1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2001 Atsushi Onoe
5 * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29#include <sys/cdefs.h>
30__FBSDID("$FreeBSD$");
31
32/*
33 * IEEE 802.11 ioctl support (FreeBSD-specific)
34 */
35
36#include "opt_inet.h"
37#include "opt_wlan.h"
38
39#include <sys/endian.h>
40#include <sys/param.h>
41#include <sys/kernel.h>
42#include <sys/malloc.h>
43#include <sys/priv.h>
44#include <sys/socket.h>
45#include <sys/sockio.h>
46#include <sys/systm.h>
47
48#include <net/if.h>
49#include <net/if_var.h>
50#include <net/if_dl.h>
51#include <net/if_media.h>
52#include <net/ethernet.h>
53
54#ifdef INET
55#include <netinet/in.h>
56#include <netinet/if_ether.h>
57#endif
58
59#include <net80211/ieee80211_var.h>
60#include <net80211/ieee80211_ioctl.h>
61#include <net80211/ieee80211_regdomain.h>
62#include <net80211/ieee80211_input.h>
63
64#define	IS_UP_AUTO(_vap) \
65	(IFNET_IS_UP_RUNNING((_vap)->iv_ifp) && \
66	 (_vap)->iv_roaming == IEEE80211_ROAMING_AUTO)
67
68static const uint8_t zerobssid[IEEE80211_ADDR_LEN];
69static struct ieee80211_channel *findchannel(struct ieee80211com *,
70		int ieee, int mode);
71static int ieee80211_scanreq(struct ieee80211vap *,
72		struct ieee80211_scan_req *);
73
74static int
75ieee80211_ioctl_getkey(struct ieee80211vap *vap, struct ieee80211req *ireq)
76{
77	struct ieee80211com *ic = vap->iv_ic;
78	struct ieee80211_node *ni;
79	struct ieee80211req_key ik;
80	struct ieee80211_key *wk;
81	const struct ieee80211_cipher *cip;
82	u_int kid;
83	int error;
84
85	if (ireq->i_len != sizeof(ik))
86		return EINVAL;
87	error = copyin(ireq->i_data, &ik, sizeof(ik));
88	if (error)
89		return error;
90	kid = ik.ik_keyix;
91	if (kid == IEEE80211_KEYIX_NONE) {
92		ni = ieee80211_find_vap_node(&ic->ic_sta, vap, ik.ik_macaddr);
93		if (ni == NULL)
94			return ENOENT;
95		wk = &ni->ni_ucastkey;
96	} else {
97		if (kid >= IEEE80211_WEP_NKID)
98			return EINVAL;
99		wk = &vap->iv_nw_keys[kid];
100		IEEE80211_ADDR_COPY(&ik.ik_macaddr, vap->iv_bss->ni_macaddr);
101		ni = NULL;
102	}
103	cip = wk->wk_cipher;
104	ik.ik_type = cip->ic_cipher;
105	ik.ik_keylen = wk->wk_keylen;
106	ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
107	if (wk->wk_keyix == vap->iv_def_txkey)
108		ik.ik_flags |= IEEE80211_KEY_DEFAULT;
109	if (priv_check(curthread, PRIV_NET80211_GETKEY) == 0) {
110		/* NB: only root can read key data */
111		ik.ik_keyrsc = wk->wk_keyrsc[IEEE80211_NONQOS_TID];
112		ik.ik_keytsc = wk->wk_keytsc;
113		memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
114		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
115			memcpy(ik.ik_keydata+wk->wk_keylen,
116				wk->wk_key + IEEE80211_KEYBUF_SIZE,
117				IEEE80211_MICBUF_SIZE);
118			ik.ik_keylen += IEEE80211_MICBUF_SIZE;
119		}
120	} else {
121		ik.ik_keyrsc = 0;
122		ik.ik_keytsc = 0;
123		memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
124	}
125	if (ni != NULL)
126		ieee80211_free_node(ni);
127	return copyout(&ik, ireq->i_data, sizeof(ik));
128}
129
130static int
131ieee80211_ioctl_getchanlist(struct ieee80211vap *vap, struct ieee80211req *ireq)
132{
133	struct ieee80211com *ic = vap->iv_ic;
134
135	if (sizeof(ic->ic_chan_active) < ireq->i_len)
136		ireq->i_len = sizeof(ic->ic_chan_active);
137	return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
138}
139
140static int
141ieee80211_ioctl_getchaninfo(struct ieee80211vap *vap, struct ieee80211req *ireq)
142{
143	struct ieee80211com *ic = vap->iv_ic;
144	uint32_t space;
145
146	space = __offsetof(struct ieee80211req_chaninfo,
147			ic_chans[ic->ic_nchans]);
148	if (space > ireq->i_len)
149		space = ireq->i_len;
150	/* XXX assumes compatible layout */
151	return copyout(&ic->ic_nchans, ireq->i_data, space);
152}
153
154static int
155ieee80211_ioctl_getwpaie(struct ieee80211vap *vap,
156	struct ieee80211req *ireq, int req)
157{
158	struct ieee80211_node *ni;
159	struct ieee80211req_wpaie2 *wpaie;
160	int error;
161
162	if (ireq->i_len < IEEE80211_ADDR_LEN)
163		return EINVAL;
164	wpaie = IEEE80211_MALLOC(sizeof(*wpaie), M_TEMP,
165	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
166	if (wpaie == NULL)
167		return ENOMEM;
168	error = copyin(ireq->i_data, wpaie->wpa_macaddr, IEEE80211_ADDR_LEN);
169	if (error != 0)
170		goto bad;
171	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, wpaie->wpa_macaddr);
172	if (ni == NULL) {
173		error = ENOENT;
174		goto bad;
175	}
176	if (ni->ni_ies.wpa_ie != NULL) {
177		int ielen = ni->ni_ies.wpa_ie[1] + 2;
178		if (ielen > sizeof(wpaie->wpa_ie))
179			ielen = sizeof(wpaie->wpa_ie);
180		memcpy(wpaie->wpa_ie, ni->ni_ies.wpa_ie, ielen);
181	}
182	if (req == IEEE80211_IOC_WPAIE2) {
183		if (ni->ni_ies.rsn_ie != NULL) {
184			int ielen = ni->ni_ies.rsn_ie[1] + 2;
185			if (ielen > sizeof(wpaie->rsn_ie))
186				ielen = sizeof(wpaie->rsn_ie);
187			memcpy(wpaie->rsn_ie, ni->ni_ies.rsn_ie, ielen);
188		}
189		if (ireq->i_len > sizeof(struct ieee80211req_wpaie2))
190			ireq->i_len = sizeof(struct ieee80211req_wpaie2);
191	} else {
192		/* compatibility op, may overwrite wpa ie */
193		/* XXX check ic_flags? */
194		if (ni->ni_ies.rsn_ie != NULL) {
195			int ielen = ni->ni_ies.rsn_ie[1] + 2;
196			if (ielen > sizeof(wpaie->wpa_ie))
197				ielen = sizeof(wpaie->wpa_ie);
198			memcpy(wpaie->wpa_ie, ni->ni_ies.rsn_ie, ielen);
199		}
200		if (ireq->i_len > sizeof(struct ieee80211req_wpaie))
201			ireq->i_len = sizeof(struct ieee80211req_wpaie);
202	}
203	ieee80211_free_node(ni);
204	error = copyout(wpaie, ireq->i_data, ireq->i_len);
205bad:
206	IEEE80211_FREE(wpaie, M_TEMP);
207	return error;
208}
209
210static int
211ieee80211_ioctl_getstastats(struct ieee80211vap *vap, struct ieee80211req *ireq)
212{
213	struct ieee80211_node *ni;
214	uint8_t macaddr[IEEE80211_ADDR_LEN];
215	const size_t off = __offsetof(struct ieee80211req_sta_stats, is_stats);
216	int error;
217
218	if (ireq->i_len < off)
219		return EINVAL;
220	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
221	if (error != 0)
222		return error;
223	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
224	if (ni == NULL)
225		return ENOENT;
226	if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
227		ireq->i_len = sizeof(struct ieee80211req_sta_stats);
228	/* NB: copy out only the statistics */
229	error = copyout(&ni->ni_stats, (uint8_t *) ireq->i_data + off,
230			ireq->i_len - off);
231	ieee80211_free_node(ni);
232	return error;
233}
234
235struct scanreq {
236	struct ieee80211req_scan_result *sr;
237	size_t space;
238};
239
240static size_t
241scan_space(const struct ieee80211_scan_entry *se, int *ielen)
242{
243	size_t len;
244
245	*ielen = se->se_ies.len;
246	/*
247	 * NB: ie's can be no more than 255 bytes and the max 802.11
248	 * packet is <3Kbytes so we are sure this doesn't overflow
249	 * 16-bits; if this is a concern we can drop the ie's.
250	 */
251	len = sizeof(struct ieee80211req_scan_result) + se->se_ssid[1] +
252	    se->se_meshid[1] + *ielen;
253	return roundup(len, sizeof(uint32_t));
254}
255
256static void
257get_scan_space(void *arg, const struct ieee80211_scan_entry *se)
258{
259	struct scanreq *req = arg;
260	int ielen;
261
262	req->space += scan_space(se, &ielen);
263}
264
265static void
266get_scan_result(void *arg, const struct ieee80211_scan_entry *se)
267{
268	struct scanreq *req = arg;
269	struct ieee80211req_scan_result *sr;
270	int ielen, len, nr, nxr;
271	uint8_t *cp;
272
273	len = scan_space(se, &ielen);
274	if (len > req->space)
275		return;
276
277	sr = req->sr;
278	KASSERT(len <= 65535 && ielen <= 65535,
279	    ("len %u ssid %u ie %u", len, se->se_ssid[1], ielen));
280	sr->isr_len = len;
281	sr->isr_ie_off = sizeof(struct ieee80211req_scan_result);
282	sr->isr_ie_len = ielen;
283	sr->isr_freq = se->se_chan->ic_freq;
284	sr->isr_flags = se->se_chan->ic_flags;
285	sr->isr_rssi = se->se_rssi;
286	sr->isr_noise = se->se_noise;
287	sr->isr_intval = se->se_intval;
288	sr->isr_capinfo = se->se_capinfo;
289	sr->isr_erp = se->se_erp;
290	IEEE80211_ADDR_COPY(sr->isr_bssid, se->se_bssid);
291	nr = min(se->se_rates[1], IEEE80211_RATE_MAXSIZE);
292	memcpy(sr->isr_rates, se->se_rates+2, nr);
293	nxr = min(se->se_xrates[1], IEEE80211_RATE_MAXSIZE - nr);
294	memcpy(sr->isr_rates+nr, se->se_xrates+2, nxr);
295	sr->isr_nrates = nr + nxr;
296
297	/* copy SSID */
298	sr->isr_ssid_len = se->se_ssid[1];
299	cp = ((uint8_t *)sr) + sr->isr_ie_off;
300	memcpy(cp, se->se_ssid+2, sr->isr_ssid_len);
301
302	/* copy mesh id */
303	cp += sr->isr_ssid_len;
304	sr->isr_meshid_len = se->se_meshid[1];
305	memcpy(cp, se->se_meshid+2, sr->isr_meshid_len);
306	cp += sr->isr_meshid_len;
307
308	if (ielen)
309		memcpy(cp, se->se_ies.data, ielen);
310
311	req->space -= len;
312	req->sr = (struct ieee80211req_scan_result *)(((uint8_t *)sr) + len);
313}
314
315static int
316ieee80211_ioctl_getscanresults(struct ieee80211vap *vap,
317	struct ieee80211req *ireq)
318{
319	struct scanreq req;
320	int error;
321
322	if (ireq->i_len < sizeof(struct scanreq))
323		return EFAULT;
324
325	error = 0;
326	req.space = 0;
327	ieee80211_scan_iterate(vap, get_scan_space, &req);
328	if (req.space > ireq->i_len)
329		req.space = ireq->i_len;
330	if (req.space > 0) {
331		uint32_t space;
332		void *p;
333
334		space = req.space;
335		/* XXX M_WAITOK after driver lock released */
336		p = IEEE80211_MALLOC(space, M_TEMP,
337		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
338		if (p == NULL)
339			return ENOMEM;
340		req.sr = p;
341		ieee80211_scan_iterate(vap, get_scan_result, &req);
342		ireq->i_len = space - req.space;
343		error = copyout(p, ireq->i_data, ireq->i_len);
344		IEEE80211_FREE(p, M_TEMP);
345	} else
346		ireq->i_len = 0;
347
348	return error;
349}
350
351struct stainforeq {
352	struct ieee80211req_sta_info *si;
353	size_t	space;
354};
355
356static size_t
357sta_space(const struct ieee80211_node *ni, size_t *ielen)
358{
359	*ielen = ni->ni_ies.len;
360	return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
361		      sizeof(uint32_t));
362}
363
364static void
365get_sta_space(void *arg, struct ieee80211_node *ni)
366{
367	struct stainforeq *req = arg;
368	size_t ielen;
369
370	if (ni->ni_vap->iv_opmode == IEEE80211_M_HOSTAP &&
371	    ni->ni_associd == 0)	/* only associated stations */
372		return;
373	req->space += sta_space(ni, &ielen);
374}
375
376static void
377get_sta_info(void *arg, struct ieee80211_node *ni)
378{
379	struct stainforeq *req = arg;
380	struct ieee80211vap *vap = ni->ni_vap;
381	struct ieee80211req_sta_info *si;
382	size_t ielen, len;
383	uint8_t *cp;
384
385	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
386	    ni->ni_associd == 0)	/* only associated stations */
387		return;
388	if (ni->ni_chan == IEEE80211_CHAN_ANYC)	/* XXX bogus entry */
389		return;
390	len = sta_space(ni, &ielen);
391	if (len > req->space)
392		return;
393	si = req->si;
394	si->isi_len = len;
395	si->isi_ie_off = sizeof(struct ieee80211req_sta_info);
396	si->isi_ie_len = ielen;
397	si->isi_freq = ni->ni_chan->ic_freq;
398	si->isi_flags = ni->ni_chan->ic_flags;
399	si->isi_state = ni->ni_flags;
400	si->isi_authmode = ni->ni_authmode;
401	vap->iv_ic->ic_node_getsignal(ni, &si->isi_rssi, &si->isi_noise);
402	vap->iv_ic->ic_node_getmimoinfo(ni, &si->isi_mimo);
403	si->isi_capinfo = ni->ni_capinfo;
404	si->isi_erp = ni->ni_erp;
405	IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
406	si->isi_nrates = ni->ni_rates.rs_nrates;
407	if (si->isi_nrates > 15)
408		si->isi_nrates = 15;
409	memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
410	si->isi_txrate = ni->ni_txrate;
411	if (si->isi_txrate & IEEE80211_RATE_MCS) {
412		const struct ieee80211_mcs_rates *mcs =
413		    &ieee80211_htrates[ni->ni_txrate &~ IEEE80211_RATE_MCS];
414		if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
415			if (ni->ni_flags & IEEE80211_NODE_SGI40)
416				si->isi_txmbps = mcs->ht40_rate_800ns;
417			else
418				si->isi_txmbps = mcs->ht40_rate_400ns;
419		} else {
420			if (ni->ni_flags & IEEE80211_NODE_SGI20)
421				si->isi_txmbps = mcs->ht20_rate_800ns;
422			else
423				si->isi_txmbps = mcs->ht20_rate_400ns;
424		}
425	} else
426		si->isi_txmbps = si->isi_txrate;
427	si->isi_associd = ni->ni_associd;
428	si->isi_txpower = ni->ni_txpower;
429	si->isi_vlan = ni->ni_vlan;
430	if (ni->ni_flags & IEEE80211_NODE_QOS) {
431		memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
432		memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
433	} else {
434		si->isi_txseqs[0] = ni->ni_txseqs[IEEE80211_NONQOS_TID];
435		si->isi_rxseqs[0] = ni->ni_rxseqs[IEEE80211_NONQOS_TID];
436	}
437	/* NB: leave all cases in case we relax ni_associd == 0 check */
438	if (ieee80211_node_is_authorized(ni))
439		si->isi_inact = vap->iv_inact_run;
440	else if (ni->ni_associd != 0 ||
441	    (vap->iv_opmode == IEEE80211_M_WDS &&
442	     (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY)))
443		si->isi_inact = vap->iv_inact_auth;
444	else
445		si->isi_inact = vap->iv_inact_init;
446	si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
447	si->isi_localid = ni->ni_mllid;
448	si->isi_peerid = ni->ni_mlpid;
449	si->isi_peerstate = ni->ni_mlstate;
450
451	if (ielen) {
452		cp = ((uint8_t *)si) + si->isi_ie_off;
453		memcpy(cp, ni->ni_ies.data, ielen);
454	}
455
456	req->si = (struct ieee80211req_sta_info *)(((uint8_t *)si) + len);
457	req->space -= len;
458}
459
460static int
461getstainfo_common(struct ieee80211vap *vap, struct ieee80211req *ireq,
462	struct ieee80211_node *ni, size_t off)
463{
464	struct ieee80211com *ic = vap->iv_ic;
465	struct stainforeq req;
466	size_t space;
467	void *p;
468	int error;
469
470	error = 0;
471	req.space = 0;
472	if (ni == NULL) {
473		ieee80211_iterate_nodes_vap(&ic->ic_sta, vap, get_sta_space,
474		    &req);
475	} else
476		get_sta_space(&req, ni);
477	if (req.space > ireq->i_len)
478		req.space = ireq->i_len;
479	if (req.space > 0) {
480		space = req.space;
481		/* XXX M_WAITOK after driver lock released */
482		p = IEEE80211_MALLOC(space, M_TEMP,
483		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
484		if (p == NULL) {
485			error = ENOMEM;
486			goto bad;
487		}
488		req.si = p;
489		if (ni == NULL) {
490			ieee80211_iterate_nodes_vap(&ic->ic_sta, vap,
491			    get_sta_info, &req);
492		} else
493			get_sta_info(&req, ni);
494		ireq->i_len = space - req.space;
495		error = copyout(p, (uint8_t *) ireq->i_data+off, ireq->i_len);
496		IEEE80211_FREE(p, M_TEMP);
497	} else
498		ireq->i_len = 0;
499bad:
500	if (ni != NULL)
501		ieee80211_free_node(ni);
502	return error;
503}
504
505static int
506ieee80211_ioctl_getstainfo(struct ieee80211vap *vap, struct ieee80211req *ireq)
507{
508	uint8_t macaddr[IEEE80211_ADDR_LEN];
509	const size_t off = __offsetof(struct ieee80211req_sta_req, info);
510	struct ieee80211_node *ni;
511	int error;
512
513	if (ireq->i_len < sizeof(struct ieee80211req_sta_req))
514		return EFAULT;
515	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
516	if (error != 0)
517		return error;
518	if (IEEE80211_ADDR_EQ(macaddr, vap->iv_ifp->if_broadcastaddr)) {
519		ni = NULL;
520	} else {
521		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
522		if (ni == NULL)
523			return ENOENT;
524	}
525	return getstainfo_common(vap, ireq, ni, off);
526}
527
528static int
529ieee80211_ioctl_getstatxpow(struct ieee80211vap *vap, struct ieee80211req *ireq)
530{
531	struct ieee80211_node *ni;
532	struct ieee80211req_sta_txpow txpow;
533	int error;
534
535	if (ireq->i_len != sizeof(txpow))
536		return EINVAL;
537	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
538	if (error != 0)
539		return error;
540	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, txpow.it_macaddr);
541	if (ni == NULL)
542		return ENOENT;
543	txpow.it_txpow = ni->ni_txpower;
544	error = copyout(&txpow, ireq->i_data, sizeof(txpow));
545	ieee80211_free_node(ni);
546	return error;
547}
548
549static int
550ieee80211_ioctl_getwmeparam(struct ieee80211vap *vap, struct ieee80211req *ireq)
551{
552	struct ieee80211com *ic = vap->iv_ic;
553	struct ieee80211_wme_state *wme = &ic->ic_wme;
554	struct wmeParams *wmep;
555	int ac;
556
557	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
558		return EINVAL;
559
560	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
561	if (ac >= WME_NUM_AC)
562		ac = WME_AC_BE;
563	if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
564		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
565	else
566		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
567	switch (ireq->i_type) {
568	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
569		ireq->i_val = wmep->wmep_logcwmin;
570		break;
571	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
572		ireq->i_val = wmep->wmep_logcwmax;
573		break;
574	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
575		ireq->i_val = wmep->wmep_aifsn;
576		break;
577	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
578		ireq->i_val = wmep->wmep_txopLimit;
579		break;
580	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
581		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
582		ireq->i_val = wmep->wmep_acm;
583		break;
584	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
585		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
586		ireq->i_val = !wmep->wmep_noackPolicy;
587		break;
588	}
589	return 0;
590}
591
592static int
593ieee80211_ioctl_getmaccmd(struct ieee80211vap *vap, struct ieee80211req *ireq)
594{
595	const struct ieee80211_aclator *acl = vap->iv_acl;
596
597	return (acl == NULL ? EINVAL : acl->iac_getioctl(vap, ireq));
598}
599
600static int
601ieee80211_ioctl_getcurchan(struct ieee80211vap *vap, struct ieee80211req *ireq)
602{
603	struct ieee80211com *ic = vap->iv_ic;
604	struct ieee80211_channel *c;
605
606	if (ireq->i_len != sizeof(struct ieee80211_channel))
607		return EINVAL;
608	/*
609	 * vap's may have different operating channels when HT is
610	 * in use.  When in RUN state report the vap-specific channel.
