE80211_IOC_MCASTCIPHER:
1313 		ireq->i_val = rsn->rsn_mcastcipher;
1314 		break;
1315 	case IEEE80211_IOC_MCASTKEYLEN:
1316 		ireq->i_val = rsn->rsn_mcastkeylen;
1317 		break;
1318 	case IEEE80211_IOC_UCASTCIPHERS:
1319 		ireq->i_val = 0;
1320 		for (m = 0x1; m != 0; m <<= 1)
1321 			if (rsn->rsn_ucastcipherset & m)
1322 				ireq->i_val |= 1<<cap2cipher(m);
1323 		break;
1324 	case IEEE80211_IOC_UCASTCIPHER:
1325 		ireq->i_val = rsn->rsn_ucastcipher;
1326 		break;
1327 	case IEEE80211_IOC_UCASTKEYLEN:
1328 		ireq->i_val = rsn->rsn_ucastkeylen;
1329 		break;
1330 	case IEEE80211_IOC_KEYMGTALGS:
1331 		ireq->i_val = rsn->rsn_keymgmtset;
1332 		break;
1333 	case IEEE80211_IOC_RSNCAPS:
1334 		ireq->i_val = rsn->rsn_caps;
1335 		break;
1336 	case IEEE80211_IOC_WPA:
1337 		switch (ic->ic_flags & IEEE80211_F_WPA) {
1338 		case IEEE80211_F_WPA1:
1339 			ireq->i_val = 1;
1340 			break;
1341 		case IEEE80211_F_WPA2:
1342 			ireq->i_val = 2;
1343 			break;
1344 		case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
1345 			ireq->i_val = 3;
1346 			break;
1347 		default:
1348 			ireq->i_val = 0;
1349 			break;
1350 		}
1351 		break;
1352 	case IEEE80211_IOC_CHANLIST:
1353 		error = ieee80211_ioctl_getchanlist(ic, ireq);
1354 		break;
1355 	case IEEE80211_IOC_ROAMING:
1356 		ireq->i_val = ic->ic_roaming;
1357 		break;
1358 	case IEEE80211_IOC_PRIVACY:
1359 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
1360 		break;
1361 	case IEEE80211_IOC_DROPUNENCRYPTED:
1362 		ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
1363 		break;
1364 	case IEEE80211_IOC_COUNTERMEASURES:
1365 		ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
1366 		break;
1367 	case IEEE80211_IOC_DRIVER_CAPS:
1368 		ireq->i_val = ic->ic_caps>>16;
1369 		ireq->i_len = ic->ic_caps&0xffff;
1370 		break;
1371 	case IEEE80211_IOC_WME:
1372 		ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
1373 		break;
1374 	case IEEE80211_IOC_HIDESSID:
1375 		ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
1376 		break;
1377 	case IEEE80211_IOC_APBRIDGE:
1378 		ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
1379 		break;
1380 	case IEEE80211_IOC_OPTIE:
1381 		if (ic->ic_opt_ie == NULL)
1382 			return EINVAL;
1383 		/* NB: truncate, caller can check length */
1384 		if (ireq->i_len > ic->ic_opt_ie_len)
1385 			ireq->i_len = ic->ic_opt_ie_len;
1386 		error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
1387 		break;
1388 	case IEEE80211_IOC_WPAKEY:
1389 		error = ieee80211_ioctl_getkey(ic, ireq);
1390 		break;
1391 	case IEEE80211_IOC_CHANINFO:
1392 		error = ieee80211_ioctl_getchaninfo(ic, ireq);
1393 		break;
1394 	case IEEE80211_IOC_BSSID:
1395 		if (ireq->i_len != IEEE80211_ADDR_LEN)
1396 			return EINVAL;
1397 		error = copyout(ic->ic_state == IEEE80211_S_RUN ?
1398 					ic->ic_bss->ni_bssid :
1399 					ic->ic_des_bssid,
1400 				ireq->i_data, ireq->i_len);
1401 		break;
1402 	case IEEE80211_IOC_WPAIE:
1403 		error = ieee80211_ioctl_getwpaie(ic, ireq);
1404 		break;
1405 	case IEEE80211_IOC_SCAN_RESULTS:
1406 		error = ieee80211_ioctl_getscanresults(ic, ireq);
1407 		break;
1408 	case IEEE80211_IOC_STA_STATS:
1409 		error = ieee80211_ioctl_getstastats(ic, ireq);
1410 		break;
1411 	case IEEE80211_IOC_TXPOWMAX:
1412 		ireq->i_val = ic->ic_bss->ni_txpower;
1413 		break;
1414 	case IEEE80211_IOC_STA_TXPOW:
1415 		error = ieee80211_ioctl_getstatxpow(ic, ireq);
1416 		break;
1417 	case IEEE80211_IOC_STA_INFO:
1418 		error = ieee80211_ioctl_getstainfo(ic, ireq);
1419 		break;
1420 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1421 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1422 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1423 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1424 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1425 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
1426 		error = ieee80211_ioctl_getwmeparam(ic, ireq);
1427 		break;
1428 	case IEEE80211_IOC_DTIM_PERIOD:
1429 		ireq->i_val = ic->ic_dtim_period;
1430 		break;
1431 	case IEEE80211_IOC_BEACON_INTERVAL:
1432 		/* NB: get from ic_bss for station mode */
1433 		ireq->i_val = ic->ic_bss->ni_intval;
1434 		break;
1435 	default:
1436 		error = EINVAL;
1437 		break;
1438 	}
1439 	return error;
1440 }
1441 
1442 static int
1443 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
1444 {
1445 	int error;
1446 	void *ie;
1447 
1448 	/*
1449 	 * NB: Doing this for ap operation could be useful (e.g. for
1450 	 *     WPA and/or WME) except that it typically is worthless
1451 	 *     without being able to intervene when processing
1452 	 *     association response frames--so disallow it for now.
