Use an accessor function to access ifr_data.

This fixes 32-bit compat (no ioctl command defintions are required
as struct ifreq is the same size).  This is believed to be sufficent to
fully support ifconfig on 32-bit systems.

Reviewed by:	kib
Obtained from:	CheriBSD
MFC after:	1 week
Relnotes:	yes
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D14900

28 files changed, 139 insertions, 91 deletions

diff --git a/sys/dev/an/if_an.c b/sys/dev/an/if_an.c
index c1871e513d4d..a2418e4119cd 100644
--- a/sys/dev/an/if_an.c
+++ b/sys/dev/an/if_an.c
@@ -1934,7 +1934,8 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
 		error = 0;
 		break;
 	case SIOCGAIRONET:
-		error = copyin(ifr->ifr_data, &sc->areq, sizeof(sc->areq));
+		error = copyin(ifr_data_get_ptr(ifr), &sc->areq,
+		    sizeof(sc->areq));
 		if (error != 0)
 			break;
 		AN_LOCK(sc);
@@ -1963,13 +1964,15 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
 			break;
 		}
 		AN_UNLOCK(sc);
-		error = copyout(&sc->areq, ifr->ifr_data, sizeof(sc->areq));
+		error = copyout(&sc->areq, ifr_data_get_ptr(ifr),
+		    sizeof(sc->areq));
 		break;
 	case SIOCSAIRONET:
 		if ((error = priv_check(td, PRIV_DRIVER)))
 			goto out;
 		AN_LOCK(sc);
-		error = copyin(ifr->ifr_data, &sc->areq, sizeof(sc->areq));
+		error = copyin(ifr_data_get_ptr(ifr), &sc->areq,
+		    sizeof(sc->areq));
 		if (error != 0)
 			break;
 		an_setdef(sc, &sc->areq);
@@ -1978,7 +1981,8 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
 	case SIOCGPRIVATE_0:		/* used by Cisco client utility */
 		if ((error = priv_check(td, PRIV_DRIVER)))
 			goto out;
-		error = copyin(ifr->ifr_data, &l_ioctl, sizeof(l_ioctl));
+		error = copyin(ifr_data_get_ptr(ifr), &l_ioctl,
+		    sizeof(l_ioctl));
 		if (error)
 			goto out;
 		mode = l_ioctl.command;
@@ -1996,13 +2000,15 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
 		AN_UNLOCK(sc);
 		if (!error) {
 			/* copy out the updated command info */
-			error = copyout(&l_ioctl, ifr->ifr_data, sizeof(l_ioctl));
+			error = copyout(&l_ioctl, ifr_data_get_ptr(ifr),
+			    sizeof(l_ioctl));
 		}
 		break;
 	case SIOCGPRIVATE_1:		/* used by Cisco client utility */
 		if ((error = priv_check(td, PRIV_DRIVER)))
 			goto out;
-		error = copyin(ifr->ifr_data, &l_ioctl, sizeof(l_ioctl));
+		error = copyin(ifr_data_get_ptr(ifr), &l_ioctl,
+		    sizeof(l_ioctl));
 		if (error)
 			goto out;
 		l_ioctl.command = 0;
diff --git a/sys/dev/ath/if_ath_ioctl.c b/sys/dev/ath/if_ath_ioctl.c
index 37122c16fc0b..9601ba3456bb 100644
--- a/sys/dev/ath/if_ath_ioctl.c
+++ b/sys/dev/ath/if_ath_ioctl.c
@@ -267,12 +267,12 @@ ath_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 		    rt->info[sc->sc_txrix].dot11Rate &~ IEEE80211_RATE_BASIC;
 		if (rt->info[sc->sc_txrix].phy & IEEE80211_T_HT)
 			sc->sc_stats.ast_tx_rate |= IEEE80211_RATE_MCS;
-		return copyout(&sc->sc_stats,
-		    ifr->ifr_data, sizeof (sc->sc_stats));
+		return copyout(&sc->sc_stats, ifr_data_get_ptr(ifr),
+		    sizeof (sc->sc_stats));
 	}
 	case SIOCGATHAGSTATS:
-		return copyout(&sc->sc_aggr_stats,
-		    ifr->ifr_data, sizeof (sc->sc_aggr_stats));
+		return copyout(&sc->sc_aggr_stats, ifr_data_get_ptr(ifr),
+		    sizeof (sc->sc_aggr_stats));
 	case SIOCZATHSTATS: {
 		int error;
 
diff --git a/sys/dev/cxgbe/t4_main.c b/sys/dev/cxgbe/t4_main.c
index 6002f1245067..0d5a072caa03 100644
--- a/sys/dev/cxgbe/t4_main.c
+++ b/sys/dev/cxgbe/t4_main.c
@@ -1800,7 +1800,7 @@ fail:
 	case SIOCGI2C: {
 		struct ifi2creq i2c;
 
