xref: /freebsd/sbin/ifconfig/ifieee80211.c (revision 732a02b4e77866604a120a275c082bb6221bd2ff)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright 2001 The Aerospace Corporation.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of The Aerospace Corporation may not be used to endorse or
15  *    promote products derived from this software.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AEROSPACE CORPORATION ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AEROSPACE CORPORATION BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*-
33  * Copyright (c) 1997, 1998, 2000 The NetBSD Foundation, Inc.
34  * All rights reserved.
35  *
36  * This code is derived from software contributed to The NetBSD Foundation
37  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
38  * NASA Ames Research Center.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
50  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
51  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
52  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
53  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
54  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
55  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
56  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
57  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
58  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
59  * POSSIBILITY OF SUCH DAMAGE.
60  */
61 
62 #include <sys/param.h>
63 #include <sys/ioctl.h>
64 #include <sys/socket.h>
65 #include <sys/sysctl.h>
66 #include <sys/time.h>
67 
68 #include <net/ethernet.h>
69 #include <net/if.h>
70 #include <net/if_dl.h>
71 #include <net/if_types.h>
72 #include <net/if_media.h>
73 #include <net/route.h>
74 
75 #include <net80211/ieee80211_ioctl.h>
76 #include <net80211/ieee80211_freebsd.h>
77 #include <net80211/ieee80211_superg.h>
78 #include <net80211/ieee80211_tdma.h>
79 #include <net80211/ieee80211_mesh.h>
80 #include <net80211/ieee80211_wps.h>
81 
82 #include <assert.h>
83 #include <ctype.h>
84 #include <err.h>
85 #include <errno.h>
86 #include <fcntl.h>
87 #include <inttypes.h>
88 #include <stdio.h>
89 #include <stdlib.h>
90 #include <string.h>
91 #include <unistd.h>
92 #include <stdarg.h>
93 #include <stddef.h>		/* NB: for offsetof */
94 #include <locale.h>
95 #include <langinfo.h>
96 
97 #include "ifconfig.h"
98 
99 #include <lib80211/lib80211_regdomain.h>
100 #include <lib80211/lib80211_ioctl.h>
101 
102 #ifndef IEEE80211_FIXED_RATE_NONE
103 #define	IEEE80211_FIXED_RATE_NONE	0xff
104 #endif
105 
106 /* XXX need these publicly defined or similar */
107 #ifndef IEEE80211_NODE_AUTH
108 #define	IEEE80211_NODE_AUTH	0x000001	/* authorized for data */
109 #define	IEEE80211_NODE_QOS	0x000002	/* QoS enabled */
110 #define	IEEE80211_NODE_ERP	0x000004	/* ERP enabled */
111 #define	IEEE80211_NODE_PWR_MGT	0x000010	/* power save mode enabled */
112 #define	IEEE80211_NODE_AREF	0x000020	/* authentication ref held */
113 #define	IEEE80211_NODE_HT	0x000040	/* HT enabled */
114 #define	IEEE80211_NODE_HTCOMPAT	0x000080	/* HT setup w/ vendor OUI's */
115 #define	IEEE80211_NODE_WPS	0x000100	/* WPS association */
116 #define	IEEE80211_NODE_TSN	0x000200	/* TSN association */
117 #define	IEEE80211_NODE_AMPDU_RX	0x000400	/* AMPDU rx enabled */
118 #define	IEEE80211_NODE_AMPDU_TX	0x000800	/* AMPDU tx enabled */
119 #define	IEEE80211_NODE_MIMO_PS	0x001000	/* MIMO power save enabled */
120 #define	IEEE80211_NODE_MIMO_RTS	0x002000	/* send RTS in MIMO PS */
121 #define	IEEE80211_NODE_RIFS	0x004000	/* RIFS enabled */
122 #define	IEEE80211_NODE_SGI20	0x008000	/* Short GI in HT20 enabled */
123 #define	IEEE80211_NODE_SGI40	0x010000	/* Short GI in HT40 enabled */
124 #define	IEEE80211_NODE_ASSOCID	0x020000	/* xmit requires associd */
125 #define	IEEE80211_NODE_AMSDU_RX	0x040000	/* AMSDU rx enabled */
126 #define	IEEE80211_NODE_AMSDU_TX	0x080000	/* AMSDU tx enabled */
127 #define	IEEE80211_NODE_VHT	0x100000	/* VHT enabled */
128 #endif
129 
130 #define	MAXCHAN	1536		/* max 1.5K channels */
131 
132 #define	MAXCOL	78
133 static	int col;
134 static	char spacer;
135 
136 static void LINE_INIT(char c);
137 static void LINE_BREAK(void);
138 static void LINE_CHECK(const char *fmt, ...);
139 
140 static const char *modename[IEEE80211_MODE_MAX] = {
141 	[IEEE80211_MODE_AUTO]	  = "auto",
142 	[IEEE80211_MODE_11A]	  = "11a",
143 	[IEEE80211_MODE_11B]	  = "11b",
144 	[IEEE80211_MODE_11G]	  = "11g",
145 	[IEEE80211_MODE_FH]	  = "fh",
146 	[IEEE80211_MODE_TURBO_A]  = "turboA",
147 	[IEEE80211_MODE_TURBO_G]  = "turboG",
148 	[IEEE80211_MODE_STURBO_A] = "sturbo",
149 	[IEEE80211_MODE_11NA]	  = "11na",
150 	[IEEE80211_MODE_11NG]	  = "11ng",
151 	[IEEE80211_MODE_HALF]	  = "half",
152 	[IEEE80211_MODE_QUARTER]  = "quarter",
153 	[IEEE80211_MODE_VHT_2GHZ] = "11acg",
154 	[IEEE80211_MODE_VHT_5GHZ] = "11ac",
155 };
156 
157 static void set80211(int s, int type, int val, int len, void *data);
158 static int get80211(int s, int type, void *data, int len);
159 static int get80211len(int s, int type, void *data, int len, int *plen);
160 static int get80211val(int s, int type, int *val);
161 static const char *get_string(const char *val, const char *sep,
162     u_int8_t *buf, int *lenp);
163 static void print_string(const u_int8_t *buf, int len);
164 static void print_regdomain(const struct ieee80211_regdomain *, int);
165 static void print_channels(int, const struct ieee80211req_chaninfo *,
166     int allchans, int verbose);
167 static void regdomain_makechannels(struct ieee80211_regdomain_req *,
168     const struct ieee80211_devcaps_req *);
169 static const char *mesh_linkstate_string(uint8_t state);
170 
171 static struct ieee80211req_chaninfo *chaninfo;
172 static struct ieee80211_regdomain regdomain;
173 static int gotregdomain = 0;
174 static struct ieee80211_roamparams_req roamparams;
175 static int gotroam = 0;
176 static struct ieee80211_txparams_req txparams;
177 static int gottxparams = 0;
178 static struct ieee80211_channel curchan;
179 static int gotcurchan = 0;
180 static struct ifmediareq *ifmr;
181 static int htconf = 0;
182 static	int gothtconf = 0;
183 
184 static void
185 gethtconf(int s)
186 {
187 	if (gothtconf)
188 		return;
189 	if (get80211val(s, IEEE80211_IOC_HTCONF, &htconf) < 0)
190 		warn("unable to get HT configuration information");
191 	gothtconf = 1;
192 }
193 
194 /* VHT */
195 static int vhtconf = 0;
196 static	int gotvhtconf = 0;
197 
198 static void
199 getvhtconf(int s)
200 {
201 	if (gotvhtconf)
202 		return;
203 	if (get80211val(s, IEEE80211_IOC_VHTCONF, &vhtconf) < 0)
204 		warn("unable to get VHT configuration information");
205 	gotvhtconf = 1;
206 }
207 
208 /*
209  * Collect channel info from the kernel.  We use this (mostly)
210  * to handle mapping between frequency and IEEE channel number.
211  */
212 static void
213 getchaninfo(int s)
214 {
215 	if (chaninfo != NULL)
216 		return;
217 	chaninfo = malloc(IEEE80211_CHANINFO_SIZE(MAXCHAN));
218 	if (chaninfo == NULL)
219 		errx(1, "no space for channel list");
220 	if (get80211(s, IEEE80211_IOC_CHANINFO, chaninfo,
221 	    IEEE80211_CHANINFO_SIZE(MAXCHAN)) < 0)
222 		err(1, "unable to get channel information");
223 	ifmr = ifmedia_getstate(s);
224 	gethtconf(s);
225 	getvhtconf(s);
226 }
227 
228 static struct regdata *
229 getregdata(void)
230 {
231 	static struct regdata *rdp = NULL;
232 	if (rdp == NULL) {
233 		rdp = lib80211_alloc_regdata();
234 		if (rdp == NULL)
235 			errx(-1, "missing or corrupted regdomain database");
236 	}
237 	return rdp;
238 }
239 
240 /*
241  * Given the channel at index i with attributes from,
242  * check if there is a channel with attributes to in
243  * the channel table.  With suitable attributes this
244  * allows the caller to look for promotion; e.g. from
245  * 11b > 11g.
246  */
247 static int
248 canpromote(int i, int from, int to)
249 {
250 	const struct ieee80211_channel *fc = &chaninfo->ic_chans[i];
251 	u_int j;
252 
253 	if ((fc->ic_flags & from) != from)
254 		return i;
255 	/* NB: quick check exploiting ordering of chans w/ same frequency */
256 	if (i+1 < chaninfo->ic_nchans &&
257 	    chaninfo->ic_chans[i+1].ic_freq == fc->ic_freq &&
258 	    (chaninfo->ic_chans[i+1].ic_flags & to) == to)
259 		return i+1;
260 	/* brute force search in case channel list is not ordered */
261 	for (j = 0; j < chaninfo->ic_nchans; j++) {
262 		const struct ieee80211_channel *tc = &chaninfo->ic_chans[j];
263 		if (j != i &&
264 		    tc->ic_freq == fc->ic_freq && (tc->ic_flags & to) == to)
265 		return j;
266 	}
267 	return i;
268 }
269 
270 /*
271  * Handle channel promotion.  When a channel is specified with
272  * only a frequency we want to promote it to the ``best'' channel
273  * available.  The channel list has separate entries for 11b, 11g,
274  * 11a, and 11n[ga] channels so specifying a frequency w/o any
275  * attributes requires we upgrade, e.g. from 11b -> 11g.  This
276  * gets complicated when the channel is specified on the same
277  * command line with a media request that constrains the available
278  * channe list (e.g. mode 11a); we want to honor that to avoid
279  * confusing behaviour.
280  */
281 /*
282  * XXX VHT
283  */
284 static int
285 promote(int i)
286 {
287 	/*
288 	 * Query the current mode of the interface in case it's
289 	 * constrained (e.g. to 11a).  We must do this carefully
290 	 * as there may be a pending ifmedia request in which case
291 	 * asking the kernel will give us the wrong answer.  This
292 	 * is an unfortunate side-effect of the way ifconfig is
293 	 * structure for modularity (yech).
294 	 *
295 	 * NB: ifmr is actually setup in getchaninfo (above); we
296 	 *     assume it's called coincident with to this call so
297 	 *     we have a ``current setting''; otherwise we must pass
298 	 *     the socket descriptor down to here so we can make
299 	 *     the ifmedia_getstate call ourselves.
300 	 */
301 	int chanmode = ifmr != NULL ? IFM_MODE(ifmr->ifm_current) : IFM_AUTO;
302 
303 	/* when ambiguous promote to ``best'' */
304 	/* NB: we abitrarily pick HT40+ over HT40- */
305 	if (chanmode != IFM_IEEE80211_11B)
306 		i = canpromote(i, IEEE80211_CHAN_B, IEEE80211_CHAN_G);
307 	if (chanmode != IFM_IEEE80211_11G && (htconf & 1)) {
308 		i = canpromote(i, IEEE80211_CHAN_G,
309 			IEEE80211_CHAN_G | IEEE80211_CHAN_HT20);
310 		if (htconf & 2) {
311 			i = canpromote(i, IEEE80211_CHAN_G,
312 				IEEE80211_CHAN_G | IEEE80211_CHAN_HT40D);
313 			i = canpromote(i, IEEE80211_CHAN_G,
314 				IEEE80211_CHAN_G | IEEE80211_CHAN_HT40U);
315 		}
316 	}
317 	if (chanmode != IFM_IEEE80211_11A && (htconf & 1)) {
318 		i = canpromote(i, IEEE80211_CHAN_A,
319 			IEEE80211_CHAN_A | IEEE80211_CHAN_HT20);
320 		if (htconf & 2) {
321 			i = canpromote(i, IEEE80211_CHAN_A,
322 				IEEE80211_CHAN_A | IEEE80211_CHAN_HT40D);
323 			i = canpromote(i, IEEE80211_CHAN_A,
324 				IEEE80211_CHAN_A | IEEE80211_CHAN_HT40U);
325 		}
326 	}
327 	return i;
328 }
329 
330 static void
331 mapfreq(struct ieee80211_channel *chan, int freq, int flags)
332 {
333 	u_int i;
334 
335 	for (i = 0; i < chaninfo->ic_nchans; i++) {
336 		const struct ieee80211_channel *c = &chaninfo->ic_chans[i];
337 
338 		if (c->ic_freq == freq && (c->ic_flags & flags) == flags) {
339 			if (flags == 0) {
340 				/* when ambiguous promote to ``best'' */
341 				c = &chaninfo->ic_chans[promote(i)];
342 			}
343 			*chan = *c;
344 			return;
345 		}
346 	}
347 	errx(1, "unknown/undefined frequency %u/0x%x", freq, flags);
348 }
349 
350 static void
351 mapchan(struct ieee80211_channel *chan, int ieee, int flags)
352 {
353 	u_int i;
354 
355 	for (i = 0; i < chaninfo->ic_nchans; i++) {
356 		const struct ieee80211_channel *c = &chaninfo->ic_chans[i];
357 
358 		if (c->ic_ieee == ieee && (c->ic_flags & flags) == flags) {
359 			if (flags == 0) {
360 				/* when ambiguous promote to ``best'' */
361 				c = &chaninfo->ic_chans[promote(i)];
362 			}
363 			*chan = *c;
364 			return;
365 		}
366 	}
367 	errx(1, "unknown/undefined channel number %d flags 0x%x", ieee, flags);
368 }
369 
370 static const struct ieee80211_channel *
371 getcurchan(int s)
372 {
373 	if (gotcurchan)
374 		return &curchan;
375 	if (get80211(s, IEEE80211_IOC_CURCHAN, &curchan, sizeof(curchan)) < 0) {
376 		int val;
377 		/* fall back to legacy ioctl */
378 		if (get80211val(s, IEEE80211_IOC_CHANNEL, &val) < 0)
379 			err(-1, "cannot figure out current channel");
380 		getchaninfo(s);
381 		mapchan(&curchan, val, 0);
382 	}
383 	gotcurchan = 1;
384 	return &curchan;
385 }
386 
387 static enum ieee80211_phymode
388 chan2mode(const struct ieee80211_channel *c)
389 {
390 	if (IEEE80211_IS_CHAN_VHTA(c))
391 		return IEEE80211_MODE_VHT_5GHZ;
392 	if (IEEE80211_IS_CHAN_VHTG(c))
393 		return IEEE80211_MODE_VHT_2GHZ;
394 	if (IEEE80211_IS_CHAN_HTA(c))
395 		return IEEE80211_MODE_11NA;
396 	if (IEEE80211_IS_CHAN_HTG(c))
397 		return IEEE80211_MODE_11NG;
398 	if (IEEE80211_IS_CHAN_108A(c))
399 		return IEEE80211_MODE_TURBO_A;
400 	if (IEEE80211_IS_CHAN_108G(c))
401 		return IEEE80211_MODE_TURBO_G;
402 	if (IEEE80211_IS_CHAN_ST(c))
403 		return IEEE80211_MODE_STURBO_A;
404 	if (IEEE80211_IS_CHAN_FHSS(c))
405 		return IEEE80211_MODE_FH;
406 	if (IEEE80211_IS_CHAN_HALF(c))
407 		return IEEE80211_MODE_HALF;
408 	if (IEEE80211_IS_CHAN_QUARTER(c))
409 		return IEEE80211_MODE_QUARTER;
410 	if (IEEE80211_IS_CHAN_A(c))
411 		return IEEE80211_MODE_11A;
412 	if (IEEE80211_IS_CHAN_ANYG(c))
413 		return IEEE80211_MODE_11G;
414 	if (IEEE80211_IS_CHAN_B(c))
415 		return IEEE80211_MODE_11B;
416 	return IEEE80211_MODE_AUTO;
417 }
418 
419 static void
420 getroam(int s)
421 {
422 	if (gotroam)
423 		return;
424 	if (get80211(s, IEEE80211_IOC_ROAM,
425 	    &roamparams, sizeof(roamparams)) < 0)
426 		err(1, "unable to get roaming parameters");
427 	gotroam = 1;
428 }
429 
430 static void
431 setroam_cb(int s, void *arg)
432 {
433 	struct ieee80211_roamparams_req *roam = arg;
434 	set80211(s, IEEE80211_IOC_ROAM, 0, sizeof(*roam), roam);
435 }
436 
437 static void
438 gettxparams(int s)
439 {
440 	if (gottxparams)
441 		return;
442 	if (get80211(s, IEEE80211_IOC_TXPARAMS,
443 	    &txparams, sizeof(txparams)) < 0)
444 		err(1, "unable to get transmit parameters");
445 	gottxparams = 1;
446 }
447 
448 static void
449 settxparams_cb(int s, void *arg)
450 {
451 	struct ieee80211_txparams_req *txp = arg;
452 	set80211(s, IEEE80211_IOC_TXPARAMS, 0, sizeof(*txp), txp);
453 }
454 
455 static void
456 getregdomain(int s)
457 {
458 	if (gotregdomain)
459 		return;
460 	if (get80211(s, IEEE80211_IOC_REGDOMAIN,
461 	    &regdomain, sizeof(regdomain)) < 0)
462 		err(1, "unable to get regulatory domain info");
463 	gotregdomain = 1;
464 }
465 
466 static void
467 getdevcaps(int s, struct ieee80211_devcaps_req *dc)
468 {
469 	if (get80211(s, IEEE80211_IOC_DEVCAPS, dc,
470 	    IEEE80211_DEVCAPS_SPACE(dc)) < 0)
471 		err(1, "unable to get device capabilities");
472 }
473 
474 static void
475 setregdomain_cb(int s, void *arg)
476 {
477 	struct ieee80211_regdomain_req *req;
478 	struct ieee80211_regdomain *rd = arg;
479 	struct ieee80211_devcaps_req *dc;
480 	struct regdata *rdp = getregdata();
481 
482 	if (rd->country != NO_COUNTRY) {
483 		const struct country *cc;
484 		/*
485 		 * Check current country seting to make sure it's
486 		 * compatible with the new regdomain.  If not, then
487 		 * override it with any default country for this
488 		 * SKU.  If we cannot arrange a match, then abort.
489 		 */
490 		cc = lib80211_country_findbycc(rdp, rd->country);
491 		if (cc == NULL)
492 			errx(1, "unknown ISO country code %d", rd->country);
493 		if (cc->rd->sku != rd->regdomain) {
494 			const struct regdomain *rp;
495 			/*
496 			 * Check if country is incompatible with regdomain.
497 			 * To enable multiple regdomains for a country code
498 			 * we permit a mismatch between the regdomain and
499 			 * the country's associated regdomain when the
500 			 * regdomain is setup w/o a default country.  For
501 			 * example, US is bound to the FCC regdomain but
502 			 * we allow US to be combined with FCC3 because FCC3
503 			 * has not default country.  This allows bogus
504 			 * combinations like FCC3+DK which are resolved when
505 			 * constructing the channel list by deferring to the
506 			 * regdomain to construct the channel list.
507 			 */
508 			rp = lib80211_regdomain_findbysku(rdp, rd->regdomain);
509 			if (rp == NULL)
510 				errx(1, "country %s (%s) is not usable with "
511 				    "regdomain %d", cc->isoname, cc->name,
512 				    rd->regdomain);
513 			else if (rp->cc != NULL && rp->cc != cc)
514 				errx(1, "country %s (%s) is not usable with "
515 				   "regdomain %s", cc->isoname, cc->name,
516 				   rp->name);
517 		}
518 	}
519 	/*
520 	 * Fetch the device capabilities and calculate the
521 	 * full set of netbands for which we request a new
522 	 * channel list be constructed.  Once that's done we
523 	 * push the regdomain info + channel list to the kernel.
524 	 */
525 	dc = malloc(IEEE80211_DEVCAPS_SIZE(MAXCHAN));
526 	if (dc == NULL)
527 		errx(1, "no space for device capabilities");
528 	dc->dc_chaninfo.ic_nchans = MAXCHAN;
529 	getdevcaps(s, dc);
530 #if 0
531 	if (verbose) {
532 		printf("drivercaps: 0x%x\n", dc->dc_drivercaps);
533 		printf("cryptocaps: 0x%x\n", dc->dc_cryptocaps);
534 		printf("htcaps    : 0x%x\n", dc->dc_htcaps);
535 		printf("vhtcaps   : 0x%x\n", dc->dc_vhtcaps);
536 #if 0
537 		memcpy(chaninfo, &dc->dc_chaninfo,
538 		    IEEE80211_CHANINFO_SPACE(&dc->dc_chaninfo));
539 		print_channels(s, &dc->dc_chaninfo, 1/*allchans*/, 1/*verbose*/);
540 #endif
541 	}
542 #endif
543 	req = malloc(IEEE80211_REGDOMAIN_SIZE(dc->dc_chaninfo.ic_nchans));
544 	if (req == NULL)
545 		errx(1, "no space for regdomain request");
546 	req->rd = *rd;
547 	regdomain_makechannels(req, dc);
548 	if (verbose) {
549 		LINE_INIT(':');
550 		print_regdomain(rd, 1/*verbose*/);
551 		LINE_BREAK();
552 		/* blech, reallocate channel list for new data */
553 		if (chaninfo != NULL)
554 			free(chaninfo);
555 		chaninfo = malloc(IEEE80211_CHANINFO_SPACE(&req->chaninfo));
556 		if (chaninfo == NULL)
557 			errx(1, "no space for channel list");
558 		memcpy(chaninfo, &req->chaninfo,
559 		    IEEE80211_CHANINFO_SPACE(&req->chaninfo));
560 		print_channels(s, &req->chaninfo, 1/*allchans*/, 1/*verbose*/);
561 	}
562 	if (req->chaninfo.ic_nchans == 0)
563 		errx(1, "no channels calculated");
564 	set80211(s, IEEE80211_IOC_REGDOMAIN, 0,
565 	    IEEE80211_REGDOMAIN_SPACE(req), req);
566 	free(req);
567 	free(dc);
568 }
569 
570 static int
571 ieee80211_mhz2ieee(int freq, int flags)
572 {
573 	struct ieee80211_channel chan;
574 	mapfreq(&chan, freq, flags);
575 	return chan.ic_ieee;
576 }
577 
578 static int
579 isanyarg(const char *arg)
580 {
581 	return (strncmp(arg, "-", 1) == 0 ||
582 	    strncasecmp(arg, "any", 3) == 0 || strncasecmp(arg, "off", 3) == 0);
583 }
584 
585 static void
586 set80211ssid(const char *val, int d, int s, const struct afswtch *rafp)
587 {
588 	int		ssid;
589 	int		len;
590 	u_int8_t	data[IEEE80211_NWID_LEN];
591 
592 	ssid = 0;
593 	len = strlen(val);
594 	if (len > 2 && isdigit((int)val[0]) && val[1] == ':') {
595 		ssid = atoi(val)-1;
596 		val += 2;
597 	}
598 
599 	bzero(data, sizeof(data));
600 	len = sizeof(data);
601 	if (get_string(val, NULL, data, &len) == NULL)
602 		exit(1);
603 
604 	set80211(s, IEEE80211_IOC_SSID, ssid, len, data);
605 }
606 
607 static void
608 set80211meshid(const char *val, int d, int s, const struct afswtch *rafp)
609 {
610 	int		len;
611 	u_int8_t	data[IEEE80211_NWID_LEN];
612 
613 	memset(data, 0, sizeof(data));
614 	len = sizeof(data);
615 	if (get_string(val, NULL, data, &len) == NULL)
616 		exit(1);
617 
618 	set80211(s, IEEE80211_IOC_MESH_ID, 0, len, data);
619 }
620 
621 static void
622 set80211stationname(const char *val, int d, int s, const struct afswtch *rafp)
623 {
624 	int			len;
625 	u_int8_t		data[33];
626 
627 	bzero(data, sizeof(data));
628 	len = sizeof(data);
629 	get_string(val, NULL, data, &len);
630 
631 	set80211(s, IEEE80211_IOC_STATIONNAME, 0, len, data);
632 }
633 
634 /*
635  * Parse a channel specification for attributes/flags.