1453 	 */
1454 	if (ic->ic_opmode != IEEE80211_M_STA)
1455 		return EINVAL;
1456 	if (ireq->i_len > IEEE80211_MAX_OPT_IE)
1457 		return EINVAL;
1458 	/* NB: data.length is validated by the wireless extensions code */
1459 	MALLOC(ie, void *, ireq->i_len, M_DEVBUF, M_WAITOK);
1460 	if (ie == NULL)
1461 		return ENOMEM;
1462 	error = copyin(ireq->i_data, ie, ireq->i_len);
1463 	/* XXX sanity check data? */
1464 	if (ic->ic_opt_ie != NULL)
1465 		FREE(ic->ic_opt_ie, M_DEVBUF);
1466 	ic->ic_opt_ie = ie;
1467 	ic->ic_opt_ie_len = ireq->i_len;
1468 	return 0;
1469 }
1470 
1471 static int
1472 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1473 {
1474 	struct ieee80211req_key ik;
1475 	struct ieee80211_node *ni;
1476 	struct ieee80211_key *wk;
1477 	u_int16_t kid;
1478 	int error;
1479 
1480 	if (ireq->i_len != sizeof(ik))
1481 		return EINVAL;
1482 	error = copyin(ireq->i_data, &ik, sizeof(ik));
1483 	if (error)
1484 		return error;
1485 	/* NB: cipher support is verified by ieee80211_crypt_newkey */
1486 	/* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1487 	if (ik.ik_keylen > sizeof(ik.ik_keydata))
1488 		return E2BIG;
1489 	kid = ik.ik_keyix;
1490 	if (kid == IEEE80211_KEYIX_NONE) {
1491 		/* XXX unicast keys currently must be tx/rx */
1492 		if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1493 			return EINVAL;
1494 		if (ic->ic_opmode == IEEE80211_M_STA) {
1495 			ni = ic->ic_bss;
1496 			if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid))
1497 				return EADDRNOTAVAIL;
1498 		} else {
1499 			ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
1500 			if (ni == NULL)
1501 				return ENOENT;
1502 		}
1503 		wk = &ni->ni_ucastkey;
1504 	} else {
1505 		if (kid >= IEEE80211_WEP_NKID)
1506 			return EINVAL;
1507 		wk = &ic->ic_nw_keys[kid];
1508 		ni = NULL;
1509 	}
1510 	error = 0;
1511 	ieee80211_key_update_begin(ic);
1512 	if (ieee80211_crypto_newkey(ic, ik.ik_type, wk)) {
1513 		wk->wk_keylen = ik.ik_keylen;
1514 		/* NB: MIC presence is implied by cipher type */
1515 		if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1516 			wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1517 		wk->wk_keyrsc = ik.ik_keyrsc;
1518 		wk->wk_keytsc = 0;			/* new key, reset */
1519 		wk->wk_flags |=
1520 			ik.ik_flags & (IEEE80211_KEY_XMIT|IEEE80211_KEY_RECV);
1521 		memset(wk->wk_key, 0, sizeof(wk->wk_key));
1522 		memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1523 		if (!ieee80211_crypto_setkey(ic, wk,
1524 		    ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
1525 			error = EIO;
1526 		else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1527 			ic->ic_def_txkey = kid;
1528 	} else
1529 		error = ENXIO;
1530 	ieee80211_key_update_end(ic);
1531 	if (ni != NULL)
1532 		ieee80211_free_node(ni);
1533 	return error;
1534 }
1535 
1536 static int
1537 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1538 {
1539 	struct ieee80211req_del_key dk;
1540 	int kid, error;
1541 
1542 	if (ireq->i_len != sizeof(dk))
1543 		return EINVAL;
1544 	error = copyin(ireq->i_data, &dk, sizeof(dk));
1545 	if (error)
1546 		return error;
1547 	kid = dk.idk_keyix;
1548 	/* XXX u_int8_t -> u_int16_t */
1549 	if (dk.idk_keyix == (u_int8_t) IEEE80211_KEYIX_NONE) {
1550 		struct ieee80211_node *ni;
1551 
1552 		ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
1553 		if (ni == NULL)
1554 			return EINVAL;		/* XXX */
1555 		/* XXX error return */
1556 		ieee80211_crypto_delkey(ic, &ni->ni_ucastkey);
1557 		ieee80211_free_node(ni);
1558 	} else {
1559 		if (kid >= IEEE80211_WEP_NKID)
1560 			return EINVAL;
1561 		/* XXX error return */
1562 		ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
1563 	}
1564 	return 0;
1565 }
1566 
1567 static void
1568 domlme(void *arg, struct ieee80211_node *ni)
1569 {
1570 	struct ieee80211com *ic = ni->ni_ic;
1571 	struct ieee80211req_mlme *mlme = arg;
1572 
1573 	if (ni->ni_associd != 0) {
1574 		IEEE80211_SEND_MGMT(ic, ni,
1575 			mlme->im_op == IEEE80211_MLME_DEAUTH ?
