sys/net80211/ieee80211_ioctl.c

   1 /*-
   2  * Copyright (c) 2001 Atsushi Onoe
   3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  * 3. The name of the author may not be used to endorse or promote products
  15  *    derived from this software without specific prior written permission.
  16  *
  17  * Alternatively, this software may be distributed under the terms of the
  18  * GNU General Public License ("GPL") version 2 as published by the Free
  19  * Software Foundation.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 /*
  37  * IEEE 802.11 ioctl support (FreeBSD-specific)
  38  */
  39
  40 #include "opt_inet.h"
  41 #include "opt_ipx.h"
  42
  43 #include <sys/endian.h>
  44 #include <sys/param.h>
  45 #include <sys/kernel.h>
  46 #include <sys/socket.h>
  47 #include <sys/sockio.h>
  48 #include <sys/systm.h>
  49
  50 #include <net/if.h>
  51 #include <net/if_arp.h>
  52 #include <net/if_media.h>
  53 #include <net/ethernet.h>
  54
  55 #ifdef INET
  56 #include <netinet/in.h>
  57 #include <netinet/if_ether.h>
  58 #endif
  59
  60 #ifdef IPX
  61 #include <netipx/ipx.h>
  62 #include <netipx/ipx_if.h>
  63 #endif
  64
  65 #include <net80211/ieee80211_var.h>
  66 #include <net80211/ieee80211_ioctl.h>
  67
  68 #include <dev/wi/if_wavelan_ieee.h>
  69
  70 #define IS_UP(_ic) \
  71         (((_ic)->ic_ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP))
  72 #define IS_UP_AUTO(_ic) \
  73         (IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
  74
  75 /*
  76  * XXX
  77  * Wireless LAN specific configuration interface, which is compatible
  78  * with wicontrol(8).
  79  */
  80
  81 struct wi_read_ap_args {
  82         int     i;              /* result count */
  83         struct wi_apinfo *ap;   /* current entry in result buffer */
  84         caddr_t max;            /* result buffer bound */
  85 };
  86
  87 static void
  88 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
  89 {
  90         struct ieee80211com *ic = ni->ni_ic;
  91         struct wi_read_ap_args *sa = arg;
  92         struct wi_apinfo *ap = sa->ap;
  93         struct ieee80211_rateset *rs;
  94         int j;
  95
  96         if ((caddr_t)(ap + 1) > sa->max)
  97                 return;
  98         memset(ap, 0, sizeof(struct wi_apinfo));
  99         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 100                 IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
 101                 ap->namelen = ic->ic_des_esslen;
 102                 if (ic->ic_des_esslen)
 103                         memcpy(ap->name, ic->ic_des_essid,
 104                             ic->ic_des_esslen);
 105         } else {
 106                 IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
 107                 ap->namelen = ni->ni_esslen;
 108                 if (ni->ni_esslen)
 109                         memcpy(ap->name, ni->ni_essid,
 110                             ni->ni_esslen);
 111         }
 112         ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
 113         ap->signal = ic->ic_node_getrssi(ni);
 114         ap->capinfo = ni->ni_capinfo;
 115         ap->interval = ni->ni_intval;
 116         rs = &ni->ni_rates;
 117         for (j = 0; j < rs->rs_nrates; j++) {
 118                 if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
 119                         ap->rate = (rs->rs_rates[j] &
 120                             IEEE80211_RATE_VAL) * 5; /* XXX */
 121                 }
 122         }
 123         sa->i++;
 124         sa->ap++;
 125 }
 126
 127 struct wi_read_prism2_args {
 128         int     i;              /* result count */
 129         struct wi_scan_res *res;/* current entry in result buffer */
 130         caddr_t max;            /* result buffer bound */
 131 };
 132
 133 static void
 134 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
 135 {
 136         struct ieee80211com *ic = ni->ni_ic;
 137         struct wi_read_prism2_args *sa = arg;
 138         struct wi_scan_res *res = sa->res;
 139
 140         if ((caddr_t)(res + 1) > sa->max)
 141                 return;
 142         res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
 143         res->wi_noise = 0;
 144         res->wi_signal = ic->ic_node_getrssi(ni);
 145         IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
 146         res->wi_interval = ni->ni_intval;
 147         res->wi_capinfo = ni->ni_capinfo;
 148         res->wi_ssid_len = ni->ni_esslen;
 149         memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
 150         /* NB: assumes wi_srates holds <= ni->ni_rates */
 151         memcpy(res->wi_srates, ni->ni_rates.rs_rates,
 152                 sizeof(res->wi_srates));
 153         if (ni->ni_rates.rs_nrates < 10)
 154                 res->wi_srates[ni->ni_rates.rs_nrates] = 0;
 155         res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
 156         res->wi_rsvd = 0;
 157
 158         sa->i++;
 159         sa->res++;
 160 }
 161
 162 struct wi_read_sigcache_args {
 163         int     i;              /* result count */
 164         struct wi_sigcache *wsc;/* current entry in result buffer */
 165         caddr_t max;            /* result buffer bound */
 166 };
 167
 168 static void
 169 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
 170 {
 171         struct ieee80211com *ic = ni->ni_ic;
 172         struct wi_read_sigcache_args *sa = arg;
 173         struct wi_sigcache *wsc = sa->wsc;
 174
 175         if ((caddr_t)(wsc + 1) > sa->max)
 176                 return;
 177         memset(wsc, 0, sizeof(struct wi_sigcache));
 178         IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
 179         wsc->signal = ic->ic_node_getrssi(ni);
 180
 181         sa->wsc++;
 182         sa->i++;
 183 }
 184
 185 int
 186 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, caddr_t data)
 187 {
 188         struct ifnet *ifp = ic->ic_ifp;
 189         int i, j, error;
 190         struct ifreq *ifr = (struct ifreq *)data;
 191         struct wi_req wreq;
 192         struct wi_ltv_keys *keys;
 193
 194         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
 195         if (error)
 196                 return error;
 197         wreq.wi_len = 0;
 198         switch (wreq.wi_type) {
 199         case WI_RID_SERIALNO:
 200                 /* nothing appropriate */
 201                 break;
 202         case WI_RID_NODENAME:
 203                 strcpy((char *)&wreq.wi_val[1], hostname);
 204                 wreq.wi_val[0] = htole16(strlen(hostname));
 205                 wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
 206                 break;
 207         case WI_RID_CURRENT_SSID:
 208                 if (ic->ic_state != IEEE80211_S_RUN) {
 209                         wreq.wi_val[0] = 0;
 210                         wreq.wi_len = 1;
 211                         break;
 212                 }
 213                 wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
 214                 memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
 215                     ic->ic_bss->ni_esslen);
 216                 wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
 217                 break;
 218         case WI_RID_OWN_SSID:
 219         case WI_RID_DESIRED_SSID:
 220                 wreq.wi_val[0] = htole16(ic->ic_des_esslen);
 221                 memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
 222                 wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
 223                 break;
 224         case WI_RID_CURRENT_BSSID:
 225                 if (ic->ic_state == IEEE80211_S_RUN)
 226                         IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
 227                 else
 228                         memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
 229                 wreq.wi_len = IEEE80211_ADDR_LEN / 2;
 230                 break;
 231         case WI_RID_CHANNEL_LIST:
 232                 memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
 233                 /*
 234                  * Since channel 0 is not available for DS, channel 1
 235                  * is assigned to LSB on WaveLAN.
 236                  */
 237                 if (ic->ic_phytype == IEEE80211_T_DS)
 238                         i = 1;
 239                 else
 240                         i = 0;
 241                 for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
 242                         if (isset(ic->ic_chan_active, i)) {
 243                                 setbit((u_int8_t *)wreq.wi_val, j);
 244                                 wreq.wi_len = j / 16 + 1;
 245                         }
 246                 break;
 247         case WI_RID_OWN_CHNL:
 248                 wreq.wi_val[0] = htole16(
 249                         ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
 250                 wreq.wi_len = 1;
 251                 break;
 252         case WI_RID_CURRENT_CHAN:
 253                 wreq.wi_val[0] = htole16(
 254                         ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan));
 255                 wreq.wi_len = 1;
 256                 break;
 257         case WI_RID_COMMS_QUALITY:
 258                 wreq.wi_val[0] = 0;                             /* quality */
 259                 wreq.wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
 260                 wreq.wi_val[2] = 0;                             /* noise */
 261                 wreq.wi_len = 3;
 262                 break;
 263         case WI_RID_PROMISC:
 264                 wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
 265                 wreq.wi_len = 1;
 266                 break;
 267         case WI_RID_PORTTYPE:
 268                 wreq.wi_val[0] = htole16(ic->ic_opmode);
 269                 wreq.wi_len = 1;
 270                 break;
 271         case WI_RID_MAC_NODE:
 272                 IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
 273                 wreq.wi_len = IEEE80211_ADDR_LEN / 2;
 274                 break;
 275         case WI_RID_TX_RATE:
 276                 if (ic->ic_fixed_rate == -1)
 277                         wreq.wi_val[0] = 0;     /* auto */
 278                 else
 279                         wreq.wi_val[0] = htole16(
 280                             (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
 281                             IEEE80211_RATE_VAL) / 2);
 282                 wreq.wi_len = 1;
 283                 break;
 284         case WI_RID_CUR_TX_RATE:
 285                 wreq.wi_val[0] = htole16(
 286                     (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
 287                     IEEE80211_RATE_VAL) / 2);
 288                 wreq.wi_len = 1;
 289                 break;
 290         case WI_RID_RTS_THRESH:
 291                 wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
 292                 wreq.wi_len = 1;
 293                 break;
 294         case WI_RID_CREATE_IBSS:
 295                 wreq.wi_val[0] =
 296                     htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
 297                 wreq.wi_len = 1;
 298                 break;
 299         case WI_RID_MICROWAVE_OVEN:
 300                 wreq.wi_val[0] = 0;     /* no ... not supported */
 301                 wreq.wi_len = 1;
 302                 break;
 303         case WI_RID_ROAMING_MODE:
 304                 wreq.wi_val[0] = htole16(ic->ic_roaming);       /* XXX map */
 305                 wreq.wi_len = 1;
 306                 break;
 307         case WI_RID_SYSTEM_SCALE:
 308                 wreq.wi_val[0] = htole16(1);    /* low density ... not supp */
 309                 wreq.wi_len = 1;
 310                 break;
 311         case WI_RID_PM_ENABLED:
 312                 wreq.wi_val[0] =
 313                     htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
 314                 wreq.wi_len = 1;
 315                 break;
 316         case WI_RID_MAX_SLEEP:
 317                 wreq.wi_val[0] = htole16(ic->ic_lintval);
 318                 wreq.wi_len = 1;
 319                 break;
 320         case WI_RID_CUR_BEACON_INT:
 321                 wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
 322                 wreq.wi_len = 1;
 323                 break;
 324         case WI_RID_WEP_AVAIL:
 325                 wreq.wi_val[0] = htole16(1);    /* always available */
 326                 wreq.wi_len = 1;
 327                 break;
 328         case WI_RID_CNFAUTHMODE:
 329                 wreq.wi_val[0] = htole16(1);    /* TODO: open system only */
 330                 wreq.wi_len = 1;
 331                 break;
 332         case WI_RID_ENCRYPTION:
 333                 wreq.wi_val[0] =
 334                     htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
 335                 wreq.wi_len = 1;
 336                 break;
 337         case WI_RID_TX_CRYPT_KEY:
 338                 wreq.wi_val[0] = htole16(ic->ic_def_txkey);
 339                 wreq.wi_len = 1;
 340                 break;
 341         case WI_RID_DEFLT_CRYPT_KEYS:
 342                 keys = (struct wi_ltv_keys *)&wreq;
 343                 /* do not show keys to non-root user */
 344                 error = suser(curthread);
 345                 if (error) {
 346                         memset(keys, 0, sizeof(*keys));
 347                         error = 0;
 348                         break;
 349                 }
 350                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 351                         keys->wi_keys[i].wi_keylen =
 352                             htole16(ic->ic_nw_keys[i].wk_keylen);
 353                         memcpy(keys->wi_keys[i].wi_keydat,
 354                             ic->ic_nw_keys[i].wk_key,
 355                             ic->ic_nw_keys[i].wk_keylen);
 356                 }
 357                 wreq.wi_len = sizeof(*keys) / 2;
 358                 break;
 359         case WI_RID_MAX_DATALEN:
 360                 wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
 361                 wreq.wi_len = 1;
 362                 break;
 363         case WI_RID_IFACE_STATS:
 364                 /* XXX: should be implemented in lower drivers */
 365                 break;
 366         case WI_RID_READ_APS:
 367                 /*
 368                  * Don't return results until active scan completes.