611	 * Otherwise return curchan.
612	 */
613	if (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP)
614		c = vap->iv_bss->ni_chan;
615	else
616		c = ic->ic_curchan;
617	return copyout(c, ireq->i_data, sizeof(*c));
618}
619
620static int
621getappie(const struct ieee80211_appie *aie, struct ieee80211req *ireq)
622{
623	if (aie == NULL)
624		return EINVAL;
625	/* NB: truncate, caller can check length */
626	if (ireq->i_len > aie->ie_len)
627		ireq->i_len = aie->ie_len;
628	return copyout(aie->ie_data, ireq->i_data, ireq->i_len);
629}
630
631static int
632ieee80211_ioctl_getappie(struct ieee80211vap *vap, struct ieee80211req *ireq)
633{
634	uint8_t fc0;
635
636	fc0 = ireq->i_val & 0xff;
637	if ((fc0 & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
638		return EINVAL;
639	/* NB: could check iv_opmode and reject but hardly worth the effort */
640	switch (fc0 & IEEE80211_FC0_SUBTYPE_MASK) {
641	case IEEE80211_FC0_SUBTYPE_BEACON:
642		return getappie(vap->iv_appie_beacon, ireq);
643	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
644		return getappie(vap->iv_appie_proberesp, ireq);
645	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
646		return getappie(vap->iv_appie_assocresp, ireq);
647	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
648		return getappie(vap->iv_appie_probereq, ireq);
649	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
650		return getappie(vap->iv_appie_assocreq, ireq);
651	case IEEE80211_FC0_SUBTYPE_BEACON|IEEE80211_FC0_SUBTYPE_PROBE_RESP:
652		return getappie(vap->iv_appie_wpa, ireq);
653	}
654	return EINVAL;
655}
656
657static int
658ieee80211_ioctl_getregdomain(struct ieee80211vap *vap,
659	const struct ieee80211req *ireq)
660{
661	struct ieee80211com *ic = vap->iv_ic;
662
663	if (ireq->i_len != sizeof(ic->ic_regdomain))
664		return EINVAL;
665	return copyout(&ic->ic_regdomain, ireq->i_data,
666	    sizeof(ic->ic_regdomain));
667}
668
669static int
670ieee80211_ioctl_getroam(struct ieee80211vap *vap,
671	const struct ieee80211req *ireq)
672{
673	size_t len = ireq->i_len;
674	/* NB: accept short requests for backwards compat */
675	if (len > sizeof(vap->iv_roamparms))
676		len = sizeof(vap->iv_roamparms);
677	return copyout(vap->iv_roamparms, ireq->i_data, len);
678}
679
680static int
681ieee80211_ioctl_gettxparams(struct ieee80211vap *vap,
682	const struct ieee80211req *ireq)
683{
684	size_t len = ireq->i_len;
685	/* NB: accept short requests for backwards compat */
686	if (len > sizeof(vap->iv_txparms))
687		len = sizeof(vap->iv_txparms);
688	return copyout(vap->iv_txparms, ireq->i_data, len);
689}
690
691static int
692ieee80211_ioctl_getdevcaps(struct ieee80211com *ic,
693	const struct ieee80211req *ireq)
694{
695	struct ieee80211_devcaps_req *dc;
696	struct ieee80211req_chaninfo *ci;
697	int maxchans, error;
698
699	maxchans = 1 + ((ireq->i_len - sizeof(struct ieee80211_devcaps_req)) /
700	    sizeof(struct ieee80211_channel));
701	/* NB: require 1 so we know ic_nchans is accessible */
702	if (maxchans < 1)
703		return EINVAL;
704	/* constrain max request size, 2K channels is ~24Kbytes */
705	if (maxchans > 2048)
706		maxchans = 2048;
707	dc = (struct ieee80211_devcaps_req *)
708	    IEEE80211_MALLOC(IEEE80211_DEVCAPS_SIZE(maxchans), M_TEMP,
709	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
710	if (dc == NULL)
711		return ENOMEM;
712	dc->dc_drivercaps = ic->ic_caps;
713	dc->dc_cryptocaps = ic->ic_cryptocaps;
714	dc->dc_htcaps = ic->ic_htcaps;
715	dc->dc_vhtcaps = ic->ic_vhtcaps;
716	ci = &dc->dc_chaninfo;
717	ic->ic_getradiocaps(ic, maxchans, &ci->ic_nchans, ci->ic_chans);
718	KASSERT(ci->ic_nchans <= maxchans,
719	    ("nchans %d maxchans %d", ci->ic_nchans, maxchans));
720	ieee80211_sort_channels(ci->ic_chans, ci->ic_nchans);
721	error = copyout(dc, ireq->i_data, IEEE80211_DEVCAPS_SPACE(dc));
722	IEEE80211_FREE(dc, M_TEMP);
723	return error;
724}
725
726static int
727ieee80211_ioctl_getstavlan(struct ieee80211vap *vap, struct ieee80211req *ireq)
728{
729	struct ieee80211_node *ni;
730	struct ieee80211req_sta_vlan vlan;
731	int error;
732
733	if (ireq->i_len != sizeof(vlan))
734		return EINVAL;
735	error = copyin(ireq->i_data, &vlan, sizeof(vlan));
736	if (error != 0)
737		return error;
738	if (!IEEE80211_ADDR_EQ(vlan.sv_macaddr, zerobssid)) {
739		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
740		    vlan.sv_macaddr);
741		if (ni == NULL)
742			return ENOENT;
743	} else
744		ni = ieee80211_ref_node(vap->iv_bss);
745	vlan.sv_vlan = ni->ni_vlan;
746	error = copyout(&vlan, ireq->i_data, sizeof(vlan));
747	ieee80211_free_node(ni);
748	return error;
749}
750
751/*
752 * Dummy ioctl get handler so the linker set is defined.
753 */
754static int
755dummy_ioctl_get(struct ieee80211vap *vap, struct ieee80211req *ireq)
756{
757	return ENOSYS;
758}
759IEEE80211_IOCTL_GET(dummy, dummy_ioctl_get);
760
761static int
762ieee80211_ioctl_getdefault(struct ieee80211vap *vap, struct ieee80211req *ireq)
763{
764	ieee80211_ioctl_getfunc * const *get;
765	int error;
766
767	SET_FOREACH(get, ieee80211_ioctl_getset) {
768		error = (*get)(vap, ireq);
769		if (error != ENOSYS)
770			return error;
771	}
772	return EINVAL;
773}
774
775static int
776ieee80211_ioctl_get80211(struct ieee80211vap *vap, u_long cmd,
777    struct ieee80211req *ireq)
778{
779#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
780	struct ieee80211com *ic = vap->iv_ic;
781	u_int kid, len;
782	uint8_t tmpkey[IEEE80211_KEYBUF_SIZE];
783	char tmpssid[IEEE80211_NWID_LEN];
784	int error = 0;
785
786	switch (ireq->i_type) {
787	case IEEE80211_IOC_SSID:
788		switch (vap->iv_state) {
789		case IEEE80211_S_INIT:
790		case IEEE80211_S_SCAN:
791			ireq->i_len = vap->iv_des_ssid[0].len;
792			memcpy(tmpssid, vap->iv_des_ssid[0].ssid, ireq->i_len);
793			break;
794		default:
795			ireq->i_len = vap->iv_bss->ni_esslen;
796			memcpy(tmpssid, vap->iv_bss->ni_essid, ireq->i_len);
797			break;
798		}
799		error = copyout(tmpssid, ireq->i_data, ireq->i_len);
800		break;
801	case IEEE80211_IOC_NUMSSIDS:
802		ireq->i_val = 1;
803		break;
804	case IEEE80211_IOC_WEP:
805		if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0)
806			ireq->i_val = IEEE80211_WEP_OFF;
807		else if (vap->iv_flags & IEEE80211_F_DROPUNENC)
808			ireq->i_val = IEEE80211_WEP_ON;
809		else
810			ireq->i_val = IEEE80211_WEP_MIXED;
811		break;
812	case IEEE80211_IOC_WEPKEY:
813		kid = (u_int) ireq->i_val;
814		if (kid >= IEEE80211_WEP_NKID)
815			return EINVAL;
816		len = (u_int) vap->iv_nw_keys[kid].wk_keylen;
817		/* NB: only root can read WEP keys */
818		if (priv_check(curthread, PRIV_NET80211_GETKEY) == 0) {
819			bcopy(vap->iv_nw_keys[kid].wk_key, tmpkey, len);
820		} else {
821			bzero(tmpkey, len);
822		}
823		ireq->i_len = len;
824		error = copyout(tmpkey, ireq->i_data, len);
825		break;
826	case IEEE80211_IOC_NUMWEPKEYS:
827		ireq->i_val = IEEE80211_WEP_NKID;
828		break;
829	case IEEE80211_IOC_WEPTXKEY:
830		ireq->i_val = vap->iv_def_txkey;
831		break;
832	case IEEE80211_IOC_AUTHMODE:
833		if (vap->iv_flags & IEEE80211_F_WPA)
834			ireq->i_val = IEEE80211_AUTH_WPA;
835		else
836			ireq->i_val = vap->iv_bss->ni_authmode;
837		break;
838	case IEEE80211_IOC_CHANNEL:
839		ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
840		break;
841	case IEEE80211_IOC_POWERSAVE:
842		if (vap->iv_flags & IEEE80211_F_PMGTON)
843			ireq->i_val = IEEE80211_POWERSAVE_ON;
844		else
845			ireq->i_val = IEEE80211_POWERSAVE_OFF;
846		break;
847	case IEEE80211_IOC_POWERSAVESLEEP:
848		ireq->i_val = ic->ic_lintval;
849		break;
850	case IEEE80211_IOC_RTSTHRESHOLD:
851		ireq->i_val = vap->iv_rtsthreshold;
852		break;
853	case IEEE80211_IOC_PROTMODE:
854		ireq->i_val = ic->ic_protmode;
855		break;
856	case IEEE80211_IOC_TXPOWER:
857		/*
858		 * Tx power limit is the min of max regulatory
859		 * power, any user-set limit, and the max the
860		 * radio can do.
861		 *
862		 * TODO: methodize this
863		 */
864		ireq->i_val = 2*ic->ic_curchan->ic_maxregpower;
865		if (ireq->i_val > ic->ic_txpowlimit)
866			ireq->i_val = ic->ic_txpowlimit;
867		if (ireq->i_val > ic->ic_curchan->ic_maxpower)
868			ireq->i_val = ic->ic_curchan->ic_maxpower;
869		break;
870	case IEEE80211_IOC_WPA:
871		switch (vap->iv_flags & IEEE80211_F_WPA) {
872		case IEEE80211_F_WPA1:
873			ireq->i_val = 1;
874			break;
875		case IEEE80211_F_WPA2:
876			ireq->i_val = 2;
877			break;
878		case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
879			ireq->i_val = 3;
880			break;
881		default:
882			ireq->i_val = 0;
883			break;
884		}
885		break;
886	case IEEE80211_IOC_CHANLIST:
887		error = ieee80211_ioctl_getchanlist(vap, ireq);
888		break;
889	case IEEE80211_IOC_ROAMING:
890		ireq->i_val = vap->iv_roaming;
891		break;
892	case IEEE80211_IOC_PRIVACY:
893		ireq->i_val = (vap->iv_flags & IEEE80211_F_PRIVACY) != 0;
894		break;
895	case IEEE80211_IOC_DROPUNENCRYPTED:
896		ireq->i_val = (vap->iv_flags & IEEE80211_F_DROPUNENC) != 0;
897		break;
898	case IEEE80211_IOC_COUNTERMEASURES:
899		ireq->i_val = (vap->iv_flags & IEEE80211_F_COUNTERM) != 0;
900		break;
901	case IEEE80211_IOC_WME:
902		ireq->i_val = (vap->iv_flags & IEEE80211_F_WME) != 0;
903		break;
904	case IEEE80211_IOC_HIDESSID:
905		ireq->i_val = (vap->iv_flags & IEEE80211_F_HIDESSID) != 0;
906		break;
907	case IEEE80211_IOC_APBRIDGE:
908		ireq->i_val = (vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0;
909		break;
910	case IEEE80211_IOC_WPAKEY:
911		error = ieee80211_ioctl_getkey(vap, ireq);
912		break;
913	case IEEE80211_IOC_CHANINFO:
914		error = ieee80211_ioctl_getchaninfo(vap, ireq);
915		break;
916	case IEEE80211_IOC_BSSID:
917		if (ireq->i_len != IEEE80211_ADDR_LEN)
918			return EINVAL;
919		if (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP) {
920			error = copyout(vap->iv_opmode == IEEE80211_M_WDS ?
921			    vap->iv_bss->ni_macaddr : vap->iv_bss->ni_bssid,
922			    ireq->i_data, ireq->i_len);
923		} else
924			error = copyout(vap->iv_des_bssid, ireq->i_data,
925			    ireq->i_len);
926		break;
927	case IEEE80211_IOC_WPAIE:
928	case IEEE80211_IOC_WPAIE2:
929		error = ieee80211_ioctl_getwpaie(vap, ireq, ireq->i_type);
930		break;
931	case IEEE80211_IOC_SCAN_RESULTS:
932		error = ieee80211_ioctl_getscanresults(vap, ireq);
933		break;
934	case IEEE80211_IOC_STA_STATS:
935		error = ieee80211_ioctl_getstastats(vap, ireq);
936		break;
937	case IEEE80211_IOC_TXPOWMAX:
938		ireq->i_val = vap->iv_bss->ni_txpower;
939		break;
940	case IEEE80211_IOC_STA_TXPOW:
941		error = ieee80211_ioctl_getstatxpow(vap, ireq);
942		break;
943	case IEEE80211_IOC_STA_INFO:
944		error = ieee80211_ioctl_getstainfo(vap, ireq);
945		break;
946	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
947	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
948	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
949	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
950	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
951	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only) */
952		error = ieee80211_ioctl_getwmeparam(vap, ireq);
953		break;
954	case IEEE80211_IOC_DTIM_PERIOD:
955		ireq->i_val = vap->iv_dtim_period;
956		break;
957	case IEEE80211_IOC_BEACON_INTERVAL:
958		/* NB: get from ic_bss for station mode */
959		ireq->i_val = vap->iv_bss->ni_intval;
960		break;
961	case IEEE80211_IOC_PUREG:
962		ireq->i_val = (vap->iv_flags & IEEE80211_F_PUREG) != 0;
963		break;
964	case IEEE80211_IOC_QUIET:
965		ireq->i_val = vap->iv_quiet;
966		break;
967	case IEEE80211_IOC_QUIET_COUNT:
968		ireq->i_val = vap->iv_quiet_count;
969		break;
970	case IEEE80211_IOC_QUIET_PERIOD:
971		ireq->i_val = vap->iv_quiet_period;
972		break;
973	case IEEE80211_IOC_QUIET_DUR:
974		ireq->i_val = vap->iv_quiet_duration;
975		break;
976	case IEEE80211_IOC_QUIET_OFFSET:
977		ireq->i_val = vap->iv_quiet_offset;
978		break;
979	case IEEE80211_IOC_BGSCAN:
980		ireq->i_val = (vap->iv_flags & IEEE80211_F_BGSCAN) != 0;
981		break;
982	case IEEE80211_IOC_BGSCAN_IDLE:
983		ireq->i_val = vap->iv_bgscanidle*hz/1000;	/* ms */
984		break;
985	case IEEE80211_IOC_BGSCAN_INTERVAL:
986		ireq->i_val = vap->iv_bgscanintvl/hz;		/* seconds */
987		break;
988	case IEEE80211_IOC_SCANVALID:
989		ireq->i_val = vap->iv_scanvalid/hz;		/* seconds */
990		break;
991	case IEEE80211_IOC_FRAGTHRESHOLD:
992		ireq->i_val = vap->iv_fragthreshold;
993		break;
994	case IEEE80211_IOC_MACCMD:
995		error = ieee80211_ioctl_getmaccmd(vap, ireq);
996		break;
997	case IEEE80211_IOC_BURST:
998		ireq->i_val = (vap->iv_flags & IEEE80211_F_BURST) != 0;
999		break;
1000	case IEEE80211_IOC_BMISSTHRESHOLD:
1001		ireq->i_val = vap->iv_bmissthreshold;
1002		break;
1003	case IEEE80211_IOC_CURCHAN:
1004		error = ieee80211_ioctl_getcurchan(vap, ireq);
1005		break;
1006	case IEEE80211_IOC_SHORTGI:
1007		ireq->i_val = 0;
1008		if (vap->iv_flags_ht & IEEE80211_FHT_SHORTGI20)
1009			ireq->i_val |= IEEE80211_HTCAP_SHORTGI20;
1010		if (vap->iv_flags_ht & IEEE80211_FHT_SHORTGI40)
1011			ireq->i_val |= IEEE80211_HTCAP_SHORTGI40;
1012		break;
1013	case IEEE80211_IOC_AMPDU:
1014		ireq->i_val = 0;
1015		if (vap->iv_flags_ht & IEEE80211_FHT_AMPDU_TX)
1016			ireq->i_val |= 1;
1017		if (vap->iv_flags_ht & IEEE80211_FHT_AMPDU_RX)
1018			ireq->i_val |= 2;
1019		break;
1020	case IEEE80211_IOC_AMPDU_LIMIT:
1021		/* XXX TODO: make this a per-node thing; and leave this as global */
1022		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
1023			ireq->i_val = vap->iv_ampdu_rxmax;
1024		else if (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP)
1025			/*
1026			 * XXX TODO: this isn't completely correct, as we've
1027			 * negotiated the higher of the two.
