Implement set(IEEE80211_IOC_STA_STATS) for hostapd; for
[dragonfly.git] / sys / netproto / 802_11 / wlan / ieee80211_ioctl.c
1 /*
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/net80211/ieee80211_ioctl.c,v 1.25.2.12 2006/04/03 17:21:05 sam Exp $
33  * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_ioctl.c,v 1.5 2006/11/23 12:57:56 sephe Exp $
34  */
35
36 /*
37  * IEEE 802.11 ioctl support (DragonFlyBSD-specific)
38  */
39
40 #include "opt_inet.h"
41 #include "opt_ipx.h"
42
43 #include <sys/endian.h>
44 #include <sys/param.h>
45 #include <sys/kernel.h>
46 #include <sys/proc.h>
47 #include <sys/socket.h>
48 #include <sys/sockio.h>
49 #include <sys/systm.h>
50  
51 #include <net/if.h>
52 #include <net/if_arp.h>
53 #include <net/if_dl.h>
54 #include <net/if_media.h>
55 #include <net/ethernet.h>
56
57 #ifdef INET
58 #include <netinet/in.h>
59 #include <netinet/if_ether.h>
60 #endif
61
62 #ifdef IPX
63 #include <netproto/ipx/ipx.h>
64 #include <netproto/ipx/ipx_if.h>
65 #endif
66
67 #include <netproto/802_11/ieee80211_var.h>
68 #include <netproto/802_11/ieee80211_ioctl.h>
69
70 #include <netproto/802_11/if_wavelan_ieee.h>
71
72 #define IS_UP(_ic)                                              \
73         (((_ic)->ic_ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==  \
74          (IFF_UP | IFF_RUNNING))
75
76 #define IS_UP_AUTO(_ic) \
77         (IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
78
79 /*
80  * XXX
81  * Wireless LAN specific configuration interface, which is compatible
82  * with wicontrol(8).
83  */
84
85 struct wi_read_ap_args {
86         int     i;              /* result count */
87         struct wi_apinfo *ap;   /* current entry in result buffer */
88         caddr_t max;            /* result buffer bound */
89 };
90
91 static void
92 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
93 {
94         struct ieee80211com *ic = ni->ni_ic;
95         struct wi_read_ap_args *sa = arg;
96         struct wi_apinfo *ap = sa->ap;
97         struct ieee80211_rateset *rs;
98         int j;
99
100         if ((caddr_t)(ap + 1) > sa->max)
101                 return;
102         memset(ap, 0, sizeof(struct wi_apinfo));
103         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
104                 IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
105                 ap->namelen = ic->ic_des_esslen;
106                 if (ic->ic_des_esslen)
107                         memcpy(ap->name, ic->ic_des_essid,
108                             ic->ic_des_esslen);
109         } else {
110                 IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
111                 ap->namelen = ni->ni_esslen;
112                 if (ni->ni_esslen)
113                         memcpy(ap->name, ni->ni_essid,
114                             ni->ni_esslen);
115         }
116         ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
117         ap->signal = ic->ic_node_getrssi(ni);
118         ap->capinfo = ni->ni_capinfo;
119         ap->interval = ni->ni_intval;
120         rs = &ni->ni_rates;
121         for (j = 0; j < rs->rs_nrates; j++) {
122                 if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
123                         ap->rate = (rs->rs_rates[j] &
124                             IEEE80211_RATE_VAL) * 5; /* XXX */
125                 }
126         }
127         sa->i++;
128         sa->ap++;
129 }
130
131 struct wi_read_prism2_args {
132         int     i;              /* result count */
133         struct wi_scan_res *res;/* current entry in result buffer */
134         caddr_t max;            /* result buffer bound */
135 };
136
137 static void
138 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
139 {
140         struct ieee80211com *ic = ni->ni_ic;
141         struct wi_read_prism2_args *sa = arg;
142         struct wi_scan_res *res = sa->res;
143
144         if ((caddr_t)(res + 1) > sa->max)
145                 return;
146         res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
147         res->wi_noise = 0;
148         res->wi_signal = ic->ic_node_getrssi(ni);
149         IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
150         res->wi_interval = ni->ni_intval;
151         res->wi_capinfo = ni->ni_capinfo;
152         res->wi_ssid_len = ni->ni_esslen;
153         memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
154         /* NB: assumes wi_srates holds <= ni->ni_rates */
155         memcpy(res->wi_srates, ni->ni_rates.rs_rates,
156                 sizeof(res->wi_srates));
157         if (ni->ni_rates.rs_nrates < 10)
158                 res->wi_srates[ni->ni_rates.rs_nrates] = 0;
159         res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
160         res->wi_rsvd = 0;
161
162         sa->i++;
163         sa->res++;
164 }
165
166 struct wi_read_sigcache_args {
167         int     i;              /* result count */
168         struct wi_sigcache *wsc;/* current entry in result buffer */
169         caddr_t max;            /* result buffer bound */
170 };
171
172 static void
173 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
174 {
175         struct ieee80211com *ic = ni->ni_ic;
176         struct wi_read_sigcache_args *sa = arg;
177         struct wi_sigcache *wsc = sa->wsc;
178
179         if ((caddr_t)(wsc + 1) > sa->max)
180                 return;
181         memset(wsc, 0, sizeof(struct wi_sigcache));
182         IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
183         wsc->signal = ic->ic_node_getrssi(ni);
184
185         sa->wsc++;
186         sa->i++;
187 }
188
189 int
190 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, caddr_t data,
191                  struct ucred *cr)
192 {
193         struct ifnet *ifp = ic->ic_ifp;
194         int i, j, error;
195         struct ifreq *ifr = (struct ifreq *)data;
196         struct wi_req wreq;
197         struct wi_ltv_keys *keys;
198
199         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
200         if (error)
201                 return error;
202         wreq.wi_len = 0;
203         switch (wreq.wi_type) {
204         case WI_RID_SERIALNO:
205                 /* nothing appropriate */
206                 break;
207         case WI_RID_NODENAME:
208                 strcpy((char *)&wreq.wi_val[1], hostname);
209                 wreq.wi_val[0] = htole16(strlen(hostname));
210                 wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
211                 break;
212         case WI_RID_CURRENT_SSID:
213                 if (ic->ic_state != IEEE80211_S_RUN) {
214                         wreq.wi_val[0] = 0;
215                         wreq.wi_len = 1;
216                         break;
217                 }
218                 wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
219                 memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
220                     ic->ic_bss->ni_esslen);
221                 wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
222                 break;
223         case WI_RID_OWN_SSID:
224         case WI_RID_DESIRED_SSID:
225                 wreq.wi_val[0] = htole16(ic->ic_des_esslen);
226                 memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
227                 wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
228                 break;
229         case WI_RID_CURRENT_BSSID:
230                 if (ic->ic_state == IEEE80211_S_RUN)
231                         IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
232                 else
233                         memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
234                 wreq.wi_len = IEEE80211_ADDR_LEN / 2;
235                 break;
236         case WI_RID_CHANNEL_LIST:
237                 memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
238                 /*
239                  * Since channel 0 is not available for DS, channel 1
240                  * is assigned to LSB on WaveLAN.
241                  */
242                 if (ic->ic_phytype == IEEE80211_T_DS)
243                         i = 1;
244                 else
245                         i = 0;
246                 for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
247                         if (isset(ic->ic_chan_active, i)) {
248                                 setbit((uint8_t *)wreq.wi_val, j);
249                                 wreq.wi_len = j / 16 + 1;
250                         }
251                 break;
252         case WI_RID_OWN_CHNL:
253                 wreq.wi_val[0] = htole16(
254                         ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
255                 wreq.wi_len = 1;
256                 break;
257         case WI_RID_CURRENT_CHAN:
258                 wreq.wi_val[0] = htole16(
259                         ieee80211_chan2ieee(ic, ic->ic_curchan));
260                 wreq.wi_len = 1;
261                 break;
262         case WI_RID_COMMS_QUALITY:
263                 wreq.wi_val[0] = 0;                             /* quality */
264                 wreq.wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
265                 wreq.wi_val[2] = 0;                             /* noise */
266                 wreq.wi_len = 3;
267                 break;
268         case WI_RID_PROMISC:
269                 wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
270                 wreq.wi_len = 1;
271                 break;
272         case WI_RID_PORTTYPE:
273                 wreq.wi_val[0] = htole16(ic->ic_opmode);
274                 wreq.wi_len = 1;
275                 break;
276         case WI_RID_MAC_NODE:
277                 IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
278                 wreq.wi_len = IEEE80211_ADDR_LEN / 2;
279                 break;
280         case WI_RID_TX_RATE:
281                 if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
282                         wreq.wi_val[0] = 0;     /* auto */
283                 else
284                         wreq.wi_val[0] = htole16(
285                             (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
286                             IEEE80211_RATE_VAL) / 2);
287                 wreq.wi_len = 1;
288                 break;
289         case WI_RID_CUR_TX_RATE:
290                 wreq.wi_val[0] = htole16(
291                     (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
292                     IEEE80211_RATE_VAL) / 2);
293                 wreq.wi_len = 1;
294                 break;
295         case WI_RID_RTS_THRESH:
296                 wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
297                 wreq.wi_len = 1;
298                 break;
299         case WI_RID_CREATE_IBSS:
300                 wreq.wi_val[0] =
301                     htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
302                 wreq.wi_len = 1;
303                 break;
304         case WI_RID_MICROWAVE_OVEN:
305                 wreq.wi_val[0] = 0;     /* no ... not supported */
306                 wreq.wi_len = 1;
307                 break;
308         case WI_RID_ROAMING_MODE:
309                 wreq.wi_val[0] = htole16(ic->ic_roaming);       /* XXX map */
310                 wreq.wi_len = 1;
311                 break;
312         case WI_RID_SYSTEM_SCALE:
313                 wreq.wi_val[0] = htole16(1);    /* low density ... not supp */
314                 wreq.wi_len = 1;
315                 break;
316         case WI_RID_PM_ENABLED:
317                 wreq.wi_val[0] =
318                     htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
319                 wreq.wi_len = 1;
320                 break;
321         case WI_RID_MAX_SLEEP:
322                 wreq.wi_val[0] = htole16(ic->ic_lintval);
323                 wreq.wi_len = 1;
324                 break;
325         case WI_RID_CUR_BEACON_INT:
326                 wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
327                 wreq.wi_len = 1;
328                 break;
329         case WI_RID_WEP_AVAIL:
330                 wreq.wi_val[0] = htole16(1);    /* always available */
331                 wreq.wi_len = 1;
332                 break;
333         case WI_RID_CNFAUTHMODE:
334                 wreq.wi_val[0] = htole16(1);    /* TODO: open system only */
335                 wreq.wi_len = 1;
336                 break;
337         case WI_RID_ENCRYPTION:
338                 wreq.wi_val[0] =
339                     htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
340                 wreq.wi_len = 1;
341                 break;
342         case WI_RID_TX_CRYPT_KEY:
343                 wreq.wi_val[0] = htole16(ic->ic_def_txkey);
344                 wreq.wi_len = 1;
345                 break;
346         case WI_RID_DEFLT_CRYPT_KEYS:
347                 keys = (struct wi_ltv_keys *)&wreq;
348                 /* do not show keys to non-root user */
349                 error = suser_cred(cr, NULL_CRED_OKAY);
350                 if (error) {
351                         memset(keys, 0, sizeof(*keys));
352                         error = 0;
353                         break;
354                 }
355                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
356                         keys->wi_keys[i].wi_keylen =
357                             htole16(ic->ic_nw_keys[i].wk_keylen);
358                         memcpy(keys->wi_keys[i].wi_keydat,
359                             ic->ic_nw_keys[i].wk_key,
360                             ic->ic_nw_keys[i].wk_keylen);
361                 }
362                 wreq.wi_len = sizeof(*keys) / 2;
363                 break;
364         case WI_RID_MAX_DATALEN:
365                 wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
366                 wreq.wi_len = 1;
367                 break;
368         case WI_RID_IFACE_STATS:
369                 /* XXX: should be implemented in lower drivers */
370                 break;
371         case WI_RID_READ_APS:
372                 /*
373                  * Don't return results until active scan completes.