 369                  */
 370                 if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
 371                         struct wi_read_ap_args args;
 372
 373                         args.i = 0;
 374                         args.ap = (void *)((char *)wreq.wi_val + sizeof(i));
 375                         args.max = (void *)(&wreq + 1);
 376                         ieee80211_iterate_nodes(&ic->ic_scan,
 377                                 wi_read_ap_result, &args);
 378                         memcpy(wreq.wi_val, &args.i, sizeof(args.i));
 379                         wreq.wi_len = (sizeof(int) +
 380                                 sizeof(struct wi_apinfo) * args.i) / 2;
 381                 } else
 382                         error = EINPROGRESS;
 383                 break;
 384         case WI_RID_PRISM2:
 385                 /* NB: we lie so WI_RID_SCAN_RES can include rates */
 386                 wreq.wi_val[0] = 1;
 387                 wreq.wi_len = sizeof(u_int16_t) / 2;
 388                 break;
 389         case WI_RID_SCAN_RES:                   /* compatibility interface */
 390                 if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
 391                         struct wi_read_prism2_args args;
 392                         struct wi_scan_p2_hdr *p2;
 393
 394                         /* NB: use Prism2 format so we can include rate info */
 395                         p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
 396                         args.i = 0;
 397                         args.res = (void *)&p2[1];
 398                         args.max = (void *)(&wreq + 1);
 399                         ieee80211_iterate_nodes(&ic->ic_scan,
 400                                 wi_read_prism2_result, &args);
 401                         p2->wi_rsvd = 0;
 402                         p2->wi_reason = args.i;
 403                         wreq.wi_len = (sizeof(*p2) +
 404                                 sizeof(struct wi_scan_res) * args.i) / 2;
 405                 } else
 406                         error = EINPROGRESS;
 407                 break;
 408         case WI_RID_READ_CACHE: {
 409                 struct wi_read_sigcache_args args;
 410                 args.i = 0;
 411                 args.wsc = (struct wi_sigcache *) wreq.wi_val;
 412                 args.max = (void *)(&wreq + 1);
 413                 ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
 414                 wreq.wi_len = sizeof(struct wi_sigcache) * args.i / 2;
 415                 break;
 416         }
 417         default:
 418                 error = EINVAL;
 419                 break;
 420         }
 421         if (error == 0) {
 422                 wreq.wi_len++;
 423                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
 424         }
 425         return error;
 426 }
 427
 428 static int
 429 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
 430 {
 431 #define IEEERATE(_ic,_m,_i) \
 432         ((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
 433         int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
 434         for (i = 0; i < nrates; i++)
 435                 if (IEEERATE(ic, mode, i) == rate)
 436                         return i;
 437         return -1;
 438 #undef IEEERATE
 439 }
 440
 441 /*
 442  * Prepare to do a user-initiated scan for AP's.  If no
 443  * current/default channel is setup or the current channel
 444  * is invalid then pick the first available channel from
 445  * the active list as the place to start the scan.
 446  */
 447 static int
 448 ieee80211_setupscan(struct ieee80211com *ic, const u_int8_t chanlist[])
 449 {
 450         int i;
 451
 452         /*
 453          * XXX don't permit a scan to be started unless we
 454          * know the device is ready.  For the moment this means
 455          * the device is marked up as this is the required to
 456          * initialize the hardware.  It would be better to permit
 457          * scanning prior to being up but that'll require some
 458          * changes to the infrastructure.
 459          */
 460         if (!IS_UP(ic))
 461                 return EINVAL;
 462         if (ic->ic_ibss_chan == NULL ||
 463             isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
 464                 for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
 465                         if (isset(chanlist, i)) {
 466                                 ic->ic_ibss_chan = &ic->ic_channels[i];
 467                                 goto found;
 468                         }
 469                 return EINVAL;                  /* no active channels */
 470 found:
 471                 ;
 472         }
 473         if (ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC ||
 474             isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan)))
 475                 ic->ic_bss->ni_chan = ic->ic_ibss_chan;
 476         memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
 477         /*
 478          * We force the state to INIT before calling ieee80211_new_state
 479          * to get ieee80211_begin_scan called.  We really want to scan w/o
 480          * altering the current state but that's not possible right now.
 481          */
 482         /* XXX handle proberequest case */
 483         ic->ic_state = IEEE80211_S_INIT;        /* XXX bypass state machine */
 484         return 0;
 485 }
 486
 487 int
 488 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, caddr_t data)
 489 {
 490         struct ifnet *ifp = ic->ic_ifp;
 491         int i, j, len, error, rate;
 492         struct ifreq *ifr = (struct ifreq *)data;
 493         struct wi_ltv_keys *keys;
 494         struct wi_req wreq;
 495         u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
 496
 497         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
 498         if (error)
 499                 return error;
 500         len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
 501         switch (wreq.wi_type) {
 502         case WI_RID_SERIALNO:
 503         case WI_RID_NODENAME:
 504                 return EPERM;
 505         case WI_RID_CURRENT_SSID:
 506                 return EPERM;
 507         case WI_RID_OWN_SSID:
 508         case WI_RID_DESIRED_SSID:
 509                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
 510                     le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
 511                         error = ENOSPC;
 512                         break;
 513                 }
 514                 memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
 515                 ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
 516                 memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
 517                 error = ENETRESET;
 518                 break;
 519         case WI_RID_CURRENT_BSSID:
 520                 return EPERM;
 521         case WI_RID_OWN_CHNL:
 522                 if (len != 2)
 523                         return EINVAL;
 524                 i = le16toh(wreq.wi_val[0]);
 525                 if (i < 0 ||
 526                     i > IEEE80211_CHAN_MAX ||
 527                     isclr(ic->ic_chan_active, i))
 528                         return EINVAL;
 529                 ic->ic_ibss_chan = &ic->ic_channels[i];
 530                 if (ic->ic_opmode == IEEE80211_M_MONITOR)
 531                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 532                 else
 533                         error = ENETRESET;
 534                 break;
 535         case WI_RID_CURRENT_CHAN:
 536                 return EPERM;
 537         case WI_RID_COMMS_QUALITY:
 538                 return EPERM;
 539         case WI_RID_PROMISC:
 540                 if (len != 2)
 541                         return EINVAL;
 542                 if (ifp->if_flags & IFF_PROMISC) {
 543                         if (wreq.wi_val[0] == 0) {
 544                                 ifp->if_flags &= ~IFF_PROMISC;
 545                                 error = ENETRESET;
 546                         }
 547                 } else {
 548                         if (wreq.wi_val[0] != 0) {
 549                                 ifp->if_flags |= IFF_PROMISC;
 550                                 error = ENETRESET;
 551                         }
 552                 }
 553                 break;
 554         case WI_RID_PORTTYPE:
 555                 if (len != 2)
 556                         return EINVAL;
 557                 switch (le16toh(wreq.wi_val[0])) {
 558                 case IEEE80211_M_STA:
 559                         break;
 560                 case IEEE80211_M_IBSS:
 561                         if (!(ic->ic_caps & IEEE80211_C_IBSS))
 562                                 return EINVAL;
 563                         break;
 564                 case IEEE80211_M_AHDEMO:
 565                         if (ic->ic_phytype != IEEE80211_T_DS ||
 566                             !(ic->ic_caps & IEEE80211_C_AHDEMO))
 567                                 return EINVAL;
 568                         break;
 569                 case IEEE80211_M_HOSTAP:
 570                         if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
 571                                 return EINVAL;
 572                         break;
 573                 default:
 574                         return EINVAL;
 575                 }
 576                 if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
 577                         ic->ic_opmode = le16toh(wreq.wi_val[0]);
 578                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 579                 }
 580                 break;
 581 #if 0
 582         case WI_RID_MAC_NODE:
 583                 if (len != IEEE80211_ADDR_LEN)
 584                         return EINVAL;
 585                 IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
 586                 /* if_init will copy lladdr into ic_myaddr */
 587                 error = ENETRESET;
 588                 break;
 589 #endif
 590         case WI_RID_TX_RATE:
 591                 if (len != 2)
 592                         return EINVAL;
 593                 if (wreq.wi_val[0] == 0) {
 594                         /* auto */
 595                         ic->ic_fixed_rate = -1;
 596                         break;
 597                 }
 598                 rate = 2 * le16toh(wreq.wi_val[0]);
 599                 if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
 600                         /*
 601                          * In autoselect mode search for the rate.  We take
 602                          * the first instance which may not be right, but we
 603                          * are limited by the interface.  Note that we also
 604                          * lock the mode to insure the rate is meaningful
 605                          * when it is used.
