Home | History | Annotate | Line # | Download | only in net80211
ieee80211_ioctl.c revision 1.7
      1 /*	$NetBSD: ieee80211_ioctl.c,v 1.7 2003/12/14 09:56:53 dyoung Exp $	*/
      2 /*-
      3  * Copyright (c) 2001 Atsushi Onoe
      4  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. The name of the author may not be used to endorse or promote products
     16  *    derived from this software without specific prior written permission.
     17  *
     18  * Alternatively, this software may be distributed under the terms of the
     19  * GNU General Public License ("GPL") version 2 as published by the Free
     20  * Software Foundation.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #include <sys/cdefs.h>
     35 #ifdef __FreeBSD__
     36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_ioctl.c,v 1.9 2003/11/13 05:23:58 sam Exp $");
     37 #else
     38 __KERNEL_RCSID(0, "$NetBSD: ieee80211_ioctl.c,v 1.7 2003/12/14 09:56:53 dyoung Exp $");
     39 #endif
     40 
     41 /*
     42  * IEEE 802.11 ioctl support (FreeBSD-specific)
     43  */
     44 
     45 #include <sys/endian.h>
     46 #include <sys/param.h>
     47 #include <sys/kernel.h>
     48 #include <sys/socket.h>
     49 #include <sys/sockio.h>
     50 #include <sys/systm.h>
     51 #include <sys/proc.h>
     52 
     53 #include <net/if.h>
     54 #include <net/if_arp.h>
     55 #include <net/if_media.h>
     56 #ifdef __FreeBSD__
     57 #include <net/ethernet.h>
     58 #else
     59 #include <net/if_ether.h>
     60 #endif
     61 
     62 #include <net80211/ieee80211_var.h>
     63 #include <net80211/ieee80211_ioctl.h>
     64 
     65 #ifdef __FreeBSD__
     66 #include <dev/wi/if_wavelan_ieee.h>
     67 #else
     68 #include <dev/ic/wi_ieee.h>
     69 #endif
     70 
     71 /*
     72  * XXX
     73  * Wireless LAN specific configuration interface, which is compatible
     74  * with wicontrol(8).
     75  */
     76 
     77 int
     78 ieee80211_cfgget(struct ifnet *ifp, u_long cmd, caddr_t data)
     79 {
     80 	struct ieee80211com *ic = (void *)ifp;
     81 	int i, j, error;
     82 	struct ifreq *ifr = (struct ifreq *)data;
     83 	struct wi_req wreq;
     84 	struct wi_ltv_keys *keys;
     85 	struct wi_apinfo *ap;
     86 	struct ieee80211_node *ni;
     87 	struct ieee80211_rateset *rs;
     88 #ifdef WICACHE
     89 	struct wi_sigcache wsc;
     90 #endif /* WICACHE */
     91 #if 0 /* TBD */
     92 	struct wi_scan_p2_hdr *p2;
     93 	struct wi_scan_res *res;
     94 #endif
     95 
     96 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
     97 	if (error)
     98 		return error;
     99 	wreq.wi_len = 0;
    100 	switch (wreq.wi_type) {
    101 	case WI_RID_SERIALNO:
    102 		/* nothing appropriate */
    103 		break;
    104 	case WI_RID_NODENAME:
    105 		strcpy((char *)&wreq.wi_val[1], hostname);
    106 		wreq.wi_val[0] = htole16(strlen(hostname));
    107 		wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
    108 		break;
    109 	case WI_RID_CURRENT_SSID:
    110 		if (ic->ic_state != IEEE80211_S_RUN) {
    111 			wreq.wi_val[0] = 0;
    112 			wreq.wi_len = 1;
    113 			break;
    114 		}
    115 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
    116 		memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
    117 		    ic->ic_bss->ni_esslen);
    118 		wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
    119 		break;
    120 	case WI_RID_OWN_SSID:
    121 	case WI_RID_DESIRED_SSID:
    122 		wreq.wi_val[0] = htole16(ic->ic_des_esslen);
    123 		memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
    124 		wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
    125 		break;
    126 	case WI_RID_CURRENT_BSSID:
    127 		if (ic->ic_state == IEEE80211_S_RUN)
    128 			IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
    129 		else
    130 			memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
    131 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
    132 		break;
    133 	case WI_RID_CHANNEL_LIST:
    134 		memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
    135 		/*
    136 		 * Since channel 0 is not available for DS, channel 1
    137 		 * is assigned to LSB on WaveLAN.
    138 		 */
    139 		if (ic->ic_phytype == IEEE80211_T_DS)
    140 			i = 1;
    141 		else
    142 			i = 0;
    143 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
    144 			if (isset(ic->ic_chan_active, i)) {
    145 				setbit((u_int8_t *)wreq.wi_val, j);
    146 				wreq.wi_len = j / 16 + 1;
    147 			}
    148 		break;
    149 	case WI_RID_OWN_CHNL:
    150 		wreq.wi_val[0] = htole16(
    151 			ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
    152 		wreq.wi_len = 1;
    153 		break;
    154 	case WI_RID_CURRENT_CHAN:
    155 		wreq.wi_val[0] = htole16(
    156 			ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan));
    157 		wreq.wi_len = 1;
    158 		break;
    159 	case WI_RID_COMMS_QUALITY:
    160 		wreq.wi_val[0] = 0;				/* quality */
    161 		wreq.wi_val[1] =
    162 			htole16((*ic->ic_node_getrssi)(ic, ic->ic_bss));
    163 		wreq.wi_val[2] = 0;				/* noise */
    164 		wreq.wi_len = 3;
    165 		break;
    166 	case WI_RID_PROMISC:
    167 		wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
    168 		wreq.wi_len = 1;
    169 		break;
    170 	case WI_RID_PORTTYPE:
    171 		wreq.wi_val[0] = htole16(ic->ic_opmode);
    172 		wreq.wi_len = 1;
    173 		break;
    174 	case WI_RID_MAC_NODE:
    175 		IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
    176 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
    177 		break;
    178 	case WI_RID_TX_RATE:
    179 		if (ic->ic_fixed_rate == -1)
    180 			wreq.wi_val[0] = 0;	/* auto */
    181 		else
    182 			wreq.wi_val[0] = htole16(
    183 			    (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
    184 			    IEEE80211_RATE_VAL) / 2);
    185 		wreq.wi_len = 1;
    186 		break;
    187 	case WI_RID_CUR_TX_RATE:
    188 		wreq.wi_val[0] = htole16(
    189 		    (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
    190 		    IEEE80211_RATE_VAL) / 2);
    191 		wreq.wi_len = 1;
    192 		break;
    193 	case WI_RID_FRAG_THRESH:
    194 		wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
    195 		wreq.wi_len = 1;
    196 		break;
    197 	case WI_RID_RTS_THRESH:
    198 		wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
    199 		wreq.wi_len = 1;
    200 		break;