1576 				IEEE80211_FC0_SUBTYPE_DEAUTH :
1577 				IEEE80211_FC0_SUBTYPE_DISASSOC,
1578 			mlme->im_reason);
1579 	}
1580 	ieee80211_node_leave(ic, ni);
1581 }
1582 
1583 static int
1584 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
1585 {
1586 	struct ieee80211req_mlme mlme;
1587 	struct ieee80211_node *ni;
1588 	int error;
1589 
1590 	if (ireq->i_len != sizeof(mlme))
1591 		return EINVAL;
1592 	error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1593 	if (error)
1594 		return error;
1595 	switch (mlme.im_op) {
1596 	case IEEE80211_MLME_ASSOC:
1597 		if (ic->ic_opmode != IEEE80211_M_STA)
1598 			return EINVAL;
1599 		/* XXX must be in S_SCAN state? */
1600 
1601 		if (ic->ic_des_esslen != 0) {
1602 			/*
1603 			 * Desired ssid specified; must match both bssid and
1604 			 * ssid to distinguish ap advertising multiple ssid's.
1605 			 */
1606 			ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
1607 				mlme.im_macaddr,
1608 				ic->ic_des_esslen, ic->ic_des_essid);
1609 		} else {
1610 			/*
1611 			 * Normal case; just match bssid.
1612 			 */
1613 			ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
1614 		}
1615 		if (ni == NULL)
1616 			return EINVAL;
1617 		if (!ieee80211_sta_join(ic, ni)) {
1618 			ieee80211_free_node(ni);
1619 			return EINVAL;
1620 		}
1621 		break;
1622 	case IEEE80211_MLME_DISASSOC:
1623 	case IEEE80211_MLME_DEAUTH:
1624 		switch (ic->ic_opmode) {
1625 		case IEEE80211_M_STA:
1626 			/* XXX not quite right */
1627 			ieee80211_new_state(ic, IEEE80211_S_INIT,
1628 				mlme.im_reason);
1629 			break;
1630 		case IEEE80211_M_HOSTAP:
1631 			/* NB: the broadcast address means do 'em all */
1632 			if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
1633 				if ((ni = ieee80211_find_node(&ic->ic_sta,
1634 						mlme.im_macaddr)) == NULL)
1635 					return EINVAL;
1636 				domlme(&mlme, ni);
1637 				ieee80211_free_node(ni);
1638 			} else {
1639 				ieee80211_iterate_nodes(&ic->ic_sta,
1640 						domlme, &mlme);
1641 			}
1642 			break;
1643 		default:
1644 			return EINVAL;
1645 		}
1646 		break;
1647 	case IEEE80211_MLME_AUTHORIZE:
1648 	case IEEE80211_MLME_UNAUTHORIZE:
1649 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1650 			return EINVAL;
1651 		ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
1652 		if (ni == NULL)
1653 			return EINVAL;
1654 		if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
1655 			ieee80211_node_authorize(ic, ni);
1656 		else
1657 			ieee80211_node_unauthorize(ic, ni);
1658 		ieee80211_free_node(ni);
1659 		break;
1660 	default:
1661 		return EINVAL;
1662 	}
1663 	return 0;
1664 }
1665 
1666 static int
1667 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
1668 {
1669 	u_int8_t mac[IEEE80211_ADDR_LEN];
1670 	const struct ieee80211_aclator *acl = ic->ic_acl;
1671 	int error;
1672 
1673 	if (ireq->i_len != sizeof(mac))
1674 		return EINVAL;
1675 	error = copyin(ireq->i_data, mac, ireq->i_len);
1676 	if (error)
1677 		return error;
1678 	if (acl == NULL) {
1679 		acl = ieee80211_aclator_get("mac");
1680 		if (acl == NULL || !acl->iac_attach(ic))
1681 			return EINVAL;
1682 		ic->ic_acl = acl;
1683 	}
1684 	if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1685 		acl->iac_add(ic, mac);
1686 	else
1687 		acl->iac_remove(ic, mac);
1688 	return 0;
1689 }
1690 
1691 static int
1692 ieee80211_ioctl_maccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1693 {
1694 	const struct ieee80211_aclator *acl = ic->ic_acl;
1695 
1696 	switch (ireq->i_val) {
1697 	case IEEE80211_MACCMD_POLICY_OPEN:
1698 	case IEEE80211_MACCMD_POLICY_ALLOW:
1699 	case IEEE80211_MACCMD_POLICY_DENY:
1700 		if (acl == NULL) {
1701 			acl = ieee80211_aclator_get("mac");
1702 			if (acl == NULL || !acl->iac_attach(ic))
1703 				return EINVAL;
1704 			ic->ic_acl = acl;
1705 		}
1706 		acl->iac_setpolicy(ic, ireq->i_val);
1707 		break;
1708 	case IEEE80211_MACCMD_FLUSH:
1709 		if (acl != NULL)
1710 			acl->iac_flush(ic);
1711 		/* NB: silently ignore when not in use */
1712 		break;
1713 	case IEEE80211_MACCMD_DETACH:
1714 		if (acl != NULL) {
1715 			ic->ic_acl = NULL;
1716 			acl->iac_detach(ic);
1717 		}
1718 		break;
1719 	default:
1720 		return EINVAL;
1721 	}
1722 	return 0;
1723 }
1724 
1725 static int
1726 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
1727 {
1728 	struct ieee80211req_chanlist list;
1729 	u_char chanlist[IEEE80211_CHAN_BYTES];
1730 	int i, j, error;
1731 
1732 	if (ireq->i_len != sizeof(list))
1733 		return EINVAL;
1734 	error = copyin(ireq->i_data, &list, sizeof(list));
1735 	if (error)
1736 		return error;
1737 	memset(chanlist, 0, sizeof(chanlist));
1738 	/*
1739 	 * Since channel 0 is not available for DS, channel 1
1740 	 * is assigned to LSB on WaveLAN.