636  * The syntax is:
637  *	freq/xx		channel width (5,10,20,40,40+,40-)
638  *	freq:mode	channel mode (a,b,g,h,n,t,s,d)
639  *
640  * These can be combined in either order; e.g. 2437:ng/40.
641  * Modes are case insensitive.
642  *
643  * The result is not validated here; it's assumed to be
644  * checked against the channel table fetched from the kernel.
645  */
646 static int
647 getchannelflags(const char *val, int freq)
648 {
649 #define	_CHAN_HT	0x80000000
650 	const char *cp;
651 	int flags;
652 	int is_vht = 0;
653 
654 	flags = 0;
655 
656 	cp = strchr(val, ':');
657 	if (cp != NULL) {
658 		for (cp++; isalpha((int) *cp); cp++) {
659 			/* accept mixed case */
660 			int c = *cp;
661 			if (isupper(c))
662 				c = tolower(c);
663 			switch (c) {
664 			case 'a':		/* 802.11a */
665 				flags |= IEEE80211_CHAN_A;
666 				break;
667 			case 'b':		/* 802.11b */
668 				flags |= IEEE80211_CHAN_B;
669 				break;
670 			case 'g':		/* 802.11g */
671 				flags |= IEEE80211_CHAN_G;
672 				break;
673 			case 'v':		/* vht: 802.11ac */
674 				is_vht = 1;
675 				/* Fallthrough */
676 			case 'h':		/* ht = 802.11n */
677 			case 'n':		/* 802.11n */
678 				flags |= _CHAN_HT;	/* NB: private */
679 				break;
680 			case 'd':		/* dt = Atheros Dynamic Turbo */
681 				flags |= IEEE80211_CHAN_TURBO;
682 				break;
683 			case 't':		/* ht, dt, st, t */
684 				/* dt and unadorned t specify Dynamic Turbo */
685 				if ((flags & (IEEE80211_CHAN_STURBO|_CHAN_HT)) == 0)
686 					flags |= IEEE80211_CHAN_TURBO;
687 				break;
688 			case 's':		/* st = Atheros Static Turbo */
689 				flags |= IEEE80211_CHAN_STURBO;
690 				break;
691 			default:
692 				errx(-1, "%s: Invalid channel attribute %c\n",
693 				    val, *cp);
694 			}
695 		}
696 	}
697 	cp = strchr(val, '/');
698 	if (cp != NULL) {
699 		char *ep;
700 		u_long cw = strtoul(cp+1, &ep, 10);
701 
702 		switch (cw) {
703 		case 5:
704 			flags |= IEEE80211_CHAN_QUARTER;
705 			break;
706 		case 10:
707 			flags |= IEEE80211_CHAN_HALF;
708 			break;
709 		case 20:
710 			/* NB: this may be removed below */
711 			flags |= IEEE80211_CHAN_HT20;
712 			break;
713 		case 40:
714 		case 80:
715 		case 160:
716 			/* Handle the 80/160 VHT flag */
717 			if (cw == 80)
718 				flags |= IEEE80211_CHAN_VHT80;
719 			else if (cw == 160)
720 				flags |= IEEE80211_CHAN_VHT160;
721 
722 			/* Fallthrough */
723 			if (ep != NULL && *ep == '+')
724 				flags |= IEEE80211_CHAN_HT40U;
725 			else if (ep != NULL && *ep == '-')
726 				flags |= IEEE80211_CHAN_HT40D;
727 			break;
728 		default:
729 			errx(-1, "%s: Invalid channel width\n", val);
730 		}
731 	}
732 
733 	/*
734 	 * Cleanup specifications.
735 	 */
736 	if ((flags & _CHAN_HT) == 0) {
737 		/*
738 		 * If user specified freq/20 or freq/40 quietly remove
739 		 * HT cw attributes depending on channel use.  To give
740 		 * an explicit 20/40 width for an HT channel you must
741 		 * indicate it is an HT channel since all HT channels
742 		 * are also usable for legacy operation; e.g. freq:n/40.
743 		 */
744 		flags &= ~IEEE80211_CHAN_HT;
745 		flags &= ~IEEE80211_CHAN_VHT;
746 	} else {
747 		/*
748 		 * Remove private indicator that this is an HT channel
749 		 * and if no explicit channel width has been given
750 		 * provide the default settings.
751 		 */
752 		flags &= ~_CHAN_HT;
753 		if ((flags & IEEE80211_CHAN_HT) == 0) {
754 			struct ieee80211_channel chan;
755 			/*
756 			 * Consult the channel list to see if we can use
757 			 * HT40+ or HT40- (if both the map routines choose).
758 			 */
759 			if (freq > 255)
760 				mapfreq(&chan, freq, 0);
761 			else
762 				mapchan(&chan, freq, 0);
763 			flags |= (chan.ic_flags & IEEE80211_CHAN_HT);
764 		}
765 
766 		/*
767 		 * If VHT is enabled, then also set the VHT flag and the
768 		 * relevant channel up/down.
769 		 */
770 		if (is_vht && (flags & IEEE80211_CHAN_HT)) {
771 			/*
772 			 * XXX yes, maybe we should just have VHT, and reuse
773 			 * HT20/HT40U/HT40D
774 			 */
775 			if (flags & IEEE80211_CHAN_VHT80)
776 				;
777 			else if (flags & IEEE80211_CHAN_HT20)
778 				flags |= IEEE80211_CHAN_VHT20;
779 			else if (flags & IEEE80211_CHAN_HT40U)
780 				flags |= IEEE80211_CHAN_VHT40U;
781 			else if (flags & IEEE80211_CHAN_HT40D)
782 				flags |= IEEE80211_CHAN_VHT40D;
783 		}
784 	}
785 	return flags;
786 #undef _CHAN_HT
787 }
788 
789 static void
790 getchannel(int s, struct ieee80211_channel *chan, const char *val)
791 {
792 	int v, flags;
793 	char *eptr;
794 
795 	memset(chan, 0, sizeof(*chan));
796 	if (isanyarg(val)) {
797 		chan->ic_freq = IEEE80211_CHAN_ANY;
798 		return;
799 	}
800 	getchaninfo(s);
801 	errno = 0;
802 	v = strtol(val, &eptr, 10);
803 	if (val[0] == '\0' || val == eptr || errno == ERANGE ||
804 	    /* channel may be suffixed with nothing, :flag, or /width */
805 	    (eptr[0] != '\0' && eptr[0] != ':' && eptr[0] != '/'))
806 		errx(1, "invalid channel specification%s",
807 		    errno == ERANGE ? " (out of range)" : "");
808 	flags = getchannelflags(val, v);
809 	if (v > 255) {		/* treat as frequency */
810 		mapfreq(chan, v, flags);
811 	} else {
812 		mapchan(chan, v, flags);
813 	}
814 }
815 
816 static void
817 set80211channel(const char *val, int d, int s, const struct afswtch *rafp)
818 {
819 	struct ieee80211_channel chan;
820 
821 	getchannel(s, &chan, val);
822 	set80211(s, IEEE80211_IOC_CURCHAN, 0, sizeof(chan), &chan);
823 }
824 
825 static void
826 set80211chanswitch(const char *val, int d, int s, const struct afswtch *rafp)
827 {
828 	struct ieee80211_chanswitch_req csr;
829 
830 	getchannel(s, &csr.csa_chan, val);
831 	csr.csa_mode = 1;
832 	csr.csa_count = 5;
833 	set80211(s, IEEE80211_IOC_CHANSWITCH, 0, sizeof(csr), &csr);
834 }
835 
836 static void
837 set80211authmode(const char *val, int d, int s, const struct afswtch *rafp)
838 {
839 	int	mode;
840 
841 	if (strcasecmp(val, "none") == 0) {
842 		mode = IEEE80211_AUTH_NONE;
843 	} else if (strcasecmp(val, "open") == 0) {
844 		mode = IEEE80211_AUTH_OPEN;
845 	} else if (strcasecmp(val, "shared") == 0) {
846 		mode = IEEE80211_AUTH_SHARED;
847 	} else if (strcasecmp(val, "8021x") == 0) {
848 		mode = IEEE80211_AUTH_8021X;
849 	} else if (strcasecmp(val, "wpa") == 0) {
850 		mode = IEEE80211_AUTH_WPA;
851 	} else {
852 		errx(1, "unknown authmode");
853 	}
854 
855 	set80211(s, IEEE80211_IOC_AUTHMODE, mode, 0, NULL);
856 }
857 
858 static void
859 set80211powersavemode(const char *val, int d, int s, const struct afswtch *rafp)
860 {
861 	int	mode;
862 
863 	if (strcasecmp(val, "off") == 0) {
864 		mode = IEEE80211_POWERSAVE_OFF;
865 	} else if (strcasecmp(val, "on") == 0) {
866 		mode = IEEE80211_POWERSAVE_ON;
867 	} else if (strcasecmp(val, "cam") == 0) {
868 		mode = IEEE80211_POWERSAVE_CAM;
869 	} else if (strcasecmp(val, "psp") == 0) {
870 		mode = IEEE80211_POWERSAVE_PSP;
871 	} else if (strcasecmp(val, "psp-cam") == 0) {
872 		mode = IEEE80211_POWERSAVE_PSP_CAM;
873 	} else {
874 		errx(1, "unknown powersavemode");
875 	}
876 
877 	set80211(s, IEEE80211_IOC_POWERSAVE, mode, 0, NULL);
878 }
879 
880 static void
881 set80211powersave(const char *val, int d, int s, const struct afswtch *rafp)
882 {
883 	if (d == 0)
884 		set80211(s, IEEE80211_IOC_POWERSAVE, IEEE80211_POWERSAVE_OFF,
885 		    0, NULL);
886 	else
887 		set80211(s, IEEE80211_IOC_POWERSAVE, IEEE80211_POWERSAVE_ON,
888 		    0, NULL);
889 }
890 
891 static void
892 set80211powersavesleep(const char *val, int d, int s, const struct afswtch *rafp)
893 {
894 	set80211(s, IEEE80211_IOC_POWERSAVESLEEP, atoi(val), 0, NULL);
895 }
896 
897 static void
898 set80211wepmode(const char *val, int d, int s, const struct afswtch *rafp)
899 {
900 	int	mode;
901 
902 	if (strcasecmp(val, "off") == 0) {
903 		mode = IEEE80211_WEP_OFF;
904 	} else if (strcasecmp(val, "on") == 0) {
905 		mode = IEEE80211_WEP_ON;
906 	} else if (strcasecmp(val, "mixed") == 0) {
907 		mode = IEEE80211_WEP_MIXED;
908 	} else {
909 		errx(1, "unknown wep mode");
910 	}
911 
912 	set80211(s, IEEE80211_IOC_WEP, mode, 0, NULL);
913 }
914 
915 static void
916 set80211wep(const char *val, int d, int s, const struct afswtch *rafp)
917 {
918 	set80211(s, IEEE80211_IOC_WEP, d, 0, NULL);
919 }
920 
921 static int
922 isundefarg(const char *arg)
923 {
924 	return (strcmp(arg, "-") == 0 || strncasecmp(arg, "undef", 5) == 0);
925 }
926 
927 static void
928 set80211weptxkey(const char *val, int d, int s, const struct afswtch *rafp)
929 {
930 	if (isundefarg(val))
931 		set80211(s, IEEE80211_IOC_WEPTXKEY, IEEE80211_KEYIX_NONE, 0, NULL);
932 	else
933 		set80211(s, IEEE80211_IOC_WEPTXKEY, atoi(val)-1, 0, NULL);
934 }
935 
936 static void
937 set80211wepkey(const char *val, int d, int s, const struct afswtch *rafp)
938 {
939 	int		key = 0;
940 	int		len;
941 	u_int8_t	data[IEEE80211_KEYBUF_SIZE];
942 
943 	if (isdigit((int)val[0]) && val[1] == ':') {
944 		key = atoi(val)-1;
945 		val += 2;
946 	}
947 
948 	bzero(data, sizeof(data));
949 	len = sizeof(data);
950 	get_string(val, NULL, data, &len);
951 
952 	set80211(s, IEEE80211_IOC_WEPKEY, key, len, data);
953 }
954 
955 /*
956  * This function is purely a NetBSD compatibility interface.  The NetBSD
957  * interface is too inflexible, but it's there so we'll support it since
958  * it's not all that hard.
959  */
960 static void
961 set80211nwkey(const char *val, int d, int s, const struct afswtch *rafp)
962 {
963 	int		txkey;
964 	int		i, len;
965 	u_int8_t	data[IEEE80211_KEYBUF_SIZE];
966 
967 	set80211(s, IEEE80211_IOC_WEP, IEEE80211_WEP_ON, 0, NULL);
968 
969 	if (isdigit((int)val[0]) && val[1] == ':') {
970 		txkey = val[0]-'0'-1;
971 		val += 2;
972 
973 		for (i = 0; i < 4; i++) {
974 			bzero(data, sizeof(data));
975 			len = sizeof(data);
976 			val = get_string(val, ",", data, &len);
977 			if (val == NULL)
978 				exit(1);
979 
980 			set80211(s, IEEE80211_IOC_WEPKEY, i, len, data);
981 		}
982 	} else {
983 		bzero(data, sizeof(data));
984 		len = sizeof(data);
985 		get_string(val, NULL, data, &len);
986 		txkey = 0;
987 
988 		set80211(s, IEEE80211_IOC_WEPKEY, 0, len, data);
989 
990 		bzero(data, sizeof(data));
991 		for (i = 1; i < 4; i++)
992 			set80211(s, IEEE80211_IOC_WEPKEY, i, 0, data);
993 	}
994 
995 	set80211(s, IEEE80211_IOC_WEPTXKEY, txkey, 0, NULL);
996 }
997 
998 static void
999 set80211rtsthreshold(const char *val, int d, int s, const struct afswtch *rafp)
1000 {
1001 	set80211(s, IEEE80211_IOC_RTSTHRESHOLD,
1002 		isundefarg(val) ? IEEE80211_RTS_MAX : atoi(val), 0, NULL);
1003 }
1004 
1005 static void
1006 set80211protmode(const char *val, int d, int s, const struct afswtch *rafp)
1007 {
1008 	int	mode;
1009 
1010 	if (strcasecmp(val, "off") == 0) {
1011 		mode = IEEE80211_PROTMODE_OFF;
1012 	} else if (strcasecmp(val, "cts") == 0) {
1013 		mode = IEEE80211_PROTMODE_CTS;
1014 	} else if (strncasecmp(val, "rtscts", 3) == 0) {
1015 		mode = IEEE80211_PROTMODE_RTSCTS;
1016 	} else {
1017 		errx(1, "unknown protection mode");
1018 	}
1019 
1020 	set80211(s, IEEE80211_IOC_PROTMODE, mode, 0, NULL);
1021 }
1022 
1023 static void
1024 set80211htprotmode(const char *val, int d, int s, const struct afswtch *rafp)
1025 {
1026 	int	mode;
1027 
1028 	if (strcasecmp(val, "off") == 0) {
1029 		mode = IEEE80211_PROTMODE_OFF;
1030 	} else if (strncasecmp(val, "rts", 3) == 0) {
1031 		mode = IEEE80211_PROTMODE_RTSCTS;
1032 	} else {
1033 		errx(1, "unknown protection mode");
1034 	}
1035 
1036 	set80211(s, IEEE80211_IOC_HTPROTMODE, mode, 0, NULL);
1037 }
1038 
1039 static void
1040 set80211txpower(const char *val, int d, int s, const struct afswtch *rafp)
1041 {
1042 	double v = atof(val);
1043 	int txpow;
1044 
1045 	txpow = (int) (2*v);
1046 	if (txpow != 2*v)
1047 		errx(-1, "invalid tx power (must be .5 dBm units)");
1048 	set80211(s, IEEE80211_IOC_TXPOWER, txpow, 0, NULL);
1049 }
1050 
1051 #define	IEEE80211_ROAMING_DEVICE	0
1052 #define	IEEE80211_ROAMING_AUTO		1
1053 #define	IEEE80211_ROAMING_MANUAL	2
1054 
1055 static void
1056 set80211roaming(const char *val, int d, int s, const struct afswtch *rafp)
1057 {
1058 	int mode;
1059 
1060 	if (strcasecmp(val, "device") == 0) {
1061 		mode = IEEE80211_ROAMING_DEVICE;
1062 	} else if (strcasecmp(val, "auto") == 0) {
1063 		mode = IEEE80211_ROAMING_AUTO;
1064 	} else if (strcasecmp(val, "manual") == 0) {
1065 		mode = IEEE80211_ROAMING_MANUAL;
1066 	} else {
1067 		errx(1, "unknown roaming mode");
1068 	}
1069 	set80211(s, IEEE80211_IOC_ROAMING, mode, 0, NULL);
1070 }
1071 
1072 static void
1073 set80211wme(const char *val, int d, int s, const struct afswtch *rafp)
1074 {
1075 	set80211(s, IEEE80211_IOC_WME, d, 0, NULL);
1076 }
1077 
1078 static void
1079 set80211hidessid(const char *val, int d, int s, const struct afswtch *rafp)
1080 {
1081 	set80211(s, IEEE80211_IOC_HIDESSID, d, 0, NULL);
1082 }
1083 
1084 static void
1085 set80211apbridge(const char *val, int d, int s, const struct afswtch *rafp)
1086 {
1087 	set80211(s, IEEE80211_IOC_APBRIDGE, d, 0, NULL);
1088 }
1089 
1090 static void
1091 set80211fastframes(const char *val, int d, int s, const struct afswtch *rafp)
1092 {
1093 	set80211(s, IEEE80211_IOC_FF, d, 0, NULL);
1094 }
1095 
1096 static void
1097 set80211dturbo(const char *val, int d, int s, const struct afswtch *rafp)
1098 {
1099 	set80211(s, IEEE80211_IOC_TURBOP, d, 0, NULL);
1100 }
1101 
1102 static void
1103 set80211chanlist(const char *val, int d, int s, const struct afswtch *rafp)
1104 {
1105 	struct ieee80211req_chanlist chanlist;
1106 	char *temp, *cp, *tp;
1107 
1108 	temp = malloc(strlen(val) + 1);
1109 	if (temp == NULL)
1110 		errx(1, "malloc failed");
1111 	strcpy(temp, val);
1112 	memset(&chanlist, 0, sizeof(chanlist));
1113 	cp = temp;
1114 	for (;;) {
1115 		int first, last, f, c;
1116 
1117 		tp = strchr(cp, ',');
1118 		if (tp != NULL)
1119 			*tp++ = '\0';
1120 		switch (sscanf(cp, "%u-%u", &first, &last)) {
1121 		case 1:
1122 			if (first > IEEE80211_CHAN_MAX)
1123 				errx(-1, "channel %u out of range, max %u",
1124 					first, IEEE80211_CHAN_MAX);
1125 			setbit(chanlist.ic_channels, first);
1126 			break;
1127 		case 2:
1128 			if (first > IEEE80211_CHAN_MAX)
1129 				errx(-1, "channel %u out of range, max %u",
1130 					first, IEEE80211_CHAN_MAX);
1131 			if (last > IEEE80211_CHAN_MAX)
1132 				errx(-1, "channel %u out of range, max %u",
1133 					last, IEEE80211_CHAN_MAX);
1134 			if (first > last)
1135 				errx(-1, "void channel range, %u > %u",
1136 					first, last);
1137 			for (f = first; f <= last; f++)
1138 				setbit(chanlist.ic_channels, f);
1139 			break;
1140 		}
1141 		if (tp == NULL)
1142 			break;
1143 		c = *tp;
1144 		while (isspace(c))
1145 			tp++;
1146 		if (!isdigit(c))
1147 			break;
1148 		cp = tp;
1149 	}
1150 	set80211(s, IEEE80211_IOC_CHANLIST, 0, sizeof(chanlist), &chanlist);
1151 	free(temp);
1152 }
1153 
1154 static void
1155 set80211bssid(const char *val, int d, int s, const struct afswtch *rafp)
1156 {
1157 
1158 	if (!isanyarg(val)) {
1159 		char *temp;
1160 		struct sockaddr_dl sdl;
1161 
1162 		temp = malloc(strlen(val) + 2); /* ':' and '\0' */
1163 		if (temp == NULL)
1164 			errx(1, "malloc failed");
1165 		temp[0] = ':';
1166 		strcpy(temp + 1, val);
1167 		sdl.sdl_len = sizeof(sdl);
1168 		link_addr(temp, &sdl);
1169 		free(temp);
1170 		if (sdl.sdl_alen != IEEE80211_ADDR_LEN)
1171 			errx(1, "malformed link-level address");
1172 		set80211(s, IEEE80211_IOC_BSSID, 0,
1173 			IEEE80211_ADDR_LEN, LLADDR(&sdl));
1174 	} else {
1175 		uint8_t zerobssid[IEEE80211_ADDR_LEN];
1176 		memset(zerobssid, 0, sizeof(zerobssid));
1177 		set80211(s, IEEE80211_IOC_BSSID, 0,
1178 			IEEE80211_ADDR_LEN, zerobssid);
1179 	}
1180 }
1181 
1182 static int
1183 getac(const char *ac)
1184 {
1185 	if (strcasecmp(ac, "ac_be") == 0 || strcasecmp(ac, "be") == 0)
1186 		return WME_AC_BE;
1187 	if (strcasecmp(ac, "ac_bk") == 0 || strcasecmp(ac, "bk") == 0)
1188 		return WME_AC_BK;
1189 	if (strcasecmp(ac, "ac_vi") == 0 || strcasecmp(ac, "vi") == 0)
1190 		return WME_AC_VI;
1191 	if (strcasecmp(ac, "ac_vo") == 0 || strcasecmp(ac, "vo") == 0)
1192 		return WME_AC_VO;
1193 	errx(1, "unknown wme access class %s", ac);
1194 }
1195 
1196 static
1197 DECL_CMD_FUNC2(set80211cwmin, ac, val)
1198 {
1199 	set80211(s, IEEE80211_IOC_WME_CWMIN, atoi(val), getac(ac), NULL);
1200 }
1201 
1202 static
1203 DECL_CMD_FUNC2(set80211cwmax, ac, val)
1204 {
1205 	set80211(s, IEEE80211_IOC_WME_CWMAX, atoi(val), getac(ac), NULL);
1206 }
1207 
1208 static
1209 DECL_CMD_FUNC2(set80211aifs, ac, val)
1210 {
1211 	set80211(s, IEEE80211_IOC_WME_AIFS, atoi(val), getac(ac), NULL);
1212 }
1213 
1214 static
1215 DECL_CMD_FUNC2(set80211txoplimit, ac, val)
1216 {
1217 	set80211(s, IEEE80211_IOC_WME_TXOPLIMIT, atoi(val), getac(ac), NULL);
1218 }
1219 
1220 static
1221 DECL_CMD_FUNC(set80211acm, ac, d)
1222 {
1223 	set80211(s, IEEE80211_IOC_WME_ACM, 1, getac(ac), NULL);
1224 }
1225 static
1226 DECL_CMD_FUNC(set80211noacm, ac, d)
1227 {
1228 	set80211(s, IEEE80211_IOC_WME_ACM, 0, getac(ac), NULL);
1229 }
1230 
1231 static
1232 DECL_CMD_FUNC(set80211ackpolicy, ac, d)
1233 {
1234 	set80211(s, IEEE80211_IOC_WME_ACKPOLICY, 1, getac(ac), NULL);
1235 }
1236 static
1237 DECL_CMD_FUNC(set80211noackpolicy, ac, d)
1238 {
1239 	set80211(s, IEEE80211_IOC_WME_ACKPOLICY, 0, getac(ac), NULL);
1240 }
1241 
1242 static
1243 DECL_CMD_FUNC2(set80211bsscwmin, ac, val)
1244 {
1245 	set80211(s, IEEE80211_IOC_WME_CWMIN, atoi(val),
1246 		getac(ac)|IEEE80211_WMEPARAM_BSS, NULL);
1247 }
1248 
1249 static
1250 DECL_CMD_FUNC2(set80211bsscwmax, ac, val)
1251 {
1252 	set80211(s, IEEE80211_IOC_WME_CWMAX, atoi(val),
1253 		getac(ac)|IEEE80211_WMEPARAM_BSS, NULL);
1254 }
1255 
1256 static
1257 DECL_CMD_FUNC2(set80211bssaifs, ac, val)
1258 {
1259 	set80211(s, IEEE80211_IOC_WME_AIFS, atoi(val),
1260 		getac(ac)|IEEE80211_WMEPARAM_BSS, NULL);
1261 }
1262 
1263 static
1264 DECL_CMD_FUNC2(set80211bsstxoplimit, ac, val)
1265 {
1266 	set80211(s, IEEE80211_IOC_WME_TXOPLIMIT, atoi(val),
1267 		getac(ac)|IEEE80211_WMEPARAM_BSS, NULL);
1268 }
1269 
1270 static
1271 DECL_CMD_FUNC(set80211dtimperiod, val, d)
1272 {
1273 	set80211(s, IEEE80211_IOC_DTIM_PERIOD, atoi(val), 0, NULL);
1274 }
1275 
1276 static
1277 DECL_CMD_FUNC(set80211bintval, val, d)
1278 {
1279 	set80211(s, IEEE80211_IOC_BEACON_INTERVAL, atoi(val), 0, NULL);
1280 }
1281 
1282 static void
1283 set80211macmac(int s, int op, const char *val)
1284 {
1285 	char *temp;
1286 	struct sockaddr_dl sdl;
1287 
1288 	temp = malloc(strlen(val) + 2); /* ':' and '\0' */
1289 	if (temp == NULL)
1290 		errx(1, "malloc failed");
1291 	temp[0] = ':';
1292 	strcpy(temp + 1, val);
1293 	sdl.sdl_len = sizeof(sdl);
1294 	link_addr(temp, &sdl);
1295 	free(temp);
1296 	if (sdl.sdl_alen != IEEE80211_ADDR_LEN)
1297 		errx(1, "malformed link-level address");
1298 	set80211(s, op, 0, IEEE80211_ADDR_LEN, LLADDR(&sdl));
1299 }
1300 
1301 static
1302 DECL_CMD_FUNC(set80211addmac, val, d)
1303 {
1304 	set80211macmac(s, IEEE80211_IOC_ADDMAC, val);
1305 }
1306 
1307 static
1308 DECL_CMD_FUNC(set80211delmac, val, d)
1309 {
1310 	set80211macmac(s, IEEE80211_IOC_DELMAC, val);
1311 }
1312 
1313 static
1314 DECL_CMD_FUNC(set80211kickmac, val, d)
1315 {
1316 	char *temp;
1317 	struct sockaddr_dl sdl;
1318 	struct ieee80211req_mlme mlme;
1319 
1320 	temp = malloc(strlen(val) + 2); /* ':' and '\0' */
1321 	if (temp == NULL)
1322 		errx(1, "malloc failed");
1323 	temp[0] = ':';
1324 	strcpy(temp + 1, val);
1325 	sdl.sdl_len = sizeof(sdl);
1326 	link_addr(temp, &sdl);
1327 	free(temp);
1328 	if (sdl.sdl_alen != IEEE80211_ADDR_LEN)
1329 		errx(1, "malformed link-level address");
1330 	memset(&mlme, 0, sizeof(mlme));
1331 	mlme.im_op = IEEE80211_MLME_DEAUTH;
1332 	mlme.im_reason = IEEE80211_REASON_AUTH_EXPIRE;
1333 	memcpy(mlme.im_macaddr, LLADDR(&sdl), IEEE80211_ADDR_LEN);
1334 	set80211(s, IEEE80211_IOC_MLME, 0, sizeof(mlme), &mlme);
1335 }
1336 
1337 static
1338 DECL_CMD_FUNC(set80211maccmd, val, d)
1339 {
1340 	set80211(s, IEEE80211_IOC_MACCMD, d, 0, NULL);
1341 }
1342 
1343 static void
1344 set80211meshrtmac(int s, int req, const char *val)
1345 {
1346 	char *temp;
1347 	struct sockaddr_dl sdl;
1348 
1349 	temp = malloc(strlen(val) + 2); /* ':' and '\0' */
1350 	if (temp == NULL)
1351 		errx(1, "malloc failed");
1352 	temp[0] = ':';
1353 	strcpy(temp + 1, val);
1354 	sdl.sdl_len = sizeof(sdl);
1355 	link_addr(temp, &sdl);
1356 	free(temp);