    201 	case WI_RID_CREATE_IBSS:
    202 		wreq.wi_val[0] =
    203 		    htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
    204 		wreq.wi_len = 1;
    205 		break;
    206 	case WI_RID_MICROWAVE_OVEN:
    207 		wreq.wi_val[0] = 0;	/* no ... not supported */
    208 		wreq.wi_len = 1;
    209 		break;
    210 	case WI_RID_ROAMING_MODE:
    211 		wreq.wi_val[0] = htole16(1);	/* enabled ... not supported */
    212 		wreq.wi_len = 1;
    213 		break;
    214 	case WI_RID_SYSTEM_SCALE:
    215 		wreq.wi_val[0] = htole16(1);	/* low density ... not supp */
    216 		wreq.wi_len = 1;
    217 		break;
    218 	case WI_RID_PM_ENABLED:
    219 		wreq.wi_val[0] =
    220 		    htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
    221 		wreq.wi_len = 1;
    222 		break;
    223 	case WI_RID_MAX_SLEEP:
    224 		wreq.wi_val[0] = htole16(ic->ic_lintval);
    225 		wreq.wi_len = 1;
    226 		break;
    227 	case WI_RID_CUR_BEACON_INT:
    228 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
    229 		wreq.wi_len = 1;
    230 		break;
    231 	case WI_RID_WEP_AVAIL:
    232 		wreq.wi_val[0] =
    233 		    htole16((ic->ic_caps & IEEE80211_C_WEP) ? 1 : 0);
    234 		wreq.wi_len = 1;
    235 		break;
    236 	case WI_RID_CNFAUTHMODE:
    237 		wreq.wi_val[0] = htole16(1);	/* TODO: open system only */
    238 		wreq.wi_len = 1;
    239 		break;
    240 	case WI_RID_ENCRYPTION:
    241 		wreq.wi_val[0] =
    242 		    htole16((ic->ic_flags & IEEE80211_F_WEPON) ? 1 : 0);
    243 		wreq.wi_len = 1;
    244 		break;
    245 	case WI_RID_TX_CRYPT_KEY:
    246 		wreq.wi_val[0] = htole16(ic->ic_wep_txkey);
    247 		wreq.wi_len = 1;
    248 		break;
    249 	case WI_RID_DEFLT_CRYPT_KEYS:
    250 		keys = (struct wi_ltv_keys *)&wreq;
    251 		/* do not show keys to non-root user */
    252 		error = suser(curproc->p_ucred, &curproc->p_acflag);
    253 		if (error) {
    254 			memset(keys, 0, sizeof(*keys));
    255 			error = 0;
    256 			break;
    257 		}
    258 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    259 			keys->wi_keys[i].wi_keylen =
    260 			    htole16(ic->ic_nw_keys[i].wk_len);
    261 			memcpy(keys->wi_keys[i].wi_keydat,
    262 			    ic->ic_nw_keys[i].wk_key, ic->ic_nw_keys[i].wk_len);
    263 		}
    264 		wreq.wi_len = sizeof(*keys) / 2;
    265 		break;
    266 	case WI_RID_MAX_DATALEN:
    267 		wreq.wi_val[0] = htole16(IEEE80211_MAX_LEN);	/* TODO: frag */
    268 		wreq.wi_len = 1;
    269 		break;
    270 	case WI_RID_IFACE_STATS:
    271 		/* XXX: should be implemented in lower drivers */
    272 		break;
    273 	case WI_RID_READ_APS:
    274 		if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
    275 			/*
    276 			 * Don't return results until active scan completes.
    277 			 */
    278 			if (ic->ic_state == IEEE80211_S_SCAN &&
    279 			    (ic->ic_flags & IEEE80211_F_ASCAN)) {
    280 				error = EINPROGRESS;
    281 				break;
    282 			}
    283 		}
    284 		i = 0;
    285 		ap = (void *)((char *)wreq.wi_val + sizeof(i));
    286 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
    287 			if ((caddr_t)(ap + 1) > (caddr_t)(&wreq + 1))
    288 				break;
    289 			memset(ap, 0, sizeof(*ap));
    290 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
    291 				IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
    292 				ap->namelen = ic->ic_des_esslen;
    293 				if (ic->ic_des_esslen)
    294 					memcpy(ap->name, ic->ic_des_essid,
    295 					    ic->ic_des_esslen);
    296 			} else {
    297 				IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
    298 				ap->namelen = ni->ni_esslen;
    299 				if (ni->ni_esslen)
    300 					memcpy(ap->name, ni->ni_essid,
    301 					    ni->ni_esslen);
    302 			}
    303 			ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
    304 			ap->signal = (*ic->ic_node_getrssi)(ic, ni);
    305 			ap->capinfo = ni->ni_capinfo;
    306 			ap->interval = ni->ni_intval;
    307 			rs = &ni->ni_rates;
    308 			for (j = 0; j < rs->rs_nrates; j++) {
    309 				if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
    310 					ap->rate = (rs->rs_rates[j] &
    311 					    IEEE80211_RATE_VAL) * 5; /* XXX */
    312 				}
    313 			}
    314 			i++;
    315 			ap++;
    316 		}
    317 		memcpy(wreq.wi_val, &i, sizeof(i));
    318 		wreq.wi_len = (sizeof(int) + sizeof(*ap) * i) / 2;
    319 		break;
    320 #if 0
    321 	case WI_RID_PRISM2:
    322 		wreq.wi_val[0] = 1;	/* XXX lie so SCAN_RES can give rates */
    323 		wreq.wi_len = sizeof(u_int16_t) / 2;
    324 		break;
    325 	case WI_RID_SCAN_RES:			/* compatibility interface */
    326 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
    327 		    ic->ic_state == IEEE80211_S_SCAN) {
    328 			error = EINPROGRESS;
    329 			break;
    330 		}
    331 		/* NB: we use the Prism2 format so we can return rate info */
    332 		p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
    333 		res = (void *)&p2[1];
    334 		i = 0;
    335 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
    336 			if ((caddr_t)(res + 1) > (caddr_t)(&wreq + 1))
    337 				break;
    338 			res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
    339 			res->wi_noise = 0;
    340 			res->wi_signal = (*ic->ic_node_getrssi)(ic, ni);
    341 			IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
    342 			res->wi_interval = ni->ni_intval;
    343 			res->wi_capinfo = ni->ni_capinfo;
    344 			res->wi_ssid_len = ni->ni_esslen;
    345 			memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
    346 			/* NB: assumes wi_srates holds <= ni->ni_rates */
    347 			memcpy(res->wi_srates, ni->ni_rates.rs_rates,
    348 				sizeof(res->wi_srates));
    349 			if (ni->ni_rates.rs_nrates < 10)
    350 				res->wi_srates[ni->ni_rates.rs_nrates] = 0;
    351 			res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
    352 			res->wi_rsvd = 0;
    353 			res++, i++;
    354 		}
    355 		p2->wi_rsvd = 0;
    356 		p2->wi_reason = i;
    357 		wreq.wi_len = (sizeof(*p2) + sizeof(*res) * i) / 2;
    358 		break;
    359 #endif /* 0 */
    360 #ifdef WICACHE
    361 	case WI_RID_READ_CACHE:
    362 		i = 0;
    363 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
    364 			if (i == (WI_MAX_DATALEN/sizeof(struct wi_sigcache))-1)
    365 				break;
    366 			IEEE80211_ADDR_COPY(wsc.macsrc, ni->ni_macaddr);
    367 			memset(&wsc.ipsrc, 0, sizeof(wsc.ipsrc));
    368 			wsc.signal = (*ic->ic_node_getrssi)(ic, ni);