374                  */
375                 if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
376                         struct wi_read_ap_args args;
377
378                         args.i = 0;
379                         args.ap = (void *)((char *)wreq.wi_val + sizeof(i));
380                         args.max = (void *)(&wreq + 1);
381                         ieee80211_iterate_nodes(&ic->ic_scan,
382                                 wi_read_ap_result, &args);
383                         memcpy(wreq.wi_val, &args.i, sizeof(args.i));
384                         wreq.wi_len = (sizeof(int) +
385                                 sizeof(struct wi_apinfo) * args.i) / 2;
386                 } else
387                         error = EINPROGRESS;
388                 break;
389         case WI_RID_PRISM2:
390                 /* NB: we lie so WI_RID_SCAN_RES can include rates */
391                 wreq.wi_val[0] = 1;
392                 wreq.wi_len = sizeof(uint16_t) / 2;
393                 break;
394         case WI_RID_SCAN_RES:                   /* compatibility interface */
395                 if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
396                         struct wi_read_prism2_args args;
397                         struct wi_scan_p2_hdr *p2;
398
399                         /* NB: use Prism2 format so we can include rate info */
400                         p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
401                         args.i = 0;
402                         args.res = (void *)&p2[1];
403                         args.max = (void *)(&wreq + 1);
404                         ieee80211_iterate_nodes(&ic->ic_scan,
405                                 wi_read_prism2_result, &args);
406                         p2->wi_rsvd = 0;
407                         p2->wi_reason = args.i;
408                         wreq.wi_len = (sizeof(*p2) +
409                                 sizeof(struct wi_scan_res) * args.i) / 2;
410                 } else
411                         error = EINPROGRESS;
412                 break;
413         case WI_RID_READ_CACHE: {
414                 struct wi_read_sigcache_args args;
415                 args.i = 0;
416                 args.wsc = (struct wi_sigcache *) wreq.wi_val;
417                 args.max = (void *)(&wreq + 1);
418                 ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
419                 wreq.wi_len = sizeof(struct wi_sigcache) * args.i / 2;
420                 break;
421         }
422         default:
423                 error = EINVAL;
424                 break;
425         }
426         if (error == 0) {
427                 wreq.wi_len++;
428                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
429         }
430         return error;
431 }
432
433 static int
434 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
435 {
436 #define IEEERATE(_ic,_m,_i) \
437         ((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
438         int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
439         for (i = 0; i < nrates; i++)
440                 if (IEEERATE(ic, mode, i) == rate)
441                         return i;
442         return -1;
443 #undef IEEERATE
444 }
445
446 /*
447  * Prepare to do a user-initiated scan for AP's.  If no
448  * current/default channel is setup or the current channel
449  * is invalid then pick the first available channel from
450  * the active list as the place to start the scan.
451  */
452 static int
453 ieee80211_setupscan(struct ieee80211com *ic, const uint8_t chanlist[])
454 {
455
456         /*
457          * XXX don't permit a scan to be started unless we
458          * know the device is ready.  For the moment this means
459          * the device is marked up as this is the required to
460          * initialize the hardware.  It would be better to permit
461          * scanning prior to being up but that'll require some
462          * changes to the infrastructure.
463          */
464         if (!IS_UP(ic))
465                 return EINVAL;
466         memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
467         /*
468          * We force the state to INIT before calling ieee80211_new_state
469          * to get ieee80211_begin_scan called.  We really want to scan w/o
470          * altering the current state but that's not possible right now.
471          */
472         /* XXX handle proberequest case */
473         ic->ic_state = IEEE80211_S_INIT;        /* XXX bypass state machine */
474         return 0;
475 }
476
477 int
478 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, caddr_t data)
479 {
480         struct ifnet *ifp = ic->ic_ifp;
481         int i, j, len, error, rate;
482         struct ifreq *ifr = (struct ifreq *)data;
483         struct wi_ltv_keys *keys;
484         struct wi_req wreq;
485         u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
486
487         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
488         if (error)
489                 return error;
490         len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
491         switch (wreq.wi_type) {
492         case WI_RID_SERIALNO:
493         case WI_RID_NODENAME:
494                 return EPERM;
495         case WI_RID_CURRENT_SSID:
496                 return EPERM;
497         case WI_RID_OWN_SSID:
498         case WI_RID_DESIRED_SSID:
499                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
500                     le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
501                         error = ENOSPC;
502                         break;
503                 }
504                 memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
505                 ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
506                 memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
507                 error = ENETRESET;
508                 break;
509         case WI_RID_CURRENT_BSSID:
510                 return EPERM;
511         case WI_RID_OWN_CHNL:
512                 if (len != 2)
513                         return EINVAL;
514                 i = le16toh(wreq.wi_val[0]);
515                 if (i < 0 ||
516                     i > IEEE80211_CHAN_MAX ||
517                     isclr(ic->ic_chan_active, i))
518                         return EINVAL;
519                 ic->ic_ibss_chan = &ic->ic_channels[i];
520                 if (ic->ic_opmode == IEEE80211_M_MONITOR)
521                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
522                 else
523                         error = ENETRESET;
524                 break;
525         case WI_RID_CURRENT_CHAN:
526                 return EPERM;
527         case WI_RID_COMMS_QUALITY:
528                 return EPERM;
529         case WI_RID_PROMISC:
530                 if (len != 2)
531                         return EINVAL;
532                 if (ifp->if_flags & IFF_PROMISC) {
533                         if (wreq.wi_val[0] == 0) {
534                                 ifp->if_flags &= ~IFF_PROMISC;
535                                 error = ENETRESET;
536                         }
537                 } else {
538                         if (wreq.wi_val[0] != 0) {
539                                 ifp->if_flags |= IFF_PROMISC;
540                                 error = ENETRESET;
541                         }
542                 }
543                 break;
544         case WI_RID_PORTTYPE:
545                 if (len != 2)
546                         return EINVAL;
547                 switch (le16toh(wreq.wi_val[0])) {
548                 case IEEE80211_M_STA:
549                         break;
550                 case IEEE80211_M_IBSS:
551                         if (!(ic->ic_caps & IEEE80211_C_IBSS))
552                                 return EINVAL;
553                         break;
554                 case IEEE80211_M_AHDEMO:
555                         if (ic->ic_phytype != IEEE80211_T_DS ||
556                             !(ic->ic_caps & IEEE80211_C_AHDEMO))
557                                 return EINVAL;
558                         break;
559                 case IEEE80211_M_HOSTAP:
560                         if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
561                                 return EINVAL;
562                         break;
563                 default:
564                         return EINVAL;
565                 }
566                 if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
567                         ic->ic_opmode = le16toh(wreq.wi_val[0]);
568                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
569                 }
570                 break;
571 #if 0
572         case WI_RID_MAC_NODE:
573                 if (len != IEEE80211_ADDR_LEN)
574                         return EINVAL;
575                 IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
576                 /* if_init will copy lladdr into ic_myaddr */
577                 error = ENETRESET;
578                 break;
579 #endif
580         case WI_RID_TX_RATE:
581                 if (len != 2)
582                         return EINVAL;
583                 if (wreq.wi_val[0] == 0) {
584                         /* auto */
585                         ic->ic_fixed_rate = IEEE80211_FIXED_RATE_NONE;
586                         break;
587                 }
588                 rate = 2 * le16toh(wreq.wi_val[0]);
589                 if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
590                         /*
591                          * In autoselect mode search for the rate.  We take
592                          * the first instance which may not be right, but we
593                          * are limited by the interface.  Note that we also
594                          * lock the mode to insure the rate is meaningful
595                          * when it is used.
596                          */
597                         for (j = IEEE80211_MODE_11A;
598                              j < IEEE80211_MODE_MAX; j++) {
599                                 if ((ic->ic_modecaps & (1<<j)) == 0)
600                                         continue;
601                                 i = findrate(ic, j, rate);
602                                 if (i != -1) {
603                                         /* lock mode too */
604                                         ic->ic_curmode = j;
605                                         goto setrate;
606                                 }
607                         }
608                 } else {
609                         i = findrate(ic, ic->ic_curmode, rate);
610                         if (i != -1)
611                                 goto setrate;
612                 }
613                 return EINVAL;
614         setrate:
615                 ic->ic_fixed_rate = i;
616                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
617                 break;
618         case WI_RID_CUR_TX_RATE:
619                 return EPERM;
620         case WI_RID_RTS_THRESH:
621                 if (len != 2)
622                         return EINVAL;
623                 if (le16toh(wreq.wi_val[0]) != IEEE80211_MAX_LEN)
624                         return EINVAL;          /* TODO: RTS */
625                 break;
626         case WI_RID_CREATE_IBSS:
627                 if (len != 2)
628                         return EINVAL;
629                 if (wreq.wi_val[0] != 0) {
630                         if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
631                                 return EINVAL;
632                         if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
633                                 ic->ic_flags |= IEEE80211_F_IBSSON;
634                                 if (ic->ic_opmode == IEEE80211_M_IBSS &&
635                                     ic->ic_state == IEEE80211_S_SCAN)
636                                         error = IS_UP_AUTO(ic) ? ENETRESET : 0;
637                         }
638                 } else {
639                         if (ic->ic_flags & IEEE80211_F_IBSSON) {
640                                 ic->ic_flags &= ~IEEE80211_F_IBSSON;
641                                 if (ic->ic_flags & IEEE80211_F_SIBSS) {
642                                         ic->ic_flags &= ~IEEE80211_F_SIBSS;
643                                         error = IS_UP_AUTO(ic) ? ENETRESET : 0;
644                                 }
645                         }
646                 }
647                 break;
648         case WI_RID_MICROWAVE_OVEN:
649                 if (len != 2)
650                         return EINVAL;
651                 if (wreq.wi_val[0] != 0)
652                         return EINVAL;          /* not supported */
653                 break;
654         case WI_RID_ROAMING_MODE:
655                 if (len != 2)
656                         return EINVAL;
657                 i = le16toh(wreq.wi_val[0]);
658                 if (i > IEEE80211_ROAMING_MANUAL)
659                         return EINVAL;          /* not supported */
660                 ic->ic_roaming = i;
661                 break;
662         case WI_RID_SYSTEM_SCALE:
663                 if (len != 2)
664                         return EINVAL;
665                 if (le16toh(wreq.wi_val[0]) != 1)
666                         return EINVAL;          /* not supported */
667                 break;
668         case WI_RID_PM_ENABLED:
669                 if (len != 2)
670                         return EINVAL;
671                 if (wreq.wi_val[0] != 0) {
672                         if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
673                                 return EINVAL;
674                         if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
675                                 ic->ic_flags |= IEEE80211_F_PMGTON;
676                                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
677                         }
678                 } else {
679                         if (ic->ic_flags & IEEE80211_F_PMGTON) {
680                                 ic->ic_flags &= ~IEEE80211_F_PMGTON;
681                                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
682                         }
683                 }
684                 break;
685         case WI_RID_MAX_SLEEP:
686                 if (len != 2)
687                         return EINVAL;
688                 ic->ic_lintval = le16toh(wreq.wi_val[0]);
689                 if (ic->ic_flags & IEEE80211_F_PMGTON)
690                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
691                 break;
692         case WI_RID_CUR_BEACON_INT:
693                 return EPERM;
694         case WI_RID_WEP_AVAIL:
695                 return EPERM;
696         case WI_RID_CNFAUTHMODE:
697                 if (len != 2)
698                         return EINVAL;
699                 i = le16toh(wreq.wi_val[0]);
700                 if (i > IEEE80211_AUTH_WPA)
701                         return EINVAL;
702                 ic->ic_bss->ni_authmode = i;            /* XXX ENETRESET? */
703                 error = ENETRESET;
704                 break;
705         case WI_RID_ENCRYPTION:
706                 if (len != 2)
707                         return EINVAL;
708                 if (wreq.wi_val[0] != 0) {
709                         if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
710                                 return EINVAL;
711                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
712                                 ic->ic_flags |= IEEE80211_F_PRIVACY;
713                                 error = ENETRESET;
714                         }
715                 } else {
716                         if (ic->ic_flags & IEEE80211_F_PRIVACY) {
717                                 ic->ic_flags &= ~IEEE80211_F_PRIVACY;
718                                 error = ENETRESET;
719                         }
720                 }
721                 break;
722         case WI_RID_TX_CRYPT_KEY:
723                 if (len != 2)
724                         return EINVAL;
725                 i = le16toh(wreq.wi_val[0]);
726                 if (i >= IEEE80211_WEP_NKID)
727                         return EINVAL;
728                 ic->ic_def_txkey = i;
729                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
730                 break;
731         case WI_RID_DEFLT_CRYPT_KEYS:
732                 if (len != sizeof(struct wi_ltv_keys))
733                         return EINVAL;
734                 keys = (struct wi_ltv_keys *)&wreq;
735                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
736                         len = le16toh(keys->wi_keys[i].wi_keylen);
737                         if (len != 0 && len < IEEE80211_WEP_KEYLEN)
738                                 return EINVAL;
739                         if (len > IEEE80211_KEYBUF_SIZE)
740                                 return EINVAL;
741                 }
742                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
743                         struct ieee80211_key *k = &ic->ic_nw_keys[i];
744
745                         len = le16toh(keys->wi_keys[i].wi_keylen);
746                         k->wk_keylen = len;
747                         k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
748                         memset(k->wk_key, 0, sizeof(k->wk_key));
749                         memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
750 #if 0
751                         k->wk_type = IEEE80211_CIPHER_WEP;
752 #endif
753                 }
754                 error = ENETRESET;
755                 break;
756         case WI_RID_MAX_DATALEN:
757                 if (len != 2)
758                         return EINVAL;
759                 len = le16toh(wreq.wi_val[0]);
760                 if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
761                         return EINVAL;
762                 ic->ic_fragthreshold = len;
763                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
764                 break;
765         case WI_RID_IFACE_STATS:
766                 error = EPERM;
767                 break;
768         case WI_RID_SCAN_REQ:                   /* XXX wicontrol */
769                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
770                         break;
771                 error = ieee80211_setupscan(ic, ic->ic_chan_avail);
772                 if (error == 0)
773                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
774                 break;
775         case WI_RID_SCAN_APS:
776                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
777                         break;
778                 len--;                  /* XXX: tx rate? */
779                 /* FALLTHRU */
780         case WI_RID_CHANNEL_LIST:
781                 memset(chanlist, 0, sizeof(chanlist));
782                 /*
783                  * Since channel 0 is not available for DS, channel 1
784                  * is assigned to LSB on WaveLAN.