1357 	if (sdl.sdl_alen != IEEE80211_ADDR_LEN)
1358 		errx(1, "malformed link-level address");
1359 	set80211(s, IEEE80211_IOC_MESH_RTCMD, req,
1360 	    IEEE80211_ADDR_LEN, LLADDR(&sdl));
1361 }
1362 
1363 static
1364 DECL_CMD_FUNC(set80211addmeshrt, val, d)
1365 {
1366 	set80211meshrtmac(s, IEEE80211_MESH_RTCMD_ADD, val);
1367 }
1368 
1369 static
1370 DECL_CMD_FUNC(set80211delmeshrt, val, d)
1371 {
1372 	set80211meshrtmac(s, IEEE80211_MESH_RTCMD_DELETE, val);
1373 }
1374 
1375 static
1376 DECL_CMD_FUNC(set80211meshrtcmd, val, d)
1377 {
1378 	set80211(s, IEEE80211_IOC_MESH_RTCMD, d, 0, NULL);
1379 }
1380 
1381 static
1382 DECL_CMD_FUNC(set80211hwmprootmode, val, d)
1383 {
1384 	int mode;
1385 
1386 	if (strcasecmp(val, "normal") == 0)
1387 		mode = IEEE80211_HWMP_ROOTMODE_NORMAL;
1388 	else if (strcasecmp(val, "proactive") == 0)
1389 		mode = IEEE80211_HWMP_ROOTMODE_PROACTIVE;
1390 	else if (strcasecmp(val, "rann") == 0)
1391 		mode = IEEE80211_HWMP_ROOTMODE_RANN;
1392 	else
1393 		mode = IEEE80211_HWMP_ROOTMODE_DISABLED;
1394 	set80211(s, IEEE80211_IOC_HWMP_ROOTMODE, mode, 0, NULL);
1395 }
1396 
1397 static
1398 DECL_CMD_FUNC(set80211hwmpmaxhops, val, d)
1399 {
1400 	set80211(s, IEEE80211_IOC_HWMP_MAXHOPS, atoi(val), 0, NULL);
1401 }
1402 
1403 static void
1404 set80211pureg(const char *val, int d, int s, const struct afswtch *rafp)
1405 {
1406 	set80211(s, IEEE80211_IOC_PUREG, d, 0, NULL);
1407 }
1408 
1409 static void
1410 set80211quiet(const char *val, int d, int s, const struct afswtch *rafp)
1411 {
1412 	set80211(s, IEEE80211_IOC_QUIET, d, 0, NULL);
1413 }
1414 
1415 static
1416 DECL_CMD_FUNC(set80211quietperiod, val, d)
1417 {
1418 	set80211(s, IEEE80211_IOC_QUIET_PERIOD, atoi(val), 0, NULL);
1419 }
1420 
1421 static
1422 DECL_CMD_FUNC(set80211quietcount, val, d)
1423 {
1424 	set80211(s, IEEE80211_IOC_QUIET_COUNT, atoi(val), 0, NULL);
1425 }
1426 
1427 static
1428 DECL_CMD_FUNC(set80211quietduration, val, d)
1429 {
1430 	set80211(s, IEEE80211_IOC_QUIET_DUR, atoi(val), 0, NULL);
1431 }
1432 
1433 static
1434 DECL_CMD_FUNC(set80211quietoffset, val, d)
1435 {
1436 	set80211(s, IEEE80211_IOC_QUIET_OFFSET, atoi(val), 0, NULL);
1437 }
1438 
1439 static void
1440 set80211bgscan(const char *val, int d, int s, const struct afswtch *rafp)
1441 {
1442 	set80211(s, IEEE80211_IOC_BGSCAN, d, 0, NULL);
1443 }
1444 
1445 static
1446 DECL_CMD_FUNC(set80211bgscanidle, val, d)
1447 {
1448 	set80211(s, IEEE80211_IOC_BGSCAN_IDLE, atoi(val), 0, NULL);
1449 }
1450 
1451 static
1452 DECL_CMD_FUNC(set80211bgscanintvl, val, d)
1453 {
1454 	set80211(s, IEEE80211_IOC_BGSCAN_INTERVAL, atoi(val), 0, NULL);
1455 }
1456 
1457 static
1458 DECL_CMD_FUNC(set80211scanvalid, val, d)
1459 {
1460 	set80211(s, IEEE80211_IOC_SCANVALID, atoi(val), 0, NULL);
1461 }
1462 
1463 /*
1464  * Parse an optional trailing specification of which netbands
1465  * to apply a parameter to.  This is basically the same syntax
1466  * as used for channels but you can concatenate to specify
1467  * multiple.  For example:
1468  *	14:abg		apply to 11a, 11b, and 11g
1469  *	6:ht		apply to 11na and 11ng
1470  * We don't make a big effort to catch silly things; this is
1471  * really a convenience mechanism.
1472  */
1473 static int
1474 getmodeflags(const char *val)
1475 {
1476 	const char *cp;
1477 	int flags;
1478 
1479 	flags = 0;
1480 
1481 	cp = strchr(val, ':');
1482 	if (cp != NULL) {
1483 		for (cp++; isalpha((int) *cp); cp++) {
1484 			/* accept mixed case */
1485 			int c = *cp;
1486 			if (isupper(c))
1487 				c = tolower(c);
1488 			switch (c) {
1489 			case 'a':		/* 802.11a */
1490 				flags |= IEEE80211_CHAN_A;
1491 				break;
1492 			case 'b':		/* 802.11b */
1493 				flags |= IEEE80211_CHAN_B;
1494 				break;
1495 			case 'g':		/* 802.11g */
1496 				flags |= IEEE80211_CHAN_G;
1497 				break;
1498 			case 'n':		/* 802.11n */
1499 				flags |= IEEE80211_CHAN_HT;
1500 				break;
1501 			case 'd':		/* dt = Atheros Dynamic Turbo */
1502 				flags |= IEEE80211_CHAN_TURBO;
1503 				break;
1504 			case 't':		/* ht, dt, st, t */
1505 				/* dt and unadorned t specify Dynamic Turbo */
1506 				if ((flags & (IEEE80211_CHAN_STURBO|IEEE80211_CHAN_HT)) == 0)
1507 					flags |= IEEE80211_CHAN_TURBO;
1508 				break;
1509 			case 's':		/* st = Atheros Static Turbo */
1510 				flags |= IEEE80211_CHAN_STURBO;
1511 				break;
1512 			case 'h':		/* 1/2-width channels */
1513 				flags |= IEEE80211_CHAN_HALF;
1514 				break;
1515 			case 'q':		/* 1/4-width channels */
1516 				flags |= IEEE80211_CHAN_QUARTER;
1517 				break;
1518 			case 'v':
1519 				/* XXX set HT too? */
1520 				flags |= IEEE80211_CHAN_VHT;
1521 				break;
1522 			default:
1523 				errx(-1, "%s: Invalid mode attribute %c\n",
1524 				    val, *cp);
1525 			}
1526 		}
1527 	}
1528 	return flags;
1529 }
1530 
1531 #define	_APPLY(_flags, _base, _param, _v) do {				\
1532     if (_flags & IEEE80211_CHAN_HT) {					\
1533 	    if ((_flags & (IEEE80211_CHAN_5GHZ|IEEE80211_CHAN_2GHZ)) == 0) {\
1534 		    _base.params[IEEE80211_MODE_11NA]._param = _v;	\
1535 		    _base.params[IEEE80211_MODE_11NG]._param = _v;	\
1536 	    } else if (_flags & IEEE80211_CHAN_5GHZ)			\
1537 		    _base.params[IEEE80211_MODE_11NA]._param = _v;	\
1538 	    else							\
1539 		    _base.params[IEEE80211_MODE_11NG]._param = _v;	\
1540     }									\
1541     if (_flags & IEEE80211_CHAN_TURBO) {				\
1542 	    if ((_flags & (IEEE80211_CHAN_5GHZ|IEEE80211_CHAN_2GHZ)) == 0) {\
1543 		    _base.params[IEEE80211_MODE_TURBO_A]._param = _v;	\
1544 		    _base.params[IEEE80211_MODE_TURBO_G]._param = _v;	\
1545 	    } else if (_flags & IEEE80211_CHAN_5GHZ)			\
1546 		    _base.params[IEEE80211_MODE_TURBO_A]._param = _v;	\
1547 	    else							\
1548 		    _base.params[IEEE80211_MODE_TURBO_G]._param = _v;	\
1549     }									\
1550     if (_flags & IEEE80211_CHAN_STURBO)					\
1551 	    _base.params[IEEE80211_MODE_STURBO_A]._param = _v;		\
1552     if ((_flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)		\
1553 	    _base.params[IEEE80211_MODE_11A]._param = _v;		\
1554     if ((_flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)		\
1555 	    _base.params[IEEE80211_MODE_11G]._param = _v;		\
1556     if ((_flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)		\
1557 	    _base.params[IEEE80211_MODE_11B]._param = _v;		\
1558     if (_flags & IEEE80211_CHAN_HALF)					\
1559 	    _base.params[IEEE80211_MODE_HALF]._param = _v;		\
1560     if (_flags & IEEE80211_CHAN_QUARTER)				\
1561 	    _base.params[IEEE80211_MODE_QUARTER]._param = _v;		\
1562 } while (0)
1563 #define	_APPLY1(_flags, _base, _param, _v) do {				\
1564     if (_flags & IEEE80211_CHAN_HT) {					\
1565 	    if (_flags & IEEE80211_CHAN_5GHZ)				\
1566 		    _base.params[IEEE80211_MODE_11NA]._param = _v;	\
1567 	    else							\
1568 		    _base.params[IEEE80211_MODE_11NG]._param = _v;	\
1569     } else if ((_flags & IEEE80211_CHAN_108A) == IEEE80211_CHAN_108A)	\
1570 	    _base.params[IEEE80211_MODE_TURBO_A]._param = _v;		\
1571     else if ((_flags & IEEE80211_CHAN_108G) == IEEE80211_CHAN_108G)	\
1572 	    _base.params[IEEE80211_MODE_TURBO_G]._param = _v;		\
1573     else if ((_flags & IEEE80211_CHAN_ST) == IEEE80211_CHAN_ST)		\
1574 	    _base.params[IEEE80211_MODE_STURBO_A]._param = _v;		\
1575     else if (_flags & IEEE80211_CHAN_HALF)				\
1576 	    _base.params[IEEE80211_MODE_HALF]._param = _v;		\
1577     else if (_flags & IEEE80211_CHAN_QUARTER)				\
1578 	    _base.params[IEEE80211_MODE_QUARTER]._param = _v;		\
1579     else if ((_flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)		\
1580 	    _base.params[IEEE80211_MODE_11A]._param = _v;		\
1581     else if ((_flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)		\
1582 	    _base.params[IEEE80211_MODE_11G]._param = _v;		\
1583     else if ((_flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)		\
1584 	    _base.params[IEEE80211_MODE_11B]._param = _v;		\
1585 } while (0)
1586 #define	_APPLY_RATE(_flags, _base, _param, _v) do {			\
1587     if (_flags & IEEE80211_CHAN_HT) {					\
1588 	(_v) = (_v / 2) | IEEE80211_RATE_MCS;				\
1589     }									\
1590     _APPLY(_flags, _base, _param, _v);					\
1591 } while (0)
1592 #define	_APPLY_RATE1(_flags, _base, _param, _v) do {			\
1593     if (_flags & IEEE80211_CHAN_HT) {					\
1594 	(_v) = (_v / 2) | IEEE80211_RATE_MCS;				\
1595     }									\
1596     _APPLY1(_flags, _base, _param, _v);					\
1597 } while (0)
1598 
1599 static
1600 DECL_CMD_FUNC(set80211roamrssi, val, d)
1601 {
1602 	double v = atof(val);
1603 	int rssi, flags;
1604 
1605 	rssi = (int) (2*v);
1606 	if (rssi != 2*v)
1607 		errx(-1, "invalid rssi (must be .5 dBm units)");
1608 	flags = getmodeflags(val);
1609 	getroam(s);
1610 	if (flags == 0) {		/* NB: no flags => current channel */
1611 		flags = getcurchan(s)->ic_flags;
1612 		_APPLY1(flags, roamparams, rssi, rssi);
1613 	} else
1614 		_APPLY(flags, roamparams, rssi, rssi);
1615 	callback_register(setroam_cb, &roamparams);
1616 }
1617 
1618 static int
1619 getrate(const char *val, const char *tag)
1620 {
1621 	double v = atof(val);
1622 	int rate;
1623 
1624 	rate = (int) (2*v);
1625 	if (rate != 2*v)
1626 		errx(-1, "invalid %s rate (must be .5 Mb/s units)", tag);
1627 	return rate;		/* NB: returns 2x the specified value */
1628 }
1629 
1630 static
1631 DECL_CMD_FUNC(set80211roamrate, val, d)
1632 {
1633 	int rate, flags;
1634 
1635 	rate = getrate(val, "roam");
1636 	flags = getmodeflags(val);
1637 	getroam(s);
1638 	if (flags == 0) {		/* NB: no flags => current channel */
1639 		flags = getcurchan(s)->ic_flags;
1640 		_APPLY_RATE1(flags, roamparams, rate, rate);
1641 	} else
1642 		_APPLY_RATE(flags, roamparams, rate, rate);
1643 	callback_register(setroam_cb, &roamparams);
1644 }
1645 
1646 static
1647 DECL_CMD_FUNC(set80211mcastrate, val, d)
1648 {
1649 	int rate, flags;
1650 
1651 	rate = getrate(val, "mcast");
1652 	flags = getmodeflags(val);
1653 	gettxparams(s);
1654 	if (flags == 0) {		/* NB: no flags => current channel */
1655 		flags = getcurchan(s)->ic_flags;
1656 		_APPLY_RATE1(flags, txparams, mcastrate, rate);
1657 	} else
1658 		_APPLY_RATE(flags, txparams, mcastrate, rate);
1659 	callback_register(settxparams_cb, &txparams);
1660 }
1661 
1662 static
1663 DECL_CMD_FUNC(set80211mgtrate, val, d)
1664 {
1665 	int rate, flags;
1666 
1667 	rate = getrate(val, "mgmt");
1668 	flags = getmodeflags(val);
1669 	gettxparams(s);
1670 	if (flags == 0) {		/* NB: no flags => current channel */
1671 		flags = getcurchan(s)->ic_flags;
1672 		_APPLY_RATE1(flags, txparams, mgmtrate, rate);
1673 	} else
1674 		_APPLY_RATE(flags, txparams, mgmtrate, rate);
1675 	callback_register(settxparams_cb, &txparams);
1676 }
1677 
1678 static
1679 DECL_CMD_FUNC(set80211ucastrate, val, d)
1680 {
1681 	int flags;
1682 
1683 	gettxparams(s);
1684 	flags = getmodeflags(val);
1685 	if (isanyarg(val)) {
1686 		if (flags == 0) {	/* NB: no flags => current channel */
1687 			flags = getcurchan(s)->ic_flags;
1688 			_APPLY1(flags, txparams, ucastrate,
1689 			    IEEE80211_FIXED_RATE_NONE);
1690 		} else
1691 			_APPLY(flags, txparams, ucastrate,
1692 			    IEEE80211_FIXED_RATE_NONE);
1693 	} else {
1694 		int rate = getrate(val, "ucast");
1695 		if (flags == 0) {	/* NB: no flags => current channel */
1696 			flags = getcurchan(s)->ic_flags;
1697 			_APPLY_RATE1(flags, txparams, ucastrate, rate);
1698 		} else
1699 			_APPLY_RATE(flags, txparams, ucastrate, rate);
1700 	}
1701 	callback_register(settxparams_cb, &txparams);
1702 }
1703 
1704 static
1705 DECL_CMD_FUNC(set80211maxretry, val, d)
1706 {
1707 	int v = atoi(val), flags;
1708 
1709 	flags = getmodeflags(val);
1710 	gettxparams(s);
1711 	if (flags == 0) {		/* NB: no flags => current channel */
1712 		flags = getcurchan(s)->ic_flags;
1713 		_APPLY1(flags, txparams, maxretry, v);
1714 	} else
1715 		_APPLY(flags, txparams, maxretry, v);
1716 	callback_register(settxparams_cb, &txparams);
1717 }
1718 #undef _APPLY_RATE
1719 #undef _APPLY
1720 
1721 static
1722 DECL_CMD_FUNC(set80211fragthreshold, val, d)
1723 {
1724 	set80211(s, IEEE80211_IOC_FRAGTHRESHOLD,
1725 		isundefarg(val) ? IEEE80211_FRAG_MAX : atoi(val), 0, NULL);
1726 }
1727 
1728 static
1729 DECL_CMD_FUNC(set80211bmissthreshold, val, d)
1730 {
1731 	set80211(s, IEEE80211_IOC_BMISSTHRESHOLD,
1732 		isundefarg(val) ? IEEE80211_HWBMISS_MAX : atoi(val), 0, NULL);
1733 }
1734 
1735 static void
1736 set80211burst(const char *val, int d, int s, const struct afswtch *rafp)
1737 {
1738 	set80211(s, IEEE80211_IOC_BURST, d, 0, NULL);
1739 }
1740 
1741 static void
1742 set80211doth(const char *val, int d, int s, const struct afswtch *rafp)
1743 {
1744 	set80211(s, IEEE80211_IOC_DOTH, d, 0, NULL);
1745 }
1746 
1747 static void
1748 set80211dfs(const char *val, int d, int s, const struct afswtch *rafp)
1749 {
1750 	set80211(s, IEEE80211_IOC_DFS, d, 0, NULL);
1751 }
1752 
1753 static void
1754 set80211shortgi(const char *val, int d, int s, const struct afswtch *rafp)
1755 {
1756 	set80211(s, IEEE80211_IOC_SHORTGI,
1757 		d ? (IEEE80211_HTCAP_SHORTGI20 | IEEE80211_HTCAP_SHORTGI40) : 0,
1758 		0, NULL);
1759 }
1760 
1761 /* XXX 11ac density/size is different */
1762 static void
1763 set80211ampdu(const char *val, int d, int s, const struct afswtch *rafp)
1764 {
1765 	int ampdu;
1766 
1767 	if (get80211val(s, IEEE80211_IOC_AMPDU, &ampdu) < 0)
1768 		errx(-1, "cannot set AMPDU setting");
1769 	if (d < 0) {
1770 		d = -d;
1771 		ampdu &= ~d;
1772 	} else
1773 		ampdu |= d;
1774 	set80211(s, IEEE80211_IOC_AMPDU, ampdu, 0, NULL);
1775 }
1776 
1777 static void
1778 set80211stbc(const char *val, int d, int s, const struct afswtch *rafp)
1779 {
1780 	int stbc;
1781 
1782 	if (get80211val(s, IEEE80211_IOC_STBC, &stbc) < 0)
1783 		errx(-1, "cannot set STBC setting");
1784 	if (d < 0) {
1785 		d = -d;
1786 		stbc &= ~d;
1787 	} else
1788 		stbc |= d;
1789 	set80211(s, IEEE80211_IOC_STBC, stbc, 0, NULL);
1790 }
1791 
1792 static void
1793 set80211ldpc(const char *val, int d, int s, const struct afswtch *rafp)
1794 {
1795         int ldpc;
1796 
1797         if (get80211val(s, IEEE80211_IOC_LDPC, &ldpc) < 0)
1798                 errx(-1, "cannot set LDPC setting");
1799         if (d < 0) {
1800                 d = -d;
1801                 ldpc &= ~d;
1802         } else
1803                 ldpc |= d;
1804         set80211(s, IEEE80211_IOC_LDPC, ldpc, 0, NULL);
1805 }
1806 
1807 static
1808 DECL_CMD_FUNC(set80211ampdulimit, val, d)
1809 {
1810 	int v;
1811 
1812 	switch (atoi(val)) {
1813 	case 8:
1814 	case 8*1024:
1815 		v = IEEE80211_HTCAP_MAXRXAMPDU_8K;
1816 		break;
1817 	case 16:
1818 	case 16*1024:
1819 		v = IEEE80211_HTCAP_MAXRXAMPDU_16K;
1820 		break;
1821 	case 32:
1822 	case 32*1024:
1823 		v = IEEE80211_HTCAP_MAXRXAMPDU_32K;
1824 		break;
1825 	case 64:
1826 	case 64*1024:
1827 		v = IEEE80211_HTCAP_MAXRXAMPDU_64K;
1828 		break;
1829 	default:
1830 		errx(-1, "invalid A-MPDU limit %s", val);
1831 	}
1832 	set80211(s, IEEE80211_IOC_AMPDU_LIMIT, v, 0, NULL);
1833 }
1834 
1835 /* XXX 11ac density/size is different */
1836 static
1837 DECL_CMD_FUNC(set80211ampdudensity, val, d)
1838 {
1839 	int v;
1840 
1841 	if (isanyarg(val) || strcasecmp(val, "na") == 0)
1842 		v = IEEE80211_HTCAP_MPDUDENSITY_NA;
1843 	else switch ((int)(atof(val)*4)) {
1844 	case 0:
1845 		v = IEEE80211_HTCAP_MPDUDENSITY_NA;
1846 		break;
1847 	case 1:
1848 		v = IEEE80211_HTCAP_MPDUDENSITY_025;
1849 		break;
1850 	case 2:
1851 		v = IEEE80211_HTCAP_MPDUDENSITY_05;
1852 		break;
1853 	case 4:
1854 		v = IEEE80211_HTCAP_MPDUDENSITY_1;
1855 		break;
1856 	case 8:
1857 		v = IEEE80211_HTCAP_MPDUDENSITY_2;
1858 		break;
1859 	case 16:
1860 		v = IEEE80211_HTCAP_MPDUDENSITY_4;
1861 		break;
1862 	case 32:
1863 		v = IEEE80211_HTCAP_MPDUDENSITY_8;
1864 		break;
1865 	case 64:
1866 		v = IEEE80211_HTCAP_MPDUDENSITY_16;
1867 		break;
1868 	default:
1869 		errx(-1, "invalid A-MPDU density %s", val);
1870 	}
1871 	set80211(s, IEEE80211_IOC_AMPDU_DENSITY, v, 0, NULL);
1872 }
1873 
1874 static void
1875 set80211amsdu(const char *val, int d, int s, const struct afswtch *rafp)
1876 {
1877 	int amsdu;
1878 
1879 	if (get80211val(s, IEEE80211_IOC_AMSDU, &amsdu) < 0)
1880 		err(-1, "cannot get AMSDU setting");
1881 	if (d < 0) {
1882 		d = -d;
1883 		amsdu &= ~d;
1884 	} else
1885 		amsdu |= d;
1886 	set80211(s, IEEE80211_IOC_AMSDU, amsdu, 0, NULL);
1887 }
1888 
1889 static
1890 DECL_CMD_FUNC(set80211amsdulimit, val, d)
1891 {
1892 	set80211(s, IEEE80211_IOC_AMSDU_LIMIT, atoi(val), 0, NULL);
1893 }
1894 
1895 static void
1896 set80211puren(const char *val, int d, int s, const struct afswtch *rafp)
1897 {
1898 	set80211(s, IEEE80211_IOC_PUREN, d, 0, NULL);
1899 }
1900 
1901 static void
1902 set80211htcompat(const char *val, int d, int s, const struct afswtch *rafp)
1903 {
1904 	set80211(s, IEEE80211_IOC_HTCOMPAT, d, 0, NULL);
1905 }
1906 
1907 static void
1908 set80211htconf(const char *val, int d, int s, const struct afswtch *rafp)
1909 {
1910 	set80211(s, IEEE80211_IOC_HTCONF, d, 0, NULL);
1911 	htconf = d;
1912 }
1913 
1914 static void
1915 set80211dwds(const char *val, int d, int s, const struct afswtch *rafp)
1916 {
1917 	set80211(s, IEEE80211_IOC_DWDS, d, 0, NULL);
1918 }
1919 
1920 static void
1921 set80211inact(const char *val, int d, int s, const struct afswtch *rafp)
1922 {
1923 	set80211(s, IEEE80211_IOC_INACTIVITY, d, 0, NULL);
1924 }
1925 
1926 static void
1927 set80211tsn(const char *val, int d, int s, const struct afswtch *rafp)
1928 {
1929 	set80211(s, IEEE80211_IOC_TSN, d, 0, NULL);
1930 }
1931 
1932 static void
1933 set80211dotd(const char *val, int d, int s, const struct afswtch *rafp)
1934 {
1935 	set80211(s, IEEE80211_IOC_DOTD, d, 0, NULL);
1936 }
1937 
1938 static void
1939 set80211smps(const char *val, int d, int s, const struct afswtch *rafp)
1940 {
1941 	set80211(s, IEEE80211_IOC_SMPS, d, 0, NULL);
1942 }
1943 
1944 static void
1945 set80211rifs(const char *val, int d, int s, const struct afswtch *rafp)
1946 {
1947 	set80211(s, IEEE80211_IOC_RIFS, d, 0, NULL);
1948 }
1949 
1950 static void
1951 set80211vhtconf(const char *val, int d, int s, const struct afswtch *rafp)
1952 {
1953 	if (get80211val(s, IEEE80211_IOC_VHTCONF, &vhtconf) < 0)
1954 		errx(-1, "cannot set VHT setting");
1955 	printf("%s: vhtconf=0x%08x, d=%d\n", __func__, vhtconf, d);
1956 	if (d < 0) {
1957 		d = -d;
1958 		vhtconf &= ~d;
1959 	} else
1960 		vhtconf |= d;
1961 	printf("%s: vhtconf is now 0x%08x\n", __func__, vhtconf);
1962 	set80211(s, IEEE80211_IOC_VHTCONF, vhtconf, 0, NULL);
1963 }
1964 
1965 static
1966 DECL_CMD_FUNC(set80211tdmaslot, val, d)
1967 {
1968 	set80211(s, IEEE80211_IOC_TDMA_SLOT, atoi(val), 0, NULL);
1969 }
1970 
1971 static
1972 DECL_CMD_FUNC(set80211tdmaslotcnt, val, d)
1973 {
1974 	set80211(s, IEEE80211_IOC_TDMA_SLOTCNT, atoi(val), 0, NULL);
1975 }
1976 
1977 static
1978 DECL_CMD_FUNC(set80211tdmaslotlen, val, d)
1979 {
1980 	set80211(s, IEEE80211_IOC_TDMA_SLOTLEN, atoi(val), 0, NULL);
1981 }
1982 
1983 static
1984 DECL_CMD_FUNC(set80211tdmabintval, val, d)
1985 {
1986 	set80211(s, IEEE80211_IOC_TDMA_BINTERVAL, atoi(val), 0, NULL);
1987 }
1988 
1989 static
1990 DECL_CMD_FUNC(set80211meshttl, val, d)
1991 {
1992 	set80211(s, IEEE80211_IOC_MESH_TTL, atoi(val), 0, NULL);
1993 }
1994 
1995 static
1996 DECL_CMD_FUNC(set80211meshforward, val, d)
1997 {
1998 	set80211(s, IEEE80211_IOC_MESH_FWRD, d, 0, NULL);
1999 }
2000 
2001 static
2002 DECL_CMD_FUNC(set80211meshgate, val, d)
2003 {
2004 	set80211(s, IEEE80211_IOC_MESH_GATE, d, 0, NULL);
2005 }
2006 
2007 static
2008 DECL_CMD_FUNC(set80211meshpeering, val, d)
2009 {
2010 	set80211(s, IEEE80211_IOC_MESH_AP, d, 0, NULL);
2011 }
2012 
2013 static
2014 DECL_CMD_FUNC(set80211meshmetric, val, d)
2015 {
2016 	char v[12];
2017 
2018 	memcpy(v, val, sizeof(v));
2019 	set80211(s, IEEE80211_IOC_MESH_PR_METRIC, 0, 0, v);
2020 }
2021 
2022 static
2023 DECL_CMD_FUNC(set80211meshpath, val, d)
2024 {
2025 	char v[12];
2026 
2027 	memcpy(v, val, sizeof(v));
2028 	set80211(s, IEEE80211_IOC_MESH_PR_PATH, 0, 0, v);
2029 }
2030 
2031 static int
2032 regdomain_sort(const void *a, const void *b)
2033 {
2034 #define	CHAN_ALL \
2035 	(IEEE80211_CHAN_ALLTURBO|IEEE80211_CHAN_HALF|IEEE80211_CHAN_QUARTER)
2036 	const struct ieee80211_channel *ca = a;
2037 	const struct ieee80211_channel *cb = b;
2038 
2039 	return ca->ic_freq == cb->ic_freq ?