 606                          */
 607                         for (j = IEEE80211_MODE_11A;
 608                              j < IEEE80211_MODE_MAX; j++) {
 609                                 if ((ic->ic_modecaps & (1<<j)) == 0)
 610                                         continue;
 611                                 i = findrate(ic, j, rate);
 612                                 if (i != -1) {
 613                                         /* lock mode too */
 614                                         ic->ic_curmode = j;
 615                                         goto setrate;
 616                                 }
 617                         }
 618                 } else {
 619                         i = findrate(ic, ic->ic_curmode, rate);
 620                         if (i != -1)
 621                                 goto setrate;
 622                 }
 623                 return EINVAL;
 624         setrate:
 625                 ic->ic_fixed_rate = i;
 626                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 627                 break;
 628         case WI_RID_CUR_TX_RATE:
 629                 return EPERM;
 630         case WI_RID_RTS_THRESH:
 631                 if (len != 2)
 632                         return EINVAL;
 633                 if (le16toh(wreq.wi_val[0]) != IEEE80211_MAX_LEN)
 634                         return EINVAL;          /* TODO: RTS */
 635                 break;
 636         case WI_RID_CREATE_IBSS:
 637                 if (len != 2)
 638                         return EINVAL;
 639                 if (wreq.wi_val[0] != 0) {
 640                         if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
 641                                 return EINVAL;
 642                         if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
 643                                 ic->ic_flags |= IEEE80211_F_IBSSON;
 644                                 if (ic->ic_opmode == IEEE80211_M_IBSS &&
 645                                     ic->ic_state == IEEE80211_S_SCAN)
 646                                         error = IS_UP_AUTO(ic) ? ENETRESET : 0;
 647                         }
 648                 } else {
 649                         if (ic->ic_flags & IEEE80211_F_IBSSON) {
 650                                 ic->ic_flags &= ~IEEE80211_F_IBSSON;
 651                                 if (ic->ic_flags & IEEE80211_F_SIBSS) {
 652                                         ic->ic_flags &= ~IEEE80211_F_SIBSS;
 653                                         error = IS_UP_AUTO(ic) ? ENETRESET : 0;
 654                                 }
 655                         }
 656                 }
 657                 break;
 658         case WI_RID_MICROWAVE_OVEN:
 659                 if (len != 2)
 660                         return EINVAL;
 661                 if (wreq.wi_val[0] != 0)
 662                         return EINVAL;          /* not supported */
 663                 break;
 664         case WI_RID_ROAMING_MODE:
 665                 if (len != 2)
 666                         return EINVAL;
 667                 i = le16toh(wreq.wi_val[0]);
 668                 if (i > IEEE80211_ROAMING_MANUAL)
 669                         return EINVAL;          /* not supported */
 670                 ic->ic_roaming = i;
 671                 break;
 672         case WI_RID_SYSTEM_SCALE:
 673                 if (len != 2)
 674                         return EINVAL;
 675                 if (le16toh(wreq.wi_val[0]) != 1)
 676                         return EINVAL;          /* not supported */
 677                 break;
 678         case WI_RID_PM_ENABLED:
 679                 if (len != 2)
 680                         return EINVAL;
 681                 if (wreq.wi_val[0] != 0) {
 682                         if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
 683                                 return EINVAL;
 684                         if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
 685                                 ic->ic_flags |= IEEE80211_F_PMGTON;
 686                                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 687                         }
 688                 } else {
 689                         if (ic->ic_flags & IEEE80211_F_PMGTON) {
 690                                 ic->ic_flags &= ~IEEE80211_F_PMGTON;
 691                                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 692                         }
 693                 }
 694                 break;
 695         case WI_RID_MAX_SLEEP:
 696                 if (len != 2)
 697                         return EINVAL;
 698                 ic->ic_lintval = le16toh(wreq.wi_val[0]);
 699                 if (ic->ic_flags & IEEE80211_F_PMGTON)
 700                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 701                 break;
 702         case WI_RID_CUR_BEACON_INT:
 703                 return EPERM;
 704         case WI_RID_WEP_AVAIL:
 705                 return EPERM;
 706         case WI_RID_CNFAUTHMODE:
 707                 if (len != 2)
 708                         return EINVAL;
 709                 i = le16toh(wreq.wi_val[0]);
 710                 if (i > IEEE80211_AUTH_WPA)
 711                         return EINVAL;
 712                 ic->ic_bss->ni_authmode = i;            /* XXX ENETRESET? */
 713                 error = ENETRESET;
 714                 break;
 715         case WI_RID_ENCRYPTION:
 716                 if (len != 2)
 717                         return EINVAL;
 718                 if (wreq.wi_val[0] != 0) {
 719                         if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
 720                                 return EINVAL;
 721                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
 722                                 ic->ic_flags |= IEEE80211_F_PRIVACY;
 723                                 error = ENETRESET;
 724                         }
 725                 } else {
 726                         if (ic->ic_flags & IEEE80211_F_PRIVACY) {
 727                                 ic->ic_flags &= ~IEEE80211_F_PRIVACY;
 728                                 error = ENETRESET;
 729                         }
 730                 }
 731                 break;
 732         case WI_RID_TX_CRYPT_KEY:
 733                 if (len != 2)
 734                         return EINVAL;
 735                 i = le16toh(wreq.wi_val[0]);
 736                 if (i >= IEEE80211_WEP_NKID)
 737                         return EINVAL;
 738                 ic->ic_def_txkey = i;
 739                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 740                 break;
 741         case WI_RID_DEFLT_CRYPT_KEYS:
 742                 if (len != sizeof(struct wi_ltv_keys))
 743                         return EINVAL;
 744                 keys = (struct wi_ltv_keys *)&wreq;
 745                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 746                         len = le16toh(keys->wi_keys[i].wi_keylen);
 747                         if (len != 0 && len < IEEE80211_WEP_KEYLEN)
 748                                 return EINVAL;
 749                         if (len > IEEE80211_KEYBUF_SIZE)
 750                                 return EINVAL;
 751                 }
 752                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 753                         struct ieee80211_key *k = &ic->ic_nw_keys[i];
 754
 755                         len = le16toh(keys->wi_keys[i].wi_keylen);
 756                         k->wk_keylen = len;
 757                         k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
 758                         memset(k->wk_key, 0, sizeof(k->wk_key));
 759                         memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
 760 #if 0
 761                         k->wk_type = IEEE80211_CIPHER_WEP;
 762 #endif
 763                 }
 764                 error = ENETRESET;
 765                 break;
 766         case WI_RID_MAX_DATALEN:
 767                 if (len != 2)
 768                         return EINVAL;
 769                 len = le16toh(wreq.wi_val[0]);
 770                 if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
 771                         return EINVAL;
 772                 ic->ic_fragthreshold = len;
 773                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 774                 break;
 775         case WI_RID_IFACE_STATS:
 776                 error = EPERM;
 777                 break;
 778         case WI_RID_SCAN_REQ:                   /* XXX wicontrol */
 779                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
 780                         break;
 781                 error = ieee80211_setupscan(ic, ic->ic_chan_avail);
 782                 if (error == 0)
 783                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 784                 break;
 785         case WI_RID_SCAN_APS:
 786                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
 787                         break;
 788                 len--;                  /* XXX: tx rate? */
 789                 /* FALLTHRU */
 790         case WI_RID_CHANNEL_LIST:
 791                 memset(chanlist, 0, sizeof(chanlist));
 792                 /*
 793                  * Since channel 0 is not available for DS, channel 1
 794                  * is assigned to LSB on WaveLAN.
 795                  */
 796                 if (ic->ic_phytype == IEEE80211_T_DS)
 797                         i = 1;
 798                 else
 799                         i = 0;
 800                 for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
 801                         if ((j / 8) >= len)
 802                                 break;
 803                         if (isclr((u_int8_t *)wreq.wi_val, j))
 804                                 continue;
 805                         if (isclr(ic->ic_chan_active, i)) {
 806                                 if (wreq.wi_type != WI_RID_CHANNEL_LIST)
 807                                         continue;
 808                                 if (isclr(ic->ic_chan_avail, i))
 809                                         return EPERM;
 810                         }
 811                         setbit(chanlist, i);
 812                 }
 813                 error = ieee80211_setupscan(ic, chanlist);
 814                 if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
 815                         /* NB: ignore error from ieee80211_setupscan */
 816                         error = ENETRESET;
 817                 } else if (error == 0)
 818                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 819                 break;
 820         default:
 821                 error = EINVAL;
 822                 break;
 823         }
 824         if (error == ENETRESET && !IS_UP_AUTO(ic))
 825                 error = 0;
 826         return error;
 827 }
 828
 829 static struct ieee80211_channel *
 830 getcurchan(struct ieee80211com *ic)
 831 {
 832         switch (ic->ic_state) {
 833         case IEEE80211_S_INIT:
 834         case IEEE80211_S_SCAN:
 835                 return ic->ic_des_chan;
 836         default:
 837                 return ic->ic_ibss_chan;
 838         }
 839 }
 840
 841 static int
 842 cap2cipher(int flag)
 843 {
 844         switch (flag) {
 845         case IEEE80211_C_WEP:           return IEEE80211_CIPHER_WEP;
 846         case IEEE80211_C_AES:           return IEEE80211_CIPHER_AES_OCB;
 847         case IEEE80211_C_AES_CCM:       return IEEE80211_CIPHER_AES_CCM;
 848         case IEEE80211_C_CKIP:          return IEEE80211_CIPHER_CKIP;
 849         case IEEE80211_C_TKIP:          return IEEE80211_CIPHER_TKIP;
 850         }
 851         return -1;
 852 }
 853
 854 static int
 855 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq)
 856 {
 857         struct ieee80211_node *ni;
 858         struct ieee80211req_key ik;
 859         struct ieee80211_key *wk;
 860         const struct ieee80211_cipher *cip;
 861         u_int kid;
 862         int error;
 863
 864         if (ireq->i_len != sizeof(ik))
 865                 return EINVAL;
 866         error = copyin(ireq->i_data, &ik, sizeof(ik));
 867         if (error)
 868                 return error;
 869         kid = ik.ik_keyix;
 870         if (kid == IEEE80211_KEYIX_NONE) {
 871                 ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
 872                 if (ni == NULL)
 873                         return EINVAL;          /* XXX */
 874                 wk = &ni->ni_ucastkey;
 875         } else {
 876                 if (kid >= IEEE80211_WEP_NKID)
 877                         return EINVAL;
 878                 wk = &ic->ic_nw_keys[kid];
 879                 IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
 880                 ni = NULL;
 881         }
 882         cip = wk->wk_cipher;
 883         ik.ik_type = cip->ic_cipher;
 884         ik.ik_keylen = wk->wk_keylen;
 885         ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
 886         if (wk->wk_keyix == ic->ic_def_txkey)
 887                 ik.ik_flags |= IEEE80211_KEY_DEFAULT;
 888         if (suser(curthread) == 0) {
 889                 /* NB: only root can read key data */
 890                 ik.ik_keyrsc = wk->wk_keyrsc;
 891                 ik.ik_keytsc = wk->wk_keytsc;
 892                 memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
 893                 if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
 894                         memcpy(ik.ik_keydata+wk->wk_keylen,
 895                                 wk->wk_key + IEEE80211_KEYBUF_SIZE,
 896                                 IEEE80211_MICBUF_SIZE);
 897                         ik.ik_keylen += IEEE80211_MICBUF_SIZE;
 898                 }
 899         } else {
 900                 ik.ik_keyrsc = 0;
 901                 ik.ik_keytsc = 0;
 902                 memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
 903         }
 904         if (ni != NULL)
 905                 ieee80211_free_node(ni);
 906         return copyout(&ik, ireq->i_data, sizeof(ik));
 907 }
 908
 909 static int
 910 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
 911 {
 912
 913         if (sizeof(ic->ic_chan_active) > ireq->i_len)
 914                 ireq->i_len = sizeof(ic->ic_chan_active);
 915         return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
 916 }
 917
 918 static int
 919 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
 920 {
 921         struct ieee80211req_chaninfo chans;     /* XXX off stack? */
 922         int i, space;
 923
 924         /*
 925          * Since channel 0 is not available for DS, channel 1
 926          * is assigned to LSB on WaveLAN.