1028			 */
1029			ireq->i_val = MS(vap->iv_bss->ni_htparam,
1030			    IEEE80211_HTCAP_MAXRXAMPDU);
1031		else
1032			ireq->i_val = vap->iv_ampdu_limit;
1033		break;
1034	case IEEE80211_IOC_AMPDU_DENSITY:
1035		/* XXX TODO: make this a per-node thing; and leave this as global */
1036		if (vap->iv_opmode == IEEE80211_M_STA &&
1037		    (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP))
1038			/*
1039			 * XXX TODO: this isn't completely correct, as we've
1040			 * negotiated the higher of the two.
1041			 */
1042			ireq->i_val = MS(vap->iv_bss->ni_htparam,
1043			    IEEE80211_HTCAP_MPDUDENSITY);
1044		else
1045			ireq->i_val = vap->iv_ampdu_density;
1046		break;
1047	case IEEE80211_IOC_AMSDU:
1048		ireq->i_val = 0;
1049		if (vap->iv_flags_ht & IEEE80211_FHT_AMSDU_TX)
1050			ireq->i_val |= 1;
1051		if (vap->iv_flags_ht & IEEE80211_FHT_AMSDU_RX)
1052			ireq->i_val |= 2;
1053		break;
1054	case IEEE80211_IOC_AMSDU_LIMIT:
1055		ireq->i_val = vap->iv_amsdu_limit;	/* XXX truncation? */
1056		break;
1057	case IEEE80211_IOC_PUREN:
1058		ireq->i_val = (vap->iv_flags_ht & IEEE80211_FHT_PUREN) != 0;
1059		break;
1060	case IEEE80211_IOC_DOTH:
1061		ireq->i_val = (vap->iv_flags & IEEE80211_F_DOTH) != 0;
1062		break;
1063	case IEEE80211_IOC_REGDOMAIN:
1064		error = ieee80211_ioctl_getregdomain(vap, ireq);
1065		break;
1066	case IEEE80211_IOC_ROAM:
1067		error = ieee80211_ioctl_getroam(vap, ireq);
1068		break;
1069	case IEEE80211_IOC_TXPARAMS:
1070		error = ieee80211_ioctl_gettxparams(vap, ireq);
1071		break;
1072	case IEEE80211_IOC_HTCOMPAT:
1073		ireq->i_val = (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) != 0;
1074		break;
1075	case IEEE80211_IOC_DWDS:
1076		ireq->i_val = (vap->iv_flags & IEEE80211_F_DWDS) != 0;
1077		break;
1078	case IEEE80211_IOC_INACTIVITY:
1079		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_INACT) != 0;
1080		break;
1081	case IEEE80211_IOC_APPIE:
1082		error = ieee80211_ioctl_getappie(vap, ireq);
1083		break;
1084	case IEEE80211_IOC_WPS:
1085		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_WPS) != 0;
1086		break;
1087	case IEEE80211_IOC_TSN:
1088		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_TSN) != 0;
1089		break;
1090	case IEEE80211_IOC_DFS:
1091		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_DFS) != 0;
1092		break;
1093	case IEEE80211_IOC_DOTD:
1094		ireq->i_val = (vap->iv_flags_ext & IEEE80211_FEXT_DOTD) != 0;
1095		break;
1096	case IEEE80211_IOC_DEVCAPS:
1097		error = ieee80211_ioctl_getdevcaps(ic, ireq);
1098		break;
1099	case IEEE80211_IOC_HTPROTMODE:
1100		ireq->i_val = ic->ic_htprotmode;
1101		break;
1102	case IEEE80211_IOC_HTCONF:
1103		if (vap->iv_flags_ht & IEEE80211_FHT_HT) {
1104			ireq->i_val = 1;
1105			if (vap->iv_flags_ht & IEEE80211_FHT_USEHT40)
1106				ireq->i_val |= 2;
1107		} else
1108			ireq->i_val = 0;
1109		break;
1110	case IEEE80211_IOC_STA_VLAN:
1111		error = ieee80211_ioctl_getstavlan(vap, ireq);
1112		break;
1113	case IEEE80211_IOC_SMPS:
1114		if (vap->iv_opmode == IEEE80211_M_STA &&
1115		    (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP)) {
1116			if (vap->iv_bss->ni_flags & IEEE80211_NODE_MIMO_RTS)
1117				ireq->i_val = IEEE80211_HTCAP_SMPS_DYNAMIC;
1118			else if (vap->iv_bss->ni_flags & IEEE80211_NODE_MIMO_PS)
1119				ireq->i_val = IEEE80211_HTCAP_SMPS_ENA;
1120			else
1121				ireq->i_val = IEEE80211_HTCAP_SMPS_OFF;
1122		} else
1123			ireq->i_val = vap->iv_htcaps & IEEE80211_HTCAP_SMPS;
1124		break;
1125	case IEEE80211_IOC_RIFS:
1126		if (vap->iv_opmode == IEEE80211_M_STA &&
1127		    (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP))
1128			ireq->i_val =
1129			    (vap->iv_bss->ni_flags & IEEE80211_NODE_RIFS) != 0;
1130		else
1131			ireq->i_val =
1132			    (vap->iv_flags_ht & IEEE80211_FHT_RIFS) != 0;
1133		break;
1134	case IEEE80211_IOC_STBC:
1135		ireq->i_val = 0;
1136		if (vap->iv_flags_ht & IEEE80211_FHT_STBC_TX)
1137			ireq->i_val |= 1;
1138		if (vap->iv_flags_ht & IEEE80211_FHT_STBC_RX)
1139			ireq->i_val |= 2;
1140		break;
1141	case IEEE80211_IOC_LDPC:
1142		ireq->i_val = 0;
1143		if (vap->iv_flags_ht & IEEE80211_FHT_LDPC_TX)
1144			ireq->i_val |= 1;
1145		if (vap->iv_flags_ht & IEEE80211_FHT_LDPC_RX)
1146			ireq->i_val |= 2;
1147		break;
1148
1149	/* VHT */
1150	case IEEE80211_IOC_VHTCONF:
1151		ireq->i_val = 0;
1152		if (vap->iv_flags_vht & IEEE80211_FVHT_VHT)
1153			ireq->i_val |= 1;
1154		if (vap->iv_flags_vht & IEEE80211_FVHT_USEVHT40)
1155			ireq->i_val |= 2;
1156		if (vap->iv_flags_vht & IEEE80211_FVHT_USEVHT80)
1157			ireq->i_val |= 4;
1158		if (vap->iv_flags_vht & IEEE80211_FVHT_USEVHT80P80)
1159			ireq->i_val |= 8;
1160		if (vap->iv_flags_vht & IEEE80211_FVHT_USEVHT160)
1161			ireq->i_val |= 16;
1162		break;
1163
1164	default:
1165		error = ieee80211_ioctl_getdefault(vap, ireq);
1166		break;
1167	}
1168	return error;
1169#undef MS
1170}
1171
1172static int
1173ieee80211_ioctl_setkey(struct ieee80211vap *vap, struct ieee80211req *ireq)
1174{
1175	struct ieee80211req_key ik;
1176	struct ieee80211_node *ni;
1177	struct ieee80211_key *wk;
1178	uint16_t kid;
1179	int error, i;
1180
1181	if (ireq->i_len != sizeof(ik))
1182		return EINVAL;
1183	error = copyin(ireq->i_data, &ik, sizeof(ik));
1184	if (error)
1185		return error;
1186	/* NB: cipher support is verified by ieee80211_crypt_newkey */
1187	/* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1188	if (ik.ik_keylen > sizeof(ik.ik_keydata))
1189		return E2BIG;
1190	kid = ik.ik_keyix;
1191	if (kid == IEEE80211_KEYIX_NONE) {
1192		/* XXX unicast keys currently must be tx/rx */
1193		if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1194			return EINVAL;
1195		if (vap->iv_opmode == IEEE80211_M_STA) {
1196			ni = ieee80211_ref_node(vap->iv_bss);
1197			if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
1198				ieee80211_free_node(ni);
1199				return EADDRNOTAVAIL;
1200			}
1201		} else {
1202			ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
1203				ik.ik_macaddr);
1204			if (ni == NULL)
1205				return ENOENT;
1206		}
1207		wk = &ni->ni_ucastkey;
1208	} else {
1209		if (kid >= IEEE80211_WEP_NKID)
1210			return EINVAL;
1211		wk = &vap->iv_nw_keys[kid];
1212		/*
1213		 * Global slots start off w/o any assigned key index.
1214		 * Force one here for consistency with IEEE80211_IOC_WEPKEY.
1215		 */
1216		if (wk->wk_keyix == IEEE80211_KEYIX_NONE)
1217			wk->wk_keyix = kid;
1218		ni = NULL;
1219	}
1220	error = 0;
1221	ieee80211_key_update_begin(vap);
1222	if (ieee80211_crypto_newkey(vap, ik.ik_type, ik.ik_flags, wk)) {
1223		wk->wk_keylen = ik.ik_keylen;
1224		/* NB: MIC presence is implied by cipher type */
1225		if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1226			wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1227		for (i = 0; i < IEEE80211_TID_SIZE; i++)
1228			wk->wk_keyrsc[i] = ik.ik_keyrsc;
1229		wk->wk_keytsc = 0;			/* new key, reset */
1230		memset(wk->wk_key, 0, sizeof(wk->wk_key));
1231		memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1232		IEEE80211_ADDR_COPY(wk->wk_macaddr,
1233		    ni != NULL ?  ni->ni_macaddr : ik.ik_macaddr);
1234		if (!ieee80211_crypto_setkey(vap, wk))
1235			error = EIO;
1236		else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1237			/*
1238			 * Inform the driver that this is the default
1239			 * transmit key.  Now, ideally we'd just set
1240			 * a flag in the key update that would
1241			 * say "yes, we're the default key", but
1242			 * that currently isn't the way the ioctl ->
1243			 * key interface works.
1244			 */
1245			ieee80211_crypto_set_deftxkey(vap, kid);
1246	} else
1247		error = ENXIO;
1248	ieee80211_key_update_end(vap);
1249	if (ni != NULL)
1250		ieee80211_free_node(ni);
1251	return error;
1252}
1253
1254static int
1255ieee80211_ioctl_delkey(struct ieee80211vap *vap, struct ieee80211req *ireq)
1256{
1257	struct ieee80211req_del_key dk;
1258	int kid, error;
1259
1260	if (ireq->i_len != sizeof(dk))
1261		return EINVAL;
1262	error = copyin(ireq->i_data, &dk, sizeof(dk));
1263	if (error)
1264		return error;
1265	kid = dk.idk_keyix;
1266	/* XXX uint8_t -> uint16_t */
1267	if (dk.idk_keyix == (uint8_t) IEEE80211_KEYIX_NONE) {
1268		struct ieee80211_node *ni;
1269
1270		if (vap->iv_opmode == IEEE80211_M_STA) {
1271			ni = ieee80211_ref_node(vap->iv_bss);
1272			if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
1273				ieee80211_free_node(ni);
1274				return EADDRNOTAVAIL;
1275			}
1276		} else {
1277			ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
1278				dk.idk_macaddr);
1279			if (ni == NULL)
1280				return ENOENT;
1281		}
1282		/* XXX error return */
1283		ieee80211_node_delucastkey(ni);
1284		ieee80211_free_node(ni);
1285	} else {
1286		if (kid >= IEEE80211_WEP_NKID)
1287			return EINVAL;
1288		/* XXX error return */
1289		ieee80211_crypto_delkey(vap, &vap->iv_nw_keys[kid]);
1290	}
1291	return 0;
1292}
1293
1294struct mlmeop {
1295	struct ieee80211vap *vap;
1296	int	op;
1297	int	reason;
1298};
1299
1300static void
1301mlmedebug(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
1302	int op, int reason)
1303{
1304#ifdef IEEE80211_DEBUG
1305	static const struct {
1306		int mask;
1307		const char *opstr;
1308	} ops[] = {
1309		{ 0, "op#0" },
1310		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1311		  IEEE80211_MSG_ASSOC, "assoc" },
1312		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1313		  IEEE80211_MSG_ASSOC, "disassoc" },
1314		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1315		  IEEE80211_MSG_AUTH, "deauth" },
1316		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1317		  IEEE80211_MSG_AUTH, "authorize" },
1318		{ IEEE80211_MSG_IOCTL | IEEE80211_MSG_STATE |
1319		  IEEE80211_MSG_AUTH, "unauthorize" },
1320	};
1321
1322	if (op == IEEE80211_MLME_AUTH) {
1323		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_IOCTL |
1324		    IEEE80211_MSG_STATE | IEEE80211_MSG_AUTH, mac,
1325		    "station authenticate %s via MLME (reason: %d (%s))",
1326		    reason == IEEE80211_STATUS_SUCCESS ? "ACCEPT" : "REJECT",
1327		    reason, ieee80211_reason_to_string(reason));
1328	} else if (!(IEEE80211_MLME_ASSOC <= op && op <= IEEE80211_MLME_AUTH)) {
1329		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, mac,
1330		    "unknown MLME request %d (reason: %d (%s))", op, reason,
1331		    ieee80211_reason_to_string(reason));
1332	} else if (reason == IEEE80211_STATUS_SUCCESS) {
1333		IEEE80211_NOTE_MAC(vap, ops[op].mask, mac,
1334		    "station %s via MLME", ops[op].opstr);
1335	} else {
1336		IEEE80211_NOTE_MAC(vap, ops[op].mask, mac,
1337		    "station %s via MLME (reason: %d (%s))", ops[op].opstr,
1338		    reason, ieee80211_reason_to_string(reason));
1339	}
1340#endif /* IEEE80211_DEBUG */
1341}
1342
1343static void
1344domlme(void *arg, struct ieee80211_node *ni)
1345{
1346	struct mlmeop *mop = arg;
1347	struct ieee80211vap *vap = ni->ni_vap;
1348
1349	if (vap != mop->vap)
1350		return;
1351	/*
1352	 * NB: if ni_associd is zero then the node is already cleaned
1353	 * up and we don't need to do this (we're safely holding a
1354	 * reference but should otherwise not modify it's state).
1355	 */
1356	if (ni->ni_associd == 0)
1357		return;
1358	mlmedebug(vap, ni->ni_macaddr, mop->op, mop->reason);
1359	if (mop->op == IEEE80211_MLME_DEAUTH) {
1360		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
1361		    mop->reason);
1362	} else {
1363		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC,
1364		    mop->reason);
1365	}
1366	ieee80211_node_leave(ni);
1367}
1368
1369static int
1370setmlme_dropsta(struct ieee80211vap *vap,
1371	const uint8_t mac[IEEE80211_ADDR_LEN], struct mlmeop *mlmeop)
1372{
1373	struct ieee80211_node_table *nt = &vap->iv_ic->ic_sta;
1374	struct ieee80211_node *ni;
1375	int error = 0;
1376
1377	/* NB: the broadcast address means do 'em all */
1378	if (!IEEE80211_ADDR_EQ(mac, vap->iv_ifp->if_broadcastaddr)) {
1379		IEEE80211_NODE_LOCK(nt);
1380		ni = ieee80211_find_node_locked(nt, mac);
1381		IEEE80211_NODE_UNLOCK(nt);
1382		/*
1383		 * Don't do the node update inside the node
1384		 * table lock.  This unfortunately causes LORs
1385		 * with drivers and their TX paths.
1386		 */
1387		if (ni != NULL) {
1388			domlme(mlmeop, ni);
1389			ieee80211_free_node(ni);
1390		} else
1391			error = ENOENT;
1392	} else {
1393		ieee80211_iterate_nodes(nt, domlme, mlmeop);
1394	}
1395	return error;
1396}
1397
1398static int
1399setmlme_common(struct ieee80211vap *vap, int op,
1400	const uint8_t mac[IEEE80211_ADDR_LEN], int reason)
1401{
1402	struct ieee80211com *ic = vap->iv_ic;
1403	struct ieee80211_node_table *nt = &ic->ic_sta;
1404	struct ieee80211_node *ni;
1405	struct mlmeop mlmeop;
1406	int error;
1407
1408	error = 0;
1409	switch (op) {
1410	case IEEE80211_MLME_DISASSOC:
1411	case IEEE80211_MLME_DEAUTH:
1412		switch (vap->iv_opmode) {
1413		case IEEE80211_M_STA:
1414			mlmedebug(vap, vap->iv_bss->ni_macaddr, op, reason);
1415			/* XXX not quite right */
1416			ieee80211_new_state(vap, IEEE80211_S_INIT, reason);
1417			break;
1418		case IEEE80211_M_HOSTAP:
1419			mlmeop.vap = vap;
1420			mlmeop.op = op;
1421			mlmeop.reason = reason;
1422			error = setmlme_dropsta(vap, mac, &mlmeop);
1423			break;
1424		case IEEE80211_M_WDS:
1425			/* XXX user app should send raw frame? */
1426			if (op != IEEE80211_MLME_DEAUTH) {
1427				error = EINVAL;
1428				break;
1429			}
1430#if 0
1431			/* XXX accept any address, simplifies user code */
1432			if (!IEEE80211_ADDR_EQ(mac, vap->iv_bss->ni_macaddr)) {
1433				error = EINVAL;
1434				break;
1435			}
1436#endif
1437			mlmedebug(vap, vap->iv_bss->ni_macaddr, op, reason);
1438			ni = ieee80211_ref_node(vap->iv_bss);
1439			IEEE80211_SEND_MGMT(ni,
1440			    IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
1441			ieee80211_free_node(ni);
1442			break;
1443		case IEEE80211_M_MBSS:
1444			IEEE80211_NODE_LOCK(nt);
1445			ni = ieee80211_find_node_locked(nt, mac);
1446			/*
1447			 * Don't do the node update inside the node
1448			 * table lock.  This unfortunately causes LORs
1449			 * with drivers and their TX paths.