    369 			wsc.noise = 0;
    370 			wsc.quality = 0;
    371 			memcpy((caddr_t)wreq.wi_val + sizeof(wsc) * i,
    372 			    &wsc, sizeof(wsc));
    373 			i++;
    374 		}
    375 		wreq.wi_len = sizeof(wsc) * i / 2;
    376 		break;
    377 #endif /* WICACHE */
    378 	case WI_RID_SCAN_APS:
    379 		error = EINVAL;
    380 		break;
    381 	default:
    382 		error = EINVAL;
    383 		break;
    384 	}
    385 	if (error == 0) {
    386 		wreq.wi_len++;
    387 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
    388 	}
    389 	return error;
    390 }
    391 
    392 static int
    393 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
    394 {
    395 #define	IEEERATE(_ic,_m,_i) \
    396 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
    397 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
    398 	for (i = 0; i < nrates; i++)
    399 		if (IEEERATE(ic, mode, i) == rate)
    400 			return i;
    401 	return -1;
    402 #undef IEEERATE
    403 }
    404 
    405 /*
    406  * Prepare to do a user-initiated scan for AP's.  If no
    407  * current/default channel is setup or the current channel
    408  * is invalid then pick the first available channel from
    409  * the active list as the place to start the scan.
    410  */
    411 static int
    412 ieee80211_setupscan(struct ieee80211com *ic)
    413 {
    414 	u_char *chanlist = ic->ic_chan_active;
    415 	int i;
    416 
    417 	if (ic->ic_ibss_chan == NULL ||
    418 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
    419 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
    420 			if (isset(chanlist, i)) {
    421 				ic->ic_ibss_chan = &ic->ic_channels[i];
    422 				goto found;
    423 			}
    424 		return EINVAL;			/* no active channels */
    425 found:
    426 		;
    427 	}
    428 	if (ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC ||
    429 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan)))
    430 		ic->ic_bss->ni_chan = ic->ic_ibss_chan;
    431 	/*
    432 	 * XXX don't permit a scan to be started unless we
    433 	 * know the device is ready.  For the moment this means
    434 	 * the device is marked up as this is the required to
    435 	 * initialize the hardware.  It would be better to permit
    436 	 * scanning prior to being up but that'll require some
    437 	 * changes to the infrastructure.
    438 	 */
    439 	return (ic->ic_if.if_flags & IFF_UP) ? 0 : ENETRESET;
    440 }
    441 
    442 int
    443 ieee80211_cfgset(struct ifnet *ifp, u_long cmd, caddr_t data)
    444 {
    445 	struct ieee80211com *ic = (void *)ifp;
    446 	int i, j, len, error, rate;
    447 	struct ifreq *ifr = (struct ifreq *)data;
    448 	struct wi_ltv_keys *keys;
    449 	struct wi_req wreq;
    450 	u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
    451 
    452 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
    453 	if (error)
    454 		return error;
    455 	len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
    456 	switch (wreq.wi_type) {
    457 	case WI_RID_SERIALNO:
    458 	case WI_RID_NODENAME:
    459 		return EPERM;
    460 	case WI_RID_CURRENT_SSID:
    461 		return EPERM;
    462 	case WI_RID_OWN_SSID:
    463 	case WI_RID_DESIRED_SSID:
    464 		if (le16toh(wreq.wi_val[0]) * 2 > len ||
    465 		    le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
    466 			error = ENOSPC;
    467 			break;
    468 		}
    469 		memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
    470 		ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
    471 		memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
    472 		error = ENETRESET;
    473 		break;
    474 	case WI_RID_CURRENT_BSSID:
    475 		return EPERM;
    476 	case WI_RID_OWN_CHNL:
    477 		if (len != 2)
    478 			return EINVAL;
    479 		i = le16toh(wreq.wi_val[0]);
    480 		if (i < 0 ||
    481 		    i > IEEE80211_CHAN_MAX ||
    482 		    isclr(ic->ic_chan_active, i))
    483 			return EINVAL;
    484 		ic->ic_ibss_chan = &ic->ic_channels[i];
    485 		if (ic->ic_flags & IEEE80211_F_SIBSS)
    486 			error = ENETRESET;
    487 		break;
    488 	case WI_RID_CURRENT_CHAN:
    489 		return EPERM;
    490 	case WI_RID_COMMS_QUALITY:
    491 		return EPERM;
    492 	case WI_RID_PROMISC:
    493 		if (len != 2)
    494 			return EINVAL;
    495 		if (ifp->if_flags & IFF_PROMISC) {
    496 			if (wreq.wi_val[0] == 0) {
    497 				ifp->if_flags &= ~IFF_PROMISC;
    498 				error = ENETRESET;
    499 			}
    500 		} else {
    501 			if (wreq.wi_val[0] != 0) {
    502 				ifp->if_flags |= IFF_PROMISC;
    503 				error = ENETRESET;
    504 			}
    505 		}
    506 		break;
    507 	case WI_RID_PORTTYPE:
    508 		if (len != 2)
    509 			return EINVAL;
    510 		switch (le16toh(wreq.wi_val[0])) {
    511 		case IEEE80211_M_STA:
    512 			break;
    513 		case IEEE80211_M_IBSS:
    514 			if (!(ic->ic_caps & IEEE80211_C_IBSS))
    515 				return EINVAL;
    516 			break;
    517 		case IEEE80211_M_AHDEMO:
    518 			if (ic->ic_phytype != IEEE80211_T_DS ||
    519 			    !(ic->ic_caps & IEEE80211_C_AHDEMO))
    520 				return EINVAL;
    521 			break;
    522 		case IEEE80211_M_HOSTAP:
    523 			if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
    524 				return EINVAL;
    525 			break;
    526 		default:
    527 			return EINVAL;
    528 		}
    529 		if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
    530 			ic->ic_opmode = le16toh(wreq.wi_val[0]);
    531 			error = ENETRESET;
    532 		}
    533 		break;
    534 #if 0
    535 	case WI_RID_MAC_NODE:
    536 		if (len != IEEE80211_ADDR_LEN)
    537 			return EINVAL;
    538 		IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
    539 		/* if_init will copy lladdr into ic_myaddr */
    540 		error = ENETRESET;
    541 		break;
    542 #endif
    543 	case WI_RID_TX_RATE:
    544 		if (len != 2)
    545 			return EINVAL;
    546 		if (wreq.wi_val[0] == 0) {
    547 			/* auto */
    548 			ic->ic_fixed_rate = -1;
    549 			break;
    550 		}
    551 		rate = 2 * le16toh(wreq.wi_val[0]);
    552 		if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
    553 			/*
    554 			 * In autoselect mode search for the rate.  We take
    555 			 * the first instance which may not be right, but we
    556 			 * are limited by the interface.  Note that we also
    557 			 * lock the mode to insure the rate is meaningful
    558 			 * when it is used.