1741 	 */
1742 	if (ic->ic_phytype == IEEE80211_T_DS)
1743 		i = 1;
1744 	else
1745 		i = 0;
1746 	for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
1747 		/*
1748 		 * NB: silently discard unavailable channels so users
1749 		 *     can specify 1-255 to get all available channels.
1750 		 */
1751 		if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
1752 			setbit(chanlist, i);
1753 	}
1754 	if (ic->ic_ibss_chan == NULL ||
1755 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1756 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1757 			if (isset(chanlist, i)) {
1758 				ic->ic_ibss_chan = &ic->ic_channels[i];
1759 				goto found;
1760 			}
1761 		return EINVAL;			/* no active channels */
1762 found:
1763 		;
1764 	}
1765 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
1766 	if (ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC ||
1767 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan)))
1768 		ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1769 	return IS_UP_AUTO(ic) ? ENETRESET : 0;
1770 }
1771 
1772 static int
1773 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1774 {
1775 	struct ieee80211_node *ni;
1776 	struct ieee80211req_sta_txpow txpow;
1777 	int error;
1778 
1779 	if (ireq->i_len != sizeof(txpow))
1780 		return EINVAL;
1781 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1782 	if (error != 0)
1783 		return error;
1784 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1785 	if (ni == NULL)
1786 		return EINVAL;		/* XXX */
1787 	ni->ni_txpower = txpow.it_txpow;
1788 	ieee80211_free_node(ni);
1789 	return error;
1790 }
1791 
1792 static int
1793 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1794 {
1795 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1796 	struct wmeParams *wmep, *chanp;
1797 	int isbss, ac;
1798 
1799 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1800 		return EINVAL;
1801 
1802 	isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1803 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1804 	if (ac >= WME_NUM_AC)
1805 		ac = WME_AC_BE;
1806 	if (isbss) {
1807 		chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1808 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1809 	} else {
1810 		chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1811 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1812 	}
1813 	switch (ireq->i_type) {
1814 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1815 		if (isbss) {
1816 			wmep->wmep_logcwmin = ireq->i_val;
1817 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1818 				chanp->wmep_logcwmin = ireq->i_val;
1819 		} else {
1820 			wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1821 				ireq->i_val;
1822 		}
1823 		break;
1824 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1825 		if (isbss) {
1826 			wmep->wmep_logcwmax = ireq->i_val;
1827 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1828 				chanp->wmep_logcwmax = ireq->i_val;
1829 		} else {
1830 			wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1831 				ireq->i_val;
1832 		}
1833 		break;
1834 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1835 		if (isbss) {
1836 			wmep->wmep_aifsn = ireq->i_val;
1837 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1838 				chanp->wmep_aifsn = ireq->i_val;
1839 		} else {
1840 			wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
1841 		}
1842 		break;
1843 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1844 		if (isbss) {
1845 			wmep->wmep_txopLimit = ireq->i_val;
1846 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1847 				chanp->wmep_txopLimit = ireq->i_val;
1848 		} else {
1849 			wmep->wmep_txopLimit = chanp->wmep_txopLimit =
1850 				ireq->i_val;
1851 		}
1852 		break;
1853 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1854 		wmep->wmep_acm = ireq->i_val;
1855 		if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1856 			chanp->wmep_acm = ireq->i_val;
1857 		break;
1858 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1859 		wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1860 			(ireq->i_val) == 0;
1861 		break;
1862 	}
1863 	ieee80211_wme_updateparams(ic);
1864 	return 0;
1865 }
1866 
1867 static int
1868 cipher2cap(int cipher)
1869 {
1870 	switch (cipher) {
1871 	case IEEE80211_CIPHER_WEP:	return IEEE80211_C_WEP;
1872 	case IEEE80211_CIPHER_AES_OCB:	return IEEE80211_C_AES;
1873 	case IEEE80211_CIPHER_AES_CCM:	return IEEE80211_C_AES_CCM;
1874 	case IEEE80211_CIPHER_CKIP:	return IEEE80211_C_CKIP;
1875 	case IEEE80211_CIPHER_TKIP:	return IEEE80211_C_TKIP;
1876 	}
1877 	return 0;
1878 }
1879 
1880 static int
1881 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1882 {
1883 	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
1884 	struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1885 	int error;
