Home | History | Annotate | Line # | Download | only in net80211
ieee80211_ioctl.c revision 1.8
      1 /*	$NetBSD: ieee80211_ioctl.c,v 1.8 2004/01/16 14:07:32 onoe Exp $	*/
      2 /*-
      3  * Copyright (c) 2001 Atsushi Onoe
      4  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. The name of the author may not be used to endorse or promote products
     16  *    derived from this software without specific prior written permission.
     17  *
     18  * Alternatively, this software may be distributed under the terms of the
     19  * GNU General Public License ("GPL") version 2 as published by the Free
     20  * Software Foundation.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #include <sys/cdefs.h>
     35 #ifdef __FreeBSD__
     36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_ioctl.c,v 1.9 2003/11/13 05:23:58 sam Exp $");
     37 #else
     38 __KERNEL_RCSID(0, "$NetBSD: ieee80211_ioctl.c,v 1.8 2004/01/16 14:07:32 onoe Exp $");
     39 #endif
     40 
     41 /*
     42  * IEEE 802.11 ioctl support (FreeBSD-specific)
     43  */
     44 
     45 #include <sys/endian.h>
     46 #include <sys/param.h>
     47 #include <sys/kernel.h>
     48 #include <sys/socket.h>
     49 #include <sys/sockio.h>
     50 #include <sys/systm.h>
     51 #include <sys/proc.h>
     52 
     53 #include <net/if.h>
     54 #include <net/if_arp.h>
     55 #include <net/if_media.h>
     56 #ifdef __FreeBSD__
     57 #include <net/ethernet.h>
     58 #else
     59 #include <net/if_ether.h>
     60 #endif
     61 
     62 #include <net80211/ieee80211_var.h>
     63 #include <net80211/ieee80211_ioctl.h>
     64 
     65 #ifdef __FreeBSD__
     66 #include <dev/wi/if_wavelan_ieee.h>
     67 #else
     68 #include <dev/ic/wi_ieee.h>
     69 #endif
     70 
     71 /*
     72  * XXX
     73  * Wireless LAN specific configuration interface, which is compatible
     74  * with wicontrol(8).
     75  */
     76 
     77 int
     78 ieee80211_cfgget(struct ifnet *ifp, u_long cmd, caddr_t data)
     79 {
     80 	struct ieee80211com *ic = (void *)ifp;
     81 	int i, j, error;
     82 	struct ifreq *ifr = (struct ifreq *)data;
     83 	struct wi_req wreq;
     84 	struct wi_ltv_keys *keys;
     85 	struct wi_apinfo *ap;
     86 	struct ieee80211_node *ni;
     87 	struct ieee80211_rateset *rs;
     88 #ifdef WICACHE
     89 	struct wi_sigcache wsc;
     90 #endif /* WICACHE */
     91 #if 0 /* TBD */
     92 	struct wi_scan_p2_hdr *p2;
     93 	struct wi_scan_res *res;
     94 #endif
     95 
     96 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
     97 	if (error)
     98 		return error;
     99 	wreq.wi_len = 0;
    100 	switch (wreq.wi_type) {
    101 	case WI_RID_SERIALNO:
    102 	case WI_RID_STA_IDENTITY:
    103 		/* nothing appropriate */
    104 		break;
    105 	case WI_RID_NODENAME:
    106 		strcpy((char *)&wreq.wi_val[1], hostname);
    107 		wreq.wi_val[0] = htole16(strlen(hostname));
    108 		wreq.wi_len = (1 + strlen(hostname) + 1) / 2;
    109 		break;
    110 	case WI_RID_CURRENT_SSID:
    111 		if (ic->ic_state != IEEE80211_S_RUN) {
    112 			wreq.wi_val[0] = 0;
    113 			wreq.wi_len = 1;
    114 			break;
    115 		}
    116 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_esslen);
    117 		memcpy(&wreq.wi_val[1], ic->ic_bss->ni_essid,
    118 		    ic->ic_bss->ni_esslen);
    119 		wreq.wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
    120 		break;
    121 	case WI_RID_OWN_SSID:
    122 	case WI_RID_DESIRED_SSID:
    123 		wreq.wi_val[0] = htole16(ic->ic_des_esslen);
    124 		memcpy(&wreq.wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
    125 		wreq.wi_len = (1 + ic->ic_des_esslen + 1) / 2;
    126 		break;
    127 	case WI_RID_CURRENT_BSSID:
    128 		if (ic->ic_state == IEEE80211_S_RUN)
    129 			IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_bss->ni_bssid);
    130 		else
    131 			memset(wreq.wi_val, 0, IEEE80211_ADDR_LEN);
    132 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
    133 		break;
    134 	case WI_RID_CHANNEL_LIST:
    135 		memset(wreq.wi_val, 0, sizeof(wreq.wi_val));
    136 		/*
    137 		 * Since channel 0 is not available for DS, channel 1
    138 		 * is assigned to LSB on WaveLAN.