    559 			 */
    560 			for (j = IEEE80211_MODE_11A;
    561 			     j < IEEE80211_MODE_MAX; j++) {
    562 				if ((ic->ic_modecaps & (1<<j)) == 0)
    563 					continue;
    564 				i = findrate(ic, j, rate);
    565 				if (i != -1) {
    566 					/* lock mode too */
    567 					ic->ic_curmode = j;
    568 					goto setrate;
    569 				}
    570 			}
    571 		} else {
    572 			i = findrate(ic, ic->ic_curmode, rate);
    573 			if (i != -1)
    574 				goto setrate;
    575 		}
    576 		return EINVAL;
    577 	setrate:
    578 		ic->ic_fixed_rate = i;
    579 		error = ENETRESET;
    580 		break;
    581 	case WI_RID_CUR_TX_RATE:
    582 		return EPERM;
    583 	case WI_RID_FRAG_THRESH:
    584 		if (len != 2)
    585 			return EINVAL;
    586 		ic->ic_fragthreshold = le16toh(wreq.wi_val[0]);
    587 		error = ENETRESET;
    588 		break;
    589 	case WI_RID_RTS_THRESH:
    590 		if (len != 2)
    591 			return EINVAL;
    592 		ic->ic_rtsthreshold = le16toh(wreq.wi_val[0]);
    593 		error = ENETRESET;
    594 		break;
    595 	case WI_RID_CREATE_IBSS:
    596 		if (len != 2)
    597 			return EINVAL;
    598 		if (wreq.wi_val[0] != 0) {
    599 			if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
    600 				return EINVAL;
    601 			if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
    602 				ic->ic_flags |= IEEE80211_F_IBSSON;
    603 				if (ic->ic_opmode == IEEE80211_M_IBSS &&
    604 				    ic->ic_state == IEEE80211_S_SCAN)
    605 					error = ENETRESET;
    606 			}
    607 		} else {
    608 			if (ic->ic_flags & IEEE80211_F_IBSSON) {
    609 				ic->ic_flags &= ~IEEE80211_F_IBSSON;
    610 				if (ic->ic_flags & IEEE80211_F_SIBSS) {
    611 					ic->ic_flags &= ~IEEE80211_F_SIBSS;
    612 					error = ENETRESET;
    613 				}
    614 			}
    615 		}
    616 		break;
    617 	case WI_RID_MICROWAVE_OVEN:
    618 		if (len != 2)
    619 			return EINVAL;
    620 		if (wreq.wi_val[0] != 0)
    621 			return EINVAL;		/* not supported */
    622 		break;
    623 	case WI_RID_ROAMING_MODE:
    624 		if (len != 2)
    625 			return EINVAL;
    626 		if (le16toh(wreq.wi_val[0]) != 1)
    627 			return EINVAL;		/* not supported */
    628 		break;
    629 	case WI_RID_SYSTEM_SCALE:
    630 		if (len != 2)
    631 			return EINVAL;
    632 		if (le16toh(wreq.wi_val[0]) != 1)
    633 			return EINVAL;		/* not supported */
    634 		break;
    635 	case WI_RID_PM_ENABLED:
    636 		if (len != 2)
    637 			return EINVAL;
    638 		if (wreq.wi_val[0] != 0) {
    639 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
    640 				return EINVAL;
    641 			if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
    642 				ic->ic_flags |= IEEE80211_F_PMGTON;
    643 				error = ENETRESET;
    644 			}
    645 		} else {
    646 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
    647 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
    648 				error = ENETRESET;
    649 			}
    650 		}
    651 		break;
    652 	case WI_RID_MAX_SLEEP:
    653 		if (len != 2)
    654 			return EINVAL;
    655 		ic->ic_lintval = le16toh(wreq.wi_val[0]);
    656 		if (ic->ic_flags & IEEE80211_F_PMGTON)
    657 			error = ENETRESET;
    658 		break;
    659 	case WI_RID_CUR_BEACON_INT:
    660 		return EPERM;
    661 	case WI_RID_WEP_AVAIL:
    662 		return EPERM;
    663 	case WI_RID_CNFAUTHMODE:
    664 		if (len != 2)
    665 			return EINVAL;
    666 		if (le16toh(wreq.wi_val[0]) != 1)
    667 			return EINVAL;		/* TODO: shared key auth */
    668 		break;
    669 	case WI_RID_ENCRYPTION:
    670 		if (len != 2)
    671 			return EINVAL;
    672 		if (wreq.wi_val[0] != 0) {
    673 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
    674 				return EINVAL;
    675 			if ((ic->ic_flags & IEEE80211_F_WEPON) == 0) {
    676 				ic->ic_flags |= IEEE80211_F_WEPON;
    677 				error = ENETRESET;
    678 			}
    679 		} else {
    680 			if (ic->ic_flags & IEEE80211_F_WEPON) {
    681 				ic->ic_flags &= ~IEEE80211_F_WEPON;
    682 				error = ENETRESET;
    683 			}
    684 		}
    685 		break;
    686 	case WI_RID_TX_CRYPT_KEY:
    687 		if (len != 2)
    688 			return EINVAL;
    689 		i = le16toh(wreq.wi_val[0]);
    690 		if (i >= IEEE80211_WEP_NKID)
    691 			return EINVAL;
    692 		ic->ic_wep_txkey = i;
    693 		break;
    694 	case WI_RID_DEFLT_CRYPT_KEYS:
    695 		if (len != sizeof(struct wi_ltv_keys))
    696 			return EINVAL;
    697 		keys = (struct wi_ltv_keys *)&wreq;
    698 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    699 			len = le16toh(keys->wi_keys[i].wi_keylen);
    700 			if (len != 0 && len < IEEE80211_WEP_KEYLEN)
    701 				return EINVAL;
    702 			if (len > sizeof(ic->ic_nw_keys[i].wk_key))
    703 				return EINVAL;
    704 		}
    705 		memset(ic->ic_nw_keys, 0, sizeof(ic->ic_nw_keys));
    706 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    707 			len = le16toh(keys->wi_keys[i].wi_keylen);
    708 			ic->ic_nw_keys[i].wk_len = len;
    709 			memcpy(ic->ic_nw_keys[i].wk_key,
    710 			    keys->wi_keys[i].wi_keydat, len);