1886 	const struct ieee80211_authenticator *auth;
1887 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1888 	char tmpssid[IEEE80211_NWID_LEN];
1889 	u_int8_t tmpbssid[IEEE80211_ADDR_LEN];
1890 	struct ieee80211_key *k;
1891 	int j, caps;
1892 	u_int kid;
1893 
1894 	error = 0;
1895 	switch (ireq->i_type) {
1896 	case IEEE80211_IOC_SSID:
1897 		if (ireq->i_val != 0 ||
1898 		    ireq->i_len > IEEE80211_NWID_LEN)
1899 			return EINVAL;
1900 		error = copyin(ireq->i_data, tmpssid, ireq->i_len);
1901 		if (error)
1902 			break;
1903 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
1904 		ic->ic_des_esslen = ireq->i_len;
1905 		memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
1906 		error = ENETRESET;
1907 		break;
1908 	case IEEE80211_IOC_WEP:
1909 		switch (ireq->i_val) {
1910 		case IEEE80211_WEP_OFF:
1911 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
1912 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1913 			break;
1914 		case IEEE80211_WEP_ON:
1915 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1916 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
1917 			break;
1918 		case IEEE80211_WEP_MIXED:
1919 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1920 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1921 			break;
1922 		}
1923 		error = ENETRESET;
1924 		break;
1925 	case IEEE80211_IOC_WEPKEY:
1926 		kid = (u_int) ireq->i_val;
1927 		if (kid >= IEEE80211_WEP_NKID)
1928 			return EINVAL;
1929 		k = &ic->ic_nw_keys[kid];
1930 		if (ireq->i_len == 0) {
1931 			/* zero-len =>'s delete any existing key */
1932 			(void) ieee80211_crypto_delkey(ic, k);
1933 			break;
1934 		}
1935 		if (ireq->i_len > sizeof(tmpkey))
1936 			return EINVAL;
1937 		memset(tmpkey, 0, sizeof(tmpkey));
1938 		error = copyin(ireq->i_data, tmpkey, ireq->i_len);
1939 		if (error)
1940 			break;
1941 		ieee80211_key_update_begin(ic);
1942 		if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP, k)) {
1943 			k->wk_keylen = ireq->i_len;
1944 			k->wk_flags |=
1945 			    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
1946 			memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
1947 			if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
1948 				error = EINVAL;
1949 		} else
1950 			error = EINVAL;
1951 		ieee80211_key_update_end(ic);
1952 		break;
1953 	case IEEE80211_IOC_WEPTXKEY:
1954 		kid = (u_int) ireq->i_val;
1955 		if (kid >= IEEE80211_WEP_NKID &&
1956 		    (u_int16_t) kid != IEEE80211_KEYIX_NONE)
1957 			return EINVAL;
1958 		ic->ic_def_txkey = kid;
1959 		error = ENETRESET;	/* push to hardware */
1960 		break;
1961 	case IEEE80211_IOC_AUTHMODE:
1962 		switch (ireq->i_val) {
1963 		case IEEE80211_AUTH_WPA:
1964 		case IEEE80211_AUTH_8021X:	/* 802.1x */
1965 		case IEEE80211_AUTH_OPEN:	/* open */
1966 		case IEEE80211_AUTH_SHARED:	/* shared-key */
1967 		case IEEE80211_AUTH_AUTO:	/* auto */
1968 			auth = ieee80211_authenticator_get(ireq->i_val);
1969 			if (auth == NULL)
1970 				return EINVAL;
1971 			break;
1972 		default:
1973 			return EINVAL;
1974 		}
1975 		switch (ireq->i_val) {
1976 		case IEEE80211_AUTH_WPA:	/* WPA w/ 802.1x */
1977 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1978 			ireq->i_val = IEEE80211_AUTH_8021X;
1979 			break;
1980 		case IEEE80211_AUTH_OPEN:	/* open */
1981 			ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
1982 			break;
1983 		case IEEE80211_AUTH_SHARED:	/* shared-key */
1984 		case IEEE80211_AUTH_8021X:	/* 802.1x */
1985 			ic->ic_flags &= ~IEEE80211_F_WPA;
1986 			/* both require a key so mark the PRIVACY capability */
1987 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1988 			break;
1989 		case IEEE80211_AUTH_AUTO:	/* auto */
1990 			ic->ic_flags &= ~IEEE80211_F_WPA;
1991 			/* XXX PRIVACY handling? */
1992 			/* XXX what's the right way to do this? */
1993 			break;
1994 		}
1995 		/* NB: authenticator attach/detach happens on state change */
1996 		ic->ic_bss->ni_authmode = ireq->i_val;
1997 		/* XXX mixed/mode/usage? */
1998 		ic->ic_auth = auth;
1999 		error = ENETRESET;
2000 		break;
2001 	case IEEE80211_IOC_CHANNEL:
2002 		/* XXX 0xffff overflows 16-bit signed */
2003 		if (ireq->i_val == 0 ||
2004 		    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
2005 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2006 		else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
2007 		    isclr(ic->ic_chan_active, ireq->i_val)) {
2008 			return EINVAL;
2009 		} else
2010 			ic->ic_ibss_chan = ic->ic_des_chan =
2011 				&ic->ic_channels[ireq->i_val];
2012 		switch (ic->ic_state) {
2013 		case IEEE80211_S_INIT:
2014 		case IEEE80211_S_SCAN:
2015 			error = ENETRESET;
2016 			break;
2017 		default:
2018 			/*
2019 			 * If the desired channel has changed (to something
2020 			 * other than any) and we're not already scanning,
2021 			 * then kick the state machine.