-		rc = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		rc = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 		if (rc != 0)
 			break;
 		if (i2c.dev_addr != 0xA0 && i2c.dev_addr != 0xA2) {
@@ -1818,7 +1818,7 @@ fail:
 		    i2c.offset, i2c.len, &i2c.data[0]);
 		end_synchronized_op(sc, 0);
 		if (rc == 0)
-			rc = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+			rc = copyout(&i2c, ifr_data_get_ptr(ifr), sizeof(i2c));
 		break;
 	}
 
diff --git a/sys/dev/if_ndis/if_ndis.c b/sys/dev/if_ndis/if_ndis.c
index c0a4a3cc1907..ac6ff249925c 100644
--- a/sys/dev/if_ndis/if_ndis.c
+++ b/sys/dev/if_ndis/if_ndis.c
@@ -2975,11 +2975,12 @@ ndis_80211ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 	switch (cmd) {
 	case SIOCGDRVSPEC:
 	case SIOCSDRVSPEC:
-		error = copyin(ifr->ifr_data, &oid, sizeof(oid));
+		error = copyin(ifr_data_get_ptr(ifr), &oid, sizeof(oid));
 		if (error)
 			break;
 		oidbuf = malloc(oid.len, M_TEMP, M_WAITOK | M_ZERO);
-		error = copyin(ifr->ifr_data + sizeof(oid), oidbuf, oid.len);
+		error = copyin((caddr_t)ifr_data_get_ptr(ifr) + sizeof(oid),
+		    oidbuf, oid.len);
 	}
 
 	if (error) {
@@ -3001,7 +3002,7 @@ ndis_80211ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 			NDIS_UNLOCK(sc);
 			break;
 		}
-		error = copyin(ifr->ifr_data, &evt, sizeof(evt));
+		error = copyin(ifr_data_get_ptr(ifr), &evt, sizeof(evt));
 		if (error) {
 			NDIS_UNLOCK(sc);
 			break;
@@ -3012,14 +3013,15 @@ ndis_80211ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 			break;
 		}
 		error = copyout(&sc->ndis_evt[sc->ndis_evtcidx],
-		    ifr->ifr_data, sizeof(uint32_t) * 2);
+		    ifr_data_get_ptr(ifr), sizeof(uint32_t) * 2);
 		if (error) {
 			NDIS_UNLOCK(sc);
 			break;
 		}
 		if (sc->ndis_evt[sc->ndis_evtcidx].ne_len) {
 			error = copyout(sc->ndis_evt[sc->ndis_evtcidx].ne_buf,
-			    ifr->ifr_data + (sizeof(uint32_t) * 2),
+			    (caddr_t)ifr_data_get_ptr(ifr) +
+			    (sizeof(uint32_t) * 2),
 			    sc->ndis_evt[sc->ndis_evtcidx].ne_len);
 			if (error) {
 				NDIS_UNLOCK(sc);
@@ -3041,10 +3043,11 @@ ndis_80211ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 	switch (cmd) {
 	case SIOCGDRVSPEC:
 	case SIOCSDRVSPEC:
-		error = copyout(&oid, ifr->ifr_data, sizeof(oid));
+		error = copyout(&oid, ifr_data_get_ptr(ifr), sizeof(oid));
 		if (error)
 			break;
-		error = copyout(oidbuf, ifr->ifr_data + sizeof(oid), oid.len);
+		error = copyout(oidbuf,
+		    (caddr_t)ifr_data_get_ptr(ifr) + sizeof(oid), oid.len);
 	}
 
 	free(oidbuf, M_TEMP);
diff --git a/sys/dev/iwi/if_iwi.c b/sys/dev/iwi/if_iwi.c
index d3329cf811f3..5a396c3d51ec 100644
--- a/sys/dev/iwi/if_iwi.c
+++ b/sys/dev/iwi/if_iwi.c
@@ -2059,7 +2059,7 @@ iwi_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 	switch (cmd) {
 	case SIOCGIWISTATS:
 		/* XXX validate permissions/memory/etc? */
-		error = copyout(&sc->sc_linkqual, ifr->ifr_data,
+		error = copyout(&sc->sc_linkqual, ifr_data_get_ptr(ifr),
 		    sizeof(struct iwi_notif_link_quality));
 		break;
 	case SIOCZIWISTATS:
diff --git a/sys/dev/ixl/ixl_pf_main.c b/sys/dev/ixl/ixl_pf_main.c
index fa271d434ec4..a5b312d0a73c 100644
--- a/sys/dev/ixl/ixl_pf_main.c
+++ b/sys/dev/ixl/ixl_pf_main.c
@@ -5174,7 +5174,7 @@ ixl_ioctl(struct ifnet * ifp, u_long command, caddr_t data)
 		if (!pf->has_i2c)
 			return (ENOTTY);
 
-		error = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		error = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 		if (error != 0)
 			break;
 		if (i2c.dev_addr != 0xA0 && i2c.dev_addr != 0xA2) {
@@ -5191,7 +5191,7 @@ ixl_ioctl(struct ifnet * ifp, u_long command, caddr_t data)
 			    i2c.dev_addr, &i2c.data[i]))
 				return (EIO);
 
-		error = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+		error = copyout(&i2c, ifr_data_get_ptr(ifr), sizeof(i2c));
 		break;
 	}
 #endif
diff --git a/sys/dev/mlx4/mlx4_en/mlx4_en_netdev.c b/sys/dev/mlx4/mlx4_en/mlx4_en_netdev.c
index 72fd57a7ba88..cdf7abef2d65 100644
--- a/sys/dev/mlx4/mlx4_en/mlx4_en_netdev.c
+++ b/sys/dev/mlx4/mlx4_en/mlx4_en_netdev.c
@@ -2058,7 +2058,7 @@ out:
 	case SIOCGI2C: {
 		struct ifi2creq i2c;
 
