Some documentation for the 802.11 stack written by

Bruce M. Simpson and Darron Broad for FreeBSD, adapted to reflect
the state of our stack.  Help from and ok jmc@

9 files changed, 1397 insertions, 2 deletions

diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile
index 44d3c524681..706dd23598b 100644
--- a/share/man/man9/Makefile
+++ b/share/man/man9/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.90 2005/03/01 19:22:10 damien Exp $
+#	$OpenBSD: Makefile,v 1.91 2005/04/04 12:48:42 jsg Exp $
 #	$NetBSD: Makefile,v 1.4 1996/01/09 03:23:01 thorpej Exp $
 
 #	Makefile for section 9 (kernel function and variable) manual pages.
@@ -9,7 +9,11 @@ MAN=	altq.9 audio.9 autoconf.9 boot.9 buffercache.9 bus_dma.9 bus_space.9 \
 	domountroothooks.9 doshutdownhooks.9 dostartuphooks.9 \
 	evcount.9 extattr.9 file.9 \
 	fork1.9 extent.9 getdevvp.9 getnewvnode.9 hash.9 hashinit.9 \
-	hardclock.9 hook_establish.9 hz.9 hzto.9 iic.9 intro.9 inittodr.9 \
+	hardclock.9 hook_establish.9 hz.9 hzto.9 \
+	ieee80211.9 ieee80211_crypto.9 ieee80211_input.9 ieee80211_ioctl.9 \
+	ieee80211_node.9 ieee80211_output.9 ieee80211_proto.9 \
+	ieee80211_radiotap.9 \
+	iic.9 intro.9 inittodr.9 \
 	kern.9 knote.9 kthread.9 ktrace.9 loadfirmware.9 lock.9 log.9 \
 	malloc.9 mbuf.9 mbuf_tags.9 md5.9 microtime.9 \
 	mountroothook_establish.9 mutex.9 namei.9 \
@@ -118,6 +122,51 @@ MLINKS+=file.9 falloc.9 file.9 fdrelease.9 file.9 FREF.9 file.9 FRELE.9 \
 MLINKS+=getdevvp.9 bdevvp.9 getdevvp.9 cdevvp.9
 MLINKS+=hook_establish.9 hook_disestablish.9
 MLINKS+=hz.9 tick.9 hz.9 tickadj.9 hz.9 stathz.9 hz.9 profhz.9
+MLINKS+=ieee80211.9 ieee80211_ifattach.9 \
+	ieee80211.9 ieee80211_ifdetach.9 \
+	ieee80211.9 ieee80211_mhz2ieee.9 \
+	ieee80211.9 ieee80211_chan2ieee.9 \
+	ieee80211.9 ieee80211_ieee2mhz.9 \
+	ieee80211.9 ieee80211_media_init.9 \
+	ieee80211.9 ieee80211_media_change.9 \
+	ieee80211.9 ieee80211_media_status.9 \
+	ieee80211.9 ieee80211_watchdog.9 \
+	ieee80211.9 ieee80211_setmode.9 \
+	ieee80211.9 ieee80211_chan2mode.9 \
+	ieee80211.9 ieee80211_rate2media.9 \
+	ieee80211.9 ieee80211_media2rate.9
+MLINKS+=ieee80211_crypto.9 ieee80211_crypto_attach.9 \
+	ieee80211_crypto.9 ieee80211_crypto_detach.9 \
+	ieee80211_crypto.9 ieee80211_wep_crypt.9
+MLINKS+=ieee80211_input.9 ieee80211_decap.9 \
+	ieee80211_input.9 ieee80211_recv_mgmt.9
+MLINKS+=ieee80211_ioctl.9 ieee80211_cfgget.9 \
+	ieee80211_ioctl.9 ieee80211_cfgset.9
+MLINKS+=ieee80211_node.9 ieee80211_node_attach.9 \
+	ieee80211_node.9 ieee80211_node_lateattach.9 \
+	ieee80211_node.9 ieee80211_node_detach.9 \
+	ieee80211_node.9 ieee80211_begin_scan.9 \
+	ieee80211_node.9 ieee80211_next_scan.9 \
+	ieee80211_node.9 ieee80211_create_ibss.9 \
+	ieee80211_node.9 ieee80211_end_scan.9 \
+	ieee80211_node.9 ieee80211_alloc_node.9 \
+	ieee80211_node.9 ieee80211_dup_bss.9 \
+	ieee80211_node.9 ieee80211_find_node.9 \
+	ieee80211_node.9 ieee80211_lookup_node.9 \
+	ieee80211_node.9 ieee80211_release_node.9 \
+	ieee80211_node.9 ieee80211_free_node.9 \
+	ieee80211_node.9 ieee80211_free_allnodes.9 \
+	ieee80211_node.9 ieee80211_iterate_nodes.9
+MLINKS+=ieee80211_output.9 ieee80211_encap.9 \
+	ieee80211_output.9 ieee80211_add_rates.9 \
+	ieee80211_output.9 ieee80211_add_xrates.9 \
+	ieee80211_output.9 ieee80211_compute_duration.9 \
+	ieee80211_output.9 ieee80211_send_mgmt.9
+MLINKS+=ieee80211_proto.9 ieee80211_proto_attach.9 \
+	ieee80211_proto.9 ieee80211_proto_detach.9 \
+	ieee80211_proto.9 ieee80211_print_essid.9 \
+	ieee80211_proto.9 ieee80211_dump_pkt.9 \
+	ieee80211_proto.9 ieee80211_fix_rate.9
 MLINKS+=knote.9 KNOTE.9
 MLINKS+=kthread.9 kthread_create.9 kthread.9 kthread_exit.9 \
 	kthread.9 kthread_create_deferred.9
diff --git a/share/man/man9/ieee80211.9 b/share/man/man9/ieee80211.9
new file mode 100644
index 00000000000..c721f4ff77a
--- /dev/null
+++ b/share/man/man9/ieee80211.9