2022 			 */
2023 			if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2024 			    ic->ic_bss->ni_chan != ic->ic_des_chan &&
2025 			    (ic->ic_flags & IEEE80211_F_SCAN) == 0)
2026 				error = ENETRESET;
2027 			break;
2028 		}
2029 		if (error == ENETRESET && ic->ic_opmode == IEEE80211_M_MONITOR)
2030 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2031 		break;
2032 	case IEEE80211_IOC_POWERSAVE:
2033 		switch (ireq->i_val) {
2034 		case IEEE80211_POWERSAVE_OFF:
2035 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
2036 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
2037 				error = ENETRESET;
2038 			}
2039 			break;
2040 		case IEEE80211_POWERSAVE_ON:
2041 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2042 				error = EINVAL;
2043 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2044 				ic->ic_flags |= IEEE80211_F_PMGTON;
2045 				error = ENETRESET;
2046 			}
2047 			break;
2048 		default:
2049 			error = EINVAL;
2050 			break;
2051 		}
2052 		break;
2053 	case IEEE80211_IOC_POWERSAVESLEEP:
2054 		if (ireq->i_val < 0)
2055 			return EINVAL;
2056 		ic->ic_lintval = ireq->i_val;
2057 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2058 		break;
2059 	case IEEE80211_IOC_RTSTHRESHOLD:
2060 		if (!(IEEE80211_RTS_MIN < ireq->i_val &&
2061 		      ireq->i_val < IEEE80211_RTS_MAX))
2062 			return EINVAL;
2063 		ic->ic_rtsthreshold = ireq->i_val;
2064 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2065 		break;
2066 	case IEEE80211_IOC_PROTMODE:
2067 		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2068 			return EINVAL;
2069 		ic->ic_protmode = ireq->i_val;
2070 		/* NB: if not operating in 11g this can wait */
2071 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2072 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2073 		break;
2074 	case IEEE80211_IOC_TXPOWER:
2075 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2076 			return EINVAL;
2077 		if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
2078 		      ireq->i_val < IEEE80211_TXPOWER_MAX))
2079 			return EINVAL;
2080 		ic->ic_txpowlimit = ireq->i_val;
2081 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2082 		break;
2083 	case IEEE80211_IOC_ROAMING:
2084 		if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2085 		    ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2086 			return EINVAL;
2087 		ic->ic_roaming = ireq->i_val;
2088 		/* XXXX reset? */
2089 		break;
2090 	case IEEE80211_IOC_PRIVACY:
2091 		if (ireq->i_val) {
2092 			/* XXX check for key state? */
2093 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2094 		} else
2095 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2096 		break;
2097 	case IEEE80211_IOC_DROPUNENCRYPTED:
2098 		if (ireq->i_val)
2099 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
2100 		else
2101 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2102 		break;
2103 	case IEEE80211_IOC_WPAKEY:
2104 		error = ieee80211_ioctl_setkey(ic, ireq);
2105 		break;
2106 	case IEEE80211_IOC_DELKEY:
2107 		error = ieee80211_ioctl_delkey(ic, ireq);
2108 		break;
2109 	case IEEE80211_IOC_MLME:
2110 		error = ieee80211_ioctl_setmlme(ic, ireq);
2111 		break;
2112 	case IEEE80211_IOC_OPTIE:
2113 		error = ieee80211_ioctl_setoptie(ic, ireq);
2114 		break;
2115 	case IEEE80211_IOC_COUNTERMEASURES:
2116 		if (ireq->i_val) {
2117 			if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
2118 				return EINVAL;
2119 			ic->ic_flags |= IEEE80211_F_COUNTERM;
2120 		} else
2121 			ic->ic_flags &= ~IEEE80211_F_COUNTERM;
2122 		break;
2123 	case IEEE80211_IOC_WPA:
2124 		if (ireq->i_val > 3)
2125 			return EINVAL;
2126 		/* XXX verify ciphers available */
2127 		ic->ic_flags &= ~IEEE80211_F_WPA;
2128 		switch (ireq->i_val) {
2129 		case 1:
2130 			ic->ic_flags |= IEEE80211_F_WPA1;
2131 			break;
2132 		case 2:
2133 			ic->ic_flags |= IEEE80211_F_WPA2;
2134 			break;
2135 		case 3:
2136 			ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2137 			break;
2138 		}
2139 		error = ENETRESET;		/* XXX? */
2140 		break;
2141 	case IEEE80211_IOC_WME:
2142 		if (ireq->i_val) {
2143 			if ((ic->ic_caps & IEEE80211_C_WME) == 0)
2144 				return EINVAL;
2145 			ic->ic_flags |= IEEE80211_F_WME;
2146 		} else