1450			 */
1451			IEEE80211_NODE_UNLOCK(nt);
1452			if (ni != NULL) {
1453				ieee80211_node_leave(ni);
1454				ieee80211_free_node(ni);
1455			} else {
1456				error = ENOENT;
1457			}
1458			break;
1459		default:
1460			error = EINVAL;
1461			break;
1462		}
1463		break;
1464	case IEEE80211_MLME_AUTHORIZE:
1465	case IEEE80211_MLME_UNAUTHORIZE:
1466		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
1467		    vap->iv_opmode != IEEE80211_M_WDS) {
1468			error = EINVAL;
1469			break;
1470		}
1471		IEEE80211_NODE_LOCK(nt);
1472		ni = ieee80211_find_vap_node_locked(nt, vap, mac);
1473		/*
1474		 * Don't do the node update inside the node
1475		 * table lock.  This unfortunately causes LORs
1476		 * with drivers and their TX paths.
1477		 */
1478		IEEE80211_NODE_UNLOCK(nt);
1479		if (ni != NULL) {
1480			mlmedebug(vap, mac, op, reason);
1481			if (op == IEEE80211_MLME_AUTHORIZE)
1482				ieee80211_node_authorize(ni);
1483			else
1484				ieee80211_node_unauthorize(ni);
1485			ieee80211_free_node(ni);
1486		} else
1487			error = ENOENT;
1488		break;
1489	case IEEE80211_MLME_AUTH:
1490		if (vap->iv_opmode != IEEE80211_M_HOSTAP) {
1491			error = EINVAL;
1492			break;
1493		}
1494		IEEE80211_NODE_LOCK(nt);
1495		ni = ieee80211_find_vap_node_locked(nt, vap, mac);
1496		/*
1497		 * Don't do the node update inside the node
1498		 * table lock.  This unfortunately causes LORs
1499		 * with drivers and their TX paths.
1500		 */
1501		IEEE80211_NODE_UNLOCK(nt);
1502		if (ni != NULL) {
1503			mlmedebug(vap, mac, op, reason);
1504			if (reason == IEEE80211_STATUS_SUCCESS) {
1505				IEEE80211_SEND_MGMT(ni,
1506				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
1507				/*
1508				 * For shared key auth, just continue the
1509				 * exchange.  Otherwise when 802.1x is not in
1510				 * use mark the port authorized at this point
1511				 * so traffic can flow.
1512				 */
1513				if (ni->ni_authmode != IEEE80211_AUTH_8021X &&
1514				    ni->ni_challenge == NULL)
1515				      ieee80211_node_authorize(ni);
1516			} else {
1517				vap->iv_stats.is_rx_acl++;
1518				ieee80211_send_error(ni, ni->ni_macaddr,
1519				    IEEE80211_FC0_SUBTYPE_AUTH, 2|(reason<<16));
1520				ieee80211_node_leave(ni);
1521			}
1522			ieee80211_free_node(ni);
1523		} else
1524			error = ENOENT;
1525		break;
1526	default:
1527		error = EINVAL;
1528		break;
1529	}
1530	return error;
1531}
1532
1533struct scanlookup {
1534	const uint8_t *mac;
1535	int esslen;
1536	const uint8_t *essid;
1537	const struct ieee80211_scan_entry *se;
1538};
1539
1540/*
1541 * Match mac address and any ssid.
1542 */
1543static void
1544mlmelookup(void *arg, const struct ieee80211_scan_entry *se)
1545{
1546	struct scanlookup *look = arg;
1547
1548	if (!IEEE80211_ADDR_EQ(look->mac, se->se_macaddr))
1549		return;
1550	if (look->esslen != 0) {
1551		if (se->se_ssid[1] != look->esslen)
1552			return;
1553		if (memcmp(look->essid, se->se_ssid+2, look->esslen))
1554			return;
1555	}
1556	look->se = se;
1557}
1558
1559static int
1560setmlme_assoc_sta(struct ieee80211vap *vap,
1561	const uint8_t mac[IEEE80211_ADDR_LEN], int ssid_len,
1562	const uint8_t ssid[IEEE80211_NWID_LEN])
1563{
1564	struct scanlookup lookup;
1565
1566	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
1567	    ("expected opmode STA not %s",
1568	    ieee80211_opmode_name[vap->iv_opmode]));
1569
1570	/* NB: this is racey if roaming is !manual */
1571	lookup.se = NULL;
1572	lookup.mac = mac;
1573	lookup.esslen = ssid_len;
1574	lookup.essid = ssid;
1575	ieee80211_scan_iterate(vap, mlmelookup, &lookup);
1576	if (lookup.se == NULL)
1577		return ENOENT;
1578	mlmedebug(vap, mac, IEEE80211_MLME_ASSOC, 0);
1579	if (!ieee80211_sta_join(vap, lookup.se->se_chan, lookup.se))
1580		return EIO;		/* XXX unique but could be better */
1581	return 0;
1582}
1583
1584static int
1585setmlme_assoc_adhoc(struct ieee80211vap *vap,
1586	const uint8_t mac[IEEE80211_ADDR_LEN], int ssid_len,
1587	const uint8_t ssid[IEEE80211_NWID_LEN])
1588{
1589	struct ieee80211_scan_req *sr;
1590	int error;
1591
1592	KASSERT(vap->iv_opmode == IEEE80211_M_IBSS ||
1593	    vap->iv_opmode == IEEE80211_M_AHDEMO,
1594	    ("expected opmode IBSS or AHDEMO not %s",
1595	    ieee80211_opmode_name[vap->iv_opmode]));
1596
1597	if (ssid_len == 0)
1598		return EINVAL;
1599
1600	sr = IEEE80211_MALLOC(sizeof(*sr), M_TEMP,
1601	     IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
1602	if (sr == NULL)
1603		return ENOMEM;
1604
1605	/* NB: IEEE80211_IOC_SSID call missing for ap_scan=2. */
1606	memset(vap->iv_des_ssid[0].ssid, 0, IEEE80211_NWID_LEN);
1607	vap->iv_des_ssid[0].len = ssid_len;
1608	memcpy(vap->iv_des_ssid[0].ssid, ssid, ssid_len);
1609	vap->iv_des_nssid = 1;
1610
1611	sr->sr_flags = IEEE80211_IOC_SCAN_ACTIVE | IEEE80211_IOC_SCAN_ONCE;
1612	sr->sr_duration = IEEE80211_IOC_SCAN_FOREVER;
1613	memcpy(sr->sr_ssid[0].ssid, ssid, ssid_len);
1614	sr->sr_ssid[0].len = ssid_len;
1615	sr->sr_nssid = 1;
1616
1617	error = ieee80211_scanreq(vap, sr);
1618
1619	IEEE80211_FREE(sr, M_TEMP);
1620	return error;
1621}
1622
1623static int
1624ieee80211_ioctl_setmlme(struct ieee80211vap *vap, struct ieee80211req *ireq)
1625{
1626	struct ieee80211req_mlme mlme;
1627	int error;
1628
1629	if (ireq->i_len != sizeof(mlme))
1630		return EINVAL;
1631	error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1632	if (error)
1633		return error;
1634	if  (vap->iv_opmode == IEEE80211_M_STA &&
1635	    mlme.im_op == IEEE80211_MLME_ASSOC)
1636		return setmlme_assoc_sta(vap, mlme.im_macaddr,
1637		    vap->iv_des_ssid[0].len, vap->iv_des_ssid[0].ssid);
1638	else if ((vap->iv_opmode == IEEE80211_M_IBSS ||
1639	    vap->iv_opmode == IEEE80211_M_AHDEMO) &&
1640	    mlme.im_op == IEEE80211_MLME_ASSOC)
1641		return setmlme_assoc_adhoc(vap, mlme.im_macaddr,
1642		    mlme.im_ssid_len, mlme.im_ssid);
1643	else
1644		return setmlme_common(vap, mlme.im_op,
1645		    mlme.im_macaddr, mlme.im_reason);
1646}
1647
1648static int
1649ieee80211_ioctl_macmac(struct ieee80211vap *vap, struct ieee80211req *ireq)
1650{
1651	uint8_t mac[IEEE80211_ADDR_LEN];
1652	const struct ieee80211_aclator *acl = vap->iv_acl;
1653	int error;
1654
1655	if (ireq->i_len != sizeof(mac))
1656		return EINVAL;
1657	error = copyin(ireq->i_data, mac, ireq->i_len);
1658	if (error)
1659		return error;
1660	if (acl == NULL) {
1661		acl = ieee80211_aclator_get("mac");
1662		if (acl == NULL || !acl->iac_attach(vap))
1663			return EINVAL;
1664		vap->iv_acl = acl;
1665	}
1666	if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1667		acl->iac_add(vap, mac);
1668	else
1669		acl->iac_remove(vap, mac);
1670	return 0;
1671}
1672
1673static int
1674ieee80211_ioctl_setmaccmd(struct ieee80211vap *vap, struct ieee80211req *ireq)
1675{
1676	const struct ieee80211_aclator *acl = vap->iv_acl;
1677
1678	switch (ireq->i_val) {
1679	case IEEE80211_MACCMD_POLICY_OPEN:
1680	case IEEE80211_MACCMD_POLICY_ALLOW:
1681	case IEEE80211_MACCMD_POLICY_DENY:
1682	case IEEE80211_MACCMD_POLICY_RADIUS:
1683		if (acl == NULL) {
1684			acl = ieee80211_aclator_get("mac");
1685			if (acl == NULL || !acl->iac_attach(vap))
1686				return EINVAL;
1687			vap->iv_acl = acl;
1688		}
1689		acl->iac_setpolicy(vap, ireq->i_val);
1690		break;
1691	case IEEE80211_MACCMD_FLUSH:
1692		if (acl != NULL)
1693			acl->iac_flush(vap);
1694		/* NB: silently ignore when not in use */
1695		break;
1696	case IEEE80211_MACCMD_DETACH:
1697		if (acl != NULL) {
1698			vap->iv_acl = NULL;
1699			acl->iac_detach(vap);
1700		}
1701		break;
1702	default:
1703		if (acl == NULL)
1704			return EINVAL;
1705		else
1706			return acl->iac_setioctl(vap, ireq);
1707	}
1708	return 0;
1709}
1710
1711static int
1712ieee80211_ioctl_setchanlist(struct ieee80211vap *vap, struct ieee80211req *ireq)
1713{
1714	struct ieee80211com *ic = vap->iv_ic;
1715	uint8_t *chanlist, *list;
1716	int i, nchan, maxchan, error;
1717
1718	if (ireq->i_len > sizeof(ic->ic_chan_active))
1719		ireq->i_len = sizeof(ic->ic_chan_active);
1720	list = IEEE80211_MALLOC(ireq->i_len + IEEE80211_CHAN_BYTES, M_TEMP,
1721	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
1722	if (list == NULL)
1723		return ENOMEM;
1724	error = copyin(ireq->i_data, list, ireq->i_len);
1725	if (error) {
1726		IEEE80211_FREE(list, M_TEMP);
1727		return error;
1728	}
1729	nchan = 0;
1730	chanlist = list + ireq->i_len;		/* NB: zero'd already */
1731	maxchan = ireq->i_len * NBBY;
1732	for (i = 0; i < ic->ic_nchans; i++) {
1733		const struct ieee80211_channel *c = &ic->ic_channels[i];
1734		/*
1735		 * Calculate the intersection of the user list and the
1736		 * available channels so users can do things like specify
1737		 * 1-255 to get all available channels.
1738		 */
1739		if (c->ic_ieee < maxchan && isset(list, c->ic_ieee)) {
1740			setbit(chanlist, c->ic_ieee);
1741			nchan++;
1742		}
1743	}
1744	if (nchan == 0) {
1745		IEEE80211_FREE(list, M_TEMP);
1746		return EINVAL;
1747	}
1748	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&	/* XXX */
1749	    isclr(chanlist, ic->ic_bsschan->ic_ieee))
1750		ic->ic_bsschan = IEEE80211_CHAN_ANYC;
1751	memcpy(ic->ic_chan_active, chanlist, IEEE80211_CHAN_BYTES);
1752	ieee80211_scan_flush(vap);
1753	IEEE80211_FREE(list, M_TEMP);
1754	return ENETRESET;
1755}
1756
1757static int
1758ieee80211_ioctl_setstastats(struct ieee80211vap *vap, struct ieee80211req *ireq)
1759{
1760	struct ieee80211_node *ni;
1761	uint8_t macaddr[IEEE80211_ADDR_LEN];
1762	int error;
1763
1764	/*
1765	 * NB: we could copyin ieee80211req_sta_stats so apps
1766	 *     could make selective changes but that's overkill;
1767	 *     just clear all stats for now.
1768	 */
1769	if (ireq->i_len < IEEE80211_ADDR_LEN)
1770		return EINVAL;
1771	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
1772	if (error != 0)
1773		return error;
1774	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
1775	if (ni == NULL)
1776		return ENOENT;
1777	/* XXX require ni_vap == vap? */
1778	memset(&ni->ni_stats, 0, sizeof(ni->ni_stats));
1779	ieee80211_free_node(ni);
1780	return 0;
1781}
1782
1783static int
1784ieee80211_ioctl_setstatxpow(struct ieee80211vap *vap, struct ieee80211req *ireq)
1785{
1786	struct ieee80211_node *ni;
1787	struct ieee80211req_sta_txpow txpow;
1788	int error;
1789
1790	if (ireq->i_len != sizeof(txpow))
1791		return EINVAL;
1792	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1793	if (error != 0)
1794		return error;
1795	ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, txpow.it_macaddr);
1796	if (ni == NULL)
1797		return ENOENT;
1798	ni->ni_txpower = txpow.it_txpow;
1799	ieee80211_free_node(ni);
1800	return error;
1801}
1802
1803static int
1804ieee80211_ioctl_setwmeparam(struct ieee80211vap *vap, struct ieee80211req *ireq)
1805{
1806	struct ieee80211com *ic = vap->iv_ic;
1807	struct ieee80211_wme_state *wme = &ic->ic_wme;
1808	struct wmeParams *wmep, *chanp;
1809	int isbss, ac, aggrmode;
1810
1811	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1812		return EOPNOTSUPP;
1813
1814	isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1815	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1816	aggrmode = (wme->wme_flags & WME_F_AGGRMODE);
1817	if (ac >= WME_NUM_AC)
1818		ac = WME_AC_BE;
1819	if (isbss) {
1820		chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1821		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1822	} else {
1823		chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1824		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1825	}
1826	switch (ireq->i_type) {
1827	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1828		wmep->wmep_logcwmin = ireq->i_val;
1829		if (!isbss || !aggrmode)
1830			chanp->wmep_logcwmin = ireq->i_val;
1831		break;
1832	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1833		wmep->wmep_logcwmax = ireq->i_val;
1834		if (!isbss || !aggrmode)
1835			chanp->wmep_logcwmax = ireq->i_val;
1836		break;
1837	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1838		wmep->wmep_aifsn = ireq->i_val;
1839		if (!isbss || !aggrmode)
1840			chanp->wmep_aifsn = ireq->i_val;
1841		break;
1842	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1843		wmep->wmep_txopLimit = ireq->i_val;
1844		if (!isbss || !aggrmode)
1845			chanp->wmep_txopLimit = ireq->i_val;
1846		break;
1847	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1848		wmep->wmep_acm = ireq->i_val;
1849		if (!aggrmode)
1850			chanp->wmep_acm = ireq->i_val;
1851		break;
1852	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1853		wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
1854			(ireq->i_val) == 0;
1855		break;
1856	}
1857	ieee80211_wme_updateparams(vap);
1858	return 0;
1859}
1860
1861static int
1862find11gchannel(struct ieee80211com *ic, int start, int freq)
1863{
1864	const struct ieee80211_channel *c;
1865	int i;
1866
1867	for (i = start+1; i < ic->ic_nchans; i++) {
1868		c = &ic->ic_channels[i];
1869		if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
1870			return 1;
1871	}
1872	/* NB: should not be needed but in case things are mis-sorted */
1873	for (i = 0; i < start; i++) {
1874		c = &ic->ic_channels[i];
1875		if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
1876			return 1;
1877	}
1878	return 0;
1879}
1880
1881static struct ieee80211_channel *
1882findchannel(struct ieee80211com *ic, int ieee, int mode)
1883{
1884	static const u_int chanflags[IEEE80211_MODE_MAX] = {
1885	    [IEEE80211_MODE_AUTO]	= 0,
1886	    [IEEE80211_MODE_11A]	= IEEE80211_CHAN_A,
1887	    [IEEE80211_MODE_11B]	= IEEE80211_CHAN_B,
1888	    [IEEE80211_MODE_11G]	= IEEE80211_CHAN_G,
1889	    [IEEE80211_MODE_FH]		= IEEE80211_CHAN_FHSS,
1890	    [IEEE80211_MODE_TURBO_A]	= IEEE80211_CHAN_108A,
1891	    [IEEE80211_MODE_TURBO_G]	= IEEE80211_CHAN_108G,
1892	    [IEEE80211_MODE_STURBO_A]	= IEEE80211_CHAN_STURBO,
1893	    [IEEE80211_MODE_HALF]	= IEEE80211_CHAN_HALF,
1894	    [IEEE80211_MODE_QUARTER]	= IEEE80211_CHAN_QUARTER,
1895	    /* NB: handled specially below */
1896	    [IEEE80211_MODE_11NA]	= IEEE80211_CHAN_A,
1897	    [IEEE80211_MODE_11NG]	= IEEE80211_CHAN_G,
1898	    [IEEE80211_MODE_VHT_5GHZ]	= IEEE80211_CHAN_A,
1899	    [IEEE80211_MODE_VHT_2GHZ]	= IEEE80211_CHAN_G,
1900	};
1901	u_int modeflags;
1902	int i;
1903
1904	modeflags = chanflags[mode];
1905	for (i = 0; i < ic->ic_nchans; i++) {
1906		struct ieee80211_channel *c = &ic->ic_channels[i];
1907
1908		if (c->ic_ieee != ieee)
1909			continue;
1910		if (mode == IEEE80211_MODE_AUTO) {
1911			/* ignore turbo channels for autoselect */
1912			if (IEEE80211_IS_CHAN_TURBO(c))
1913				continue;
1914			/*
1915			 * XXX special-case 11b/g channels so we
1916			 *     always select the g channel if both
1917			 *     are present.
1918			 * XXX prefer HT to non-HT?