@@ -0,0 +1,262 @@
+.\"	$OpenBSD: ieee80211.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211.9,v 1.3 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211 9
+.Os
+.Sh NAME
+.Nm ieee80211_ifattach , ieee80211_ifdetach ,
+.Nm ieee80211_mhz2ieee , ieee80211_chan2ieee , ieee80211_ieee2mhz ,
+.Nm ieee80211_media_init , ieee80211_media_change , ieee80211_media_status ,
+.Nm ieee80211_watchdog ,
+.Nm ieee80211_setmode , ieee80211_chan2mode ,
+.Nm ieee80211_rate2media , ieee80211_media2rate
+.Nd core 802.11 network stack functions
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_proto.h
+.Ft void
+.Fn ieee80211_ifattach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_ifdetach "struct ifnet *ifp"
+.Ft u_int
+.Fn ieee80211_mhz2ieee "u_int freq" "u_int flags"
+.Ft u_int
+.Fn ieee80211_chan2ieee "struct ieee80211com *ic" "struct ieee80211_channel *c"
+.Ft u_int
+.Fn ieee80211_ieee2mhz "u_int chan" "u_int flags"
+.Ft void
+.Fo ieee80211_media_init
+.Fa "struct ifnet *ifp" "ifm_change_cb_t media_change"
+.Fa "ifm_stat_cb_t media_stat"
+.Fc
+.Fa int
+.Fn ieee80211_media_change "struct ifnet *ifp"
+.Fa void
+.Fn ieee80211_media_status "struct ifnet *ifp" "struct ifmediareq *imr"
+.Ft void
+.Fn ieee80211_watchdog "struct ifnet *ifp"
+.Ft int
+.Fn ieee80211_setmode "struct ieee80211com *ic" "enum ieee80211_phymode mode"
+.Ft enum ieee80211_phymode
+.Fo ieee80211_chan2mode
+.Fa "struct ieee80211com *ic" "struct ieee80211_channel *chan"
+.Fc
+.Ft int
+.Fo ieee80211_rate2media
+.Fa "struct ieee80211com *ic" "int rate" "enum ieee80211_phymode mode"
+.Fc
+.Ft int
+.Fn ieee80211_media2rate "int mword"
+.Sh DESCRIPTION
+The
+.Nm ieee80211
+collection of functions are used to manage wireless network interfaces in the
+system which use the system's software 802.11 network stack.
+Most of these functions require that attachment to the stack is performed
+before calling.
+Several utility functions are also provided; these are safe to call from
+any driver without prior initialization.
+.Pp
+.\"
+The
+.Fn ieee80211_ifattach
+function attaches the network interface
+.Fa ifp
+to the 802.11 network stack layer.
+This function must be called before using any of the
+.Nm ieee80211
+functions which need to store driver state across invocations;
+The
+.Vt struct ifnet
+instance pointed to by
+.Fa ifp
+MUST be an instance of
+.Vt struct ieee80211com ,
+with various fields initialized to tell
+.Nm ieee80211
+about its capabilities.
+This function performs Ethernet and BPF attachment (by calling
+.Fn ether_ifattach
+and
+.Fn bpfattach )
+on behalf of the caller.
+It also implements the
+.Vt ifmedia
+interface.
+.Pp
+.\"
+The
+.Fn ieee80211_ifdetach
+function frees any
+.Nm ieee80211
+structures associated with the driver, and performs Ethernet and BPF
+detachment on behalf of the caller.
+.Pp
+.\"
+The
+.Fn ieee80211_mhz2ieee
+utility function converts the frequency
+.Fa freq
+(specified in MHz) to an IEEE 802.11 channel number.
+The
+.Fa flags
+argument is a hint which specifies whether the frequency is in
+the 2GHz ISM band
+.Pq Vt IEEE80211_CHAN_2GHZ
+or the 5GHz band
+.Pq Vt IEEE80211_CHAN_5GHZ ;
+appropriate clipping of the result is then performed.
+.Pp
+.\"
+The
+.Fn ieee80211_chan2ieee
+function converts the channel specified in
+.Fa *c
+to an IEEE channel number for the driver
+.Fa ic .
+If the conversion would be invalid, an error message is printed to the
+system console.
+This function REQUIRES that the driver is hooked up to the
+.Nm ieee80211
+subsystem.
+.Pp
+.\"
+The
+.Fn ieee80211_ieee2mhz
+utility function converts the IEEE channel number
+.Ft chan
+to a frequency (in MHz).
+The
+.Fa flags
+argument is a hint which specifies whether the frequency is in
+the 2GHz ISM band
+.Pq Vt IEEE80211_CHAN_2GHZ
+or the 5GHz band
+.Pq Vt IEEE80211_CHAN_5GHZ ;
+appropriate clipping of the result is then performed.