2147 			ic->ic_flags &= ~IEEE80211_F_WME;
2148 		error = ENETRESET;		/* XXX maybe not for station? */
2149 		break;
2150 	case IEEE80211_IOC_HIDESSID:
2151 		if (ireq->i_val)
2152 			ic->ic_flags |= IEEE80211_F_HIDESSID;
2153 		else
2154 			ic->ic_flags &= ~IEEE80211_F_HIDESSID;
2155 		error = ENETRESET;
2156 		break;
2157 	case IEEE80211_IOC_APBRIDGE:
2158 		if (ireq->i_val == 0)
2159 			ic->ic_flags |= IEEE80211_F_NOBRIDGE;
2160 		else
2161 			ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
2162 		break;
2163 	case IEEE80211_IOC_MCASTCIPHER:
2164 		if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
2165 		    !ieee80211_crypto_available(ireq->i_val))
2166 			return EINVAL;
2167 		rsn->rsn_mcastcipher = ireq->i_val;
2168 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2169 		break;
2170 	case IEEE80211_IOC_MCASTKEYLEN:
2171 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2172 			return EINVAL;
2173 		/* XXX no way to verify driver capability */
2174 		rsn->rsn_mcastkeylen = ireq->i_val;
2175 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2176 		break;
2177 	case IEEE80211_IOC_UCASTCIPHERS:
2178 		/*
2179 		 * Convert user-specified cipher set to the set
2180 		 * we can support (via hardware or software).
2181 		 * NB: this logic intentionally ignores unknown and
2182 		 * unsupported ciphers so folks can specify 0xff or
2183 		 * similar and get all available ciphers.
2184 		 */
2185 		caps = 0;
2186 		for (j = 1; j < 32; j++)	/* NB: skip WEP */
2187 			if ((ireq->i_val & (1<<j)) &&
2188 			    ((ic->ic_caps & cipher2cap(j)) ||
2189 			     ieee80211_crypto_available(j)))
2190 				caps |= 1<<j;
2191 		if (caps == 0)			/* nothing available */
2192 			return EINVAL;
2193 		/* XXX verify ciphers ok for unicast use? */
2194 		/* XXX disallow if running as it'll have no effect */
2195 		rsn->rsn_ucastcipherset = caps;
2196 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2197 		break;
2198 	case IEEE80211_IOC_UCASTCIPHER:
2199 		if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
2200 			return EINVAL;
2201 		rsn->rsn_ucastcipher = ireq->i_val;
2202 		break;
2203 	case IEEE80211_IOC_UCASTKEYLEN:
2204 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2205 			return EINVAL;
2206 		/* XXX no way to verify driver capability */
2207 		rsn->rsn_ucastkeylen = ireq->i_val;
2208 		break;
2209 	case IEEE80211_IOC_DRIVER_CAPS:
2210 		/* NB: for testing */
2211 		ic->ic_caps = (((u_int16_t) ireq->i_val) << 16) |
2212 			       ((u_int16_t) ireq->i_len);
2213 		break;
2214 	case IEEE80211_IOC_KEYMGTALGS:
2215 		/* XXX check */
2216 		rsn->rsn_keymgmtset = ireq->i_val;
2217 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2218 		break;
2219 	case IEEE80211_IOC_RSNCAPS:
2220 		/* XXX check */
2221 		rsn->rsn_caps = ireq->i_val;
2222 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2223 		break;
2224 	case IEEE80211_IOC_BSSID:
2225 		/* NB: should only be set when in STA mode */
2226 		if (ic->ic_opmode != IEEE80211_M_STA)
2227 			return EINVAL;
2228 		if (ireq->i_len != sizeof(tmpbssid))
2229 			return EINVAL;
2230 		error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2231 		if (error)
2232 			break;
2233 		IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
2234 		if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2235 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2236 		else
2237 			ic->ic_flags |= IEEE80211_F_DESBSSID;
2238 		error = ENETRESET;
2239 		break;
2240 	case IEEE80211_IOC_CHANLIST:
2241 		error = ieee80211_ioctl_setchanlist(ic, ireq);
2242 		break;
2243 	case IEEE80211_IOC_SCAN_REQ:
2244 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)	/* XXX ignore */
2245 			break;
2246 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
2247 		if (error == 0)		/* XXX background scan */
2248 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2249 		break;
2250 	case IEEE80211_IOC_ADDMAC:
2251 	case IEEE80211_IOC_DELMAC:
2252 		error = ieee80211_ioctl_macmac(ic, ireq);
2253 		break;
2254 	case IEEE80211_IOC_MACCMD:
2255 		error = ieee80211_ioctl_maccmd(ic, ireq);
2256 		break;
2257 	case IEEE80211_IOC_STA_TXPOW:
2258 		error = ieee80211_ioctl_setstatxpow(ic, ireq);
2259 		break;
2260 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