    711 		}
    712 		error = ENETRESET;
    713 		break;
    714 	case WI_RID_MAX_DATALEN:
    715 		if (len != 2)
    716 			return EINVAL;
    717 		len = le16toh(wreq.wi_val[0]);
    718 		if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
    719 			return EINVAL;
    720 		if (len != IEEE80211_MAX_LEN)
    721 			return EINVAL;		/* TODO: fragment */
    722 		ic->ic_fragthreshold = len;
    723 		error = ENETRESET;
    724 		break;
    725 	case WI_RID_IFACE_STATS:
    726 		error = EPERM;
    727 		break;
    728 	case WI_RID_SCAN_REQ:			/* XXX wicontrol */
    729 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
    730 			break;
    731 		error = ieee80211_setupscan(ic);
    732 		if (error == 0)
    733 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    734 		break;
    735 	case WI_RID_SCAN_APS:
    736 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
    737 			break;
    738 		len--;			/* XXX: tx rate? */
    739 		/* FALLTHRU */
    740 	case WI_RID_CHANNEL_LIST:
    741 		memset(chanlist, 0, sizeof(chanlist));
    742 		/*
    743 		 * Since channel 0 is not available for DS, channel 1
    744 		 * is assigned to LSB on WaveLAN.
    745 		 */
    746 		if (ic->ic_phytype == IEEE80211_T_DS)
    747 			i = 1;
    748 		else
    749 			i = 0;
    750 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
    751 			if ((j / 8) >= len)
    752 				break;
    753 			if (isclr((u_int8_t *)wreq.wi_val, j))
    754 				continue;
    755 			if (isclr(ic->ic_chan_active, i)) {
    756 				if (wreq.wi_type != WI_RID_CHANNEL_LIST)
    757 					continue;
    758 				if (isclr(ic->ic_chan_avail, i))
    759 					return EPERM;
    760 			}
    761 			setbit(chanlist, i);
    762 		}
    763 		memcpy(ic->ic_chan_active, chanlist,
    764 		    sizeof(ic->ic_chan_active));
    765 		error = ieee80211_setupscan(ic);
    766 		if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
    767 			/* NB: ignore error from ieee80211_setupscan */
    768 			error = ENETRESET;
    769 		} else if (error == 0)
    770 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    771 		break;
    772 	default:
    773 		error = EINVAL;
    774 		break;
    775 	}
    776 	return error;
    777 }
    778 
    779 #ifdef __FreeBSD__
    780 int
    781 ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
    782 {
    783 	struct ieee80211com *ic = (void *)ifp;
    784 	int error = 0;
    785 	u_int kid, len;
    786 	struct ieee80211req *ireq;
    787 	struct ifreq *ifr;
    788 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
    789 	char tmpssid[IEEE80211_NWID_LEN];
    790 	struct ieee80211_channel *chan;
    791 
    792 	switch (cmd) {
    793 	case SIOCSIFMEDIA:
    794 	case SIOCGIFMEDIA:
    795 		error = ifmedia_ioctl(ifp, (struct ifreq *) data,
    796 				&ic->ic_media, cmd);
    797 		break;
    798 	case SIOCG80211:
    799 		ireq = (struct ieee80211req *) data;
    800 		switch (ireq->i_type) {
    801 		case IEEE80211_IOC_SSID:
    802 			switch (ic->ic_state) {
    803 			case IEEE80211_S_INIT:
    804 			case IEEE80211_S_SCAN:
    805 				ireq->i_len = ic->ic_des_esslen;
    806 				memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
    807 				break;
    808 			default:
    809 				ireq->i_len = ic->ic_bss->ni_esslen;
    810 				memcpy(tmpssid, ic->ic_bss->ni_essid,
    811 					ireq->i_len);
    812 				break;
    813 			}
    814 			error = copyout(tmpssid, ireq->i_data, ireq->i_len);
    815 			break;
    816 		case IEEE80211_IOC_NUMSSIDS:
    817 			ireq->i_val = 1;
    818 			break;
    819 		case IEEE80211_IOC_WEP:
    820 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0) {
    821 				ireq->i_val = IEEE80211_WEP_NOSUP;
    822 			} else {
    823 				if (ic->ic_flags & IEEE80211_F_WEPON) {
    824 					ireq->i_val =
    825 					    IEEE80211_WEP_MIXED;
    826 				} else {
    827 					ireq->i_val =
    828 					    IEEE80211_WEP_OFF;
    829 				}
    830 			}
    831 			break;
    832 		case IEEE80211_IOC_WEPKEY:
    833 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0) {
    834 				error = EINVAL;
    835 				break;
    836 			}
    837 			kid = (u_int) ireq->i_val;
    838 			if (kid >= IEEE80211_WEP_NKID) {
    839 				error = EINVAL;
    840 				break;
    841 			}
    842 			len = (u_int) ic->ic_nw_keys[kid].wk_len;
    843 			/* NB: only root can read WEP keys */
    844 			if (suser(curthread) == 0) {
    845 				bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
    846 			} else {
    847 				bzero(tmpkey, len);
    848 			}
    849 			ireq->i_len = len;
    850 			error = copyout(tmpkey, ireq->i_data, len);
    851 			break;
    852 		case IEEE80211_IOC_NUMWEPKEYS:
    853 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
    854 				error = EINVAL;
    855 			else
    856 				ireq->i_val = IEEE80211_WEP_NKID;
    857 			break;
    858 		case IEEE80211_IOC_WEPTXKEY:
    859 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
    860 				error = EINVAL;
    861 			else
    862 				ireq->i_val = ic->ic_wep_txkey;