785                  */
786                 if (ic->ic_phytype == IEEE80211_T_DS)
787                         i = 1;
788                 else
789                         i = 0;
790                 for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
791                         if ((j / 8) >= len)
792                                 break;
793                         if (isclr((uint8_t *)wreq.wi_val, j))
794                                 continue;
795                         if (isclr(ic->ic_chan_active, i)) {
796                                 if (wreq.wi_type != WI_RID_CHANNEL_LIST)
797                                         continue;
798                                 if (isclr(ic->ic_chan_avail, i))
799                                         return EPERM;
800                         }
801                         setbit(chanlist, i);
802                 }
803                 error = ieee80211_setupscan(ic, chanlist);
804                 if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
805                         /* NB: ignore error from ieee80211_setupscan */
806                         error = ENETRESET;
807                 } else if (error == 0)
808                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
809                 break;
810         default:
811                 error = EINVAL;
812                 break;
813         }
814         if (error == ENETRESET && !IS_UP_AUTO(ic))
815                 error = 0;
816         return error;
817 }
818
819 static int
820 cap2cipher(int flag)
821 {
822         switch (flag) {
823         case IEEE80211_C_WEP:           return IEEE80211_CIPHER_WEP;
824         case IEEE80211_C_AES:           return IEEE80211_CIPHER_AES_OCB;
825         case IEEE80211_C_AES_CCM:       return IEEE80211_CIPHER_AES_CCM;
826         case IEEE80211_C_CKIP:          return IEEE80211_CIPHER_CKIP;
827         case IEEE80211_C_TKIP:          return IEEE80211_CIPHER_TKIP;
828         }
829         return -1;
830 }
831
832 static int
833 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq,
834                        struct ucred *cr)
835 {
836         struct ieee80211_node *ni;
837         struct ieee80211req_key ik;
838         struct ieee80211_key *wk;
839         const struct ieee80211_cipher *cip;
840         u_int kid;
841         int error;
842
843         if (ireq->i_len != sizeof(ik))
844                 return EINVAL;
845         error = copyin(ireq->i_data, &ik, sizeof(ik));
846         if (error)
847                 return error;
848         kid = ik.ik_keyix;
849         if (kid == IEEE80211_KEYIX_NONE) {
850                 ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
851                 if (ni == NULL)
852                         return EINVAL;          /* XXX */
853                 wk = &ni->ni_ucastkey;
854         } else {
855                 if (kid >= IEEE80211_WEP_NKID)
856                         return EINVAL;
857                 wk = &ic->ic_nw_keys[kid];
858                 IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
859                 ni = NULL;
860         }
861         cip = wk->wk_cipher;
862         ik.ik_type = cip->ic_cipher;
863         ik.ik_keylen = wk->wk_keylen;
864         ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
865         if (wk->wk_keyix == ic->ic_def_txkey)
866                 ik.ik_flags |= IEEE80211_KEY_DEFAULT;
867         if (suser_cred(cr, NULL_CRED_OKAY) == 0) {
868                 /* NB: only root can read key data */
869                 ik.ik_keyrsc = wk->wk_keyrsc;
870                 ik.ik_keytsc = wk->wk_keytsc;
871                 memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
872                 if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
873                         memcpy(ik.ik_keydata+wk->wk_keylen,
874                                 wk->wk_key + IEEE80211_KEYBUF_SIZE,
875                                 IEEE80211_MICBUF_SIZE);
876                         ik.ik_keylen += IEEE80211_MICBUF_SIZE;
877                 }
878         } else {
879                 ik.ik_keyrsc = 0;
880                 ik.ik_keytsc = 0;
881                 memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
882         }
883         if (ni != NULL)
884                 ieee80211_free_node(ni);
885         return copyout(&ik, ireq->i_data, sizeof(ik));
886 }
887
888 static int
889 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
890 {
891
892         if (sizeof(ic->ic_chan_active) < ireq->i_len)
893                 ireq->i_len = sizeof(ic->ic_chan_active);
894         return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
895 }
896
897 static int
898 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
899 {
900         struct ieee80211req_chaninfo chans;     /* XXX off stack? */
901         int i, space;
902
903         /*
904          * Since channel 0 is not available for DS, channel 1
905          * is assigned to LSB on WaveLAN.
906          */
907         if (ic->ic_phytype == IEEE80211_T_DS)
908                 i = 1;
909         else
910                 i = 0;
911         memset(&chans, 0, sizeof(chans));
912         for (; i <= IEEE80211_CHAN_MAX; i++)
913                 if (isset(ic->ic_chan_avail, i)) {
914                         struct ieee80211_channel *c = &ic->ic_channels[i];
915                         chans.ic_chans[chans.ic_nchans].ic_freq = c->ic_freq;
916                         chans.ic_chans[chans.ic_nchans].ic_flags = c->ic_flags;
917                         chans.ic_nchans++;
918                 }
919         space = __offsetof(struct ieee80211req_chaninfo,
920                         ic_chans[chans.ic_nchans]);
921         if (space > ireq->i_len)
922                 space = ireq->i_len;
923         return copyout(&chans, ireq->i_data, space);
924 }
925
926 static int
927 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
928 {
929         struct ieee80211_node *ni;
930         struct ieee80211req_wpaie wpaie;
931         int error;
932
933         if (ireq->i_len < IEEE80211_ADDR_LEN)
934                 return EINVAL;
935         error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
936         if (error != 0)
937                 return error;
938         ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
939         if (ni == NULL)
940                 return EINVAL;          /* XXX */
941         memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
942         if (ni->ni_wpa_ie != NULL) {
943                 int ielen = ni->ni_wpa_ie[1] + 2;
944                 if (ielen > sizeof(wpaie.wpa_ie))
945                         ielen = sizeof(wpaie.wpa_ie);
946                 memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
947         }
948         ieee80211_free_node(ni);
949         if (ireq->i_len > sizeof(wpaie))
950                 ireq->i_len = sizeof(wpaie);
951         return copyout(&wpaie, ireq->i_data, ireq->i_len);
952 }
953
954 static int
955 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
956 {
957         struct ieee80211_node *ni;
958         uint8_t macaddr[IEEE80211_ADDR_LEN];
959         const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
960         int error;
961
962         if (ireq->i_len < off)
963                 return EINVAL;
964         error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
965         if (error != 0)
966                 return error;
967         ni = ieee80211_find_node(&ic->ic_sta, macaddr);
968         if (ni == NULL)
969                 return EINVAL;          /* XXX */
970         if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
971                 ireq->i_len = sizeof(struct ieee80211req_sta_stats);
972         /* NB: copy out only the statistics */
973         error = copyout(&ni->ni_stats, (uint8_t *) ireq->i_data + off,
974                         ireq->i_len - off);
975         ieee80211_free_node(ni);
976         return error;
977 }
978
979 static void
980 get_scan_result(struct ieee80211req_scan_result *sr,
981         const struct ieee80211_node *ni)
982 {
983         struct ieee80211com *ic = ni->ni_ic;
984         u_int ielen = 0;
985
986         memset(sr, 0, sizeof(*sr));
987         sr->isr_ssid_len = ni->ni_esslen;
988         if (ni->ni_wpa_ie != NULL)
989                 ielen += 2+ni->ni_wpa_ie[1];
990         if (ni->ni_wme_ie != NULL)
991                 ielen += 2+ni->ni_wme_ie[1];
992
993         /*
994          * The value sr->isr_ie_len is defined as a uint8_t, so we
995          * need to be careful to avoid an integer overflow.  If the
996          * value would overflow, we will set isr_ie_len to zero, and
997          * ieee80211_ioctl_getscanresults (below) will avoid copying
998          * the (overflowing) data.
