The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_ioctl.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001 Atsushi Onoe
    3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
    4  * All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions
    8  * are met:
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  * 3. The name of the author may not be used to endorse or promote products
   15  *    derived from this software without specific prior written permission.
   16  *
   17  * Alternatively, this software may be distributed under the terms of the
   18  * GNU General Public License ("GPL") version 2 as published by the Free
   19  * Software Foundation.
   20  *
   21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/cdefs.h>
   34 __FBSDID("$FreeBSD: releng/6.0/sys/net80211/ieee80211_ioctl.c 154808 2006-01-25 10:01:26Z cperciva $");
   35 
   36 /*
   37  * IEEE 802.11 ioctl support (FreeBSD-specific)
   38  */
   39 
   40 #include "opt_inet.h"
   41 #include "opt_ipx.h"
   42 
   43 #include <sys/endian.h>
   44 #include <sys/param.h>
   45 #include <sys/kernel.h>
   46 #include <sys/socket.h>
   47 #include <sys/sockio.h>
   48 #include <sys/systm.h>
   49  
   50 #include <net/if.h>
   51 #include <net/if_arp.h>
   52 #include <net/if_media.h>
   53 #include <net/ethernet.h>
   54 
   55 #ifdef INET
   56 #include <netinet/in.h>
   57 #include <netinet/if_ether.h>
   58 #endif
   59 
   60 #ifdef IPX
   61 #include <netipx/ipx.h>
   62 #include <netipx/ipx_if.h>
   63 #endif
   64 
   65 #include <net80211/ieee80211_var.h>
   66 #include <net80211/ieee80211_ioctl.h>
   67 
   68 #include <dev/wi/if_wavelan_ieee.h>
   69 
   70 #define IS_UP(_ic) \
   71         (((_ic)->ic_ifp->if_flags & IFF_UP) &&                  \
   72             ((_ic)->ic_ifp->if_drv_flags & IFF_DRV_RUNNING))
   73 #define IS_UP_AUTO(_ic) \
   74         (IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
   75 
   76 /*
   77  * XXX
   78  * Wireless LAN specific configuration interface, which is compatible
   79  * with wicontrol(8).
   80  */
   81 
   82 struct wi_read_ap_args {
   83         int     i;              /* result count */
   84         struct wi_apinfo *ap;   /* current entry in result buffer */
   85         caddr_t max;            /* result buffer bound */
   86 };
   87 
   88 static void
   89 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
   90 {
   91         struct ieee80211com *ic = ni->ni_ic;
   92         struct wi_read_ap_args *sa = arg;
   93         struct wi_apinfo *ap = sa->ap;
   94         struct ieee80211_rateset *rs;
   95         int j;
   96 
   97         if ((caddr_t)(ap + 1) > sa->max)
   98                 return;
   99         memset(ap, 0, sizeof(struct wi_apinfo));
  100         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
  101                 IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
  102                 ap->namelen = ic->ic_des_esslen;
  103                 if (ic->ic_des_esslen)
  104                         memcpy(ap->name, ic->ic_des_essid,
  105                             ic->ic_des_esslen);
  106         } else {
  107                 IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
  108                 ap->namelen = ni->ni_esslen;
  109                 if (ni->ni_esslen)
  110                         memcpy(ap->name, ni->ni_essid,
  111                             ni->ni_esslen);
  112         }
  113         ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
  114         ap->signal = ic->ic_node_getrssi(ni);
  115         ap->capinfo = ni->ni_capinfo;
  116         ap->interval = ni->ni_intval;
  117         rs = &ni->ni_rates;
  118         for (j = 0; j < rs->rs_nrates; j++) {
  119                 if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
  120                         ap->rate = (rs->rs_rates[j] &
  121                             IEEE80211_RATE_VAL) * 5; /* XXX */
  122                 }
  123         }
  124         sa->i++;
  125         sa->ap++;
  126 }
  127 
  128 struct wi_read_prism2_args {
  129         int     i;              /* result count */
  130         struct wi_scan_res *res;/* current entry in result buffer */
  131         caddr_t max;            /* result buffer bound */
  132 };
  133 
  134 static void
  135 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
  136 {
  137         struct ieee80211com *ic = ni->ni_ic;
  138         struct wi_read_prism2_args *sa = arg;
  139         struct wi_scan_res *res = sa->res;
  140 
  141         if ((caddr_t)(res + 1) > sa->max)
  142                 return;
  143         res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
  144         res->wi_noise = 0;
  145         res->wi_signal = ic->ic_node_getrssi(ni);
  146         IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
  147         res->wi_interval = ni->ni_intval;
  148         res->wi_capinfo = ni->ni_capinfo;
  149         res->wi_ssid_len = ni->ni_esslen;
  150         memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
  151         /* NB: assumes wi_srates holds <= ni->ni_rates */
  152         memcpy(res->wi_srates, ni->ni_rates.rs_rates,
  153                 sizeof(res->wi_srates));
  154         if (ni->ni_rates.rs_nrates < 10)
  155                 res->wi_srates[ni->ni_rates.rs_nrates] = 0;
  156         res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
  157         res->wi_rsvd = 0;
  158 
  159         sa->i++;
  160         sa->res++;
  161 }
  162 
  163 struct wi_read_sigcache_args {
  164         int     i;              /* result count */
  165         struct wi_sigcache *wsc;/* current entry in result buffer */
  166         caddr_t max;            /* result buffer bound */
  167 };
  168 
  169 static void
  170 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
  171 {
  172         struct ieee80211com *ic = ni->ni_ic;
  173         struct wi_read_sigcache_args *sa = arg;
  174         struct wi_sigcache *wsc = sa->wsc;
  175 
  176         if ((caddr_t)(wsc + 1) > sa->max)
  177                 return;
  178         memset(wsc, 0, sizeof(struct wi_sigcache));
  179         IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
  180         wsc->signal = ic->ic_node_getrssi(ni);
  181 
  182         sa->wsc++;
  183         sa->i++;
  184 }
  185 
  186 int
  187 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, caddr_t data)
  188 {
  189         struct ifnet *ifp = ic->ic_ifp;
  190         int i, j, error;
  191         struct ifreq *ifr = (struct ifreq *)data;
  192         struct wi_req wreq;
  193         struct wi_ltv_keys *keys;
  194 
  195         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
  196         if (error)
  197                 return error;
  198         wreq.wi_len = 0;
  199         switch (wreq.wi_type) {
  200         case WI_RID_SERIALNO:
  201                 /* nothing appropriate */
  202                 break;
  203         case WI_RID_NODENAME:
  204                 strcpy((char *)&wreq.wi_val[1], hostname);
  205                 wreq.wi_val[0] = htole16(strlen(hostname));
  206                 wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
  207                 break;
  208         case WI_RID_CURRENT_SSID:
  209                 if (ic->ic_state != IEEE80211_S_RUN) {
  210                         wreq.wi_val[0] = 0;
  211                         wreq.wi_len = 1;
  212                         break;
  213                 }
  214                 wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
  215                 memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
  216                     ic->ic_bss->ni_esslen);
  217                 wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
  218                 break;
  219         case WI_RID_OWN_SSID:
  220         case WI_RID_DESIRED_SSID:
  221                 wreq.wi_val[0] = htole16(ic->ic_des_esslen);
  222                 memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
  223                 wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
  224                 break;
  225         case WI_RID_CURRENT_BSSID:
  226                 if (ic->ic_state == IEEE80211_S_RUN)
  227                         IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
  228                 else
  229                         memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
  230                 wreq.wi_len = IEEE80211_ADDR_LEN / 2;
  231                 break;
  232         case WI_RID_CHANNEL_LIST:
  233                 memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
  234                 /*
  235                  * Since channel 0 is not available for DS, channel 1
  236                  * is assigned to LSB on WaveLAN.
  237                  */
  238                 if (ic->ic_phytype == IEEE80211_T_DS)
  239                         i = 1;
  240                 else
  241                         i = 0;
  242                 for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
  243                         if (isset(ic->ic_chan_active, i)) {
  244                                 setbit((u_int8_t *)wreq.wi_val, j);
  245                                 wreq.wi_len = j / 16 + 1;
  246                         }
  247                 break;
  248         case WI_RID_OWN_CHNL:
  249                 wreq.wi_val[0] = htole16(
  250                         ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
  251                 wreq.wi_len = 1;
  252                 break;
  253         case WI_RID_CURRENT_CHAN:
  254                 wreq.wi_val[0] = htole16(
  255                         ieee80211_chan2ieee(ic, ic->ic_curchan));
  256                 wreq.wi_len = 1;
  257                 break;
  258         case WI_RID_COMMS_QUALITY:
  259                 wreq.wi_val[0] = 0;                             /* quality */
  260                 wreq.wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
  261                 wreq.wi_val[2] = 0;                             /* noise */
  262                 wreq.wi_len = 3;
  263                 break;
  264         case WI_RID_PROMISC:
  265                 wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
  266                 wreq.wi_len = 1;
  267                 break;
  268         case WI_RID_PORTTYPE:
  269                 wreq.wi_val[0] = htole16(ic->ic_opmode);
  270                 wreq.wi_len = 1;
  271                 break;
  272         case WI_RID_MAC_NODE:
  273                 IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
  274                 wreq.wi_len = IEEE80211_ADDR_LEN / 2;
  275                 break;
  276         case WI_RID_TX_RATE:
  277                 if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
  278                         wreq.wi_val[0] = 0;     /* auto */
  279                 else
  280                         wreq.wi_val[0] = htole16(
  281                             (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
  282                             IEEE80211_RATE_VAL) / 2);
  283                 wreq.wi_len = 1;
  284                 break;
  285         case WI_RID_CUR_TX_RATE:
  286                 wreq.wi_val[0] = htole16(
  287                     (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
  288                     IEEE80211_RATE_VAL) / 2);
  289                 wreq.wi_len = 1;
  290                 break;
  291         case WI_RID_RTS_THRESH:
  292                 wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
  293                 wreq.wi_len = 1;
  294                 break;
  295         case WI_RID_CREATE_IBSS:
  296                 wreq.wi_val[0] =
  297                     htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
  298                 wreq.wi_len = 1;
  299                 break;
  300         case WI_RID_MICROWAVE_OVEN:
  301                 wreq.wi_val[0] = 0;     /* no ... not supported */
  302                 wreq.wi_len = 1;
  303                 break;
  304         case WI_RID_ROAMING_MODE:
  305                 wreq.wi_val[0] = htole16(ic->ic_roaming);       /* XXX map */
  306                 wreq.wi_len = 1;
  307                 break;
  308         case WI_RID_SYSTEM_SCALE:
  309                 wreq.wi_val[0] = htole16(1);    /* low density ... not supp */
  310                 wreq.wi_len = 1;
  311                 break;
  312         case WI_RID_PM_ENABLED:
  313                 wreq.wi_val[0] =
  314                     htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
  315                 wreq.wi_len = 1;
  316                 break;
  317         case WI_RID_MAX_SLEEP:
  318                 wreq.wi_val[0] = htole16(ic->ic_lintval);
  319                 wreq.wi_len = 1;
  320                 break;
  321         case WI_RID_CUR_BEACON_INT:
  322                 wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
  323                 wreq.wi_len = 1;
  324                 break;
  325         case WI_RID_WEP_AVAIL:
  326                 wreq.wi_val[0] = htole16(1);    /* always available */
  327                 wreq.wi_len = 1;
  328                 break;
  329         case WI_RID_CNFAUTHMODE:
  330                 wreq.wi_val[0] = htole16(1);    /* TODO: open system only */
  331                 wreq.wi_len = 1;
  332                 break;
  333         case WI_RID_ENCRYPTION:
  334                 wreq.wi_val[0] =
  335                     htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
  336                 wreq.wi_len = 1;
  337                 break;
  338         case WI_RID_TX_CRYPT_KEY:
  339                 wreq.wi_val[0] = htole16(ic->ic_def_txkey);
  340                 wreq.wi_len = 1;
  341                 break;
  342         case WI_RID_DEFLT_CRYPT_KEYS:
  343                 keys = (struct wi_ltv_keys *)&wreq;
  344                 /* do not show keys to non-root user */
  345                 error = suser(curthread);
  346                 if (error) {
  347                         memset(keys, 0, sizeof(*keys));
  348                         error = 0;
  349                         break;
  350                 }
  351                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
  352                         keys->wi_keys[i].wi_keylen =
  353                             htole16(ic->ic_nw_keys[i].wk_keylen);
  354                         memcpy(keys->wi_keys[i].wi_keydat,
  355                             ic->ic_nw_keys[i].wk_key,
  356                             ic->ic_nw_keys[i].wk_keylen);
  357                 }
  358                 wreq.wi_len = sizeof(*keys) / 2;
  359                 break;
  360         case WI_RID_MAX_DATALEN:
  361                 wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
  362                 wreq.wi_len = 1;
  363                 break;
  364         case WI_RID_IFACE_STATS:
  365                 /* XXX: should be implemented in lower drivers */
  366                 break;
  367         case WI_RID_READ_APS:
  368                 /*
  369                  * Don't return results until active scan completes.