+.Pp
+.\"
+The
+.Fn ieee80211_media_init
+function initializes media data structures used by the
+.Vt ifmedia
+interface, for the driver
+.Fa ifp .
+It must be called by the driver after calling
+.Fn ieee80211_ifattach
+and before calling most
+.Nm ieee80211
+functions.
+The
+.Fa media_change
+and
+.Fa media_stat
+arguments specify helper functions which will be invoked by the
+.Vt ifmedia
+framework when the user changes or queries media options,
+using a command such as
+.Xr ifconfig 8 .
+.Pp
+.\"
+The
+.Fn ieee80211_media_status
+and
+.Fn ieee80211_media_change
+functions are device-independent handlers for
+.Vt ifmedia
+commands and are not intended to be called directly.
+.Pp
+.\"
+The
+.Fn ieee80211_watchdog
+function is intended to be called from a driver's
+.Va if_watchdog
+routine.
+It is used to perform periodic cleanup of state within the software 802.11
+stack, as well as timing out scans.
+.Pp
+.\"
+The
+.Fn ieee80211_setmode
+function is called from within the 802.11 stack to change the mode
+of the driver's PHY; it is not intended to be called directly.
+.Pp
+.\"
+The
+.Fn ieee80211_chan2mode
+function returns the PHY mode required for use with the channel
+.Fa chan
+on the device
+.Fa ic .
+This is typically used when selecting a rate set, to be advertised in
+beacons, for example.
+.Pp
+.\"
+The
+.Fn ieee80211_rate2media
+function converts the bit rate
+.Fa rate
+(measured in units of 0.5Mbps) to an
+.Vt ifmedia
+sub-type, for the device
+.Fa ic
+running in PHY mode
+.Fa mode .
+The
+.Fn ieee80211_media2rate
+performs the reverse of this conversion, returning the bit rate (in 0.5Mbps
+units) corresponding to an
+.Vt ifmedia
+sub-type.
+.\"
+.Sh SEE ALSO
+.Xr ifmedia 4 ,
+.Xr ieee80211_crypto 9 ,
+.Xr ieee80211_input 9 ,
+.Xr ieee80211_ioctl 9 ,
+.Xr ieee80211_node 9 ,
+.Xr ieee80211_output 9 ,
+.Xr ieee80211_proto 9 ,
+.Xr ieee80211_radiotap 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
diff --git a/share/man/man9/ieee80211_crypto.9 b/share/man/man9/ieee80211_crypto.9
new file mode 100644
index 00000000000..83d095e2c8f
--- /dev/null
+++ b/share/man/man9/ieee80211_crypto.9
@@ -0,0 +1,100 @@
+.\"	$OpenBSD: ieee80211_crypto.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_crypto.9,v 1.2 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_crypto.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211_CRYPTO 9
+.Os
+.Sh NAME
+.Nm ieee80211_crypto_attach , ieee80211_crypto_detach , ieee80211_wep_crypt
+.Nd 802.11 WEP encryption functions
+.Sh SYNOPSIS
+.Ft void
+.Fn ieee80211_crypto_attach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_crypto_detach "struct ifnet *ifp"
+.Ft struct mbuf *
+.Fn ieee80211_wep_crypt "struct ifnet *ifp" "struct mbuf *m0" "int txflag"
+.Sh DESCRIPTION
+These functions provide software encryption support
+for 802.11 device drivers.
+.Pp
+.\"
+The
+.Fn ieee80211_crypto_attach
+function initializes crypto support for the interface
+.Fa ifp ,
+and sets the initialization vector (IV) for WEP encryption to
+a random number derived from a secure PRNG.
+.Pp
+.\"
+The
+.Fn ieee80211_crypto_detach
+function frees data structures associated with crypto support
+for the interface
+.Fa ifp .
+.Pp
+.\"
+The
+.Fn ieee80211_wep_crypt
+function runs the appropriate WEP encryption algorithm over the 802.11
+encapsulated frame held in the mbuf chain
+.Fa m0 ,
+for transmission or reception on the interface
+.Fa ifp .
+The
+.Fa txflag
+argument specifies whether the frame is being received or transmitted.
+A value of 0 indicates that the frame is being received and should
+therefore be decrypted; a non-zero value indicates that the frame
+is being transmitted
+and should be encrypted.
+.\"
+.Sh IMPLEMENTATION NOTES
+The
+.Fn ieee80211_wep_crypt
+function stores its IV in the interface's embedded
+.Vt struct ieee80211com
+instance.
+.Sh SEE ALSO
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6 
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
diff --git a/share/man/man9/ieee80211_input.9 b/share/man/man9/ieee80211_input.9
new file mode 100644
index 00000000000..9a570cc488b
--- /dev/null
+++ b/share/man/man9/ieee80211_input.9
@@ -0,0 +1,114 @@
+.\"	$OpenBSD: ieee80211_input.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_input.9,v 1.2 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_input.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211_INPUT 9
+.Os
+.Sh NAME
+.Nm ieee80211_input , ieee80211_decap , ieee80211_recv_mgmt
+.Nd software 802.11 stack input functions
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_proto.h
+.Ft void
+.Fo ieee80211_input
+.Fa "struct ifnet *ifp" "struct mbuf *m" "struct ieee80211_node *ni"
+.Fa "int rssi" "u_int32_t rstamp"
+.Fc
+.Ft struct mbuf *
+.Fn ieee80211_decap "struct ifnet *ifp" "struct mbuf *m"
+.Ft void
+.Fo ieee80211_recv_mgmt
+.Fa "struct ieee80211com *ic" "struct mbuf *m0" "struct ieee80211_node *ni"
+.Fa "int subtype" "int rssi" "u_int32_t rstamp"
+.Fc
+.Sh DESCRIPTION
+These
+functions process received 802.11 frames.