    139 		 */
    140 		if (ic->ic_phytype == IEEE80211_T_DS)
    141 			i = 1;
    142 		else
    143 			i = 0;
    144 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
    145 			if (isset(ic->ic_chan_active, i)) {
    146 				setbit((u_int8_t *)wreq.wi_val, j);
    147 				wreq.wi_len = j / 16 + 1;
    148 			}
    149 		break;
    150 	case WI_RID_OWN_CHNL:
    151 		wreq.wi_val[0] = htole16(
    152 			ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
    153 		wreq.wi_len = 1;
    154 		break;
    155 	case WI_RID_CURRENT_CHAN:
    156 		wreq.wi_val[0] = htole16(
    157 			ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan));
    158 		wreq.wi_len = 1;
    159 		break;
    160 	case WI_RID_COMMS_QUALITY:
    161 		wreq.wi_val[0] = 0;				/* quality */
    162 		wreq.wi_val[1] =
    163 			htole16((*ic->ic_node_getrssi)(ic, ic->ic_bss));
    164 		wreq.wi_val[2] = 0;				/* noise */
    165 		wreq.wi_len = 3;
    166 		break;
    167 	case WI_RID_PROMISC:
    168 		wreq.wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
    169 		wreq.wi_len = 1;
    170 		break;
    171 	case WI_RID_PORTTYPE:
    172 		wreq.wi_val[0] = htole16(ic->ic_opmode);
    173 		wreq.wi_len = 1;
    174 		break;
    175 	case WI_RID_MAC_NODE:
    176 		IEEE80211_ADDR_COPY(wreq.wi_val, ic->ic_myaddr);
    177 		wreq.wi_len = IEEE80211_ADDR_LEN / 2;
    178 		break;
    179 	case WI_RID_TX_RATE:
    180 		if (ic->ic_fixed_rate == -1)
    181 			wreq.wi_val[0] = 0;	/* auto */
    182 		else
    183 			wreq.wi_val[0] = htole16(
    184 			    (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
    185 			    IEEE80211_RATE_VAL) / 2);
    186 		wreq.wi_len = 1;
    187 		break;
    188 	case WI_RID_CUR_TX_RATE:
    189 		wreq.wi_val[0] = htole16(
    190 		    (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
    191 		    IEEE80211_RATE_VAL) / 2);
    192 		wreq.wi_len = 1;
    193 		break;
    194 	case WI_RID_FRAG_THRESH:
    195 		wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
    196 		wreq.wi_len = 1;
    197 		break;
    198 	case WI_RID_RTS_THRESH:
    199 		wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
    200 		wreq.wi_len = 1;
    201 		break;
    202 	case WI_RID_CREATE_IBSS:
    203 		wreq.wi_val[0] =
    204 		    htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
    205 		wreq.wi_len = 1;
    206 		break;
    207 	case WI_RID_MICROWAVE_OVEN:
    208 		wreq.wi_val[0] = 0;	/* no ... not supported */
    209 		wreq.wi_len = 1;
    210 		break;
    211 	case WI_RID_ROAMING_MODE:
    212 		wreq.wi_val[0] = htole16(1);	/* enabled ... not supported */
    213 		wreq.wi_len = 1;
    214 		break;
    215 	case WI_RID_SYSTEM_SCALE:
    216 		wreq.wi_val[0] = htole16(1);	/* low density ... not supp */
    217 		wreq.wi_len = 1;
    218 		break;
    219 	case WI_RID_PM_ENABLED:
    220 		wreq.wi_val[0] =
    221 		    htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
    222 		wreq.wi_len = 1;
    223 		break;
    224 	case WI_RID_MAX_SLEEP:
    225 		wreq.wi_val[0] = htole16(ic->ic_lintval);
    226 		wreq.wi_len = 1;
    227 		break;
    228 	case WI_RID_CUR_BEACON_INT:
    229 		wreq.wi_val[0] = htole16(ic->ic_bss->ni_intval);
    230 		wreq.wi_len = 1;
    231 		break;
    232 	case WI_RID_WEP_AVAIL:
    233 		wreq.wi_val[0] =
    234 		    htole16((ic->ic_caps & IEEE80211_C_WEP) ? 1 : 0);
    235 		wreq.wi_len = 1;
    236 		break;
    237 	case WI_RID_CNFAUTHMODE:
    238 		wreq.wi_val[0] = htole16(1);	/* TODO: open system only */
    239 		wreq.wi_len = 1;
    240 		break;
    241 	case WI_RID_ENCRYPTION:
    242 		wreq.wi_val[0] =
    243 		    htole16((ic->ic_flags & IEEE80211_F_WEPON) ? 1 : 0);
    244 		wreq.wi_len = 1;
    245 		break;
    246 	case WI_RID_TX_CRYPT_KEY:
    247 		wreq.wi_val[0] = htole16(ic->ic_wep_txkey);
    248 		wreq.wi_len = 1;
    249 		break;
    250 	case WI_RID_DEFLT_CRYPT_KEYS:
    251 		keys = (struct wi_ltv_keys *)&wreq;
    252 		/* do not show keys to non-root user */
    253 		error = suser(curproc->p_ucred, &curproc->p_acflag);
    254 		if (error) {
    255 			memset(keys, 0, sizeof(*keys));
    256 			error = 0;
    257 			break;
    258 		}
    259 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    260 			keys->wi_keys[i].wi_keylen =
    261 			    htole16(ic->ic_nw_keys[i].wk_len);
    262 			memcpy(keys->wi_keys[i].wi_keydat,
    263 			    ic->ic_nw_keys[i].wk_key, ic->ic_nw_keys[i].wk_len);
    264 		}
    265 		wreq.wi_len = sizeof(*keys) / 2;
    266 		break;
    267 	case WI_RID_MAX_DATALEN:
    268 		wreq.wi_val[0] = htole16(IEEE80211_MAX_LEN);	/* TODO: frag */
    269 		wreq.wi_len = 1;
    270 		break;
    271 	case WI_RID_DBM_ADJUST:
    272 		/* not supported, we just pass rssi value from driver. */
    273 		break;
    274 	case WI_RID_IFACE_STATS:
    275 		/* XXX: should be implemented in lower drivers */
    276 		break;
    277 	case WI_RID_READ_APS:
    278 		if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
    279 			/*
    280 			 * Don't return results until active scan completes.
    281 			 */
    282 			if (ic->ic_state == IEEE80211_S_SCAN &&
    283 			    (ic->ic_flags & IEEE80211_F_ASCAN)) {
    284 				error = EINPROGRESS;
    285 				break;
    286 			}
    287 		}
    288 		i = 0;
    289 		ap = (void *)((char *)wreq.wi_val + sizeof(i));
    290 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
    291 			if ((caddr_t)(ap + 1) > (caddr_t)(&wreq + 1))
    292 				break;
    293 			memset(ap, 0, sizeof(*ap));
    294 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
    295 				IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
    296 				ap->namelen = ic->ic_des_esslen;
    297 				if (ic->ic_des_esslen)
    298 					memcpy(ap->name, ic->ic_des_essid,
    299 					    ic->ic_des_esslen);