  370                  */
  371                 if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
  372                         struct wi_read_ap_args args;
  373 
  374                         args.i = 0;
  375                         args.ap = (void *)((char *)wreq.wi_val + sizeof(i));
  376                         args.max = (void *)(&wreq + 1);
  377                         ieee80211_iterate_nodes(&ic->ic_scan,
  378                                 wi_read_ap_result, &args);
  379                         memcpy(wreq.wi_val, &args.i, sizeof(args.i));
  380                         wreq.wi_len = (sizeof(int) +
  381                                 sizeof(struct wi_apinfo) * args.i) / 2;
  382                 } else
  383                         error = EINPROGRESS;
  384                 break;
  385         case WI_RID_PRISM2:
  386                 /* NB: we lie so WI_RID_SCAN_RES can include rates */
  387                 wreq.wi_val[0] = 1;
  388                 wreq.wi_len = sizeof(u_int16_t) / 2;
  389                 break;
  390         case WI_RID_SCAN_RES:                   /* compatibility interface */
  391                 if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
  392                         struct wi_read_prism2_args args;
  393                         struct wi_scan_p2_hdr *p2;
  394 
  395                         /* NB: use Prism2 format so we can include rate info */
  396                         p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
  397                         args.i = 0;
  398                         args.res = (void *)&p2[1];
  399                         args.max = (void *)(&wreq + 1);
  400                         ieee80211_iterate_nodes(&ic->ic_scan,
  401                                 wi_read_prism2_result, &args);
  402                         p2->wi_rsvd = 0;
  403                         p2->wi_reason = args.i;
  404                         wreq.wi_len = (sizeof(*p2) +
  405                                 sizeof(struct wi_scan_res) * args.i) / 2;
  406                 } else
  407                         error = EINPROGRESS;
  408                 break;
  409         case WI_RID_READ_CACHE: {
  410                 struct wi_read_sigcache_args args;
  411                 args.i = 0;
  412                 args.wsc = (struct wi_sigcache *) wreq.wi_val;
  413                 args.max = (void *)(&wreq + 1);
  414                 ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
  415                 wreq.wi_len = sizeof(struct wi_sigcache) * args.i / 2;
  416                 break;
  417         }
  418         default:
  419                 error = EINVAL;
  420                 break;
  421         }
  422         if (error == 0) {
  423                 wreq.wi_len++;
  424                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
  425         }
  426         return error;
  427 }
  428 
  429 static int
  430 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
  431 {
  432 #define IEEERATE(_ic,_m,_i) \
  433         ((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
  434         int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
  435         for (i = 0; i < nrates; i++)
  436                 if (IEEERATE(ic, mode, i) == rate)
  437                         return i;
  438         return -1;
  439 #undef IEEERATE
  440 }
  441 
  442 /*
  443  * Prepare to do a user-initiated scan for AP's.  If no
  444  * current/default channel is setup or the current channel
  445  * is invalid then pick the first available channel from
  446  * the active list as the place to start the scan.
  447  */
  448 static int
  449 ieee80211_setupscan(struct ieee80211com *ic, const u_int8_t chanlist[])
  450 {
  451 
  452         /*
  453          * XXX don't permit a scan to be started unless we
  454          * know the device is ready.  For the moment this means
  455          * the device is marked up as this is the required to
  456          * initialize the hardware.  It would be better to permit
  457          * scanning prior to being up but that'll require some
  458          * changes to the infrastructure.
  459          */
  460         if (!IS_UP(ic))
  461                 return EINVAL;
  462         memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
  463         /*
  464          * We force the state to INIT before calling ieee80211_new_state
  465          * to get ieee80211_begin_scan called.  We really want to scan w/o
  466          * altering the current state but that's not possible right now.
  467          */
  468         /* XXX handle proberequest case */
  469         ic->ic_state = IEEE80211_S_INIT;        /* XXX bypass state machine */
  470         return 0;
  471 }
  472 
  473 int
  474 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, caddr_t data)
  475 {
  476         struct ifnet *ifp = ic->ic_ifp;
  477         int i, j, len, error, rate;
  478         struct ifreq *ifr = (struct ifreq *)data;
  479         struct wi_ltv_keys *keys;
  480         struct wi_req wreq;
  481         u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
  482 
  483         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
  484         if (error)
  485                 return error;
  486         len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
  487         switch (wreq.wi_type) {
  488         case WI_RID_SERIALNO:
  489         case WI_RID_NODENAME:
  490                 return EPERM;
  491         case WI_RID_CURRENT_SSID:
  492                 return EPERM;
  493         case WI_RID_OWN_SSID:
  494         case WI_RID_DESIRED_SSID:
  495                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
  496                     le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
  497                         error = ENOSPC;
  498                         break;
  499                 }
  500                 memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
  501                 ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
  502                 memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
  503                 error = ENETRESET;
  504                 break;
  505         case WI_RID_CURRENT_BSSID:
  506                 return EPERM;
  507         case WI_RID_OWN_CHNL:
  508                 if (len != 2)
  509                         return EINVAL;
  510                 i = le16toh(wreq.wi_val[0]);
  511                 if (i < 0 ||
  512                     i > IEEE80211_CHAN_MAX ||
  513                     isclr(ic->ic_chan_active, i))
  514                         return EINVAL;
  515                 ic->ic_ibss_chan = &ic->ic_channels[i];
  516                 if (ic->ic_opmode == IEEE80211_M_MONITOR)
  517                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  518                 else
  519                         error = ENETRESET;
  520                 break;
  521         case WI_RID_CURRENT_CHAN:
  522                 return EPERM;
  523         case WI_RID_COMMS_QUALITY:
  524                 return EPERM;
  525         case WI_RID_PROMISC:
  526                 if (len != 2)
  527                         return EINVAL;
  528                 if (ifp->if_flags & IFF_PROMISC) {
  529                         if (wreq.wi_val[0] == 0) {
  530                                 ifp->if_flags &= ~IFF_PROMISC;
  531                                 error = ENETRESET;
  532                         }
  533                 } else {
  534                         if (wreq.wi_val[0] != 0) {
  535                                 ifp->if_flags |= IFF_PROMISC;
  536                                 error = ENETRESET;
  537                         }
  538                 }
  539                 break;
  540         case WI_RID_PORTTYPE:
  541                 if (len != 2)
  542                         return EINVAL;
  543                 switch (le16toh(wreq.wi_val[0])) {
  544                 case IEEE80211_M_STA:
  545                         break;
  546                 case IEEE80211_M_IBSS:
  547                         if (!(ic->ic_caps & IEEE80211_C_IBSS))
  548                                 return EINVAL;
  549                         break;
  550                 case IEEE80211_M_AHDEMO:
  551                         if (ic->ic_phytype != IEEE80211_T_DS ||
  552                             !(ic->ic_caps & IEEE80211_C_AHDEMO))
  553                                 return EINVAL;
  554                         break;
  555                 case IEEE80211_M_HOSTAP:
  556                         if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
  557                                 return EINVAL;
  558                         break;
  559                 default:
  560                         return EINVAL;
  561                 }
  562                 if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
  563                         ic->ic_opmode = le16toh(wreq.wi_val[0]);
  564                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  565                 }
  566                 break;
  567 #if 0
  568         case WI_RID_MAC_NODE:
  569                 if (len != IEEE80211_ADDR_LEN)
  570                         return EINVAL;
  571                 IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
  572                 /* if_init will copy lladdr into ic_myaddr */
  573                 error = ENETRESET;
  574                 break;
  575 #endif
  576         case WI_RID_TX_RATE:
  577                 if (len != 2)
  578                         return EINVAL;
  579                 if (wreq.wi_val[0] == 0) {
  580                         /* auto */
  581                         ic->ic_fixed_rate = IEEE80211_FIXED_RATE_NONE;
  582                         break;
  583                 }
  584                 rate = 2 * le16toh(wreq.wi_val[0]);
  585                 if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
  586                         /*
  587                          * In autoselect mode search for the rate.  We take
  588                          * the first instance which may not be right, but we
  589                          * are limited by the interface.  Note that we also
  590                          * lock the mode to insure the rate is meaningful
  591                          * when it is used.