1919			 */
1920			if (!IEEE80211_IS_CHAN_B(c) ||
1921			    !find11gchannel(ic, i, c->ic_freq))
1922				return c;
1923		} else {
1924			/* must check VHT specifically */
1925			if ((mode == IEEE80211_MODE_VHT_5GHZ ||
1926			    mode == IEEE80211_MODE_VHT_2GHZ) &&
1927			    !IEEE80211_IS_CHAN_VHT(c))
1928				continue;
1929
1930			/*
1931			 * Must check HT specially - only match on HT,
1932			 * not HT+VHT channels
1933			 */
1934			if ((mode == IEEE80211_MODE_11NA ||
1935			    mode == IEEE80211_MODE_11NG) &&
1936			    !IEEE80211_IS_CHAN_HT(c))
1937				continue;
1938
1939			if ((mode == IEEE80211_MODE_11NA ||
1940			    mode == IEEE80211_MODE_11NG) &&
1941			    IEEE80211_IS_CHAN_VHT(c))
1942				continue;
1943
1944			/* Check that the modeflags above match */
1945			if ((c->ic_flags & modeflags) == modeflags)
1946				return c;
1947		}
1948	}
1949	return NULL;
1950}
1951
1952/*
1953 * Check the specified against any desired mode (aka netband).
1954 * This is only used (presently) when operating in hostap mode
1955 * to enforce consistency.
1956 */
1957static int
1958check_mode_consistency(const struct ieee80211_channel *c, int mode)
1959{
1960	KASSERT(c != IEEE80211_CHAN_ANYC, ("oops, no channel"));
1961
1962	switch (mode) {
1963	case IEEE80211_MODE_11B:
1964		return (IEEE80211_IS_CHAN_B(c));
1965	case IEEE80211_MODE_11G:
1966		return (IEEE80211_IS_CHAN_ANYG(c) && !IEEE80211_IS_CHAN_HT(c));
1967	case IEEE80211_MODE_11A:
1968		return (IEEE80211_IS_CHAN_A(c) && !IEEE80211_IS_CHAN_HT(c));
1969	case IEEE80211_MODE_STURBO_A:
1970		return (IEEE80211_IS_CHAN_STURBO(c));
1971	case IEEE80211_MODE_11NA:
1972		return (IEEE80211_IS_CHAN_HTA(c));
1973	case IEEE80211_MODE_11NG:
1974		return (IEEE80211_IS_CHAN_HTG(c));
1975	}
1976	return 1;
1977
1978}
1979
1980/*
1981 * Common code to set the current channel.  If the device
1982 * is up and running this may result in an immediate channel
1983 * change or a kick of the state machine.
1984 */
1985static int
1986setcurchan(struct ieee80211vap *vap, struct ieee80211_channel *c)
1987{
1988	struct ieee80211com *ic = vap->iv_ic;
1989	int error;
1990
1991	if (c != IEEE80211_CHAN_ANYC) {
1992		if (IEEE80211_IS_CHAN_RADAR(c))
1993			return EBUSY;	/* XXX better code? */
1994		if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1995			if (IEEE80211_IS_CHAN_NOHOSTAP(c))
1996				return EINVAL;
1997			if (!check_mode_consistency(c, vap->iv_des_mode))
1998				return EINVAL;
1999		} else if (vap->iv_opmode == IEEE80211_M_IBSS) {
2000			if (IEEE80211_IS_CHAN_NOADHOC(c))
2001				return EINVAL;
2002		}
2003		if ((vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP) &&
2004		    vap->iv_bss->ni_chan == c)
2005			return 0;	/* NB: nothing to do */
2006	}
2007	vap->iv_des_chan = c;
2008
2009	error = 0;
2010	if (vap->iv_opmode == IEEE80211_M_MONITOR &&
2011	    vap->iv_des_chan != IEEE80211_CHAN_ANYC) {
2012		/*
2013		 * Monitor mode can switch directly.
2014		 */
2015		if (IFNET_IS_UP_RUNNING(vap->iv_ifp)) {
2016			/* XXX need state machine for other vap's to follow */
2017			ieee80211_setcurchan(ic, vap->iv_des_chan);
2018			vap->iv_bss->ni_chan = ic->ic_curchan;
2019		} else {
2020			ic->ic_curchan = vap->iv_des_chan;
2021			ic->ic_rt = ieee80211_get_ratetable(ic->ic_curchan);
2022		}
2023	} else {
2024		/*
2025		 * Need to go through the state machine in case we
2026		 * need to reassociate or the like.  The state machine
2027		 * will pickup the desired channel and avoid scanning.
2028		 */
2029		if (IS_UP_AUTO(vap))
2030			ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
2031		else if (vap->iv_des_chan != IEEE80211_CHAN_ANYC) {
2032			/*
2033			 * When not up+running and a real channel has
2034			 * been specified fix the current channel so
2035			 * there is immediate feedback; e.g. via ifconfig.
2036			 */
2037			ic->ic_curchan = vap->iv_des_chan;
2038			ic->ic_rt = ieee80211_get_ratetable(ic->ic_curchan);
2039		}
2040	}
2041	return error;
2042}
2043
2044/*
2045 * Old api for setting the current channel; this is
2046 * deprecated because channel numbers are ambiguous.
2047 */
2048static int
2049ieee80211_ioctl_setchannel(struct ieee80211vap *vap,
2050	const struct ieee80211req *ireq)
2051{
2052	struct ieee80211com *ic = vap->iv_ic;
2053	struct ieee80211_channel *c;
2054
2055	/* XXX 0xffff overflows 16-bit signed */
2056	if (ireq->i_val == 0 ||
2057	    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY) {
2058		c = IEEE80211_CHAN_ANYC;
2059	} else {
2060		struct ieee80211_channel *c2;
2061
2062		c = findchannel(ic, ireq->i_val, vap->iv_des_mode);
2063		if (c == NULL) {
2064			c = findchannel(ic, ireq->i_val,
2065				IEEE80211_MODE_AUTO);
2066			if (c == NULL)
2067				return EINVAL;
2068		}
2069
2070		/*
2071		 * Fine tune channel selection based on desired mode:
2072		 *   if 11b is requested, find the 11b version of any
2073		 *      11g channel returned,
2074		 *   if static turbo, find the turbo version of any
2075		 *	11a channel return,
2076		 *   if 11na is requested, find the ht version of any
2077		 *      11a channel returned,
2078		 *   if 11ng is requested, find the ht version of any
2079		 *      11g channel returned,
2080		 *   if 11ac is requested, find the 11ac version
2081		 *      of any 11a/11na channel returned,
2082		 *   (TBD) 11acg (2GHz VHT)
2083		 *   otherwise we should be ok with what we've got.
2084		 */
2085		switch (vap->iv_des_mode) {
2086		case IEEE80211_MODE_11B:
2087			if (IEEE80211_IS_CHAN_ANYG(c)) {
2088				c2 = findchannel(ic, ireq->i_val,
2089					IEEE80211_MODE_11B);
2090				/* NB: should not happen, =>'s 11g w/o 11b */
2091				if (c2 != NULL)
2092					c = c2;
2093			}
2094			break;
2095		case IEEE80211_MODE_TURBO_A:
2096			if (IEEE80211_IS_CHAN_A(c)) {
2097				c2 = findchannel(ic, ireq->i_val,
2098					IEEE80211_MODE_TURBO_A);
2099				if (c2 != NULL)
2100					c = c2;
2101			}
2102			break;
2103		case IEEE80211_MODE_11NA:
2104			if (IEEE80211_IS_CHAN_A(c)) {
2105				c2 = findchannel(ic, ireq->i_val,
2106					IEEE80211_MODE_11NA);
2107				if (c2 != NULL)
2108					c = c2;
2109			}
2110			break;
2111		case IEEE80211_MODE_11NG:
2112			if (IEEE80211_IS_CHAN_ANYG(c)) {
2113				c2 = findchannel(ic, ireq->i_val,
2114					IEEE80211_MODE_11NG);
2115				if (c2 != NULL)
2116					c = c2;
2117			}
2118			break;
2119		case IEEE80211_MODE_VHT_2GHZ:
2120			printf("%s: TBD\n", __func__);
2121			break;
2122		case IEEE80211_MODE_VHT_5GHZ:
2123			if (IEEE80211_IS_CHAN_A(c)) {
2124				c2 = findchannel(ic, ireq->i_val,
2125					IEEE80211_MODE_VHT_5GHZ);
2126				if (c2 != NULL)
2127					c = c2;
2128			}
2129			break;
2130		default:		/* NB: no static turboG */
2131			break;
2132		}
2133	}
2134	return setcurchan(vap, c);
2135}
2136
2137/*
2138 * New/current api for setting the current channel; a complete
2139 * channel description is provide so there is no ambiguity in
2140 * identifying the channel.
2141 */
2142static int
2143ieee80211_ioctl_setcurchan(struct ieee80211vap *vap,
2144	const struct ieee80211req *ireq)
2145{
2146	struct ieee80211com *ic = vap->iv_ic;
2147	struct ieee80211_channel chan, *c;
2148	int error;
2149
2150	if (ireq->i_len != sizeof(chan))
2151		return EINVAL;
2152	error = copyin(ireq->i_data, &chan, sizeof(chan));
2153	if (error != 0)
2154		return error;
2155
2156	/* XXX 0xffff overflows 16-bit signed */
2157	if (chan.ic_freq == 0 || chan.ic_freq == IEEE80211_CHAN_ANY) {
2158		c = IEEE80211_CHAN_ANYC;
2159	} else {
2160		c = ieee80211_find_channel(ic, chan.ic_freq, chan.ic_flags);
2161		if (c == NULL)
2162			return EINVAL;
2163	}
2164	return setcurchan(vap, c);
2165}
2166
2167static int
2168ieee80211_ioctl_setregdomain(struct ieee80211vap *vap,
2169	const struct ieee80211req *ireq)
2170{
2171	struct ieee80211_regdomain_req *reg;
2172	int nchans, error;
2173
2174	nchans = 1 + ((ireq->i_len - sizeof(struct ieee80211_regdomain_req)) /
2175	    sizeof(struct ieee80211_channel));
2176	if (!(1 <= nchans && nchans <= IEEE80211_CHAN_MAX)) {
2177		IEEE80211_DPRINTF(vap, IEEE80211_MSG_IOCTL,
2178		    "%s: bad # chans, i_len %d nchans %d\n", __func__,
2179		    ireq->i_len, nchans);
2180		return EINVAL;
2181	}
2182	reg = (struct ieee80211_regdomain_req *)
2183	    IEEE80211_MALLOC(IEEE80211_REGDOMAIN_SIZE(nchans), M_TEMP,
2184	      IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2185	if (reg == NULL) {
2186		IEEE80211_DPRINTF(vap, IEEE80211_MSG_IOCTL,
2187		    "%s: no memory, nchans %d\n", __func__, nchans);
2188		return ENOMEM;
2189	}
2190	error = copyin(ireq->i_data, reg, IEEE80211_REGDOMAIN_SIZE(nchans));
2191	if (error == 0) {
2192		/* NB: validate inline channel count against storage size */
2193		if (reg->chaninfo.ic_nchans != nchans) {
2194			IEEE80211_DPRINTF(vap, IEEE80211_MSG_IOCTL,
2195			    "%s: chan cnt mismatch, %d != %d\n", __func__,
2196				reg->chaninfo.ic_nchans, nchans);
2197			error = EINVAL;
2198		} else
2199			error = ieee80211_setregdomain(vap, reg);
2200	}
2201	IEEE80211_FREE(reg, M_TEMP);
2202
2203	return (error == 0 ? ENETRESET : error);
2204}
2205
2206static int
2207checkrate(const struct ieee80211_rateset *rs, int rate)
2208{
2209	int i;
2210
2211	if (rate == IEEE80211_FIXED_RATE_NONE)
2212		return 1;
2213	for (i = 0; i < rs->rs_nrates; i++)
2214		if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == rate)
2215			return 1;
2216	return 0;
2217}
2218
2219static int
2220checkmcs(const struct ieee80211_htrateset *rs, int mcs)
2221{
2222	int rate_val = IEEE80211_RV(mcs);
2223	int i;
2224
2225	if (mcs == IEEE80211_FIXED_RATE_NONE)
2226		return 1;
2227	if ((mcs & IEEE80211_RATE_MCS) == 0)	/* MCS always have 0x80 set */
2228		return 0;
2229	for (i = 0; i < rs->rs_nrates; i++)
2230		if (IEEE80211_RV(rs->rs_rates[i]) == rate_val)
2231			return 1;
2232	return 0;
2233}
2234
2235static int
2236ieee80211_ioctl_setroam(struct ieee80211vap *vap,
2237        const struct ieee80211req *ireq)
2238{
2239	struct ieee80211com *ic = vap->iv_ic;
2240	struct ieee80211_roamparams_req *parms;
2241	struct ieee80211_roamparam *src, *dst;
2242	const struct ieee80211_htrateset *rs_ht;
2243	const struct ieee80211_rateset *rs;
2244	int changed, error, mode, is11n, nmodes;
2245
2246	if (ireq->i_len != sizeof(vap->iv_roamparms))
2247		return EINVAL;
2248
2249	parms = IEEE80211_MALLOC(sizeof(*parms), M_TEMP,
2250	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2251	if (parms == NULL)
2252		return ENOMEM;
2253
2254	error = copyin(ireq->i_data, parms, ireq->i_len);
2255	if (error != 0)
2256		goto fail;
2257
2258	changed = 0;
2259	nmodes = IEEE80211_MODE_MAX;
2260
2261	/* validate parameters and check if anything changed */
2262	for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
2263		if (isclr(ic->ic_modecaps, mode))
2264			continue;
2265		src = &parms->params[mode];
2266		dst = &vap->iv_roamparms[mode];
2267		rs = &ic->ic_sup_rates[mode];	/* NB: 11n maps to legacy */
2268		rs_ht = &ic->ic_sup_htrates;
2269		is11n = (mode == IEEE80211_MODE_11NA ||
2270			 mode == IEEE80211_MODE_11NG);
2271		/* XXX TODO: 11ac */
2272		if (src->rate != dst->rate) {
2273			if (!checkrate(rs, src->rate) &&
2274			    (!is11n || !checkmcs(rs_ht, src->rate))) {
2275				error = EINVAL;
2276				goto fail;
2277			}
2278			changed++;
2279		}
2280		if (src->rssi != dst->rssi)
2281			changed++;
2282	}
2283	if (changed) {
2284		/*
2285		 * Copy new parameters in place and notify the
2286		 * driver so it can push state to the device.
2287		 */
2288		/* XXX locking? */
2289		for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
2290			if (isset(ic->ic_modecaps, mode))
2291				vap->iv_roamparms[mode] = parms->params[mode];
2292		}
2293
2294		if (vap->iv_roaming == IEEE80211_ROAMING_DEVICE)
2295			error = ERESTART;
2296	}
2297
2298fail:	IEEE80211_FREE(parms, M_TEMP);
2299	return error;
2300}
2301
2302static int
2303ieee80211_ioctl_settxparams(struct ieee80211vap *vap,
2304	const struct ieee80211req *ireq)
2305{
2306	struct ieee80211com *ic = vap->iv_ic;
2307	struct ieee80211_txparams_req parms;	/* XXX stack use? */
2308	struct ieee80211_txparam *src, *dst;
2309	const struct ieee80211_htrateset *rs_ht;
2310	const struct ieee80211_rateset *rs;
2311	int error, mode, changed, is11n, nmodes;
2312
2313	/* NB: accept short requests for backwards compat */
2314	if (ireq->i_len > sizeof(parms))
2315		return EINVAL;
2316	error = copyin(ireq->i_data, &parms, ireq->i_len);
2317	if (error != 0)
2318		return error;
2319	nmodes = ireq->i_len / sizeof(struct ieee80211_txparam);
2320	changed = 0;
2321	/* validate parameters and check if anything changed */
2322	for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
2323		if (isclr(ic->ic_modecaps, mode))
2324			continue;
2325		src = &parms.params[mode];
2326		dst = &vap->iv_txparms[mode];
2327		rs = &ic->ic_sup_rates[mode];	/* NB: 11n maps to legacy */
2328		rs_ht = &ic->ic_sup_htrates;
2329		is11n = (mode == IEEE80211_MODE_11NA ||
2330			 mode == IEEE80211_MODE_11NG);
2331		if (src->ucastrate != dst->ucastrate) {
2332			if (!checkrate(rs, src->ucastrate) &&
2333			    (!is11n || !checkmcs(rs_ht, src->ucastrate)))
2334				return EINVAL;
2335			changed++;
2336		}
2337		if (src->mcastrate != dst->mcastrate) {
2338			if (!checkrate(rs, src->mcastrate) &&
2339			    (!is11n || !checkmcs(rs_ht, src->mcastrate)))
2340				return EINVAL;
2341			changed++;
2342		}
2343		if (src->mgmtrate != dst->mgmtrate) {
2344			if (!checkrate(rs, src->mgmtrate) &&
2345			    (!is11n || !checkmcs(rs_ht, src->mgmtrate)))
2346				return EINVAL;
2347			changed++;
2348		}
2349		if (src->maxretry != dst->maxretry)	/* NB: no bounds */
2350			changed++;
2351	}
2352	if (changed) {
2353		/*
2354		 * Copy new parameters in place and notify the
2355		 * driver so it can push state to the device.
2356		 */
2357		for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
2358			if (isset(ic->ic_modecaps, mode))
2359				vap->iv_txparms[mode] = parms.params[mode];
2360		}
2361		/* XXX could be more intelligent,
2362		   e.g. don't reset if setting not being used */
2363		return ENETRESET;
2364	}
2365	return 0;
2366}
2367
2368/*
2369 * Application Information Element support.
2370 */
2371static int
2372setappie(struct ieee80211_appie **aie, const struct ieee80211req *ireq)
2373{
2374	struct ieee80211_appie *app = *aie;
2375	struct ieee80211_appie *napp;
2376	int error;
2377
2378	if (ireq->i_len == 0) {		/* delete any existing ie */
2379		if (app != NULL) {
2380			*aie = NULL;	/* XXX racey */
2381			IEEE80211_FREE(app, M_80211_NODE_IE);
2382		}
2383		return 0;
2384	}
2385	if (!(2 <= ireq->i_len && ireq->i_len <= IEEE80211_MAX_APPIE))
2386		return EINVAL;
2387	/*
2388	 * Allocate a new appie structure and copy in the user data.
2389	 * When done swap in the new structure.  Note that we do not
2390	 * guard against users holding a ref to the old structure;
2391	 * this must be handled outside this code.