    300 			} else {
    301 				IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
    302 				ap->namelen = ni->ni_esslen;
    303 				if (ni->ni_esslen)
    304 					memcpy(ap->name, ni->ni_essid,
    305 					    ni->ni_esslen);
    306 			}
    307 			ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
    308 			ap->signal = (*ic->ic_node_getrssi)(ic, ni);
    309 			ap->capinfo = ni->ni_capinfo;
    310 			ap->interval = ni->ni_intval;
    311 			rs = &ni->ni_rates;
    312 			for (j = 0; j < rs->rs_nrates; j++) {
    313 				if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
    314 					ap->rate = (rs->rs_rates[j] &
    315 					    IEEE80211_RATE_VAL) * 5; /* XXX */
    316 				}
    317 			}
    318 			i++;
    319 			ap++;
    320 		}
    321 		memcpy(wreq.wi_val, &i, sizeof(i));
    322 		wreq.wi_len = (sizeof(int) + sizeof(*ap) * i) / 2;
    323 		break;
    324 #if 0
    325 	case WI_RID_PRISM2:
    326 		wreq.wi_val[0] = 1;	/* XXX lie so SCAN_RES can give rates */
    327 		wreq.wi_len = sizeof(u_int16_t) / 2;
    328 		break;
    329 	case WI_RID_SCAN_RES:			/* compatibility interface */
    330 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
    331 		    ic->ic_state == IEEE80211_S_SCAN) {
    332 			error = EINPROGRESS;
    333 			break;
    334 		}
    335 		/* NB: we use the Prism2 format so we can return rate info */
    336 		p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
    337 		res = (void *)&p2[1];
    338 		i = 0;
    339 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
    340 			if ((caddr_t)(res + 1) > (caddr_t)(&wreq + 1))
    341 				break;
    342 			res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
    343 			res->wi_noise = 0;
    344 			res->wi_signal = (*ic->ic_node_getrssi)(ic, ni);
    345 			IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
    346 			res->wi_interval = ni->ni_intval;
    347 			res->wi_capinfo = ni->ni_capinfo;
    348 			res->wi_ssid_len = ni->ni_esslen;
    349 			memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
    350 			/* NB: assumes wi_srates holds <= ni->ni_rates */
    351 			memcpy(res->wi_srates, ni->ni_rates.rs_rates,
    352 				sizeof(res->wi_srates));
    353 			if (ni->ni_rates.rs_nrates < 10)
    354 				res->wi_srates[ni->ni_rates.rs_nrates] = 0;
    355 			res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
    356 			res->wi_rsvd = 0;
    357 			res++, i++;
    358 		}
    359 		p2->wi_rsvd = 0;
    360 		p2->wi_reason = i;
    361 		wreq.wi_len = (sizeof(*p2) + sizeof(*res) * i) / 2;
    362 		break;
    363 #endif /* 0 */
    364 #ifdef WICACHE
    365 	case WI_RID_READ_CACHE:
    366 		i = 0;
    367 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
    368 			if (i == (WI_MAX_DATALEN/sizeof(struct wi_sigcache))-1)
    369 				break;
    370 			IEEE80211_ADDR_COPY(wsc.macsrc, ni->ni_macaddr);
    371 			memset(&wsc.ipsrc, 0, sizeof(wsc.ipsrc));
    372 			wsc.signal = (*ic->ic_node_getrssi)(ic, ni);
    373 			wsc.noise = 0;
    374 			wsc.quality = 0;
    375 			memcpy((caddr_t)wreq.wi_val + sizeof(wsc) * i,
    376 			    &wsc, sizeof(wsc));
    377 			i++;
    378 		}
    379 		wreq.wi_len = sizeof(wsc) * i / 2;
    380 		break;
    381 #endif /* WICACHE */
    382 	case WI_RID_SCAN_APS:
    383 		error = EINVAL;
    384 		break;
    385 	default:
    386 		error = EINVAL;
    387 		break;
    388 	}
    389 	if (error == 0) {
    390 		wreq.wi_len++;
    391 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
    392 	}
    393 	return error;
    394 }
    395 
    396 static int
    397 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
    398 {
    399 #define	IEEERATE(_ic,_m,_i) \
    400 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
    401 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
    402 	for (i = 0; i < nrates; i++)
    403 		if (IEEERATE(ic, mode, i) == rate)
    404 			return i;
    405 	return -1;
    406 #undef IEEERATE
    407 }
    408 
    409 /*
    410  * Prepare to do a user-initiated scan for AP's.  If no
    411  * current/default channel is setup or the current channel
    412  * is invalid then pick the first available channel from
    413  * the active list as the place to start the scan.
    414  */
    415 static int
    416 ieee80211_setupscan(struct ieee80211com *ic)
    417 {
    418 	u_char *chanlist = ic->ic_chan_active;
    419 	int i;
    420 
    421 	if (ic->ic_ibss_chan == NULL ||
    422 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
    423 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
    424 			if (isset(chanlist, i)) {
    425 				ic->ic_ibss_chan = &ic->ic_channels[i];
    426 				goto found;
    427 			}
    428 		return EINVAL;			/* no active channels */
    429 found:
    430 		;
    431 	}
    432 	if (ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC ||
    433 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan)))
    434 		ic->ic_bss->ni_chan = ic->ic_ibss_chan;
    435 	/*
    436 	 * XXX don't permit a scan to be started unless we
    437 	 * know the device is ready.  For the moment this means
    438 	 * the device is marked up as this is the required to
    439 	 * initialize the hardware.  It would be better to permit
    440 	 * scanning prior to being up but that'll require some
    441 	 * changes to the infrastructure.
    442 	 */
    443 	return (ic->ic_if.if_flags & IFF_UP) ? 0 : ENETRESET;
    444 }
    445 
    446 int
    447 ieee80211_cfgset(struct ifnet *ifp, u_long cmd, caddr_t data)
    448 {
    449 	struct ieee80211com *ic = (void *)ifp;
    450 	int i, j, len, error, rate;
    451 	struct ifreq *ifr = (struct ifreq *)data;
    452 	struct wi_ltv_keys *keys;
    453 	struct wi_req wreq;
    454 	u_char chanlist[roundup(IEEE80211_CHAN_MAX, NBBY)];
