diff --git a/include/toksvc/toksvc.h b/include/toksvc/toksvc.h
index 99e1447..0958d9b 100644
--- a/include/toksvc/toksvc.h
+++ b/include/toksvc/toksvc.h
@@ -167,6 +167,7 @@ toks_api void toks_driver_unset_timeout (struct toks_driver_ctx *);
 
 /* core api */
 toks_api int  toks_service_abort        (struct toks_driver_ctx *);
+toks_api int  toks_service_ioctl        (struct toks_driver_ctx *, uint32_t ctlcode, uintptr_t * data, void * any);
 toks_api int  toks_service_start        (struct toks_common_ctx *, int ntokens, int32_t ctrlpid, int32_t csyspid);
 
 /* client api */
diff --git a/project/common.mk b/project/common.mk
index 004101a..e773276 100644
--- a/project/common.mk
+++ b/project/common.mk
@@ -27,6 +27,7 @@ INTERNAL_SRCS = \
 	src/internal/toksvc_open_impl.c \
 	src/log/toks_log_lpc_message.c \
 	src/service/toks_service_abort.c \
+	src/service/toks_service_ioctl.c \
 	src/service/toks_service_start.c \
 	src/skin/toks_skin_default.c \
 
diff --git a/src/service/toks_service_ioctl.c b/src/service/toks_service_ioctl.c
new file mode 100644
index 0000000..ee59bcd
--- /dev/null
+++ b/src/service/toks_service_ioctl.c
@@ -0,0 +1,62 @@
+/*********************************************************/
+/*  toksvc: a framework-native token broker service      */
+/*  Copyright (C) 2020  Z. Gilboa                        */
+/*  Released under GPLv2 and GPLv3; see COPYING.TOKSVC.  */
+/*********************************************************/
+
+#include <psxtypes/psxtypes.h>
+#include <ntapi/ntapi.h>
+
+#include <toksvc/toksvc.h>
+#include "toksvc_driver_impl.h"
+#include "toksvc_daemon_impl.h"
+
+int32_t toks_service_ioctl(
+	struct toks_driver_ctx *  dctx,
+	uint32_t                  ctlcode,
+	uintptr_t *               data,
+	void *                    any)
+{
+	int32_t			status;
+	void *			hport;
+	struct _nt_tty_sync_msg	msg;
+
+	hport = toks_get_driver_hservice(dctx);
+
+	ntapi->tt_aligned_block_memset(
+		&msg,0,sizeof(msg));
+
+	msg.header.msg_type	= NT_LPC_NEW_MESSAGE;
+	msg.header.data_size	= sizeof(msg.data);
+	msg.header.msg_size	= sizeof(msg);
+	msg.data.ttyinfo.opcode	= TOKS_DAEMON_IOCTL;
+	msg.data.ttyinfo.opdata	= ctlcode;
+
+	switch (ctlcode) {
+		case TOKS_IOCTL_SET_TOKEN_COUNT:
+			msg.data.ttyinfo.exarg = (void *)(intptr_t)*data;
+			break;
+
+		default:
+			(void)any;
+			break;
+	}
+
+	if ((status = ntapi->zw_request_wait_reply_port(hport,&msg,&msg)))
+		return status;
+
+	else if (msg.data.ttyinfo.status)
+		return msg.data.ttyinfo.status;
+
+	switch (ctlcode) {
+		case TOKS_IOCTL_GET_TOKEN_COUNT:
+			*data = (int)(intptr_t)msg.data.ttyinfo.exarg;
+			break;
+
+		default:
+			(void)any;
+			break;
+	}
+
+	return NT_STATUS_SUCCESS;
+}