999          */
1000         if (ielen > 255)
1001                 ielen = 0;
1002         sr->isr_ie_len = ielen;
1003         sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
1004         sr->isr_len = roundup(sr->isr_len, sizeof(uint32_t));
1005         if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
1006                 sr->isr_freq = ni->ni_chan->ic_freq;
1007                 sr->isr_flags = ni->ni_chan->ic_flags;
1008         }
1009         sr->isr_rssi = ic->ic_node_getrssi(ni);
1010         sr->isr_intval = ni->ni_intval;
1011         sr->isr_capinfo = ni->ni_capinfo;
1012         sr->isr_erp = ni->ni_erp;
1013         IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
1014         sr->isr_nrates = ni->ni_rates.rs_nrates;
1015         if (sr->isr_nrates > 15)
1016                 sr->isr_nrates = 15;
1017         memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
1018 }
1019
1020 static int
1021 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
1022 {
1023         union {
1024                 struct ieee80211req_scan_result res;
1025                 char data[512];         /* XXX shrink? */
1026         } u;
1027         struct ieee80211req_scan_result *sr = &u.res;
1028         struct ieee80211_node_table *nt;
1029         struct ieee80211_node *ni;
1030         int error, space;
1031         uint8_t *p, *cp;
1032
1033         p = ireq->i_data;
1034         space = ireq->i_len;
1035         error = 0;
1036         /* XXX locking */
1037         nt =  &ic->ic_scan;
1038         TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1039                 /* NB: skip pre-scan node state */ 
1040                 if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1041                         continue;
1042                 get_scan_result(sr, ni);
1043                 if (sr->isr_len > sizeof(u))
1044                         continue;               /* XXX */
1045                 if (space < sr->isr_len)
1046                         break;
1047                 cp = (uint8_t *)(sr+1);
1048                 memcpy(cp, ni->ni_essid, ni->ni_esslen);
1049                 cp += ni->ni_esslen;
1050                 if (sr->isr_ie_len > 0 && ni->ni_wpa_ie != NULL) {
1051                         memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1052                         cp += 2+ni->ni_wpa_ie[1];
1053                 }
1054                 if (sr->isr_ie_len > 0 && ni->ni_wme_ie != NULL) {
1055                         memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1056                         cp += 2+ni->ni_wme_ie[1];
1057                 }
1058                 error = copyout(sr, p, sr->isr_len);
1059                 if (error)
1060                         break;
1061                 p += sr->isr_len;
1062                 space -= sr->isr_len;
1063         }
1064         ireq->i_len -= space;
1065         return error;
1066 }
1067
1068 struct stainforeq {
1069         struct ieee80211com *ic;
1070         struct ieee80211req_sta_info *si;
1071         size_t  space;
1072 };
1073
1074 static size_t
1075 sta_space(const struct ieee80211_node *ni, size_t *ielen)
1076 {
1077         *ielen = 0;
1078         if (ni->ni_wpa_ie != NULL)
1079                 *ielen += 2+ni->ni_wpa_ie[1];
1080         if (ni->ni_wme_ie != NULL)
1081                 *ielen += 2+ni->ni_wme_ie[1];
1082         return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
1083                       sizeof(uint32_t));
1084 }
1085
1086 static void
1087 get_sta_space(void *arg, struct ieee80211_node *ni)
1088 {
1089         struct stainforeq *req = arg;
1090         struct ieee80211com *ic = ni->ni_ic;
1091         size_t ielen;
1092
1093         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1094             ni->ni_associd == 0)        /* only associated stations */
1095                 return;
1096         req->space += sta_space(ni, &ielen);
1097 }
1098
1099 static void
1100 get_sta_info(void *arg, struct ieee80211_node *ni)
1101 {
1102         struct stainforeq *req = arg;
1103         struct ieee80211com *ic = ni->ni_ic;
1104         struct ieee80211req_sta_info *si;
1105         size_t ielen, len;
1106         uint8_t *cp;
1107
1108         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1109             ni->ni_associd == 0)        /* only associated stations */
1110                 return;
1111         if (ni->ni_chan == IEEE80211_CHAN_ANYC) /* XXX bogus entry */
1112                 return;
1113         len = sta_space(ni, &ielen);
1114         if (len > req->space)
1115                 return;
1116         si = req->si;
1117         si->isi_len = len;
1118         si->isi_ie_len = ielen;
1119         si->isi_freq = ni->ni_chan->ic_freq;
1120         si->isi_flags = ni->ni_chan->ic_flags;
1121         si->isi_state = ni->ni_flags;
1122         si->isi_authmode = ni->ni_authmode;
1123         si->isi_rssi = ic->ic_node_getrssi(ni);
1124         si->isi_capinfo = ni->ni_capinfo;
1125         si->isi_erp = ni->ni_erp;
1126         IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
1127         si->isi_nrates = ni->ni_rates.rs_nrates;
1128         if (si->isi_nrates > 15)
1129                 si->isi_nrates = 15;
1130         memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
1131         si->isi_txrate = ni->ni_txrate;
1132         si->isi_associd = ni->ni_associd;
1133         si->isi_txpower = ni->ni_txpower;
1134         si->isi_vlan = ni->ni_vlan;
1135         if (ni->ni_flags & IEEE80211_NODE_QOS) {
1136                 memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
1137                 memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
1138         } else {
1139                 si->isi_txseqs[0] = ni->ni_txseqs[0];
1140                 si->isi_rxseqs[0] = ni->ni_rxseqs[0];
1141         }
1142         /* NB: leave all cases in case we relax ni_associd == 0 check */
1143         if (ieee80211_node_is_authorized(ni))
1144                 si->isi_inact = ic->ic_inact_run;
1145         else if (ni->ni_associd != 0)
1146                 si->isi_inact = ic->ic_inact_auth;
1147         else
1148                 si->isi_inact = ic->ic_inact_init;
1149         si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
1150
1151         cp = (uint8_t *)(si+1);
1152         if (ni->ni_wpa_ie != NULL) {
1153                 memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1154                 cp += 2+ni->ni_wpa_ie[1];
1155         }
1156         if (ni->ni_wme_ie != NULL) {
1157                 memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1158                 cp += 2+ni->ni_wme_ie[1];
1159         }
1160
1161         req->si = (struct ieee80211req_sta_info *)(((uint8_t *)si) + len);
1162         req->space -= len;
1163 }
1164
1165 static int
1166 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
1167 {
1168         struct stainforeq req;
1169         int error;
1170
1171         if (ireq->i_len < sizeof(struct stainforeq))
1172                 return EFAULT;
1173
1174         error = 0;
1175         req.space = 0;
1176         ieee80211_iterate_nodes(&ic->ic_sta, get_sta_space, &req);
1177         if (req.space > ireq->i_len)
1178                 req.space = ireq->i_len;
1179         if (req.space > 0) {
1180                 size_t space;
1181                 void *p;
1182
1183                 space = req.space;
1184                 /* XXX M_WAITOK after driver lock released */
1185                 p = kmalloc(space, M_TEMP, M_NOWAIT);
1186                 if (p == NULL)
1187                         return ENOMEM;
1188                 req.si = p;
1189                 ieee80211_iterate_nodes(&ic->ic_sta, get_sta_info, &req);
1190                 ireq->i_len = space - req.space;
1191                 error = copyout(p, ireq->i_data, ireq->i_len);
1192                 kfree(p, M_TEMP);
1193         } else
1194                 ireq->i_len = 0;
1195
1196         return error;
1197 }
1198
1199 static int
1200 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1201 {
1202         struct ieee80211_node *ni;
1203         struct ieee80211req_sta_txpow txpow;
1204         int error;
1205
1206         if (ireq->i_len != sizeof(txpow))
1207                 return EINVAL;
1208         error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1209         if (error != 0)
1210                 return error;
1211         ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1212         if (ni == NULL)
1213                 return EINVAL;          /* XXX */
1214         txpow.it_txpow = ni->ni_txpower;
1215         error = copyout(&txpow, ireq->i_data, sizeof(txpow));
1216         ieee80211_free_node(ni);
1217         return error;
1218 }
1219
1220 static int
1221 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1222 {
1223         struct ieee80211_wme_state *wme = &ic->ic_wme;
1224         struct wmeParams *wmep;
1225         int ac;
1226
1227         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1228                 return EINVAL;
1229
1230         ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1231         if (ac >= WME_NUM_AC)
1232                 ac = WME_AC_BE;
1233         if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
1234                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1235         else
1236                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1237         switch (ireq->i_type) {
1238         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
1239                 ireq->i_val = wmep->wmep_logcwmin;
1240                 break;
1241         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
1242                 ireq->i_val = wmep->wmep_logcwmax;
1243                 break;
1244         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
1245                 ireq->i_val = wmep->wmep_aifsn;
1246                 break;
1247         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
1248                 ireq->i_val = wmep->wmep_txopLimit;
1249                 break;
1250         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
1251                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1252                 ireq->i_val = wmep->wmep_acm;
1253                 break;
1254         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (!bss only)*/
1255                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1256                 ireq->i_val = !wmep->wmep_noackPolicy;
1257                 break;
1258         }
1259         return 0;
1260 }
1261
1262 static int
1263 ieee80211_ioctl_getmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1264 {
1265         const struct ieee80211_aclator *acl = ic->ic_acl;
1266
1267         return (acl == NULL ? EINVAL : acl->iac_getioctl(ic, ireq));
1268 }
1269
1270 /*
1271  * When building the kernel with -O2 on the i386 architecture, gcc
1272  * seems to want to inline this function into ieee80211_ioctl()
1273  * (which is the only routine that calls it). When this happens,
1274  * ieee80211_ioctl() ends up consuming an additional 2K of stack
1275  * space. (Exactly why it needs so much is unclear.) The problem
1276  * is that it's possible for ieee80211_ioctl() to invoke other
1277  * routines (including driver init functions) which could then find
1278  * themselves perilously close to exhausting the stack.
1279  *
1280  * To avoid this, we deliberately prevent gcc from inlining this
1281  * routine. Another way to avoid this is to use less agressive
1282  * optimization when compiling this file (i.e. -O instead of -O2)
1283  * but special-casing the compilation of this one module in the
1284  * build system would be awkward.