    455 
    456 	error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
    457 	if (error)
    458 		return error;
    459 	len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
    460 	switch (wreq.wi_type) {
    461 	case WI_RID_SERIALNO:
    462 	case WI_RID_NODENAME:
    463 		return EPERM;
    464 	case WI_RID_CURRENT_SSID:
    465 		return EPERM;
    466 	case WI_RID_OWN_SSID:
    467 	case WI_RID_DESIRED_SSID:
    468 		if (le16toh(wreq.wi_val[0]) * 2 > len ||
    469 		    le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
    470 			error = ENOSPC;
    471 			break;
    472 		}
    473 		memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
    474 		ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
    475 		memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
    476 		error = ENETRESET;
    477 		break;
    478 	case WI_RID_CURRENT_BSSID:
    479 		return EPERM;
    480 	case WI_RID_OWN_CHNL:
    481 		if (len != 2)
    482 			return EINVAL;
    483 		i = le16toh(wreq.wi_val[0]);
    484 		if (i < 0 ||
    485 		    i > IEEE80211_CHAN_MAX ||
    486 		    isclr(ic->ic_chan_active, i))
    487 			return EINVAL;
    488 		ic->ic_ibss_chan = &ic->ic_channels[i];
    489 		if (ic->ic_flags & IEEE80211_F_SIBSS)
    490 			error = ENETRESET;
    491 		break;
    492 	case WI_RID_CURRENT_CHAN:
    493 		return EPERM;
    494 	case WI_RID_COMMS_QUALITY:
    495 		return EPERM;
    496 	case WI_RID_PROMISC:
    497 		if (len != 2)
    498 			return EINVAL;
    499 		if (ifp->if_flags & IFF_PROMISC) {
    500 			if (wreq.wi_val[0] == 0) {
    501 				ifp->if_flags &= ~IFF_PROMISC;
    502 				error = ENETRESET;
    503 			}
    504 		} else {
    505 			if (wreq.wi_val[0] != 0) {
    506 				ifp->if_flags |= IFF_PROMISC;
    507 				error = ENETRESET;
    508 			}
    509 		}
    510 		break;
    511 	case WI_RID_PORTTYPE:
    512 		if (len != 2)
    513 			return EINVAL;
    514 		switch (le16toh(wreq.wi_val[0])) {
    515 		case IEEE80211_M_STA:
    516 			break;
    517 		case IEEE80211_M_IBSS:
    518 			if (!(ic->ic_caps & IEEE80211_C_IBSS))
    519 				return EINVAL;
    520 			break;
    521 		case IEEE80211_M_AHDEMO:
    522 			if (ic->ic_phytype != IEEE80211_T_DS ||
    523 			    !(ic->ic_caps & IEEE80211_C_AHDEMO))
    524 				return EINVAL;
    525 			break;
    526 		case IEEE80211_M_HOSTAP:
    527 			if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
    528 				return EINVAL;
    529 			break;
    530 		default:
    531 			return EINVAL;
    532 		}
    533 		if (le16toh(wreq.wi_val[0]) != ic->ic_opmode) {
    534 			ic->ic_opmode = le16toh(wreq.wi_val[0]);
    535 			error = ENETRESET;
    536 		}
    537 		break;
    538 #if 0
    539 	case WI_RID_MAC_NODE:
    540 		if (len != IEEE80211_ADDR_LEN)
    541 			return EINVAL;
    542 		IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq.wi_val);
    543 		/* if_init will copy lladdr into ic_myaddr */
    544 		error = ENETRESET;
    545 		break;
    546 #endif
    547 	case WI_RID_TX_RATE:
    548 		if (len != 2)
    549 			return EINVAL;
    550 		if (wreq.wi_val[0] == 0) {
    551 			/* auto */
    552 			ic->ic_fixed_rate = -1;
    553 			break;
    554 		}
    555 		rate = 2 * le16toh(wreq.wi_val[0]);
    556 		if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
    557 			/*
    558 			 * In autoselect mode search for the rate.  We take
    559 			 * the first instance which may not be right, but we
    560 			 * are limited by the interface.  Note that we also
    561 			 * lock the mode to insure the rate is meaningful
    562 			 * when it is used.
    563 			 */
    564 			for (j = IEEE80211_MODE_11A;
    565 			     j < IEEE80211_MODE_MAX; j++) {
    566 				if ((ic->ic_modecaps & (1<<j)) == 0)
    567 					continue;
    568 				i = findrate(ic, j, rate);
    569 				if (i != -1) {
    570 					/* lock mode too */
    571 					ic->ic_curmode = j;
    572 					goto setrate;
    573 				}
    574 			}
    575 		} else {
    576 			i = findrate(ic, ic->ic_curmode, rate);
    577 			if (i != -1)
    578 				goto setrate;
    579 		}
    580 		return EINVAL;
    581 	setrate:
    582 		ic->ic_fixed_rate = i;
    583 		error = ENETRESET;
    584 		break;
    585 	case WI_RID_CUR_TX_RATE:
    586 		return EPERM;
    587 	case WI_RID_FRAG_THRESH:
    588 		if (len != 2)
    589 			return EINVAL;
    590 		ic->ic_fragthreshold = le16toh(wreq.wi_val[0]);
    591 		error = ENETRESET;
    592 		break;
    593 	case WI_RID_RTS_THRESH:
    594 		if (len != 2)
    595 			return EINVAL;
    596 		ic->ic_rtsthreshold = le16toh(wreq.wi_val[0]);
    597 		error = ENETRESET;
    598 		break;
    599 	case WI_RID_CREATE_IBSS:
    600 		if (len != 2)
    601 			return EINVAL;
    602 		if (wreq.wi_val[0] != 0) {
    603 			if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
    604 				return EINVAL;
    605 			if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
    606 				ic->ic_flags |= IEEE80211_F_IBSSON;
    607 				if (ic->ic_opmode == IEEE80211_M_IBSS &&
    608 				    ic->ic_state == IEEE80211_S_SCAN)
    609 					error = ENETRESET;
    610 			}
    611 		} else {
    612 			if (ic->ic_flags & IEEE80211_F_IBSSON) {
    613 				ic->ic_flags &= ~IEEE80211_F_IBSSON;
    614 				if (ic->ic_flags & IEEE80211_F_SIBSS) {
    615 					ic->ic_flags &= ~IEEE80211_F_SIBSS;
    616 					error = ENETRESET;
    617 				}
    618 			}
    619 		}
    620 		break;
    621 	case WI_RID_MICROWAVE_OVEN:
    622 		if (len != 2)
    623 			return EINVAL;
    624 		if (wreq.wi_val[0] != 0)
    625 			return EINVAL;		/* not supported */
    626 		break;
    627 	case WI_RID_ROAMING_MODE:
    628 		if (len != 2)
    629 			return EINVAL;
    630 		if (le16toh(wreq.wi_val[0]) != 1)