 927          */
 928         if (ic->ic_phytype == IEEE80211_T_DS)
 929                 i = 1;
 930         else
 931                 i = 0;
 932         memset(&chans, 0, sizeof(chans));
 933         for (; i <= IEEE80211_CHAN_MAX; i++)
 934                 if (isset(ic->ic_chan_avail, i)) {
 935                         struct ieee80211_channel *c = &ic->ic_channels[i];
 936                         chans.ic_chans[chans.ic_nchans].ic_freq = c->ic_freq;
 937                         chans.ic_chans[chans.ic_nchans].ic_flags = c->ic_flags;
 938                         chans.ic_nchans++;
 939                 }
 940         space = __offsetof(struct ieee80211req_chaninfo,
 941                         ic_chans[chans.ic_nchans]);
 942         if (space > ireq->i_len)
 943                 space = ireq->i_len;
 944         return copyout(&chans, ireq->i_data, space);
 945 }
 946
 947 static int
 948 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
 949 {
 950         struct ieee80211_node *ni;
 951         struct ieee80211req_wpaie wpaie;
 952         int error;
 953
 954         if (ireq->i_len < IEEE80211_ADDR_LEN)
 955                 return EINVAL;
 956         error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
 957         if (error != 0)
 958                 return error;
 959         ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
 960         if (ni == NULL)
 961                 return EINVAL;          /* XXX */
 962         memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
 963         if (ni->ni_wpa_ie != NULL) {
 964                 int ielen = ni->ni_wpa_ie[1] + 2;
 965                 if (ielen > sizeof(wpaie.wpa_ie))
 966                         ielen = sizeof(wpaie.wpa_ie);
 967                 memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
 968         }
 969         ieee80211_free_node(ni);
 970         if (ireq->i_len > sizeof(wpaie))
 971                 ireq->i_len = sizeof(wpaie);
 972         return copyout(&wpaie, ireq->i_data, ireq->i_len);
 973 }
 974
 975 static int
 976 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
 977 {
 978         struct ieee80211_node *ni;
 979         u_int8_t macaddr[IEEE80211_ADDR_LEN];
 980         const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
 981         int error;
 982
 983         if (ireq->i_len < off)
 984                 return EINVAL;
 985         error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
 986         if (error != 0)
 987                 return error;
 988         ni = ieee80211_find_node(&ic->ic_sta, macaddr);
 989         if (ni == NULL)
 990                 return EINVAL;          /* XXX */
 991         if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
 992                 ireq->i_len = sizeof(struct ieee80211req_sta_stats);
 993         /* NB: copy out only the statistics */
 994         error = copyout(&ni->ni_stats, (u_int8_t *) ireq->i_data + off,
 995                         ireq->i_len - off);
 996         ieee80211_free_node(ni);
 997         return error;
 998 }
 999
1000 static void
1001 get_scan_result(struct ieee80211req_scan_result *sr,
1002         const struct ieee80211_node *ni)
1003 {
1004         struct ieee80211com *ic = ni->ni_ic;
1005
1006         memset(sr, 0, sizeof(*sr));
1007         sr->isr_ssid_len = ni->ni_esslen;
1008         if (ni->ni_wpa_ie != NULL)
1009                 sr->isr_ie_len += 2+ni->ni_wpa_ie[1];
1010         if (ni->ni_wme_ie != NULL)
1011                 sr->isr_ie_len += 2+ni->ni_wme_ie[1];
1012         sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
1013         sr->isr_len = roundup(sr->isr_len, sizeof(u_int32_t));
1014         if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
1015                 sr->isr_freq = ni->ni_chan->ic_freq;
1016                 sr->isr_flags = ni->ni_chan->ic_flags;
1017         }
1018         sr->isr_rssi = ic->ic_node_getrssi(ni);
1019         sr->isr_intval = ni->ni_intval;
1020         sr->isr_capinfo = ni->ni_capinfo;
1021         sr->isr_erp = ni->ni_erp;
1022         IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
1023         sr->isr_nrates = ni->ni_rates.rs_nrates;
1024         if (sr->isr_nrates > 15)
1025                 sr->isr_nrates = 15;
1026         memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
1027 }
1028
1029 static int
1030 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
1031 {
1032         union {
1033                 struct ieee80211req_scan_result res;
1034                 char data[512];         /* XXX shrink? */
1035         } u;
1036         struct ieee80211req_scan_result *sr = &u.res;
1037         struct ieee80211_node_table *nt;
1038         struct ieee80211_node *ni;
1039         int error, space;
1040         u_int8_t *p, *cp;
1041
1042         p = ireq->i_data;
1043         space = ireq->i_len;
1044         error = 0;
1045         /* XXX locking */
1046         nt =  &ic->ic_scan;
1047         TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1048                 /* NB: skip pre-scan node state */
1049                 if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1050                         continue;
1051                 get_scan_result(sr, ni);
1052                 if (sr->isr_len > sizeof(u))
1053                         continue;               /* XXX */
1054                 if (space < sr->isr_len)
1055                         break;
1056                 cp = (u_int8_t *)(sr+1);
1057                 memcpy(cp, ni->ni_essid, ni->ni_esslen);
1058                 cp += ni->ni_esslen;
1059                 if (ni->ni_wpa_ie != NULL) {
1060                         memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1061                         cp += 2+ni->ni_wpa_ie[1];
1062                 }
1063                 if (ni->ni_wme_ie != NULL) {
1064                         memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1065                         cp += 2+ni->ni_wme_ie[1];
1066                 }
1067                 error = copyout(sr, p, sr->isr_len);
1068                 if (error)
1069                         break;
1070                 p += sr->isr_len;
1071                 space -= sr->isr_len;
1072         }
1073         ireq->i_len -= space;
1074         return error;
1075 }
1076
1077 static void
1078 get_sta_info(struct ieee80211req_sta_info *si, const struct ieee80211_node *ni)
1079 {
1080         struct ieee80211com *ic = ni->ni_ic;
1081
1082         si->isi_ie_len = 0;
1083         if (ni->ni_wpa_ie != NULL)
1084                 si->isi_ie_len += 2+ni->ni_wpa_ie[1];
1085         if (ni->ni_wme_ie != NULL)
1086                 si->isi_ie_len += 2+ni->ni_wme_ie[1];
1087         si->isi_len = sizeof(*si) + si->isi_ie_len, sizeof(u_int32_t);
1088         si->isi_len = roundup(si->isi_len, sizeof(u_int32_t));
1089         si->isi_freq = ni->ni_chan->ic_freq;
1090         si->isi_flags = ni->ni_chan->ic_flags;
1091         si->isi_state = ni->ni_flags;
1092         si->isi_authmode = ni->ni_authmode;
1093         si->isi_rssi = ic->ic_node_getrssi(ni);
1094         si->isi_capinfo = ni->ni_capinfo;
1095         si->isi_erp = ni->ni_erp;
1096         IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
1097         si->isi_nrates = ni->ni_rates.rs_nrates;
1098         if (si->isi_nrates > 15)
1099                 si->isi_nrates = 15;
1100         memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
1101         si->isi_txrate = ni->ni_txrate;
1102         si->isi_associd = ni->ni_associd;
1103         si->isi_txpower = ni->ni_txpower;
1104         si->isi_vlan = ni->ni_vlan;
1105         if (ni->ni_flags & IEEE80211_NODE_QOS) {
1106                 memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
1107                 memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
1108         } else {
1109                 si->isi_txseqs[0] = ni->ni_txseqs[0];
1110                 si->isi_rxseqs[0] = ni->ni_rxseqs[0];
1111         }
1112         if (ic->ic_opmode == IEEE80211_M_IBSS || ni->ni_associd != 0)
1113                 si->isi_inact = ic->ic_inact_run;
1114         else if (ieee80211_node_is_authorized(ni))
1115                 si->isi_inact = ic->ic_inact_auth;
1116         else
1117                 si->isi_inact = ic->ic_inact_init;
1118         si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
1119 }
1120
1121 static int
1122 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
1123 {
1124         union {
1125                 struct ieee80211req_sta_info info;
1126                 char data[512];         /* XXX shrink? */
1127         } u;
1128         struct ieee80211req_sta_info *si = &u.info;
1129         struct ieee80211_node_table *nt;
1130         struct ieee80211_node *ni;
1131         int error, space;
1132         u_int8_t *p, *cp;
1133
1134         nt = &ic->ic_sta;
1135         p = ireq->i_data;
1136         space = ireq->i_len;
1137         error = 0;
1138         /* XXX locking */
1139         TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1140                 get_sta_info(si, ni);
1141                 if (si->isi_len > sizeof(u))
1142                         continue;               /* XXX */
1143                 if (space < si->isi_len)
1144                         break;
1145                 cp = (u_int8_t *)(si+1);
1146                 if (ni->ni_wpa_ie != NULL) {
1147                         memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1148                         cp += 2+ni->ni_wpa_ie[1];
1149                 }
1150                 if (ni->ni_wme_ie != NULL) {
1151                         memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1152                         cp += 2+ni->ni_wme_ie[1];
1153                 }
1154                 error = copyout(si, p, si->isi_len);
1155                 if (error)
1156                         break;
1157                 p += si->isi_len;
1158                 space -= si->isi_len;
1159         }
1160         ireq->i_len -= space;
1161         return error;
1162 }
1163
1164 static int
1165 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1166 {
1167         struct ieee80211_node *ni;
1168         struct ieee80211req_sta_txpow txpow;
1169         int error;
1170
1171         if (ireq->i_len != sizeof(txpow))
1172                 return EINVAL;
1173         error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1174         if (error != 0)
1175                 return error;
1176         ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1177         if (ni == NULL)
1178                 return EINVAL;          /* XXX */
1179         txpow.it_txpow = ni->ni_txpower;
1180         error = copyout(&txpow, ireq->i_data, sizeof(txpow));
1181         ieee80211_free_node(ni);
1182         return error;
1183 }
1184
1185 static int
1186 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1187 {
1188         struct ieee80211_wme_state *wme = &ic->ic_wme;
1189         struct wmeParams *wmep;
1190         int ac;
1191
1192         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1193                 return EINVAL;
1194
1195         ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1196         if (ac >= WME_NUM_AC)
1197                 ac = WME_AC_BE;
1198         if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
1199                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1200         else
1201                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1202         switch (ireq->i_type) {
1203         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
1204                 ireq->i_val = wmep->wmep_logcwmin;
1205                 break;
1206         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
1207                 ireq->i_val = wmep->wmep_logcwmax;
1208                 break;
1209         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
1210                 ireq->i_val = wmep->wmep_aifsn;
1211                 break;
1212         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
1213                 ireq->i_val = wmep->wmep_txopLimit;
1214                 break;
1215         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
1216                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1217                 ireq->i_val = wmep->wmep_acm;
1218                 break;
1219         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (!bss only)*/
1220                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1221                 ireq->i_val = !wmep->wmep_noackPolicy;
1222                 break;
1223         }
1224         return 0;
1225 }
1226
1227 /*
1228  * When building the kernel with -O2 on the i386 architecture, gcc
1229  * seems to want to inline this function into ieee80211_ioctl()
1230  * (which is the only routine that calls it). When this happens,
1231  * ieee80211_ioctl() ends up consuming an additional 2K of stack
1232  * space. (Exactly why it needs so much is unclear.) The problem
1233  * is that it's possible for ieee80211_ioctl() to invoke other
1234  * routines (including driver init functions) which could then find
1235  * themselves perilously close to exhausting the stack.