-		error = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		error = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 		if (error)
 			break;
 		if (i2c.len > sizeof(i2c.data)) {
@@ -2075,7 +2075,7 @@ out:
 			error = -error;
 			break;
 		}
-		error = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+		error = copyout(&i2c, ifr_data_get_ptr(ifr), sizeof(i2c));
 		break;
 	}
 #endif
diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
index 853d8d8c78f2..fa3693dcd088 100644
--- a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
+++ b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
@@ -2884,7 +2884,7 @@ out:
 		 * Copy from the user-space address ifr_data to the
 		 * kernel-space address i2c
 		 */
-		error = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		error = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 		if (error)
 			break;
 
@@ -2948,7 +2948,7 @@ out:
 			goto err_i2c;
 		}
 
-		error = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+		error = copyout(&i2c, ifr_data_get_ptr(ifr), sizeof(i2c));
 err_i2c:
 		PRIV_UNLOCK(priv);
 		break;
diff --git a/sys/dev/mwl/if_mwl.c b/sys/dev/mwl/if_mwl.c
index e1ec18294081..b54dc7e8cb58 100644
--- a/sys/dev/mwl/if_mwl.c
+++ b/sys/dev/mwl/if_mwl.c
@@ -4750,8 +4750,8 @@ mwl_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 		 * statistics.  The alternative is to copy the data
 		 * to a local structure.
 		 */
-		return (copyout(&sc->sc_stats,
-				ifr->ifr_data, sizeof (sc->sc_stats)));
+		return (copyout(&sc->sc_stats, ifr_data_get_ptr(ifr),
+		    sizeof (sc->sc_stats)));
 #ifdef MWL_DIAGAPI
 	case SIOCGMVDIAG:
 		/* XXX check privs */
diff --git a/sys/dev/nxge/if_nxge.c b/sys/dev/nxge/if_nxge.c
index ccf994e2b46b..3c3591f38284 100644
--- a/sys/dev/nxge/if_nxge.c
+++ b/sys/dev/nxge/if_nxge.c
@@ -1368,7 +1368,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	void *info = NULL;
 	int retValue = EINVAL;
 
-	cmd = fubyte(ifreqp->ifr_data);
+	cmd = fubyte(ifr_data_get_ptr(ifreqp));
 	if (cmd == -1)
 		return (EFAULT);
 
@@ -1379,7 +1379,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	            (xge_hal_stats_hw_info_t **)&info);
 	        mtx_unlock(&lldev->mtx_drv);
 	        if(status == XGE_HAL_OK) {
-	            if(copyout(info, ifreqp->ifr_data,
+	            if(copyout(info, ifr_data_get_ptr(ifreqp),
 	                sizeof(xge_hal_stats_hw_info_t)) == 0)
 	                retValue = 0;
 	        }
@@ -1397,7 +1397,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	                sizeof(xge_hal_pci_config_t));
 	            mtx_unlock(&lldev->mtx_drv);
 	            if(status == XGE_HAL_OK) {
-	                if(copyout(info, ifreqp->ifr_data,
+	                if(copyout(info, ifr_data_get_ptr(ifreqp),
 	                    sizeof(xge_hal_pci_config_t)) == 0)
 	                    retValue = 0;
 	            }
@@ -1417,7 +1417,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	                sizeof(xge_hal_stats_device_info_t));
 	            mtx_unlock(&lldev->mtx_drv);
 	            if(status == XGE_HAL_OK) {
-	                if(copyout(info, ifreqp->ifr_data,
+	                if(copyout(info, ifr_data_get_ptr(ifreqp),
 	                    sizeof(xge_hal_stats_device_info_t)) == 0)
 	                    retValue = 0;
 	            }
@@ -1438,7 +1438,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	                sizeof(xge_hal_stats_sw_err_t));
 	            mtx_unlock(&lldev->mtx_drv);
 	            if(status == XGE_HAL_OK) {
-	                if(copyout(info, ifreqp->ifr_data,
+	                if(copyout(info, ifr_data_get_ptr(ifreqp),
 	                    sizeof(xge_hal_stats_sw_err_t)) == 0)
 	                    retValue = 0;
 	            }
@@ -1451,7 +1451,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	        break;
 
 	    case XGE_QUERY_DRIVERSTATS:
-		if(copyout(&lldev->driver_stats, ifreqp->ifr_data,
+		if(copyout(&lldev->driver_stats, ifr_data_get_ptr(ifreqp),
 	            sizeof(xge_driver_stats_t)) == 0) {
 	            retValue = 0;
 	        }
@@ -1465,7 +1465,8 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	        info = xge_os_malloc(NULL, XGE_BUFFER_SIZE);
 	        if(info != NULL) {
 	            strcpy(info, XGE_DRIVER_VERSION);
-	            if(copyout(info, ifreqp->ifr_data, XGE_BUFFER_SIZE) == 0)
+	            if(copyout(info, ifr_data_get_ptr(ifreqp),
+			XGE_BUFFER_SIZE) == 0)
 	                retValue = 0;
 	            xge_os_free(NULL, info, XGE_BUFFER_SIZE);
 	        }
@@ -1479,7 +1480,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	                sizeof(xge_hal_device_config_t));
 	            mtx_unlock(&lldev->mtx_drv);
 	            if(status == XGE_HAL_OK) {
-	                if(copyout(info, ifreqp->ifr_data,
+	                if(copyout(info, ifr_data_get_ptr(ifreqp),
 	                    sizeof(xge_hal_device_config_t)) == 0)
 	                    retValue = 0;
 	            }
@@ -1492,7 +1493,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	        break;
 