2392	 *
2393	 * XXX bad bad bad
2394	 */
2395	napp = (struct ieee80211_appie *) IEEE80211_MALLOC(
2396	    sizeof(struct ieee80211_appie) + ireq->i_len, M_80211_NODE_IE,
2397	    IEEE80211_M_NOWAIT);
2398	if (napp == NULL)
2399		return ENOMEM;
2400	/* XXX holding ic lock */
2401	error = copyin(ireq->i_data, napp->ie_data, ireq->i_len);
2402	if (error) {
2403		IEEE80211_FREE(napp, M_80211_NODE_IE);
2404		return error;
2405	}
2406	napp->ie_len = ireq->i_len;
2407	*aie = napp;
2408	if (app != NULL)
2409		IEEE80211_FREE(app, M_80211_NODE_IE);
2410	return 0;
2411}
2412
2413static void
2414setwparsnie(struct ieee80211vap *vap, uint8_t *ie, int space)
2415{
2416	/* validate data is present as best we can */
2417	if (space == 0 || 2+ie[1] > space)
2418		return;
2419	if (ie[0] == IEEE80211_ELEMID_VENDOR)
2420		vap->iv_wpa_ie = ie;
2421	else if (ie[0] == IEEE80211_ELEMID_RSN)
2422		vap->iv_rsn_ie = ie;
2423}
2424
2425static int
2426ieee80211_ioctl_setappie_locked(struct ieee80211vap *vap,
2427	const struct ieee80211req *ireq, int fc0)
2428{
2429	int error;
2430
2431	IEEE80211_LOCK_ASSERT(vap->iv_ic);
2432
2433	switch (fc0 & IEEE80211_FC0_SUBTYPE_MASK) {
2434	case IEEE80211_FC0_SUBTYPE_BEACON:
2435		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
2436		    vap->iv_opmode != IEEE80211_M_IBSS) {
2437			error = EINVAL;
2438			break;
2439		}
2440		error = setappie(&vap->iv_appie_beacon, ireq);
2441		if (error == 0)
2442			ieee80211_beacon_notify(vap, IEEE80211_BEACON_APPIE);
2443		break;
2444	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2445		error = setappie(&vap->iv_appie_proberesp, ireq);
2446		break;
2447	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2448		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2449			error = setappie(&vap->iv_appie_assocresp, ireq);
2450		else
2451			error = EINVAL;
2452		break;
2453	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2454		error = setappie(&vap->iv_appie_probereq, ireq);
2455		break;
2456	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2457		if (vap->iv_opmode == IEEE80211_M_STA)
2458			error = setappie(&vap->iv_appie_assocreq, ireq);
2459		else
2460			error = EINVAL;
2461		break;
2462	case (IEEE80211_APPIE_WPA & IEEE80211_FC0_SUBTYPE_MASK):
2463		error = setappie(&vap->iv_appie_wpa, ireq);
2464		if (error == 0) {
2465			/*
2466			 * Must split single blob of data into separate
2467			 * WPA and RSN ie's because they go in different
2468			 * locations in the mgt frames.
2469			 * XXX use IEEE80211_IOC_WPA2 so user code does split
2470			 */
2471			vap->iv_wpa_ie = NULL;
2472			vap->iv_rsn_ie = NULL;
2473			if (vap->iv_appie_wpa != NULL) {
2474				struct ieee80211_appie *appie =
2475				    vap->iv_appie_wpa;
2476				uint8_t *data = appie->ie_data;
2477
2478				/* XXX ie length validate is painful, cheat */
2479				setwparsnie(vap, data, appie->ie_len);
2480				setwparsnie(vap, data + 2 + data[1],
2481				    appie->ie_len - (2 + data[1]));
2482			}
2483			if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2484			    vap->iv_opmode == IEEE80211_M_IBSS) {
2485				/*
2486				 * Must rebuild beacon frame as the update
2487				 * mechanism doesn't handle WPA/RSN ie's.
2488				 * Could extend it but it doesn't normally
2489				 * change; this is just to deal with hostapd
2490				 * plumbing the ie after the interface is up.
2491				 */
2492				error = ENETRESET;
2493			}
2494		}
2495		break;
2496	default:
2497		error = EINVAL;
2498		break;
2499	}
2500	return error;
2501}
2502
2503static int
2504ieee80211_ioctl_setappie(struct ieee80211vap *vap,
2505	const struct ieee80211req *ireq)
2506{
2507	struct ieee80211com *ic = vap->iv_ic;
2508	int error;
2509	uint8_t fc0;
2510
2511	fc0 = ireq->i_val & 0xff;
2512	if ((fc0 & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_MGT)
2513		return EINVAL;
2514	/* NB: could check iv_opmode and reject but hardly worth the effort */
2515	IEEE80211_LOCK(ic);
2516	error = ieee80211_ioctl_setappie_locked(vap, ireq, fc0);
2517	IEEE80211_UNLOCK(ic);
2518	return error;
2519}
2520
2521static int
2522ieee80211_ioctl_chanswitch(struct ieee80211vap *vap, struct ieee80211req *ireq)
2523{
2524	struct ieee80211com *ic = vap->iv_ic;
2525	struct ieee80211_chanswitch_req csr;
2526	struct ieee80211_channel *c;
2527	int error;
2528
2529	if (ireq->i_len != sizeof(csr))
2530		return EINVAL;
2531	error = copyin(ireq->i_data, &csr, sizeof(csr));
2532	if (error != 0)
2533		return error;
2534	/* XXX adhoc mode not supported */
2535	if (vap->iv_opmode != IEEE80211_M_HOSTAP ||
2536	    (vap->iv_flags & IEEE80211_F_DOTH) == 0)
2537		return EOPNOTSUPP;
2538	c = ieee80211_find_channel(ic,
2539	    csr.csa_chan.ic_freq, csr.csa_chan.ic_flags);
2540	if (c == NULL)
2541		return ENOENT;
2542	IEEE80211_LOCK(ic);
2543	if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0)
2544		ieee80211_csa_startswitch(ic, c, csr.csa_mode, csr.csa_count);
2545	else if (csr.csa_count == 0)
2546		ieee80211_csa_cancelswitch(ic);
2547	else
2548		error = EBUSY;
2549	IEEE80211_UNLOCK(ic);
2550	return error;
2551}
2552
2553static int
2554ieee80211_scanreq(struct ieee80211vap *vap, struct ieee80211_scan_req *sr)
2555{
2556#define	IEEE80211_IOC_SCAN_FLAGS \
2557	(IEEE80211_IOC_SCAN_NOPICK | IEEE80211_IOC_SCAN_ACTIVE | \
2558	 IEEE80211_IOC_SCAN_PICK1ST | IEEE80211_IOC_SCAN_BGSCAN | \
2559	 IEEE80211_IOC_SCAN_ONCE | IEEE80211_IOC_SCAN_NOBCAST | \
2560	 IEEE80211_IOC_SCAN_NOJOIN | IEEE80211_IOC_SCAN_FLUSH | \
2561	 IEEE80211_IOC_SCAN_CHECK)
2562	struct ieee80211com *ic = vap->iv_ic;
2563	int error, i;
2564
2565	/* convert duration */
2566	if (sr->sr_duration == IEEE80211_IOC_SCAN_FOREVER)
2567		sr->sr_duration = IEEE80211_SCAN_FOREVER;
2568	else {
2569		if (sr->sr_duration < IEEE80211_IOC_SCAN_DURATION_MIN ||
2570		    sr->sr_duration > IEEE80211_IOC_SCAN_DURATION_MAX)
2571			return EINVAL;
2572		sr->sr_duration = msecs_to_ticks(sr->sr_duration);
2573	}
2574	/* convert min/max channel dwell */
2575	if (sr->sr_mindwell != 0)
2576		sr->sr_mindwell = msecs_to_ticks(sr->sr_mindwell);
2577	if (sr->sr_maxdwell != 0)
2578		sr->sr_maxdwell = msecs_to_ticks(sr->sr_maxdwell);
2579	/* NB: silently reduce ssid count to what is supported */
2580	if (sr->sr_nssid > IEEE80211_SCAN_MAX_SSID)
2581		sr->sr_nssid = IEEE80211_SCAN_MAX_SSID;
2582	for (i = 0; i < sr->sr_nssid; i++)
2583		if (sr->sr_ssid[i].len > IEEE80211_NWID_LEN)
2584			return EINVAL;
2585	/* cleanse flags just in case, could reject if invalid flags */
2586	sr->sr_flags &= IEEE80211_IOC_SCAN_FLAGS;
2587	/*
2588	 * Add an implicit NOPICK if the vap is not marked UP.  This
2589	 * allows applications to scan without joining a bss (or picking
2590	 * a channel and setting up a bss) and without forcing manual
2591	 * roaming mode--you just need to mark the parent device UP.
2592	 */
2593	if ((vap->iv_ifp->if_flags & IFF_UP) == 0)
2594		sr->sr_flags |= IEEE80211_IOC_SCAN_NOPICK;
2595
2596	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
2597	    "%s: flags 0x%x%s duration 0x%x mindwell %u maxdwell %u nssid %d\n",
2598	    __func__, sr->sr_flags,
2599	    (vap->iv_ifp->if_flags & IFF_UP) == 0 ? " (!IFF_UP)" : "",
2600	    sr->sr_duration, sr->sr_mindwell, sr->sr_maxdwell, sr->sr_nssid);
2601	/*
2602	 * If we are in INIT state then the driver has never had a chance
2603	 * to setup hardware state to do a scan; we must use the state
2604	 * machine to get us up to the SCAN state but once we reach SCAN
2605	 * state we then want to use the supplied params.  Stash the
2606	 * parameters in the vap and mark IEEE80211_FEXT_SCANREQ; the
2607	 * state machines will recognize this and use the stashed params
2608	 * to issue the scan request.
2609	 *
2610	 * Otherwise just invoke the scan machinery directly.
2611	 */
2612	IEEE80211_LOCK(ic);
2613	if (ic->ic_nrunning == 0) {
2614		IEEE80211_UNLOCK(ic);
2615		return ENXIO;
2616	}
2617
2618	if (vap->iv_state == IEEE80211_S_INIT) {
2619		/* NB: clobbers previous settings */
2620		vap->iv_scanreq_flags = sr->sr_flags;
2621		vap->iv_scanreq_duration = sr->sr_duration;
2622		vap->iv_scanreq_nssid = sr->sr_nssid;
2623		for (i = 0; i < sr->sr_nssid; i++) {
2624			vap->iv_scanreq_ssid[i].len = sr->sr_ssid[i].len;
2625			memcpy(vap->iv_scanreq_ssid[i].ssid,
2626			    sr->sr_ssid[i].ssid, sr->sr_ssid[i].len);
2627		}
2628		vap->iv_flags_ext |= IEEE80211_FEXT_SCANREQ;
2629		IEEE80211_UNLOCK(ic);
2630		ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
2631	} else {
2632		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
2633		IEEE80211_UNLOCK(ic);
2634		if (sr->sr_flags & IEEE80211_IOC_SCAN_CHECK) {
2635			error = ieee80211_check_scan(vap, sr->sr_flags,
2636			    sr->sr_duration, sr->sr_mindwell, sr->sr_maxdwell,
2637			    sr->sr_nssid,
2638			    /* NB: cheat, we assume structures are compatible */
2639			    (const struct ieee80211_scan_ssid *) &sr->sr_ssid[0]);
2640		} else {
2641			error = ieee80211_start_scan(vap, sr->sr_flags,
2642			    sr->sr_duration, sr->sr_mindwell, sr->sr_maxdwell,
2643			    sr->sr_nssid,
2644			    /* NB: cheat, we assume structures are compatible */
2645			    (const struct ieee80211_scan_ssid *) &sr->sr_ssid[0]);
2646		}
2647		if (error == 0)
2648			return EINPROGRESS;
2649	}
2650	return 0;
2651#undef IEEE80211_IOC_SCAN_FLAGS
2652}
2653
2654static int
2655ieee80211_ioctl_scanreq(struct ieee80211vap *vap, struct ieee80211req *ireq)
2656{
2657	struct ieee80211_scan_req *sr;
2658	int error;
2659
2660	if (ireq->i_len != sizeof(*sr))
2661		return EINVAL;
2662	sr = IEEE80211_MALLOC(sizeof(*sr), M_TEMP,
2663	     IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2664	if (sr == NULL)
2665		return ENOMEM;
2666	error = copyin(ireq->i_data, sr, sizeof(*sr));
2667	if (error != 0)
2668		goto bad;
2669	error = ieee80211_scanreq(vap, sr);
2670bad:
2671	IEEE80211_FREE(sr, M_TEMP);
2672	return error;
2673}
2674
2675static int
2676ieee80211_ioctl_setstavlan(struct ieee80211vap *vap, struct ieee80211req *ireq)
2677{
2678	struct ieee80211_node *ni;
2679	struct ieee80211req_sta_vlan vlan;
2680	int error;
2681
2682	if (ireq->i_len != sizeof(vlan))
2683		return EINVAL;
2684	error = copyin(ireq->i_data, &vlan, sizeof(vlan));
2685	if (error != 0)
2686		return error;
2687	if (!IEEE80211_ADDR_EQ(vlan.sv_macaddr, zerobssid)) {
2688		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap,
2689		    vlan.sv_macaddr);
2690		if (ni == NULL)
2691			return ENOENT;
2692	} else
2693		ni = ieee80211_ref_node(vap->iv_bss);
2694	ni->ni_vlan = vlan.sv_vlan;
2695	ieee80211_free_node(ni);
2696	return error;
2697}
2698
2699static int
2700isvap11g(const struct ieee80211vap *vap)
2701{
2702	const struct ieee80211_node *bss = vap->iv_bss;
2703	return bss->ni_chan != IEEE80211_CHAN_ANYC &&
2704	    IEEE80211_IS_CHAN_ANYG(bss->ni_chan);
2705}
2706
2707static int
2708isvapht(const struct ieee80211vap *vap)
2709{
2710	const struct ieee80211_node *bss = vap->iv_bss;
2711	return bss->ni_chan != IEEE80211_CHAN_ANYC &&
2712	    IEEE80211_IS_CHAN_HT(bss->ni_chan);
2713}
2714
2715/*
2716 * Dummy ioctl set handler so the linker set is defined.
2717 */
2718static int
2719dummy_ioctl_set(struct ieee80211vap *vap, struct ieee80211req *ireq)
2720{
2721	return ENOSYS;
2722}
2723IEEE80211_IOCTL_SET(dummy, dummy_ioctl_set);
2724
2725static int
2726ieee80211_ioctl_setdefault(struct ieee80211vap *vap, struct ieee80211req *ireq)
2727{
2728	ieee80211_ioctl_setfunc * const *set;
2729	int error;
2730
2731	SET_FOREACH(set, ieee80211_ioctl_setset) {
2732		error = (*set)(vap, ireq);
2733		if (error != ENOSYS)
2734			return error;
2735	}
2736	return EINVAL;
2737}
2738
2739static int
2740ieee80211_ioctl_set80211(struct ieee80211vap *vap, u_long cmd, struct ieee80211req *ireq)
2741{
2742	struct ieee80211com *ic = vap->iv_ic;
2743	int error;
2744	const struct ieee80211_authenticator *auth;
2745	uint8_t tmpkey[IEEE80211_KEYBUF_SIZE];
2746	char tmpssid[IEEE80211_NWID_LEN];
2747	uint8_t tmpbssid[IEEE80211_ADDR_LEN];
2748	struct ieee80211_key *k;
2749	u_int kid;
2750	uint32_t flags;
2751
2752	error = 0;
2753	switch (ireq->i_type) {
2754	case IEEE80211_IOC_SSID:
2755		if (ireq->i_val != 0 ||
2756		    ireq->i_len > IEEE80211_NWID_LEN)
2757			return EINVAL;
2758		error = copyin(ireq->i_data, tmpssid, ireq->i_len);
2759		if (error)
2760			break;
2761		memset(vap->iv_des_ssid[0].ssid, 0, IEEE80211_NWID_LEN);
2762		vap->iv_des_ssid[0].len = ireq->i_len;
2763		memcpy(vap->iv_des_ssid[0].ssid, tmpssid, ireq->i_len);
2764		vap->iv_des_nssid = (ireq->i_len > 0);
2765		error = ENETRESET;
2766		break;
2767	case IEEE80211_IOC_WEP:
2768		switch (ireq->i_val) {
2769		case IEEE80211_WEP_OFF:
2770			vap->iv_flags &= ~IEEE80211_F_PRIVACY;
2771			vap->iv_flags &= ~IEEE80211_F_DROPUNENC;
2772			break;
2773		case IEEE80211_WEP_ON:
2774			vap->iv_flags |= IEEE80211_F_PRIVACY;
2775			vap->iv_flags |= IEEE80211_F_DROPUNENC;
2776			break;
2777		case IEEE80211_WEP_MIXED:
2778			vap->iv_flags |= IEEE80211_F_PRIVACY;
2779			vap->iv_flags &= ~IEEE80211_F_DROPUNENC;
2780			break;
2781		}
2782		error = ENETRESET;
2783		break;
2784	case IEEE80211_IOC_WEPKEY:
2785		kid = (u_int) ireq->i_val;
2786		if (kid >= IEEE80211_WEP_NKID)
2787			return EINVAL;
2788		k = &vap->iv_nw_keys[kid];
2789		if (ireq->i_len == 0) {
2790			/* zero-len =>'s delete any existing key */
2791			(void) ieee80211_crypto_delkey(vap, k);
2792			break;
2793		}
2794		if (ireq->i_len > sizeof(tmpkey))
2795			return EINVAL;
2796		memset(tmpkey, 0, sizeof(tmpkey));
2797		error = copyin(ireq->i_data, tmpkey, ireq->i_len);
2798		if (error)
2799			break;
2800		ieee80211_key_update_begin(vap);
2801		k->wk_keyix = kid;	/* NB: force fixed key id */
2802		if (ieee80211_crypto_newkey(vap, IEEE80211_CIPHER_WEP,
2803		    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2804			k->wk_keylen = ireq->i_len;
2805			memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
2806			IEEE80211_ADDR_COPY(k->wk_macaddr, vap->iv_myaddr);
2807			if  (!ieee80211_crypto_setkey(vap, k))
2808				error = EINVAL;
2809		} else
2810			error = EINVAL;
2811		ieee80211_key_update_end(vap);
2812		break;
2813	case IEEE80211_IOC_WEPTXKEY:
2814		kid = (u_int) ireq->i_val;
2815		if (kid >= IEEE80211_WEP_NKID &&
2816		    (uint16_t) kid != IEEE80211_KEYIX_NONE)
2817			return EINVAL;
2818		/*
2819		 * Firmware devices may need to be told about an explicit
2820		 * key index here, versus just inferring it from the
2821		 * key set / change.  Since we may also need to pause
2822		 * things like transmit before the key is updated,
2823		 * give the driver a chance to flush things by tying
2824		 * into key update begin/end.