1236  *
1237  * To avoid this, we deliberately prevent gcc from inlining this
1238  * routine. Another way to avoid this is to use less agressive
1239  * optimization when compiling this file (i.e. -O instead of -O2)
1240  * but special-casing the compilation of this one module in the
1241  * build system would be awkward.
1242  */
1243 #ifdef __GNUC__
1244 __attribute__ ((noinline))
1245 #endif
1246 static int
1247 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1248 {
1249         const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1250         int error = 0;
1251         u_int kid, len, m;
1252         u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1253         char tmpssid[IEEE80211_NWID_LEN];
1254
1255         switch (ireq->i_type) {
1256         case IEEE80211_IOC_SSID:
1257                 switch (ic->ic_state) {
1258                 case IEEE80211_S_INIT:
1259                 case IEEE80211_S_SCAN:
1260                         ireq->i_len = ic->ic_des_esslen;
1261                         memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
1262                         break;
1263                 default:
1264                         ireq->i_len = ic->ic_bss->ni_esslen;
1265                         memcpy(tmpssid, ic->ic_bss->ni_essid,
1266                                 ireq->i_len);
1267                         break;
1268                 }
1269                 error = copyout(tmpssid, ireq->i_data, ireq->i_len);
1270                 break;
1271         case IEEE80211_IOC_NUMSSIDS:
1272                 ireq->i_val = 1;
1273                 break;
1274         case IEEE80211_IOC_WEP:
1275                 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
1276                         ireq->i_val = IEEE80211_WEP_OFF;
1277                 else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
1278                         ireq->i_val = IEEE80211_WEP_ON;
1279                 else
1280                         ireq->i_val = IEEE80211_WEP_MIXED;
1281                 break;
1282         case IEEE80211_IOC_WEPKEY:
1283                 kid = (u_int) ireq->i_val;
1284                 if (kid >= IEEE80211_WEP_NKID)
1285                         return EINVAL;
1286                 len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
1287                 /* NB: only root can read WEP keys */
1288                 if (suser(curthread) == 0) {
1289                         bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
1290                 } else {
1291                         bzero(tmpkey, len);
1292                 }
1293                 ireq->i_len = len;
1294                 error = copyout(tmpkey, ireq->i_data, len);
1295                 break;
1296         case IEEE80211_IOC_NUMWEPKEYS:
1297                 ireq->i_val = IEEE80211_WEP_NKID;
1298                 break;
1299         case IEEE80211_IOC_WEPTXKEY:
1300                 ireq->i_val = ic->ic_def_txkey;
1301                 break;
1302         case IEEE80211_IOC_AUTHMODE:
1303                 if (ic->ic_flags & IEEE80211_F_WPA)
1304                         ireq->i_val = IEEE80211_AUTH_WPA;
1305                 else
1306                         ireq->i_val = ic->ic_bss->ni_authmode;
1307                 break;
1308         case IEEE80211_IOC_CHANNEL:
1309                 ireq->i_val = ieee80211_chan2ieee(ic, getcurchan(ic));
1310                 break;
1311         case IEEE80211_IOC_POWERSAVE:
1312                 if (ic->ic_flags & IEEE80211_F_PMGTON)
1313                         ireq->i_val = IEEE80211_POWERSAVE_ON;
1314                 else
1315                         ireq->i_val = IEEE80211_POWERSAVE_OFF;
1316                 break;
1317         case IEEE80211_IOC_POWERSAVESLEEP:
1318                 ireq->i_val = ic->ic_lintval;
1319                 break;
1320         case IEEE80211_IOC_RTSTHRESHOLD:
1321                 ireq->i_val = ic->ic_rtsthreshold;
1322                 break;
1323         case IEEE80211_IOC_PROTMODE:
1324                 ireq->i_val = ic->ic_protmode;
1325                 break;
1326         case IEEE80211_IOC_TXPOWER:
1327                 if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
1328                         return EINVAL;
1329                 ireq->i_val = ic->ic_txpowlimit;
1330                 break;
1331         case IEEE80211_IOC_MCASTCIPHER:
1332                 ireq->i_val = rsn->rsn_mcastcipher;
1333                 break;
1334         case IEEE80211_IOC_MCASTKEYLEN:
1335                 ireq->i_val = rsn->rsn_mcastkeylen;
1336                 break;
1337         case IEEE80211_IOC_UCASTCIPHERS:
1338                 ireq->i_val = 0;
1339                 for (m = 0x1; m != 0; m <<= 1)
1340                         if (rsn->rsn_ucastcipherset & m)
1341                                 ireq->i_val |= 1<<cap2cipher(m);
1342                 break;
1343         case IEEE80211_IOC_UCASTCIPHER:
1344                 ireq->i_val = rsn->rsn_ucastcipher;
1345                 break;
1346         case IEEE80211_IOC_UCASTKEYLEN:
1347                 ireq->i_val = rsn->rsn_ucastkeylen;
1348                 break;
1349         case IEEE80211_IOC_KEYMGTALGS:
1350                 ireq->i_val = rsn->rsn_keymgmtset;
1351                 break;
1352         case IEEE80211_IOC_RSNCAPS:
1353                 ireq->i_val = rsn->rsn_caps;
1354                 break;
1355         case IEEE80211_IOC_WPA:
1356                 switch (ic->ic_flags & IEEE80211_F_WPA) {
1357                 case IEEE80211_F_WPA1:
1358                         ireq->i_val = 1;
1359                         break;
1360                 case IEEE80211_F_WPA2:
1361                         ireq->i_val = 2;
1362                         break;
1363                 case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
1364                         ireq->i_val = 3;
1365                         break;
1366                 default:
1367                         ireq->i_val = 0;
1368                         break;
1369                 }
1370                 break;
1371         case IEEE80211_IOC_CHANLIST:
1372                 error = ieee80211_ioctl_getchanlist(ic, ireq);
1373                 break;
1374         case IEEE80211_IOC_ROAMING:
1375                 ireq->i_val = ic->ic_roaming;
1376                 break;
1377         case IEEE80211_IOC_PRIVACY:
1378                 ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
1379                 break;
1380         case IEEE80211_IOC_DROPUNENCRYPTED:
1381                 ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
1382                 break;
1383         case IEEE80211_IOC_COUNTERMEASURES:
1384                 ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
1385                 break;
1386         case IEEE80211_IOC_DRIVER_CAPS:
1387                 ireq->i_val = ic->ic_caps>>16;
1388                 ireq->i_len = ic->ic_caps&0xffff;
1389                 break;
1390         case IEEE80211_IOC_WME:
1391                 ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
1392                 break;
1393         case IEEE80211_IOC_HIDESSID:
1394                 ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
1395                 break;
1396         case IEEE80211_IOC_APBRIDGE:
1397                 ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
1398                 break;
1399         case IEEE80211_IOC_OPTIE:
1400                 if (ic->ic_opt_ie == NULL)
1401                         return EINVAL;
1402                 /* NB: truncate, caller can check length */
1403                 if (ireq->i_len > ic->ic_opt_ie_len)
1404                         ireq->i_len = ic->ic_opt_ie_len;
1405                 error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
1406                 break;
1407         case IEEE80211_IOC_WPAKEY:
1408                 error = ieee80211_ioctl_getkey(ic, ireq);
1409                 break;
1410         case IEEE80211_IOC_CHANINFO:
1411                 error = ieee80211_ioctl_getchaninfo(ic, ireq);
1412                 break;
1413         case IEEE80211_IOC_BSSID:
1414                 if (ireq->i_len != IEEE80211_ADDR_LEN)
1415                         return EINVAL;
1416                 error = copyout(ic->ic_state == IEEE80211_S_RUN ?
1417                                         ic->ic_bss->ni_bssid :
1418                                         ic->ic_des_bssid,
1419                                 ireq->i_data, ireq->i_len);
1420                 break;
1421         case IEEE80211_IOC_WPAIE:
1422                 error = ieee80211_ioctl_getwpaie(ic, ireq);
1423                 break;
1424         case IEEE80211_IOC_SCAN_RESULTS:
1425                 error = ieee80211_ioctl_getscanresults(ic, ireq);
1426                 break;
1427         case IEEE80211_IOC_STA_STATS:
1428                 error = ieee80211_ioctl_getstastats(ic, ireq);
1429                 break;
1430         case IEEE80211_IOC_TXPOWMAX:
1431                 ireq->i_val = ic->ic_bss->ni_txpower;
1432                 break;
1433         case IEEE80211_IOC_STA_TXPOW:
1434                 error = ieee80211_ioctl_getstatxpow(ic, ireq);
1435                 break;
1436         case IEEE80211_IOC_STA_INFO:
1437                 error = ieee80211_ioctl_getstainfo(ic, ireq);
1438                 break;
1439         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
1440         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
1441         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
1442         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
1443         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
1444         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (bss only) */
1445                 error = ieee80211_ioctl_getwmeparam(ic, ireq);
1446                 break;
1447         case IEEE80211_IOC_DTIM_PERIOD:
1448                 ireq->i_val = ic->ic_dtim_period;
1449                 break;
1450         case IEEE80211_IOC_BEACON_INTERVAL:
1451                 /* NB: get from ic_bss for station mode */
1452                 ireq->i_val = ic->ic_bss->ni_intval;
1453                 break;
1454         default:
1455                 error = EINVAL;
1456                 break;
1457         }
1458         return error;
1459 }
1460
1461 static int
1462 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
1463 {
1464         int error;
1465         void *ie;
1466
1467         /*
1468          * NB: Doing this for ap operation could be useful (e.g. for
1469          *     WPA and/or WME) except that it typically is worthless
1470          *     without being able to intervene when processing
1471          *     association response frames--so disallow it for now.