2261 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
2262 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
2263 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
2264 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
2265 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
2266 		error = ieee80211_ioctl_setwmeparam(ic, ireq);
2267 		break;
2268 	case IEEE80211_IOC_DTIM_PERIOD:
2269 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2270 		    ic->ic_opmode != IEEE80211_M_IBSS)
2271 			return EINVAL;
2272 		if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2273 		    ireq->i_val <= IEEE80211_DTIM_MAX) {
2274 			ic->ic_dtim_period = ireq->i_val;
2275 			error = ENETRESET;		/* requires restart */
2276 		} else
2277 			error = EINVAL;
2278 		break;
2279 	case IEEE80211_IOC_BEACON_INTERVAL:
2280 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2281 		    ic->ic_opmode != IEEE80211_M_IBSS)
2282 			return EINVAL;
2283 		if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2284 		    ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2285 			ic->ic_lintval = ireq->i_val;
2286 			error = ENETRESET;		/* requires restart */
2287 		} else
2288 			error = EINVAL;
2289 		break;
2290 	default:
2291 		error = EINVAL;
2292 		break;
2293 	}
2294 	if (error == ENETRESET && !IS_UP_AUTO(ic))
2295 		error = 0;
2296 	return error;
2297 }
2298 
2299 int
2300 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, caddr_t data)
2301 {
2302 	struct ifnet *ifp = ic->ic_ifp;
2303 	int error = 0;
2304 	struct ifreq *ifr;
2305 	struct ifaddr *ifa;			/* XXX */
2306 
2307 	switch (cmd) {
2308 	case SIOCSIFMEDIA:
2309 	case SIOCGIFMEDIA:
2310 		error = ifmedia_ioctl(ifp, (struct ifreq *) data,
2311 				&ic->ic_media, cmd);
2312 		break;
2313 	case SIOCG80211:
2314 		error = ieee80211_ioctl_get80211(ic, cmd,
2315 				(struct ieee80211req *) data);
2316 		break;
2317 	case SIOCS80211:
2318 		error = suser(curthread);
2319 		if (error == 0)
2320 			error = ieee80211_ioctl_set80211(ic, cmd,
2321 					(struct ieee80211req *) data);
2322 		break;
2323 	case SIOCGIFGENERIC:
2324 		error = ieee80211_cfgget(ic, cmd, data);
2325 		break;
2326 	case SIOCSIFGENERIC:
2327 		error = suser(curthread);
2328 		if (error)
2329 			break;
2330 		error = ieee80211_cfgset(ic, cmd, data);
2331 		break;
2332 	case SIOCG80211STATS:
2333 		ifr = (struct ifreq *)data;
2334 		copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
2335 		break;
2336 	case SIOCSIFMTU:
2337 		ifr = (struct ifreq *)data;
2338 		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2339 		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2340 			error = EINVAL;
2341 		else
2342 			ifp->if_mtu = ifr->ifr_mtu;
2343 		break;
2344 	case SIOCSIFADDR:
2345 		/*
2346 		 * XXX Handle this directly so we can supress if_init calls.
2347 		 * XXX This should be done in ether_ioctl but for the moment
2348 		 * XXX there are too many other parts of the system that
2349 		 * XXX set IFF_UP and so supress if_init being called when
2350 		 * XXX it should be.
2351 		 */
2352 		ifa = (struct ifaddr *) data;
2353 		switch (ifa->ifa_addr->sa_family) {
2354 #ifdef INET
2355 		case AF_INET:
2356 			if ((ifp->if_flags & IFF_UP) == 0) {
2357 				ifp->if_flags |= IFF_UP;
2358 				ifp->if_init(ifp->if_softc);
2359 			}
2360 			arp_ifinit(ifp, ifa);
2361 			break;
2362 #endif
2363 #ifdef IPX
2364 		/*
2365 		 * XXX - This code is probably wrong,
2366 		 *	 but has been copied many times.
2367 		 */
2368 		case AF_IPX: {
2369 			struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
2370 			struct arpcom *ac = (struct arpcom *)ifp;
2371 
2372 			if (ipx_nullhost(*ina))
2373 				ina->x_host = *(union ipx_host *) ac->ac_enaddr;
2374 			else
2375 				bcopy((caddr_t) ina->x_host.c_host,
2376 				      (caddr_t) ac->ac_enaddr,
2377 				      sizeof(ac->ac_enaddr));
2378 			/* fall thru... */
2379 		}
2380 #endif
2381 		default:
2382 			if ((ifp->if_flags & IFF_UP) == 0) {
2383 				ifp->if_flags |= IFF_UP;
2384 				ifp->if_init(ifp->if_softc);
2385 			}
2386 			break;
2387 		}
2388 		break;
2389 	default:
2390 		error = ether_ioctl(ifp, cmd, data);
2391 		break;
2392 	}
2393 	return error;
2394 }
2395