+.Pp
+.\"
+The
+.Fn ieee80211_input
+function takes an mbuf chain
+.Fa m
+containing a complete 802.11 frame from the driver
+.Fa ifp
+and passes it to the software 802.11 stack for input processing.
+The
+.Fa ni
+argument specifies an instance of
+.Vt struct ieee80211_node
+(which may be driver-specific) representing the node from which the
+frame was received.
+The arguments
+.Fa rssi
+and
+.Fa stamp
+are typically derived from on-card data structures; they are used for
+recording the signal strength and time received of the frame respectively.
+.Pp
+.\"
+The
+.Fn ieee80211_decap
+function performs decapsulation of the 802.11 frame in the mbuf chain
+.Fa m
+received by the device
+.Fa ifp ,
+taking the form of the 802.11 address fields into account;
+the structure of 802.11 addresses vary according to the intended
+source and destination of the frame.
+It is typically called from within
+.Fn ieee80211_input .
+.Pp
+.\"
+The
+.Fn ieee80211_recv_mgmt
+performs input processing for 802.11 management frames.
+It is typically called from within
+.Fn ieee80211_input .
+.\"
+.Sh SEE ALSO
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
+.Sh BUGS
+There is no netisr queue specifically for the software 802.11 stack yet.
diff --git a/share/man/man9/ieee80211_ioctl.9 b/share/man/man9/ieee80211_ioctl.9
new file mode 100644
index 00000000000..dec211d9571
--- /dev/null
+++ b/share/man/man9/ieee80211_ioctl.9
@@ -0,0 +1,97 @@
+.\"	$OpenBSD: ieee80211_ioctl.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_ioctl.9,v 1.2 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_ioctl.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211_IOCTL 9
+.Os
+.Sh NAME
+.Nm ieee80211_cfgget , ieee80211_cfgset , ieee80211_ioctl
+.Nd 802.11 interface ioctl commands
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_proto.h
+.In net80211/ieee80211_ioctl.h
+.Ft int
+.Fn ieee80211_cfgget "struct ifnet *ifp" "u_long cmd" "caddr_t data"
+.Ft int
+.Fn ieee80211_cfgset "struct ifnet *ifp" "u_long cmd" "caddr_t data"
+.Ft int
+.Fn ieee80211_ioctl "struct ifnet *ifp" "u_long cmd" "caddr_t data"
+.Sh DESCRIPTION
+These
+functions are typically invoked by drivers in response to requests
+for information or to change settings from the userland.
+.Pp
+.\"
+The
+.Fn ieee80211_cfgget
+and
+.Fn ieee80211_cfgset
+functions implement a legacy interface for getting and setting 802.11
+interface attributes respectively.
+The interface is compatible with the RIDs used by the
+.Xr wicontrol 8
+utility.
+.Pp
+.\"
+The
+.Fn ieee80211_ioctl
+function provides a default implementation of the
+.Dv SIOCS80211
+and
+.Dv SIOCG80211
+ifioctls commands for 802.11 drivers.
+The call signature is identical to that of the
+.Va if_ioctl
+member found in
+.Vt struct ifnet ,
+however, many drivers store attributes such as
+.Dv IEEE80211_IOC_STATIONNAME
+in the driver's private soft state structure, so driver writers may prefer
+to use this as the catch-all in a switch statement to avoid code duplication.
+.\"
+.Sh SEE ALSO
+.Xr ifconfig 8 ,
+.Xr wicontrol 8 ,
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
diff --git a/share/man/man9/ieee80211_node.9 b/share/man/man9/ieee80211_node.9
new file mode 100644
index 00000000000..2717ec0b8a2
--- /dev/null
+++ b/share/man/man9/ieee80211_node.9
@@ -0,0 +1,285 @@
+.\"	$OpenBSD: ieee80211_node.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_node.9,v 1.3 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_node.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd July 4, 2004
+.Dt IEEE80211_NODE 9
+.Os
+.Sh NAME
+.Nm ieee80211_node_attach ,
+.Nm ieee80211_node_lateattach ,
+.Nm ieee80211_node_detach ,
+.Nm ieee80211_begin_scan ,
+.Nm ieee80211_next_scan ,
+.Nm ieee80211_create_ibss ,
+.Nm ieee80211_end_scan ,
+.Nm ieee80211_alloc_node ,
+.Nm ieee80211_dup_bss ,
+.Nm ieee80211_find_node ,
+.Nm ieee80211_lookup_node ,
+.Nm ieee80211_release_node ,
+.Nm ieee80211_free_node ,
+.Nm ieee80211_free_allnodes ,
+.Nm ieee80211_iterate_nodes
+.Nd software 802.11 stack node management functions
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_proto.h
+.In net80211/ieee80211_node.h
+.Ft void
+.Fn ieee80211_node_attach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_node_lateattach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_node_detach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_begin_scan "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_next_scan "struct ifnet *ifp"
+.Ft void
+.Fo ieee80211_create_ibss
+.Fa "struct ieee80211com *ic" "struct ieee80211_channel *chan"
+.Fc
+.Ft void
+.Fn ieee80211_end_scan "struct ifnet *ifp"
+.Ft struct ieee80211_node *
+.Fn ieee80211_alloc_node "struct ieee80211com *ic" "u_int8_t *macaddr"
+.Ft struct ieee80211_node *
+.Fn ieee80211_dup_bss "struct ieee80211com *ic" "u_int8_t *macaddr"
+.Ft struct ieee80211_node *
+.Fn ieee80211_find_node "struct ieee80211com *ic" "u_int8_t *macaddr"
+.Ft struct ieee80211_node *
+.Fo ieee80211_lookup_node
+.Fa "struct ieee80211com *ic" "u_int8_t *macaddr"
+.Fa "struct ieee80211_channel *chan"
+.Fc
+.Ft void
+.Fn ieee80211_release_node "struct ieee80211com *ic" "struct ieee80211_node *ni"
+.Ft void
+.Fn ieee80211_free_node "struct ieee80211com *ic" "struct ieee80211_node *ni"
+.Ft void
+.Fn ieee80211_free_allnodes "struct ieee80211com *ic"
+.Ft void
+.Fo ieee80211_iterate_nodes
+.Fa "struct ieee80211com *ic" "ieee80211_iter_func *f" "void *arg"
+.Fc
+.Sh DESCRIPTION
+These functions are used to manage node lists within the software
+802.11 stack.