2040 	    (ca->ic_flags & CHAN_ALL) - (cb->ic_flags & CHAN_ALL) :
2041 	    ca->ic_freq - cb->ic_freq;
2042 #undef CHAN_ALL
2043 }
2044 
2045 static const struct ieee80211_channel *
2046 chanlookup(const struct ieee80211_channel chans[], int nchans,
2047 	int freq, int flags)
2048 {
2049 	int i;
2050 
2051 	flags &= IEEE80211_CHAN_ALLTURBO;
2052 	for (i = 0; i < nchans; i++) {
2053 		const struct ieee80211_channel *c = &chans[i];
2054 		if (c->ic_freq == freq &&
2055 		    (c->ic_flags & IEEE80211_CHAN_ALLTURBO) == flags)
2056 			return c;
2057 	}
2058 	return NULL;
2059 }
2060 
2061 static int
2062 chanfind(const struct ieee80211_channel chans[], int nchans, int flags)
2063 {
2064 	int i;
2065 
2066 	for (i = 0; i < nchans; i++) {
2067 		const struct ieee80211_channel *c = &chans[i];
2068 		if ((c->ic_flags & flags) == flags)
2069 			return 1;
2070 	}
2071 	return 0;
2072 }
2073 
2074 /*
2075  * Check channel compatibility.
2076  */
2077 static int
2078 checkchan(const struct ieee80211req_chaninfo *avail, int freq, int flags)
2079 {
2080 	flags &= ~REQ_FLAGS;
2081 	/*
2082 	 * Check if exact channel is in the calibration table;
2083 	 * everything below is to deal with channels that we
2084 	 * want to include but that are not explicitly listed.
2085 	 */
2086 	if (chanlookup(avail->ic_chans, avail->ic_nchans, freq, flags) != NULL)
2087 		return 1;
2088 	if (flags & IEEE80211_CHAN_GSM) {
2089 		/*
2090 		 * XXX GSM frequency mapping is handled in the kernel
2091 		 * so we cannot find them in the calibration table;
2092 		 * just accept the channel and the kernel will reject
2093 		 * the channel list if it's wrong.
2094 		 */
2095 		return 1;
2096 	}
2097 	/*
2098 	 * If this is a 1/2 or 1/4 width channel allow it if a full
2099 	 * width channel is present for this frequency, and the device
2100 	 * supports fractional channels on this band.  This is a hack
2101 	 * that avoids bloating the calibration table; it may be better
2102 	 * by per-band attributes though (we are effectively calculating
2103 	 * this attribute by scanning the channel list ourself).
2104 	 */
2105 	if ((flags & (IEEE80211_CHAN_HALF | IEEE80211_CHAN_QUARTER)) == 0)
2106 		return 0;
2107 	if (chanlookup(avail->ic_chans, avail->ic_nchans, freq,
2108 	    flags &~ (IEEE80211_CHAN_HALF | IEEE80211_CHAN_QUARTER)) == NULL)
2109 		return 0;
2110 	if (flags & IEEE80211_CHAN_HALF) {
2111 		return chanfind(avail->ic_chans, avail->ic_nchans,
2112 		    IEEE80211_CHAN_HALF |
2113 		       (flags & (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ)));
2114 	} else {
2115 		return chanfind(avail->ic_chans, avail->ic_nchans,
2116 		    IEEE80211_CHAN_QUARTER |
2117 			(flags & (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ)));
2118 	}
2119 }
2120 
2121 static void
2122 regdomain_addchans(struct ieee80211req_chaninfo *ci,
2123 	const netband_head *bands,
2124 	const struct ieee80211_regdomain *reg,
2125 	uint32_t chanFlags,
2126 	const struct ieee80211req_chaninfo *avail)
2127 {
2128 	const struct netband *nb;
2129 	const struct freqband *b;
2130 	struct ieee80211_channel *c, *prev;
2131 	int freq, hi_adj, lo_adj, channelSep;
2132 	uint32_t flags;
2133 
2134 	hi_adj = (chanFlags & IEEE80211_CHAN_HT40U) ? -20 : 0;
2135 	lo_adj = (chanFlags & IEEE80211_CHAN_HT40D) ? 20 : 0;
2136 	channelSep = (chanFlags & IEEE80211_CHAN_2GHZ) ? 0 : 40;
2137 
2138 	LIST_FOREACH(nb, bands, next) {
2139 		b = nb->band;
2140 		if (verbose) {
2141 			printf("%s:", __func__);
2142 			printb(" chanFlags", chanFlags, IEEE80211_CHAN_BITS);
2143 			printb(" bandFlags", nb->flags | b->flags,
2144 			    IEEE80211_CHAN_BITS);
2145 			putchar('\n');
2146 		}
2147 		prev = NULL;
2148 
2149 		for (freq = b->freqStart + lo_adj;
2150 		     freq <= b->freqEnd + hi_adj; freq += b->chanSep) {
2151 			/*
2152 			 * Construct flags for the new channel.  We take
2153 			 * the attributes from the band descriptions except
2154 			 * for HT40 which is enabled generically (i.e. +/-
2155 			 * extension channel) in the band description and
2156 			 * then constrained according by channel separation.
2157 			 */
2158 			flags = nb->flags | b->flags;
2159 
2160 			/*
2161 			 * VHT first - HT is a subset.
2162 			 *
2163 			 * XXX TODO: VHT80p80, VHT160 is not yet done.
2164 			 */
2165 			if (flags & IEEE80211_CHAN_VHT) {
2166 				if ((chanFlags & IEEE80211_CHAN_VHT20) &&
2167 				    (flags & IEEE80211_CHAN_VHT20) == 0) {
2168 					if (verbose)
2169 						printf("%u: skip, not a "
2170 						    "VHT20 channel\n", freq);
2171 					continue;
2172 				}
2173 				if ((chanFlags & IEEE80211_CHAN_VHT40) &&
2174 				    (flags & IEEE80211_CHAN_VHT40) == 0) {
2175 					if (verbose)
2176 						printf("%u: skip, not a "
2177 						    "VHT40 channel\n", freq);
2178 					continue;
2179 				}
2180 				if ((chanFlags & IEEE80211_CHAN_VHT80) &&
2181 				    (flags & IEEE80211_CHAN_VHT80) == 0) {
2182 					if (verbose)
2183 						printf("%u: skip, not a "
2184 						    "VHT80 channel\n", freq);
2185 					continue;
2186 				}
2187 
2188 				flags &= ~IEEE80211_CHAN_VHT;
2189 				flags |= chanFlags & IEEE80211_CHAN_VHT;
2190 			}
2191 
2192 			/* Now, constrain HT */
2193 			if (flags & IEEE80211_CHAN_HT) {
2194 				/*
2195 				 * HT channels are generated specially; we're
2196 				 * called to add HT20, HT40+, and HT40- chan's
2197 				 * so we need to expand only band specs for
2198 				 * the HT channel type being added.
2199 				 */
2200 				if ((chanFlags & IEEE80211_CHAN_HT20) &&
2201 				    (flags & IEEE80211_CHAN_HT20) == 0) {
2202 					if (verbose)
2203 						printf("%u: skip, not an "
2204 						    "HT20 channel\n", freq);
2205 					continue;
2206 				}
2207 				if ((chanFlags & IEEE80211_CHAN_HT40) &&
2208 				    (flags & IEEE80211_CHAN_HT40) == 0) {
2209 					if (verbose)
2210 						printf("%u: skip, not an "
2211 						    "HT40 channel\n", freq);
2212 					continue;
2213 				}
2214 				/* NB: HT attribute comes from caller */
2215 				flags &= ~IEEE80211_CHAN_HT;
2216 				flags |= chanFlags & IEEE80211_CHAN_HT;
2217 			}
2218 			/*
2219 			 * Check if device can operate on this frequency.
2220 			 */
2221 			if (!checkchan(avail, freq, flags)) {
2222 				if (verbose) {
2223 					printf("%u: skip, ", freq);
2224 					printb("flags", flags,
2225 					    IEEE80211_CHAN_BITS);
2226 					printf(" not available\n");
2227 				}
2228 				continue;
2229 			}
2230 			if ((flags & REQ_ECM) && !reg->ecm) {
2231 				if (verbose)
2232 					printf("%u: skip, ECM channel\n", freq);
2233 				continue;
2234 			}
2235 			if ((flags & REQ_INDOOR) && reg->location == 'O') {
2236 				if (verbose)
2237 					printf("%u: skip, indoor channel\n",
2238 					    freq);
2239 				continue;
2240 			}
2241 			if ((flags & REQ_OUTDOOR) && reg->location == 'I') {
2242 				if (verbose)
2243 					printf("%u: skip, outdoor channel\n",
2244 					    freq);
2245 				continue;
2246 			}
2247 			if ((flags & IEEE80211_CHAN_HT40) &&
2248 			    prev != NULL && (freq - prev->ic_freq) < channelSep) {
2249 				if (verbose)
2250 					printf("%u: skip, only %u channel "
2251 					    "separation, need %d\n", freq,
2252 					    freq - prev->ic_freq, channelSep);
2253 				continue;
2254 			}
2255 			if (ci->ic_nchans == IEEE80211_CHAN_MAX) {
2256 				if (verbose)
2257 					printf("%u: skip, channel table full\n",
2258 					    freq);
2259 				break;
2260 			}
2261 			c = &ci->ic_chans[ci->ic_nchans++];
2262 			memset(c, 0, sizeof(*c));
2263 			c->ic_freq = freq;
2264 			c->ic_flags = flags;
2265 		if (c->ic_flags & IEEE80211_CHAN_DFS)
2266 				c->ic_maxregpower = nb->maxPowerDFS;
2267 			else
2268 				c->ic_maxregpower = nb->maxPower;
2269 			if (verbose) {
2270 				printf("[%3d] add freq %u ",
2271 				    ci->ic_nchans-1, c->ic_freq);
2272 				printb("flags", c->ic_flags, IEEE80211_CHAN_BITS);
2273 				printf(" power %u\n", c->ic_maxregpower);
2274 			}
2275 			/* NB: kernel fills in other fields */
2276 			prev = c;
2277 		}
2278 	}
2279 }
2280 
2281 static void
2282 regdomain_makechannels(
2283 	struct ieee80211_regdomain_req *req,
2284 	const struct ieee80211_devcaps_req *dc)
2285 {
2286 	struct regdata *rdp = getregdata();
2287 	const struct country *cc;
2288 	const struct ieee80211_regdomain *reg = &req->rd;
2289 	struct ieee80211req_chaninfo *ci = &req->chaninfo;
2290 	const struct regdomain *rd;
2291 
2292 	/*
2293 	 * Locate construction table for new channel list.  We treat
2294 	 * the regdomain/SKU as definitive so a country can be in
2295 	 * multiple with different properties (e.g. US in FCC+FCC3).
2296 	 * If no regdomain is specified then we fallback on the country
2297 	 * code to find the associated regdomain since countries always
2298 	 * belong to at least one regdomain.
2299 	 */
2300 	if (reg->regdomain == 0) {
2301 		cc = lib80211_country_findbycc(rdp, reg->country);
2302 		if (cc == NULL)
2303 			errx(1, "internal error, country %d not found",
2304 			    reg->country);
2305 		rd = cc->rd;
2306 	} else
2307 		rd = lib80211_regdomain_findbysku(rdp, reg->regdomain);
2308 	if (rd == NULL)
2309 		errx(1, "internal error, regdomain %d not found",
2310 			    reg->regdomain);
2311 	if (rd->sku != SKU_DEBUG) {
2312 		/*
2313 		 * regdomain_addchans incrememnts the channel count for
2314 		 * each channel it adds so initialize ic_nchans to zero.
2315 		 * Note that we know we have enough space to hold all possible
2316 		 * channels because the devcaps list size was used to
2317 		 * allocate our request.
2318 		 */
2319 		ci->ic_nchans = 0;
2320 		if (!LIST_EMPTY(&rd->bands_11b))
2321 			regdomain_addchans(ci, &rd->bands_11b, reg,
2322 			    IEEE80211_CHAN_B, &dc->dc_chaninfo);
2323 		if (!LIST_EMPTY(&rd->bands_11g))
2324 			regdomain_addchans(ci, &rd->bands_11g, reg,
2325 			    IEEE80211_CHAN_G, &dc->dc_chaninfo);
2326 		if (!LIST_EMPTY(&rd->bands_11a))
2327 			regdomain_addchans(ci, &rd->bands_11a, reg,
2328 			    IEEE80211_CHAN_A, &dc->dc_chaninfo);
2329 		if (!LIST_EMPTY(&rd->bands_11na) && dc->dc_htcaps != 0) {
2330 			regdomain_addchans(ci, &rd->bands_11na, reg,
2331 			    IEEE80211_CHAN_A | IEEE80211_CHAN_HT20,
2332 			    &dc->dc_chaninfo);
2333 			if (dc->dc_htcaps & IEEE80211_HTCAP_CHWIDTH40) {
2334 				regdomain_addchans(ci, &rd->bands_11na, reg,
2335 				    IEEE80211_CHAN_A | IEEE80211_CHAN_HT40U,
2336 				    &dc->dc_chaninfo);
2337 				regdomain_addchans(ci, &rd->bands_11na, reg,
2338 				    IEEE80211_CHAN_A | IEEE80211_CHAN_HT40D,
2339 				    &dc->dc_chaninfo);
2340 			}
2341 		}
2342 		if (!LIST_EMPTY(&rd->bands_11ac) && dc->dc_vhtcaps != 0) {
2343 			regdomain_addchans(ci, &rd->bands_11ac, reg,
2344 			    IEEE80211_CHAN_A | IEEE80211_CHAN_HT20 |
2345 			    IEEE80211_CHAN_VHT20,
2346 			    &dc->dc_chaninfo);
2347 
2348 			/* VHT40 is a function of HT40.. */
2349 			if (dc->dc_htcaps & IEEE80211_HTCAP_CHWIDTH40) {
2350 				regdomain_addchans(ci, &rd->bands_11ac, reg,
2351 				    IEEE80211_CHAN_A | IEEE80211_CHAN_HT40U |
2352 				    IEEE80211_CHAN_VHT40U,
2353 				    &dc->dc_chaninfo);
2354 				regdomain_addchans(ci, &rd->bands_11ac, reg,
2355 				    IEEE80211_CHAN_A | IEEE80211_CHAN_HT40D |
2356 				    IEEE80211_CHAN_VHT40D,
2357 				    &dc->dc_chaninfo);
2358 			}
2359 
2360 			/* VHT80 */
2361 			/* XXX dc_vhtcap? */
2362 			if (1) {
2363 				regdomain_addchans(ci, &rd->bands_11ac, reg,
2364 				    IEEE80211_CHAN_A | IEEE80211_CHAN_HT40U |
2365 				    IEEE80211_CHAN_VHT80,
2366 				    &dc->dc_chaninfo);
2367 				regdomain_addchans(ci, &rd->bands_11ac, reg,
2368 				    IEEE80211_CHAN_A | IEEE80211_CHAN_HT40D |
2369 				    IEEE80211_CHAN_VHT80,
2370 				    &dc->dc_chaninfo);
2371 			}
2372 
2373 			/* XXX TODO: VHT80_80, VHT160 */
2374 		}
2375 
2376 		if (!LIST_EMPTY(&rd->bands_11ng) && dc->dc_htcaps != 0) {
2377 			regdomain_addchans(ci, &rd->bands_11ng, reg,
2378 			    IEEE80211_CHAN_G | IEEE80211_CHAN_HT20,
2379 			    &dc->dc_chaninfo);
2380 			if (dc->dc_htcaps & IEEE80211_HTCAP_CHWIDTH40) {
2381 				regdomain_addchans(ci, &rd->bands_11ng, reg,
2382 				    IEEE80211_CHAN_G | IEEE80211_CHAN_HT40U,
2383 				    &dc->dc_chaninfo);
2384 				regdomain_addchans(ci, &rd->bands_11ng, reg,
2385 				    IEEE80211_CHAN_G | IEEE80211_CHAN_HT40D,
2386 				    &dc->dc_chaninfo);
2387 			}
2388 		}
2389 		qsort(ci->ic_chans, ci->ic_nchans, sizeof(ci->ic_chans[0]),
2390 		    regdomain_sort);
2391 	} else
2392 		memcpy(ci, &dc->dc_chaninfo,
2393 		    IEEE80211_CHANINFO_SPACE(&dc->dc_chaninfo));
2394 }
2395 
2396 static void
2397 list_countries(void)
2398 {
2399 	struct regdata *rdp = getregdata();
2400 	const struct country *cp;
2401 	const struct regdomain *dp;
2402 	int i;
2403 
2404 	i = 0;
2405 	printf("\nCountry codes:\n");
2406 	LIST_FOREACH(cp, &rdp->countries, next) {
2407 		printf("%2s %-15.15s%s", cp->isoname,
2408 		    cp->name, ((i+1)%4) == 0 ? "\n" : " ");
2409 		i++;
2410 	}
2411 	i = 0;
2412 	printf("\nRegulatory domains:\n");
2413 	LIST_FOREACH(dp, &rdp->domains, next) {
2414 		printf("%-15.15s%s", dp->name, ((i+1)%4) == 0 ? "\n" : " ");
2415 		i++;
2416 	}
2417 	printf("\n");
2418 }
2419 
2420 static void
2421 defaultcountry(const struct regdomain *rd)
2422 {
2423 	struct regdata *rdp = getregdata();
2424 	const struct country *cc;
2425 
2426 	cc = lib80211_country_findbycc(rdp, rd->cc->code);
2427 	if (cc == NULL)
2428 		errx(1, "internal error, ISO country code %d not "
2429 		    "defined for regdomain %s", rd->cc->code, rd->name);
2430 	regdomain.country = cc->code;
2431 	regdomain.isocc[0] = cc->isoname[0];
2432 	regdomain.isocc[1] = cc->isoname[1];
2433 }
2434 
2435 static
2436 DECL_CMD_FUNC(set80211regdomain, val, d)
2437 {
2438 	struct regdata *rdp = getregdata();
2439 	const struct regdomain *rd;
2440 
2441 	rd = lib80211_regdomain_findbyname(rdp, val);
2442 	if (rd == NULL) {
2443 		char *eptr;
2444 		long sku = strtol(val, &eptr, 0);
2445 
2446 		if (eptr != val)
2447 			rd = lib80211_regdomain_findbysku(rdp, sku);
2448 		if (eptr == val || rd == NULL)
2449 			errx(1, "unknown regdomain %s", val);
2450 	}
2451 	getregdomain(s);
2452 	regdomain.regdomain = rd->sku;
2453 	if (regdomain.country == 0 && rd->cc != NULL) {
2454 		/*
2455 		 * No country code setup and there's a default
2456 		 * one for this regdomain fill it in.