    631 			return EINVAL;		/* not supported */
    632 		break;
    633 	case WI_RID_SYSTEM_SCALE:
    634 		if (len != 2)
    635 			return EINVAL;
    636 		if (le16toh(wreq.wi_val[0]) != 1)
    637 			return EINVAL;		/* not supported */
    638 		break;
    639 	case WI_RID_PM_ENABLED:
    640 		if (len != 2)
    641 			return EINVAL;
    642 		if (wreq.wi_val[0] != 0) {
    643 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
    644 				return EINVAL;
    645 			if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
    646 				ic->ic_flags |= IEEE80211_F_PMGTON;
    647 				error = ENETRESET;
    648 			}
    649 		} else {
    650 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
    651 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
    652 				error = ENETRESET;
    653 			}
    654 		}
    655 		break;
    656 	case WI_RID_MAX_SLEEP:
    657 		if (len != 2)
    658 			return EINVAL;
    659 		ic->ic_lintval = le16toh(wreq.wi_val[0]);
    660 		if (ic->ic_flags & IEEE80211_F_PMGTON)
    661 			error = ENETRESET;
    662 		break;
    663 	case WI_RID_CUR_BEACON_INT:
    664 		return EPERM;
    665 	case WI_RID_WEP_AVAIL:
    666 		return EPERM;
    667 	case WI_RID_CNFAUTHMODE:
    668 		if (len != 2)
    669 			return EINVAL;
    670 		if (le16toh(wreq.wi_val[0]) != 1)
    671 			return EINVAL;		/* TODO: shared key auth */
    672 		break;
    673 	case WI_RID_ENCRYPTION:
    674 		if (len != 2)
    675 			return EINVAL;
    676 		if (wreq.wi_val[0] != 0) {
    677 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
    678 				return EINVAL;
    679 			if ((ic->ic_flags & IEEE80211_F_WEPON) == 0) {
    680 				ic->ic_flags |= IEEE80211_F_WEPON;
    681 				error = ENETRESET;
    682 			}
    683 		} else {
    684 			if (ic->ic_flags & IEEE80211_F_WEPON) {
    685 				ic->ic_flags &= ~IEEE80211_F_WEPON;
    686 				error = ENETRESET;
    687 			}
    688 		}
    689 		break;
    690 	case WI_RID_TX_CRYPT_KEY:
    691 		if (len != 2)
    692 			return EINVAL;
    693 		i = le16toh(wreq.wi_val[0]);
    694 		if (i >= IEEE80211_WEP_NKID)
    695 			return EINVAL;
    696 		ic->ic_wep_txkey = i;
    697 		break;
    698 	case WI_RID_DEFLT_CRYPT_KEYS:
    699 		if (len != sizeof(struct wi_ltv_keys))
    700 			return EINVAL;
    701 		keys = (struct wi_ltv_keys *)&wreq;
    702 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    703 			len = le16toh(keys->wi_keys[i].wi_keylen);
    704 			if (len != 0 && len < IEEE80211_WEP_KEYLEN)
    705 				return EINVAL;
    706 			if (len > sizeof(ic->ic_nw_keys[i].wk_key))
    707 				return EINVAL;
    708 		}
    709 		memset(ic->ic_nw_keys, 0, sizeof(ic->ic_nw_keys));
    710 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    711 			len = le16toh(keys->wi_keys[i].wi_keylen);
    712 			ic->ic_nw_keys[i].wk_len = len;
    713 			memcpy(ic->ic_nw_keys[i].wk_key,
    714 			    keys->wi_keys[i].wi_keydat, len);
    715 		}
    716 		error = ENETRESET;
    717 		break;
    718 	case WI_RID_MAX_DATALEN:
    719 		if (len != 2)
    720 			return EINVAL;
    721 		len = le16toh(wreq.wi_val[0]);
    722 		if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
    723 			return EINVAL;
    724 		if (len != IEEE80211_MAX_LEN)
    725 			return EINVAL;		/* TODO: fragment */
    726 		ic->ic_fragthreshold = len;
    727 		error = ENETRESET;
    728 		break;
    729 	case WI_RID_IFACE_STATS:
    730 		error = EPERM;
    731 		break;
    732 	case WI_RID_SCAN_REQ:			/* XXX wicontrol */
    733 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
    734 			break;
    735 		error = ieee80211_setupscan(ic);
    736 		if (error == 0)
    737 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    738 		break;
    739 	case WI_RID_SCAN_APS:
    740 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
    741 			break;
    742 		len--;			/* XXX: tx rate? */
    743 		/* FALLTHRU */
    744 	case WI_RID_CHANNEL_LIST:
    745 		memset(chanlist, 0, sizeof(chanlist));
    746 		/*
    747 		 * Since channel 0 is not available for DS, channel 1
    748 		 * is assigned to LSB on WaveLAN.
    749 		 */
    750 		if (ic->ic_phytype == IEEE80211_T_DS)
    751 			i = 1;
    752 		else
    753 			i = 0;
    754 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
    755 			if ((j / 8) >= len)
    756 				break;
    757 			if (isclr((u_int8_t *)wreq.wi_val, j))
    758 				continue;
    759 			if (isclr(ic->ic_chan_active, i)) {
    760 				if (wreq.wi_type != WI_RID_CHANNEL_LIST)
    761 					continue;
    762 				if (isclr(ic->ic_chan_avail, i))
    763 					return EPERM;
    764 			}
    765 			setbit(chanlist, i);
    766 		}
    767 		memcpy(ic->ic_chan_active, chanlist,
    768 		    sizeof(ic->ic_chan_active));
    769 		error = ieee80211_setupscan(ic);
    770 		if (wreq.wi_type == WI_RID_CHANNEL_LIST) {
    771 			/* NB: ignore error from ieee80211_setupscan */
    772 			error = ENETRESET;
    773 		} else if (error == 0)
    774 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    775 		break;
    776 	default:
    777 		error = EINVAL;
    778 		break;
    779 	}
    780 	return error;
    781 }
    782 
    783 #ifdef __FreeBSD__
    784 int
    785 ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
    786 {
    787 	struct ieee80211com *ic = (void *)ifp;
    788 	int error = 0;
    789 	u_int kid, len;
    790 	struct ieee80211req *ireq;
    791 	struct ifreq *ifr;
    792 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
    793 	char tmpssid[IEEE80211_NWID_LEN];
    794 	struct ieee80211_channel *chan;
    795 
    796 	switch (cmd) {
    797 	case SIOCSIFMEDIA:
    798 	case SIOCGIFMEDIA:
    799 		error = ifmedia_ioctl(ifp, (struct ifreq *) data,
    800 				&ic->ic_media, cmd);
    801 		break;
    802 	case SIOCG80211:
    803 		ireq = (struct ieee80211req *) data;
    804 		switch (ireq->i_type) {
    805 		case IEEE80211_IOC_SSID:
    806 			switch (ic->ic_state) {
    807 			case IEEE80211_S_INIT:
    808 			case IEEE80211_S_SCAN:
    809 				ireq->i_len = ic->ic_des_esslen;
    810 				memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
    811 				break;
    812 			default:
    813 				ireq->i_len = ic->ic_bss->ni_esslen;
    814 				memcpy(tmpssid, ic->ic_bss->ni_essid,
    815 					ireq->i_len);
    816 				break;
    817 			}
    818 			error = copyout(tmpssid, ireq->i_data, ireq->i_len);
    819 			break;
    820 		case IEEE80211_IOC_NUMSSIDS:
    821 			ireq->i_val = 1;
    822 			break;
    823 		case IEEE80211_IOC_WEP:
    824 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0) {
    825 				ireq->i_val = IEEE80211_WEP_NOSUP;
    826 			} else {
    827 				if (ic->ic_flags & IEEE80211_F_WEPON) {
    828 					ireq->i_val =
    829 					    IEEE80211_WEP_MIXED;
    830 				} else {
    831 					ireq->i_val =
    832 					    IEEE80211_WEP_OFF;
    833 				}
    834 			}
    835 			break;
    836 		case IEEE80211_IOC_WEPKEY:
    837 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0) {
    838 				error = EINVAL;
    839 				break;
    840 			}
    841 			kid = (u_int) ireq->i_val;
    842 			if (kid >= IEEE80211_WEP_NKID) {
    843 				error = EINVAL;
    844 				break;
    845 			}
    846 			len = (u_int) ic->ic_nw_keys[kid].wk_len;
    847 			/* NB: only root can read WEP keys */
    848 			if (suser(curthread) == 0) {
    849 				bcopy(ic->ic_nw_keys[kid].wk_key, tmpkey, len);
    850 			} else {
    851 				bzero(tmpkey, len);
    852 			}
    853 			ireq->i_len = len;
    854 			error = copyout(tmpkey, ireq->i_data, len);
    855 			break;
    856 		case IEEE80211_IOC_NUMWEPKEYS:
    857 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
    858 				error = EINVAL;
    859 			else
    860 				ireq->i_val = IEEE80211_WEP_NKID;
    861 			break;
    862 		case IEEE80211_IOC_WEPTXKEY:
    863 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
    864 				error = EINVAL;
    865 			else
    866 				ireq->i_val = ic->ic_wep_txkey;
    867 			break;
    868 		case IEEE80211_IOC_AUTHMODE:
    869 			ireq->i_val = IEEE80211_AUTH_OPEN;
    870 			break;
    871 		case IEEE80211_IOC_CHANNEL:
    872 			switch (ic->ic_state) {
    873 			case IEEE80211_S_INIT:
    874 			case IEEE80211_S_SCAN:
    875 				if (ic->ic_opmode == IEEE80211_M_STA)
    876 					chan = ic->ic_des_chan;
    877 				else
    878 					chan = ic->ic_ibss_chan;
    879 				break;
    880 			default:
    881 				chan = ic->ic_bss->ni_chan;
    882 				break;
    883 			}
    884 			ireq->i_val = ieee80211_chan2ieee(ic, chan);
    885 			break;
    886 		case IEEE80211_IOC_POWERSAVE:
    887 			if (ic->ic_flags & IEEE80211_F_PMGTON)
    888 				ireq->i_val = IEEE80211_POWERSAVE_ON;
    889 			else
    890 				ireq->i_val = IEEE80211_POWERSAVE_OFF;
    891 			break;
    892 		case IEEE80211_IOC_POWERSAVESLEEP:
    893 			ireq->i_val = ic->ic_lintval;
    894 			break;
    895 		case IEEE80211_IOC_RTSTHRESHOLD:
    896 			ireq->i_val = ic->ic_rtsthreshold;
    897 			break;
    898 		default:
    899 			error = EINVAL;
    900 		}
    901 		break;
    902 	case SIOCS80211:
    903 		error = suser(curproc->p_ucred, &curproc->p_acflag);
    904 		if (error)
    905 			break;
    906 		ireq = (struct ieee80211req *) data;
    907 		switch (ireq->i_type) {
    908 		case IEEE80211_IOC_SSID:
    909 			if (ireq->i_val != 0 ||
    910 			    ireq->i_len > IEEE80211_NWID_LEN) {
    911 				error = EINVAL;
    912 				break;
    913 			}
    914 			error = copyin(ireq->i_data, tmpssid, ireq->i_len);
    915 			if (error)
    916 				break;
    917 			memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
    918 			ic->ic_des_esslen = ireq->i_len;
    919 			memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
    920 			error = ENETRESET;
    921 			break;
    922 		case IEEE80211_IOC_WEP:
    923 			/*
    924 			 * These cards only support one mode so
    925 			 * we just turn wep on if what ever is
    926 			 * passed in is not OFF.
    927 			 */
    928 			if (ireq->i_val == IEEE80211_WEP_OFF) {
    929 				ic->ic_flags &= ~IEEE80211_F_WEPON;
    930 			} else {
    931 				ic->ic_flags |= IEEE80211_F_WEPON;
    932 			}
    933 			error = ENETRESET;
    934 			break;
    935 		case IEEE80211_IOC_WEPKEY:
    936 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0) {
    937 				error = EINVAL;
    938 				break;
    939 			}
    940 			kid = (u_int) ireq->i_val;
    941 			if (kid >= IEEE80211_WEP_NKID) {
    942 				error = EINVAL;
    943 				break;
    944 			}
    945 			if (ireq->i_len > sizeof(tmpkey)) {
    946 				error = EINVAL;
    947 				break;
    948 			}
    949 			memset(tmpkey, 0, sizeof(tmpkey));
    950 			error = copyin(ireq->i_data, tmpkey, ireq->i_len);
    951 			if (error)
    952 				break;
    953 			memcpy(ic->ic_nw_keys[kid].wk_key, tmpkey,
    954 				sizeof(tmpkey));
    955 			ic->ic_nw_keys[kid].wk_len = ireq->i_len;
    956 			error = ENETRESET;
    957 			break;
    958 		case IEEE80211_IOC_WEPTXKEY:
    959 			kid = (u_int) ireq->i_val;
    960 			if (kid >= IEEE80211_WEP_NKID) {
    961 				error = EINVAL;
    962 				break;
    963 			}
    964 			ic->ic_wep_txkey = kid;
    965 			error = ENETRESET;
    966 			break;
    967 #if 0
    968 		case IEEE80211_IOC_AUTHMODE:
    969 			sc->wi_authmode = ireq->i_val;
    970 			break;
    971 #endif
    972 		case IEEE80211_IOC_CHANNEL:
    973 			/* XXX 0xffff overflows 16-bit signed */
    974 			if (ireq->i_val == 0 ||
    975 			    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
    976 				ic->ic_des_chan = IEEE80211_CHAN_ANYC;