+These lists are typically used for implementing host-mode AP functionality,
+or providing signal quality information about neighbouring nodes.
+.Pp
+.\"
+The
+.Fn ieee80211_node_attach
+function is called from
+.Xr ieee80211_ifattach 9
+to initialize node database management callbacks for the interface
+.Fa ifp
+(specifically for memory allocation, node copying and node
+signal inspection).
+These functions may be overridden in special circumstances,
+as long as this is done after calling
+.Xr ieee80211_ifattach 9
+and prior to any other call which may allocate a node.
+.Pp
+.\"
+The
+.Fn ieee80211_node_lateattach
+function initialises the
+.Va ic_bss
+node element of the interface
+.Fa ifp
+during
+.Xr ieee80211_media_init 9 .
+This late attachment is to account for certain special cases described under
+.Fn ieee80211_node_attach .
+.Pp
+.\"
+The
+.Fn ieee80211_node_detach
+function destroys all node database state associated with the interface
+.Fa ifp ,
+and is usually called during device detach.
+.Pp
+.\"
+The
+.Fn ieee80211_begin_scan
+function initialises the node database in preparation of an active
+scan for an access point on the interface
+.Fa ifp .
+The scan begins on the next radio channel by calling
+.Fn ieee80211_next_scan
+internally.
+The actual scanning for an access point is not automated;
+the device driver itself only handles setting the radio frequency
+of the card and stepping through the channels.
+.Pp
+.\"
+The
+.Fn ieee80211_next_scan
+function is used to inform the
+.Xr ieee80211 9
+layer that the interface
+.Fa ifp
+is now scanning for an access point on the next radio channel.
+A device driver is expected to first call
+.Fn ieee80211_begin_scan ,
+to initialize the node database,
+then set the radio channel on the device;
+then, after a certain time has elapsed (200ms for example), call
+.Fn ieee80211_next_scan
+to move to the next channel.
+Typically, a timeout is used to automate this process; see
+.Xr timeout 9
+for more information on how to use timeouts.
+.Pp
+.\"
+The
+.Fn ieee80211_create_ibss
+function sets up the net80211-specific portion of an interface's softc,
+.Fa ic ,
+for use in IBSS mode.
+.Pp
+.\"
+The
+.Fn ieee80211_end_scan
+function is called by
+.Fn ieee80211_next_scan
+when the state machine has peformed a full cycle of scanning on
+all available radio channels.
+Internally,
+.Fn ieee80211_end_scan
+will inspect the node cache associated with the interface
+.Fa ifp
+for suitable access points found during scanning, and associate with one,
+should the parameters of the node match those of the configuration
+requested from userland.
+.Pp
+.\"
+The
+.Fn ieee80211_alloc_node
+function allocates an instance of
+.Vt "struct ieee80211_node"
+for a node having the MAC address
+.Fa macaddr ,
+and associates it with the interface
+.Fa ic .
+If the allocation is successful, the node structure is initialised by
+.Fn ieee80211_setup_node ;
+otherwise,
+.Dv NULL
+is returned.
+.Pp
+.\"
+The
+.Fn ieee80211_dup_bss
+function is similar to
+.Fn ieee80211_alloc_node ,
+but is instead used to create a node database entry for the BSSID
+.Fa macaddr
+associated with the interface
+.Fa ic .
+If the allocation is successful, the node structure is initialised by
+.Fn ieee80211_setup_node ;
+otherwise,
+.Dv NULL
+is returned.
+.Pp
+.\"
+The
+.Fn ieee80211_find_node
+function will iterate through the node list associated with the interface
+.Fa ic ,
+searching for a node entry which matches
+.Fa macaddr .
+If the entry is found, its reference count is incremented, and
+a pointer to the node is returned; otherwise,
+.Dv NULL
+will be returned.
+.Pp
+.\"
+The
+.Fn ieee80211_lookup_node
+function is similar to
+.Fn ieee80211_find_node ,
+with an additional argument
+.Fa chan
+which is used to specify a channel for the match.