    863 			break;
    864 		case IEEE80211_IOC_AUTHMODE:
    865 			ireq->i_val = IEEE80211_AUTH_OPEN;
    866 			break;
    867 		case IEEE80211_IOC_CHANNEL:
    868 			switch (ic->ic_state) {
    869 			case IEEE80211_S_INIT:
    870 			case IEEE80211_S_SCAN:
    871 				if (ic->ic_opmode == IEEE80211_M_STA)
    872 					chan = ic->ic_des_chan;
    873 				else
    874 					chan = ic->ic_ibss_chan;
    875 				break;
    876 			default:
    877 				chan = ic->ic_bss->ni_chan;
    878 				break;
    879 			}
    880 			ireq->i_val = ieee80211_chan2ieee(ic, chan);
    881 			break;
    882 		case IEEE80211_IOC_POWERSAVE:
    883 			if (ic->ic_flags & IEEE80211_F_PMGTON)
    884 				ireq->i_val = IEEE80211_POWERSAVE_ON;
    885 			else
    886 				ireq->i_val = IEEE80211_POWERSAVE_OFF;
    887 			break;
    888 		case IEEE80211_IOC_POWERSAVESLEEP:
    889 			ireq->i_val = ic->ic_lintval;
    890 			break;
    891 		case IEEE80211_IOC_RTSTHRESHOLD:
    892 			ireq->i_val = ic->ic_rtsthreshold;
    893 			break;
    894 		default:
    895 			error = EINVAL;
    896 		}
    897 		break;
    898 	case SIOCS80211:
    899 		error = suser(curproc->p_ucred, &curproc->p_acflag);
    900 		if (error)
    901 			break;
    902 		ireq = (struct ieee80211req *) data;
    903 		switch (ireq->i_type) {
    904 		case IEEE80211_IOC_SSID:
    905 			if (ireq->i_val != 0 ||
    906 			    ireq->i_len > IEEE80211_NWID_LEN) {
    907 				error = EINVAL;
    908 				break;
    909 			}
    910 			error = copyin(ireq->i_data, tmpssid, ireq->i_len);
    911 			if (error)
    912 				break;
    913 			memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
    914 			ic->ic_des_esslen = ireq->i_len;
    915 			memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
    916 			error = ENETRESET;
    917 			break;
    918 		case IEEE80211_IOC_WEP:
    919 			/*
    920 			 * These cards only support one mode so
    921 			 * we just turn wep on if what ever is
    922 			 * passed in is not OFF.
    923 			 */
    924 			if (ireq->i_val == IEEE80211_WEP_OFF) {
    925 				ic->ic_flags &= ~IEEE80211_F_WEPON;
    926 			} else {
    927 				ic->ic_flags |= IEEE80211_F_WEPON;
    928 			}
    929 			error = ENETRESET;
    930 			break;
    931 		case IEEE80211_IOC_WEPKEY:
    932 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0) {
    933 				error = EINVAL;
    934 				break;
    935 			}
    936 			kid = (u_int) ireq->i_val;
    937 			if (kid >= IEEE80211_WEP_NKID) {
    938 				error = EINVAL;
    939 				break;
    940 			}
    941 			if (ireq->i_len > sizeof(tmpkey)) {
    942 				error = EINVAL;
    943 				break;
    944 			}
    945 			memset(tmpkey, 0, sizeof(tmpkey));
    946 			error = copyin(ireq->i_data, tmpkey, ireq->i_len);
    947 			if (error)
    948 				break;
    949 			memcpy(ic->ic_nw_keys[kid].wk_key, tmpkey,
    950 				sizeof(tmpkey));
    951 			ic->ic_nw_keys[kid].wk_len = ireq->i_len;
    952 			error = ENETRESET;
    953 			break;
    954 		case IEEE80211_IOC_WEPTXKEY:
    955 			kid = (u_int) ireq->i_val;
    956 			if (kid >= IEEE80211_WEP_NKID) {
    957 				error = EINVAL;
    958 				break;
    959 			}
    960 			ic->ic_wep_txkey = kid;
    961 			error = ENETRESET;
    962 			break;
    963 #if 0
    964 		case IEEE80211_IOC_AUTHMODE:
    965 			sc->wi_authmode = ireq->i_val;
    966 			break;
    967 #endif
    968 		case IEEE80211_IOC_CHANNEL:
    969 			/* XXX 0xffff overflows 16-bit signed */
    970 			if (ireq->i_val == 0 ||
    971 			    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
    972 				ic->ic_des_chan = IEEE80211_CHAN_ANYC;
    973 			else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
    974 			    isclr(ic->ic_chan_active, ireq->i_val)) {
    975 				error = EINVAL;
    976 				break;
    977 			} else
    978 				ic->ic_ibss_chan = ic->ic_des_chan =
    979 					&ic->ic_channels[ireq->i_val];
    980 			switch (ic->ic_state) {
    981 			case IEEE80211_S_INIT:
    982 			case IEEE80211_S_SCAN:
    983 				error = ENETRESET;
    984 				break;
    985 			default:
    986 				if (ic->ic_opmode == IEEE80211_M_STA) {
    987 					if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
    988 					    ic->ic_bss->ni_chan != ic->ic_des_chan)
    989 						error = ENETRESET;
    990 				} else {
    991 					if (ic->ic_bss->ni_chan != ic->ic_ibss_chan)
    992 						error = ENETRESET;
    993 				}
    994 				break;
    995 			}
    996 			break;
    997 		case IEEE80211_IOC_POWERSAVE:
    998 			switch (ireq->i_val) {
    999 			case IEEE80211_POWERSAVE_OFF:
   1000 				if (ic->ic_flags & IEEE80211_F_PMGTON) {
   1001 					ic->ic_flags &= ~IEEE80211_F_PMGTON;
   1002 					error = ENETRESET;
   1003 				}
   1004 				break;
   1005 			case IEEE80211_POWERSAVE_ON:
   1006 				if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
   1007 					error = EINVAL;
   1008 				else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
   1009 					ic->ic_flags |= IEEE80211_F_PMGTON;
   1010 					error = ENETRESET;
   1011 				}
   1012 				break;