    977 			else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
    978 			    isclr(ic->ic_chan_active, ireq->i_val)) {
    979 				error = EINVAL;
    980 				break;
    981 			} else
    982 				ic->ic_ibss_chan = ic->ic_des_chan =
    983 					&ic->ic_channels[ireq->i_val];
    984 			switch (ic->ic_state) {
    985 			case IEEE80211_S_INIT:
    986 			case IEEE80211_S_SCAN:
    987 				error = ENETRESET;
    988 				break;
    989 			default:
    990 				if (ic->ic_opmode == IEEE80211_M_STA) {
    991 					if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
    992 					    ic->ic_bss->ni_chan != ic->ic_des_chan)
    993 						error = ENETRESET;
    994 				} else {
    995 					if (ic->ic_bss->ni_chan != ic->ic_ibss_chan)
    996 						error = ENETRESET;
    997 				}
    998 				break;
    999 			}
   1000 			break;
   1001 		case IEEE80211_IOC_POWERSAVE:
   1002 			switch (ireq->i_val) {
   1003 			case IEEE80211_POWERSAVE_OFF:
   1004 				if (ic->ic_flags & IEEE80211_F_PMGTON) {
   1005 					ic->ic_flags &= ~IEEE80211_F_PMGTON;
   1006 					error = ENETRESET;
   1007 				}
   1008 				break;
   1009 			case IEEE80211_POWERSAVE_ON:
   1010 				if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
   1011 					error = EINVAL;
   1012 				else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
   1013 					ic->ic_flags |= IEEE80211_F_PMGTON;
   1014 					error = ENETRESET;
   1015 				}
   1016 				break;
   1017 			default:
   1018 				error = EINVAL;
   1019 				break;
   1020 			}
   1021 			break;
   1022 		case IEEE80211_IOC_POWERSAVESLEEP:
   1023 			if (ireq->i_val < 0) {
   1024 				error = EINVAL;
   1025 				break;
   1026 			}
   1027 			ic->ic_lintval = ireq->i_val;
   1028 			error = ENETRESET;
   1029 			break;
   1030 		case IEEE80211_IOC_RTSTHRESHOLD:
   1031 			if (!(IEEE80211_RTS_MIN < ireq->i_val &&
   1032 			      ireq->i_val <= IEEE80211_RTS_MAX + 1)) {
   1033 				error = EINVAL;
   1034 				break;
   1035 			}
   1036 			ic->ic_rtsthreshold = ireq->i_val;
   1037 			error = ENETRESET;
   1038 			break;
   1039 		default:
   1040 			error = EINVAL;
   1041 			break;
   1042 		}
   1043 		break;
   1044 	case SIOCGIFGENERIC:
   1045 		error = ieee80211_cfgget(ifp, cmd, data);
   1046 		break;
   1047 	case SIOCSIFGENERIC:
   1048 		error = suser(curproc->p_ucred, &curproc->p_acflag);
   1049 		if (error)
   1050 			break;
   1051 		error = ieee80211_cfgset(ifp, cmd, data);
   1052 		break;
   1053 	default:
   1054 		error = ether_ioctl(ifp, cmd, data);
   1055 		break;
   1056 	}
   1057 	return error;
   1058 }
   1059 #endif /* __FreeBSD__ */
   1060 
   1061 #ifdef __NetBSD__
   1062 int
   1063 ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
   1064 {
   1065 	struct ieee80211com *ic = (void *)ifp;
   1066 	struct ifreq *ifr = (struct ifreq *)data;
   1067 	int i, error = 0;
   1068 	struct ieee80211_nwid nwid;
   1069 	struct ieee80211_nwkey *nwkey;
   1070 	struct ieee80211_power *power;
   1071 	struct ieee80211_bssid *bssid;
   1072 	struct ieee80211chanreq *chanreq;
   1073 	struct ieee80211_channel *chan;
   1074 	struct ieee80211_wepkey keys[IEEE80211_WEP_NKID];
   1075 	static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
   1076 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
   1077 	};
   1078 
   1079 	switch (cmd) {
   1080 	case SIOCSIFMEDIA:
   1081 	case SIOCGIFMEDIA:
   1082 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
   1083 		break;
   1084 	case SIOCS80211NWID:
   1085 		if ((error = copyin(ifr->ifr_data, &nwid, sizeof(nwid))) != 0)
   1086 			break;
   1087 		if (nwid.i_len > IEEE80211_NWID_LEN) {
   1088 			error = EINVAL;
   1089 			break;
   1090 		}
   1091 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
   1092 		ic->ic_des_esslen = nwid.i_len;
   1093 		memcpy(ic->ic_des_essid, nwid.i_nwid, nwid.i_len);
   1094 		error = ENETRESET;
   1095 		break;
   1096 	case SIOCG80211NWID:
   1097 		memset(&nwid, 0, sizeof(nwid));
   1098 		switch (ic->ic_state) {
   1099 		case IEEE80211_S_INIT:
   1100 		case IEEE80211_S_SCAN:
   1101 			nwid.i_len = ic->ic_des_esslen;
   1102 			memcpy(nwid.i_nwid, ic->ic_des_essid, nwid.i_len);
   1103 			break;
   1104 		default:
   1105 			nwid.i_len = ic->ic_bss->ni_esslen;
   1106 			memcpy(nwid.i_nwid, ic->ic_bss->ni_essid, nwid.i_len);
   1107 			break;
   1108 		}
   1109 		error = copyout(&nwid, ifr->ifr_data, sizeof(nwid));
   1110 		break;
   1111 	case SIOCS80211NWKEY:
   1112 		nwkey = (struct ieee80211_nwkey *)data;
   1113 		if ((ic->ic_caps & IEEE80211_C_WEP) == 0 &&
   1114 		    nwkey->i_wepon != IEEE80211_NWKEY_OPEN) {
   1115 			error = EINVAL;
   1116 			break;
   1117 		}
   1118 		/* check and copy keys */
   1119 		memset(keys, 0, sizeof(keys));
   1120 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1121 			keys[i].wk_len = nwkey->i_key[i].i_keylen;
   1122 			if ((keys[i].wk_len > 0 &&
   1123 			    keys[i].wk_len < IEEE80211_WEP_KEYLEN) ||
   1124 			    keys[i].wk_len > sizeof(keys[i].wk_key)) {
   1125 				error = EINVAL;
   1126 				break;
   1127 			}
   1128 			if (keys[i].wk_len <= 0)
   1129 				continue;
   1130 			if ((error = copyin(nwkey->i_key[i].i_keydat,
   1131 			    keys[i].wk_key, keys[i].wk_len)) != 0)
   1132 				break;
   1133 		}
   1134 		if (error)
   1135 			break;
   1136 		i = nwkey->i_defkid - 1;
   1137 		if (i < 0 || i >= IEEE80211_WEP_NKID ||
   1138 		    keys[i].wk_len == 0 ||
   1139 		    (keys[i].wk_len == -1 && ic->ic_nw_keys[i].wk_len == 0)) {
   1140 			if (nwkey->i_wepon != IEEE80211_NWKEY_OPEN) {
   1141 				error = EINVAL;
   1142 				break;
   1143 			}
   1144 		} else
   1145 			ic->ic_wep_txkey = i;
   1146 		/* save the key */
   1147 		if (nwkey->i_wepon == IEEE80211_NWKEY_OPEN)