+If the entry is found, its reference count is incremented, and
+a pointer to the node is returned; otherwise,
+.Dv NULL
+will be returned.
+.Pp
+.\"
+The
+.Fn ieee80211_free_node
+function will remove the node
+.Fa ni
+from the node database entries associated with the interface
+.Fa ic ,
+and free any memory associated with the node.
+This private method can be overridden in
+.Fn ieee80211_node_attach .
+.\"
+.Pp
+The
+.Fn ieee80211_free_allnodes
+function will iterate through the node list calling
+.Fn ieee80211_free_node
+for all nodes associated with the interface
+.Fa ic .
+.Pp
+.\"
+The
+.Fn ieee80211_iterate_nodes
+function will call the user-defined callback function
+.Fa f
+for all nodes in the node database associated with the interface
+.Fa ic .
+The callback is invoked with the with the user-supplied value
+.Fa arg
+and a pointer to the current node.
+.\"
+.Sh SEE ALSO
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
diff --git a/share/man/man9/ieee80211_output.9 b/share/man/man9/ieee80211_output.9
new file mode 100644
index 00000000000..8e1d5b29203
--- /dev/null
+++ b/share/man/man9/ieee80211_output.9
@@ -0,0 +1,171 @@
+.\"	$OpenBSD: ieee80211_output.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_output.9,v 1.2 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_output.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211_OUTPUT 9
+.Os
+.Sh NAME
+.Nm ieee80211_encap , ieee80211_add_rates ,
+.Nm ieee80211_add_xrates , ieee80211_compute_duration
+.Nm ieee80211_send_mgmt
+.Nd software 802.11 stack output functions
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_proto.h
+.Ft struct mbuf *
+.Fo ieee80211_encap
+.Fa "struct ifnet *ifp" "struct mbuf *m" "struct ieee80211_node **pni"
+.Fc
+.Ft u_int8_t *
+.Fn ieee80211_add_rates "u_int8_t *frm" "const struct ieee80211_rateset *rs"
+.Ft u_int8_t *
+.Fn ieee80211_add_xrates "u_int8_t *frm" "const struct ieee80211_rateset *rs"
+.Ft int
+.Fo ieee80211_compute_duration
+.Fa "struct ieee80211_frame *wh"
+.Fa "int len"
+.Fa "uint32_t flags"
+.Fa "int fraglen"
+.Fa "int rate"
+.Fa "struct ieee80211_duration *d0"
+.Fa "struct ieee80211_duration *dn"
+.Fa "int *npktp"
+.Fa "int debug"
+.Fc
+.Ft int
+.Fo ieee80211_send_mgmt
+.Fa "struct ieee80211com *ic" "struct ieee80211_node *ni" "int type" "int arg"
+.Fc
+.Sh DESCRIPTION
+These functions handle the encapsulation and transmission of 802.11 frames
+within the software 802.11 stack.
+.Pp
+The
+.Fn ieee80211_encap
+function encapsulates an outbound data frame contained within the
+mbuf chain
+.Fa m
+from the interface
+.Fa ifp .
+The argument
+.Fa *pni
+is a reference to the destination node.
+.Pp
+If the function is successful, the mbuf chain is updated with the
+802.11 frame header prepended, and a pointer to the head of the chain
+is returned.
+If an error occurs,
+.Dv NULL
+will be returned, and
+.Fa *pni
+is also set to
+.Dv NULL .
+The caller is responsible for freeing the node reference if
+.Fa *pni
+is
+.Pf non- Dv NULL
+on return.
+The convention is that
+.Va ic_bss
+is not reference counted; the caller is responsible for maintaining this
+reference count.
+.Pp
+.\"
+The
+.Fn ieee80211_add_rates
+utility function is used to add the rate set element
+.Fa *rs
+to the frame
+.Fa frm .
+A pointer to the location in the buffer after the addition of the rate set
+is returned.
+It is typically used when constructing management frames from within the
+software 802.11 stack.
+.Pp
+.\"
+The
+.Fn ieee80211_add_xrates
+utility function is used to add the extended rate set element
+.Fa *rs
+to the frame
+.Fa frm .
+A pointer to the location in the buffer after the addition of the rate set
+is returned.
+It is typically used when constructing management frames from within the
+software 802.11 stack in 802.11g mode.
+.Pp
+.\"
+The
+.Fn ieee80211_compute_duration
+function computes for any packet the appropriate 802.11 Duration field,
+the PLCP Length field, as well as the Duration and Length fields for an RTS frame.
+.Pp
+.\"
+The
+.Fn ieee80211_send_mgmt
+function transmits a management frame on the interface
+.Fa ic
+to the destination node
+.Fa ni
+of type
+.Fa type .
+.Pp
+The argument
+.Fa arg
+specifies either a sequence number for authentication operations,
+a status code for [re]association operations,
+or a reason for deauthentication and deassociation operations.
+.Pp
+Nodes other than
+.Va ic_bss
+have their reference count incremented to reflect their use for an
+indeterminate amount of time.
+This reference is freed when the function returns.
+.Pp
+The function returns 0 if successful; if temporary buffer space is not
+available, the function returns
+.Er ENOMEM .