  592                          */
  593                         for (j = IEEE80211_MODE_11A;
  594                              j < IEEE80211_MODE_MAX; j++) {
  595                                 if ((ic->ic_modecaps & (1<<j)) == 0)
  596                                         continue;
  597                                 i = findrate(ic, j, rate);
  598                                 if (i != -1) {
  599                                         /* lock mode too */
  600                                         ic->ic_curmode = j;
  601                                         goto setrate;
  602                                 }
  603                         }
  604                 } else {
  605                         i = findrate(ic, ic->ic_curmode, rate);
  606                         if (i != -1)
  607                                 goto setrate;
  608                 }
  609                 return EINVAL;
  610         setrate:
  611                 ic->ic_fixed_rate = i;
  612                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  613                 break;
  614         case WI_RID_CUR_TX_RATE:
  615                 return EPERM;
  616         case WI_RID_RTS_THRESH:
  617                 if (len != 2)
  618                         return EINVAL;
  619                 if (le16toh(wreq.wi_val[0]) != IEEE80211_MAX_LEN)
  620                         return EINVAL;          /* TODO: RTS */
  621                 break;
  622         case WI_RID_CREATE_IBSS:
  623                 if (len != 2)
  624                         return EINVAL;
  625                 if (wreq.wi_val[0] != 0) {
  626                         if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
  627                                 return EINVAL;
  628                         if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
  629                                 ic->ic_flags |= IEEE80211_F_IBSSON;
  630                                 if (ic->ic_opmode == IEEE80211_M_IBSS &&
  631                                     ic->ic_state == IEEE80211_S_SCAN)
  632                                         error = IS_UP_AUTO(ic) ? ENETRESET : 0;
  633                         }
  634                 } else {
  635                         if (ic->ic_flags & IEEE80211_F_IBSSON) {
  636                                 ic->ic_flags &= ~IEEE80211_F_IBSSON;
  637                                 if (ic->ic_flags & IEEE80211_F_SIBSS) {
  638                                         ic->ic_flags &= ~IEEE80211_F_SIBSS;
  639                                         error = IS_UP_AUTO(ic) ? ENETRESET : 0;
  640                                 }
  641                         }
  642                 }
  643                 break;
  644         case WI_RID_MICROWAVE_OVEN:
  645                 if (len != 2)
  646                         return EINVAL;
  647                 if (wreq.wi_val[0] != 0)
  648                         return EINVAL;          /* not supported */
  649                 break;
  650         case WI_RID_ROAMING_MODE:
  651                 if (len != 2)
  652                         return EINVAL;
  653                 i = le16toh(wreq.wi_val[0]);
  654                 if (i > IEEE80211_ROAMING_MANUAL)
  655                         return EINVAL;          /* not supported */
  656                 ic->ic_roaming = i;
  657                 break;
  658         case WI_RID_SYSTEM_SCALE:
  659                 if (len != 2)
  660                         return EINVAL;
  661                 if (le16toh(wreq.wi_val[0]) != 1)
  662                         return EINVAL;          /* not supported */
  663                 break;
  664         case WI_RID_PM_ENABLED:
  665                 if (len != 2)
  666                         return EINVAL;
  667                 if (wreq.wi_val[0] != 0) {
  668                         if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
  669                                 return EINVAL;
  670                         if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
  671                                 ic->ic_flags |= IEEE80211_F_PMGTON;
  672                                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  673                         }
  674                 } else {
  675                         if (ic->ic_flags & IEEE80211_F_PMGTON) {
  676                                 ic->ic_flags &= ~IEEE80211_F_PMGTON;
  677                                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  678                         }
  679                 }
  680                 break;
  681         case WI_RID_MAX_SLEEP:
  682                 if (len != 2)
  683                         return EINVAL;
  684                 ic->ic_lintval = le16toh(wreq.wi_val[0]);
  685                 if (ic->ic_flags & IEEE80211_F_PMGTON)
  686                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  687                 break;
  688         case WI_RID_CUR_BEACON_INT:
  689                 return EPERM;
  690         case WI_RID_WEP_AVAIL:
  691                 return EPERM;
  692         case WI_RID_CNFAUTHMODE:
  693                 if (len != 2)
  694                         return EINVAL;
  695                 i = le16toh(wreq.wi_val[0]);
  696                 if (i > IEEE80211_AUTH_WPA)
  697                         return EINVAL;
  698                 ic->ic_bss->ni_authmode = i;            /* XXX ENETRESET? */
  699                 error = ENETRESET;
  700                 break;
  701         case WI_RID_ENCRYPTION:
  702                 if (len != 2)
  703                         return EINVAL;
  704                 if (wreq.wi_val[0] != 0) {
  705                         if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
  706                                 return EINVAL;
  707                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
  708                                 ic->ic_flags |= IEEE80211_F_PRIVACY;
  709                                 error = ENETRESET;
  710                         }
  711                 } else {
  712                         if (ic->ic_flags & IEEE80211_F_PRIVACY) {
  713                                 ic->ic_flags &= ~IEEE80211_F_PRIVACY;
  714                                 error = ENETRESET;
  715                         }
  716                 }
  717                 break;
  718         case WI_RID_TX_CRYPT_KEY:
  719                 if (len != 2)
  720                         return EINVAL;
  721                 i = le16toh(wreq.wi_val[0]);
  722                 if (i >= IEEE80211_WEP_NKID)
  723                         return EINVAL;
  724                 ic->ic_def_txkey = i;
  725                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  726                 break;
  727         case WI_RID_DEFLT_CRYPT_KEYS:
  728                 if (len != sizeof(struct wi_ltv_keys))
  729                         return EINVAL;
  730                 keys = (struct wi_ltv_keys *)&wreq;
  731                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
  732                         len = le16toh(keys->wi_keys[i].wi_keylen);
  733                         if (len != 0 && len < IEEE80211_WEP_KEYLEN)
  734                                 return EINVAL;
  735                         if (len > IEEE80211_KEYBUF_SIZE)
  736                                 return EINVAL;
  737                 }
  738                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
  739                         struct ieee80211_key *k = &ic->ic_nw_keys[i];
  740 
  741                         len = le16toh(keys->wi_keys[i].wi_keylen);
  742                         k->wk_keylen = len;
  743                         k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
  744                         memset(k->wk_key, 0, sizeof(k->wk_key));
  745                         memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
  746 #if 0
  747                         k->wk_type = IEEE80211_CIPHER_WEP;
  748 #endif
  749                 }
  750                 error = ENETRESET;
  751                 break;
  752         case WI_RID_MAX_DATALEN:
  753                 if (len != 2)
  754                         return EINVAL;
  755                 len = le16toh(wreq.wi_val[0]);
  756                 if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
  757                         return EINVAL;
  758                 ic->ic_fragthreshold = len;
  759                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
  760                 break;
  761         case WI_RID_IFACE_STATS:
  762                 error = EPERM;
  763                 break;
  764         case WI_RID_SCAN_REQ:                   /* XXX wicontrol */
  765                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
  766                         break;
  767                 error = ieee80211_setupscan(ic, ic->ic_chan_avail);
  768                 if (error == 0)
  769                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
  770                 break;
  771         case WI_RID_SCAN_APS:
  772                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
  773                         break;
  774                 len--;                  /* XXX: tx rate? */
  775                 /* FALLTHRU */
  776         case WI_RID_CHANNEL_LIST:
  777                 memset(chanlist, 0, sizeof(chanlist));
  778                 /*
  779                  * Since channel 0 is not available for DS, channel 1
  780                  * is assigned to LSB on WaveLAN.
  781                  */
  782                 if (ic->ic_phytype == IEEE80211_T_DS)
  783                         i = 1;
  784                 else
  785                         i = 0;
  786                 for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
  787                         if ((j / 8) >= len)
  788                                 break;
  789                         if (isclr((u_int8_t *)wreq.wi_val, j))
  790                                 continue;
  791                         if (isclr(ic->ic_chan_active, i)) {
  792                                 if (wreq.wi_type != WI_RID_CHANNEL_LIST)
  793                                         continue;
  794                                 if (isclr(ic->ic_chan_avail, i))
  795                                         return EPERM;
  796                         }
  797                         setbit(chanlist, i);
  798                 }
  799                 error = ieee80211_setupscan(ic, chanlist);
  800                 if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
  801                         /* NB: ignore error from ieee80211_setupscan */
  802                         error = ENETRESET;
  803                 } else if (error == 0)
  804                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
  805                 break;
  806         default:
  807                 error = EINVAL;
  808                 break;
  809         }
  810         if (error == ENETRESET && !IS_UP_AUTO(ic))
  811                 error = 0;
  812         return error;
  813 }
  814 
  815 static int
  816 cap2cipher(int flag)
  817 {
  818         switch (flag) {
  819         case IEEE80211_C_WEP:           return IEEE80211_CIPHER_WEP;
  820         case IEEE80211_C_AES:           return IEEE80211_CIPHER_AES_OCB;
  821         case IEEE80211_C_AES_CCM:       return IEEE80211_CIPHER_AES_CCM;
  822         case IEEE80211_C_CKIP:          return IEEE80211_CIPHER_CKIP;
  823         case IEEE80211_C_TKIP:          return IEEE80211_CIPHER_TKIP;
  824         }
  825         return -1;
  826 }
  827 
  828 static int
  829 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq)
  830 {
  831         struct ieee80211_node *ni;
  832         struct ieee80211req_key ik;
  833         struct ieee80211_key *wk;
  834         const struct ieee80211_cipher *cip;
  835         u_int kid;
  836         int error;
  837 
  838         if (ireq->i_len != sizeof(ik))
  839                 return EINVAL;
  840         error = copyin(ireq->i_data, &ik, sizeof(ik));
  841         if (error)
  842                 return error;
  843         kid = ik.ik_keyix;
  844         if (kid == IEEE80211_KEYIX_NONE) {
  845                 ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
  846                 if (ni == NULL)
  847                         return EINVAL;          /* XXX */
  848                 wk = &ni->ni_ucastkey;
  849         } else {
  850                 if (kid >= IEEE80211_WEP_NKID)
  851                         return EINVAL;
  852                 wk = &ic->ic_nw_keys[kid];
  853                 IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
  854                 ni = NULL;
  855         }
  856         cip = wk->wk_cipher;
  857         ik.ik_type = cip->ic_cipher;
  858         ik.ik_keylen = wk->wk_keylen;
  859         ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
  860         if (wk->wk_keyix == ic->ic_def_txkey)
  861                 ik.ik_flags |= IEEE80211_KEY_DEFAULT;
  862         if (suser(curthread) == 0) {
  863                 /* NB: only root can read key data */
  864                 ik.ik_keyrsc = wk->wk_keyrsc;
  865                 ik.ik_keytsc = wk->wk_keytsc;
  866                 memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
  867                 if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
  868                         memcpy(ik.ik_keydata+wk->wk_keylen,
  869                                 wk->wk_key + IEEE80211_KEYBUF_SIZE,
  870                                 IEEE80211_MICBUF_SIZE);
  871                         ik.ik_keylen += IEEE80211_MICBUF_SIZE;
  872                 }
  873         } else {
  874                 ik.ik_keyrsc = 0;
  875                 ik.ik_keytsc = 0;
  876                 memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
  877         }
  878         if (ni != NULL)
  879                 ieee80211_free_node(ni);
  880         return copyout(&ik, ireq->i_data, sizeof(ik));
  881 }
  882 
  883 static int
  884 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
  885 {
  886 
  887         if (sizeof(ic->ic_chan_active) < ireq->i_len)
  888                 ireq->i_len = sizeof(ic->ic_chan_active);
  889         return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
  890 }
  891 
  892 static int
  893 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
  894 {
  895         struct ieee80211req_chaninfo chans;     /* XXX off stack? */
  896         int i, space;
  897 
  898         /*
  899          * Since channel 0 is not available for DS, channel 1
  900          * is assigned to LSB on WaveLAN.
  901          */
  902         if (ic->ic_phytype == IEEE80211_T_DS)
  903                 i = 1;
  904         else
  905                 i = 0;
  906         memset(&chans, 0, sizeof(chans));
  907         for (; i <= IEEE80211_CHAN_MAX; i++)
  908                 if (isset(ic->ic_chan_avail, i)) {
  909                         struct ieee80211_channel *c = &ic->ic_channels[i];
  910                         chans.ic_chans[chans.ic_nchans].ic_freq = c->ic_freq;
  911                         chans.ic_chans[chans.ic_nchans].ic_flags = c->ic_flags;
  912                         chans.ic_nchans++;
  913                 }
  914         space = __offsetof(struct ieee80211req_chaninfo,
  915                         ic_chans[chans.ic_nchans]);
  916         if (space > ireq->i_len)
  917                 space = ireq->i_len;
  918         return copyout(&chans, ireq->i_data, space);
  919 }
  920 
  921 static int
  922 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
  923 {
  924         struct ieee80211_node *ni;
  925         struct ieee80211req_wpaie wpaie;
  926         int error;
  927 
  928         if (ireq->i_len < IEEE80211_ADDR_LEN)
  929                 return EINVAL;
  930         error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
  931         if (error != 0)
  932                 return error;
  933         ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
  934         if (ni == NULL)
  935                 return EINVAL;          /* XXX */
  936         memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
  937         if (ni->ni_wpa_ie != NULL) {
  938                 int ielen = ni->ni_wpa_ie[1] + 2;
  939                 if (ielen > sizeof(wpaie.wpa_ie))
  940                         ielen = sizeof(wpaie.wpa_ie);
  941                 memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
  942         }
  943         ieee80211_free_node(ni);
  944         if (ireq->i_len > sizeof(wpaie))
  945                 ireq->i_len = sizeof(wpaie);
  946         return copyout(&wpaie, ireq->i_data, ireq->i_len);
  947 }
  948 
  949 static int
  950 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
  951 {
  952         struct ieee80211_node *ni;
  953         u_int8_t macaddr[IEEE80211_ADDR_LEN];
  954         const int off = __offsetof(struct ieee80211req_sta_stats, is_stats);
  955         int error;
  956 
  957         if (ireq->i_len < off)
  958                 return EINVAL;
  959         error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
  960         if (error != 0)
  961                 return error;
  962         ni = ieee80211_find_node(&ic->ic_sta, macaddr);
  963         if (ni == NULL)
  964                 return EINVAL;          /* XXX */
  965         if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
  966                 ireq->i_len = sizeof(struct ieee80211req_sta_stats);
  967         /* NB: copy out only the statistics */
  968         error = copyout(&ni->ni_stats, (u_int8_t *) ireq->i_data + off,
  969                         ireq->i_len - off);
  970         ieee80211_free_node(ni);
  971         return error;
  972 }
  973 
  974 static void
  975 get_scan_result(struct ieee80211req_scan_result *sr,
  976         const struct ieee80211_node *ni)
  977 {
  978         struct ieee80211com *ic = ni->ni_ic;
  979         u_int ielen = 0;
  980 
  981         memset(sr, 0, sizeof(*sr));
  982         sr->isr_ssid_len = ni->ni_esslen;
  983         if (ni->ni_wpa_ie != NULL)
  984                 ielen += 2+ni->ni_wpa_ie[1];
  985         if (ni->ni_wme_ie != NULL)
  986                 ielen += 2+ni->ni_wme_ie[1];
  987 
  988         /*
  989          * The value sr->isr_ie_len is defined as a uint8_t, so we
  990          * need to be careful to avoid an integer overflow.  If the
  991          * value would overflow, we will set isr_ie_len to zero, and
  992          * ieee80211_ioctl_getscanresults (below) will avoid copying
  993          * the (overflowing) data.