2825		 */
2826		ieee80211_key_update_begin(vap);
2827		ieee80211_crypto_set_deftxkey(vap, kid);
2828		ieee80211_key_update_end(vap);
2829		break;
2830	case IEEE80211_IOC_AUTHMODE:
2831		switch (ireq->i_val) {
2832		case IEEE80211_AUTH_WPA:
2833		case IEEE80211_AUTH_8021X:	/* 802.1x */
2834		case IEEE80211_AUTH_OPEN:	/* open */
2835		case IEEE80211_AUTH_SHARED:	/* shared-key */
2836		case IEEE80211_AUTH_AUTO:	/* auto */
2837			auth = ieee80211_authenticator_get(ireq->i_val);
2838			if (auth == NULL)
2839				return EINVAL;
2840			break;
2841		default:
2842			return EINVAL;
2843		}
2844		switch (ireq->i_val) {
2845		case IEEE80211_AUTH_WPA:	/* WPA w/ 802.1x */
2846			vap->iv_flags |= IEEE80211_F_PRIVACY;
2847			ireq->i_val = IEEE80211_AUTH_8021X;
2848			break;
2849		case IEEE80211_AUTH_OPEN:	/* open */
2850			vap->iv_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2851			break;
2852		case IEEE80211_AUTH_SHARED:	/* shared-key */
2853		case IEEE80211_AUTH_8021X:	/* 802.1x */
2854			vap->iv_flags &= ~IEEE80211_F_WPA;
2855			/* both require a key so mark the PRIVACY capability */
2856			vap->iv_flags |= IEEE80211_F_PRIVACY;
2857			break;
2858		case IEEE80211_AUTH_AUTO:	/* auto */
2859			vap->iv_flags &= ~IEEE80211_F_WPA;
2860			/* XXX PRIVACY handling? */
2861			/* XXX what's the right way to do this? */
2862			break;
2863		}
2864		/* NB: authenticator attach/detach happens on state change */
2865		vap->iv_bss->ni_authmode = ireq->i_val;
2866		/* XXX mixed/mode/usage? */
2867		vap->iv_auth = auth;
2868		error = ENETRESET;
2869		break;
2870	case IEEE80211_IOC_CHANNEL:
2871		error = ieee80211_ioctl_setchannel(vap, ireq);
2872		break;
2873	case IEEE80211_IOC_POWERSAVE:
2874		switch (ireq->i_val) {
2875		case IEEE80211_POWERSAVE_OFF:
2876			if (vap->iv_flags & IEEE80211_F_PMGTON) {
2877				ieee80211_syncflag(vap, -IEEE80211_F_PMGTON);
2878				error = ERESTART;
2879			}
2880			break;
2881		case IEEE80211_POWERSAVE_ON:
2882			if ((vap->iv_caps & IEEE80211_C_PMGT) == 0)
2883				error = EOPNOTSUPP;
2884			else if ((vap->iv_flags & IEEE80211_F_PMGTON) == 0) {
2885				ieee80211_syncflag(vap, IEEE80211_F_PMGTON);
2886				error = ERESTART;
2887			}
2888			break;
2889		default:
2890			error = EINVAL;
2891			break;
2892		}
2893		break;
2894	case IEEE80211_IOC_POWERSAVESLEEP:
2895		if (ireq->i_val < 0)
2896			return EINVAL;
2897		ic->ic_lintval = ireq->i_val;
2898		error = ERESTART;
2899		break;
2900	case IEEE80211_IOC_RTSTHRESHOLD:
2901		if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
2902		      ireq->i_val <= IEEE80211_RTS_MAX))
2903			return EINVAL;
2904		vap->iv_rtsthreshold = ireq->i_val;
2905		error = ERESTART;
2906		break;
2907	case IEEE80211_IOC_PROTMODE:
2908		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2909			return EINVAL;
2910		ic->ic_protmode = (enum ieee80211_protmode)ireq->i_val;
2911		/* NB: if not operating in 11g this can wait */
2912		if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
2913		    IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan))
2914			error = ERESTART;
2915		break;
2916	case IEEE80211_IOC_TXPOWER:
2917		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2918			return EOPNOTSUPP;
2919		if (!(IEEE80211_TXPOWER_MIN <= ireq->i_val &&
2920		      ireq->i_val <= IEEE80211_TXPOWER_MAX))
2921			return EINVAL;
2922		ic->ic_txpowlimit = ireq->i_val;
2923		error = ERESTART;
2924		break;
2925	case IEEE80211_IOC_ROAMING:
2926		if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2927		    ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2928			return EINVAL;
2929		vap->iv_roaming = (enum ieee80211_roamingmode)ireq->i_val;
2930		/* XXXX reset? */
2931		break;
2932	case IEEE80211_IOC_PRIVACY:
2933		if (ireq->i_val) {
2934			/* XXX check for key state? */
2935			vap->iv_flags |= IEEE80211_F_PRIVACY;
2936		} else
2937			vap->iv_flags &= ~IEEE80211_F_PRIVACY;
2938		/* XXX ERESTART? */
2939		break;
2940	case IEEE80211_IOC_DROPUNENCRYPTED:
2941		if (ireq->i_val)
2942			vap->iv_flags |= IEEE80211_F_DROPUNENC;
2943		else
2944			vap->iv_flags &= ~IEEE80211_F_DROPUNENC;
2945		/* XXX ERESTART? */
2946		break;
2947	case IEEE80211_IOC_WPAKEY:
2948		error = ieee80211_ioctl_setkey(vap, ireq);
2949		break;
2950	case IEEE80211_IOC_DELKEY:
2951		error = ieee80211_ioctl_delkey(vap, ireq);
2952		break;
2953	case IEEE80211_IOC_MLME:
2954		error = ieee80211_ioctl_setmlme(vap, ireq);
2955		break;
2956	case IEEE80211_IOC_COUNTERMEASURES:
2957		if (ireq->i_val) {
2958			if ((vap->iv_flags & IEEE80211_F_WPA) == 0)
2959				return EOPNOTSUPP;
2960			vap->iv_flags |= IEEE80211_F_COUNTERM;
2961		} else
2962			vap->iv_flags &= ~IEEE80211_F_COUNTERM;
2963		/* XXX ERESTART? */
2964		break;
2965	case IEEE80211_IOC_WPA:
2966		if (ireq->i_val > 3)
2967			return EINVAL;
2968		/* XXX verify ciphers available */
2969		flags = vap->iv_flags & ~IEEE80211_F_WPA;
2970		switch (ireq->i_val) {
2971		case 0:
2972			/* wpa_supplicant calls this to clear the WPA config */
2973			break;
2974		case 1:
2975			if (!(vap->iv_caps & IEEE80211_C_WPA1))
2976				return EOPNOTSUPP;
2977			flags |= IEEE80211_F_WPA1;
2978			break;
2979		case 2:
2980			if (!(vap->iv_caps & IEEE80211_C_WPA2))
2981				return EOPNOTSUPP;
2982			flags |= IEEE80211_F_WPA2;
2983			break;
2984		case 3:
2985			if ((vap->iv_caps & IEEE80211_C_WPA) != IEEE80211_C_WPA)
2986				return EOPNOTSUPP;
2987			flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2988			break;
2989		default:	/*  Can't set any -> error */
2990			return EOPNOTSUPP;
2991		}
2992		vap->iv_flags = flags;
2993		error = ERESTART;	/* NB: can change beacon frame */
2994		break;
2995	case IEEE80211_IOC_WME:
2996		if (ireq->i_val) {
2997			if ((vap->iv_caps & IEEE80211_C_WME) == 0)
2998				return EOPNOTSUPP;
2999			ieee80211_syncflag(vap, IEEE80211_F_WME);
3000		} else
3001			ieee80211_syncflag(vap, -IEEE80211_F_WME);
3002		error = ERESTART;	/* NB: can change beacon frame */
3003		break;
3004	case IEEE80211_IOC_HIDESSID:
3005		if (ireq->i_val)
3006			vap->iv_flags |= IEEE80211_F_HIDESSID;
3007		else
3008			vap->iv_flags &= ~IEEE80211_F_HIDESSID;
3009		error = ERESTART;		/* XXX ENETRESET? */
3010		break;
3011	case IEEE80211_IOC_APBRIDGE:
3012		if (ireq->i_val == 0)
3013			vap->iv_flags |= IEEE80211_F_NOBRIDGE;
3014		else
3015			vap->iv_flags &= ~IEEE80211_F_NOBRIDGE;
3016		break;
3017	case IEEE80211_IOC_BSSID:
3018		if (ireq->i_len != sizeof(tmpbssid))
3019			return EINVAL;
3020		error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
3021		if (error)
3022			break;
3023		IEEE80211_ADDR_COPY(vap->iv_des_bssid, tmpbssid);
3024		if (IEEE80211_ADDR_EQ(vap->iv_des_bssid, zerobssid))
3025			vap->iv_flags &= ~IEEE80211_F_DESBSSID;
3026		else
3027			vap->iv_flags |= IEEE80211_F_DESBSSID;
3028		error = ENETRESET;
3029		break;
3030	case IEEE80211_IOC_CHANLIST:
3031		error = ieee80211_ioctl_setchanlist(vap, ireq);
3032		break;
3033#define	OLD_IEEE80211_IOC_SCAN_REQ	23
3034#ifdef OLD_IEEE80211_IOC_SCAN_REQ
3035	case OLD_IEEE80211_IOC_SCAN_REQ:
3036		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
3037			"%s: active scan request\n", __func__);
3038		/*
3039		 * If we are in INIT state then the driver has never
3040		 * had a chance to setup hardware state to do a scan;
3041		 * use the state machine to get us up the SCAN state.
3042		 * Otherwise just invoke the scan machinery to start
3043		 * a one-time scan.
3044		 */
3045		if (vap->iv_state == IEEE80211_S_INIT)
3046			ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
3047		else
3048			(void) ieee80211_start_scan(vap,
3049				IEEE80211_SCAN_ACTIVE |
3050				IEEE80211_SCAN_NOPICK |
3051				IEEE80211_SCAN_ONCE,
3052				IEEE80211_SCAN_FOREVER, 0, 0,
3053				/* XXX use ioctl params */
3054				vap->iv_des_nssid, vap->iv_des_ssid);
3055		break;
3056#endif /* OLD_IEEE80211_IOC_SCAN_REQ */
3057	case IEEE80211_IOC_SCAN_REQ:
3058		error = ieee80211_ioctl_scanreq(vap, ireq);
3059		break;
3060	case IEEE80211_IOC_SCAN_CANCEL:
3061		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
3062		    "%s: cancel scan\n", __func__);
3063		ieee80211_cancel_scan(vap);
3064		break;
3065	case IEEE80211_IOC_HTCONF:
3066		if (ireq->i_val & 1)
3067			ieee80211_syncflag_ht(vap, IEEE80211_FHT_HT);
3068		else
3069			ieee80211_syncflag_ht(vap, -IEEE80211_FHT_HT);
3070		if (ireq->i_val & 2)
3071			ieee80211_syncflag_ht(vap, IEEE80211_FHT_USEHT40);
3072		else
3073			ieee80211_syncflag_ht(vap, -IEEE80211_FHT_USEHT40);
3074		error = ENETRESET;
3075		break;
3076	case IEEE80211_IOC_ADDMAC:
3077	case IEEE80211_IOC_DELMAC:
3078		error = ieee80211_ioctl_macmac(vap, ireq);
3079		break;
3080	case IEEE80211_IOC_MACCMD:
3081		error = ieee80211_ioctl_setmaccmd(vap, ireq);
3082		break;
3083	case IEEE80211_IOC_STA_STATS:
3084		error = ieee80211_ioctl_setstastats(vap, ireq);
3085		break;
3086	case IEEE80211_IOC_STA_TXPOW:
3087		error = ieee80211_ioctl_setstatxpow(vap, ireq);
3088		break;
3089	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
3090	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
3091	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
3092	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
3093	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
3094	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only) */
3095		error = ieee80211_ioctl_setwmeparam(vap, ireq);
3096		break;
3097	case IEEE80211_IOC_DTIM_PERIOD:
3098		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
3099		    vap->iv_opmode != IEEE80211_M_MBSS &&
3100		    vap->iv_opmode != IEEE80211_M_IBSS)
3101			return EINVAL;
3102		if (IEEE80211_DTIM_MIN <= ireq->i_val &&
3103		    ireq->i_val <= IEEE80211_DTIM_MAX) {
3104			vap->iv_dtim_period = ireq->i_val;
3105			error = ENETRESET;		/* requires restart */
3106		} else
3107			error = EINVAL;
3108		break;
3109	case IEEE80211_IOC_BEACON_INTERVAL:
3110		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
3111		    vap->iv_opmode != IEEE80211_M_MBSS &&
3112		    vap->iv_opmode != IEEE80211_M_IBSS)
3113			return EINVAL;
3114		if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
3115		    ireq->i_val <= IEEE80211_BINTVAL_MAX) {
3116			ic->ic_bintval = ireq->i_val;
3117			error = ENETRESET;		/* requires restart */
3118		} else
3119			error = EINVAL;
3120		break;
3121	case IEEE80211_IOC_PUREG:
3122		if (ireq->i_val)
3123			vap->iv_flags |= IEEE80211_F_PUREG;
3124		else
3125			vap->iv_flags &= ~IEEE80211_F_PUREG;
3126		/* NB: reset only if we're operating on an 11g channel */
3127		if (isvap11g(vap))
3128			error = ENETRESET;
3129		break;
3130	case IEEE80211_IOC_QUIET:
3131		vap->iv_quiet= ireq->i_val;
3132		break;
3133	case IEEE80211_IOC_QUIET_COUNT:
3134		vap->iv_quiet_count=ireq->i_val;
3135		break;
3136	case IEEE80211_IOC_QUIET_PERIOD:
3137		vap->iv_quiet_period=ireq->i_val;
3138		break;
3139	case IEEE80211_IOC_QUIET_OFFSET:
3140		vap->iv_quiet_offset=ireq->i_val;
3141		break;
3142	case IEEE80211_IOC_QUIET_DUR:
3143		if(ireq->i_val < vap->iv_bss->ni_intval)
3144			vap->iv_quiet_duration = ireq->i_val;
3145		else
3146			error = EINVAL;
3147		break;
3148	case IEEE80211_IOC_BGSCAN:
3149		if (ireq->i_val) {
3150			if ((vap->iv_caps & IEEE80211_C_BGSCAN) == 0)
3151				return EOPNOTSUPP;
3152			vap->iv_flags |= IEEE80211_F_BGSCAN;
3153		} else
3154			vap->iv_flags &= ~IEEE80211_F_BGSCAN;
3155		break;
3156	case IEEE80211_IOC_BGSCAN_IDLE:
3157		if (ireq->i_val >= IEEE80211_BGSCAN_IDLE_MIN)
3158			vap->iv_bgscanidle = ireq->i_val*hz/1000;
3159		else
3160			error = EINVAL;
3161		break;
3162	case IEEE80211_IOC_BGSCAN_INTERVAL:
3163		if (ireq->i_val >= IEEE80211_BGSCAN_INTVAL_MIN)
3164			vap->iv_bgscanintvl = ireq->i_val*hz;
3165		else
3166			error = EINVAL;
3167		break;
3168	case IEEE80211_IOC_SCANVALID:
3169		if (ireq->i_val >= IEEE80211_SCAN_VALID_MIN)
3170			vap->iv_scanvalid = ireq->i_val*hz;
3171		else
3172			error = EINVAL;
3173		break;
3174	case IEEE80211_IOC_FRAGTHRESHOLD:
3175		if ((vap->iv_caps & IEEE80211_C_TXFRAG) == 0 &&
3176		    ireq->i_val != IEEE80211_FRAG_MAX)
3177			return EOPNOTSUPP;
3178		if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
3179		      ireq->i_val <= IEEE80211_FRAG_MAX))
3180			return EINVAL;
3181		vap->iv_fragthreshold = ireq->i_val;
3182		error = ERESTART;
3183		break;
3184	case IEEE80211_IOC_BURST:
3185		if (ireq->i_val) {
3186			if ((vap->iv_caps & IEEE80211_C_BURST) == 0)
3187				return EOPNOTSUPP;
3188			ieee80211_syncflag(vap, IEEE80211_F_BURST);
3189		} else
3190			ieee80211_syncflag(vap, -IEEE80211_F_BURST);
3191		error = ERESTART;
3192		break;
3193	case IEEE80211_IOC_BMISSTHRESHOLD:
3194		if (!(IEEE80211_HWBMISS_MIN <= ireq->i_val &&
3195		      ireq->i_val <= IEEE80211_HWBMISS_MAX))
3196			return EINVAL;
3197		vap->iv_bmissthreshold = ireq->i_val;
3198		error = ERESTART;
3199		break;
3200	case IEEE80211_IOC_CURCHAN:
3201		error = ieee80211_ioctl_setcurchan(vap, ireq);
3202		break;
3203	case IEEE80211_IOC_SHORTGI:
3204		if (ireq->i_val) {
3205#define	IEEE80211_HTCAP_SHORTGI \
3206	(IEEE80211_HTCAP_SHORTGI20 | IEEE80211_HTCAP_SHORTGI40)
3207			if (((ireq->i_val ^ vap->iv_htcaps) & IEEE80211_HTCAP_SHORTGI) != 0)
3208				return EINVAL;
3209			if (ireq->i_val & IEEE80211_HTCAP_SHORTGI20)
3210				vap->iv_flags_ht |= IEEE80211_FHT_SHORTGI20;
3211			if (ireq->i_val & IEEE80211_HTCAP_SHORTGI40)
3212				vap->iv_flags_ht |= IEEE80211_FHT_SHORTGI40;
3213#undef IEEE80211_HTCAP_SHORTGI
3214		} else
3215			vap->iv_flags_ht &=
3216			    ~(IEEE80211_FHT_SHORTGI20 | IEEE80211_FHT_SHORTGI40);
3217		error = ERESTART;
3218		break;
3219	case IEEE80211_IOC_AMPDU:
3220		if (ireq->i_val && (vap->iv_htcaps & IEEE80211_HTC_AMPDU) == 0)
3221			return EINVAL;
3222		if (ireq->i_val & 1)
3223			vap->iv_flags_ht |= IEEE80211_FHT_AMPDU_TX;
3224		else
3225			vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_TX;
3226		if (ireq->i_val & 2)
3227			vap->iv_flags_ht |= IEEE80211_FHT_AMPDU_RX;
3228		else
3229			vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
3230		/* NB: reset only if we're operating on an 11n channel */
3231		if (isvapht(vap))
3232			error = ERESTART;
3233		break;
3234	case IEEE80211_IOC_AMPDU_LIMIT:
3235		/* XXX TODO: figure out ampdu_limit versus ampdu_rxmax */
3236		if (!(IEEE80211_HTCAP_MAXRXAMPDU_8K <= ireq->i_val &&
3237		      ireq->i_val <= IEEE80211_HTCAP_MAXRXAMPDU_64K))
3238			return EINVAL;
3239		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
3240			vap->iv_ampdu_rxmax = ireq->i_val;
3241		else