 	    case XGE_QUERY_BUFFER_MODE:
-	        if(copyout(&lldev->buffer_mode, ifreqp->ifr_data,
+	        if(copyout(&lldev->buffer_mode, ifr_data_get_ptr(ifreqp),
 	            sizeof(int)) == 0)
 	            retValue = 0;
 	        break;
@@ -1501,7 +1502,7 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	    case XGE_SET_BUFFER_MODE_2:
 	    case XGE_SET_BUFFER_MODE_5:
 	        mode = (cmd == XGE_SET_BUFFER_MODE_1) ? 'Y':'N';
-	        if(copyout(&mode, ifreqp->ifr_data, sizeof(mode)) == 0)
+	        if(copyout(&mode, ifr_data_get_ptr(ifreqp), sizeof(mode)) == 0)
 	            retValue = 0;
 	        break;
 	    default:
@@ -1529,7 +1530,7 @@ xge_ioctl_registers(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	int error;
 	u64 val64 = 0;
 
-	error = copyin(ifreqp->ifr_data, &tmpdata, sizeof(tmpdata));
+	error = copyin(ifr_data_get_ptr(ifreqp), &tmpdata, sizeof(tmpdata));
 	if (error != 0)
 		return (error);
 	data = &tmpdata;
@@ -1542,7 +1543,8 @@ xge_ioctl_registers(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	        &data->value);
 	    mtx_unlock(&lldev->mtx_drv);
 	    if(status == XGE_HAL_OK) {
-	        if(copyout(data, ifreqp->ifr_data, sizeof(xge_register_t)) == 0)
+	        if(copyout(data, ifr_data_get_ptr(ifreqp),
+		    sizeof(xge_register_t)) == 0)
 	            retValue = 0;
 	    }
 	}
@@ -1587,7 +1589,7 @@ xge_ioctl_registers(xge_lldev_t *lldev, struct ifreq *ifreqp)
 	    mtx_unlock(&lldev->mtx_drv);
 
 	    if(retValue == 0) {
-	        if(copyout(data, ifreqp->ifr_data,
+	        if(copyout(data, ifr_data_get_ptr(ifreqp),
 	            sizeof(xge_hal_pci_bar0_t)) != 0) {
 	            xge_trace(XGE_ERR, "Copyout of register values failed");
 	            retValue = EINVAL;
diff --git a/sys/dev/oce/oce_if.c b/sys/dev/oce/oce_if.c
index efa57db8cb8e..23e32a59de49 100644
--- a/sys/dev/oce/oce_if.c
+++ b/sys/dev/oce/oce_if.c
@@ -2276,7 +2276,7 @@ oce_handle_passthrough(struct ifnet *ifp, caddr_t data)
 	struct ifreq *ifr = (struct ifreq *)data;
 	int rc = ENXIO;
 	char cookie[32] = {0};
-	void *priv_data = (void *)ifr->ifr_data;
+	void *priv_data = ifr_data_get_ptr(ifr);
 	void *ioctl_ptr;
 	uint32_t req_size;
 	struct mbx_hdr req;
diff --git a/sys/dev/qlnx/qlnxe/qlnx_os.c b/sys/dev/qlnx/qlnxe/qlnx_os.c
index a1aea4d784a2..78efdeb9119b 100644
--- a/sys/dev/qlnx/qlnxe/qlnx_os.c
+++ b/sys/dev/qlnx/qlnxe/qlnx_os.c
@@ -2464,7 +2464,7 @@ qlnx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		struct ecore_hwfn *p_hwfn = &ha->cdev.hwfns[0];
 		struct ecore_ptt *p_ptt;
 
-		ret = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		ret = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 
 		if (ret)
 			break;
@@ -2494,7 +2494,7 @@ qlnx_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 			break;
 		}
 
-		ret = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+		ret = copyout(&i2c, ifr_data_get_ptr(ifr), sizeof(i2c));
 
 		QL_DPRINT8(ha, "SIOCGI2C copyout ret = %d \
 			 len = %d addr = 0x%02x offset = 0x%04x \
diff --git a/sys/dev/sbni/if_sbni.c b/sys/dev/sbni/if_sbni.c
index 7a3c810d0b36..12f7c0afc414 100644
--- a/sys/dev/sbni/if_sbni.c
+++ b/sys/dev/sbni/if_sbni.c
@@ -1153,7 +1153,7 @@ sbni_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
 		SBNI_LOCK(sc);
 		bcopy(&sc->in_stats, in_stats, sizeof(struct sbni_in_stats));
 		SBNI_UNLOCK(sc);
-		error = copyout(ifr->ifr_data, in_stats,
+		error = copyout(ifr_data_get_ptr(ifr), in_stats,
 		    sizeof(struct sbni_in_stats));
 		free(in_stats, M_DEVBUF);
 		break;
diff --git a/sys/dev/sfxge/sfxge.c b/sys/dev/sfxge/sfxge.c
index 9aa1ff8ab006..fc24998fa998 100644
--- a/sys/dev/sfxge/sfxge.c
+++ b/sys/dev/sfxge/sfxge.c
@@ -529,7 +529,7 @@ sfxge_if_ioctl(struct ifnet *ifp, unsigned long command, caddr_t data)
 	{
 		struct ifi2creq i2c;
 