+.\"
+.Sh SEE ALSO
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
diff --git a/share/man/man9/ieee80211_proto.9 b/share/man/man9/ieee80211_proto.9
new file mode 100644
index 00000000000..1cdd528eeb9
--- /dev/null
+++ b/share/man/man9/ieee80211_proto.9
@@ -0,0 +1,76 @@
+.\"	$OpenBSD: ieee80211_proto.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004 Bruce M. Simpson <bms@spc.org>
+.\" Copyright (c) 2004 Darron Broad <darron@kewl.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_proto.9,v 1.2 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_proto.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211_PROTO 9
+.Os
+.Sh NAME
+.Nm ieee80211_proto_attach ,
+.Nm ieee80211_proto_detach ,
+.Nm ieee80211_print_essid ,
+.Nm ieee80211_dump_pkt ,
+.Nm ieee80211_fix_rate ,
+.Nm ieee80211_proto
+.Nd software 802.11 stack protocol helper functions
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_proto.h
+.Ft void
+.Fn ieee80211_proto_attach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_proto_detach "struct ifnet *ifp"
+.Ft void
+.Fn ieee80211_print_essid "u_int8_t *essid" "int len"
+.Ft void
+.Fn ieee80211_dump_pkt "u_int8_t *buf" "int len" "int rate" "int rssi"
+.Ft int
+.Fo ieee80211_fix_rate
+.Fa "struct ieee80211com *ic" "struct ieee80211_node *ni" "int flags"
+.Fc
+.Sh DESCRIPTION
+These
+functions are helper functions used throughout the software 802.11 protocol
+stack.
+.Sh SEE ALSO
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm ieee80211
+series of functions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.Sh AUTHORS
+This man page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .
diff --git a/share/man/man9/ieee80211_radiotap.9 b/share/man/man9/ieee80211_radiotap.9
new file mode 100644
index 00000000000..e5fc5ca1343
--- /dev/null
+++ b/share/man/man9/ieee80211_radiotap.9
@@ -0,0 +1,241 @@
+.\"	$OpenBSD: ieee80211_radiotap.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.\" Copyright (c) 2004	Bruce M. Simpson <bms@spc.org>,
+.\"			Darron Broad <darron@kewl.org>,
+.\"			David Young <dyoung@pobox.com>.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: src/share/man/man9/ieee80211_radiotap.9,v 1.3 2004/07/07 12:59:39 ru Exp $
+.\" $Id: ieee80211_radiotap.9,v 1.1 2005/04/04 12:48:42 jsg Exp $
+.\"
+.Dd March 2, 2004
+.Dt IEEE80211_RADIOTAP 9
+.Os
+.Sh NAME
+.Nm ieee80211_radiotap
+.Nd software 802.11 stack packet capture definitions
+.Sh SYNOPSIS
+.In net80211/ieee80211_var.h
+.In net80211/ieee80211_ioctl.h
+.In net80211/ieee80211_radiotap.h
+.In net/bpf.h
+.\"
+.Sh DESCRIPTION
+The
+.Nm
+definitions provide a device-independent
+.Xr bpf 4
+attachment for the
+capture of information about 802.11 traffic which is not part of
+the 802.11 frame structure.
+.Pp
+Radiotap was designed to balance the desire for a capture format
+that conserved CPU and memory bandwidth on embedded systems,
+with the desire for a hardware-independent, extensible format
+that would support the diverse capabilities of virtually all
+802.11
+radios.
+.Pp
+These considerations led radiotap to settle on a format consisting of
+a standard preamble followed by an extensible bitmap indicating the
+presence of optional capture fields.
+.Pp
+The capture fields were packed into the header as compactly as possible,
+modulo the requirements that they had to be packed swiftly,
+with suitable alignment, in the same order as the bits indicating
+their presence.
+.Pp
+This typically includes information such as signal quality and
+timestamps.
+This information may be used by a variety of user agents, including
+.Xr tcpdump 1 .
+It is requested by using the
+.Xr bpf 4
+data-link type
+.Dv DLT_IEEE_80211_RADIO .
+.Pp
+.\"
+Each frame using this attachment has the following header prepended to it:
+.Bd -literal -offset indent
+struct ieee80211_radiotap_header {
+	u_int8_t	it_version;	/* set to 0 */
+	u_int8_t	it_pad;
+	u_int16_t	it_len;		/* entire length */
+	u_int32_t	it_present;	/* fields present */
+} __attribute__((__packed__));
+.Ed
+.Pp
+.\"
+A device driver implementing
+.Vt radiotap
+typically defines a packed structure embedding an instance of
+.Vt "struct ieee80211_radiotap_header"
+at the beginning,
+with subsequent fields in the appropriate order,
+and a macro to set the bits of the
+.Va it_present
+bitmap to indicate which fields exist and are filled in by the driver.
+.\"
+.Pp
+Radiotap headers are copied to the userland via a separate bpf attachment.
+It is necessary for the driver to create this attachment after calling
+.Xr ieee80211_ifattach 9
+by calling
+.Fn bpfattach2
+with the data-link type set to
+.Dv DLT_IEEE_80211_RADIO .
+.Pp
+.\"
+When the the information is available,
+usually immediately before a link-layer transmission or after a receive,
+the driver copies it to the bpf layer using the
+.Fn bpf_mtap2
+function.
+.Pp
+.\"
+The following extension fields are defined for
+.Vt radiotap ,
+in the order in which they should appear in the buffer copied to userland:
+.Bl -tag -width indent
+.It Dv IEEE80211_RADIOTAP_TSFT
+This field contains the unsigned 64-bit value, in microseconds,
+of the MAC's 802.11 Time Synchronization Function timer,
+when the first bit of the MPDU arrived at the MAC.