3242			vap->iv_ampdu_limit = ireq->i_val;
3243		error = ERESTART;
3244		break;
3245	case IEEE80211_IOC_AMPDU_DENSITY:
3246		if (!(IEEE80211_HTCAP_MPDUDENSITY_NA <= ireq->i_val &&
3247		      ireq->i_val <= IEEE80211_HTCAP_MPDUDENSITY_16))
3248			return EINVAL;
3249		vap->iv_ampdu_density = ireq->i_val;
3250		error = ERESTART;
3251		break;
3252	case IEEE80211_IOC_AMSDU:
3253		if (ireq->i_val && (vap->iv_htcaps & IEEE80211_HTC_AMSDU) == 0)
3254			return EINVAL;
3255		if (ireq->i_val & 1)
3256			vap->iv_flags_ht |= IEEE80211_FHT_AMSDU_TX;
3257		else
3258			vap->iv_flags_ht &= ~IEEE80211_FHT_AMSDU_TX;
3259		if (ireq->i_val & 2)
3260			vap->iv_flags_ht |= IEEE80211_FHT_AMSDU_RX;
3261		else
3262			vap->iv_flags_ht &= ~IEEE80211_FHT_AMSDU_RX;
3263		/* NB: reset only if we're operating on an 11n channel */
3264		if (isvapht(vap))
3265			error = ERESTART;
3266		break;
3267	case IEEE80211_IOC_AMSDU_LIMIT:
3268		/* XXX validate */
3269		vap->iv_amsdu_limit = ireq->i_val;	/* XXX truncation? */
3270		break;
3271	case IEEE80211_IOC_PUREN:
3272		if (ireq->i_val) {
3273			if ((vap->iv_flags_ht & IEEE80211_FHT_HT) == 0)
3274				return EINVAL;
3275			vap->iv_flags_ht |= IEEE80211_FHT_PUREN;
3276		} else
3277			vap->iv_flags_ht &= ~IEEE80211_FHT_PUREN;
3278		/* NB: reset only if we're operating on an 11n channel */
3279		if (isvapht(vap))
3280			error = ERESTART;
3281		break;
3282	case IEEE80211_IOC_DOTH:
3283		if (ireq->i_val) {
3284#if 0
3285			/* XXX no capability */
3286			if ((vap->iv_caps & IEEE80211_C_DOTH) == 0)
3287				return EOPNOTSUPP;
3288#endif
3289			vap->iv_flags |= IEEE80211_F_DOTH;
3290		} else
3291			vap->iv_flags &= ~IEEE80211_F_DOTH;
3292		error = ENETRESET;
3293		break;
3294	case IEEE80211_IOC_REGDOMAIN:
3295		error = ieee80211_ioctl_setregdomain(vap, ireq);
3296		break;
3297	case IEEE80211_IOC_ROAM:
3298		error = ieee80211_ioctl_setroam(vap, ireq);
3299		break;
3300	case IEEE80211_IOC_TXPARAMS:
3301		error = ieee80211_ioctl_settxparams(vap, ireq);
3302		break;
3303	case IEEE80211_IOC_HTCOMPAT:
3304		if (ireq->i_val) {
3305			if ((vap->iv_flags_ht & IEEE80211_FHT_HT) == 0)
3306				return EOPNOTSUPP;
3307			vap->iv_flags_ht |= IEEE80211_FHT_HTCOMPAT;
3308		} else
3309			vap->iv_flags_ht &= ~IEEE80211_FHT_HTCOMPAT;
3310		/* NB: reset only if we're operating on an 11n channel */
3311		if (isvapht(vap))
3312			error = ERESTART;
3313		break;
3314	case IEEE80211_IOC_DWDS:
3315		if (ireq->i_val) {
3316			/* NB: DWDS only makes sense for WDS-capable devices */
3317			if ((ic->ic_caps & IEEE80211_C_WDS) == 0)
3318				return EOPNOTSUPP;
3319			/* NB: DWDS is used only with ap+sta vaps */
3320			if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
3321			    vap->iv_opmode != IEEE80211_M_STA)
3322				return EINVAL;
3323			vap->iv_flags |= IEEE80211_F_DWDS;
3324			if (vap->iv_opmode == IEEE80211_M_STA)
3325				vap->iv_flags_ext |= IEEE80211_FEXT_4ADDR;
3326		} else {
3327			vap->iv_flags &= ~IEEE80211_F_DWDS;
3328			if (vap->iv_opmode == IEEE80211_M_STA)
3329				vap->iv_flags_ext &= ~IEEE80211_FEXT_4ADDR;
3330		}
3331		break;
3332	case IEEE80211_IOC_INACTIVITY:
3333		if (ireq->i_val)
3334			vap->iv_flags_ext |= IEEE80211_FEXT_INACT;
3335		else
3336			vap->iv_flags_ext &= ~IEEE80211_FEXT_INACT;
3337		break;
3338	case IEEE80211_IOC_APPIE:
3339		error = ieee80211_ioctl_setappie(vap, ireq);
3340		break;
3341	case IEEE80211_IOC_WPS:
3342		if (ireq->i_val) {
3343			if ((vap->iv_caps & IEEE80211_C_WPA) == 0)
3344				return EOPNOTSUPP;
3345			vap->iv_flags_ext |= IEEE80211_FEXT_WPS;
3346		} else
3347			vap->iv_flags_ext &= ~IEEE80211_FEXT_WPS;
3348		break;
3349	case IEEE80211_IOC_TSN:
3350		if (ireq->i_val) {
3351			if ((vap->iv_caps & IEEE80211_C_WPA) == 0)
3352				return EOPNOTSUPP;
3353			vap->iv_flags_ext |= IEEE80211_FEXT_TSN;
3354		} else
3355			vap->iv_flags_ext &= ~IEEE80211_FEXT_TSN;
3356		break;
3357	case IEEE80211_IOC_CHANSWITCH:
3358		error = ieee80211_ioctl_chanswitch(vap, ireq);
3359		break;
3360	case IEEE80211_IOC_DFS:
3361		if (ireq->i_val) {
3362			if ((vap->iv_caps & IEEE80211_C_DFS) == 0)
3363				return EOPNOTSUPP;
3364			/* NB: DFS requires 11h support */
3365			if ((vap->iv_flags & IEEE80211_F_DOTH) == 0)
3366				return EINVAL;
3367			vap->iv_flags_ext |= IEEE80211_FEXT_DFS;
3368		} else
3369			vap->iv_flags_ext &= ~IEEE80211_FEXT_DFS;
3370		break;
3371	case IEEE80211_IOC_DOTD:
3372		if (ireq->i_val)
3373			vap->iv_flags_ext |= IEEE80211_FEXT_DOTD;
3374		else
3375			vap->iv_flags_ext &= ~IEEE80211_FEXT_DOTD;
3376		if (vap->iv_opmode == IEEE80211_M_STA)
3377			error = ENETRESET;
3378		break;
3379	case IEEE80211_IOC_HTPROTMODE:
3380		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
3381			return EINVAL;
3382		ic->ic_htprotmode = ireq->i_val ?
3383		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_NONE;
3384		/* NB: if not operating in 11n this can wait */
3385		if (isvapht(vap))
3386			error = ERESTART;
3387		break;
3388	case IEEE80211_IOC_STA_VLAN:
3389		error = ieee80211_ioctl_setstavlan(vap, ireq);
3390		break;
3391	case IEEE80211_IOC_SMPS:
3392		if ((ireq->i_val &~ IEEE80211_HTCAP_SMPS) != 0 ||
3393		    ireq->i_val == 0x0008)	/* value of 2 is reserved */
3394			return EINVAL;
3395		if (ireq->i_val != IEEE80211_HTCAP_SMPS_OFF &&
3396		    (vap->iv_htcaps & IEEE80211_HTC_SMPS) == 0)
3397			return EOPNOTSUPP;
3398		vap->iv_htcaps = (vap->iv_htcaps &~ IEEE80211_HTCAP_SMPS) |
3399			ireq->i_val;
3400		/* NB: if not operating in 11n this can wait */
3401		if (isvapht(vap))
3402			error = ERESTART;
3403		break;
3404	case IEEE80211_IOC_RIFS:
3405		if (ireq->i_val != 0) {
3406			if ((vap->iv_htcaps & IEEE80211_HTC_RIFS) == 0)
3407				return EOPNOTSUPP;
3408			vap->iv_flags_ht |= IEEE80211_FHT_RIFS;
3409		} else
3410			vap->iv_flags_ht &= ~IEEE80211_FHT_RIFS;
3411		/* NB: if not operating in 11n this can wait */
3412		if (isvapht(vap))
3413			error = ERESTART;
3414		break;
3415	case IEEE80211_IOC_STBC:
3416		/* Check if we can do STBC TX/RX before changing the setting */
3417		if ((ireq->i_val & 1) &&
3418		    ((vap->iv_htcaps & IEEE80211_HTCAP_TXSTBC) == 0))
3419			return EOPNOTSUPP;
3420		if ((ireq->i_val & 2) &&
3421		    ((vap->iv_htcaps & IEEE80211_HTCAP_RXSTBC) == 0))
3422			return EOPNOTSUPP;
3423
3424		/* TX */
3425		if (ireq->i_val & 1)
3426			vap->iv_flags_ht |= IEEE80211_FHT_STBC_TX;
3427		else
3428			vap->iv_flags_ht &= ~IEEE80211_FHT_STBC_TX;
3429
3430		/* RX */
3431		if (ireq->i_val & 2)
3432			vap->iv_flags_ht |= IEEE80211_FHT_STBC_RX;
3433		else
3434			vap->iv_flags_ht &= ~IEEE80211_FHT_STBC_RX;
3435
3436		/* NB: reset only if we're operating on an 11n channel */
3437		if (isvapht(vap))
3438			error = ERESTART;
3439		break;
3440	case IEEE80211_IOC_LDPC:
3441		/* Check if we can do LDPC TX/RX before changing the setting */
3442		if ((ireq->i_val & 1) &&
3443		    (vap->iv_htcaps & IEEE80211_HTC_TXLDPC) == 0)
3444			return EOPNOTSUPP;
3445		if ((ireq->i_val & 2) &&
3446		    (vap->iv_htcaps & IEEE80211_HTCAP_LDPC) == 0)
3447			return EOPNOTSUPP;
3448
3449		/* TX */
3450		if (ireq->i_val & 1)
3451			vap->iv_flags_ht |= IEEE80211_FHT_LDPC_TX;
3452		else
3453			vap->iv_flags_ht &= ~IEEE80211_FHT_LDPC_TX;
3454
3455		/* RX */
3456		if (ireq->i_val & 2)
3457			vap->iv_flags_ht |= IEEE80211_FHT_LDPC_RX;
3458		else
3459			vap->iv_flags_ht &= ~IEEE80211_FHT_LDPC_RX;
3460
3461		/* NB: reset only if we're operating on an 11n channel */
3462		if (isvapht(vap))
3463			error = ERESTART;
3464		break;
3465
3466	/* VHT */
3467	case IEEE80211_IOC_VHTCONF:
3468		if (ireq->i_val & 1)
3469			ieee80211_syncflag_vht(vap, IEEE80211_FVHT_VHT);
3470		else
3471			ieee80211_syncflag_vht(vap, -IEEE80211_FVHT_VHT);
3472
3473		if (ireq->i_val & 2)
3474			ieee80211_syncflag_vht(vap, IEEE80211_FVHT_USEVHT40);
3475		else
3476			ieee80211_syncflag_vht(vap, -IEEE80211_FVHT_USEVHT40);
3477
3478		if (ireq->i_val & 4)
3479			ieee80211_syncflag_vht(vap, IEEE80211_FVHT_USEVHT80);
3480		else
3481			ieee80211_syncflag_vht(vap, -IEEE80211_FVHT_USEVHT80);
3482
3483		if (ireq->i_val & 8)
3484			ieee80211_syncflag_vht(vap, IEEE80211_FVHT_USEVHT80P80);
3485		else
3486			ieee80211_syncflag_vht(vap, -IEEE80211_FVHT_USEVHT80P80);
3487
3488		if (ireq->i_val & 16)
3489			ieee80211_syncflag_vht(vap, IEEE80211_FVHT_USEVHT160);
3490		else
3491			ieee80211_syncflag_vht(vap, -IEEE80211_FVHT_USEVHT160);
3492
3493		error = ENETRESET;
3494		break;
3495
3496	default:
3497		error = ieee80211_ioctl_setdefault(vap, ireq);
3498		break;
3499	}
3500	/*
3501	 * The convention is that ENETRESET means an operation
3502	 * requires a complete re-initialization of the device (e.g.
3503	 * changing something that affects the association state).
3504	 * ERESTART means the request may be handled with only a
3505	 * reload of the hardware state.  We hand ERESTART requests
3506	 * to the iv_reset callback so the driver can decide.  If
3507	 * a device does not fillin iv_reset then it defaults to one
3508	 * that returns ENETRESET.  Otherwise a driver may return
3509	 * ENETRESET (in which case a full reset will be done) or
3510	 * 0 to mean there's no need to do anything (e.g. when the
3511	 * change has no effect on the driver/device).
3512	 */
3513	if (error == ERESTART)
3514		error = IFNET_IS_UP_RUNNING(vap->iv_ifp) ?
3515		    vap->iv_reset(vap, ireq->i_type) : 0;
3516	if (error == ENETRESET) {
3517		/* XXX need to re-think AUTO handling */
3518		if (IS_UP_AUTO(vap))
3519			ieee80211_init(vap);
3520		error = 0;
3521	}
3522	return error;
3523}
3524
3525int
3526ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
3527{
3528	struct ieee80211vap *vap = ifp->if_softc;
3529	struct ieee80211com *ic = vap->iv_ic;
3530	int error = 0, wait = 0, ic_used;
3531	struct ifreq *ifr;
3532	struct ifaddr *ifa;			/* XXX */
3533
3534	ic_used = (cmd != SIOCSIFMTU && cmd != SIOCG80211STATS);
3535	if (ic_used && (error = ieee80211_com_vincref(vap)) != 0)
3536		return (error);
3537
3538	switch (cmd) {
3539	case SIOCSIFFLAGS:
3540		IEEE80211_LOCK(ic);
3541		if ((ifp->if_flags ^ vap->iv_ifflags) & IFF_PROMISC) {
3542			/*
3543			 * Enable promiscuous mode when:
3544			 * 1. Interface is not a member of bridge, or
3545			 * 2. Requested by user, or
3546			 * 3. In monitor (or adhoc-demo) mode.
3547			 */
3548			if (ifp->if_bridge == NULL ||
3549			    (ifp->if_flags & IFF_PPROMISC) != 0 ||
3550			    vap->iv_opmode == IEEE80211_M_MONITOR ||
3551			    (vap->iv_opmode == IEEE80211_M_AHDEMO &&
3552			    (vap->iv_caps & IEEE80211_C_TDMA) == 0)) {
3553				ieee80211_promisc(vap,
3554				    ifp->if_flags & IFF_PROMISC);
3555				vap->iv_ifflags ^= IFF_PROMISC;
3556			}
3557		}
3558		if ((ifp->if_flags ^ vap->iv_ifflags) & IFF_ALLMULTI) {
3559			ieee80211_allmulti(vap, ifp->if_flags & IFF_ALLMULTI);
3560			vap->iv_ifflags ^= IFF_ALLMULTI;
3561		}
3562		if (ifp->if_flags & IFF_UP) {
3563			/*
3564			 * Bring ourself up unless we're already operational.
3565			 * If we're the first vap and the parent is not up
3566			 * then it will automatically be brought up as a
3567			 * side-effect of bringing ourself up.
3568			 */
3569			if (vap->iv_state == IEEE80211_S_INIT) {
3570				if (ic->ic_nrunning == 0)
3571					wait = 1;
3572				ieee80211_start_locked(vap);
3573			}
3574		} else if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
3575			/*
3576			 * Stop ourself.  If we are the last vap to be
3577			 * marked down the parent will also be taken down.
3578			 */
3579			if (ic->ic_nrunning == 1)
3580				wait = 1;
3581			ieee80211_stop_locked(vap);
3582		}
3583		IEEE80211_UNLOCK(ic);
3584		/* Wait for parent ioctl handler if it was queued */
3585		if (wait) {
3586			ieee80211_waitfor_parent(ic);
3587
3588			/*
3589			 * Check if the MAC address was changed
3590			 * via SIOCSIFLLADDR ioctl.
3591			 *
3592			 * NB: device may be detached during initialization;
3593			 * use if_ioctl for existence check.
3594			 */
3595			if_addr_rlock(ifp);
3596			if (ifp->if_ioctl == ieee80211_ioctl &&
3597			    (ifp->if_flags & IFF_UP) == 0 &&
3598			    !IEEE80211_ADDR_EQ(vap->iv_myaddr, IF_LLADDR(ifp)))
3599				IEEE80211_ADDR_COPY(vap->iv_myaddr,
3600				    IF_LLADDR(ifp));
3601			if_addr_runlock(ifp);
3602		}
3603		break;
3604	case SIOCADDMULTI:
3605	case SIOCDELMULTI:
3606		ieee80211_runtask(ic, &ic->ic_mcast_task);
3607		break;
3608	case SIOCSIFMEDIA:
3609	case SIOCGIFMEDIA:
3610		ifr = (struct ifreq *)data;
3611		error = ifmedia_ioctl(ifp, ifr, &vap->iv_media, cmd);
3612		break;
3613	case SIOCG80211:
3614		error = ieee80211_ioctl_get80211(vap, cmd,
3615				(struct ieee80211req *) data);
3616		break;
3617	case SIOCS80211:
3618		error = priv_check(curthread, PRIV_NET80211_MANAGE);
3619		if (error == 0)
3620			error = ieee80211_ioctl_set80211(vap, cmd,
3621					(struct ieee80211req *) data);
3622		break;
3623	case SIOCG80211STATS:
3624		ifr = (struct ifreq *)data;
3625		copyout(&vap->iv_stats, ifr_data_get_ptr(ifr),
3626		    sizeof (vap->iv_stats));
3627		break;
3628	case SIOCSIFMTU:
3629		ifr = (struct ifreq *)data;
3630		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
3631		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
3632			error = EINVAL;
3633		else
3634			ifp->if_mtu = ifr->ifr_mtu;
3635		break;
3636	case SIOCSIFADDR:
3637		/*
3638		 * XXX Handle this directly so we can suppress if_init calls.
3639		 * XXX This should be done in ether_ioctl but for the moment
3640		 * XXX there are too many other parts of the system that
3641		 * XXX set IFF_UP and so suppress if_init being called when
3642		 * XXX it should be.
3643		 */
3644		ifa = (struct ifaddr *) data;
3645		switch (ifa->ifa_addr->sa_family) {
3646#ifdef INET
3647		case AF_INET:
3648			if ((ifp->if_flags & IFF_UP) == 0) {
3649				ifp->if_flags |= IFF_UP;
3650				ifp->if_init(ifp->if_softc);
3651			}
3652			arp_ifinit(ifp, ifa);
3653			break;
3654#endif
3655		default:
3656			if ((ifp->if_flags & IFF_UP) == 0) {
3657				ifp->if_flags |= IFF_UP;
3658				ifp->if_init(ifp->if_softc);
3659			}
3660			break;
3661		}
3662		break;
3663	default:
3664		/*
3665		 * Pass unknown ioctls first to the driver, and if it
3666		 * returns ENOTTY, then to the generic Ethernet handler.
3667		 */
3668		if (ic->ic_ioctl != NULL &&
3669		    (error = ic->ic_ioctl(ic, cmd, data)) != ENOTTY)
3670			break;
3671		error = ether_ioctl(ifp, cmd, data);
3672		break;
3673	}
3674
3675	if (ic_used)
3676		ieee80211_com_vdecref(vap);
3677
3678	return (error);
3679}
3680