-		error = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		error = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 		if (error != 0)
 			break;
 
@@ -544,7 +544,8 @@ sfxge_if_ioctl(struct ifnet *ifp, unsigned long command, caddr_t data)
 						&i2c.data[0]);
 		SFXGE_ADAPTER_UNLOCK(sc);
 		if (error == 0)
-			error = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+			error = copyout(&i2c, ifr_data_get_ptr(ifr),
+			    sizeof(i2c));
 		break;
 	}
 #endif
@@ -552,12 +553,13 @@ sfxge_if_ioctl(struct ifnet *ifp, unsigned long command, caddr_t data)
 		error = priv_check(curthread, PRIV_DRIVER);
 		if (error != 0)
 			break;
-		error = copyin(ifr->ifr_data, &ioc, sizeof(ioc));
+		error = copyin(ifr_data_get_ptr(ifr), &ioc, sizeof(ioc));
 		if (error != 0)
 			return (error);
 		error = sfxge_private_ioctl(sc, &ioc);
 		if (error == 0) {
-			error = copyout(&ioc, ifr->ifr_data, sizeof(ioc));
+			error = copyout(&ioc, ifr_data_get_ptr(ifr),
+			    sizeof(ioc));
 		}
 		break;
 	default:
diff --git a/sys/dev/vxge/vxge.c b/sys/dev/vxge/vxge.c
index 115fedb0d319..ebc5b8a35088 100644
--- a/sys/dev/vxge/vxge.c
+++ b/sys/dev/vxge/vxge.c
@@ -3710,8 +3710,8 @@ vxge_ioctl_regs(vxge_dev_t *vdev, struct ifreq *ifr)
 	u32 offset, reqd_size = 0;
 	int i, err = EINVAL;
 
-	char *command = (char *) ifr->ifr_data;
-	void *reg_info = (void *) ifr->ifr_data;
+	char *command = ifr_data_get_ptr(ifr);
+	void *reg_info = ifr_data_get_ptr(ifr);
 
 	vxge_vpath_t *vpath;
 	vxge_hal_status_e status = VXGE_HAL_OK;
@@ -3818,7 +3818,7 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 	vxge_drv_stats_t *drv_stat;
 
 	char *buffer = NULL;
-	char *command = (char *) ifr->ifr_data;
+	char *command = ifr_data_get_ptr(ifr);
 	vxge_hal_status_e status = VXGE_HAL_OK;
 
 	switch (*command) {
@@ -3829,7 +3829,8 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 			status = vxge_hal_aux_pci_config_read(vdev->devh,
 			    bufsize, buffer, &retsize);
 			if (status == VXGE_HAL_OK)
-				err = copyout(buffer, ifr->ifr_data, retsize);
+				err = copyout(buffer, ifr_data_get_ptr(ifr),
+				    retsize);
 			else
 				device_printf(vdev->ndev,
 				    "failed pciconfig statistics query\n");
@@ -3848,7 +3849,8 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 			status = vxge_hal_aux_stats_mrpcim_read(vdev->devh,
 			    bufsize, buffer, &retsize);
 			if (status == VXGE_HAL_OK)
-				err = copyout(buffer, ifr->ifr_data, retsize);
+				err = copyout(buffer, ifr_data_get_ptr(ifr),
+				    retsize);
 			else
 				device_printf(vdev->ndev,
 				    "failed mrpcim statistics query\n");
@@ -3864,7 +3866,8 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 			status = vxge_hal_aux_stats_device_read(vdev->devh,
 			    bufsize, buffer, &retsize);
 			if (status == VXGE_HAL_OK)
-				err = copyout(buffer, ifr->ifr_data, retsize);
+				err = copyout(buffer, ifr_data_get_ptr(ifr),
+				    retsize);
 			else
 				device_printf(vdev->ndev,
 				    "failed device statistics query\n");
@@ -3888,7 +3891,7 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 			((vxge_device_hw_info_t *) buffer)->port_failure =
 			    vdev->port_failure;
 
-			err = copyout(buffer, ifr->ifr_data, bufsize);
+			err = copyout(buffer, ifr_data_get_ptr(ifr), bufsize);
 			if (err != 0)
 				device_printf(vdev->ndev,
 				    "failed device hardware info query\n");
@@ -3915,7 +3918,7 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 				    sizeof(vxge_drv_stats_t));
 			}
 
-			err = copyout(drv_stat, ifr->ifr_data, bufsize);
+			err = copyout(drv_stat, ifr_data_get_ptr(ifr), bufsize);
 			if (err != 0)
 				device_printf(vdev->ndev,
 				    "failed driver statistics query\n");
@@ -3925,7 +3928,7 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 		break;
 
 	case VXGE_GET_BANDWIDTH:
-		bw_info = (vxge_bw_info_t *) ifr->ifr_data;
+		bw_info = ifr_data_get_ptr(ifr);
 
 		if ((vdev->config.hw_info.func_id != 0) &&
 		    (vdev->hw_fw_version < VXGE_FW_VERSION(1, 8, 0)))
@@ -3938,7 +3941,8 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 		if (status != VXGE_HAL_OK)
 			break;
 