2457 		 */
2458 		defaultcountry(rd);
2459 	}
2460 	callback_register(setregdomain_cb, &regdomain);
2461 }
2462 
2463 static
2464 DECL_CMD_FUNC(set80211country, val, d)
2465 {
2466 	struct regdata *rdp = getregdata();
2467 	const struct country *cc;
2468 
2469 	cc = lib80211_country_findbyname(rdp, val);
2470 	if (cc == NULL) {
2471 		char *eptr;
2472 		long code = strtol(val, &eptr, 0);
2473 
2474 		if (eptr != val)
2475 			cc = lib80211_country_findbycc(rdp, code);
2476 		if (eptr == val || cc == NULL)
2477 			errx(1, "unknown ISO country code %s", val);
2478 	}
2479 	getregdomain(s);
2480 	regdomain.regdomain = cc->rd->sku;
2481 	regdomain.country = cc->code;
2482 	regdomain.isocc[0] = cc->isoname[0];
2483 	regdomain.isocc[1] = cc->isoname[1];
2484 	callback_register(setregdomain_cb, &regdomain);
2485 }
2486 
2487 static void
2488 set80211location(const char *val, int d, int s, const struct afswtch *rafp)
2489 {
2490 	getregdomain(s);
2491 	regdomain.location = d;
2492 	callback_register(setregdomain_cb, &regdomain);
2493 }
2494 
2495 static void
2496 set80211ecm(const char *val, int d, int s, const struct afswtch *rafp)
2497 {
2498 	getregdomain(s);
2499 	regdomain.ecm = d;
2500 	callback_register(setregdomain_cb, &regdomain);
2501 }
2502 
2503 static void
2504 LINE_INIT(char c)
2505 {
2506 	spacer = c;
2507 	if (c == '\t')
2508 		col = 8;
2509 	else
2510 		col = 1;
2511 }
2512 
2513 static void
2514 LINE_BREAK(void)
2515 {
2516 	if (spacer != '\t') {
2517 		printf("\n");
2518 		spacer = '\t';
2519 	}
2520 	col = 8;		/* 8-col tab */
2521 }
2522 
2523 static void
2524 LINE_CHECK(const char *fmt, ...)
2525 {
2526 	char buf[80];
2527 	va_list ap;
2528 	int n;
2529 
2530 	va_start(ap, fmt);
2531 	n = vsnprintf(buf+1, sizeof(buf)-1, fmt, ap);
2532 	va_end(ap);
2533 	col += 1+n;
2534 	if (col > MAXCOL) {
2535 		LINE_BREAK();
2536 		col += n;
2537 	}
2538 	buf[0] = spacer;
2539 	printf("%s", buf);
2540 	spacer = ' ';
2541 }
2542 
2543 static int
2544 getmaxrate(const uint8_t rates[15], uint8_t nrates)
2545 {
2546 	int i, maxrate = -1;
2547 
2548 	for (i = 0; i < nrates; i++) {
2549 		int rate = rates[i] & IEEE80211_RATE_VAL;
2550 		if (rate > maxrate)
2551 			maxrate = rate;
2552 	}
2553 	return maxrate / 2;
2554 }
2555 
2556 static const char *
2557 getcaps(int capinfo)
2558 {
2559 	static char capstring[32];
2560 	char *cp = capstring;
2561 
2562 	if (capinfo & IEEE80211_CAPINFO_ESS)
2563 		*cp++ = 'E';
2564 	if (capinfo & IEEE80211_CAPINFO_IBSS)
2565 		*cp++ = 'I';
2566 	if (capinfo & IEEE80211_CAPINFO_CF_POLLABLE)
2567 		*cp++ = 'c';
2568 	if (capinfo & IEEE80211_CAPINFO_CF_POLLREQ)
2569 		*cp++ = 'C';
2570 	if (capinfo & IEEE80211_CAPINFO_PRIVACY)
2571 		*cp++ = 'P';
2572 	if (capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)
2573 		*cp++ = 'S';
2574 	if (capinfo & IEEE80211_CAPINFO_PBCC)
2575 		*cp++ = 'B';
2576 	if (capinfo & IEEE80211_CAPINFO_CHNL_AGILITY)
2577 		*cp++ = 'A';
2578 	if (capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)
2579 		*cp++ = 's';
2580 	if (capinfo & IEEE80211_CAPINFO_RSN)
2581 		*cp++ = 'R';
2582 	if (capinfo & IEEE80211_CAPINFO_DSSSOFDM)
2583 		*cp++ = 'D';
2584 	*cp = '\0';
2585 	return capstring;
2586 }
2587 
2588 static const char *
2589 getflags(int flags)
2590 {
2591 	static char flagstring[32];
2592 	char *cp = flagstring;
2593 
2594 	if (flags & IEEE80211_NODE_AUTH)
2595 		*cp++ = 'A';
2596 	if (flags & IEEE80211_NODE_QOS)
2597 		*cp++ = 'Q';
2598 	if (flags & IEEE80211_NODE_ERP)
2599 		*cp++ = 'E';
2600 	if (flags & IEEE80211_NODE_PWR_MGT)
2601 		*cp++ = 'P';
2602 	if (flags & IEEE80211_NODE_HT) {
2603 		*cp++ = 'H';
2604 		if (flags & IEEE80211_NODE_HTCOMPAT)
2605 			*cp++ = '+';
2606 	}
2607 	if (flags & IEEE80211_NODE_VHT)
2608 		*cp++ = 'V';
2609 	if (flags & IEEE80211_NODE_WPS)
2610 		*cp++ = 'W';
2611 	if (flags & IEEE80211_NODE_TSN)
2612 		*cp++ = 'N';
2613 	if (flags & IEEE80211_NODE_AMPDU_TX)
2614 		*cp++ = 'T';
2615 	if (flags & IEEE80211_NODE_AMPDU_RX)
2616 		*cp++ = 'R';
2617 	if (flags & IEEE80211_NODE_MIMO_PS) {
2618 		*cp++ = 'M';
2619 		if (flags & IEEE80211_NODE_MIMO_RTS)
2620 			*cp++ = '+';
2621 	}
2622 	if (flags & IEEE80211_NODE_RIFS)
2623 		*cp++ = 'I';
2624 	if (flags & IEEE80211_NODE_SGI40) {
2625 		*cp++ = 'S';
2626 		if (flags & IEEE80211_NODE_SGI20)
2627 			*cp++ = '+';
2628 	} else if (flags & IEEE80211_NODE_SGI20)
2629 		*cp++ = 's';
2630 	if (flags & IEEE80211_NODE_AMSDU_TX)
2631 		*cp++ = 't';
2632 	if (flags & IEEE80211_NODE_AMSDU_RX)
2633 		*cp++ = 'r';
2634 	*cp = '\0';
2635 	return flagstring;
2636 }
2637 
2638 static void
2639 printie(const char* tag, const uint8_t *ie, size_t ielen, int maxlen)
2640 {
2641 	printf("%s", tag);
2642 	if (verbose) {
2643 		maxlen -= strlen(tag)+2;
2644 		if (2*ielen > maxlen)
2645 			maxlen--;
2646 		printf("<");
2647 		for (; ielen > 0; ie++, ielen--) {
2648 			if (maxlen-- <= 0)
2649 				break;
2650 			printf("%02x", *ie);
2651 		}
2652 		if (ielen != 0)
2653 			printf("-");
2654 		printf(">");
2655 	}
2656 }
2657 
2658 #define LE_READ_2(p)					\
2659 	((u_int16_t)					\
2660 	 ((((const u_int8_t *)(p))[0]      ) |		\
2661 	  (((const u_int8_t *)(p))[1] <<  8)))
2662 #define LE_READ_4(p)					\
2663 	((u_int32_t)					\
2664 	 ((((const u_int8_t *)(p))[0]      ) |		\
2665 	  (((const u_int8_t *)(p))[1] <<  8) |		\
2666 	  (((const u_int8_t *)(p))[2] << 16) |		\
2667 	  (((const u_int8_t *)(p))[3] << 24)))
2668 
2669 /*
2670  * NB: The decoding routines assume a properly formatted ie
2671  *     which should be safe as the kernel only retains them
2672  *     if they parse ok.
2673  */
2674 
2675 static void
2676 printwmeparam(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2677 {
2678 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
2679 	static const char *acnames[] = { "BE", "BK", "VO", "VI" };
2680 	const struct ieee80211_wme_param *wme =
2681 	    (const struct ieee80211_wme_param *) ie;
2682 	int i;
2683 
2684 	printf("%s", tag);
2685 	if (!verbose)
2686 		return;
2687 	printf("<qosinfo 0x%x", wme->param_qosInfo);
2688 	ie += offsetof(struct ieee80211_wme_param, params_acParams);
2689 	for (i = 0; i < WME_NUM_AC; i++) {
2690 		const struct ieee80211_wme_acparams *ac =
2691 		    &wme->params_acParams[i];
2692 
2693 		printf(" %s[%saifsn %u cwmin %u cwmax %u txop %u]"
2694 			, acnames[i]
2695 			, MS(ac->acp_aci_aifsn, WME_PARAM_ACM) ? "acm " : ""
2696 			, MS(ac->acp_aci_aifsn, WME_PARAM_AIFSN)
2697 			, MS(ac->acp_logcwminmax, WME_PARAM_LOGCWMIN)
2698 			, MS(ac->acp_logcwminmax, WME_PARAM_LOGCWMAX)
2699 			, LE_READ_2(&ac->acp_txop)
2700 		);
2701 	}
2702 	printf(">");
2703 #undef MS
2704 }
2705 
2706 static void
2707 printwmeinfo(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2708 {
2709 	printf("%s", tag);
2710 	if (verbose) {
2711 		const struct ieee80211_wme_info *wme =
2712 		    (const struct ieee80211_wme_info *) ie;
2713 		printf("<version 0x%x info 0x%x>",
2714 		    wme->wme_version, wme->wme_info);
2715 	}
2716 }
2717 
2718 static void
2719 printvhtcap(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2720 {
2721 	printf("%s", tag);
2722 	if (verbose) {
2723 		const struct ieee80211_ie_vhtcap *vhtcap =
2724 		    (const struct ieee80211_ie_vhtcap *) ie;
2725 		uint32_t vhtcap_info = LE_READ_4(&vhtcap->vht_cap_info);
2726 
2727 		printf("<cap 0x%08x", vhtcap_info);
2728 		printf(" rx_mcs_map 0x%x",
2729 		    LE_READ_2(&vhtcap->supp_mcs.rx_mcs_map));
2730 		printf(" rx_highest %d",
2731 		    LE_READ_2(&vhtcap->supp_mcs.rx_highest) & 0x1fff);
2732 		printf(" tx_mcs_map 0x%x",
2733 		    LE_READ_2(&vhtcap->supp_mcs.tx_mcs_map));
2734 		printf(" tx_highest %d",
2735 		    LE_READ_2(&vhtcap->supp_mcs.tx_highest) & 0x1fff);
2736 
2737 		printf(">");
2738 	}
2739 }
2740 
2741 static void
2742 printvhtinfo(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2743 {
2744 	printf("%s", tag);
2745 	if (verbose) {
2746 		const struct ieee80211_ie_vht_operation *vhtinfo =
2747 		    (const struct ieee80211_ie_vht_operation *) ie;
2748 
2749 		printf("<chw %d freq1_idx %d freq2_idx %d basic_mcs_set 0x%04x>",
2750 		    vhtinfo->chan_width,
2751 		    vhtinfo->center_freq_seg1_idx,
2752 		    vhtinfo->center_freq_seg2_idx,
2753 		    LE_READ_2(&vhtinfo->basic_mcs_set));
2754 	}
2755 }
2756 
2757 static void
2758 printvhtpwrenv(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2759 {
2760 	printf("%s", tag);
2761 	static const char *txpwrmap[] = {
2762 		"20",
2763 		"40",
2764 		"80",
2765 		"160",
2766 	};
2767 	if (verbose) {
2768 		const struct ieee80211_ie_vht_txpwrenv *vhtpwr =
2769 		    (const struct ieee80211_ie_vht_txpwrenv *) ie;
2770 		int i, n;
2771 		const char *sep = "";
2772 
2773 		/* Get count; trim at ielen */
2774 		n = (vhtpwr->tx_info &
2775 		    IEEE80211_VHT_TXPWRENV_INFO_COUNT_MASK) + 1;
2776 		/* Trim at ielen */
2777 		if (n > ielen - 3)
2778 			n = ielen - 3;
2779 		printf("<tx_info 0x%02x pwr:[", vhtpwr->tx_info);
2780 		for (i = 0; i < n; i++) {
2781 			printf("%s%s:%.2f", sep, txpwrmap[i],
2782 			    ((float) ((int8_t) ie[i+3])) / 2.0);
2783 			sep = " ";
2784 		}
2785 
2786 		printf("]>");
2787 	}
2788 }
2789 
2790 static void
2791 printhtcap(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2792 {
2793 	printf("%s", tag);
2794 	if (verbose) {
2795 		const struct ieee80211_ie_htcap *htcap =
2796 		    (const struct ieee80211_ie_htcap *) ie;
2797 		const char *sep;
2798 		int i, j;
2799 
2800 		printf("<cap 0x%x param 0x%x",
2801 		    LE_READ_2(&htcap->hc_cap), htcap->hc_param);
2802 		printf(" mcsset[");
2803 		sep = "";
2804 		for (i = 0; i < IEEE80211_HTRATE_MAXSIZE; i++)
2805 			if (isset(htcap->hc_mcsset, i)) {
2806 				for (j = i+1; j < IEEE80211_HTRATE_MAXSIZE; j++)
2807 					if (isclr(htcap->hc_mcsset, j))
2808 						break;
2809 				j--;
2810 				if (i == j)
2811 					printf("%s%u", sep, i);
2812 				else
2813 					printf("%s%u-%u", sep, i, j);
2814 				i += j-i;
2815 				sep = ",";
2816 			}
2817 		printf("] extcap 0x%x txbf 0x%x antenna 0x%x>",
2818 		    LE_READ_2(&htcap->hc_extcap),
2819 		    LE_READ_4(&htcap->hc_txbf),
2820 		    htcap->hc_antenna);
2821 	}
2822 }
2823 
2824 static void
2825 printhtinfo(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2826 {
2827 	printf("%s", tag);
2828 	if (verbose) {
2829 		const struct ieee80211_ie_htinfo *htinfo =
2830 		    (const struct ieee80211_ie_htinfo *) ie;
2831 		const char *sep;
2832 		int i, j;
2833 
2834 		printf("<ctl %u, %x,%x,%x,%x", htinfo->hi_ctrlchannel,
2835 		    htinfo->hi_byte1, htinfo->hi_byte2, htinfo->hi_byte3,
2836 		    LE_READ_2(&htinfo->hi_byte45));
2837 		printf(" basicmcs[");
2838 		sep = "";
2839 		for (i = 0; i < IEEE80211_HTRATE_MAXSIZE; i++)
2840 			if (isset(htinfo->hi_basicmcsset, i)) {
2841 				for (j = i+1; j < IEEE80211_HTRATE_MAXSIZE; j++)
2842 					if (isclr(htinfo->hi_basicmcsset, j))
2843 						break;
2844 				j--;
2845 				if (i == j)
2846 					printf("%s%u", sep, i);
2847 				else
2848 					printf("%s%u-%u", sep, i, j);
2849 				i += j-i;
2850 				sep = ",";
2851 			}
2852 		printf("]>");
2853 	}
2854 }
2855 
2856 static void
2857 printathie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2858 {
2859 
2860 	printf("%s", tag);
2861 	if (verbose) {
2862 		const struct ieee80211_ath_ie *ath =
2863 			(const struct ieee80211_ath_ie *)ie;
2864 
2865 		printf("<");
2866 		if (ath->ath_capability & ATHEROS_CAP_TURBO_PRIME)
2867 			printf("DTURBO,");
2868 		if (ath->ath_capability & ATHEROS_CAP_COMPRESSION)
2869 			printf("COMP,");
2870 		if (ath->ath_capability & ATHEROS_CAP_FAST_FRAME)
2871 			printf("FF,");
2872 		if (ath->ath_capability & ATHEROS_CAP_XR)
2873 			printf("XR,");
2874 		if (ath->ath_capability & ATHEROS_CAP_AR)
2875 			printf("AR,");
2876 		if (ath->ath_capability & ATHEROS_CAP_BURST)
2877 			printf("BURST,");
2878 		if (ath->ath_capability & ATHEROS_CAP_WME)
2879 			printf("WME,");
2880 		if (ath->ath_capability & ATHEROS_CAP_BOOST)
2881 			printf("BOOST,");
2882 		printf("0x%x>", LE_READ_2(ath->ath_defkeyix));
2883 	}
2884 }
2885 
2886 
2887 static void
2888 printmeshconf(const char *tag, const uint8_t *ie, size_t ielen, int maxlen)
2889 {
2890 
2891 	printf("%s", tag);
2892 	if (verbose) {
2893 		const struct ieee80211_meshconf_ie *mconf =
2894 			(const struct ieee80211_meshconf_ie *)ie;
2895 		printf("<PATH:");
2896 		if (mconf->conf_pselid == IEEE80211_MESHCONF_PATH_HWMP)
2897 			printf("HWMP");
2898 		else
2899 			printf("UNKNOWN");
2900 		printf(" LINK:");
2901 		if (mconf->conf_pmetid == IEEE80211_MESHCONF_METRIC_AIRTIME)
2902 			printf("AIRTIME");
2903 		else
2904 			printf("UNKNOWN");
2905 		printf(" CONGESTION:");
2906 		if (mconf->conf_ccid == IEEE80211_MESHCONF_CC_DISABLED)
2907 			printf("DISABLED");
2908 		else
2909 			printf("UNKNOWN");
2910 		printf(" SYNC:");
2911 		if (mconf->conf_syncid == IEEE80211_MESHCONF_SYNC_NEIGHOFF)
2912 			printf("NEIGHOFF");
2913 		else
2914 			printf("UNKNOWN");
2915 		printf(" AUTH:");
2916 		if (mconf->conf_authid == IEEE80211_MESHCONF_AUTH_DISABLED)
2917 			printf("DISABLED");
2918 		else
2919 			printf("UNKNOWN");
2920 		printf(" FORM:0x%x CAPS:0x%x>", mconf->conf_form,
2921 		    mconf->conf_cap);
2922 	}
2923 }
2924 
2925 static void
2926 printbssload(const char *tag, const uint8_t *ie, size_t ielen, int maxlen)
2927 {
2928 	printf("%s", tag);
2929 	if (verbose) {
2930 		const struct ieee80211_bss_load_ie *bssload =
2931 		    (const struct ieee80211_bss_load_ie *) ie;
2932 		printf("<sta count %d, chan load %d, aac %d>",
2933 		    LE_READ_2(&bssload->sta_count),
2934 		    bssload->chan_load,
2935 		    bssload->aac);
2936 	}
2937 }
2938 
2939 static void
2940 printapchanrep(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
2941 {
2942 	printf("%s", tag);
2943 	if (verbose) {
2944 		const struct ieee80211_ap_chan_report_ie *ap =
2945 		    (const struct ieee80211_ap_chan_report_ie *) ie;
2946 		const char *sep = "";
2947 		int i;
2948 
2949 		printf("<class %u, chan:[", ap->i_class);
2950 
2951 		for (i = 3; i < ielen; i++) {
2952 			printf("%s%u", sep, ie[i]);
2953 			sep = ",";
2954 		}
2955 		printf("]>");
2956 	}
2957 }
2958 
2959 static const char *
2960 wpa_cipher(const u_int8_t *sel)
2961 {
2962 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
2963 	u_int32_t w = LE_READ_4(sel);
2964 
2965 	switch (w) {
2966 	case WPA_SEL(WPA_CSE_NULL):
2967 		return "NONE";
2968 	case WPA_SEL(WPA_CSE_WEP40):
2969 		return "WEP40";
2970 	case WPA_SEL(WPA_CSE_WEP104):
2971 		return "WEP104";
2972 	case WPA_SEL(WPA_CSE_TKIP):
2973 		return "TKIP";
2974 	case WPA_SEL(WPA_CSE_CCMP):
2975 		return "AES-CCMP";
2976 	}
2977 	return "?";		/* NB: so 1<< is discarded */
2978 #undef WPA_SEL
2979 }
2980 
2981 static const char *
2982 wpa_keymgmt(const u_int8_t *sel)
2983 {
2984 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
2985 	u_int32_t w = LE_READ_4(sel);
2986 
2987 	switch (w) {
2988 	case WPA_SEL(WPA_ASE_8021X_UNSPEC):
2989 		return "8021X-UNSPEC";
2990 	case WPA_SEL(WPA_ASE_8021X_PSK):
2991 		return "8021X-PSK";
2992 	case WPA_SEL(WPA_ASE_NONE):
2993 		return "NONE";
2994 	}
2995 	return "?";
2996 #undef WPA_SEL
2997 }
2998 
2999 static void
3000 printwpaie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3001 {
3002 	u_int8_t len = ie[1];
3003 
3004 	printf("%s", tag);
3005 	if (verbose) {
3006 		const char *sep;
3007 		int n;
3008 
3009 		ie += 6, len -= 4;		/* NB: len is payload only */
3010 
3011 		printf("<v%u", LE_READ_2(ie));
3012 		ie += 2, len -= 2;
3013 
3014 		printf(" mc:%s", wpa_cipher(ie));
3015 		ie += 4, len -= 4;
3016 
3017 		/* unicast ciphers */
3018 		n = LE_READ_2(ie);
3019 		ie += 2, len -= 2;
3020 		sep = " uc:";
3021 		for (; n > 0; n--) {
3022 			printf("%s%s", sep, wpa_cipher(ie));
3023 			ie += 4, len -= 4;
3024 			sep = "+";
3025 		}
3026 
3027 		/* key management algorithms */
3028 		n = LE_READ_2(ie);
3029 		ie += 2, len -= 2;
3030 		sep = " km:";
3031 		for (; n > 0; n--) {
3032 			printf("%s%s", sep, wpa_keymgmt(ie));
3033 			ie += 4, len -= 4;
3034 			sep = "+";
3035 		}
3036 
3037 		if (len > 2)		/* optional capabilities */
3038 			printf(", caps 0x%x", LE_READ_2(ie));
3039 		printf(">");
3040 	}
3041 }
3042 
3043 static const char *
3044 rsn_cipher(const u_int8_t *sel)
3045 {
3046 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
3047 	u_int32_t w = LE_READ_4(sel);
3048 
3049 	switch (w) {
3050 	case RSN_SEL(RSN_CSE_NULL):
3051 		return "NONE";
3052 	case RSN_SEL(RSN_CSE_WEP40):
3053 		return "WEP40";
3054 	case RSN_SEL(RSN_CSE_WEP104):
3055 		return "WEP104";
3056 	case RSN_SEL(RSN_CSE_TKIP):
3057 		return "TKIP";
3058 	case RSN_SEL(RSN_CSE_CCMP):
3059 		return "AES-CCMP";
3060 	case RSN_SEL(RSN_CSE_WRAP):
3061 		return "AES-OCB";
3062 	}
3063 	return "?";
3064 #undef WPA_SEL
3065 }
3066 
3067 static const char *
3068 rsn_keymgmt(const u_int8_t *sel)
3069 {
3070 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
3071 	u_int32_t w = LE_READ_4(sel);
3072 
3073 	switch (w) {
3074 	case RSN_SEL(RSN_ASE_8021X_UNSPEC):
3075 		return "8021X-UNSPEC";
3076 	case RSN_SEL(RSN_ASE_8021X_PSK):
3077 		return "8021X-PSK";
3078 	case RSN_SEL(RSN_ASE_NONE):
3079 		return "NONE";
3080 	}
3081 	return "?";
3082 #undef RSN_SEL
3083 }
3084 
3085 static void
3086 printrsnie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3087 {
3088 	printf("%s", tag);
3089 	if (verbose) {
3090 		const char *sep;
3091 		int n;
3092 
3093 		ie += 2, ielen -= 2;
3094 
3095 		printf("<v%u", LE_READ_2(ie));
3096 		ie += 2, ielen -= 2;
3097 
3098 		printf(" mc:%s", rsn_cipher(ie));
3099 		ie += 4, ielen -= 4;
3100 
3101 		/* unicast ciphers */
3102 		n = LE_READ_2(ie);
3103 		ie += 2, ielen -= 2;
3104 		sep = " uc:";
3105 		for (; n > 0; n--) {
3106 			printf("%s%s", sep, rsn_cipher(ie));
3107 			ie += 4, ielen -= 4;
3108 			sep = "+";
3109 		}
3110 
3111 		/* key management algorithms */
3112 		n = LE_READ_2(ie);
3113 		ie += 2, ielen -= 2;
3114 		sep = " km:";
3115 		for (; n > 0; n--) {
3116 			printf("%s%s", sep, rsn_keymgmt(ie));
3117 			ie += 4, ielen -= 4;
3118 			sep = "+";
3119 		}
3120 
3121 		if (ielen > 2)		/* optional capabilities */
3122 			printf(", caps 0x%x", LE_READ_2(ie));
3123 		/* XXXPMKID */
3124 		printf(">");
3125 	}
3126 }
3127 
3128 #define BE_READ_2(p)					\
3129 	((u_int16_t)					\
3130 	 ((((const u_int8_t *)(p))[1]      ) |		\
3131 	  (((const u_int8_t *)(p))[0] <<  8)))
3132 
3133 static void
3134 printwpsie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3135 {
3136 	u_int8_t len = ie[1];
3137 