1285  */
1286 #ifdef __GNUC__
1287 __attribute__ ((noinline))
1288 #endif
1289 static int
1290 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd,
1291                          struct ieee80211req *ireq, struct ucred *cr)
1292 {
1293         const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1294         int error = 0;
1295         u_int kid, len, m;
1296         uint8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1297         char tmpssid[IEEE80211_NWID_LEN];
1298
1299         switch (ireq->i_type) {
1300         case IEEE80211_IOC_SSID:
1301                 switch (ic->ic_state) {
1302                 case IEEE80211_S_INIT:
1303                 case IEEE80211_S_SCAN:
1304                         ireq->i_len = ic->ic_des_esslen;
1305                         memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
1306                         break;
1307                 default:
1308                         ireq->i_len = ic->ic_bss->ni_esslen;
1309                         memcpy(tmpssid, ic->ic_bss->ni_essid,
1310                                 ireq->i_len);
1311                         break;
1312                 }
1313                 error = copyout(tmpssid, ireq->i_data, ireq->i_len);
1314                 break;
1315         case IEEE80211_IOC_NUMSSIDS:
1316                 ireq->i_val = 1;
1317                 break;
1318         case IEEE80211_IOC_WEP:
1319                 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
1320                         ireq->i_val = IEEE80211_WEP_OFF;
1321                 else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
1322                         ireq->i_val = IEEE80211_WEP_ON;
1323                 else
1324                         ireq->i_val = IEEE80211_WEP_MIXED;
1325                 break;
1326         case IEEE80211_IOC_WEPKEY:
1327                 kid = (u_int) ireq->i_val;
1328                 if (kid >= IEEE80211_WEP_NKID)
1329                         return EINVAL;
1330                 len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
1331                 /* NB: only root can read WEP keys */
1332                 if (suser_cred(cr, NULL_CRED_OKAY) == 0) {
1333                         bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
1334                 } else {
1335                         bzero(tmpkey, len);
1336                 }
1337                 ireq->i_len = len;
1338                 error = copyout(tmpkey, ireq->i_data, len);
1339                 break;
1340         case IEEE80211_IOC_NUMWEPKEYS:
1341                 ireq->i_val = IEEE80211_WEP_NKID;
1342                 break;
1343         case IEEE80211_IOC_WEPTXKEY:
1344                 ireq->i_val = ic->ic_def_txkey;
1345                 break;
1346         case IEEE80211_IOC_AUTHMODE:
1347                 if (ic->ic_flags & IEEE80211_F_WPA)
1348                         ireq->i_val = IEEE80211_AUTH_WPA;
1349                 else
1350                         ireq->i_val = ic->ic_bss->ni_authmode;
1351                 break;
1352         case IEEE80211_IOC_CHANNEL:
1353                 ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
1354                 break;
1355         case IEEE80211_IOC_POWERSAVE:
1356                 if (ic->ic_flags & IEEE80211_F_PMGTON)
1357                         ireq->i_val = IEEE80211_POWERSAVE_ON;
1358                 else
1359                         ireq->i_val = IEEE80211_POWERSAVE_OFF;
1360                 break;
1361         case IEEE80211_IOC_POWERSAVESLEEP:
1362                 ireq->i_val = ic->ic_lintval;
1363                 break;
1364         case IEEE80211_IOC_RTSTHRESHOLD:
1365                 ireq->i_val = ic->ic_rtsthreshold;
1366                 break;
1367         case IEEE80211_IOC_PROTMODE:
1368                 ireq->i_val = ic->ic_protmode;
1369                 break;
1370         case IEEE80211_IOC_TXPOWER:
1371                 if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
1372                         return EINVAL;
1373                 ireq->i_val = ic->ic_txpowlimit;
1374                 break;
1375         case IEEE80211_IOC_MCASTCIPHER:
1376                 ireq->i_val = rsn->rsn_mcastcipher;
1377                 break;
1378         case IEEE80211_IOC_MCASTKEYLEN:
1379                 ireq->i_val = rsn->rsn_mcastkeylen;
1380                 break;
1381         case IEEE80211_IOC_UCASTCIPHERS:
1382                 ireq->i_val = 0;
1383                 for (m = 0x1; m != 0; m <<= 1)
1384                         if (rsn->rsn_ucastcipherset & m)
1385                                 ireq->i_val |= 1<<cap2cipher(m);
1386                 break;
1387         case IEEE80211_IOC_UCASTCIPHER:
1388                 ireq->i_val = rsn->rsn_ucastcipher;
1389                 break;
1390         case IEEE80211_IOC_UCASTKEYLEN:
1391                 ireq->i_val = rsn->rsn_ucastkeylen;
1392                 break;
1393         case IEEE80211_IOC_KEYMGTALGS:
1394                 ireq->i_val = rsn->rsn_keymgmtset;
1395                 break;
1396         case IEEE80211_IOC_RSNCAPS:
1397                 ireq->i_val = rsn->rsn_caps;
1398                 break;
1399         case IEEE80211_IOC_WPA:
1400                 switch (ic->ic_flags & IEEE80211_F_WPA) {
1401                 case IEEE80211_F_WPA1:
1402                         ireq->i_val = 1;
1403                         break;
1404                 case IEEE80211_F_WPA2:
1405                         ireq->i_val = 2;
1406                         break;
1407                 case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
1408                         ireq->i_val = 3;
1409                         break;
1410                 default:
1411                         ireq->i_val = 0;
1412                         break;
1413                 }
1414                 break;
1415         case IEEE80211_IOC_CHANLIST:
1416                 error = ieee80211_ioctl_getchanlist(ic, ireq);
1417                 break;
1418         case IEEE80211_IOC_ROAMING:
1419                 ireq->i_val = ic->ic_roaming;
1420                 break;
1421         case IEEE80211_IOC_PRIVACY:
1422                 ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
1423                 break;
1424         case IEEE80211_IOC_DROPUNENCRYPTED:
1425                 ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
1426                 break;
1427         case IEEE80211_IOC_COUNTERMEASURES:
1428                 ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
1429                 break;
1430         case IEEE80211_IOC_DRIVER_CAPS:
1431                 ireq->i_val = ic->ic_caps>>16;
1432                 ireq->i_len = ic->ic_caps&0xffff;
1433                 break;
1434         case IEEE80211_IOC_WME:
1435                 ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
1436                 break;
1437         case IEEE80211_IOC_HIDESSID:
1438                 ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
1439                 break;
1440         case IEEE80211_IOC_APBRIDGE:
1441                 ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
1442                 break;
1443         case IEEE80211_IOC_OPTIE:
1444                 if (ic->ic_opt_ie == NULL)
1445                         return EINVAL;
1446                 /* NB: truncate, caller can check length */
1447                 if (ireq->i_len > ic->ic_opt_ie_len)
1448                         ireq->i_len = ic->ic_opt_ie_len;
1449                 error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
1450                 break;
1451         case IEEE80211_IOC_WPAKEY:
1452                 error = ieee80211_ioctl_getkey(ic, ireq, cr);
1453                 break;
1454         case IEEE80211_IOC_CHANINFO:
1455                 error = ieee80211_ioctl_getchaninfo(ic, ireq);
1456                 break;
1457         case IEEE80211_IOC_BSSID:
1458                 if (ireq->i_len != IEEE80211_ADDR_LEN)
1459                         return EINVAL;
1460                 error = copyout(ic->ic_state == IEEE80211_S_RUN ?
1461                                         ic->ic_bss->ni_bssid :
1462                                         ic->ic_des_bssid,
1463                                 ireq->i_data, ireq->i_len);
1464                 break;
1465         case IEEE80211_IOC_WPAIE:
1466                 error = ieee80211_ioctl_getwpaie(ic, ireq);
1467                 break;
1468         case IEEE80211_IOC_SCAN_RESULTS:
1469                 error = ieee80211_ioctl_getscanresults(ic, ireq);
1470                 break;
1471         case IEEE80211_IOC_STA_STATS:
1472                 error = ieee80211_ioctl_getstastats(ic, ireq);
1473                 break;
1474         case IEEE80211_IOC_TXPOWMAX:
1475                 ireq->i_val = ic->ic_bss->ni_txpower;
1476                 break;
1477         case IEEE80211_IOC_STA_TXPOW:
1478                 error = ieee80211_ioctl_getstatxpow(ic, ireq);
1479                 break;
1480         case IEEE80211_IOC_STA_INFO:
1481                 error = ieee80211_ioctl_getstainfo(ic, ireq);
1482                 break;
1483         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
1484         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
1485         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
1486         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
1487         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
1488         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (bss only) */
1489                 error = ieee80211_ioctl_getwmeparam(ic, ireq);
1490                 break;
1491         case IEEE80211_IOC_DTIM_PERIOD:
1492                 ireq->i_val = ic->ic_dtim_period;
1493                 break;
1494         case IEEE80211_IOC_BEACON_INTERVAL:
1495                 /* NB: get from ic_bss for station mode */
1496                 ireq->i_val = ic->ic_bss->ni_intval;
1497                 break;
1498         case IEEE80211_IOC_PUREG:
1499                 ireq->i_val = (ic->ic_flags & IEEE80211_F_PUREG) != 0;
1500                 break;
1501         case IEEE80211_IOC_MCAST_RATE:
1502                 ireq->i_val = ic->ic_mcast_rate;
1503                 break;
1504         case IEEE80211_IOC_FRAGTHRESHOLD:
1505                 ireq->i_val = ic->ic_fragthreshold;
1506                 break;
1507         case IEEE80211_IOC_MACCMD:
1508                 error = ieee80211_ioctl_getmaccmd(ic, ireq);
1509                 break;
1510         case IEEE80211_IOC_BURST:
1511                 ireq->i_val = (ic->ic_flags & IEEE80211_F_BURST) != 0;
1512                 break;
1513         case IEEE80211_IOC_RATECTL:
1514                 ireq->i_val = ic->ic_ratectl.rc_st_ratectl;
1515                 break;
1516         default:
1517                 error = EINVAL;
1518                 break;
1519         }
1520         return error;
1521 }
1522
1523 static int
1524 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
1525 {
1526         int error;
1527         void *ie, *oie;
1528
1529         /*
1530          * NB: Doing this for ap operation could be useful (e.g. for
1531          *     WPA and/or WME) except that it typically is worthless
1532          *     without being able to intervene when processing
1533          *     association response frames--so disallow it for now.
1534          */
1535         if (ic->ic_opmode != IEEE80211_M_STA)
1536                 return EINVAL;
1537         if (ireq->i_len > IEEE80211_MAX_OPT_IE)
1538                 return EINVAL;
1539         if (ireq->i_len > 0) {
1540                 ie = kmalloc(ireq->i_len, M_DEVBUF, M_NOWAIT);
1541                 if (ie == NULL)
1542                         return ENOMEM;
1543                 error = copyin(ireq->i_data, ie, ireq->i_len);
1544                 if (error) {
1545                         kfree(ie, M_DEVBUF);
1546                         return error;
1547                 }
1548         } else {
1549                 ie = NULL;
1550                 ireq->i_len = 0;
1551         }
1552         /* XXX sanity check data? */
1553         oie = ic->ic_opt_ie;
1554         ic->ic_opt_ie = ie;
1555         ic->ic_opt_ie_len = ireq->i_len;
1556         if (oie != NULL)
1557                 kfree(oie, M_DEVBUF);
1558         return 0;
1559 }
1560
1561 static int
1562 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1563 {
1564         struct ieee80211req_key ik;
1565         struct ieee80211_node *ni;
1566         struct ieee80211_key *wk;
1567         uint16_t kid;
1568         int error;
1569
1570         if (ireq->i_len != sizeof(ik))
1571                 return EINVAL;
1572         error = copyin(ireq->i_data, &ik, sizeof(ik));
1573         if (error)
1574                 return error;
1575         /* NB: cipher support is verified by ieee80211_crypt_newkey */
1576         /* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1577         if (ik.ik_keylen > sizeof(ik.ik_keydata))
1578                 return E2BIG;
1579         kid = ik.ik_keyix;
1580         if (kid == IEEE80211_KEYIX_NONE) {
1581                 /* XXX unicast keys currently must be tx/rx */
1582                 if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1583                         return EINVAL;
1584                 if (ic->ic_opmode == IEEE80211_M_STA) {
1585                         ni = ieee80211_ref_node(ic->ic_bss);
1586                         if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
1587                                 ieee80211_free_node(ni);
1588                                 return EADDRNOTAVAIL;
1589                         }
1590                 } else {
1591                         ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
1592                         if (ni == NULL)
1593                                 return ENOENT;
1594                 }
1595                 wk = &ni->ni_ucastkey;
1596         } else {
1597                 if (kid >= IEEE80211_WEP_NKID)
1598                         return EINVAL;
1599                 wk = &ic->ic_nw_keys[kid];
1600                 /*
1601                  * Global slots start off w/o any assigned key index.
1602                  * Force one here for consistency with IEEE80211_IOC_WEPKEY.