+This field should be present for received frames only.
+.It Dv IEEE80211_RADIOTAP_FLAGS
+This field contains a single unsigned 8-bit value, containing a bitmap
+of flags specifying properties of the frame being transmitted or received.
+.It Dv IEEE80211_RADIOTAP_RATE
+This field contains a single unsigned 8-bit value, which is the data rate in
+use in units of 500Kbps.
+.It Dv IEEE80211_RADIOTAP_CHANNEL
+This field contains two unsigned 16-bit values.
+The first value is the frequency upon which this PDU was transmitted
+or received.
+The second value is a bitmap containing flags which specify properties of
+the channel in use.
+These are documented within the header file,
+.In net80211/ieee80211_radiotap.h .
+.It Dv IEEE80211_RADIOTAP_FHSS
+This field contains two 8-bit values.
+This field should be present for frequency-hopping radios only.
+The first byte is the hop set.
+The second byte is the pattern in use.
+.It Dv IEEE80211_RADIOTAP_DBM_ANTSIGNAL
+This field contains a single signed 8-bit value, which indicates the
+RF signal power at the antenna, in decibels difference from 1mW.
+.It Dv IEEE80211_RADIOTAP_DBM_ANTNOISE
+This field contains a single signed 8-bit value, which indicates the
+RF noise power at the antenna, in decibels difference from 1mW.
+.It Dv IEEE80211_RADIOTAP_LOCK_QUALITY
+This field contains a single unsigned 16-bit value, indicating the
+quality of the Barker Code lock.
+No unit is specified for this field.
+There does not appear to be a standard way of measuring this at this time;
+this quantity is often referred to as
+.Dq "Signal Quality"
+in some datasheets.
+.It Dv IEEE80211_RADIOTAP_TX_ATTENUATION
+This field contains a single unsigned 16-bit value, expressing transmit
+power as unitless distance from maximum power set at factory calibration.
+0 indicates maximum transmit power.
+Monotonically nondecreasing with lower power levels.
+.It Dv IEEE80211_RADIOTAP_DB_TX_ATTENUATION
+This field contains a single unsigned 16-bit value, expressing transmit
+power as decibel distance from maximum power set at factory calibration.
+0 indicates maximum transmit power.
+Monotonically nondecreasing with lower power levels.
+.It Dv IEEE80211_RADIOTAP_DBM_TX_POWER
+Transmit power expressed as decibels from a 1mW reference.
+This field is a single signed 8-bit value.
+This is the absolute power level measured at the antenna port.
+.It Dv IEEE80211_RADIOTAP_ANTENNA
+For radios which support antenna diversity, this field contains a single
+unsigned 8-bit value specifying which antenna is being used to transmit
+or receive this frame.
+The first antenna is antenna 0.
+.It Dv IEEE80211_RADIOTAP_DB_ANTSIGNAL
+This field contains a single unsigned 8-bit value, which indicates the
+RF signal power at the antenna, in decibels difference from an
+arbitrary, fixed reference.
+.It Dv IEEE80211_RADIOTAP_DB_ANTNOISE
+This field contains a single unsigned 8-bit value, which indicates the
+RF noise power at the antenna, in decibels difference from an
+arbitrary, fixed reference.
+.It Dv IEEE80211_RADIOTAP_EXT
+This bit is reserved for any future extensions to the
+.Vt radiotap
+structure.
+It should not be used at this time.
+.El
+.Sh EXAMPLES
+Radiotap header for the Realtek RTL8180L driver
+.Xr rtw 4 :
+.Bd -literal -offset indent
+struct rtw_rx_radiotap_header {
+	struct ieee80211_radiotap_header	rr_ihdr;
+	u_int64_t				rr_tsft;
+	u_int8_t				rr_flags;
+	u_int8_t				rr_rate;
+	u_int16_t				rr_chan_freq;
+	u_int16_t				rr_chan_flags;
+	u_int16_t				rr_barker_lock;
+	u_int8_t				rr_antsignal;
+} __attribute__((__packed__));
+.Ed
+.Pp
+Bitmap indicating which fields are present in the above structure:
+.Bd -literal -offset indent
+#define RTW_RX_RADIOTAP_PRESENT					\\
+	((1 << IEEE80211_RADIOTAP_TSFT)			|	\\
+	 (1 << IEEE80211_RADIOTAP_FLAGS)		|	\\
+	 (1 << IEEE80211_RADIOTAP_RATE)			|	\\
+	 (1 << IEEE80211_RADIOTAP_CHANNEL)		|	\\
+	 (1 << IEEE80211_RADIOTAP_LOCK_QUALITY)		|	\\
+	 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL)		|	\\
+	 0)
+.Ed
+.Sh SEE ALSO
+.Xr bpf 4 ,
+.Xr ieee80211 9
+.Sh HISTORY
+The
+.Nm
+definitions first appeared in
+.Nx 1.5 ,
+and were later ported to
+.Fx 4.6
+and
+.Ox 3.6 .
+.\"
+.Sh AUTHORS
+The
+.Nm
+interface was designed and implemented by
+.An David Young Aq dyoung@pobox.com .
+.Pp
+This manual page was written by
+.An Bruce M. Simpson Aq bms@FreeBSD.org
+and
+.An Darron Broad Aq darron@kewl.org .