-		err = copyout(bw_info, ifr->ifr_data, sizeof(vxge_bw_info_t));
+		err = copyout(bw_info, ifr_data_get_ptr(ifr),
+		    sizeof(vxge_bw_info_t));
 		break;
 
 	case VXGE_SET_BANDWIDTH:
@@ -3949,7 +3953,7 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 	case VXGE_SET_PORT_MODE:
 		if (vdev->is_privilaged) {
 			if (vdev->config.hw_info.ports == VXGE_DUAL_PORT_MODE) {
-				port_info = (vxge_port_info_t *) ifr->ifr_data;
+				port_info = ifr_data_get_ptr(ifr);
 				vdev->config.port_mode = port_info->port_mode;
 				err = vxge_port_mode_update(vdev);
 				if (err != ENXIO)
@@ -3966,10 +3970,11 @@ vxge_ioctl_stats(vxge_dev_t *vdev, struct ifreq *ifr)
 	case VXGE_GET_PORT_MODE:
 		if (vdev->is_privilaged) {
 			if (vdev->config.hw_info.ports == VXGE_DUAL_PORT_MODE) {
-				port_info = (vxge_port_info_t *) ifr->ifr_data;
+				port_info = ifr_data_get_ptr(ifr);
 				err = vxge_port_mode_get(vdev, port_info);
 				if (err == VXGE_HAL_OK) {
-					err = copyout(port_info, ifr->ifr_data,
+					err = copyout(port_info,
+					    ifr_data_get_ptr(ifr),
 					    sizeof(vxge_port_info_t));
 				}
 			}
@@ -4005,7 +4010,7 @@ vxge_bw_priority_set(vxge_dev_t *vdev, struct ifreq *ifr)
 	u32 func_id;
 	vxge_bw_info_t *bw_info;
 
-	bw_info = (vxge_bw_info_t *) ifr->ifr_data;
+	bw_info = ifr_data_get_ptr(ifr);
 	func_id = bw_info->func_id;
 
 	vdev->config.bw_info[func_id].priority = bw_info->priority;
diff --git a/sys/net/if.c b/sys/net/if.c
index f0042ce936e9..ddd54a97349c 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -2403,6 +2403,20 @@ ifr_buffer_set_length(struct thread *td, void *data, size_t len)
 		ifrup->ifr.ifr_ifru.ifru_buffer.length = len;
 }
 