1603                  */
1604                 if (wk->wk_keyix == IEEE80211_KEYIX_NONE)
1605                         wk->wk_keyix = kid;
1606                 ni = NULL;
1607         }
1608         error = 0;
1609         ieee80211_key_update_begin(ic);
1610         if (ieee80211_crypto_newkey(ic, ik.ik_type, ik.ik_flags, wk)) {
1611                 wk->wk_keylen = ik.ik_keylen;
1612                 /* NB: MIC presence is implied by cipher type */
1613                 if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1614                         wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1615                 wk->wk_keyrsc = ik.ik_keyrsc;
1616                 wk->wk_keytsc = 0;                      /* new key, reset */
1617                 memset(wk->wk_key, 0, sizeof(wk->wk_key));
1618                 memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1619                 if (!ieee80211_crypto_setkey(ic, wk,
1620                     ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
1621                         error = EIO;
1622                 else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1623                         ic->ic_def_txkey = kid;
1624         } else
1625                 error = ENXIO;
1626         ieee80211_key_update_end(ic);
1627         if (ni != NULL)
1628                 ieee80211_free_node(ni);
1629         return error;
1630 }
1631
1632 static int
1633 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1634 {
1635         struct ieee80211req_del_key dk;
1636         int kid, error;
1637
1638         if (ireq->i_len != sizeof(dk))
1639                 return EINVAL;
1640         error = copyin(ireq->i_data, &dk, sizeof(dk));
1641         if (error)
1642                 return error;
1643         kid = dk.idk_keyix;
1644         /* XXX uint8_t -> uint16_t */
1645         if (dk.idk_keyix == (uint8_t)IEEE80211_KEYIX_NONE) {
1646                 struct ieee80211_node *ni;
1647
1648                 if (ic->ic_opmode == IEEE80211_M_STA) {
1649                         ni = ieee80211_ref_node(ic->ic_bss);
1650                         if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
1651                                 ieee80211_free_node(ni);
1652                                 return EADDRNOTAVAIL;
1653                         }
1654                 } else {
1655                         ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
1656                         if (ni == NULL)
1657                                 return ENOENT;
1658                 }
1659                 /* XXX error return */
1660                 ieee80211_node_delucastkey(ni);
1661                 ieee80211_free_node(ni);
1662         } else {
1663                 if (kid >= IEEE80211_WEP_NKID)
1664                         return EINVAL;
1665                 /* XXX error return */
1666                 ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
1667         }
1668         return 0;
1669 }
1670
1671 static void
1672 domlme(void *arg, struct ieee80211_node *ni)
1673 {
1674         struct ieee80211com *ic = ni->ni_ic;
1675         struct ieee80211req_mlme *mlme = arg;
1676
1677         if (ni->ni_associd != 0) {
1678                 IEEE80211_SEND_MGMT(ic, ni,
1679                         mlme->im_op == IEEE80211_MLME_DEAUTH ?
1680                                 IEEE80211_FC0_SUBTYPE_DEAUTH :
1681                                 IEEE80211_FC0_SUBTYPE_DISASSOC,
1682                         mlme->im_reason);
1683         }
1684         ieee80211_node_leave(ic, ni);
1685 }
1686
1687 static int
1688 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
1689 {
1690         struct ieee80211req_mlme mlme;
1691         struct ieee80211_node *ni;
1692         int error;
1693
1694         if (ireq->i_len != sizeof(mlme))
1695                 return EINVAL;
1696         error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1697         if (error)
1698                 return error;
1699         switch (mlme.im_op) {
1700         case IEEE80211_MLME_ASSOC:
1701                 if (ic->ic_opmode != IEEE80211_M_STA)
1702                         return EINVAL;
1703                 /* XXX must be in S_SCAN state? */
1704
1705                 if (mlme.im_ssid_len != 0) {
1706                         /*
1707                          * Desired ssid specified; must match both bssid and
1708                          * ssid to distinguish ap advertising multiple ssid's.
1709                          */
1710                         ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
1711                                 mlme.im_macaddr,
1712                                 mlme.im_ssid_len, mlme.im_ssid);
1713                 } else {
1714                         /*
1715                          * Normal case; just match bssid.
1716                          */
1717                         ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
1718                 }
1719                 if (ni == NULL)
1720                         return EINVAL;
1721                 if (!ieee80211_sta_join(ic, ni)) {
1722                         ieee80211_free_node(ni);
1723                         return EINVAL;
1724                 }
1725                 break;
1726         case IEEE80211_MLME_DISASSOC:
1727         case IEEE80211_MLME_DEAUTH:
1728                 switch (ic->ic_opmode) {
1729                 case IEEE80211_M_STA:
1730                         /* XXX not quite right */
1731                         ieee80211_new_state(ic, IEEE80211_S_INIT,
1732                                 mlme.im_reason);
1733                         break;
1734                 case IEEE80211_M_HOSTAP:
1735                         /* NB: the broadcast address means do 'em all */
1736                         if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
1737                                 if ((ni = ieee80211_find_node(&ic->ic_sta,
1738                                                 mlme.im_macaddr)) == NULL)
1739                                         return EINVAL;
1740                                 domlme(&mlme, ni);
1741                                 ieee80211_free_node(ni);
1742                         } else {
1743                                 ieee80211_iterate_nodes(&ic->ic_sta,
1744                                                 domlme, &mlme);
1745                         }
1746                         break;
1747                 default:
1748                         return EINVAL;
1749                 }
1750                 break;
1751         case IEEE80211_MLME_AUTHORIZE:
1752         case IEEE80211_MLME_UNAUTHORIZE:
1753                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1754                         return EINVAL;
1755                 ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
1756                 if (ni == NULL)
1757                         return EINVAL;
1758                 if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
1759                         ieee80211_node_authorize(ni);
1760                 else
1761                         ieee80211_node_unauthorize(ni);
1762                 ieee80211_free_node(ni);
1763                 break;
1764         default:
1765                 return EINVAL;
1766         }
1767         return 0;
1768 }
1769
1770 static int
1771 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
1772 {
1773         uint8_t mac[IEEE80211_ADDR_LEN];
1774         const struct ieee80211_aclator *acl = ic->ic_acl;
1775         int error;
1776
1777         if (ireq->i_len != sizeof(mac))
1778                 return EINVAL;
1779         error = copyin(ireq->i_data, mac, ireq->i_len);
1780         if (error)
1781                 return error;
1782         if (acl == NULL) {
1783                 acl = ieee80211_aclator_get("mac");
1784                 if (acl == NULL || !acl->iac_attach(ic))
1785                         return EINVAL;
1786                 ic->ic_acl = acl;
1787         }
1788         if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1789                 acl->iac_add(ic, mac);
1790         else
1791                 acl->iac_remove(ic, mac);
1792         return 0;
1793 }
1794
1795 static int
1796 ieee80211_ioctl_setmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1797 {
1798         const struct ieee80211_aclator *acl = ic->ic_acl;
1799
1800         switch (ireq->i_val) {
1801         case IEEE80211_MACCMD_POLICY_OPEN:
1802         case IEEE80211_MACCMD_POLICY_ALLOW:
1803         case IEEE80211_MACCMD_POLICY_DENY:
1804                 if (acl == NULL) {
1805                         acl = ieee80211_aclator_get("mac");
1806                         if (acl == NULL || !acl->iac_attach(ic))
1807                                 return EINVAL;
1808                         ic->ic_acl = acl;
1809                 }
1810                 acl->iac_setpolicy(ic, ireq->i_val);
1811                 break;
1812         case IEEE80211_MACCMD_FLUSH:
1813                 if (acl != NULL)
1814                         acl->iac_flush(ic);
1815                 /* NB: silently ignore when not in use */
1816                 break;
1817         case IEEE80211_MACCMD_DETACH:
1818                 if (acl != NULL) {
1819                         ic->ic_acl = NULL;
1820                         acl->iac_detach(ic);
1821                 }
1822                 break;
1823         default:
1824                 if (acl == NULL)
1825                         return EINVAL;
1826                 else
1827                         return acl->iac_setioctl(ic, ireq);
1828         }
1829         return 0;
1830 }
1831
1832 static int
1833 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
1834 {
1835         struct ieee80211req_chanlist list;
1836         u_char chanlist[IEEE80211_CHAN_BYTES];
1837         int i, j, error;
1838
1839         if (ireq->i_len != sizeof(list))
1840                 return EINVAL;
1841         error = copyin(ireq->i_data, &list, sizeof(list));
1842         if (error)
1843                 return error;
1844         memset(chanlist, 0, sizeof(chanlist));
1845         /*
1846          * Since channel 0 is not available for DS, channel 1
1847          * is assigned to LSB on WaveLAN.
1848          */
1849         if (ic->ic_phytype == IEEE80211_T_DS)
1850                 i = 1;
1851         else
1852                 i = 0;
1853         for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
1854                 /*
1855                  * NB: silently discard unavailable channels so users
1856                  *     can specify 1-255 to get all available channels.
1857                  */
1858                 if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
1859                         setbit(chanlist, i);
1860         }
1861         if (ic->ic_ibss_chan == NULL ||
1862             isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1863                 for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1864                         if (isset(chanlist, i)) {
1865                                 ic->ic_ibss_chan = &ic->ic_channels[i];
1866                                 goto found;
1867                         }
1868                 return EINVAL;                  /* no active channels */
1869 found:
1870                 ;
1871         }
1872         memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
1873         return IS_UP_AUTO(ic) ? ENETRESET : 0;
1874 }
1875
1876 static int
1877 ieee80211_ioctl_setstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
1878 {
1879         struct ieee80211_node *ni;
1880         uint8_t macaddr[IEEE80211_ADDR_LEN];
1881         int error;
1882
1883         /*
1884          * NB: we could copyin ieee80211req_sta_stats so apps
1885          *     could make selective changes but that's overkill;
1886          *     just clear all stats for now.