  994          */
  995         if (ielen > 255)
  996                 ielen = 0;
  997         sr->isr_ie_len = ielen;
  998         sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
  999         sr->isr_len = roundup(sr->isr_len, sizeof(u_int32_t));
 1000         if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
 1001                 sr->isr_freq = ni->ni_chan->ic_freq;
 1002                 sr->isr_flags = ni->ni_chan->ic_flags;
 1003         }
 1004         sr->isr_rssi = ic->ic_node_getrssi(ni);
 1005         sr->isr_intval = ni->ni_intval;
 1006         sr->isr_capinfo = ni->ni_capinfo;
 1007         sr->isr_erp = ni->ni_erp;
 1008         IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
 1009         sr->isr_nrates = ni->ni_rates.rs_nrates;
 1010         if (sr->isr_nrates > 15)
 1011                 sr->isr_nrates = 15;
 1012         memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
 1013 }
 1014 
 1015 static int
 1016 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
 1017 {
 1018         union {
 1019                 struct ieee80211req_scan_result res;
 1020                 char data[512];         /* XXX shrink? */
 1021         } u;
 1022         struct ieee80211req_scan_result *sr = &u.res;
 1023         struct ieee80211_node_table *nt;
 1024         struct ieee80211_node *ni;
 1025         int error, space;
 1026         u_int8_t *p, *cp;
 1027 
 1028         p = ireq->i_data;
 1029         space = ireq->i_len;
 1030         error = 0;
 1031         /* XXX locking */
 1032         nt =  &ic->ic_scan;
 1033         TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
 1034                 /* NB: skip pre-scan node state */ 
 1035                 if (ni->ni_chan == IEEE80211_CHAN_ANYC)
 1036                         continue;
 1037                 get_scan_result(sr, ni);
 1038                 if (sr->isr_len > sizeof(u))
 1039                         continue;               /* XXX */
 1040                 if (space < sr->isr_len)
 1041                         break;
 1042                 cp = (u_int8_t *)(sr+1);
 1043                 memcpy(cp, ni->ni_essid, ni->ni_esslen);
 1044                 cp += ni->ni_esslen;
 1045                 if (sr->isr_ie_len > 0 && ni->ni_wpa_ie != NULL) {
 1046                         memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
 1047                         cp += 2+ni->ni_wpa_ie[1];
 1048                 }
 1049                 if (sr->isr_ie_len > 0 && ni->ni_wme_ie != NULL) {
 1050                         memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
 1051                         cp += 2+ni->ni_wme_ie[1];
 1052                 }
 1053                 error = copyout(sr, p, sr->isr_len);
 1054                 if (error)
 1055                         break;
 1056                 p += sr->isr_len;
 1057                 space -= sr->isr_len;
 1058         }
 1059         ireq->i_len -= space;
 1060         return error;
 1061 }
 1062 
 1063 struct stainforeq {
 1064         struct ieee80211com *ic;
 1065         struct ieee80211req_sta_info *si;
 1066         size_t  space;
 1067 };
 1068 
 1069 static size_t
 1070 sta_space(const struct ieee80211_node *ni, size_t *ielen)
 1071 {
 1072         *ielen = 0;
 1073         if (ni->ni_wpa_ie != NULL)
 1074                 *ielen += 2+ni->ni_wpa_ie[1];
 1075         if (ni->ni_wme_ie != NULL)
 1076                 *ielen += 2+ni->ni_wme_ie[1];
 1077         return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
 1078                       sizeof(u_int32_t));
 1079 }
 1080 
 1081 static void
 1082 get_sta_space(void *arg, struct ieee80211_node *ni)
 1083 {
 1084         struct stainforeq *req = arg;
 1085         struct ieee80211com *ic = ni->ni_ic;
 1086         size_t ielen;
 1087 
 1088         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 1089             ni->ni_associd == 0)        /* only associated stations */
 1090                 return;
 1091         req->space += sta_space(ni, &ielen);
 1092 }
 1093 
 1094 static void
 1095 get_sta_info(void *arg, struct ieee80211_node *ni)
 1096 {
 1097         struct stainforeq *req = arg;
 1098         struct ieee80211com *ic = ni->ni_ic;
 1099         struct ieee80211req_sta_info *si;
 1100         size_t ielen, len;
 1101         u_int8_t *cp;
 1102 
 1103         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 1104             ni->ni_associd == 0)        /* only associated stations */
 1105                 return;
 1106         if (ni->ni_chan == IEEE80211_CHAN_ANYC) /* XXX bogus entry */
 1107                 return;
 1108         len = sta_space(ni, &ielen);
 1109         if (len > req->space)
 1110                 return;
 1111         si = req->si;
 1112         si->isi_len = len;
 1113         si->isi_ie_len = ielen;
 1114         si->isi_freq = ni->ni_chan->ic_freq;
 1115         si->isi_flags = ni->ni_chan->ic_flags;
 1116         si->isi_state = ni->ni_flags;
 1117         si->isi_authmode = ni->ni_authmode;
 1118         si->isi_rssi = ic->ic_node_getrssi(ni);
 1119         si->isi_capinfo = ni->ni_capinfo;
 1120         si->isi_erp = ni->ni_erp;
 1121         IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
 1122         si->isi_nrates = ni->ni_rates.rs_nrates;
 1123         if (si->isi_nrates > 15)
 1124                 si->isi_nrates = 15;
 1125         memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
 1126         si->isi_txrate = ni->ni_txrate;
 1127         si->isi_associd = ni->ni_associd;
 1128         si->isi_txpower = ni->ni_txpower;
 1129         si->isi_vlan = ni->ni_vlan;
 1130         if (ni->ni_flags & IEEE80211_NODE_QOS) {
 1131                 memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
 1132                 memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
 1133         } else {
 1134                 si->isi_txseqs[0] = ni->ni_txseqs[0];
 1135                 si->isi_rxseqs[0] = ni->ni_rxseqs[0];
 1136         }
 1137         /* NB: leave all cases in case we relax ni_associd == 0 check */
 1138         if (ieee80211_node_is_authorized(ni))
 1139                 si->isi_inact = ic->ic_inact_run;
 1140         else if (ni->ni_associd != 0)
 1141                 si->isi_inact = ic->ic_inact_auth;
 1142         else
 1143                 si->isi_inact = ic->ic_inact_init;
 1144         si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
 1145 
 1146         cp = (u_int8_t *)(si+1);
 1147         if (ni->ni_wpa_ie != NULL) {
 1148                 memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
 1149                 cp += 2+ni->ni_wpa_ie[1];
 1150         }
 1151         if (ni->ni_wme_ie != NULL) {
 1152                 memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
 1153                 cp += 2+ni->ni_wme_ie[1];
 1154         }
 1155 
 1156         req->si = (struct ieee80211req_sta_info *)(((u_int8_t *)si) + len);
 1157         req->space -= len;
 1158 }
 1159 
 1160 static int
 1161 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
 1162 {
 1163         struct stainforeq req;
 1164         int error;
 1165 
 1166         if (ireq->i_len < sizeof(struct stainforeq))
 1167                 return EFAULT;
 1168 
 1169         error = 0;
 1170         req.space = 0;
 1171         ieee80211_iterate_nodes(&ic->ic_sta, get_sta_space, &req);
 1172         if (req.space > ireq->i_len)
 1173                 req.space = ireq->i_len;
 1174         if (req.space > 0) {
 1175                 size_t space;
 1176                 void *p;
 1177 
 1178                 space = req.space;
 1179                 /* XXX M_WAITOK after driver lock released */
 1180                 MALLOC(p, void *, space, M_TEMP, M_NOWAIT);
 1181                 if (p == NULL)
 1182                         return ENOMEM;
 1183                 req.si = p;
 1184                 ieee80211_iterate_nodes(&ic->ic_sta, get_sta_info, &req);
 1185                 ireq->i_len = space - req.space;
 1186                 error = copyout(p, ireq->i_data, ireq->i_len);
 1187                 FREE(p, M_TEMP);
 1188         } else
 1189                 ireq->i_len = 0;
 1190 
 1191         return error;
 1192 }
 1193 
 1194 static int
 1195 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
 1196 {
 1197         struct ieee80211_node *ni;
 1198         struct ieee80211req_sta_txpow txpow;
 1199         int error;
 1200 
 1201         if (ireq->i_len != sizeof(txpow))
 1202                 return EINVAL;
 1203         error = copyin(ireq->i_data, &txpow, sizeof(txpow));
 1204         if (error != 0)
 1205                 return error;
 1206         ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
 1207         if (ni == NULL)
 1208                 return EINVAL;          /* XXX */
 1209         txpow.it_txpow = ni->ni_txpower;
 1210         error = copyout(&txpow, ireq->i_data, sizeof(txpow));
 1211         ieee80211_free_node(ni);
 1212         return error;
 1213 }
 1214 
 1215 static int
 1216 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
 1217 {
 1218         struct ieee80211_wme_state *wme = &ic->ic_wme;
 1219         struct wmeParams *wmep;
 1220         int ac;
 1221 
 1222         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
 1223                 return EINVAL;
 1224 
 1225         ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
 1226         if (ac >= WME_NUM_AC)
 1227                 ac = WME_AC_BE;
 1228         if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
 1229                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
 1230         else
 1231                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
 1232         switch (ireq->i_type) {
 1233         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
 1234                 ireq->i_val = wmep->wmep_logcwmin;
 1235                 break;
 1236         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
 1237                 ireq->i_val = wmep->wmep_logcwmax;
 1238                 break;
 1239         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
 1240                 ireq->i_val = wmep->wmep_aifsn;
 1241                 break;
 1242         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
 1243                 ireq->i_val = wmep->wmep_txopLimit;
 1244                 break;
 1245         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
 1246                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
 1247                 ireq->i_val = wmep->wmep_acm;
 1248                 break;
 1249         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (!bss only)*/
 1250                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
 1251                 ireq->i_val = !wmep->wmep_noackPolicy;
 1252                 break;
 1253         }
 1254         return 0;
 1255 }
 1256 
 1257 static int
 1258 ieee80211_ioctl_getmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
 1259 {
 1260         const struct ieee80211_aclator *acl = ic->ic_acl;
 1261 
 1262         return (acl == NULL ? EINVAL : acl->iac_getioctl(ic, ireq));
 1263 }
 1264 
 1265 /*
 1266  * When building the kernel with -O2 on the i386 architecture, gcc
 1267  * seems to want to inline this function into ieee80211_ioctl()
 1268  * (which is the only routine that calls it). When this happens,
 1269  * ieee80211_ioctl() ends up consuming an additional 2K of stack
 1270  * space. (Exactly why it needs so much is unclear.) The problem
 1271  * is that it's possible for ieee80211_ioctl() to invoke other
 1272  * routines (including driver init functions) which could then find
 1273  * themselves perilously close to exhausting the stack.
 1274  *
 1275  * To avoid this, we deliberately prevent gcc from inlining this
 1276  * routine. Another way to avoid this is to use less agressive
 1277  * optimization when compiling this file (i.e. -O instead of -O2)
 1278  * but special-casing the compilation of this one module in the
 1279  * build system would be awkward.