3138 	printf("%s", tag);
3139 	if (verbose) {
3140 		static const char *dev_pass_id[] = {
3141 			"D",	/* Default (PIN) */
3142 			"U",	/* User-specified */
3143 			"M",	/* Machine-specified */
3144 			"K",	/* Rekey */
3145 			"P",	/* PushButton */
3146 			"R"	/* Registrar-specified */
3147 		};
3148 		int n;
3149 		int f;
3150 
3151 		ie +=6, len -= 4;		/* NB: len is payload only */
3152 
3153 		/* WPS IE in Beacon and Probe Resp frames have different fields */
3154 		printf("<");
3155 		while (len) {
3156 			uint16_t tlv_type = BE_READ_2(ie);
3157 			uint16_t tlv_len  = BE_READ_2(ie + 2);
3158 			uint16_t cfg_mthd;
3159 
3160 			/* some devices broadcast invalid WPS frames */
3161 			if (tlv_len > len) {
3162 				printf("bad frame length tlv_type=0x%02x "
3163 				    "tlv_len=%d len=%d", tlv_type, tlv_len,
3164 				    len);
3165 				break;
3166 			}
3167 
3168 			ie += 4, len -= 4;
3169 
3170 			switch (tlv_type) {
3171 			case IEEE80211_WPS_ATTR_VERSION:
3172 				printf("v:%d.%d", *ie >> 4, *ie & 0xf);
3173 				break;
3174 			case IEEE80211_WPS_ATTR_AP_SETUP_LOCKED:
3175 				printf(" ap_setup:%s", *ie ? "locked" :
3176 				    "unlocked");
3177 				break;
3178 			case IEEE80211_WPS_ATTR_CONFIG_METHODS:
3179 			case IEEE80211_WPS_ATTR_SELECTED_REGISTRAR_CONFIG_METHODS:
3180 				if (tlv_type == IEEE80211_WPS_ATTR_SELECTED_REGISTRAR_CONFIG_METHODS)
3181 					printf(" sel_reg_cfg_mthd:");
3182 				else
3183 					printf(" cfg_mthd:" );
3184 				cfg_mthd = BE_READ_2(ie);
3185 				f = 0;
3186 				for (n = 15; n >= 0; n--) {
3187 					if (f) {
3188 						printf(",");
3189 						f = 0;
3190 					}
3191 					switch (cfg_mthd & (1 << n)) {
3192 					case 0:
3193 						break;
3194 					case IEEE80211_WPS_CONFIG_USBA:
3195 						printf("usba");
3196 						f++;
3197 						break;
3198 					case IEEE80211_WPS_CONFIG_ETHERNET:
3199 						printf("ethernet");
3200 						f++;
3201 						break;
3202 					case IEEE80211_WPS_CONFIG_LABEL:
3203 						printf("label");
3204 						f++;
3205 						break;
3206 					case IEEE80211_WPS_CONFIG_DISPLAY:
3207 						if (!(cfg_mthd &
3208 						    (IEEE80211_WPS_CONFIG_VIRT_DISPLAY |
3209 						    IEEE80211_WPS_CONFIG_PHY_DISPLAY)))
3210 						    {
3211 							printf("display");
3212 							f++;
3213 						}
3214 						break;
3215 					case IEEE80211_WPS_CONFIG_EXT_NFC_TOKEN:
3216 						printf("ext_nfc_tokenk");
3217 						f++;
3218 						break;
3219 					case IEEE80211_WPS_CONFIG_INT_NFC_TOKEN:
3220 						printf("int_nfc_token");
3221 						f++;
3222 						break;
3223 					case IEEE80211_WPS_CONFIG_NFC_INTERFACE:
3224 						printf("nfc_interface");
3225 						f++;
3226 						break;
3227 					case IEEE80211_WPS_CONFIG_PUSHBUTTON:
3228 						if (!(cfg_mthd &
3229 						    (IEEE80211_WPS_CONFIG_VIRT_PUSHBUTTON |
3230 						    IEEE80211_WPS_CONFIG_PHY_PUSHBUTTON))) {
3231 							printf("push_button");
3232 							f++;
3233 						}
3234 						break;
3235 					case IEEE80211_WPS_CONFIG_KEYPAD:
3236 						printf("keypad");
3237 						f++;
3238 						break;
3239 					case IEEE80211_WPS_CONFIG_VIRT_PUSHBUTTON:
3240 						printf("virtual_push_button");
3241 						f++;
3242 						break;
3243 					case IEEE80211_WPS_CONFIG_PHY_PUSHBUTTON:
3244 						printf("physical_push_button");
3245 						f++;
3246 						break;
3247 					case IEEE80211_WPS_CONFIG_P2PS:
3248 						printf("p2ps");
3249 						f++;
3250 						break;
3251 					case IEEE80211_WPS_CONFIG_VIRT_DISPLAY:
3252 						printf("virtual_display");
3253 						f++;
3254 						break;
3255 					case IEEE80211_WPS_CONFIG_PHY_DISPLAY:
3256 						printf("physical_display");
3257 						f++;
3258 						break;
3259 					default:
3260 						printf("unknown_wps_config<%04x>",
3261 						    cfg_mthd & (1 << n));
3262 						f++;
3263 						break;
3264 					}
3265 				}
3266 				break;
3267 			case IEEE80211_WPS_ATTR_DEV_NAME:
3268 				printf(" device_name:<%.*s>", tlv_len, ie);
3269 				break;
3270 			case IEEE80211_WPS_ATTR_DEV_PASSWORD_ID:
3271 				n = LE_READ_2(ie);
3272 				if (n < nitems(dev_pass_id))
3273 					printf(" dpi:%s", dev_pass_id[n]);
3274 				break;
3275 			case IEEE80211_WPS_ATTR_MANUFACTURER:
3276 				printf(" manufacturer:<%.*s>", tlv_len, ie);
3277 				break;
3278 			case IEEE80211_WPS_ATTR_MODEL_NAME:
3279 				printf(" model_name:<%.*s>", tlv_len, ie);
3280 				break;
3281 			case IEEE80211_WPS_ATTR_MODEL_NUMBER:
3282 				printf(" model_number:<%.*s>", tlv_len, ie);
3283 				break;
3284 			case IEEE80211_WPS_ATTR_PRIMARY_DEV_TYPE:
3285 				printf(" prim_dev:");
3286 				for (n = 0; n < tlv_len; n++)
3287 					printf("%02x", ie[n]);
3288 				break;
3289 			case IEEE80211_WPS_ATTR_RF_BANDS:
3290 				printf(" rf:");
3291 				f = 0;
3292 				for (n = 7; n >= 0; n--) {
3293 					if (f) {
3294 						printf(",");
3295 						f = 0;
3296 					}
3297 					switch (*ie & (1 << n)) {
3298 					case 0:
3299 						break;
3300 					case IEEE80211_WPS_RF_BAND_24GHZ:
3301 						printf("2.4Ghz");
3302 						f++;
3303 						break;
3304 					case IEEE80211_WPS_RF_BAND_50GHZ:
3305 						printf("5Ghz");
3306 						f++;
3307 						break;
3308 					case IEEE80211_WPS_RF_BAND_600GHZ:
3309 						printf("60Ghz");
3310 						f++;
3311 						break;
3312 					default:
3313 						printf("unknown<%02x>",
3314 						    *ie & (1 << n));
3315 						f++;
3316 						break;
3317 					}
3318 				}
3319 				break;
3320 			case IEEE80211_WPS_ATTR_RESPONSE_TYPE:
3321 				printf(" resp_type:0x%02x", *ie);
3322 				break;
3323 			case IEEE80211_WPS_ATTR_SELECTED_REGISTRAR:
3324 				printf(" sel:%s", *ie ? "T" : "F");
3325 				break;
3326 			case IEEE80211_WPS_ATTR_SERIAL_NUMBER:
3327 				printf(" serial_number:<%.*s>", tlv_len, ie);
3328 				break;
3329 			case IEEE80211_WPS_ATTR_UUID_E:
3330 				printf(" uuid-e:");
3331 				for (n = 0; n < (tlv_len - 1); n++)
3332 					printf("%02x-", ie[n]);
3333 				printf("%02x", ie[n]);
3334 				break;
3335 			case IEEE80211_WPS_ATTR_VENDOR_EXT:
3336 				printf(" vendor:");
3337 				for (n = 0; n < tlv_len; n++)
3338 					printf("%02x", ie[n]);
3339 				break;
3340 			case IEEE80211_WPS_ATTR_WPS_STATE:
3341 				switch (*ie) {
3342 				case IEEE80211_WPS_STATE_NOT_CONFIGURED:
3343 					printf(" state:N");
3344 					break;
3345 				case IEEE80211_WPS_STATE_CONFIGURED:
3346 					printf(" state:C");
3347 					break;
3348 				default:
3349 					printf(" state:B<%02x>", *ie);
3350 					break;
3351 				}
3352 				break;
3353 			default:
3354 				printf(" unknown_wps_attr:0x%x", tlv_type);
3355 				break;
3356 			}
3357 			ie += tlv_len, len -= tlv_len;
3358 		}
3359 		printf(">");
3360 	}
3361 }
3362 
3363 static void
3364 printtdmaie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3365 {
3366 	printf("%s", tag);
3367 	if (verbose && ielen >= sizeof(struct ieee80211_tdma_param)) {
3368 		const struct ieee80211_tdma_param *tdma =
3369 		   (const struct ieee80211_tdma_param *) ie;
3370 
3371 		/* XXX tstamp */
3372 		printf("<v%u slot:%u slotcnt:%u slotlen:%u bintval:%u inuse:0x%x>",
3373 		    tdma->tdma_version, tdma->tdma_slot, tdma->tdma_slotcnt,
3374 		    LE_READ_2(&tdma->tdma_slotlen), tdma->tdma_bintval,
3375 		    tdma->tdma_inuse[0]);
3376 	}
3377 }
3378 
3379 /*
3380  * Copy the ssid string contents into buf, truncating to fit.  If the
3381  * ssid is entirely printable then just copy intact.  Otherwise convert
3382  * to hexadecimal.  If the result is truncated then replace the last
3383  * three characters with "...".
3384  */
3385 static int
3386 copy_essid(char buf[], size_t bufsize, const u_int8_t *essid, size_t essid_len)
3387 {
3388 	const u_int8_t *p;
3389 	size_t maxlen;
3390 	u_int i;
3391 
3392 	if (essid_len > bufsize)
3393 		maxlen = bufsize;
3394 	else
3395 		maxlen = essid_len;
3396 	/* determine printable or not */
3397 	for (i = 0, p = essid; i < maxlen; i++, p++) {
3398 		if (*p < ' ' || *p > 0x7e)
3399 			break;
3400 	}
3401 	if (i != maxlen) {		/* not printable, print as hex */
3402 		if (bufsize < 3)
3403 			return 0;
3404 		strlcpy(buf, "0x", bufsize);
3405 		bufsize -= 2;
3406 		p = essid;
3407 		for (i = 0; i < maxlen && bufsize >= 2; i++) {
3408 			sprintf(&buf[2+2*i], "%02x", p[i]);
3409 			bufsize -= 2;
3410 		}
3411 		if (i != essid_len)
3412 			memcpy(&buf[2+2*i-3], "...", 3);
3413 	} else {			/* printable, truncate as needed */
3414 		memcpy(buf, essid, maxlen);
3415 		if (maxlen != essid_len)
3416 			memcpy(&buf[maxlen-3], "...", 3);
3417 	}
3418 	return maxlen;
3419 }
3420 
3421 static void
3422 printssid(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3423 {
3424 	char ssid[2*IEEE80211_NWID_LEN+1];
3425 
3426 	printf("%s<%.*s>", tag, copy_essid(ssid, maxlen, ie+2, ie[1]), ssid);
3427 }
3428 
3429 static void
3430 printrates(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3431 {
3432 	const char *sep;
3433 	int i;
3434 
3435 	printf("%s", tag);
3436 	sep = "<";
3437 	for (i = 2; i < ielen; i++) {
3438 		printf("%s%s%d", sep,
3439 		    ie[i] & IEEE80211_RATE_BASIC ? "B" : "",
3440 		    ie[i] & IEEE80211_RATE_VAL);
3441 		sep = ",";
3442 	}
3443 	printf(">");
3444 }
3445 
3446 static void
3447 printcountry(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
3448 {
3449 	const struct ieee80211_country_ie *cie =
3450 	   (const struct ieee80211_country_ie *) ie;
3451 	int i, nbands, schan, nchan;
3452 
3453 	printf("%s<%c%c%c", tag, cie->cc[0], cie->cc[1], cie->cc[2]);
3454 	nbands = (cie->len - 3) / sizeof(cie->band[0]);
3455 	for (i = 0; i < nbands; i++) {
3456 		schan = cie->band[i].schan;
3457 		nchan = cie->band[i].nchan;
3458 		if (nchan != 1)
3459 			printf(" %u-%u,%u", schan, schan + nchan-1,
3460 			    cie->band[i].maxtxpwr);
3461 		else
3462 			printf(" %u,%u", schan, cie->band[i].maxtxpwr);
3463 	}
3464 	printf(">");
3465 }
3466 
3467 static __inline int
3468 iswpaoui(const u_int8_t *frm)
3469 {
3470 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
3471 }
3472 
3473 static __inline int
3474 iswmeinfo(const u_int8_t *frm)
3475 {
3476 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
3477 		frm[6] == WME_INFO_OUI_SUBTYPE;
3478 }
3479 
3480 static __inline int
3481 iswmeparam(const u_int8_t *frm)
3482 {
3483 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
3484 		frm[6] == WME_PARAM_OUI_SUBTYPE;
3485 }
3486 
3487 static __inline int
3488 isatherosoui(const u_int8_t *frm)
3489 {
3490 	return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
3491 }
3492 
3493 static __inline int
3494 istdmaoui(const uint8_t *frm)
3495 {
3496 	return frm[1] > 3 && LE_READ_4(frm+2) == ((TDMA_OUI_TYPE<<24)|TDMA_OUI);
3497 }
3498 
3499 static __inline int
3500 iswpsoui(const uint8_t *frm)
3501 {
3502 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WPS_OUI_TYPE<<24)|WPA_OUI);
3503 }
3504 
3505 static const char *
3506 iename(int elemid)
3507 {
3508 	static char iename_buf[64];
3509 	switch (elemid) {
3510 	case IEEE80211_ELEMID_FHPARMS:	return " FHPARMS";
3511 	case IEEE80211_ELEMID_CFPARMS:	return " CFPARMS";
3512 	case IEEE80211_ELEMID_TIM:	return " TIM";
3513 	case IEEE80211_ELEMID_IBSSPARMS:return " IBSSPARMS";
3514 	case IEEE80211_ELEMID_BSSLOAD:	return " BSSLOAD";
3515 	case IEEE80211_ELEMID_CHALLENGE:return " CHALLENGE";
3516 	case IEEE80211_ELEMID_PWRCNSTR:	return " PWRCNSTR";
3517 	case IEEE80211_ELEMID_PWRCAP:	return " PWRCAP";
3518 	case IEEE80211_ELEMID_TPCREQ:	return " TPCREQ";
3519 	case IEEE80211_ELEMID_TPCREP:	return " TPCREP";
3520 	case IEEE80211_ELEMID_SUPPCHAN:	return " SUPPCHAN";
3521 	case IEEE80211_ELEMID_CSA:	return " CSA";
3522 	case IEEE80211_ELEMID_MEASREQ:	return " MEASREQ";
3523 	case IEEE80211_ELEMID_MEASREP:	return " MEASREP";
3524 	case IEEE80211_ELEMID_QUIET:	return " QUIET";
3525 	case IEEE80211_ELEMID_IBSSDFS:	return " IBSSDFS";
3526 	case IEEE80211_ELEMID_RESERVED_47:
3527 					return " RESERVED_47";
3528 	case IEEE80211_ELEMID_MOBILITY_DOMAIN:
3529 					return " MOBILITY_DOMAIN";
3530 	case IEEE80211_ELEMID_RRM_ENACAPS:
3531 					return " RRM_ENCAPS";
3532 	case IEEE80211_ELEMID_OVERLAP_BSS_SCAN_PARAM:
3533 					return " OVERLAP_BSS";
3534 	case IEEE80211_ELEMID_TPC:	return " TPC";
3535 	case IEEE80211_ELEMID_CCKM:	return " CCKM";
3536 	case IEEE80211_ELEMID_EXTCAP:	return " EXTCAP";
3537 	}
3538 	snprintf(iename_buf, sizeof(iename_buf), " UNKNOWN_ELEMID_%d",
3539 	    elemid);
3540 	return (const char *) iename_buf;
3541 }
3542 
3543 static void
3544 printies(const u_int8_t *vp, int ielen, int maxcols)
3545 {
3546 	while (ielen > 0) {
3547 		switch (vp[0]) {
3548 		case IEEE80211_ELEMID_SSID:
3549 			if (verbose)
3550 				printssid(" SSID", vp, 2+vp[1], maxcols);
3551 			break;
3552 		case IEEE80211_ELEMID_RATES:
3553 		case IEEE80211_ELEMID_XRATES:
3554 			if (verbose)
3555 				printrates(vp[0] == IEEE80211_ELEMID_RATES ?
3556 				    " RATES" : " XRATES", vp, 2+vp[1], maxcols);
3557 			break;
3558 		case IEEE80211_ELEMID_DSPARMS:
3559 			if (verbose)
3560 				printf(" DSPARMS<%u>", vp[2]);
3561 			break;
3562 		case IEEE80211_ELEMID_COUNTRY:
3563 			if (verbose)
3564 				printcountry(" COUNTRY", vp, 2+vp[1], maxcols);
3565 			break;
3566 		case IEEE80211_ELEMID_ERP:
3567 			if (verbose)
3568 				printf(" ERP<0x%x>", vp[2]);
3569 			break;
3570 		case IEEE80211_ELEMID_VENDOR:
3571 			if (iswpaoui(vp))
3572 				printwpaie(" WPA", vp, 2+vp[1], maxcols);
3573 			else if (iswmeinfo(vp))
3574 				printwmeinfo(" WME", vp, 2+vp[1], maxcols);
3575 			else if (iswmeparam(vp))
3576 				printwmeparam(" WME", vp, 2+vp[1], maxcols);
3577 			else if (isatherosoui(vp))
3578 				printathie(" ATH", vp, 2+vp[1], maxcols);
3579 			else if (iswpsoui(vp))
3580 				printwpsie(" WPS", vp, 2+vp[1], maxcols);
3581 			else if (istdmaoui(vp))
3582 				printtdmaie(" TDMA", vp, 2+vp[1], maxcols);
3583 			else if (verbose)
3584 				printie(" VEN", vp, 2+vp[1], maxcols);
3585 			break;
3586 		case IEEE80211_ELEMID_RSN:
3587 			printrsnie(" RSN", vp, 2+vp[1], maxcols);
3588 			break;
3589 		case IEEE80211_ELEMID_HTCAP:
3590 			printhtcap(" HTCAP", vp, 2+vp[1], maxcols);
3591 			break;
3592 		case IEEE80211_ELEMID_HTINFO:
3593 			if (verbose)
3594 				printhtinfo(" HTINFO", vp, 2+vp[1], maxcols);
3595 			break;
3596 		case IEEE80211_ELEMID_MESHID:
3597 			if (verbose)
3598 				printssid(" MESHID", vp, 2+vp[1], maxcols);
3599 			break;
3600 		case IEEE80211_ELEMID_MESHCONF:
3601 			printmeshconf(" MESHCONF", vp, 2+vp[1], maxcols);
3602 			break;
3603 		case IEEE80211_ELEMID_VHT_CAP:
3604 			printvhtcap(" VHTCAP", vp, 2+vp[1], maxcols);
3605 			break;
3606 		case IEEE80211_ELEMID_VHT_OPMODE:
3607 			printvhtinfo(" VHTOPMODE", vp, 2+vp[1], maxcols);
3608 			break;
3609 		case IEEE80211_ELEMID_VHT_PWR_ENV:
3610 			printvhtpwrenv(" VHTPWRENV", vp, 2+vp[1], maxcols);
3611 			break;
3612 		case IEEE80211_ELEMID_BSSLOAD:
3613 			printbssload(" BSSLOAD", vp, 2+vp[1], maxcols);
3614 			break;
3615 		case IEEE80211_ELEMID_APCHANREP:
3616 			printapchanrep(" APCHANREP", vp, 2+vp[1], maxcols);
3617 			break;
3618 		default:
3619 			if (verbose)
3620 				printie(iename(vp[0]), vp, 2+vp[1], maxcols);
3621 			break;
3622 		}
3623 		ielen -= 2+vp[1];
3624 		vp += 2+vp[1];
3625 	}
3626 }
3627 
3628 static void
3629 printmimo(const struct ieee80211_mimo_info *mi)
3630 {
3631 	int i;
3632 	int r = 0;
3633 
3634 	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3635 		if (mi->ch[i].rssi != 0) {
3636 			r = 1;
3637 			break;
3638 		}
3639 	}
3640 
3641 	/* NB: don't muddy display unless there's something to show */
3642 	if (r == 0)
3643 		return;
3644 
3645 	/* XXX TODO: ignore EVM; secondary channels for now */
3646 	printf(" (rssi %.1f:%.1f:%.1f:%.1f nf %d:%d:%d:%d)",
3647 	    mi->ch[0].rssi[0] / 2.0,
3648 	    mi->ch[1].rssi[0] / 2.0,
3649 	    mi->ch[2].rssi[0] / 2.0,
3650 	    mi->ch[3].rssi[0] / 2.0,
3651 	    mi->ch[0].noise[0],
3652 	    mi->ch[1].noise[0],
3653 	    mi->ch[2].noise[0],
3654 	    mi->ch[3].noise[0]);
3655 }
3656 
3657 static void
3658 list_scan(int s)
3659 {
3660 	uint8_t buf[24*1024];
3661 	char ssid[IEEE80211_NWID_LEN+1];
3662 	const uint8_t *cp;
3663 	int len, idlen;
3664 
3665 	if (get80211len(s, IEEE80211_IOC_SCAN_RESULTS, buf, sizeof(buf), &len) < 0)
3666 		errx(1, "unable to get scan results");
3667 	if (len < sizeof(struct ieee80211req_scan_result))
3668 		return;
3669 
3670 	getchaninfo(s);
3671 
3672 	printf("%-*.*s  %-17.17s  %4s %4s   %-7s  %3s %4s\n"
3673 		, IEEE80211_NWID_LEN, IEEE80211_NWID_LEN, "SSID/MESH ID"
3674 		, "BSSID"
3675 		, "CHAN"
3676 		, "RATE"
3677 		, " S:N"
3678 		, "INT"
3679 		, "CAPS"
3680 	);
3681 	cp = buf;
3682 	do {
3683 		const struct ieee80211req_scan_result *sr;
3684 		const uint8_t *vp, *idp;
3685 
3686 		sr = (const struct ieee80211req_scan_result *) cp;
3687 		vp = cp + sr->isr_ie_off;
3688 		if (sr->isr_meshid_len) {
3689 			idp = vp + sr->isr_ssid_len;
3690 			idlen = sr->isr_meshid_len;
3691 		} else {
3692 			idp = vp;
3693 			idlen = sr->isr_ssid_len;
3694 		}
3695 		printf("%-*.*s  %s  %3d  %3dM %4d:%-4d %4d %-4.4s"
3696 			, IEEE80211_NWID_LEN
3697 			  , copy_essid(ssid, IEEE80211_NWID_LEN, idp, idlen)
3698 			  , ssid
3699 			, ether_ntoa((const struct ether_addr *) sr->isr_bssid)
3700 			, ieee80211_mhz2ieee(sr->isr_freq, sr->isr_flags)
3701 			, getmaxrate(sr->isr_rates, sr->isr_nrates)
3702 			, (sr->isr_rssi/2)+sr->isr_noise, sr->isr_noise
3703 			, sr->isr_intval
3704 			, getcaps(sr->isr_capinfo)
3705 		);
3706 		printies(vp + sr->isr_ssid_len + sr->isr_meshid_len,
3707 		    sr->isr_ie_len, 24);
3708 		printf("\n");
3709 		cp += sr->isr_len, len -= sr->isr_len;
3710 	} while (len >= sizeof(struct ieee80211req_scan_result));
3711 }
3712 
3713 static void
3714 scan_and_wait(int s)
3715 {
3716 	struct ieee80211_scan_req sr;
3717 	struct ieee80211req ireq;
3718 	int sroute;
3719 
3720 	sroute = socket(PF_ROUTE, SOCK_RAW, 0);
3721 	if (sroute < 0) {
3722 		perror("socket(PF_ROUTE,SOCK_RAW)");
3723 		return;
3724 	}
3725 	(void) memset(&ireq, 0, sizeof(ireq));
3726 	(void) strlcpy(ireq.i_name, name, sizeof(ireq.i_name));
3727 	ireq.i_type = IEEE80211_IOC_SCAN_REQ;
3728 
3729 	memset(&sr, 0, sizeof(sr));
3730 	sr.sr_flags = IEEE80211_IOC_SCAN_ACTIVE
3731 		    | IEEE80211_IOC_SCAN_BGSCAN
3732 		    | IEEE80211_IOC_SCAN_NOPICK
3733 		    | IEEE80211_IOC_SCAN_ONCE;
3734 	sr.sr_duration = IEEE80211_IOC_SCAN_FOREVER;
3735 	sr.sr_nssid = 0;
3736 
3737 	ireq.i_data = &sr;
3738 	ireq.i_len = sizeof(sr);
3739 	/*
3740 	 * NB: only root can trigger a scan so ignore errors. Also ignore
3741 	 * possible errors from net80211, even if no new scan could be
3742 	 * started there might still be a valid scan cache.