+void *
+ifr_data_get_ptr(void *ifrp)
+{
+	union ifreq_union *ifrup;
+
+	ifrup = ifrp;
+#ifdef COMPAT_FREEBSD32
+	if (SV_CURPROC_FLAG(SV_ILP32))
+		return ((void *)(uintptr_t)
+		    ifrup->ifr32.ifr_ifru.ifru_data);
+#endif
+		return (ifrup->ifr.ifr_ifru.ifru_data);
+}
+
 /*
  * Hardware specific interface ioctls.
  */
@@ -2584,7 +2598,8 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
 		error = priv_check(td, PRIV_NET_SETIFNAME);
 		if (error)
 			return (error);
-		error = copyinstr(ifr->ifr_data, new_name, IFNAMSIZ, NULL);
+		error = copyinstr(ifr_data_get_ptr(ifr), new_name, IFNAMSIZ,
+		    NULL);
 		if (error != 0)
 			return (error);
 		if (new_name[0] == '\0')
@@ -2895,8 +2910,8 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
 		error = priv_check(td, PRIV_NET_IFCREATE);
 		if (error == 0)
 			error = if_clone_create(ifr->ifr_name,
-			    sizeof(ifr->ifr_name),
-			    cmd == SIOCIFCREATE2 ? ifr->ifr_data : NULL);
+			    sizeof(ifr->ifr_name), cmd == SIOCIFCREATE2 ?
+			    ifr_data_get_ptr(ifr) : NULL);
 		CURVNET_RESTORE();
 		return (error);
 	case SIOCIFDESTROY:
diff --git a/sys/net/if.h b/sys/net/if.h
index 8e51392cba30..2b99b55d2b8f 100644
--- a/sys/net/if.h
+++ b/sys/net/if.h
@@ -412,7 +412,9 @@ struct	ifreq {
 #define	ifr_mtu		ifr_ifru.ifru_mtu	/* mtu */
 #define ifr_phys	ifr_ifru.ifru_phys	/* physical wire */
 #define ifr_media	ifr_ifru.ifru_media	/* physical media */
+#ifndef _KERNEL
 #define	ifr_data	ifr_ifru.ifru_data	/* for use by interface */
+#endif
 #define	ifr_reqcap	ifr_ifru.ifru_cap[0]	/* requested capabilities */
 #define	ifr_curcap	ifr_ifru.ifru_cap[1]	/* current capabilities */
 #define	ifr_index	ifr_ifru.ifru_index	/* interface index */
diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
index 0d738c598be8..011ad7aedeaf 100644
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -898,12 +898,14 @@ gif_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 	case GIFGOPTS:
 		options = sc->gif_options;
-		error = copyout(&options, ifr->ifr_data, sizeof(options));
+		error = copyout(&options, ifr_data_get_ptr(ifr),
+		    sizeof(options));
 		break;
 	case GIFSOPTS:
 		if ((error = priv_check(curthread, PRIV_NET_GIF)) != 0)
 			break;
-		error = copyin(ifr->ifr_data, &options, sizeof(options));
+		error = copyin(ifr_data_get_ptr(ifr), &options,
+		    sizeof(options));
 		if (error)
 			break;
 		if (options & ~GIF_OPTMASK)
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index c6c9dc1760e9..a3e578e4cad3 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -455,7 +455,8 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 	case GRESKEY:
 		if ((error = priv_check(curthread, PRIV_NET_GRE)) != 0)
 			break;
-		if ((error = copyin(ifr->ifr_data, &opt, sizeof(opt))) != 0)
+		if ((error = copyin(ifr_data_get_ptr(ifr), &opt,
+		    sizeof(opt))) != 0)
 			break;
 		if (sc->gre_key != opt) {
 			GRE_WLOCK(sc);
@@ -465,13 +466,14 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		}
 		break;
 	case GREGKEY:
-		error = copyout(&sc->gre_key, ifr->ifr_data,
+		error = copyout(&sc->gre_key, ifr_data_get_ptr(ifr),
 		    sizeof(sc->gre_key));
 		break;
 	case GRESOPTS:
 		if ((error = priv_check(curthread, PRIV_NET_GRE)) != 0)
 			break;
-		if ((error = copyin(ifr->ifr_data, &opt, sizeof(opt))) != 0)
+		if ((error = copyin(ifr_data_get_ptr(ifr), &opt,
+		    sizeof(opt))) != 0)
 			break;
 		if (opt & ~GRE_OPTMASK)
 			error = EINVAL;
@@ -486,7 +488,7 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 
 	case GREGOPTS:
-		error = copyout(&sc->gre_options, ifr->ifr_data,
+		error = copyout(&sc->gre_options, ifr_data_get_ptr(ifr),
 		    sizeof(sc->gre_options));
 		break;
 	default:
diff --git a/sys/net/if_ipsec.c b/sys/net/if_ipsec.c
index e86064815c9d..7ae27a0d8f20 100644
--- a/sys/net/if_ipsec.c
+++ b/sys/net/if_ipsec.c
@@ -688,12 +688,12 @@ ipsec_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 	case IPSECGREQID:
 		reqid = sc->reqid;
-		error = copyout(&reqid, ifr->ifr_data, sizeof(reqid));
+		error = copyout(&reqid, ifr_data_get_ptr(ifr), sizeof(reqid));
 		break;
 	case IPSECSREQID:
 		if ((error = priv_check(curthread, PRIV_NET_SETIFCAP)) != 0)
 			break;
-		error = copyin(ifr->ifr_data, &reqid, sizeof(reqid));
+		error = copyin(ifr_data_get_ptr(ifr), &reqid, sizeof(reqid));
 		if (error != 0)
 			break;
 		error = ipsec_set_reqid(ifp, reqid);
diff --git a/sys/net/if_spppsubr.c b/sys/net/if_spppsubr.c
index c4480615ed2a..bf7b664661de 100644
--- a/sys/net/if_spppsubr.c
+++ b/sys/net/if_spppsubr.c
@@ -5058,17 +5058,17 @@ sppp_params(struct sppp *sp, u_long cmd, void *data)
 	if ((spr = malloc(sizeof(struct spppreq), M_TEMP, M_NOWAIT)) == NULL)
 		return (EAGAIN);
 	/*
-	 * ifr->ifr_data is supposed to point to a struct spppreq.
+	 * ifr_data_get_ptr(ifr) is supposed to point to a struct spppreq.
 	 * Check the cmd word first before attempting to fetch all the
 	 * data.
 	 */
-	rv = fueword(ifr->ifr_data, &subcmd);
+	rv = fueword(ifr_data_get_ptr(ifr), &subcmd);
 	if (rv == -1) {
 		rv = EFAULT;
 		goto quit;
 	}
 
-	if (copyin((caddr_t)ifr->ifr_data, spr, sizeof(struct spppreq)) != 0) {
+	if (copyin(ifr_data_get_ptr(ifr), spr, sizeof(struct spppreq)) != 0) {
 		rv = EFAULT;
 		goto quit;
 	}
@@ -5105,8 +5105,8 @@ sppp_params(struct sppp *sp, u_long cmd, void *data)
 		 * setting it.
 		 */
 		spr->defs.lcp.timeout = sp->lcp.timeout * 1000 / hz;
-		rv = copyout(spr, (caddr_t)ifr->ifr_data,
-			     sizeof(struct spppreq));
+		rv = copyout(spr, ifr_data_get_ptr(ifr),
+		    sizeof(struct spppreq));
 		break;
 
 	case (u_long)SPPPIOSDEFS:
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index 53130d750776..fbb09ca5d269 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -719,6 +719,9 @@ int drbr_enqueue_drv(if_t ifp, struct buf_ring *br, struct mbuf *m);
 void if_hw_tsomax_common(if_t ifp, struct ifnet_hw_tsomax *);
 int if_hw_tsomax_update(if_t ifp, struct ifnet_hw_tsomax *);
 