   1013 			default:
   1014 				error = EINVAL;
   1015 				break;
   1016 			}
   1017 			break;
   1018 		case IEEE80211_IOC_POWERSAVESLEEP:
   1019 			if (ireq->i_val < 0) {
   1020 				error = EINVAL;
   1021 				break;
   1022 			}
   1023 			ic->ic_lintval = ireq->i_val;
   1024 			error = ENETRESET;
   1025 			break;
   1026 		case IEEE80211_IOC_RTSTHRESHOLD:
   1027 			if (!(IEEE80211_RTS_MIN < ireq->i_val &&
   1028 			      ireq->i_val <= IEEE80211_RTS_MAX + 1)) {
   1029 				error = EINVAL;
   1030 				break;
   1031 			}
   1032 			ic->ic_rtsthreshold = ireq->i_val;
   1033 			error = ENETRESET;
   1034 			break;
   1035 		default:
   1036 			error = EINVAL;
   1037 			break;
   1038 		}
   1039 		break;
   1040 	case SIOCGIFGENERIC:
   1041 		error = ieee80211_cfgget(ifp, cmd, data);
   1042 		break;
   1043 	case SIOCSIFGENERIC:
   1044 		error = suser(curproc->p_ucred, &curproc->p_acflag);
   1045 		if (error)
   1046 			break;
   1047 		error = ieee80211_cfgset(ifp, cmd, data);
   1048 		break;
   1049 	default:
   1050 		error = ether_ioctl(ifp, cmd, data);
   1051 		break;
   1052 	}
   1053 	return error;
   1054 }
   1055 #endif /* __FreeBSD__ */
   1056 
   1057 #ifdef __NetBSD__
   1058 int
   1059 ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
   1060 {
   1061 	struct ieee80211com *ic = (void *)ifp;
   1062 	struct ifreq *ifr = (struct ifreq *)data;
   1063 	int i, error = 0;
   1064 	struct ieee80211_nwid nwid;
   1065 	struct ieee80211_nwkey *nwkey;
   1066 	struct ieee80211_power *power;
   1067 	struct ieee80211_bssid *bssid;
   1068 	struct ieee80211chanreq *chanreq;
   1069 	struct ieee80211_channel *chan;
   1070 	struct ieee80211_wepkey keys[IEEE80211_WEP_NKID];
   1071 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
   1072 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
   1073 	};
   1074 
   1075 	switch (cmd) {
   1076 	case SIOCSIFMEDIA:
   1077 	case SIOCGIFMEDIA:
   1078 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
   1079 		break;
   1080 	case SIOCS80211NWID:
   1081 		if ((error = copyin(ifr->ifr_data, &nwid, sizeof(nwid))) != 0)
   1082 			break;
   1083 		if (nwid.i_len > IEEE80211_NWID_LEN) {
   1084 			error = EINVAL;
   1085 			break;
   1086 		}
   1087 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
   1088 		ic->ic_des_esslen = nwid.i_len;
   1089 		memcpy(ic->ic_des_essid, nwid.i_nwid, nwid.i_len);
   1090 		error = ENETRESET;
   1091 		break;
   1092 	case SIOCG80211NWID:
   1093 		memset(&nwid, 0, sizeof(nwid));
   1094 		switch (ic->ic_state) {
   1095 		case IEEE80211_S_INIT:
   1096 		case IEEE80211_S_SCAN:
   1097 			nwid.i_len = ic->ic_des_esslen;
   1098 			memcpy(nwid.i_nwid, ic->ic_des_essid, nwid.i_len);
   1099 			break;
   1100 		default:
   1101 			nwid.i_len = ic->ic_bss->ni_esslen;
   1102 			memcpy(nwid.i_nwid, ic->ic_bss->ni_essid, nwid.i_len);
   1103 			break;
   1104 		}
   1105 		error = copyout(&nwid, ifr->ifr_data, sizeof(nwid));
   1106 		break;
   1107 	case SIOCS80211NWKEY:
   1108 		nwkey = (struct ieee80211_nwkey *)data;
   1109 		if ((ic->ic_caps & IEEE80211_C_WEP) == 0 &&
   1110 		    nwkey->i_wepon != IEEE80211_NWKEY_OPEN) {
   1111 			error = EINVAL;
   1112 			break;
   1113 		}
   1114 		/* check and copy keys */
   1115 		memset(keys, 0, sizeof(keys));
   1116 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1117 			keys[i].wk_len = nwkey->i_key[i].i_keylen;
   1118 			if ((keys[i].wk_len > 0 &&
   1119 			    keys[i].wk_len < IEEE80211_WEP_KEYLEN) ||
   1120 			    keys[i].wk_len > sizeof(keys[i].wk_key)) {
   1121 				error = EINVAL;
   1122 				break;
   1123 			}
   1124 			if (keys[i].wk_len <= 0)
   1125 				continue;
   1126 			if ((error = copyin(nwkey->i_key[i].i_keydat,
   1127 			    keys[i].wk_key, keys[i].wk_len)) != 0)
   1128 				break;
   1129 		}
   1130 		if (error)
   1131 			break;
   1132 		i = nwkey->i_defkid - 1;
   1133 		if (i < 0 || i >= IEEE80211_WEP_NKID ||
   1134 		    keys[i].wk_len == 0 ||
   1135 		    (keys[i].wk_len == -1 && ic->ic_nw_keys[i].wk_len == 0)) {
   1136 			if (nwkey->i_wepon != IEEE80211_NWKEY_OPEN) {
   1137 				error = EINVAL;
   1138 				break;
   1139 			}
   1140 		} else
   1141 			ic->ic_wep_txkey = i;
   1142 		/* save the key */
   1143 		if (nwkey->i_wepon == IEEE80211_NWKEY_OPEN)
   1144 			ic->ic_flags &= ~IEEE80211_F_WEPON;
   1145 		else
   1146 			ic->ic_flags |= IEEE80211_F_WEPON;
   1147 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1148 			if (keys[i].wk_len < 0)
   1149 				continue;
   1150 			ic->ic_nw_keys[i].wk_len = keys[i].wk_len;
   1151 			memcpy(ic->ic_nw_keys[i].wk_key, keys[i].wk_key,
   1152 			    sizeof(keys[i].wk_key));
   1153 		}
   1154 		error = ENETRESET;
   1155 		break;
   1156 	case SIOCG80211NWKEY:
   1157 		nwkey = (struct ieee80211_nwkey *)data;
   1158 		if (ic->ic_flags & IEEE80211_F_WEPON)
   1159 			nwkey->i_wepon = IEEE80211_NWKEY_WEP;
   1160 		else
   1161 			nwkey->i_wepon = IEEE80211_NWKEY_OPEN;
   1162 		nwkey->i_defkid = ic->ic_wep_txkey + 1;