1887          */
1888         if (ireq->i_len < IEEE80211_ADDR_LEN)
1889                 return EINVAL;
1890         error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
1891         if (error != 0)
1892                 return error;
1893         ni = ieee80211_find_node(&ic->ic_sta, macaddr);
1894         if (ni == NULL)
1895                 return EINVAL;  /* XXX */
1896         memset(&ni->ni_stats, 0, sizeof(ni->ni_stats));
1897         ieee80211_free_node(ni);
1898         return 0;
1899 }
1900
1901 static int
1902 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1903 {
1904         struct ieee80211_node *ni;
1905         struct ieee80211req_sta_txpow txpow;
1906         int error;
1907
1908         if (ireq->i_len != sizeof(txpow))
1909                 return EINVAL;
1910         error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1911         if (error != 0)
1912                 return error;
1913         ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1914         if (ni == NULL)
1915                 return EINVAL;          /* XXX */
1916         ni->ni_txpower = txpow.it_txpow;
1917         ieee80211_free_node(ni);
1918         return error;
1919 }
1920
1921 static int
1922 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1923 {
1924         struct ieee80211_wme_state *wme = &ic->ic_wme;
1925         struct wmeParams *wmep, *chanp;
1926         int isbss, ac;
1927
1928         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1929                 return EINVAL;
1930
1931         isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1932         ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1933         if (ac >= WME_NUM_AC)
1934                 ac = WME_AC_BE;
1935         if (isbss) {
1936                 chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1937                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1938         } else {
1939                 chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1940                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1941         }
1942         switch (ireq->i_type) {
1943         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
1944                 if (isbss) {
1945                         wmep->wmep_logcwmin = ireq->i_val;
1946                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1947                                 chanp->wmep_logcwmin = ireq->i_val;
1948                 } else {
1949                         wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1950                                 ireq->i_val;
1951                 }
1952                 break;
1953         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
1954                 if (isbss) {
1955                         wmep->wmep_logcwmax = ireq->i_val;
1956                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1957                                 chanp->wmep_logcwmax = ireq->i_val;
1958                 } else {
1959                         wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1960                                 ireq->i_val;
1961                 }
1962                 break;
1963         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
1964                 if (isbss) {
1965                         wmep->wmep_aifsn = ireq->i_val;
1966                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1967                                 chanp->wmep_aifsn = ireq->i_val;
1968                 } else {
1969                         wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
1970                 }
1971                 break;
1972         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
1973                 if (isbss) {
1974                         wmep->wmep_txopLimit = ireq->i_val;
1975                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1976                                 chanp->wmep_txopLimit = ireq->i_val;
1977                 } else {
1978                         wmep->wmep_txopLimit = chanp->wmep_txopLimit =
1979                                 ireq->i_val;
1980                 }
1981                 break;
1982         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
1983                 wmep->wmep_acm = ireq->i_val;
1984                 if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1985                         chanp->wmep_acm = ireq->i_val;
1986                 break;
1987         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (!bss only)*/
1988                 wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1989                         (ireq->i_val) == 0;
1990                 break;
1991         }
1992         ieee80211_wme_updateparams(ic);
1993         return 0;
1994 }
1995
1996 static int
1997 cipher2cap(int cipher)
1998 {
1999         switch (cipher) {
2000         case IEEE80211_CIPHER_WEP:      return IEEE80211_C_WEP;
2001         case IEEE80211_CIPHER_AES_OCB:  return IEEE80211_C_AES;
2002         case IEEE80211_CIPHER_AES_CCM:  return IEEE80211_C_AES_CCM;
2003         case IEEE80211_CIPHER_CKIP:     return IEEE80211_C_CKIP;
2004         case IEEE80211_CIPHER_TKIP:     return IEEE80211_C_TKIP;
2005         }
2006         return 0;
2007 }
2008
2009 static int
2010 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
2011 {
2012         static const uint8_t zerobssid[IEEE80211_ADDR_LEN];
2013         struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
2014         int error;
2015         const struct ieee80211_authenticator *auth;
2016         uint8_t tmpkey[IEEE80211_KEYBUF_SIZE];
2017         char tmpssid[IEEE80211_NWID_LEN];
2018         uint8_t tmpbssid[IEEE80211_ADDR_LEN];
2019         struct ieee80211_key *k;
2020         int j, caps;
2021         u_int kid;
2022
2023         error = 0;
2024         switch (ireq->i_type) {
2025         case IEEE80211_IOC_SSID:
2026                 if (ireq->i_val != 0 ||
2027                     ireq->i_len > IEEE80211_NWID_LEN)
2028                         return EINVAL;
2029                 error = copyin(ireq->i_data, tmpssid, ireq->i_len);
2030                 if (error)
2031                         break;
2032                 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
2033                 ic->ic_des_esslen = ireq->i_len;
2034                 memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
2035                 error = ENETRESET;
2036                 break;
2037         case IEEE80211_IOC_WEP:
2038                 switch (ireq->i_val) {
2039                 case IEEE80211_WEP_OFF:
2040                         ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2041                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2042                         break;
2043                 case IEEE80211_WEP_ON:
2044                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2045                         ic->ic_flags |= IEEE80211_F_DROPUNENC;
2046                         break;
2047                 case IEEE80211_WEP_MIXED:
2048                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2049                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2050                         break;
2051                 }
2052                 error = ENETRESET;
2053                 break;
2054         case IEEE80211_IOC_WEPKEY:
2055                 kid = (u_int)ireq->i_val;
2056                 if (kid >= IEEE80211_WEP_NKID)
2057                         return EINVAL;
2058                 k = &ic->ic_nw_keys[kid];
2059                 if (ireq->i_len == 0) {
2060                         /* zero-len =>'s delete any existing key */
2061                         ieee80211_crypto_delkey(ic, k);
2062                         break;
2063                 }
2064                 if (ireq->i_len > sizeof(tmpkey))
2065                         return EINVAL;
2066                 memset(tmpkey, 0, sizeof(tmpkey));
2067                 error = copyin(ireq->i_data, tmpkey, ireq->i_len);
2068                 if (error)
2069                         break;
2070                 ieee80211_key_update_begin(ic);
2071                 k->wk_keyix = kid;      /* NB: force fixed key id */
2072                 if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
2073                     IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2074                         k->wk_keylen = ireq->i_len;
2075                         memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
2076                         if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
2077                                 error = EINVAL;
2078                 } else
2079                         error = EINVAL;
2080                 ieee80211_key_update_end(ic);
2081                 if (!error)                     /* NB: for compatibility */
2082                         error = ENETRESET;
2083                 break;
2084         case IEEE80211_IOC_WEPTXKEY:
2085                 kid = (u_int) ireq->i_val;
2086                 if (kid >= IEEE80211_WEP_NKID &&
2087                     (uint16_t) kid != IEEE80211_KEYIX_NONE)
2088                         return EINVAL;
2089                 ic->ic_def_txkey = kid;
2090                 error = ENETRESET;      /* push to hardware */
2091                 break;
2092         case IEEE80211_IOC_AUTHMODE:
2093                 switch (ireq->i_val) {
2094                 case IEEE80211_AUTH_WPA:
2095                 case IEEE80211_AUTH_8021X:      /* 802.1x */
2096                 case IEEE80211_AUTH_OPEN:       /* open */
2097                 case IEEE80211_AUTH_SHARED:     /* shared-key */
2098                 case IEEE80211_AUTH_AUTO:       /* auto */
2099                         auth = ieee80211_authenticator_get(ireq->i_val);
2100                         if (auth == NULL)
2101                                 return EINVAL;
2102                         break;
2103                 default:
2104                         return EINVAL;
2105                 }
2106                 switch (ireq->i_val) {
2107                 case IEEE80211_AUTH_WPA:        /* WPA w/ 802.1x */
2108                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2109                         ireq->i_val = IEEE80211_AUTH_8021X;
2110                         break;
2111                 case IEEE80211_AUTH_OPEN:       /* open */
2112                         ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2113                         break;
2114                 case IEEE80211_AUTH_SHARED:     /* shared-key */
2115                 case IEEE80211_AUTH_8021X:      /* 802.1x */
2116                         ic->ic_flags &= ~IEEE80211_F_WPA;
2117                         /* both require a key so mark the PRIVACY capability */
2118                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2119                         break;
2120                 case IEEE80211_AUTH_AUTO:       /* auto */
2121                         ic->ic_flags &= ~IEEE80211_F_WPA;
2122                         /* XXX PRIVACY handling? */
2123                         /* XXX what's the right way to do this? */
2124                         break;
2125                 }
2126                 /* NB: authenticator attach/detach happens on state change */
2127                 ic->ic_bss->ni_authmode = ireq->i_val;
2128                 /* XXX mixed/mode/usage? */
2129                 ic->ic_auth = auth;
2130                 error = ENETRESET;
2131                 break;
2132         case IEEE80211_IOC_CHANNEL:
2133                 /* XXX 0xffff overflows 16-bit signed */
2134                 if (ireq->i_val == 0 ||
2135                     ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
2136                         ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2137                 else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
2138                     isclr(ic->ic_chan_active, ireq->i_val)) {
2139                         return EINVAL;
2140                 } else
2141                         ic->ic_ibss_chan = ic->ic_des_chan =
2142                                 &ic->ic_channels[ireq->i_val];
2143                 switch (ic->ic_state) {
2144                 case IEEE80211_S_INIT:
2145                 case IEEE80211_S_SCAN:
2146                         error = ENETRESET;
2147                         break;
2148                 default:
2149                         /*
2150                          * If the desired channel has changed (to something
2151                          * other than any) and we're not already scanning,
2152                          * then kick the state machine.
2153                          */
2154                         if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2155                             ic->ic_bss->ni_chan != ic->ic_des_chan &&
2156                             (ic->ic_flags & IEEE80211_F_SCAN) == 0)
2157                                 error = ENETRESET;
2158                         break;
2159                 }
2160                 if (error == ENETRESET &&
2161                         ic->ic_opmode == IEEE80211_M_MONITOR) {
2162                         if (IS_UP(ic)) {
2163                                 /*
2164                                  * Monitor mode can switch directly.
2165                                  */
2166                                 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
2167                                         ic->ic_curchan = ic->ic_des_chan;
2168                                 error = ic->ic_reset(ic->ic_ifp);
2169                         } else
2170                                 error = 0;
2171                 }
2172                 break;
2173         case IEEE80211_IOC_POWERSAVE:
2174                 switch (ireq->i_val) {
2175                 case IEEE80211_POWERSAVE_OFF:
2176                         if (ic->ic_flags & IEEE80211_F_PMGTON) {
2177                                 ic->ic_flags &= ~IEEE80211_F_PMGTON;
2178                                 error = ENETRESET;
2179                         }
2180                         break;
2181                 case IEEE80211_POWERSAVE_ON:
2182                         if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2183                                 error = EINVAL;
2184                         else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2185                                 ic->ic_flags |= IEEE80211_F_PMGTON;
2186                                 error = ENETRESET;
2187                         }
2188                         break;
2189                 default:
2190                         error = EINVAL;
2191                         break;
2192                 }
2193                 break;
2194         case IEEE80211_IOC_POWERSAVESLEEP:
2195                 if (ireq->i_val < 0)
2196                         return EINVAL;
2197                 ic->ic_lintval = ireq->i_val;
2198                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2199                 break;
2200         case IEEE80211_IOC_RTSTHRESHOLD:
2201                 if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
2202                       ireq->i_val <= IEEE80211_RTS_MAX))
2203                         return EINVAL;
2204                 ic->ic_rtsthreshold = ireq->i_val;
2205                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2206                 break;
2207         case IEEE80211_IOC_PROTMODE:
2208                 if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2209                         return EINVAL;
2210                 ic->ic_protmode = ireq->i_val;
2211                 /* NB: if not operating in 11g this can wait */
2212                 if (ic->ic_curmode == IEEE80211_MODE_11G)
2213                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2214                 break;
2215         case IEEE80211_IOC_TXPOWER:
2216                 if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2217                         return EINVAL;
2218                 if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
2219                       ireq->i_val < IEEE80211_TXPOWER_MAX))
2220                         return EINVAL;
2221                 ic->ic_txpowlimit = ireq->i_val;
2222                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2223                 break;
2224         case IEEE80211_IOC_ROAMING:
2225                 if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2226                     ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2227                         return EINVAL;
2228                 ic->ic_roaming = ireq->i_val;
2229                 /* XXXX reset? */
2230                 break;
2231         case IEEE80211_IOC_PRIVACY:
2232                 if (ireq->i_val) {
2233                         /* XXX check for key state? */
2234                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2235                 } else
2236                         ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2237                 break;
2238         case IEEE80211_IOC_DROPUNENCRYPTED:
2239                 if (ireq->i_val)
2240                         ic->ic_flags |= IEEE80211_F_DROPUNENC;
2241                 else
2242                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2243                 break;
2244         case IEEE80211_IOC_WPAKEY:
2245                 error = ieee80211_ioctl_setkey(ic, ireq);
2246                 break;
2247         case IEEE80211_IOC_DELKEY:
2248                 error = ieee80211_ioctl_delkey(ic, ireq);
2249                 break;
2250         case IEEE80211_IOC_MLME:
2251                 error = ieee80211_ioctl_setmlme(ic, ireq);
2252                 break;
2253         case IEEE80211_IOC_OPTIE:
2254                 error = ieee80211_ioctl_setoptie(ic, ireq);
2255                 break;
2256         case IEEE80211_IOC_COUNTERMEASURES:
2257                 if (ireq->i_val) {
2258                         if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
2259                                 return EINVAL;
2260                         ic->ic_flags |= IEEE80211_F_COUNTERM;
2261                 } else
2262                         ic->ic_flags &= ~IEEE80211_F_COUNTERM;
2263                 break;
2264         case IEEE80211_IOC_WPA:
2265                 if (ireq->i_val > 3)
2266                         return EINVAL;
2267                 /* XXX verify ciphers available */
2268                 ic->ic_flags &= ~IEEE80211_F_WPA;
2269                 switch (ireq->i_val) {
2270                 case 1:
2271                         ic->ic_flags |= IEEE80211_F_WPA1;
2272                         break;
2273                 case 2:
2274                         ic->ic_flags |= IEEE80211_F_WPA2;
2275                         break;
2276                 case 3:
2277                         ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2278                         break;
2279                 }
2280                 error = ENETRESET;              /* XXX? */
2281                 break;
2282         case IEEE80211_IOC_WME:
2283                 if (ireq->i_val) {
2284                         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
2285                                 return EINVAL;
2286                         ic->ic_flags |= IEEE80211_F_WME;
2287                 } else
2288                         ic->ic_flags &= ~IEEE80211_F_WME;
2289                 error = ENETRESET;              /* XXX maybe not for station? */
2290                 break;
2291         case IEEE80211_IOC_HIDESSID:
2292                 if (ireq->i_val)
2293                         ic->ic_flags |= IEEE80211_F_HIDESSID;
2294                 else
2295                         ic->ic_flags &= ~IEEE80211_F_HIDESSID;
2296                 error = ENETRESET;
2297                 break;
2298         case IEEE80211_IOC_APBRIDGE:
2299                 if (ireq->i_val == 0)
2300                         ic->ic_flags |= IEEE80211_F_NOBRIDGE;
2301                 else
2302                         ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
2303                 break;
2304         case IEEE80211_IOC_MCASTCIPHER:
2305                 if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
2306                     !ieee80211_crypto_available(ireq->i_val))
2307                         return EINVAL;
2308                 rsn->rsn_mcastcipher = ireq->i_val;
2309                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2310                 break;
2311         case IEEE80211_IOC_MCASTKEYLEN:
2312                 if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2313                         return EINVAL;
2314                 /* XXX no way to verify driver capability */
2315                 rsn->rsn_mcastkeylen = ireq->i_val;
2316                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2317                 break;
2318         case IEEE80211_IOC_UCASTCIPHERS:
2319                 /*
2320                  * Convert user-specified cipher set to the set
2321                  * we can support (via hardware or software).