3743 	 */
3744 	if (ioctl(s, SIOCS80211, &ireq) == 0) {
3745 		char buf[2048];
3746 		struct if_announcemsghdr *ifan;
3747 		struct rt_msghdr *rtm;
3748 
3749 		do {
3750 			if (read(sroute, buf, sizeof(buf)) < 0) {
3751 				perror("read(PF_ROUTE)");
3752 				break;
3753 			}
3754 			rtm = (struct rt_msghdr *) buf;
3755 			if (rtm->rtm_version != RTM_VERSION)
3756 				break;
3757 			ifan = (struct if_announcemsghdr *) rtm;
3758 		} while (rtm->rtm_type != RTM_IEEE80211 ||
3759 		    ifan->ifan_what != RTM_IEEE80211_SCAN);
3760 	}
3761 	close(sroute);
3762 }
3763 
3764 static
3765 DECL_CMD_FUNC(set80211scan, val, d)
3766 {
3767 	scan_and_wait(s);
3768 	list_scan(s);
3769 }
3770 
3771 static enum ieee80211_opmode get80211opmode(int s);
3772 
3773 static int
3774 gettxseq(const struct ieee80211req_sta_info *si)
3775 {
3776 	int i, txseq;
3777 
3778 	if ((si->isi_state & IEEE80211_NODE_QOS) == 0)
3779 		return si->isi_txseqs[0];
3780 	/* XXX not right but usually what folks want */
3781 	txseq = 0;
3782 	for (i = 0; i < IEEE80211_TID_SIZE; i++)
3783 		if (si->isi_txseqs[i] > txseq)
3784 			txseq = si->isi_txseqs[i];
3785 	return txseq;
3786 }
3787 
3788 static int
3789 getrxseq(const struct ieee80211req_sta_info *si)
3790 {
3791 	int i, rxseq;
3792 
3793 	if ((si->isi_state & IEEE80211_NODE_QOS) == 0)
3794 		return si->isi_rxseqs[0];
3795 	/* XXX not right but usually what folks want */
3796 	rxseq = 0;
3797 	for (i = 0; i < IEEE80211_TID_SIZE; i++)
3798 		if (si->isi_rxseqs[i] > rxseq)
3799 			rxseq = si->isi_rxseqs[i];
3800 	return rxseq;
3801 }
3802 
3803 static void
3804 list_stations(int s)
3805 {
3806 	union {
3807 		struct ieee80211req_sta_req req;
3808 		uint8_t buf[24*1024];
3809 	} u;
3810 	enum ieee80211_opmode opmode = get80211opmode(s);
3811 	const uint8_t *cp;
3812 	int len;
3813 
3814 	/* broadcast address =>'s get all stations */
3815 	(void) memset(u.req.is_u.macaddr, 0xff, IEEE80211_ADDR_LEN);
3816 	if (opmode == IEEE80211_M_STA) {
3817 		/*
3818 		 * Get information about the associated AP.
3819 		 */
3820 		(void) get80211(s, IEEE80211_IOC_BSSID,
3821 		    u.req.is_u.macaddr, IEEE80211_ADDR_LEN);
3822 	}
3823 	if (get80211len(s, IEEE80211_IOC_STA_INFO, &u, sizeof(u), &len) < 0)
3824 		errx(1, "unable to get station information");
3825 	if (len < sizeof(struct ieee80211req_sta_info))
3826 		return;
3827 
3828 	getchaninfo(s);
3829 
3830 	if (opmode == IEEE80211_M_MBSS)
3831 		printf("%-17.17s %4s %5s %5s %7s %4s %4s %4s %6s %6s\n"
3832 			, "ADDR"
3833 			, "CHAN"
3834 			, "LOCAL"
3835 			, "PEER"
3836 			, "STATE"
3837 			, "RATE"
3838 			, "RSSI"
3839 			, "IDLE"
3840 			, "TXSEQ"
3841 			, "RXSEQ"
3842 		);
3843 	else
3844 		printf("%-17.17s %4s %4s %4s %4s %4s %6s %6s %4s %-7s\n"
3845 			, "ADDR"
3846 			, "AID"
3847 			, "CHAN"
3848 			, "RATE"
3849 			, "RSSI"
3850 			, "IDLE"
3851 			, "TXSEQ"
3852 			, "RXSEQ"
3853 			, "CAPS"
3854 			, "FLAG"
3855 		);
3856 	cp = (const uint8_t *) u.req.info;
3857 	do {
3858 		const struct ieee80211req_sta_info *si;
3859 
3860 		si = (const struct ieee80211req_sta_info *) cp;
3861 		if (si->isi_len < sizeof(*si))
3862 			break;
3863 		if (opmode == IEEE80211_M_MBSS)
3864 			printf("%s %4d %5x %5x %7.7s %3dM %4.1f %4d %6d %6d"
3865 				, ether_ntoa((const struct ether_addr*)
3866 				    si->isi_macaddr)
3867 				, ieee80211_mhz2ieee(si->isi_freq,
3868 				    si->isi_flags)
3869 				, si->isi_localid
3870 				, si->isi_peerid
3871 				, mesh_linkstate_string(si->isi_peerstate)
3872 				, si->isi_txmbps/2
3873 				, si->isi_rssi/2.
3874 				, si->isi_inact
3875 				, gettxseq(si)
3876 				, getrxseq(si)
3877 			);
3878 		else
3879 			printf("%s %4u %4d %3dM %4.1f %4d %6d %6d %-4.4s %-7.7s"
3880 				, ether_ntoa((const struct ether_addr*)
3881 				    si->isi_macaddr)
3882 				, IEEE80211_AID(si->isi_associd)
3883 				, ieee80211_mhz2ieee(si->isi_freq,
3884 				    si->isi_flags)
3885 				, si->isi_txmbps/2
3886 				, si->isi_rssi/2.
3887 				, si->isi_inact
3888 				, gettxseq(si)
3889 				, getrxseq(si)
3890 				, getcaps(si->isi_capinfo)
3891 				, getflags(si->isi_state)
3892 			);
3893 		printies(cp + si->isi_ie_off, si->isi_ie_len, 24);
3894 		printmimo(&si->isi_mimo);
3895 		printf("\n");
3896 		cp += si->isi_len, len -= si->isi_len;
3897 	} while (len >= sizeof(struct ieee80211req_sta_info));
3898 }
3899 
3900 static const char *
3901 mesh_linkstate_string(uint8_t state)
3902 {
3903 	static const char *state_names[] = {
3904 	    [0] = "IDLE",
3905 	    [1] = "OPEN-TX",
3906 	    [2] = "OPEN-RX",
3907 	    [3] = "CONF-RX",
3908 	    [4] = "ESTAB",
3909 	    [5] = "HOLDING",
3910 	};
3911 
3912 	if (state >= nitems(state_names)) {
3913 		static char buf[10];
3914 		snprintf(buf, sizeof(buf), "#%u", state);
3915 		return buf;
3916 	} else
3917 		return state_names[state];
3918 }
3919 
3920 static const char *
3921 get_chaninfo(const struct ieee80211_channel *c, int precise,
3922 	char buf[], size_t bsize)
3923 {
3924 	buf[0] = '\0';
3925 	if (IEEE80211_IS_CHAN_FHSS(c))
3926 		strlcat(buf, " FHSS", bsize);
3927 	if (IEEE80211_IS_CHAN_A(c))
3928 		strlcat(buf, " 11a", bsize);
3929 	else if (IEEE80211_IS_CHAN_ANYG(c))
3930 		strlcat(buf, " 11g", bsize);
3931 	else if (IEEE80211_IS_CHAN_B(c))
3932 		strlcat(buf, " 11b", bsize);
3933 	if (IEEE80211_IS_CHAN_HALF(c))
3934 		strlcat(buf, "/10MHz", bsize);
3935 	if (IEEE80211_IS_CHAN_QUARTER(c))
3936 		strlcat(buf, "/5MHz", bsize);
3937 	if (IEEE80211_IS_CHAN_TURBO(c))
3938 		strlcat(buf, " Turbo", bsize);
3939 	if (precise) {
3940 		/* XXX should make VHT80U, VHT80D */
3941 		if (IEEE80211_IS_CHAN_VHT80(c) &&
3942 		    IEEE80211_IS_CHAN_HT40D(c))
3943 			strlcat(buf, " vht/80-", bsize);
3944 		else if (IEEE80211_IS_CHAN_VHT80(c) &&
3945 		    IEEE80211_IS_CHAN_HT40U(c))
3946 			strlcat(buf, " vht/80+", bsize);
3947 		else if (IEEE80211_IS_CHAN_VHT80(c))
3948 			strlcat(buf, " vht/80", bsize);
3949 		else if (IEEE80211_IS_CHAN_VHT40D(c))
3950 			strlcat(buf, " vht/40-", bsize);
3951 		else if (IEEE80211_IS_CHAN_VHT40U(c))
3952 			strlcat(buf, " vht/40+", bsize);
3953 		else if (IEEE80211_IS_CHAN_VHT20(c))
3954 			strlcat(buf, " vht/20", bsize);
3955 		else if (IEEE80211_IS_CHAN_HT20(c))
3956 			strlcat(buf, " ht/20", bsize);
3957 		else if (IEEE80211_IS_CHAN_HT40D(c))
3958 			strlcat(buf, " ht/40-", bsize);
3959 		else if (IEEE80211_IS_CHAN_HT40U(c))
3960 			strlcat(buf, " ht/40+", bsize);
3961 	} else {
3962 		if (IEEE80211_IS_CHAN_VHT(c))
3963 			strlcat(buf, " vht", bsize);
3964 		else if (IEEE80211_IS_CHAN_HT(c))
3965 			strlcat(buf, " ht", bsize);
3966 	}
3967 	return buf;
3968 }
3969 
3970 static void
3971 print_chaninfo(const struct ieee80211_channel *c, int verb)
3972 {
3973 	char buf[14];
3974 
3975 	if (verb)
3976 		printf("Channel %3u : %u%c%c%c%c%c MHz%-14.14s",
3977 		    ieee80211_mhz2ieee(c->ic_freq, c->ic_flags), c->ic_freq,
3978 		    IEEE80211_IS_CHAN_PASSIVE(c) ? '*' : ' ',
3979 		    IEEE80211_IS_CHAN_DFS(c) ? 'D' : ' ',
3980 		    IEEE80211_IS_CHAN_RADAR(c) ? 'R' : ' ',
3981 		    IEEE80211_IS_CHAN_CWINT(c) ? 'I' : ' ',
3982 		    IEEE80211_IS_CHAN_CACDONE(c) ? 'C' : ' ',
3983 		    get_chaninfo(c, verb, buf, sizeof(buf)));
3984 	else
3985 	printf("Channel %3u : %u%c MHz%-14.14s",
3986 	    ieee80211_mhz2ieee(c->ic_freq, c->ic_flags), c->ic_freq,
3987 	    IEEE80211_IS_CHAN_PASSIVE(c) ? '*' : ' ',
3988 	    get_chaninfo(c, verb, buf, sizeof(buf)));
3989 
3990 }
3991 
3992 static int
3993 chanpref(const struct ieee80211_channel *c)
3994 {
3995 	if (IEEE80211_IS_CHAN_VHT160(c))
3996 		return 80;
3997 	if (IEEE80211_IS_CHAN_VHT80_80(c))
3998 		return 75;
3999 	if (IEEE80211_IS_CHAN_VHT80(c))
4000 		return 70;
4001 	if (IEEE80211_IS_CHAN_VHT40(c))
4002 		return 60;
4003 	if (IEEE80211_IS_CHAN_VHT20(c))
4004 		return 50;
4005 	if (IEEE80211_IS_CHAN_HT40(c))
4006 		return 40;
4007 	if (IEEE80211_IS_CHAN_HT20(c))
4008 		return 30;
4009 	if (IEEE80211_IS_CHAN_HALF(c))
4010 		return 10;
4011 	if (IEEE80211_IS_CHAN_QUARTER(c))
4012 		return 5;
4013 	if (IEEE80211_IS_CHAN_TURBO(c))
4014 		return 25;
4015 	if (IEEE80211_IS_CHAN_A(c))
4016 		return 20;
4017 	if (IEEE80211_IS_CHAN_G(c))
4018 		return 20;
4019 	if (IEEE80211_IS_CHAN_B(c))
4020 		return 15;
4021 	if (IEEE80211_IS_CHAN_PUREG(c))
4022 		return 15;
4023 	return 0;
4024 }
4025 
4026 static void
4027 print_channels(int s, const struct ieee80211req_chaninfo *chans,
4028 	int allchans, int verb)
4029 {
4030 	struct ieee80211req_chaninfo *achans;
4031 	uint8_t reported[IEEE80211_CHAN_BYTES];
4032 	const struct ieee80211_channel *c;
4033 	int i, half;
4034 
4035 	achans = malloc(IEEE80211_CHANINFO_SPACE(chans));
4036 	if (achans == NULL)
4037 		errx(1, "no space for active channel list");
4038 	achans->ic_nchans = 0;
4039 	memset(reported, 0, sizeof(reported));
4040 	if (!allchans) {
4041 		struct ieee80211req_chanlist active;
4042 
4043 		if (get80211(s, IEEE80211_IOC_CHANLIST, &active, sizeof(active)) < 0)
4044 			errx(1, "unable to get active channel list");
4045 		for (i = 0; i < chans->ic_nchans; i++) {
4046 			c = &chans->ic_chans[i];
4047 			if (!isset(active.ic_channels, c->ic_ieee))
4048 				continue;
4049 			/*
4050 			 * Suppress compatible duplicates unless
4051 			 * verbose.  The kernel gives us it's
4052 			 * complete channel list which has separate
4053 			 * entries for 11g/11b and 11a/turbo.
4054 			 */
4055 			if (isset(reported, c->ic_ieee) && !verb) {
4056 				/* XXX we assume duplicates are adjacent */
4057 				achans->ic_chans[achans->ic_nchans-1] = *c;
4058 			} else {
4059 				achans->ic_chans[achans->ic_nchans++] = *c;
4060 				setbit(reported, c->ic_ieee);
4061 			}
4062 		}
4063 	} else {
4064 		for (i = 0; i < chans->ic_nchans; i++) {
4065 			c = &chans->ic_chans[i];
4066 			/* suppress duplicates as above */
4067 			if (isset(reported, c->ic_ieee) && !verb) {
4068 				/* XXX we assume duplicates are adjacent */
4069 				struct ieee80211_channel *a =
4070 				    &achans->ic_chans[achans->ic_nchans-1];
4071 				if (chanpref(c) > chanpref(a))
4072 					*a = *c;
4073 			} else {
4074 				achans->ic_chans[achans->ic_nchans++] = *c;
4075 				setbit(reported, c->ic_ieee);
4076 			}
4077 		}
4078 	}
4079 	half = achans->ic_nchans / 2;
4080 	if (achans->ic_nchans % 2)
4081 		half++;
4082 
4083 	for (i = 0; i < achans->ic_nchans / 2; i++) {
4084 		print_chaninfo(&achans->ic_chans[i], verb);
4085 		print_chaninfo(&achans->ic_chans[half+i], verb);
4086 		printf("\n");
4087 	}
4088 	if (achans->ic_nchans % 2) {
4089 		print_chaninfo(&achans->ic_chans[i], verb);
4090 		printf("\n");
4091 	}
4092 	free(achans);
4093 }
4094 
4095 static void
4096 list_channels(int s, int allchans)
4097 {
4098 	getchaninfo(s);
4099 	print_channels(s, chaninfo, allchans, verbose);
4100 }
4101 
4102 static void
4103 print_txpow(const struct ieee80211_channel *c)
4104 {
4105 	printf("Channel %3u : %u MHz %3.1f reg %2d  ",
4106 	    c->ic_ieee, c->ic_freq,
4107 	    c->ic_maxpower/2., c->ic_maxregpower);
4108 }
4109 
4110 static void
4111 print_txpow_verbose(const struct ieee80211_channel *c)
4112 {
4113 	print_chaninfo(c, 1);
4114 	printf("min %4.1f dBm  max %3.1f dBm  reg %2d dBm",
4115 	    c->ic_minpower/2., c->ic_maxpower/2., c->ic_maxregpower);
4116 	/* indicate where regulatory cap limits power use */
4117 	if (c->ic_maxpower > 2*c->ic_maxregpower)
4118 		printf(" <");
4119 }
4120 
4121 static void
4122 list_txpow(int s)
4123 {
4124 	struct ieee80211req_chaninfo *achans;
4125 	uint8_t reported[IEEE80211_CHAN_BYTES];
4126 	struct ieee80211_channel *c, *prev;
4127 	int i, half;
4128 
4129 	getchaninfo(s);
4130 	achans = malloc(IEEE80211_CHANINFO_SPACE(chaninfo));
4131 	if (achans == NULL)
4132 		errx(1, "no space for active channel list");
4133 	achans->ic_nchans = 0;
4134 	memset(reported, 0, sizeof(reported));
4135 	for (i = 0; i < chaninfo->ic_nchans; i++) {
4136 		c = &chaninfo->ic_chans[i];
4137 		/* suppress duplicates as above */
4138 		if (isset(reported, c->ic_ieee) && !verbose) {
4139 			/* XXX we assume duplicates are adjacent */
4140 			assert(achans->ic_nchans > 0);
4141 			prev = &achans->ic_chans[achans->ic_nchans-1];
4142 			/* display highest power on channel */
4143 			if (c->ic_maxpower > prev->ic_maxpower)
4144 				*prev = *c;
4145 		} else {
4146 			achans->ic_chans[achans->ic_nchans++] = *c;
4147 			setbit(reported, c->ic_ieee);
4148 		}
4149 	}
4150 	if (!verbose) {
4151 		half = achans->ic_nchans / 2;
4152 		if (achans->ic_nchans % 2)
4153 			half++;
4154 
4155 		for (i = 0; i < achans->ic_nchans / 2; i++) {
4156 			print_txpow(&achans->ic_chans[i]);
4157 			print_txpow(&achans->ic_chans[half+i]);
4158 			printf("\n");
4159 		}
4160 		if (achans->ic_nchans % 2) {
4161 			print_txpow(&achans->ic_chans[i]);
4162 			printf("\n");
4163 		}
4164 	} else {
4165 		for (i = 0; i < achans->ic_nchans; i++) {
4166 			print_txpow_verbose(&achans->ic_chans[i]);
4167 			printf("\n");
4168 		}
4169 	}
4170 	free(achans);
4171 }
4172 
4173 static void
4174 list_keys(int s)
4175 {
4176 }
4177 
4178 static void
4179 list_capabilities(int s)
4180 {
4181 	struct ieee80211_devcaps_req *dc;
4182 
4183 	if (verbose)
4184 		dc = malloc(IEEE80211_DEVCAPS_SIZE(MAXCHAN));
4185 	else
4186 		dc = malloc(IEEE80211_DEVCAPS_SIZE(1));
4187 	if (dc == NULL)
4188 		errx(1, "no space for device capabilities");
4189 	dc->dc_chaninfo.ic_nchans = verbose ? MAXCHAN : 1;
4190 	getdevcaps(s, dc);
4191 	printb("drivercaps", dc->dc_drivercaps, IEEE80211_C_BITS);
4192 	if (dc->dc_cryptocaps != 0 || verbose) {
4193 		putchar('\n');
4194 		printb("cryptocaps", dc->dc_cryptocaps, IEEE80211_CRYPTO_BITS);
4195 	}
4196 	if (dc->dc_htcaps != 0 || verbose) {
4197 		putchar('\n');
4198 		printb("htcaps", dc->dc_htcaps, IEEE80211_HTCAP_BITS);
4199 	}
4200 	if (dc->dc_vhtcaps != 0 || verbose) {
4201 		putchar('\n');
4202 		printb("vhtcaps", dc->dc_vhtcaps, IEEE80211_VHTCAP_BITS);
4203 	}
4204 
4205 	putchar('\n');
4206 	if (verbose) {
4207 		chaninfo = &dc->dc_chaninfo;	/* XXX */
4208 		print_channels(s, &dc->dc_chaninfo, 1/*allchans*/, verbose);
4209 	}
4210 	free(dc);
4211 }
4212 
4213 static int
4214 get80211wme(int s, int param, int ac, int *val)
4215 {
4216 	struct ieee80211req ireq;
4217 
4218 	(void) memset(&ireq, 0, sizeof(ireq));
4219 	(void) strlcpy(ireq.i_name, name, sizeof(ireq.i_name));
4220 	ireq.i_type = param;
4221 	ireq.i_len = ac;
4222 	if (ioctl(s, SIOCG80211, &ireq) < 0) {
4223 		warn("cannot get WME parameter %d, ac %d%s",
4224 		    param, ac & IEEE80211_WMEPARAM_VAL,
4225 		    ac & IEEE80211_WMEPARAM_BSS ? " (BSS)" : "");
4226 		return -1;
4227 	}
4228 	*val = ireq.i_val;
4229 	return 0;
4230 }
4231 
4232 static void
4233 list_wme_aci(int s, const char *tag, int ac)
4234 {
4235 	int val;
4236 
4237 	printf("\t%s", tag);
4238 
4239 	/* show WME BSS parameters */
4240 	if (get80211wme(s, IEEE80211_IOC_WME_CWMIN, ac, &val) != -1)
4241 		printf(" cwmin %2u", val);
4242 	if (get80211wme(s, IEEE80211_IOC_WME_CWMAX, ac, &val) != -1)
4243 		printf(" cwmax %2u", val);
4244 	if (get80211wme(s, IEEE80211_IOC_WME_AIFS, ac, &val) != -1)
4245 		printf(" aifs %2u", val);
4246 	if (get80211wme(s, IEEE80211_IOC_WME_TXOPLIMIT, ac, &val) != -1)
4247 		printf(" txopLimit %3u", val);
4248 	if (get80211wme(s, IEEE80211_IOC_WME_ACM, ac, &val) != -1) {
4249 		if (val)
4250 			printf(" acm");
4251 		else if (verbose)
4252 			printf(" -acm");
4253 	}
4254 	/* !BSS only */
4255 	if ((ac & IEEE80211_WMEPARAM_BSS) == 0) {
4256 		if (get80211wme(s, IEEE80211_IOC_WME_ACKPOLICY, ac, &val) != -1) {
4257 			if (!val)
4258 				printf(" -ack");
4259 			else if (verbose)
4260 				printf(" ack");
4261 		}
4262 	}
4263 	printf("\n");
4264 }
4265 
4266 static void
4267 list_wme(int s)
4268 {
4269 	static const char *acnames[] = { "AC_BE", "AC_BK", "AC_VI", "AC_VO" };
4270 	int ac;
4271 
4272 	if (verbose) {
4273 		/* display both BSS and local settings */
4274 		for (ac = WME_AC_BE; ac <= WME_AC_VO; ac++) {
4275 	again:
4276 			if (ac & IEEE80211_WMEPARAM_BSS)
4277 				list_wme_aci(s, "     ", ac);
4278 			else
4279 				list_wme_aci(s, acnames[ac], ac);
4280 			if ((ac & IEEE80211_WMEPARAM_BSS) == 0) {
4281 				ac |= IEEE80211_WMEPARAM_BSS;
4282 				goto again;
4283 			} else
4284 				ac &= ~IEEE80211_WMEPARAM_BSS;
4285 		}
4286 	} else {
4287 		/* display only channel settings */
4288 		for (ac = WME_AC_BE; ac <= WME_AC_VO; ac++)
4289 			list_wme_aci(s, acnames[ac], ac);
4290 	}
4291 }
4292 
4293 static void
4294 list_roam(int s)
4295 {
4296 	const struct ieee80211_roamparam *rp;
4297 	int mode;
4298 
4299 	getroam(s);
4300 	for (mode = IEEE80211_MODE_11A; mode < IEEE80211_MODE_MAX; mode++) {