   1163 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1164 			if (nwkey->i_key[i].i_keydat == NULL)
   1165 				continue;
   1166 			/* do not show any keys to non-root user */
   1167 			if ((error = suser(curproc->p_ucred,
   1168 			    &curproc->p_acflag)) != 0)
   1169 				break;
   1170 			nwkey->i_key[i].i_keylen = ic->ic_nw_keys[i].wk_len;
   1171 			if ((error = copyout(ic->ic_nw_keys[i].wk_key,
   1172 			    nwkey->i_key[i].i_keydat,
   1173 			    ic->ic_nw_keys[i].wk_len)) != 0)
   1174 				break;
   1175 		}
   1176 		break;
   1177 	case SIOCS80211POWER:
   1178 		power = (struct ieee80211_power *)data;
   1179 		ic->ic_lintval = power->i_maxsleep;
   1180 		if (power->i_enabled != 0) {
   1181 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
   1182 				error = EINVAL;
   1183 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
   1184 				ic->ic_flags |= IEEE80211_F_PMGTON;
   1185 				error = ENETRESET;
   1186 			}
   1187 		} else {
   1188 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
   1189 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
   1190 				error = ENETRESET;
   1191 			}
   1192 		}
   1193 		break;
   1194 	case SIOCG80211POWER:
   1195 		power = (struct ieee80211_power *)data;
   1196 		power->i_enabled = (ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0;
   1197 		power->i_maxsleep = ic->ic_lintval;
   1198 		break;
   1199 	case SIOCS80211BSSID:
   1200 		bssid = (struct ieee80211_bssid *)data;
   1201 		if (IEEE80211_ADDR_EQ(bssid->i_bssid, empty_macaddr))
   1202 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
   1203 		else {
   1204 			ic->ic_flags |= IEEE80211_F_DESBSSID;
   1205 			IEEE80211_ADDR_COPY(ic->ic_des_bssid, bssid->i_bssid);
   1206 		}
   1207 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
   1208 			break;
   1209 		switch (ic->ic_state) {
   1210 		case IEEE80211_S_INIT:
   1211 		case IEEE80211_S_SCAN:
   1212 			error = ENETRESET;
   1213 			break;
   1214 		default:
   1215 			if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
   1216 			    !IEEE80211_ADDR_EQ(ic->ic_des_bssid,
   1217 			    ic->ic_bss->ni_bssid))
   1218 				error = ENETRESET;
   1219 			break;
   1220 		}
   1221 		break;
   1222 	case SIOCG80211BSSID:
   1223 		bssid = (struct ieee80211_bssid *)data;
   1224 		switch (ic->ic_state) {
   1225 		case IEEE80211_S_INIT:
   1226 		case IEEE80211_S_SCAN:
   1227 			if (ic->ic_opmode == IEEE80211_M_HOSTAP)
   1228 				IEEE80211_ADDR_COPY(bssid->i_bssid,
   1229 				    ic->ic_myaddr);
   1230 			else if (ic->ic_flags & IEEE80211_F_DESBSSID)
   1231 				IEEE80211_ADDR_COPY(bssid->i_bssid,
   1232 				    ic->ic_des_bssid);
   1233 			else
   1234 				memset(bssid->i_bssid, 0, IEEE80211_ADDR_LEN);
   1235 			break;
   1236 		default:
   1237 			IEEE80211_ADDR_COPY(bssid->i_bssid,
   1238 			    ic->ic_bss->ni_bssid);
   1239 			break;
   1240 		}
   1241 		break;
   1242 	case SIOCS80211CHANNEL:
   1243 		chanreq = (struct ieee80211chanreq *)data;
   1244 		if (chanreq->i_channel == IEEE80211_CHAN_ANY)
   1245 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
   1246 		else if (chanreq->i_channel > IEEE80211_CHAN_MAX ||
   1247 		    isclr(ic->ic_chan_active, chanreq->i_channel)) {
   1248 			error = EINVAL;
   1249 			break;
   1250 		} else
   1251 			ic->ic_ibss_chan = ic->ic_des_chan =
   1252 			    &ic->ic_channels[chanreq->i_channel];
   1253 		switch (ic->ic_state) {
   1254 		case IEEE80211_S_INIT:
   1255 		case IEEE80211_S_SCAN:
   1256 			error = ENETRESET;
   1257 			break;
   1258 		default:
   1259 			if (ic->ic_opmode == IEEE80211_M_STA) {
   1260 				if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
   1261 				    ic->ic_bss->ni_chan != ic->ic_des_chan)
   1262 					error = ENETRESET;
   1263 			} else {
   1264 				if (ic->ic_bss->ni_chan != ic->ic_ibss_chan)
   1265 					error = ENETRESET;
   1266 			}
   1267 			break;
   1268 		}
   1269 		break;
   1270 	case SIOCG80211CHANNEL:
   1271 		chanreq = (struct ieee80211chanreq *)data;
   1272 		switch (ic->ic_state) {
   1273 		case IEEE80211_S_INIT:
   1274 		case IEEE80211_S_SCAN:
   1275 			if (ic->ic_opmode == IEEE80211_M_STA)
   1276 				chan = ic->ic_des_chan;
   1277 			else
   1278 				chan = ic->ic_ibss_chan;
   1279 			break;
   1280 		default:
   1281 			chan = ic->ic_bss->ni_chan;
   1282 			break;
   1283 		}
   1284 		chanreq->i_channel = ieee80211_chan2ieee(ic, chan);
   1285 		break;
   1286 	case SIOCGIFGENERIC:
   1287 		error = ieee80211_cfgget(ifp, cmd, data);
   1288 		break;
   1289 	case SIOCSIFGENERIC:
   1290 		error = suser(curproc->p_ucred, &curproc->p_acflag);
   1291 		if (error)
   1292 			break;
   1293 		error = ieee80211_cfgset(ifp, cmd, data);
   1294 		break;
   1295 	case SIOCG80211STATS:
   1296 		ifr = (struct ifreq *)data;
   1297 		copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
   1298 		break;
   1299 	default:
   1300 		error = ether_ioctl(ifp, cmd, data);
   1301 		break;
   1302 	}
   1303 	return error;
   1304 }
   1305 #endif /* __NetBSD__ */
   1306