1472          */
1473         if (ic->ic_opmode != IEEE80211_M_STA)
1474                 return EINVAL;
1475         if (ireq->i_len > IEEE80211_MAX_OPT_IE)
1476                 return EINVAL;
1477         /* NB: data.length is validated by the wireless extensions code */
1478         MALLOC(ie, void *, ireq->i_len, M_DEVBUF, M_WAITOK);
1479         if (ie == NULL)
1480                 return ENOMEM;
1481         error = copyin(ireq->i_data, ie, ireq->i_len);
1482         /* XXX sanity check data? */
1483         if (ic->ic_opt_ie != NULL)
1484                 FREE(ic->ic_opt_ie, M_DEVBUF);
1485         ic->ic_opt_ie = ie;
1486         ic->ic_opt_ie_len = ireq->i_len;
1487         return 0;
1488 }
1489
1490 static int
1491 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1492 {
1493         struct ieee80211req_key ik;
1494         struct ieee80211_node *ni;
1495         struct ieee80211_key *wk;
1496         u_int16_t kid;
1497         int error;
1498
1499         if (ireq->i_len != sizeof(ik))
1500                 return EINVAL;
1501         error = copyin(ireq->i_data, &ik, sizeof(ik));
1502         if (error)
1503                 return error;
1504         /* NB: cipher support is verified by ieee80211_crypt_newkey */
1505         /* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1506         if (ik.ik_keylen > sizeof(ik.ik_keydata))
1507                 return E2BIG;
1508         kid = ik.ik_keyix;
1509         if (kid == IEEE80211_KEYIX_NONE) {
1510                 /* XXX unicast keys currently must be tx/rx */
1511                 if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1512                         return EINVAL;
1513                 if (ic->ic_opmode == IEEE80211_M_STA) {
1514                         ni = ic->ic_bss;
1515                         if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid))
1516                                 return EADDRNOTAVAIL;
1517                 } else {
1518                         ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
1519                         if (ni == NULL)
1520                                 return ENOENT;
1521                 }
1522                 wk = &ni->ni_ucastkey;
1523         } else {
1524                 if (kid >= IEEE80211_WEP_NKID)
1525                         return EINVAL;
1526                 wk = &ic->ic_nw_keys[kid];
1527                 ni = NULL;
1528                 /* XXX auto-add group key flag until applications are updated */
1529                 if ((ik.ik_flags & IEEE80211_KEY_XMIT) == 0)    /* XXX */
1530                         ik.ik_flags |= IEEE80211_KEY_GROUP;     /* XXX */
1531         }
1532         error = 0;
1533         ieee80211_key_update_begin(ic);
1534         if (ieee80211_crypto_newkey(ic, ik.ik_type, ik.ik_flags, wk)) {
1535                 wk->wk_keylen = ik.ik_keylen;
1536                 /* NB: MIC presence is implied by cipher type */
1537                 if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1538                         wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1539                 wk->wk_keyrsc = ik.ik_keyrsc;
1540                 wk->wk_keytsc = 0;                      /* new key, reset */
1541                 memset(wk->wk_key, 0, sizeof(wk->wk_key));
1542                 memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1543                 if (!ieee80211_crypto_setkey(ic, wk,
1544                     ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
1545                         error = EIO;
1546                 else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1547                         ic->ic_def_txkey = kid;
1548         } else
1549                 error = ENXIO;
1550         ieee80211_key_update_end(ic);
1551         if (ni != NULL)
1552                 ieee80211_free_node(ni);
1553         return error;
1554 }
1555
1556 static int
1557 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1558 {
1559         struct ieee80211req_del_key dk;
1560         int kid, error;
1561
1562         if (ireq->i_len != sizeof(dk))
1563                 return EINVAL;
1564         error = copyin(ireq->i_data, &dk, sizeof(dk));
1565         if (error)
1566                 return error;
1567         kid = dk.idk_keyix;
1568         /* XXX u_int8_t -> u_int16_t */
1569         if (dk.idk_keyix == (u_int8_t) IEEE80211_KEYIX_NONE) {
1570                 struct ieee80211_node *ni;
1571
1572                 ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
1573                 if (ni == NULL)
1574                         return EINVAL;          /* XXX */
1575                 /* XXX error return */
1576                 ieee80211_crypto_delkey(ic, &ni->ni_ucastkey);
1577                 ieee80211_free_node(ni);
1578         } else {
1579                 if (kid >= IEEE80211_WEP_NKID)
1580                         return EINVAL;
1581                 /* XXX error return */
1582                 ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
1583         }
1584         return 0;
1585 }
1586
1587 static void
1588 domlme(void *arg, struct ieee80211_node *ni)
1589 {
1590         struct ieee80211com *ic = ni->ni_ic;
1591         struct ieee80211req_mlme *mlme = arg;
1592
1593         if (ni->ni_associd != 0) {
1594                 IEEE80211_SEND_MGMT(ic, ni,
1595                         mlme->im_op == IEEE80211_MLME_DEAUTH ?
1596                                 IEEE80211_FC0_SUBTYPE_DEAUTH :
1597                                 IEEE80211_FC0_SUBTYPE_DISASSOC,
1598                         mlme->im_reason);
1599         }
1600         ieee80211_node_leave(ic, ni);
1601 }
1602
1603 static int
1604 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
1605 {
1606         struct ieee80211req_mlme mlme;
1607         struct ieee80211_node *ni;
1608         int error;
1609
1610         if (ireq->i_len != sizeof(mlme))
1611                 return EINVAL;
1612         error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1613         if (error)
1614                 return error;
1615         switch (mlme.im_op) {
1616         case IEEE80211_MLME_ASSOC:
1617                 if (ic->ic_opmode != IEEE80211_M_STA)
1618                         return EINVAL;
1619                 /* XXX must be in S_SCAN state? */
1620
1621                 if (ic->ic_des_esslen != 0) {
1622                         /*
1623                          * Desired ssid specified; must match both bssid and
1624                          * ssid to distinguish ap advertising multiple ssid's.
1625                          */
1626                         ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
1627                                 mlme.im_macaddr,
1628                                 ic->ic_des_esslen, ic->ic_des_essid);
1629                 } else {
1630                         /*
1631                          * Normal case; just match bssid.
1632                          */
1633                         ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
1634                 }
1635                 if (ni == NULL)
1636                         return EINVAL;
1637                 if (!ieee80211_sta_join(ic, ni)) {
1638                         ieee80211_free_node(ni);
1639                         return EINVAL;
1640                 }
1641                 break;
1642         case IEEE80211_MLME_DISASSOC:
1643         case IEEE80211_MLME_DEAUTH:
1644                 switch (ic->ic_opmode) {
1645                 case IEEE80211_M_STA:
1646                         /* XXX not quite right */
1647                         ieee80211_new_state(ic, IEEE80211_S_INIT,
1648                                 mlme.im_reason);
1649                         break;
1650                 case IEEE80211_M_HOSTAP:
1651                         /* NB: the broadcast address means do 'em all */
1652                         if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
1653                                 if ((ni = ieee80211_find_node(&ic->ic_sta,
1654                                                 mlme.im_macaddr)) == NULL)
1655                                         return EINVAL;
1656                                 domlme(&mlme, ni);
1657                                 ieee80211_free_node(ni);
1658                         } else {
1659                                 ieee80211_iterate_nodes(&ic->ic_sta,
1660                                                 domlme, &mlme);
1661                         }
1662                         break;
1663                 default:
1664                         return EINVAL;
1665                 }
1666                 break;
1667         case IEEE80211_MLME_AUTHORIZE:
1668         case IEEE80211_MLME_UNAUTHORIZE:
1669                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1670                         return EINVAL;
1671                 ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
1672                 if (ni == NULL)
1673                         return EINVAL;
1674                 if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
1675                         ieee80211_node_authorize(ic, ni);
1676                 else
1677                         ieee80211_node_unauthorize(ic, ni);
1678                 ieee80211_free_node(ni);
1679                 break;
1680         default:
1681                 return EINVAL;
1682         }
1683         return 0;
1684 }
1685
1686 static int
1687 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
1688 {
1689         u_int8_t mac[IEEE80211_ADDR_LEN];
1690         const struct ieee80211_aclator *acl = ic->ic_acl;
1691         int error;
1692
1693         if (ireq->i_len != sizeof(mac))
1694                 return EINVAL;
1695         error = copyin(ireq->i_data, mac, ireq->i_len);
1696         if (error)
1697                 return error;
1698         if (acl == NULL) {
1699                 acl = ieee80211_aclator_get("mac");
1700                 if (acl == NULL || !acl->iac_attach(ic))
1701                         return EINVAL;
1702                 ic->ic_acl = acl;
1703         }
1704         if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1705                 acl->iac_add(ic, mac);
1706         else
1707                 acl->iac_remove(ic, mac);
1708         return 0;
1709 }
1710
1711 static int
1712 ieee80211_ioctl_maccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1713 {
1714         const struct ieee80211_aclator *acl = ic->ic_acl;
1715
1716         switch (ireq->i_val) {
1717         case IEEE80211_MACCMD_POLICY_OPEN:
1718         case IEEE80211_MACCMD_POLICY_ALLOW:
1719         case IEEE80211_MACCMD_POLICY_DENY:
1720                 if (acl == NULL) {
1721                         acl = ieee80211_aclator_get("mac");
1722                         if (acl == NULL || !acl->iac_attach(ic))
1723                                 return EINVAL;
1724                         ic->ic_acl = acl;
1725                 }
1726                 acl->iac_setpolicy(ic, ireq->i_val);
1727                 break;
1728         case IEEE80211_MACCMD_FLUSH:
1729                 if (acl != NULL)
1730                         acl->iac_flush(ic);
1731                 /* NB: silently ignore when not in use */
1732                 break;
1733         case IEEE80211_MACCMD_DETACH:
1734                 if (acl != NULL) {
1735                         ic->ic_acl = NULL;
1736                         acl->iac_detach(ic);
1737                 }
1738                 break;
1739         default:
1740                 return EINVAL;
1741         }
1742         return 0;
1743 }
1744
1745 static int
1746 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
1747 {
1748         struct ieee80211req_chanlist list;
1749         u_char chanlist[IEEE80211_CHAN_BYTES];
1750         int i, j, error;
1751
1752         if (ireq->i_len != sizeof(list))
1753                 return EINVAL;
1754         error = copyin(ireq->i_data, &list, sizeof(list));
1755         if (error)
1756                 return error;
1757         memset(chanlist, 0, sizeof(chanlist));
1758         /*
1759          * Since channel 0 is not available for DS, channel 1
1760          * is assigned to LSB on WaveLAN.
1761          */
1762         if (ic->ic_phytype == IEEE80211_T_DS)
1763                 i = 1;
1764         else
1765                 i = 0;
1766         for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
1767                 /*
1768                  * NB: silently discard unavailable channels so users
1769                  *     can specify 1-255 to get all available channels.