 1280  */
 1281 #ifdef __GNUC__
 1282 __attribute__ ((noinline))
 1283 #endif
 1284 static int
 1285 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
 1286 {
 1287         const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
 1288         int error = 0;
 1289         u_int kid, len, m;
 1290         u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
 1291         char tmpssid[IEEE80211_NWID_LEN];
 1292 
 1293         switch (ireq->i_type) {
 1294         case IEEE80211_IOC_SSID:
 1295                 switch (ic->ic_state) {
 1296                 case IEEE80211_S_INIT:
 1297                 case IEEE80211_S_SCAN:
 1298                         ireq->i_len = ic->ic_des_esslen;
 1299                         memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
 1300                         break;
 1301                 default:
 1302                         ireq->i_len = ic->ic_bss->ni_esslen;
 1303                         memcpy(tmpssid, ic->ic_bss->ni_essid,
 1304                                 ireq->i_len);
 1305                         break;
 1306                 }
 1307                 error = copyout(tmpssid, ireq->i_data, ireq->i_len);
 1308                 break;
 1309         case IEEE80211_IOC_NUMSSIDS:
 1310                 ireq->i_val = 1;
 1311                 break;
 1312         case IEEE80211_IOC_WEP:
 1313                 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
 1314                         ireq->i_val = IEEE80211_WEP_OFF;
 1315                 else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
 1316                         ireq->i_val = IEEE80211_WEP_ON;
 1317                 else
 1318                         ireq->i_val = IEEE80211_WEP_MIXED;
 1319                 break;
 1320         case IEEE80211_IOC_WEPKEY:
 1321                 kid = (u_int) ireq->i_val;
 1322                 if (kid >= IEEE80211_WEP_NKID)
 1323                         return EINVAL;
 1324                 len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
 1325                 /* NB: only root can read WEP keys */
 1326                 if (suser(curthread) == 0) {
 1327                         bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
 1328                 } else {
 1329                         bzero(tmpkey, len);
 1330                 }
 1331                 ireq->i_len = len;
 1332                 error = copyout(tmpkey, ireq->i_data, len);
 1333                 break;
 1334         case IEEE80211_IOC_NUMWEPKEYS:
 1335                 ireq->i_val = IEEE80211_WEP_NKID;
 1336                 break;
 1337         case IEEE80211_IOC_WEPTXKEY:
 1338                 ireq->i_val = ic->ic_def_txkey;
 1339                 break;
 1340         case IEEE80211_IOC_AUTHMODE:
 1341                 if (ic->ic_flags & IEEE80211_F_WPA)
 1342                         ireq->i_val = IEEE80211_AUTH_WPA;
 1343                 else
 1344                         ireq->i_val = ic->ic_bss->ni_authmode;
 1345                 break;
 1346         case IEEE80211_IOC_CHANNEL:
 1347                 ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
 1348                 break;
 1349         case IEEE80211_IOC_POWERSAVE:
 1350                 if (ic->ic_flags & IEEE80211_F_PMGTON)
 1351                         ireq->i_val = IEEE80211_POWERSAVE_ON;
 1352                 else
 1353                         ireq->i_val = IEEE80211_POWERSAVE_OFF;
 1354                 break;
 1355         case IEEE80211_IOC_POWERSAVESLEEP:
 1356                 ireq->i_val = ic->ic_lintval;
 1357                 break;
 1358         case IEEE80211_IOC_RTSTHRESHOLD:
 1359                 ireq->i_val = ic->ic_rtsthreshold;
 1360                 break;
 1361         case IEEE80211_IOC_PROTMODE:
 1362                 ireq->i_val = ic->ic_protmode;
 1363                 break;
 1364         case IEEE80211_IOC_TXPOWER:
 1365                 if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
 1366                         return EINVAL;
 1367                 ireq->i_val = ic->ic_txpowlimit;
 1368                 break;
 1369         case IEEE80211_IOC_MCASTCIPHER:
 1370                 ireq->i_val = rsn->rsn_mcastcipher;
 1371                 break;
 1372         case IEEE80211_IOC_MCASTKEYLEN:
 1373                 ireq->i_val = rsn->rsn_mcastkeylen;
 1374                 break;
 1375         case IEEE80211_IOC_UCASTCIPHERS:
 1376                 ireq->i_val = 0;
 1377                 for (m = 0x1; m != 0; m <<= 1)
 1378                         if (rsn->rsn_ucastcipherset & m)
 1379                                 ireq->i_val |= 1<<cap2cipher(m);
 1380                 break;
 1381         case IEEE80211_IOC_UCASTCIPHER:
 1382                 ireq->i_val = rsn->rsn_ucastcipher;
 1383                 break;
 1384         case IEEE80211_IOC_UCASTKEYLEN:
 1385                 ireq->i_val = rsn->rsn_ucastkeylen;
 1386                 break;
 1387         case IEEE80211_IOC_KEYMGTALGS:
 1388                 ireq->i_val = rsn->rsn_keymgmtset;
 1389                 break;
 1390         case IEEE80211_IOC_RSNCAPS:
 1391                 ireq->i_val = rsn->rsn_caps;
 1392                 break;
 1393         case IEEE80211_IOC_WPA:
 1394                 switch (ic->ic_flags & IEEE80211_F_WPA) {
 1395                 case IEEE80211_F_WPA1:
 1396                         ireq->i_val = 1;
 1397                         break;
 1398                 case IEEE80211_F_WPA2:
 1399                         ireq->i_val = 2;
 1400                         break;
 1401                 case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
 1402                         ireq->i_val = 3;
 1403                         break;
 1404                 default:
 1405                         ireq->i_val = 0;
 1406                         break;
 1407                 }
 1408                 break;
 1409         case IEEE80211_IOC_CHANLIST:
 1410                 error = ieee80211_ioctl_getchanlist(ic, ireq);
 1411                 break;
 1412         case IEEE80211_IOC_ROAMING:
 1413                 ireq->i_val = ic->ic_roaming;
 1414                 break;
 1415         case IEEE80211_IOC_PRIVACY:
 1416                 ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
 1417                 break;
 1418         case IEEE80211_IOC_DROPUNENCRYPTED:
 1419                 ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
 1420                 break;
 1421         case IEEE80211_IOC_COUNTERMEASURES:
 1422                 ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
 1423                 break;
 1424         case IEEE80211_IOC_DRIVER_CAPS:
 1425                 ireq->i_val = ic->ic_caps>>16;
 1426                 ireq->i_len = ic->ic_caps&0xffff;
 1427                 break;
 1428         case IEEE80211_IOC_WME:
 1429                 ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
 1430                 break;
 1431         case IEEE80211_IOC_HIDESSID:
 1432                 ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
 1433                 break;
 1434         case IEEE80211_IOC_APBRIDGE:
 1435                 ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
 1436                 break;
 1437         case IEEE80211_IOC_OPTIE:
 1438                 if (ic->ic_opt_ie == NULL)
 1439                         return EINVAL;
 1440                 /* NB: truncate, caller can check length */
 1441                 if (ireq->i_len > ic->ic_opt_ie_len)
 1442                         ireq->i_len = ic->ic_opt_ie_len;
 1443                 error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
 1444                 break;
 1445         case IEEE80211_IOC_WPAKEY:
 1446                 error = ieee80211_ioctl_getkey(ic, ireq);
 1447                 break;
 1448         case IEEE80211_IOC_CHANINFO:
 1449                 error = ieee80211_ioctl_getchaninfo(ic, ireq);
 1450                 break;
 1451         case IEEE80211_IOC_BSSID:
 1452                 if (ireq->i_len != IEEE80211_ADDR_LEN)
 1453                         return EINVAL;
 1454                 error = copyout(ic->ic_state == IEEE80211_S_RUN ?
 1455                                         ic->ic_bss->ni_bssid :
 1456                                         ic->ic_des_bssid,
 1457                                 ireq->i_data, ireq->i_len);
 1458                 break;
 1459         case IEEE80211_IOC_WPAIE:
 1460                 error = ieee80211_ioctl_getwpaie(ic, ireq);
 1461                 break;
 1462         case IEEE80211_IOC_SCAN_RESULTS:
 1463                 error = ieee80211_ioctl_getscanresults(ic, ireq);
 1464                 break;
 1465         case IEEE80211_IOC_STA_STATS:
 1466                 error = ieee80211_ioctl_getstastats(ic, ireq);
 1467                 break;
 1468         case IEEE80211_IOC_TXPOWMAX:
 1469                 ireq->i_val = ic->ic_bss->ni_txpower;
 1470                 break;
 1471         case IEEE80211_IOC_STA_TXPOW:
 1472                 error = ieee80211_ioctl_getstatxpow(ic, ireq);
 1473                 break;
 1474         case IEEE80211_IOC_STA_INFO:
 1475                 error = ieee80211_ioctl_getstainfo(ic, ireq);
 1476                 break;
 1477         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
 1478         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
 1479         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
 1480         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
 1481         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
 1482         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (bss only) */
 1483                 error = ieee80211_ioctl_getwmeparam(ic, ireq);
 1484                 break;
 1485         case IEEE80211_IOC_DTIM_PERIOD:
 1486                 ireq->i_val = ic->ic_dtim_period;
 1487                 break;
 1488         case IEEE80211_IOC_BEACON_INTERVAL:
 1489                 /* NB: get from ic_bss for station mode */
 1490                 ireq->i_val = ic->ic_bss->ni_intval;
 1491                 break;
 1492         case IEEE80211_IOC_PUREG:
 1493                 ireq->i_val = (ic->ic_flags & IEEE80211_F_PUREG) != 0;
 1494                 break;
 1495         case IEEE80211_IOC_FRAGTHRESHOLD:
 1496                 ireq->i_val = ic->ic_fragthreshold;
 1497                 break;
 1498         case IEEE80211_IOC_MACCMD:
 1499                 error = ieee80211_ioctl_getmaccmd(ic, ireq);
 1500                 break;
 1501         default:
 1502                 error = EINVAL;
 1503                 break;
 1504         }
 1505         return error;
 1506 }
 1507 
 1508 static int
 1509 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
 1510 {
 1511         int error;
 1512         void *ie;
 1513 
 1514         /*
 1515          * NB: Doing this for ap operation could be useful (e.g. for
 1516          *     WPA and/or WME) except that it typically is worthless
 1517          *     without being able to intervene when processing
 1518          *     association response frames--so disallow it for now.
 1519          */
 1520         if (ic->ic_opmode != IEEE80211_M_STA)
 1521                 return EINVAL;
 1522         if (ireq->i_len > IEEE80211_MAX_OPT_IE)
 1523                 return EINVAL;
 1524         /* NB: data.length is validated by the wireless extensions code */
 1525         MALLOC(ie, void *, ireq->i_len, M_DEVBUF, M_WAITOK);
 1526         if (ie == NULL)
 1527                 return ENOMEM;
 1528         error = copyin(ireq->i_data, ie, ireq->i_len);
 1529         /* XXX sanity check data? */
 1530         if (ic->ic_opt_ie != NULL)
 1531                 FREE(ic->ic_opt_ie, M_DEVBUF);
 1532         ic->ic_opt_ie = ie;
 1533         ic->ic_opt_ie_len = ireq->i_len;
 1534         return 0;
 1535 }
 1536 
 1537 static int
 1538 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
 1539 {
 1540         struct ieee80211req_key ik;
 1541         struct ieee80211_node *ni;
 1542         struct ieee80211_key *wk;
 1543         u_int16_t kid;
 1544         int error;
 1545 
 1546         if (ireq->i_len != sizeof(ik))
 1547                 return EINVAL;
 1548         error = copyin(ireq->i_data, &ik, sizeof(ik));
 1549         if (error)
 1550                 return error;
 1551         /* NB: cipher support is verified by ieee80211_crypt_newkey */
 1552         /* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
 1553         if (ik.ik_keylen > sizeof(ik.ik_keydata))
 1554                 return E2BIG;
 1555         kid = ik.ik_keyix;
 1556         if (kid == IEEE80211_KEYIX_NONE) {
 1557                 /* XXX unicast keys currently must be tx/rx */
 1558                 if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
 1559                         return EINVAL;
 1560                 if (ic->ic_opmode == IEEE80211_M_STA) {
 1561                         ni = ieee80211_ref_node(ic->ic_bss);
 1562                         if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
 1563                                 ieee80211_free_node(ni);
 1564                                 return EADDRNOTAVAIL;
 1565                         }
 1566                 } else {
 1567                         ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
 1568                         if (ni == NULL)
 1569                                 return ENOENT;
 1570                 }
 1571                 wk = &ni->ni_ucastkey;
 1572         } else {
 1573                 if (kid >= IEEE80211_WEP_NKID)
 1574                         return EINVAL;
 1575                 wk = &ic->ic_nw_keys[kid];
 1576                 ni = NULL;
 1577         }
 1578         error = 0;
 1579         ieee80211_key_update_begin(ic);
 1580         if (ieee80211_crypto_newkey(ic, ik.ik_type, ik.ik_flags, wk)) {
 1581                 wk->wk_keylen = ik.ik_keylen;
 1582                 /* NB: MIC presence is implied by cipher type */
 1583                 if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
 1584                         wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
 1585                 wk->wk_keyrsc = ik.ik_keyrsc;
 1586                 wk->wk_keytsc = 0;                      /* new key, reset */
 1587                 memset(wk->wk_key, 0, sizeof(wk->wk_key));
 1588                 memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
 1589                 if (!ieee80211_crypto_setkey(ic, wk,
 1590                     ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
 1591                         error = EIO;
 1592                 else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
 1593                         ic->ic_def_txkey = kid;
 1594         } else
 1595                 error = ENXIO;
 1596         ieee80211_key_update_end(ic);
 1597         if (ni != NULL)
 1598                 ieee80211_free_node(ni);
 1599         return error;
 1600 }
 1601 
 1602 static int
 1603 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
 1604 {
 1605         struct ieee80211req_del_key dk;
 1606         int kid, error;
 1607 
 1608         if (ireq->i_len != sizeof(dk))
 1609                 return EINVAL;
 1610         error = copyin(ireq->i_data, &dk, sizeof(dk));
 1611         if (error)
 1612                 return error;
 1613         kid = dk.idk_keyix;
 1614         /* XXX u_int8_t -> u_int16_t */
 1615         if (dk.idk_keyix == (u_int8_t) IEEE80211_KEYIX_NONE) {
 1616                 struct ieee80211_node *ni;
 1617 
 1618                 if (ic->ic_opmode == IEEE80211_M_STA) {
 1619                         ni = ieee80211_ref_node(ic->ic_bss);
 1620                         if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
 1621                                 ieee80211_free_node(ni);
 1622                                 return EADDRNOTAVAIL;
 1623                         }
 1624                 } else {
 1625                         ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
 1626                         if (ni == NULL)
 1627                                 return ENOENT;
 1628                 }
 1629                 /* XXX error return */
 1630                 ieee80211_node_delucastkey(ni);
 1631                 ieee80211_free_node(ni);
 1632         } else {
 1633                 if (kid >= IEEE80211_WEP_NKID)
 1634                         return EINVAL;
 1635                 /* XXX error return */
 1636                 ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
 1637         }
 1638         return 0;
 1639 }
 1640 
 1641 static void
 1642 domlme(void *arg, struct ieee80211_node *ni)
 1643 {
 1644         struct ieee80211com *ic = ni->ni_ic;
 1645         struct ieee80211req_mlme *mlme = arg;
 1646 
 1647         if (ni->ni_associd != 0) {
 1648                 IEEE80211_SEND_MGMT(ic, ni,
 1649                         mlme->im_op == IEEE80211_MLME_DEAUTH ?