2322                  * NB: this logic intentionally ignores unknown and
2323                  * unsupported ciphers so folks can specify 0xff or
2324                  * similar and get all available ciphers.
2325                  */
2326                 caps = 0;
2327                 for (j = 1; j < 32; j++)        /* NB: skip WEP */
2328                         if ((ireq->i_val & (1<<j)) &&
2329                             ((ic->ic_caps & cipher2cap(j)) ||
2330                              ieee80211_crypto_available(j)))
2331                                 caps |= 1<<j;
2332                 if (caps == 0)                  /* nothing available */
2333                         return EINVAL;
2334                 /* XXX verify ciphers ok for unicast use? */
2335                 /* XXX disallow if running as it'll have no effect */
2336                 rsn->rsn_ucastcipherset = caps;
2337                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2338                 break;
2339         case IEEE80211_IOC_UCASTCIPHER:
2340                 if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
2341                         return EINVAL;
2342                 rsn->rsn_ucastcipher = ireq->i_val;
2343                 break;
2344         case IEEE80211_IOC_UCASTKEYLEN:
2345                 if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2346                         return EINVAL;
2347                 /* XXX no way to verify driver capability */
2348                 rsn->rsn_ucastkeylen = ireq->i_val;
2349                 break;
2350         case IEEE80211_IOC_DRIVER_CAPS:
2351                 /* NB: for testing */
2352                 ic->ic_caps = (((uint16_t)ireq->i_val) << 16) |
2353                                ((uint16_t)ireq->i_len);
2354                 break;
2355         case IEEE80211_IOC_KEYMGTALGS:
2356                 /* XXX check */
2357                 rsn->rsn_keymgmtset = ireq->i_val;
2358                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2359                 break;
2360         case IEEE80211_IOC_RSNCAPS:
2361                 /* XXX check */
2362                 rsn->rsn_caps = ireq->i_val;
2363                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2364                 break;
2365         case IEEE80211_IOC_BSSID:
2366                 if (ireq->i_len != sizeof(tmpbssid))
2367                         return EINVAL;
2368                 error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2369                 if (error)
2370                         break;
2371                 IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
2372                 if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2373                         ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2374                 else
2375                         ic->ic_flags |= IEEE80211_F_DESBSSID;
2376                 error = ENETRESET;
2377                 break;
2378         case IEEE80211_IOC_CHANLIST:
2379                 error = ieee80211_ioctl_setchanlist(ic, ireq);
2380                 break;
2381         case IEEE80211_IOC_SCAN_REQ:
2382                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)        /* XXX ignore */
2383                         break;
2384                 error = ieee80211_setupscan(ic, ic->ic_chan_avail);
2385                 if (error == 0)         /* XXX background scan */
2386                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2387                 break;
2388         case IEEE80211_IOC_ADDMAC:
2389         case IEEE80211_IOC_DELMAC:
2390                 error = ieee80211_ioctl_macmac(ic, ireq);
2391                 break;
2392         case IEEE80211_IOC_MACCMD:
2393                 error = ieee80211_ioctl_setmaccmd(ic, ireq);
2394                 break;
2395         case IEEE80211_IOC_STA_STATS:
2396                 error = ieee80211_ioctl_setstastats(ic, ireq);
2397                 break;
2398         case IEEE80211_IOC_STA_TXPOW:
2399                 error = ieee80211_ioctl_setstatxpow(ic, ireq);
2400                 break;
2401         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
2402         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
2403         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
2404         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
2405         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
2406         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (bss only) */
2407                 error = ieee80211_ioctl_setwmeparam(ic, ireq);
2408                 break;
2409         case IEEE80211_IOC_DTIM_PERIOD:
2410                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2411                     ic->ic_opmode != IEEE80211_M_IBSS)
2412                         return EINVAL;
2413                 if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2414                     ireq->i_val <= IEEE80211_DTIM_MAX) {
2415                         ic->ic_dtim_period = ireq->i_val;
2416                         error = ENETRESET;              /* requires restart */
2417                 } else
2418                         error = EINVAL;
2419                 break;
2420         case IEEE80211_IOC_BEACON_INTERVAL:
2421                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2422                     ic->ic_opmode != IEEE80211_M_IBSS)
2423                         return EINVAL;
2424                 if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2425                     ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2426                         ic->ic_bintval = ireq->i_val;
2427                         error = ENETRESET;              /* requires restart */
2428                 } else
2429                         error = EINVAL;
2430                 break;
2431         case IEEE80211_IOC_PUREG:
2432                 if (ireq->i_val)
2433                         ic->ic_flags |= IEEE80211_F_PUREG;
2434                 else
2435                         ic->ic_flags &= ~IEEE80211_F_PUREG;
2436                 /* NB: reset only if we're operating on an 11g channel */
2437                 if (ic->ic_curmode == IEEE80211_MODE_11G)
2438                         error = ENETRESET;
2439                 break;
2440         case IEEE80211_IOC_MCAST_RATE:
2441                 ic->ic_mcast_rate = ireq->i_val & IEEE80211_RATE_VAL;
2442                 break;
2443         case IEEE80211_IOC_FRAGTHRESHOLD:
2444                 if ((ic->ic_caps & IEEE80211_C_TXFRAG) == 0 &&
2445                     ireq->i_val != IEEE80211_FRAG_MAX)
2446                         return EINVAL;
2447                 if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
2448                       ireq->i_val <= IEEE80211_FRAG_MAX))
2449                         return EINVAL;
2450                 ic->ic_fragthreshold = ireq->i_val;
2451                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2452                 break;
2453         case IEEE80211_IOC_BURST:
2454                 if (ireq->i_val) {
2455                         if ((ic->ic_caps & IEEE80211_C_BURST) == 0)
2456                                 return EINVAL;
2457                         ic->ic_flags |= IEEE80211_F_BURST;
2458                 } else
2459                         ic->ic_flags &= ~IEEE80211_F_BURST;
2460                 error = ENETRESET;              /* XXX maybe not for station? */
2461                 break;
2462         case IEEE80211_IOC_RATECTL:
2463                 if (ireq->i_val < 0 || ireq->i_val >= IEEE80211_RATECTL_MAX ||
2464                     ireq->i_val == IEEE80211_RATECTL_NONE) {
2465                         error = EINVAL;
2466                         break;
2467                 }
2468
2469                 error = ieee80211_ratectl_change(ic, ireq->i_val);
2470                 break;
2471         default:
2472                 error = EINVAL;
2473                 break;
2474         }
2475         if (error == ENETRESET && !IS_UP_AUTO(ic))
2476                 error = 0;
2477         return error;
2478 }
2479
2480 int
2481 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, caddr_t data,
2482                 struct ucred *cr)
2483 {
2484         struct ifnet *ifp = ic->ic_ifp;
2485         int error = 0;
2486         struct ifreq *ifr;
2487         struct ifaddr *ifa;                     /* XXX */
2488
2489         switch (cmd) {
2490         case SIOCSIFMEDIA:
2491         case SIOCGIFMEDIA:
2492                 error = ifmedia_ioctl(ifp, (struct ifreq *) data,
2493                                 &ic->ic_media, cmd);
2494                 break;
2495         case SIOCG80211:
2496                 error = ieee80211_ioctl_get80211(ic, cmd,
2497                                 (struct ieee80211req *) data, cr);
2498                 break;
2499         case SIOCS80211:
2500                 error = suser_cred(cr, NULL_CRED_OKAY);
2501                 if (error == 0)
2502                         error = ieee80211_ioctl_set80211(ic, cmd,
2503                                         (struct ieee80211req *) data);
2504                 break;
2505         case SIOCGIFGENERIC:
2506                 error = ieee80211_cfgget(ic, cmd, data, cr);
2507                 break;
2508         case SIOCSIFGENERIC:
2509                 error = suser_cred(cr, NULL_CRED_OKAY);
2510                 if (error)
2511                         break;
2512                 error = ieee80211_cfgset(ic, cmd, data);
2513                 break;
2514         case SIOCG80211STATS:
2515                 ifr = (struct ifreq *)data;
2516                 copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
2517                 break;
2518         case SIOCSIFMTU:
2519                 ifr = (struct ifreq *)data;
2520                 if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2521                     ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2522                         error = EINVAL;
2523                 else
2524                         ifp->if_mtu = ifr->ifr_mtu;
2525                 break;
2526         case SIOCSIFADDR:
2527                 /*
2528                  * XXX Handle this directly so we can supress if_init calls.
2529                  * XXX This should be done in ether_ioctl but for the moment
2530                  * XXX there are too many other parts of the system that
2531                  * XXX set IFF_UP and so supress if_init being called when
2532                  * XXX it should be.
2533                  */
2534                 ifa = (struct ifaddr *) data;
2535                 switch (ifa->ifa_addr->sa_family) {
2536 #ifdef INET
2537                 case AF_INET:
2538                         if ((ifp->if_flags & IFF_UP) == 0) {
2539                                 ifp->if_flags |= IFF_UP;
2540                                 ifp->if_init(ifp->if_softc);
2541                         }
2542                         arp_ifinit(ifp, ifa);
2543                         break;
2544 #endif
2545 #ifdef IPX
2546                 /*
2547                  * XXX - This code is probably wrong,
2548                  *       but has been copied many times.
2549                  */
2550                 case AF_IPX: {
2551                         struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
2552
2553                         if (ipx_nullhost(*ina)) {
2554                                 ina->x_host = *(union ipx_host *)
2555                                     IF_LLADDR(ifp);
2556                         } else {
2557                                 bcopy(ina->x_host.c_host, IF_LLADDR(ifp),
2558                                       ETHER_ADDR_LEN);
2559                         }
2560                         /* fall thru... */
2561                 }
2562 #endif
2563                 default:
2564                         if ((ifp->if_flags & IFF_UP) == 0) {
2565                                 ifp->if_flags |= IFF_UP;
2566                                 ifp->if_init(ifp->if_softc);
2567                         }
2568                         break;
2569                 }
2570                 break;
2571         default:
2572                 error = ether_ioctl(ifp, cmd, data);
2573                 break;
2574         }
2575         return error;
2576 }