1770                  */
1771                 if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
1772                         setbit(chanlist, i);
1773         }
1774         if (ic->ic_ibss_chan == NULL ||
1775             isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1776                 for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1777                         if (isset(chanlist, i)) {
1778                                 ic->ic_ibss_chan = &ic->ic_channels[i];
1779                                 goto found;
1780                         }
1781                 return EINVAL;                  /* no active channels */
1782 found:
1783                 ;
1784         }
1785         memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
1786         if (ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC ||
1787             isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan)))
1788                 ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1789         return IS_UP_AUTO(ic) ? ENETRESET : 0;
1790 }
1791
1792 static int
1793 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1794 {
1795         struct ieee80211_node *ni;
1796         struct ieee80211req_sta_txpow txpow;
1797         int error;
1798
1799         if (ireq->i_len != sizeof(txpow))
1800                 return EINVAL;
1801         error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1802         if (error != 0)
1803                 return error;
1804         ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1805         if (ni == NULL)
1806                 return EINVAL;          /* XXX */
1807         ni->ni_txpower = txpow.it_txpow;
1808         ieee80211_free_node(ni);
1809         return error;
1810 }
1811
1812 static int
1813 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1814 {
1815         struct ieee80211_wme_state *wme = &ic->ic_wme;
1816         struct wmeParams *wmep, *chanp;
1817         int isbss, ac;
1818
1819         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1820                 return EINVAL;
1821
1822         isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1823         ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1824         if (ac >= WME_NUM_AC)
1825                 ac = WME_AC_BE;
1826         if (isbss) {
1827                 chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1828                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1829         } else {
1830                 chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1831                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1832         }
1833         switch (ireq->i_type) {
1834         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
1835                 if (isbss) {
1836                         wmep->wmep_logcwmin = ireq->i_val;
1837                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1838                                 chanp->wmep_logcwmin = ireq->i_val;
1839                 } else {
1840                         wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1841                                 ireq->i_val;
1842                 }
1843                 break;
1844         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
1845                 if (isbss) {
1846                         wmep->wmep_logcwmax = ireq->i_val;
1847                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1848                                 chanp->wmep_logcwmax = ireq->i_val;
1849                 } else {
1850                         wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1851                                 ireq->i_val;
1852                 }
1853                 break;
1854         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
1855                 if (isbss) {
1856                         wmep->wmep_aifsn = ireq->i_val;
1857                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1858                                 chanp->wmep_aifsn = ireq->i_val;
1859                 } else {
1860                         wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
1861                 }
1862                 break;
1863         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
1864                 if (isbss) {
1865                         wmep->wmep_txopLimit = ireq->i_val;
1866                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1867                                 chanp->wmep_txopLimit = ireq->i_val;
1868                 } else {
1869                         wmep->wmep_txopLimit = chanp->wmep_txopLimit =
1870                                 ireq->i_val;
1871                 }
1872                 break;
1873         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
1874                 wmep->wmep_acm = ireq->i_val;
1875                 if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1876                         chanp->wmep_acm = ireq->i_val;
1877                 break;
1878         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (!bss only)*/
1879                 wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1880                         (ireq->i_val) == 0;
1881                 break;
1882         }
1883         ieee80211_wme_updateparams(ic);
1884         return 0;
1885 }
1886
1887 static int
1888 cipher2cap(int cipher)
1889 {
1890         switch (cipher) {
1891         case IEEE80211_CIPHER_WEP:      return IEEE80211_C_WEP;
1892         case IEEE80211_CIPHER_AES_OCB:  return IEEE80211_C_AES;
1893         case IEEE80211_CIPHER_AES_CCM:  return IEEE80211_C_AES_CCM;
1894         case IEEE80211_CIPHER_CKIP:     return IEEE80211_C_CKIP;
1895         case IEEE80211_CIPHER_TKIP:     return IEEE80211_C_TKIP;
1896         }
1897         return 0;
1898 }
1899
1900 static int
1901 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
1902 {
1903         static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
1904         struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1905         int error;
1906         const struct ieee80211_authenticator *auth;
1907         u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1908         char tmpssid[IEEE80211_NWID_LEN];
1909         u_int8_t tmpbssid[IEEE80211_ADDR_LEN];
1910         struct ieee80211_key *k;
1911         int j, caps;
1912         u_int kid;
1913
1914         error = 0;
1915         switch (ireq->i_type) {
1916         case IEEE80211_IOC_SSID:
1917                 if (ireq->i_val != 0 ||
1918                     ireq->i_len > IEEE80211_NWID_LEN)
1919                         return EINVAL;
1920                 error = copyin(ireq->i_data, tmpssid, ireq->i_len);
1921                 if (error)
1922                         break;
1923                 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
1924                 ic->ic_des_esslen = ireq->i_len;
1925                 memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
1926                 error = ENETRESET;
1927                 break;
1928         case IEEE80211_IOC_WEP:
1929                 switch (ireq->i_val) {
1930                 case IEEE80211_WEP_OFF:
1931                         ic->ic_flags &= ~IEEE80211_F_PRIVACY;
1932                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1933                         break;
1934                 case IEEE80211_WEP_ON:
1935                         ic->ic_flags |= IEEE80211_F_PRIVACY;
1936                         ic->ic_flags |= IEEE80211_F_DROPUNENC;
1937                         break;
1938                 case IEEE80211_WEP_MIXED:
1939                         ic->ic_flags |= IEEE80211_F_PRIVACY;
1940                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
1941                         break;
1942                 }
1943                 error = ENETRESET;
1944                 break;
1945         case IEEE80211_IOC_WEPKEY:
1946                 kid = (u_int) ireq->i_val;
1947                 if (kid >= IEEE80211_WEP_NKID)
1948                         return EINVAL;
1949                 k = &ic->ic_nw_keys[kid];
1950                 if (ireq->i_len == 0) {
1951                         /* zero-len =>'s delete any existing key */
1952                         (void) ieee80211_crypto_delkey(ic, k);
1953                         break;
1954                 }
1955                 if (ireq->i_len > sizeof(tmpkey))
1956                         return EINVAL;
1957                 memset(tmpkey, 0, sizeof(tmpkey));
1958                 error = copyin(ireq->i_data, tmpkey, ireq->i_len);
1959                 if (error)
1960                         break;
1961                 ieee80211_key_update_begin(ic);
1962                 k->wk_keyix = kid;      /* NB: force fixed key id */
1963                 if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
1964                     IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
1965                         k->wk_keylen = ireq->i_len;
1966                         memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
1967                         if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
1968                                 error = EINVAL;
1969                 } else
1970                         error = EINVAL;
1971                 ieee80211_key_update_end(ic);
1972                 break;
1973         case IEEE80211_IOC_WEPTXKEY:
1974                 kid = (u_int) ireq->i_val;
1975                 if (kid >= IEEE80211_WEP_NKID &&
1976                     (u_int16_t) kid != IEEE80211_KEYIX_NONE)
1977                         return EINVAL;
1978                 ic->ic_def_txkey = kid;
1979                 error = ENETRESET;      /* push to hardware */
1980                 break;
1981         case IEEE80211_IOC_AUTHMODE:
1982                 switch (ireq->i_val) {
1983                 case IEEE80211_AUTH_WPA:
1984                 case IEEE80211_AUTH_8021X:      /* 802.1x */
1985                 case IEEE80211_AUTH_OPEN:       /* open */
1986                 case IEEE80211_AUTH_SHARED:     /* shared-key */
1987                 case IEEE80211_AUTH_AUTO:       /* auto */
1988                         auth = ieee80211_authenticator_get(ireq->i_val);
1989                         if (auth == NULL)
1990                                 return EINVAL;
1991                         break;
1992                 default:
1993                         return EINVAL;
1994                 }
1995                 switch (ireq->i_val) {
1996                 case IEEE80211_AUTH_WPA:        /* WPA w/ 802.1x */
1997                         ic->ic_flags |= IEEE80211_F_PRIVACY;
1998                         ireq->i_val = IEEE80211_AUTH_8021X;
1999                         break;
2000                 case IEEE80211_AUTH_OPEN:       /* open */
2001                         ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2002                         break;
2003                 case IEEE80211_AUTH_SHARED:     /* shared-key */
2004                 case IEEE80211_AUTH_8021X:      /* 802.1x */
2005                         ic->ic_flags &= ~IEEE80211_F_WPA;
2006                         /* both require a key so mark the PRIVACY capability */
2007                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2008                         break;
2009                 case IEEE80211_AUTH_AUTO:       /* auto */
2010                         ic->ic_flags &= ~IEEE80211_F_WPA;
2011                         /* XXX PRIVACY handling? */
2012                         /* XXX what's the right way to do this? */
2013                         break;
2014                 }
2015                 /* NB: authenticator attach/detach happens on state change */
2016                 ic->ic_bss->ni_authmode = ireq->i_val;
2017                 /* XXX mixed/mode/usage? */
2018                 ic->ic_auth = auth;
2019                 error = ENETRESET;
2020                 break;
2021         case IEEE80211_IOC_CHANNEL:
2022                 /* XXX 0xffff overflows 16-bit signed */
2023                 if (ireq->i_val == 0 ||
2024                     ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
2025                         ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2026                 else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
2027                     isclr(ic->ic_chan_active, ireq->i_val)) {
2028                         return EINVAL;
2029                 } else
2030                         ic->ic_ibss_chan = ic->ic_des_chan =
2031                                 &ic->ic_channels[ireq->i_val];
2032                 switch (ic->ic_state) {
2033                 case IEEE80211_S_INIT:
2034                 case IEEE80211_S_SCAN:
2035                         error = ENETRESET;
2036                         break;
2037                 default:
2038                         /*
2039                          * If the desired channel has changed (to something
2040                          * other than any) and we're not already scanning,
2041                          * then kick the state machine.