 1650                                 IEEE80211_FC0_SUBTYPE_DEAUTH :
 1651                                 IEEE80211_FC0_SUBTYPE_DISASSOC,
 1652                         mlme->im_reason);
 1653         }
 1654         ieee80211_node_leave(ic, ni);
 1655 }
 1656 
 1657 static int
 1658 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
 1659 {
 1660         struct ieee80211req_mlme mlme;
 1661         struct ieee80211_node *ni;
 1662         int error;
 1663 
 1664         if (ireq->i_len != sizeof(mlme))
 1665                 return EINVAL;
 1666         error = copyin(ireq->i_data, &mlme, sizeof(mlme));
 1667         if (error)
 1668                 return error;
 1669         switch (mlme.im_op) {
 1670         case IEEE80211_MLME_ASSOC:
 1671                 if (ic->ic_opmode != IEEE80211_M_STA)
 1672                         return EINVAL;
 1673                 /* XXX must be in S_SCAN state? */
 1674 
 1675                 if (mlme.im_ssid_len != 0) {
 1676                         /*
 1677                          * Desired ssid specified; must match both bssid and
 1678                          * ssid to distinguish ap advertising multiple ssid's.
 1679                          */
 1680                         ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
 1681                                 mlme.im_macaddr,
 1682                                 mlme.im_ssid_len, mlme.im_ssid);
 1683                 } else {
 1684                         /*
 1685                          * Normal case; just match bssid.
 1686                          */
 1687                         ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
 1688                 }
 1689                 if (ni == NULL)
 1690                         return EINVAL;
 1691                 if (!ieee80211_sta_join(ic, ni)) {
 1692                         ieee80211_free_node(ni);
 1693                         return EINVAL;
 1694                 }
 1695                 break;
 1696         case IEEE80211_MLME_DISASSOC:
 1697         case IEEE80211_MLME_DEAUTH:
 1698                 switch (ic->ic_opmode) {
 1699                 case IEEE80211_M_STA:
 1700                         /* XXX not quite right */
 1701                         ieee80211_new_state(ic, IEEE80211_S_INIT,
 1702                                 mlme.im_reason);
 1703                         break;
 1704                 case IEEE80211_M_HOSTAP:
 1705                         /* NB: the broadcast address means do 'em all */
 1706                         if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
 1707                                 if ((ni = ieee80211_find_node(&ic->ic_sta,
 1708                                                 mlme.im_macaddr)) == NULL)
 1709                                         return EINVAL;
 1710                                 domlme(&mlme, ni);
 1711                                 ieee80211_free_node(ni);
 1712                         } else {
 1713                                 ieee80211_iterate_nodes(&ic->ic_sta,
 1714                                                 domlme, &mlme);
 1715                         }
 1716                         break;
 1717                 default:
 1718                         return EINVAL;
 1719                 }
 1720                 break;
 1721         case IEEE80211_MLME_AUTHORIZE:
 1722         case IEEE80211_MLME_UNAUTHORIZE:
 1723                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
 1724                         return EINVAL;
 1725                 ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
 1726                 if (ni == NULL)
 1727                         return EINVAL;
 1728                 if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
 1729                         ieee80211_node_authorize(ni);
 1730                 else
 1731                         ieee80211_node_unauthorize(ni);
 1732                 ieee80211_free_node(ni);
 1733                 break;
 1734         default:
 1735                 return EINVAL;
 1736         }
 1737         return 0;
 1738 }
 1739 
 1740 static int
 1741 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
 1742 {
 1743         u_int8_t mac[IEEE80211_ADDR_LEN];
 1744         const struct ieee80211_aclator *acl = ic->ic_acl;
 1745         int error;
 1746 
 1747         if (ireq->i_len != sizeof(mac))
 1748                 return EINVAL;
 1749         error = copyin(ireq->i_data, mac, ireq->i_len);
 1750         if (error)
 1751                 return error;
 1752         if (acl == NULL) {
 1753                 acl = ieee80211_aclator_get("mac");
 1754                 if (acl == NULL || !acl->iac_attach(ic))
 1755                         return EINVAL;
 1756                 ic->ic_acl = acl;
 1757         }
 1758         if (ireq->i_type == IEEE80211_IOC_ADDMAC)
 1759                 acl->iac_add(ic, mac);
 1760         else
 1761                 acl->iac_remove(ic, mac);
 1762         return 0;
 1763 }
 1764 
 1765 static int
 1766 ieee80211_ioctl_setmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
 1767 {
 1768         const struct ieee80211_aclator *acl = ic->ic_acl;
 1769 
 1770         switch (ireq->i_val) {
 1771         case IEEE80211_MACCMD_POLICY_OPEN:
 1772         case IEEE80211_MACCMD_POLICY_ALLOW:
 1773         case IEEE80211_MACCMD_POLICY_DENY:
 1774                 if (acl == NULL) {
 1775                         acl = ieee80211_aclator_get("mac");
 1776                         if (acl == NULL || !acl->iac_attach(ic))
 1777                                 return EINVAL;
 1778                         ic->ic_acl = acl;
 1779                 }
 1780                 acl->iac_setpolicy(ic, ireq->i_val);
 1781                 break;
 1782         case IEEE80211_MACCMD_FLUSH:
 1783                 if (acl != NULL)
 1784                         acl->iac_flush(ic);
 1785                 /* NB: silently ignore when not in use */
 1786                 break;
 1787         case IEEE80211_MACCMD_DETACH:
 1788                 if (acl != NULL) {
 1789                         ic->ic_acl = NULL;
 1790                         acl->iac_detach(ic);
 1791                 }
 1792                 break;
 1793         default:
 1794                 if (acl == NULL)
 1795                         return EINVAL;
 1796                 else
 1797                         return acl->iac_setioctl(ic, ireq);
 1798         }
 1799         return 0;
 1800 }
 1801 
 1802 static int
 1803 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
 1804 {
 1805         struct ieee80211req_chanlist list;
 1806         u_char chanlist[IEEE80211_CHAN_BYTES];
 1807         int i, j, error;
 1808 
 1809         if (ireq->i_len != sizeof(list))
 1810                 return EINVAL;
 1811         error = copyin(ireq->i_data, &list, sizeof(list));
 1812         if (error)
 1813                 return error;
 1814         memset(chanlist, 0, sizeof(chanlist));
 1815         /*
 1816          * Since channel 0 is not available for DS, channel 1
 1817          * is assigned to LSB on WaveLAN.
 1818          */
 1819         if (ic->ic_phytype == IEEE80211_T_DS)
 1820                 i = 1;
 1821         else
 1822                 i = 0;
 1823         for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
 1824                 /*
 1825                  * NB: silently discard unavailable channels so users
 1826                  *     can specify 1-255 to get all available channels.
 1827                  */
 1828                 if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
 1829                         setbit(chanlist, i);
 1830         }
 1831         if (ic->ic_ibss_chan == NULL ||
 1832             isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
 1833                 for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
 1834                         if (isset(chanlist, i)) {
 1835                                 ic->ic_ibss_chan = &ic->ic_channels[i];
 1836                                 goto found;
 1837                         }
 1838                 return EINVAL;                  /* no active channels */
 1839 found:
 1840                 ;
 1841         }
 1842         memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
 1843         return IS_UP_AUTO(ic) ? ENETRESET : 0;
 1844 }
 1845 
 1846 static int
 1847 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
 1848 {
 1849         struct ieee80211_node *ni;
 1850         struct ieee80211req_sta_txpow txpow;
 1851         int error;
 1852 
 1853         if (ireq->i_len != sizeof(txpow))
 1854                 return EINVAL;
 1855         error = copyin(ireq->i_data, &txpow, sizeof(txpow));
 1856         if (error != 0)
 1857                 return error;
 1858         ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
 1859         if (ni == NULL)
 1860                 return EINVAL;          /* XXX */
 1861         ni->ni_txpower = txpow.it_txpow;
 1862         ieee80211_free_node(ni);
 1863         return error;
 1864 }
 1865 
 1866 static int
 1867 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
 1868 {
 1869         struct ieee80211_wme_state *wme = &ic->ic_wme;
 1870         struct wmeParams *wmep, *chanp;
 1871         int isbss, ac;
 1872 
 1873         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
 1874                 return EINVAL;
 1875 
 1876         isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
 1877         ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
 1878         if (ac >= WME_NUM_AC)
 1879                 ac = WME_AC_BE;
 1880         if (isbss) {
 1881                 chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
 1882                 wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
 1883         } else {
 1884                 chanp = &wme->wme_chanParams.cap_wmeParams[ac];
 1885                 wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
 1886         }
 1887         switch (ireq->i_type) {
 1888         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
 1889                 if (isbss) {
 1890                         wmep->wmep_logcwmin = ireq->i_val;
 1891                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
 1892                                 chanp->wmep_logcwmin = ireq->i_val;
 1893                 } else {
 1894                         wmep->wmep_logcwmin = chanp->wmep_logcwmin =
 1895                                 ireq->i_val;
 1896                 }
 1897                 break;
 1898         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
 1899                 if (isbss) {
 1900                         wmep->wmep_logcwmax = ireq->i_val;
 1901                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
 1902                                 chanp->wmep_logcwmax = ireq->i_val;
 1903                 } else {
 1904                         wmep->wmep_logcwmax = chanp->wmep_logcwmax =
 1905                                 ireq->i_val;
 1906                 }
 1907                 break;
 1908         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
 1909                 if (isbss) {
 1910                         wmep->wmep_aifsn = ireq->i_val;
 1911                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
 1912                                 chanp->wmep_aifsn = ireq->i_val;
 1913                 } else {
 1914                         wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
 1915                 }
 1916                 break;
 1917         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
 1918                 if (isbss) {
 1919                         wmep->wmep_txopLimit = ireq->i_val;
 1920                         if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
 1921                                 chanp->wmep_txopLimit = ireq->i_val;
 1922                 } else {
 1923                         wmep->wmep_txopLimit = chanp->wmep_txopLimit =
 1924                                 ireq->i_val;
 1925                 }
 1926                 break;
 1927         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
 1928                 wmep->wmep_acm = ireq->i_val;
 1929                 if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
 1930                         chanp->wmep_acm = ireq->i_val;
 1931                 break;
 1932         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (!bss only)*/
 1933                 wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
 1934                         (ireq->i_val) == 0;
 1935                 break;
 1936         }
 1937         ieee80211_wme_updateparams(ic);
 1938         return 0;
 1939 }
 1940 
 1941 static int
 1942 cipher2cap(int cipher)
 1943 {
 1944         switch (cipher) {
 1945         case IEEE80211_CIPHER_WEP:      return IEEE80211_C_WEP;
 1946         case IEEE80211_CIPHER_AES_OCB:  return IEEE80211_C_AES;
 1947         case IEEE80211_CIPHER_AES_CCM:  return IEEE80211_C_AES_CCM;
 1948         case IEEE80211_CIPHER_CKIP:     return IEEE80211_C_CKIP;
 1949         case IEEE80211_CIPHER_TKIP:     return IEEE80211_C_TKIP;
 1950         }
 1951         return 0;
 1952 }
 1953 
 1954 static int
 1955 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd, struct ieee80211req *ireq)
 1956 {
 1957         static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
 1958         struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
 1959         int error;
 1960         const struct ieee80211_authenticator *auth;
 1961         u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
 1962         char tmpssid[IEEE80211_NWID_LEN];
 1963         u_int8_t tmpbssid[IEEE80211_ADDR_LEN];
 1964         struct ieee80211_key *k;
 1965         int j, caps;
 1966         u_int kid;
 1967 
 1968         error = 0;
 1969         switch (ireq->i_type) {
 1970         case IEEE80211_IOC_SSID:
 1971                 if (ireq->i_val != 0 ||
 1972                     ireq->i_len > IEEE80211_NWID_LEN)
 1973                         return EINVAL;
 1974                 error = copyin(ireq->i_data, tmpssid, ireq->i_len);
 1975                 if (error)
 1976                         break;
 1977                 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
 1978                 ic->ic_des_esslen = ireq->i_len;
 1979                 memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
 1980                 error = ENETRESET;
 1981                 break;
 1982         case IEEE80211_IOC_WEP:
 1983                 switch (ireq->i_val) {
 1984                 case IEEE80211_WEP_OFF:
 1985                         ic->ic_flags &= ~IEEE80211_F_PRIVACY;