+/* accessors for struct ifreq */
+void *ifr_data_get_ptr(void *ifrp);
+
 #ifdef DEVICE_POLLING
 enum poll_cmd { POLL_ONLY, POLL_AND_CHECK_STATUS };
 
diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
index 35fb444794a3..364a3daae32d 100644
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -1857,7 +1857,7 @@ vlan_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 			break;
 		}
 #endif
-		error = copyin(ifr->ifr_data, &vlr, sizeof(vlr));
+		error = copyin(ifr_data_get_ptr(ifr), &vlr, sizeof(vlr));
 		if (error)
 			break;
 		if (vlr.vlr_parent[0] == '\0') {
@@ -1888,7 +1888,7 @@ vlan_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 			vlr.vlr_tag = ifv->ifv_vid;
 		}
 		VLAN_SUNLOCK();
-		error = copyout(&vlr, ifr->ifr_data, sizeof(vlr));
+		error = copyout(&vlr, ifr_data_get_ptr(ifr), sizeof(vlr));
 		break;
 		
 	case SIOCSIFFLAGS:
diff --git a/sys/net/iflib.c b/sys/net/iflib.c
index d0c205dcbf7d..31d900ec3bab 100644
--- a/sys/net/iflib.c
+++ b/sys/net/iflib.c
@@ -3984,7 +3984,7 @@ iflib_if_ioctl(if_t ifp, u_long command, caddr_t data)
 	{
 		struct ifi2creq i2c;
 
-		err = copyin(ifr->ifr_data, &i2c, sizeof(i2c));
+		err = copyin(ifr_data_get_ptr(ifr), &i2c, sizeof(i2c));
 		if (err != 0)
 			break;
 		if (i2c.dev_addr != 0xA0 && i2c.dev_addr != 0xA2) {
@@ -3997,7 +3997,8 @@ iflib_if_ioctl(if_t ifp, u_long command, caddr_t data)
 		}
 
 		if ((err = IFDI_I2C_REQ(ctx, &i2c)) == 0)
-			err = copyout(&i2c, ifr->ifr_data, sizeof(i2c));
+			err = copyout(&i2c, ifr_data_get_ptr(ifr),
+			    sizeof(i2c));
 		break;
 	}
 	case SIOCSIFCAP:
diff --git a/sys/net80211/ieee80211_ioctl.c b/sys/net80211/ieee80211_ioctl.c
index b5eaa2ca032b..2d10aa188607 100644
--- a/sys/net80211/ieee80211_ioctl.c
+++ b/sys/net80211/ieee80211_ioctl.c
@@ -3567,7 +3567,8 @@ ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 	case SIOCG80211STATS:
 		ifr = (struct ifreq *)data;
-		copyout(&vap->iv_stats, ifr->ifr_data, sizeof (vap->iv_stats));
+		copyout(&vap->iv_stats, ifr_data_get_ptr(ifr),
+		    sizeof (vap->iv_stats));
 		break;
 	case SIOCSIFMTU:
 		ifr = (struct ifreq *)data;
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
index d515aa93bd70..6753e589140b 100644
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -1708,7 +1708,7 @@ carp_ioctl(struct ifreq *ifr, u_long cmd, struct thread *td)
 	struct carp_softc *sc = NULL;
 	int error = 0, locked = 0;
 
-	if ((error = copyin(ifr->ifr_data, &carpr, sizeof carpr)))
+	if ((error = copyin(ifr_data_get_ptr(ifr), &carpr, sizeof carpr)))
 		return (error);
 
 	ifp = ifunit_ref(ifr->ifr_name);
@@ -1824,7 +1824,8 @@ carp_ioctl(struct ifreq *ifr, u_long cmd, struct thread *td)
 				break;
 			}
 			carp_carprcp(&carpr, sc, priveleged);
-			error = copyout(&carpr, ifr->ifr_data, sizeof(carpr));
+			error = copyout(&carpr, ifr_data_get_ptr(ifr),
+			    sizeof(carpr));
 		} else  {
 			int i, count;
 
@@ -1842,7 +1843,8 @@ carp_ioctl(struct ifreq *ifr, u_long cmd, struct thread *td)
 			IFNET_FOREACH_CARP(ifp, sc) {
 				carp_carprcp(&carpr, sc, priveleged);
 				carpr.carpr_count = count;
-				error = copyout(&carpr, ifr->ifr_data +
+				error = copyout(&carpr,
+				    (caddr_t)ifr_data_get_ptr(ifr) +
 				    (i * sizeof(carpr)), sizeof(carpr));
 				if (error) {
 					CIF_UNLOCK(ifp->if_carp);
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 2c3930de225c..bd2a6a4a40ac 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -1319,7 +1319,8 @@ pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		pfsyncr.pfsyncr_defer = (PFSYNCF_DEFER ==
 		    (sc->sc_flags & PFSYNCF_DEFER));
 		PFSYNC_UNLOCK(sc);
-		return (copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr)));
+		return (copyout(&pfsyncr, ifr_data_get_ptr(ifr),
+		    sizeof(pfsyncr)));
 
 	case SIOCSETPFSYNC:
 	    {
@@ -1330,7 +1331,8 @@ pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 
 		if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
 			return (error);
-		if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
+		if ((error = copyin(ifr_data_get_ptr(ifr), &pfsyncr,
+		    sizeof(pfsyncr))))
 			return (error);
 
 		if (pfsyncr.pfsyncr_maxupdates > 255)
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 5a87f47766bc..5c781e39491f 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -406,7 +406,7 @@ mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
 	if (!(mac_labeled & MPC_OBJECT_IFNET))
 		return (EINVAL);
 
-	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
+	error = copyin(ifr_data_get_ptr(ifr), &mac, sizeof(mac));
 	if (error)
 		return (error);
 
@@ -449,7 +449,7 @@ mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifp)
 	if (!(mac_labeled & MPC_OBJECT_IFNET))
 		return (EINVAL);
 
-	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
+	error = copyin(ifr_data_get_ptr(ifr), &mac, sizeof(mac));
 	if (error)
 		return (error);