2042                          */
2043                         if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2044                             ic->ic_bss->ni_chan != ic->ic_des_chan &&
2045                             (ic->ic_flags & IEEE80211_F_SCAN) == 0)
2046                                 error = ENETRESET;
2047                         break;
2048                 }
2049                 if (error == ENETRESET && ic->ic_opmode == IEEE80211_M_MONITOR)
2050                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2051                 break;
2052         case IEEE80211_IOC_POWERSAVE:
2053                 switch (ireq->i_val) {
2054                 case IEEE80211_POWERSAVE_OFF:
2055                         if (ic->ic_flags & IEEE80211_F_PMGTON) {
2056                                 ic->ic_flags &= ~IEEE80211_F_PMGTON;
2057                                 error = ENETRESET;
2058                         }
2059                         break;
2060                 case IEEE80211_POWERSAVE_ON:
2061                         if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2062                                 error = EINVAL;
2063                         else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2064                                 ic->ic_flags |= IEEE80211_F_PMGTON;
2065                                 error = ENETRESET;
2066                         }
2067                         break;
2068                 default:
2069                         error = EINVAL;
2070                         break;
2071                 }
2072                 break;
2073         case IEEE80211_IOC_POWERSAVESLEEP:
2074                 if (ireq->i_val < 0)
2075                         return EINVAL;
2076                 ic->ic_lintval = ireq->i_val;
2077                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2078                 break;
2079         case IEEE80211_IOC_RTSTHRESHOLD:
2080                 if (!(IEEE80211_RTS_MIN < ireq->i_val &&
2081                       ireq->i_val < IEEE80211_RTS_MAX))
2082                         return EINVAL;
2083                 ic->ic_rtsthreshold = ireq->i_val;
2084                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2085                 break;
2086         case IEEE80211_IOC_PROTMODE:
2087                 if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2088                         return EINVAL;
2089                 ic->ic_protmode = ireq->i_val;
2090                 /* NB: if not operating in 11g this can wait */
2091                 if (ic->ic_curmode == IEEE80211_MODE_11G)
2092                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2093                 break;
2094         case IEEE80211_IOC_TXPOWER:
2095                 if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2096                         return EINVAL;
2097                 if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
2098                       ireq->i_val < IEEE80211_TXPOWER_MAX))
2099                         return EINVAL;
2100                 ic->ic_txpowlimit = ireq->i_val;
2101                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2102                 break;
2103         case IEEE80211_IOC_ROAMING:
2104                 if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2105                     ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2106                         return EINVAL;
2107                 ic->ic_roaming = ireq->i_val;
2108                 /* XXXX reset? */
2109                 break;
2110         case IEEE80211_IOC_PRIVACY:
2111                 if (ireq->i_val) {
2112                         /* XXX check for key state? */
2113                         ic->ic_flags |= IEEE80211_F_PRIVACY;
2114                 } else
2115                         ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2116                 break;
2117         case IEEE80211_IOC_DROPUNENCRYPTED:
2118                 if (ireq->i_val)
2119                         ic->ic_flags |= IEEE80211_F_DROPUNENC;
2120                 else
2121                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2122                 break;
2123         case IEEE80211_IOC_WPAKEY:
2124                 error = ieee80211_ioctl_setkey(ic, ireq);
2125                 break;
2126         case IEEE80211_IOC_DELKEY:
2127                 error = ieee80211_ioctl_delkey(ic, ireq);
2128                 break;
2129         case IEEE80211_IOC_MLME:
2130                 error = ieee80211_ioctl_setmlme(ic, ireq);
2131                 break;
2132         case IEEE80211_IOC_OPTIE:
2133                 error = ieee80211_ioctl_setoptie(ic, ireq);
2134                 break;
2135         case IEEE80211_IOC_COUNTERMEASURES:
2136                 if (ireq->i_val) {
2137                         if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
2138                                 return EINVAL;
2139                         ic->ic_flags |= IEEE80211_F_COUNTERM;
2140                 } else
2141                         ic->ic_flags &= ~IEEE80211_F_COUNTERM;
2142                 break;
2143         case IEEE80211_IOC_WPA:
2144                 if (ireq->i_val > 3)
2145                         return EINVAL;
2146                 /* XXX verify ciphers available */
2147                 ic->ic_flags &= ~IEEE80211_F_WPA;
2148                 switch (ireq->i_val) {
2149                 case 1:
2150                         ic->ic_flags |= IEEE80211_F_WPA1;
2151                         break;
2152                 case 2:
2153                         ic->ic_flags |= IEEE80211_F_WPA2;
2154                         break;
2155                 case 3:
2156                         ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2157                         break;
2158                 }
2159                 error = ENETRESET;              /* XXX? */
2160                 break;
2161         case IEEE80211_IOC_WME:
2162                 if (ireq->i_val) {
2163                         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
2164                                 return EINVAL;
2165                         ic->ic_flags |= IEEE80211_F_WME;
2166                 } else
2167                         ic->ic_flags &= ~IEEE80211_F_WME;
2168                 error = ENETRESET;              /* XXX maybe not for station? */
2169                 break;
2170         case IEEE80211_IOC_HIDESSID:
2171                 if (ireq->i_val)
2172                         ic->ic_flags |= IEEE80211_F_HIDESSID;
2173                 else
2174                         ic->ic_flags &= ~IEEE80211_F_HIDESSID;
2175                 error = ENETRESET;
2176                 break;
2177         case IEEE80211_IOC_APBRIDGE:
2178                 if (ireq->i_val == 0)
2179                         ic->ic_flags |= IEEE80211_F_NOBRIDGE;
2180                 else
2181                         ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
2182                 break;
2183         case IEEE80211_IOC_MCASTCIPHER:
2184                 if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
2185                     !ieee80211_crypto_available(ireq->i_val))
2186                         return EINVAL;
2187                 rsn->rsn_mcastcipher = ireq->i_val;
2188                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2189                 break;
2190         case IEEE80211_IOC_MCASTKEYLEN:
2191                 if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2192                         return EINVAL;
2193                 /* XXX no way to verify driver capability */
2194                 rsn->rsn_mcastkeylen = ireq->i_val;
2195                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2196                 break;
2197         case IEEE80211_IOC_UCASTCIPHERS:
2198                 /*
2199                  * Convert user-specified cipher set to the set
2200                  * we can support (via hardware or software).
2201                  * NB: this logic intentionally ignores unknown and
2202                  * unsupported ciphers so folks can specify 0xff or
2203                  * similar and get all available ciphers.
2204                  */
2205                 caps = 0;
2206                 for (j = 1; j < 32; j++)        /* NB: skip WEP */
2207                         if ((ireq->i_val & (1<<j)) &&
2208                             ((ic->ic_caps & cipher2cap(j)) ||
2209                              ieee80211_crypto_available(j)))
2210                                 caps |= 1<<j;
2211                 if (caps == 0)                  /* nothing available */
2212                         return EINVAL;
2213                 /* XXX verify ciphers ok for unicast use? */
2214                 /* XXX disallow if running as it'll have no effect */
2215                 rsn->rsn_ucastcipherset = caps;
2216                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2217                 break;
2218         case IEEE80211_IOC_UCASTCIPHER:
2219                 if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
2220                         return EINVAL;
2221                 rsn->rsn_ucastcipher = ireq->i_val;
2222                 break;
2223         case IEEE80211_IOC_UCASTKEYLEN:
2224                 if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2225                         return EINVAL;
2226                 /* XXX no way to verify driver capability */
2227                 rsn->rsn_ucastkeylen = ireq->i_val;
2228                 break;
2229         case IEEE80211_IOC_DRIVER_CAPS:
2230                 /* NB: for testing */
2231                 ic->ic_caps = (((u_int16_t) ireq->i_val) << 16) |
2232                                ((u_int16_t) ireq->i_len);
2233                 break;
2234         case IEEE80211_IOC_KEYMGTALGS:
2235                 /* XXX check */
2236                 rsn->rsn_keymgmtset = ireq->i_val;
2237                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2238                 break;
2239         case IEEE80211_IOC_RSNCAPS:
2240                 /* XXX check */
2241                 rsn->rsn_caps = ireq->i_val;
2242                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2243                 break;
2244         case IEEE80211_IOC_BSSID:
2245                 /* NB: should only be set when in STA mode */
2246                 if (ic->ic_opmode != IEEE80211_M_STA)
2247                         return EINVAL;
2248                 if (ireq->i_len != sizeof(tmpbssid))
2249                         return EINVAL;
2250                 error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2251                 if (error)
2252                         break;
2253                 IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
2254                 if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2255                         ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2256                 else
2257                         ic->ic_flags |= IEEE80211_F_DESBSSID;
2258                 error = ENETRESET;
2259                 break;
2260         case IEEE80211_IOC_CHANLIST:
2261                 error = ieee80211_ioctl_setchanlist(ic, ireq);
2262                 break;
2263         case IEEE80211_IOC_SCAN_REQ:
2264                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)        /* XXX ignore */
2265                         break;
2266                 error = ieee80211_setupscan(ic, ic->ic_chan_avail);
2267                 if (error == 0)         /* XXX background scan */
2268                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2269                 break;
2270         case IEEE80211_IOC_ADDMAC:
2271         case IEEE80211_IOC_DELMAC:
2272                 error = ieee80211_ioctl_macmac(ic, ireq);
2273                 break;
2274         case IEEE80211_IOC_MACCMD:
2275                 error = ieee80211_ioctl_maccmd(ic, ireq);
2276                 break;
2277         case IEEE80211_IOC_STA_TXPOW:
2278                 error = ieee80211_ioctl_setstatxpow(ic, ireq);
2279                 break;
2280         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
2281         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
2282         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
2283         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
2284         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
2285         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (bss only) */
2286                 error = ieee80211_ioctl_setwmeparam(ic, ireq);
2287                 break;
2288         case IEEE80211_IOC_DTIM_PERIOD:
2289                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2290                     ic->ic_opmode != IEEE80211_M_IBSS)
2291                         return EINVAL;
2292                 if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2293                     ireq->i_val <= IEEE80211_DTIM_MAX) {
2294                         ic->ic_dtim_period = ireq->i_val;
2295                         error = ENETRESET;              /* requires restart */
2296                 } else
2297                         error = EINVAL;
2298                 break;
2299         case IEEE80211_IOC_BEACON_INTERVAL:
2300                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2301                     ic->ic_opmode != IEEE80211_M_IBSS)
2302                         return EINVAL;
2303                 if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2304                     ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2305                         ic->ic_lintval = ireq->i_val;
2306                         error = ENETRESET;              /* requires restart */
2307                 } else
2308                         error = EINVAL;
2309                 break;
2310         default:
2311                 error = EINVAL;
2312                 break;
2313         }
2314         if (error == ENETRESET && !IS_UP_AUTO(ic))
2315                 error = 0;
2316         return error;
2317 }
2318
2319 int
2320 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, caddr_t data)
2321 {
2322         struct ifnet *ifp = ic->ic_ifp;
2323         int error = 0;
2324         struct ifreq *ifr;
2325         struct ifaddr *ifa;                     /* XXX */
2326
2327         switch (cmd) {
2328         case SIOCSIFMEDIA:
2329         case SIOCGIFMEDIA:
2330                 error = ifmedia_ioctl(ifp, (struct ifreq *) data,
2331                                 &ic->ic_media, cmd);
2332                 break;
2333         case SIOCG80211:
2334                 error = ieee80211_ioctl_get80211(ic, cmd,
2335                                 (struct ieee80211req *) data);
2336                 break;
2337         case SIOCS80211:
2338                 error = suser(curthread);
2339                 if (error == 0)
2340                         error = ieee80211_ioctl_set80211(ic, cmd,
2341                                         (struct ieee80211req *) data);
2342                 break;
2343         case SIOCGIFGENERIC:
2344                 error = ieee80211_cfgget(ic, cmd, data);
2345                 break;
2346         case SIOCSIFGENERIC:
2347                 error = suser(curthread);
2348                 if (error)
2349                         break;
2350                 error = ieee80211_cfgset(ic, cmd, data);
2351                 break;
2352         case SIOCG80211STATS:
2353                 ifr = (struct ifreq *)data;
2354                 copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
2355                 break;
2356         case SIOCSIFMTU:
2357                 ifr = (struct ifreq *)data;
2358                 if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2359                     ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2360                         error = EINVAL;
2361                 else
2362                         ifp->if_mtu = ifr->ifr_mtu;
2363                 break;
2364         case SIOCSIFADDR:
2365                 /*
2366                  * XXX Handle this directly so we can supress if_init calls.
2367                  * XXX This should be done in ether_ioctl but for the moment
2368                  * XXX there are too many other parts of the system that
2369                  * XXX set IFF_UP and so supress if_init being called when
2370                  * XXX it should be.
2371                  */
2372                 ifa = (struct ifaddr *) data;
2373                 switch (ifa->ifa_addr->sa_family) {
2374 #ifdef INET
2375                 case AF_INET:
2376                         if ((ifp->if_flags & IFF_UP) == 0) {
2377                                 ifp->if_flags |= IFF_UP;
2378                                 ifp->if_init(ifp->if_softc);
2379                         }
2380                         arp_ifinit(ifp, ifa);
2381                         break;
2382 #endif
2383 #ifdef IPX
2384                 /*
2385                  * XXX - This code is probably wrong,
2386                  *       but has been copied many times.
2387                  */
2388                 case AF_IPX: {
2389                         struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
2390                         struct arpcom *ac = (struct arpcom *)ifp;
2391
2392                         if (ipx_nullhost(*ina))
2393                                 ina->x_host = *(union ipx_host *) ac->ac_enaddr;
2394                         else
2395                                 bcopy((caddr_t) ina->x_host.c_host,
2396                                       (caddr_t) ac->ac_enaddr,
2397                                       sizeof(ac->ac_enaddr));
2398                         /* fall thru... */
2399                 }
2400 #endif
2401                 default:
2402                         if ((ifp->if_flags & IFF_UP) == 0) {
2403                                 ifp->if_flags |= IFF_UP;
2404                                 ifp->if_init(ifp->if_softc);
2405                         }
2406                         break;
2407                 }
2408                 break;
2409         default:
2410                 error = ether_ioctl(ifp, cmd, data);
2411                 break;
2412         }
2413         return error;
2414 }