 1986                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
 1987                         break;
 1988                 case IEEE80211_WEP_ON:
 1989                         ic->ic_flags |= IEEE80211_F_PRIVACY;
 1990                         ic->ic_flags |= IEEE80211_F_DROPUNENC;
 1991                         break;
 1992                 case IEEE80211_WEP_MIXED:
 1993                         ic->ic_flags |= IEEE80211_F_PRIVACY;
 1994                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
 1995                         break;
 1996                 }
 1997                 error = ENETRESET;
 1998                 break;
 1999         case IEEE80211_IOC_WEPKEY:
 2000                 kid = (u_int) ireq->i_val;
 2001                 if (kid >= IEEE80211_WEP_NKID)
 2002                         return EINVAL;
 2003                 k = &ic->ic_nw_keys[kid];
 2004                 if (ireq->i_len == 0) {
 2005                         /* zero-len =>'s delete any existing key */
 2006                         (void) ieee80211_crypto_delkey(ic, k);
 2007                         break;
 2008                 }
 2009                 if (ireq->i_len > sizeof(tmpkey))
 2010                         return EINVAL;
 2011                 memset(tmpkey, 0, sizeof(tmpkey));
 2012                 error = copyin(ireq->i_data, tmpkey, ireq->i_len);
 2013                 if (error)
 2014                         break;
 2015                 ieee80211_key_update_begin(ic);
 2016                 k->wk_keyix = kid;      /* NB: force fixed key id */
 2017                 if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
 2018                     IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
 2019                         k->wk_keylen = ireq->i_len;
 2020                         memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
 2021                         if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
 2022                                 error = EINVAL;
 2023                 } else
 2024                         error = EINVAL;
 2025                 ieee80211_key_update_end(ic);
 2026                 if (!error)                     /* NB: for compatibility */
 2027                         error = ENETRESET;
 2028                 break;
 2029         case IEEE80211_IOC_WEPTXKEY:
 2030                 kid = (u_int) ireq->i_val;
 2031                 if (kid >= IEEE80211_WEP_NKID &&
 2032                     (u_int16_t) kid != IEEE80211_KEYIX_NONE)
 2033                         return EINVAL;
 2034                 ic->ic_def_txkey = kid;
 2035                 error = ENETRESET;      /* push to hardware */
 2036                 break;
 2037         case IEEE80211_IOC_AUTHMODE:
 2038                 switch (ireq->i_val) {
 2039                 case IEEE80211_AUTH_WPA:
 2040                 case IEEE80211_AUTH_8021X:      /* 802.1x */
 2041                 case IEEE80211_AUTH_OPEN:       /* open */
 2042                 case IEEE80211_AUTH_SHARED:     /* shared-key */
 2043                 case IEEE80211_AUTH_AUTO:       /* auto */
 2044                         auth = ieee80211_authenticator_get(ireq->i_val);
 2045                         if (auth == NULL)
 2046                                 return EINVAL;
 2047                         break;
 2048                 default:
 2049                         return EINVAL;
 2050                 }
 2051                 switch (ireq->i_val) {
 2052                 case IEEE80211_AUTH_WPA:        /* WPA w/ 802.1x */
 2053                         ic->ic_flags |= IEEE80211_F_PRIVACY;
 2054                         ireq->i_val = IEEE80211_AUTH_8021X;
 2055                         break;
 2056                 case IEEE80211_AUTH_OPEN:       /* open */
 2057                         ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
 2058                         break;
 2059                 case IEEE80211_AUTH_SHARED:     /* shared-key */
 2060                 case IEEE80211_AUTH_8021X:      /* 802.1x */
 2061                         ic->ic_flags &= ~IEEE80211_F_WPA;
 2062                         /* both require a key so mark the PRIVACY capability */
 2063                         ic->ic_flags |= IEEE80211_F_PRIVACY;
 2064                         break;
 2065                 case IEEE80211_AUTH_AUTO:       /* auto */
 2066                         ic->ic_flags &= ~IEEE80211_F_WPA;
 2067                         /* XXX PRIVACY handling? */
 2068                         /* XXX what's the right way to do this? */
 2069                         break;
 2070                 }
 2071                 /* NB: authenticator attach/detach happens on state change */
 2072                 ic->ic_bss->ni_authmode = ireq->i_val;
 2073                 /* XXX mixed/mode/usage? */
 2074                 ic->ic_auth = auth;
 2075                 error = ENETRESET;
 2076                 break;
 2077         case IEEE80211_IOC_CHANNEL:
 2078                 /* XXX 0xffff overflows 16-bit signed */
 2079                 if (ireq->i_val == 0 ||
 2080                     ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
 2081                         ic->ic_des_chan = IEEE80211_CHAN_ANYC;
 2082                 else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
 2083                     isclr(ic->ic_chan_active, ireq->i_val)) {
 2084                         return EINVAL;
 2085                 } else
 2086                         ic->ic_ibss_chan = ic->ic_des_chan =
 2087                                 &ic->ic_channels[ireq->i_val];
 2088                 switch (ic->ic_state) {
 2089                 case IEEE80211_S_INIT:
 2090                 case IEEE80211_S_SCAN:
 2091                         error = ENETRESET;
 2092                         break;
 2093                 default:
 2094                         /*
 2095                          * If the desired channel has changed (to something
 2096                          * other than any) and we're not already scanning,
 2097                          * then kick the state machine.
 2098                          */
 2099                         if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
 2100                             ic->ic_bss->ni_chan != ic->ic_des_chan &&
 2101                             (ic->ic_flags & IEEE80211_F_SCAN) == 0)
 2102                                 error = ENETRESET;
 2103                         break;
 2104                 }
 2105                 if (error == ENETRESET &&
 2106                         ic->ic_opmode == IEEE80211_M_MONITOR) {
 2107                         if (IS_UP(ic)) {
 2108                                 /*
 2109                                  * Monitor mode can switch directly.
 2110                                  */
 2111                                 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
 2112                                         ic->ic_curchan = ic->ic_des_chan;
 2113                                 error = ic->ic_reset(ic->ic_ifp);
 2114                         } else
 2115                                 error = 0;
 2116                 }
 2117                 break;
 2118         case IEEE80211_IOC_POWERSAVE:
 2119                 switch (ireq->i_val) {
 2120                 case IEEE80211_POWERSAVE_OFF:
 2121                         if (ic->ic_flags & IEEE80211_F_PMGTON) {
 2122                                 ic->ic_flags &= ~IEEE80211_F_PMGTON;
 2123                                 error = ENETRESET;
 2124                         }
 2125                         break;
 2126                 case IEEE80211_POWERSAVE_ON:
 2127                         if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
 2128                                 error = EINVAL;
 2129                         else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
 2130                                 ic->ic_flags |= IEEE80211_F_PMGTON;
 2131                                 error = ENETRESET;
 2132                         }
 2133                         break;
 2134                 default:
 2135                         error = EINVAL;
 2136                         break;
 2137                 }
 2138                 break;
 2139         case IEEE80211_IOC_POWERSAVESLEEP:
 2140                 if (ireq->i_val < 0)
 2141                         return EINVAL;
 2142                 ic->ic_lintval = ireq->i_val;
 2143                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 2144                 break;
 2145         case IEEE80211_IOC_RTSTHRESHOLD:
 2146                 if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
 2147                       ireq->i_val <= IEEE80211_RTS_MAX))
 2148                         return EINVAL;
 2149                 ic->ic_rtsthreshold = ireq->i_val;
 2150                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 2151                 break;
 2152         case IEEE80211_IOC_PROTMODE:
 2153                 if (ireq->i_val > IEEE80211_PROT_RTSCTS)
 2154                         return EINVAL;
 2155                 ic->ic_protmode = ireq->i_val;
 2156                 /* NB: if not operating in 11g this can wait */
 2157                 if (ic->ic_curmode == IEEE80211_MODE_11G)
 2158                         error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 2159                 break;
 2160         case IEEE80211_IOC_TXPOWER:
 2161                 if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
 2162                         return EINVAL;
 2163                 if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
 2164                       ireq->i_val < IEEE80211_TXPOWER_MAX))
 2165                         return EINVAL;
 2166                 ic->ic_txpowlimit = ireq->i_val;
 2167                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 2168                 break;
 2169         case IEEE80211_IOC_ROAMING:
 2170                 if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
 2171                     ireq->i_val <= IEEE80211_ROAMING_MANUAL))
 2172                         return EINVAL;
 2173                 ic->ic_roaming = ireq->i_val;
 2174                 /* XXXX reset? */
 2175                 break;
 2176         case IEEE80211_IOC_PRIVACY:
 2177                 if (ireq->i_val) {
 2178                         /* XXX check for key state? */
 2179                         ic->ic_flags |= IEEE80211_F_PRIVACY;
 2180                 } else
 2181                         ic->ic_flags &= ~IEEE80211_F_PRIVACY;
 2182                 break;
 2183         case IEEE80211_IOC_DROPUNENCRYPTED:
 2184                 if (ireq->i_val)
 2185                         ic->ic_flags |= IEEE80211_F_DROPUNENC;
 2186                 else
 2187                         ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
 2188                 break;
 2189         case IEEE80211_IOC_WPAKEY:
 2190                 error = ieee80211_ioctl_setkey(ic, ireq);
 2191                 break;
 2192         case IEEE80211_IOC_DELKEY:
 2193                 error = ieee80211_ioctl_delkey(ic, ireq);
 2194                 break;
 2195         case IEEE80211_IOC_MLME:
 2196                 error = ieee80211_ioctl_setmlme(ic, ireq);
 2197                 break;
 2198         case IEEE80211_IOC_OPTIE:
 2199                 error = ieee80211_ioctl_setoptie(ic, ireq);
 2200                 break;
 2201         case IEEE80211_IOC_COUNTERMEASURES:
 2202                 if (ireq->i_val) {
 2203                         if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
 2204                                 return EINVAL;
 2205                         ic->ic_flags |= IEEE80211_F_COUNTERM;
 2206                 } else
 2207                         ic->ic_flags &= ~IEEE80211_F_COUNTERM;
 2208                 break;
 2209         case IEEE80211_IOC_WPA:
 2210                 if (ireq->i_val > 3)
 2211                         return EINVAL;
 2212                 /* XXX verify ciphers available */
 2213                 ic->ic_flags &= ~IEEE80211_F_WPA;
 2214                 switch (ireq->i_val) {
 2215                 case 1:
 2216                         ic->ic_flags |= IEEE80211_F_WPA1;
 2217                         break;
 2218                 case 2:
 2219                         ic->ic_flags |= IEEE80211_F_WPA2;
 2220                         break;
 2221                 case 3:
 2222                         ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
 2223                         break;
 2224                 }
 2225                 error = ENETRESET;              /* XXX? */
 2226                 break;
 2227         case IEEE80211_IOC_WME:
 2228                 if (ireq->i_val) {
 2229                         if ((ic->ic_caps & IEEE80211_C_WME) == 0)
 2230                                 return EINVAL;
 2231                         ic->ic_flags |= IEEE80211_F_WME;
 2232                 } else
 2233                         ic->ic_flags &= ~IEEE80211_F_WME;
 2234                 error = ENETRESET;              /* XXX maybe not for station? */
 2235                 break;
 2236         case IEEE80211_IOC_HIDESSID:
 2237                 if (ireq->i_val)
 2238                         ic->ic_flags |= IEEE80211_F_HIDESSID;
 2239                 else
 2240                         ic->ic_flags &= ~IEEE80211_F_HIDESSID;
 2241                 error = ENETRESET;
 2242                 break;
 2243         case IEEE80211_IOC_APBRIDGE:
 2244                 if (ireq->i_val == 0)
 2245                         ic->ic_flags |= IEEE80211_F_NOBRIDGE;
 2246                 else
 2247                         ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
 2248                 break;
 2249         case IEEE80211_IOC_MCASTCIPHER:
 2250                 if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
 2251                     !ieee80211_crypto_available(ireq->i_val))
 2252                         return EINVAL;
 2253                 rsn->rsn_mcastcipher = ireq->i_val;
 2254                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
 2255                 break;
 2256         case IEEE80211_IOC_MCASTKEYLEN:
 2257                 if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
 2258                         return EINVAL;
 2259                 /* XXX no way to verify driver capability */
 2260                 rsn->rsn_mcastkeylen = ireq->i_val;
 2261                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
 2262                 break;
 2263         case IEEE80211_IOC_UCASTCIPHERS:
 2264                 /*
 2265                  * Convert user-specified cipher set to the set
 2266                  * we can support (via hardware or software).