   1148 			ic->ic_flags &= ~IEEE80211_F_WEPON;
   1149 		else
   1150 			ic->ic_flags |= IEEE80211_F_WEPON;
   1151 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1152 			if (keys[i].wk_len < 0)
   1153 				continue;
   1154 			ic->ic_nw_keys[i].wk_len = keys[i].wk_len;
   1155 			memcpy(ic->ic_nw_keys[i].wk_key, keys[i].wk_key,
   1156 			    sizeof(keys[i].wk_key));
   1157 		}
   1158 		error = ENETRESET;
   1159 		break;
   1160 	case SIOCG80211NWKEY:
   1161 		nwkey = (struct ieee80211_nwkey *)data;
   1162 		if (ic->ic_flags & IEEE80211_F_WEPON)
   1163 			nwkey->i_wepon = IEEE80211_NWKEY_WEP;
   1164 		else
   1165 			nwkey->i_wepon = IEEE80211_NWKEY_OPEN;
   1166 		nwkey->i_defkid = ic->ic_wep_txkey + 1;
   1167 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1168 			if (nwkey->i_key[i].i_keydat == NULL)
   1169 				continue;
   1170 			/* do not show any keys to non-root user */
   1171 			if ((error = suser(curproc->p_ucred,
   1172 			    &curproc->p_acflag)) != 0)
   1173 				break;
   1174 			nwkey->i_key[i].i_keylen = ic->ic_nw_keys[i].wk_len;
   1175 			if ((error = copyout(ic->ic_nw_keys[i].wk_key,
   1176 			    nwkey->i_key[i].i_keydat,
   1177 			    ic->ic_nw_keys[i].wk_len)) != 0)
   1178 				break;
   1179 		}
   1180 		break;
   1181 	case SIOCS80211POWER:
   1182 		power = (struct ieee80211_power *)data;
   1183 		ic->ic_lintval = power->i_maxsleep;
   1184 		if (power->i_enabled != 0) {
   1185 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
   1186 				error = EINVAL;
   1187 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
   1188 				ic->ic_flags |= IEEE80211_F_PMGTON;
   1189 				error = ENETRESET;
   1190 			}
   1191 		} else {
   1192 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
   1193 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
   1194 				error = ENETRESET;
   1195 			}
   1196 		}
   1197 		break;
   1198 	case SIOCG80211POWER:
   1199 		power = (struct ieee80211_power *)data;
   1200 		power->i_enabled = (ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0;
   1201 		power->i_maxsleep = ic->ic_lintval;
   1202 		break;
   1203 	case SIOCS80211BSSID:
   1204 		bssid = (struct ieee80211_bssid *)data;
   1205 		if (IEEE80211_ADDR_EQ(bssid->i_bssid, empty_macaddr))
   1206 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
   1207 		else {
   1208 			ic->ic_flags |= IEEE80211_F_DESBSSID;
   1209 			IEEE80211_ADDR_COPY(ic->ic_des_bssid, bssid->i_bssid);
   1210 		}
   1211 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
   1212 			break;
   1213 		switch (ic->ic_state) {
   1214 		case IEEE80211_S_INIT:
   1215 		case IEEE80211_S_SCAN:
   1216 			error = ENETRESET;
   1217 			break;
   1218 		default:
   1219 			if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
   1220 			    !IEEE80211_ADDR_EQ(ic->ic_des_bssid,
   1221 			    ic->ic_bss->ni_bssid))
   1222 				error = ENETRESET;
   1223 			break;
   1224 		}
   1225 		break;
   1226 	case SIOCG80211BSSID:
   1227 		bssid = (struct ieee80211_bssid *)data;
   1228 		switch (ic->ic_state) {
   1229 		case IEEE80211_S_INIT:
   1230 		case IEEE80211_S_SCAN:
   1231 			if (ic->ic_opmode == IEEE80211_M_HOSTAP)
   1232 				IEEE80211_ADDR_COPY(bssid->i_bssid,
   1233 				    ic->ic_myaddr);
   1234 			else if (ic->ic_flags & IEEE80211_F_DESBSSID)
   1235 				IEEE80211_ADDR_COPY(bssid->i_bssid,
   1236 				    ic->ic_des_bssid);
   1237 			else
   1238 				memset(bssid->i_bssid, 0, IEEE80211_ADDR_LEN);
   1239 			break;
   1240 		default:
   1241 			IEEE80211_ADDR_COPY(bssid->i_bssid,
   1242 			    ic->ic_bss->ni_bssid);
   1243 			break;
   1244 		}
   1245 		break;
   1246 	case SIOCS80211CHANNEL:
   1247 		chanreq = (struct ieee80211chanreq *)data;
   1248 		if (chanreq->i_channel == IEEE80211_CHAN_ANY)
   1249 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
   1250 		else if (chanreq->i_channel > IEEE80211_CHAN_MAX ||
   1251 		    isclr(ic->ic_chan_active, chanreq->i_channel)) {
   1252 			error = EINVAL;
   1253 			break;
   1254 		} else
   1255 			ic->ic_ibss_chan = ic->ic_des_chan =
   1256 			    &ic->ic_channels[chanreq->i_channel];
   1257 		switch (ic->ic_state) {
   1258 		case IEEE80211_S_INIT:
   1259 		case IEEE80211_S_SCAN:
   1260 			error = ENETRESET;
   1261 			break;
   1262 		default:
   1263 			if (ic->ic_opmode == IEEE80211_M_STA) {
   1264 				if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
   1265 				    ic->ic_bss->ni_chan != ic->ic_des_chan)
   1266 					error = ENETRESET;
   1267 			} else {
   1268 				if (ic->ic_bss->ni_chan != ic->ic_ibss_chan)
   1269 					error = ENETRESET;
   1270 			}
   1271 			break;
   1272 		}
   1273 		break;
   1274 	case SIOCG80211CHANNEL:
   1275 		chanreq = (struct ieee80211chanreq *)data;
   1276 		switch (ic->ic_state) {
   1277 		case IEEE80211_S_INIT:
   1278 		case IEEE80211_S_SCAN:
   1279 			if (ic->ic_opmode == IEEE80211_M_STA)
   1280 				chan = ic->ic_des_chan;
   1281 			else
   1282 				chan = ic->ic_ibss_chan;
   1283 			break;
   1284 		default:
   1285 			chan = ic->ic_bss->ni_chan;
   1286 			break;
   1287 		}
   1288 		chanreq->i_channel = ieee80211_chan2ieee(ic, chan);
   1289 		break;
   1290 	case SIOCGIFGENERIC:
   1291 		error = ieee80211_cfgget(ifp, cmd, data);
   1292 		break;
   1293 	case SIOCSIFGENERIC:
   1294 		error = suser(curproc->p_ucred, &curproc->p_acflag);
   1295 		if (error)
   1296 			break;
   1297 		error = ieee80211_cfgset(ifp, cmd, data);
   1298 		break;
   1299 	case SIOCG80211STATS:
   1300 		ifr = (struct ifreq *)data;
   1301 		copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
   1302 		break;
   1303 	default:
   1304 		error = ether_ioctl(ifp, cmd, data);
   1305 		break;
   1306 	}
   1307 	return error;
   1308 }
   1309 #endif /* __NetBSD__ */
   1310