 2267                  * NB: this logic intentionally ignores unknown and
 2268                  * unsupported ciphers so folks can specify 0xff or
 2269                  * similar and get all available ciphers.
 2270                  */
 2271                 caps = 0;
 2272                 for (j = 1; j < 32; j++)        /* NB: skip WEP */
 2273                         if ((ireq->i_val & (1<<j)) &&
 2274                             ((ic->ic_caps & cipher2cap(j)) ||
 2275                              ieee80211_crypto_available(j)))
 2276                                 caps |= 1<<j;
 2277                 if (caps == 0)                  /* nothing available */
 2278                         return EINVAL;
 2279                 /* XXX verify ciphers ok for unicast use? */
 2280                 /* XXX disallow if running as it'll have no effect */
 2281                 rsn->rsn_ucastcipherset = caps;
 2282                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
 2283                 break;
 2284         case IEEE80211_IOC_UCASTCIPHER:
 2285                 if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
 2286                         return EINVAL;
 2287                 rsn->rsn_ucastcipher = ireq->i_val;
 2288                 break;
 2289         case IEEE80211_IOC_UCASTKEYLEN:
 2290                 if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
 2291                         return EINVAL;
 2292                 /* XXX no way to verify driver capability */
 2293                 rsn->rsn_ucastkeylen = ireq->i_val;
 2294                 break;
 2295         case IEEE80211_IOC_DRIVER_CAPS:
 2296                 /* NB: for testing */
 2297                 ic->ic_caps = (((u_int16_t) ireq->i_val) << 16) |
 2298                                ((u_int16_t) ireq->i_len);
 2299                 break;
 2300         case IEEE80211_IOC_KEYMGTALGS:
 2301                 /* XXX check */
 2302                 rsn->rsn_keymgmtset = ireq->i_val;
 2303                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
 2304                 break;
 2305         case IEEE80211_IOC_RSNCAPS:
 2306                 /* XXX check */
 2307                 rsn->rsn_caps = ireq->i_val;
 2308                 error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
 2309                 break;
 2310         case IEEE80211_IOC_BSSID:
 2311                 /* NB: should only be set when in STA mode */
 2312                 if (ic->ic_opmode != IEEE80211_M_STA)
 2313                         return EINVAL;
 2314                 if (ireq->i_len != sizeof(tmpbssid))
 2315                         return EINVAL;
 2316                 error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
 2317                 if (error)
 2318                         break;
 2319                 IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
 2320                 if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
 2321                         ic->ic_flags &= ~IEEE80211_F_DESBSSID;
 2322                 else
 2323                         ic->ic_flags |= IEEE80211_F_DESBSSID;
 2324                 error = ENETRESET;
 2325                 break;
 2326         case IEEE80211_IOC_CHANLIST:
 2327                 error = ieee80211_ioctl_setchanlist(ic, ireq);
 2328                 break;
 2329         case IEEE80211_IOC_SCAN_REQ:
 2330                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)        /* XXX ignore */
 2331                         break;
 2332                 error = ieee80211_setupscan(ic, ic->ic_chan_avail);
 2333                 if (error == 0)         /* XXX background scan */
 2334                         error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 2335                 break;
 2336         case IEEE80211_IOC_ADDMAC:
 2337         case IEEE80211_IOC_DELMAC:
 2338                 error = ieee80211_ioctl_macmac(ic, ireq);
 2339                 break;
 2340         case IEEE80211_IOC_MACCMD:
 2341                 error = ieee80211_ioctl_setmaccmd(ic, ireq);
 2342                 break;
 2343         case IEEE80211_IOC_STA_TXPOW:
 2344                 error = ieee80211_ioctl_setstatxpow(ic, ireq);
 2345                 break;
 2346         case IEEE80211_IOC_WME_CWMIN:           /* WME: CWmin */
 2347         case IEEE80211_IOC_WME_CWMAX:           /* WME: CWmax */
 2348         case IEEE80211_IOC_WME_AIFS:            /* WME: AIFS */
 2349         case IEEE80211_IOC_WME_TXOPLIMIT:       /* WME: txops limit */
 2350         case IEEE80211_IOC_WME_ACM:             /* WME: ACM (bss only) */
 2351         case IEEE80211_IOC_WME_ACKPOLICY:       /* WME: ACK policy (bss only) */
 2352                 error = ieee80211_ioctl_setwmeparam(ic, ireq);
 2353                 break;
 2354         case IEEE80211_IOC_DTIM_PERIOD:
 2355                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
 2356                     ic->ic_opmode != IEEE80211_M_IBSS)
 2357                         return EINVAL;
 2358                 if (IEEE80211_DTIM_MIN <= ireq->i_val &&
 2359                     ireq->i_val <= IEEE80211_DTIM_MAX) {
 2360                         ic->ic_dtim_period = ireq->i_val;
 2361                         error = ENETRESET;              /* requires restart */
 2362                 } else
 2363                         error = EINVAL;
 2364                 break;
 2365         case IEEE80211_IOC_BEACON_INTERVAL:
 2366                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
 2367                     ic->ic_opmode != IEEE80211_M_IBSS)
 2368                         return EINVAL;
 2369                 if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
 2370                     ireq->i_val <= IEEE80211_BINTVAL_MAX) {
 2371                         ic->ic_bintval = ireq->i_val;
 2372                         error = ENETRESET;              /* requires restart */
 2373                 } else
 2374                         error = EINVAL;
 2375                 break;
 2376         case IEEE80211_IOC_PUREG:
 2377                 if (ireq->i_val)
 2378                         ic->ic_flags |= IEEE80211_F_PUREG;
 2379                 else
 2380                         ic->ic_flags &= ~IEEE80211_F_PUREG;
 2381                 /* NB: reset only if we're operating on an 11g channel */
 2382                 if (ic->ic_curmode == IEEE80211_MODE_11G)
 2383                         error = ENETRESET;
 2384                 break;
 2385         case IEEE80211_IOC_FRAGTHRESHOLD:
 2386                 if ((ic->ic_caps & IEEE80211_C_TXFRAG) == 0 &&
 2387                     ireq->i_val != IEEE80211_FRAG_MAX)
 2388                         return EINVAL;
 2389                 if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
 2390                       ireq->i_val <= IEEE80211_FRAG_MAX))
 2391                         return EINVAL;
 2392                 ic->ic_fragthreshold = ireq->i_val;
 2393                 error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
 2394                 break;
 2395         default:
 2396                 error = EINVAL;
 2397                 break;
 2398         }
 2399         if (error == ENETRESET && !IS_UP_AUTO(ic))
 2400                 error = 0;
 2401         return error;
 2402 }
 2403 
 2404 int
 2405 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, caddr_t data)
 2406 {
 2407         struct ifnet *ifp = ic->ic_ifp;
 2408         int error = 0;
 2409         struct ifreq *ifr;
 2410         struct ifaddr *ifa;                     /* XXX */
 2411 
 2412         switch (cmd) {
 2413         case SIOCSIFMEDIA:
 2414         case SIOCGIFMEDIA:
 2415                 error = ifmedia_ioctl(ifp, (struct ifreq *) data,
 2416                                 &ic->ic_media, cmd);
 2417                 break;
 2418         case SIOCG80211:
 2419                 error = ieee80211_ioctl_get80211(ic, cmd,
 2420                                 (struct ieee80211req *) data);
 2421                 break;
 2422         case SIOCS80211:
 2423                 error = suser(curthread);
 2424                 if (error == 0)
 2425                         error = ieee80211_ioctl_set80211(ic, cmd,
 2426                                         (struct ieee80211req *) data);
 2427                 break;
 2428         case SIOCGIFGENERIC:
 2429                 error = ieee80211_cfgget(ic, cmd, data);
 2430                 break;
 2431         case SIOCSIFGENERIC:
 2432                 error = suser(curthread);
 2433                 if (error)
 2434                         break;
 2435                 error = ieee80211_cfgset(ic, cmd, data);
 2436                 break;
 2437         case SIOCG80211STATS:
 2438                 ifr = (struct ifreq *)data;
 2439                 copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
 2440                 break;
 2441         case SIOCSIFMTU:
 2442                 ifr = (struct ifreq *)data;
 2443                 if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
 2444                     ifr->ifr_mtu <= IEEE80211_MTU_MAX))
 2445                         error = EINVAL;
 2446                 else
 2447                         ifp->if_mtu = ifr->ifr_mtu;
 2448                 break;
 2449         case SIOCSIFADDR:
 2450                 /*
 2451                  * XXX Handle this directly so we can supress if_init calls.
 2452                  * XXX This should be done in ether_ioctl but for the moment
 2453                  * XXX there are too many other parts of the system that
 2454                  * XXX set IFF_UP and so supress if_init being called when
 2455                  * XXX it should be.
 2456                  */
 2457                 ifa = (struct ifaddr *) data;
 2458                 switch (ifa->ifa_addr->sa_family) {
 2459 #ifdef INET
 2460                 case AF_INET:
 2461                         if ((ifp->if_flags & IFF_UP) == 0) {
 2462                                 ifp->if_flags |= IFF_UP;
 2463                                 ifp->if_init(ifp->if_softc);
 2464                         }
 2465                         arp_ifinit(ifp, ifa);
 2466                         break;
 2467 #endif
 2468 #ifdef IPX
 2469                 /*
 2470                  * XXX - This code is probably wrong,
 2471                  *       but has been copied many times.
 2472                  */
 2473                 case AF_IPX: {
 2474                         struct ipx_addr *ina = &(IA_SIPX(ifa)->sipx_addr);
 2475 
 2476                         if (ipx_nullhost(*ina))
 2477                                 ina->x_host = *(union ipx_host *)
 2478                                     IFP2ENADDR(ifp);
 2479                         else
 2480                                 bcopy((caddr_t) ina->x_host.c_host,
 2481                                       (caddr_t) IFP2ENADDR(ifp),
 2482                                       ETHER_ADDR_LEN);
 2483                         /* fall thru... */
 2484                 }
 2485 #endif
 2486                 default:
 2487                         if ((ifp->if_flags & IFF_UP) == 0) {
 2488                                 ifp->if_flags |= IFF_UP;
 2489                                 ifp->if_init(ifp->if_softc);
 2490                         }
 2491                         break;
 2492                 }
 2493                 break;
 2494         default:
 2495                 error = ether_ioctl(ifp, cmd, data);
 2496                 break;
 2497         }
 2498         return error;
 2499 }

Cache object: 4d76fd21f1aa27f9697bfff18702cf23


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.