4301 		rp = &roamparams.params[mode];
4302 		if (rp->rssi == 0 && rp->rate == 0)
4303 			continue;
4304 		if (mode == IEEE80211_MODE_11NA ||
4305 		    mode == IEEE80211_MODE_11NG ||
4306 		    mode == IEEE80211_MODE_VHT_2GHZ ||
4307 		    mode == IEEE80211_MODE_VHT_5GHZ) {
4308 			if (rp->rssi & 1)
4309 				LINE_CHECK("roam:%-7.7s rssi %2u.5dBm  MCS %2u    ",
4310 				    modename[mode], rp->rssi/2,
4311 				    rp->rate &~ IEEE80211_RATE_MCS);
4312 			else
4313 				LINE_CHECK("roam:%-7.7s rssi %4udBm  MCS %2u    ",
4314 				    modename[mode], rp->rssi/2,
4315 				    rp->rate &~ IEEE80211_RATE_MCS);
4316 		} else {
4317 			if (rp->rssi & 1)
4318 				LINE_CHECK("roam:%-7.7s rssi %2u.5dBm rate %2u Mb/s",
4319 				    modename[mode], rp->rssi/2, rp->rate/2);
4320 			else
4321 				LINE_CHECK("roam:%-7.7s rssi %4udBm rate %2u Mb/s",
4322 				    modename[mode], rp->rssi/2, rp->rate/2);
4323 		}
4324 	}
4325 }
4326 
4327 /* XXX TODO: rate-to-string method... */
4328 static const char*
4329 get_mcs_mbs_rate_str(uint8_t rate)
4330 {
4331 	return (rate & IEEE80211_RATE_MCS) ? "MCS " : "Mb/s";
4332 }
4333 
4334 static uint8_t
4335 get_rate_value(uint8_t rate)
4336 {
4337 	if (rate & IEEE80211_RATE_MCS)
4338 		return (rate &~ IEEE80211_RATE_MCS);
4339 	return (rate / 2);
4340 }
4341 
4342 static void
4343 list_txparams(int s)
4344 {
4345 	const struct ieee80211_txparam *tp;
4346 	int mode;
4347 
4348 	gettxparams(s);
4349 	for (mode = IEEE80211_MODE_11A; mode < IEEE80211_MODE_MAX; mode++) {
4350 		tp = &txparams.params[mode];
4351 		if (tp->mgmtrate == 0 && tp->mcastrate == 0)
4352 			continue;
4353 		if (mode == IEEE80211_MODE_11NA ||
4354 		    mode == IEEE80211_MODE_11NG ||
4355 		    mode == IEEE80211_MODE_VHT_2GHZ ||
4356 		    mode == IEEE80211_MODE_VHT_5GHZ) {
4357 			if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
4358 				LINE_CHECK("%-7.7s ucast NONE    mgmt %2u %s "
4359 				    "mcast %2u %s maxretry %u",
4360 				    modename[mode],
4361 				    get_rate_value(tp->mgmtrate),
4362 				    get_mcs_mbs_rate_str(tp->mgmtrate),
4363 				    get_rate_value(tp->mcastrate),
4364 				    get_mcs_mbs_rate_str(tp->mcastrate),
4365 				    tp->maxretry);
4366 			else
4367 				LINE_CHECK("%-7.7s ucast %2u MCS  mgmt %2u %s "
4368 				    "mcast %2u %s maxretry %u",
4369 				    modename[mode],
4370 				    tp->ucastrate &~ IEEE80211_RATE_MCS,
4371 				    get_rate_value(tp->mgmtrate),
4372 				    get_mcs_mbs_rate_str(tp->mgmtrate),
4373 				    get_rate_value(tp->mcastrate),
4374 				    get_mcs_mbs_rate_str(tp->mcastrate),
4375 				    tp->maxretry);
4376 		} else {
4377 			if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
4378 				LINE_CHECK("%-7.7s ucast NONE    mgmt %2u Mb/s "
4379 				    "mcast %2u Mb/s maxretry %u",
4380 				    modename[mode],
4381 				    tp->mgmtrate/2,
4382 				    tp->mcastrate/2, tp->maxretry);
4383 			else
4384 				LINE_CHECK("%-7.7s ucast %2u Mb/s mgmt %2u Mb/s "
4385 				    "mcast %2u Mb/s maxretry %u",
4386 				    modename[mode],
4387 				    tp->ucastrate/2, tp->mgmtrate/2,
4388 				    tp->mcastrate/2, tp->maxretry);
4389 		}
4390 	}
4391 }
4392 
4393 static void
4394 printpolicy(int policy)
4395 {
4396 	switch (policy) {
4397 	case IEEE80211_MACCMD_POLICY_OPEN:
4398 		printf("policy: open\n");
4399 		break;
4400 	case IEEE80211_MACCMD_POLICY_ALLOW:
4401 		printf("policy: allow\n");
4402 		break;
4403 	case IEEE80211_MACCMD_POLICY_DENY:
4404 		printf("policy: deny\n");
4405 		break;
4406 	case IEEE80211_MACCMD_POLICY_RADIUS:
4407 		printf("policy: radius\n");
4408 		break;
4409 	default:
4410 		printf("policy: unknown (%u)\n", policy);
4411 		break;
4412 	}
4413 }
4414 
4415 static void
4416 list_mac(int s)
4417 {
4418 	struct ieee80211req ireq;
4419 	struct ieee80211req_maclist *acllist;
4420 	int i, nacls, policy, len;
4421 	uint8_t *data;
4422 	char c;
4423 
4424 	(void) memset(&ireq, 0, sizeof(ireq));
4425 	(void) strlcpy(ireq.i_name, name, sizeof(ireq.i_name)); /* XXX ?? */
4426 	ireq.i_type = IEEE80211_IOC_MACCMD;
4427 	ireq.i_val = IEEE80211_MACCMD_POLICY;
4428 	if (ioctl(s, SIOCG80211, &ireq) < 0) {
4429 		if (errno == EINVAL) {
4430 			printf("No acl policy loaded\n");
4431 			return;
4432 		}
4433 		err(1, "unable to get mac policy");
4434 	}
4435 	policy = ireq.i_val;
4436 	if (policy == IEEE80211_MACCMD_POLICY_OPEN) {
4437 		c = '*';
4438 	} else if (policy == IEEE80211_MACCMD_POLICY_ALLOW) {
4439 		c = '+';
4440 	} else if (policy == IEEE80211_MACCMD_POLICY_DENY) {
4441 		c = '-';
4442 	} else if (policy == IEEE80211_MACCMD_POLICY_RADIUS) {
4443 		c = 'r';		/* NB: should never have entries */
4444 	} else {
4445 		printf("policy: unknown (%u)\n", policy);
4446 		c = '?';
4447 	}
4448 	if (verbose || c == '?')
4449 		printpolicy(policy);
4450 
4451 	ireq.i_val = IEEE80211_MACCMD_LIST;
4452 	ireq.i_len = 0;
4453 	if (ioctl(s, SIOCG80211, &ireq) < 0)
4454 		err(1, "unable to get mac acl list size");
4455 	if (ireq.i_len == 0) {		/* NB: no acls */
4456 		if (!(verbose || c == '?'))
4457 			printpolicy(policy);
4458 		return;
4459 	}
4460 	len = ireq.i_len;
4461 
4462 	data = malloc(len);
4463 	if (data == NULL)
4464 		err(1, "out of memory for acl list");
4465 
4466 	ireq.i_data = data;
4467 	if (ioctl(s, SIOCG80211, &ireq) < 0)
4468 		err(1, "unable to get mac acl list");
4469 	nacls = len / sizeof(*acllist);
4470 	acllist = (struct ieee80211req_maclist *) data;
4471 	for (i = 0; i < nacls; i++)
4472 		printf("%c%s\n", c, ether_ntoa(
4473 			(const struct ether_addr *) acllist[i].ml_macaddr));
4474 	free(data);
4475 }
4476 
4477 static void
4478 print_regdomain(const struct ieee80211_regdomain *reg, int verb)
4479 {
4480 	if ((reg->regdomain != 0 &&
4481 	    reg->regdomain != reg->country) || verb) {
4482 		const struct regdomain *rd =
4483 		    lib80211_regdomain_findbysku(getregdata(), reg->regdomain);
4484 		if (rd == NULL)
4485 			LINE_CHECK("regdomain %d", reg->regdomain);
4486 		else
4487 			LINE_CHECK("regdomain %s", rd->name);
4488 	}
4489 	if (reg->country != 0 || verb) {
4490 		const struct country *cc =
4491 		    lib80211_country_findbycc(getregdata(), reg->country);
4492 		if (cc == NULL)
4493 			LINE_CHECK("country %d", reg->country);
4494 		else
4495 			LINE_CHECK("country %s", cc->isoname);
4496 	}
4497 	if (reg->location == 'I')
4498 		LINE_CHECK("indoor");
4499 	else if (reg->location == 'O')
4500 		LINE_CHECK("outdoor");
4501 	else if (verb)
4502 		LINE_CHECK("anywhere");
4503 	if (reg->ecm)
4504 		LINE_CHECK("ecm");
4505 	else if (verb)
4506 		LINE_CHECK("-ecm");
4507 }
4508 
4509 static void
4510 list_regdomain(int s, int channelsalso)
4511 {
4512 	getregdomain(s);
4513 	if (channelsalso) {
4514 		getchaninfo(s);
4515 		spacer = ':';
4516 		print_regdomain(&regdomain, 1);
4517 		LINE_BREAK();
4518 		print_channels(s, chaninfo, 1/*allchans*/, 1/*verbose*/);
4519 	} else
4520 		print_regdomain(&regdomain, verbose);
4521 }
4522 
4523 static void
4524 list_mesh(int s)
4525 {
4526 	struct ieee80211req ireq;
4527 	struct ieee80211req_mesh_route routes[128];
4528 	struct ieee80211req_mesh_route *rt;
4529 
4530 	(void) memset(&ireq, 0, sizeof(ireq));
4531 	(void) strlcpy(ireq.i_name, name, sizeof(ireq.i_name));
4532 	ireq.i_type = IEEE80211_IOC_MESH_RTCMD;
4533 	ireq.i_val = IEEE80211_MESH_RTCMD_LIST;
4534 	ireq.i_data = &routes;
4535 	ireq.i_len = sizeof(routes);
4536 	if (ioctl(s, SIOCG80211, &ireq) < 0)
4537 	 	err(1, "unable to get the Mesh routing table");
4538 
4539 	printf("%-17.17s %-17.17s %4s %4s %4s %6s %s\n"
4540 		, "DEST"
4541 		, "NEXT HOP"
4542 		, "HOPS"
4543 		, "METRIC"
4544 		, "LIFETIME"
4545 		, "MSEQ"
4546 		, "FLAGS");
4547 
4548 	for (rt = &routes[0]; rt - &routes[0] < ireq.i_len / sizeof(*rt); rt++){
4549 		printf("%s ",
4550 		    ether_ntoa((const struct ether_addr *)rt->imr_dest));
4551 		printf("%s %4u   %4u   %6u %6u    %c%c\n",
4552 			ether_ntoa((const struct ether_addr *)rt->imr_nexthop),
4553 			rt->imr_nhops, rt->imr_metric, rt->imr_lifetime,
4554 			rt->imr_lastmseq,
4555 			(rt->imr_flags & IEEE80211_MESHRT_FLAGS_DISCOVER) ?
4556 			    'D' :
4557 			(rt->imr_flags & IEEE80211_MESHRT_FLAGS_VALID) ?
4558 			    'V' : '!',
4559 			(rt->imr_flags & IEEE80211_MESHRT_FLAGS_PROXY) ?
4560 			    'P' :
4561 			(rt->imr_flags & IEEE80211_MESHRT_FLAGS_GATE) ?
4562 			    'G' :' ');
4563 	}
4564 }
4565 
4566 static
4567 DECL_CMD_FUNC(set80211list, arg, d)
4568 {
4569 #define	iseq(a,b)	(strncasecmp(a,b,sizeof(b)-1) == 0)
4570 
4571 	LINE_INIT('\t');
4572 
4573 	if (iseq(arg, "sta"))
4574 		list_stations(s);
4575 	else if (iseq(arg, "scan") || iseq(arg, "ap"))
4576 		list_scan(s);
4577 	else if (iseq(arg, "chan") || iseq(arg, "freq"))
4578 		list_channels(s, 1);
4579 	else if (iseq(arg, "active"))
4580 		list_channels(s, 0);
4581 	else if (iseq(arg, "keys"))
4582 		list_keys(s);
4583 	else if (iseq(arg, "caps"))
4584 		list_capabilities(s);
4585 	else if (iseq(arg, "wme") || iseq(arg, "wmm"))
4586 		list_wme(s);
4587 	else if (iseq(arg, "mac"))
4588 		list_mac(s);
4589 	else if (iseq(arg, "txpow"))
4590 		list_txpow(s);
4591 	else if (iseq(arg, "roam"))
4592 		list_roam(s);
4593 	else if (iseq(arg, "txparam") || iseq(arg, "txparm"))
4594 		list_txparams(s);
4595 	else if (iseq(arg, "regdomain"))
4596 		list_regdomain(s, 1);
4597 	else if (iseq(arg, "countries"))
4598 		list_countries();
4599 	else if (iseq(arg, "mesh"))
4600 		list_mesh(s);
4601 	else
4602 		errx(1, "Don't know how to list %s for %s", arg, name);
4603 	LINE_BREAK();
4604 #undef iseq
4605 }
4606 
4607 static enum ieee80211_opmode
4608 get80211opmode(int s)
4609 {
4610 	struct ifmediareq ifmr;
4611 
4612 	(void) memset(&ifmr, 0, sizeof(ifmr));
4613 	(void) strlcpy(ifmr.ifm_name, name, sizeof(ifmr.ifm_name));
4614 
4615 	if (ioctl(s, SIOCGIFMEDIA, (caddr_t)&ifmr) >= 0) {
4616 		if (ifmr.ifm_current & IFM_IEEE80211_ADHOC) {
4617 			if (ifmr.ifm_current & IFM_FLAG0)
4618 				return IEEE80211_M_AHDEMO;
4619 			else
4620 				return IEEE80211_M_IBSS;
4621 		}
4622 		if (ifmr.ifm_current & IFM_IEEE80211_HOSTAP)
4623 			return IEEE80211_M_HOSTAP;
4624 		if (ifmr.ifm_current & IFM_IEEE80211_IBSS)
4625 			return IEEE80211_M_IBSS;
4626 		if (ifmr.ifm_current & IFM_IEEE80211_MONITOR)
4627 			return IEEE80211_M_MONITOR;
4628 		if (ifmr.ifm_current & IFM_IEEE80211_MBSS)
4629 			return IEEE80211_M_MBSS;
4630 	}
4631 	return IEEE80211_M_STA;
4632 }
4633 
4634 #if 0
4635 static void
4636 printcipher(int s, struct ieee80211req *ireq, int keylenop)
4637 {
4638 	switch (ireq->i_val) {
4639 	case IEEE80211_CIPHER_WEP:
4640 		ireq->i_type = keylenop;
4641 		if (ioctl(s, SIOCG80211, ireq) != -1)
4642 			printf("WEP-%s",
4643 			    ireq->i_len <= 5 ? "40" :
4644 			    ireq->i_len <= 13 ? "104" : "128");
4645 		else
4646 			printf("WEP");
4647 		break;
4648 	case IEEE80211_CIPHER_TKIP:
4649 		printf("TKIP");
4650 		break;
4651 	case IEEE80211_CIPHER_AES_OCB:
4652 		printf("AES-OCB");
4653 		break;
4654 	case IEEE80211_CIPHER_AES_CCM:
4655 		printf("AES-CCM");
4656 		break;
4657 	case IEEE80211_CIPHER_CKIP:
4658 		printf("CKIP");
4659 		break;
4660 	case IEEE80211_CIPHER_NONE:
4661 		printf("NONE");
4662 		break;
4663 	default:
4664 		printf("UNKNOWN (0x%x)", ireq->i_val);
4665 		break;
4666 	}
4667 }
4668 #endif
4669 
4670 static void
4671 printkey(const struct ieee80211req_key *ik)
4672 {
4673 	static const uint8_t zerodata[IEEE80211_KEYBUF_SIZE];
4674 	u_int keylen = ik->ik_keylen;
4675 	int printcontents;
4676 
4677 	printcontents = printkeys &&
4678 		(memcmp(ik->ik_keydata, zerodata, keylen) != 0 || verbose);
4679 	if (printcontents)
4680 		LINE_BREAK();
4681 	switch (ik->ik_type) {
4682 	case IEEE80211_CIPHER_WEP:
4683 		/* compatibility */
4684 		LINE_CHECK("wepkey %u:%s", ik->ik_keyix+1,
4685 		    keylen <= 5 ? "40-bit" :
4686 		    keylen <= 13 ? "104-bit" : "128-bit");
4687 		break;
4688 	case IEEE80211_CIPHER_TKIP:
4689 		if (keylen > 128/8)
4690 			keylen -= 128/8;	/* ignore MIC for now */
4691 		LINE_CHECK("TKIP %u:%u-bit", ik->ik_keyix+1, 8*keylen);
4692 		break;
4693 	case IEEE80211_CIPHER_AES_OCB:
4694 		LINE_CHECK("AES-OCB %u:%u-bit", ik->ik_keyix+1, 8*keylen);
4695 		break;
4696 	case IEEE80211_CIPHER_AES_CCM:
4697 		LINE_CHECK("AES-CCM %u:%u-bit", ik->ik_keyix+1, 8*keylen);
4698 		break;
4699 	case IEEE80211_CIPHER_CKIP:
4700 		LINE_CHECK("CKIP %u:%u-bit", ik->ik_keyix+1, 8*keylen);
4701 		break;
4702 	case IEEE80211_CIPHER_NONE:
4703 		LINE_CHECK("NULL %u:%u-bit", ik->ik_keyix+1, 8*keylen);
4704 		break;
4705 	default:
4706 		LINE_CHECK("UNKNOWN (0x%x) %u:%u-bit",
4707 			ik->ik_type, ik->ik_keyix+1, 8*keylen);
4708 		break;
4709 	}
4710 	if (printcontents) {
4711 		u_int i;
4712 
4713 		printf(" <");
4714 		for (i = 0; i < keylen; i++)
4715 			printf("%02x", ik->ik_keydata[i]);
4716 		printf(">");
4717 		if (ik->ik_type != IEEE80211_CIPHER_WEP &&
4718 		    (ik->ik_keyrsc != 0 || verbose))
4719 			printf(" rsc %ju", (uintmax_t)ik->ik_keyrsc);
4720 		if (ik->ik_type != IEEE80211_CIPHER_WEP &&
4721 		    (ik->ik_keytsc != 0 || verbose))
4722 			printf(" tsc %ju", (uintmax_t)ik->ik_keytsc);
4723 		if (ik->ik_flags != 0 && verbose) {
4724 			const char *sep = " ";
4725 
4726 			if (ik->ik_flags & IEEE80211_KEY_XMIT)
4727 				printf("%stx", sep), sep = "+";
4728 			if (ik->ik_flags & IEEE80211_KEY_RECV)
4729 				printf("%srx", sep), sep = "+";
4730 			if (ik->ik_flags & IEEE80211_KEY_DEFAULT)
4731 				printf("%sdef", sep), sep = "+";
4732 		}
4733 		LINE_BREAK();
4734 	}
4735 }
4736 
4737 static void
4738 printrate(const char *tag, int v, int defrate, int defmcs)
4739 {
4740 	if ((v & IEEE80211_RATE_MCS) == 0) {
4741 		if (v != defrate) {
4742 			if (v & 1)
4743 				LINE_CHECK("%s %d.5", tag, v/2);
4744 			else
4745 				LINE_CHECK("%s %d", tag, v/2);
4746 		}
4747 	} else {
4748 		if (v != defmcs)
4749 			LINE_CHECK("%s %d", tag, v &~ 0x80);
4750 	}
4751 }
4752 
4753 static int
4754 getid(int s, int ix, void *data, size_t len, int *plen, int mesh)
4755 {
4756 	struct ieee80211req ireq;
4757 
4758 	(void) memset(&ireq, 0, sizeof(ireq));
4759 	(void) strlcpy(ireq.i_name, name, sizeof(ireq.i_name));
4760 	ireq.i_type = (!mesh) ? IEEE80211_IOC_SSID : IEEE80211_IOC_MESH_ID;
4761 	ireq.i_val = ix;
4762 	ireq.i_data = data;
4763 	ireq.i_len = len;
4764 	if (ioctl(s, SIOCG80211, &ireq) < 0)
4765 		return -1;
4766 	*plen = ireq.i_len;
4767 	return 0;
4768 }
4769 
4770 static void
4771 ieee80211_status(int s)
4772 {
4773 	static const uint8_t zerobssid[IEEE80211_ADDR_LEN];
4774 	enum ieee80211_opmode opmode = get80211opmode(s);
4775 	int i, num, wpa, wme, bgscan, bgscaninterval, val, len, wepmode;
4776 	uint8_t data[32];
4777 	const struct ieee80211_channel *c;
4778 	const struct ieee80211_roamparam *rp;
4779 	const struct ieee80211_txparam *tp;
4780 
4781 	if (getid(s, -1, data, sizeof(data), &len, 0) < 0) {
4782 		/* If we can't get the SSID, this isn't an 802.11 device. */
4783 		return;
4784 	}
4785 
4786 	/*
4787 	 * Invalidate cached state so printing status for multiple
4788 	 * if's doesn't reuse the first interfaces' cached state.
4789 	 */
4790 	gotcurchan = 0;
4791 	gotroam = 0;
4792 	gottxparams = 0;
4793 	gothtconf = 0;
4794 	gotregdomain = 0;
4795 
4796 	printf("\t");
4797 	if (opmode == IEEE80211_M_MBSS) {
4798 		printf("meshid ");
4799 		getid(s, 0, data, sizeof(data), &len, 1);
4800 		print_string(data, len);
4801 	} else {
4802 		if (get80211val(s, IEEE80211_IOC_NUMSSIDS, &num) < 0)
4803 			num = 0;
4804 		printf("ssid ");
4805 		if (num > 1) {
4806 			for (i = 0; i < num; i++) {
4807 				if (getid(s, i, data, sizeof(data), &len, 0) >= 0 && len > 0) {
4808 					printf(" %d:", i + 1);
4809 					print_string(data, len);
4810 				}
4811 			}
4812 		} else
4813 			print_string(data, len);
4814 	}
4815 	c = getcurchan(s);
4816 	if (c->ic_freq != IEEE80211_CHAN_ANY) {
4817 		char buf[14];
4818 		printf(" channel %d (%u MHz%s)", c->ic_ieee, c->ic_freq,
4819 			get_chaninfo(c, 1, buf, sizeof(buf)));
4820 	} else if (verbose)
4821 		printf(" channel UNDEF");
4822 
4823 	if (get80211(s, IEEE80211_IOC_BSSID, data, IEEE80211_ADDR_LEN) >= 0 &&
4824 	    (memcmp(data, zerobssid, sizeof(zerobssid)) != 0 || verbose))
4825 		printf(" bssid %s", ether_ntoa((struct ether_addr *)data));
4826 
4827 	if (get80211len(s, IEEE80211_IOC_STATIONNAME, data, sizeof(data), &len) != -1) {
4828 		printf("\n\tstationname ");
4829 		print_string(data, len);
4830 	}
4831 
4832 	spacer = ' ';		/* force first break */
4833 	LINE_BREAK();
4834 
4835 	list_regdomain(s, 0);
4836 
4837 	wpa = 0;
4838 	if (get80211val(s, IEEE80211_IOC_AUTHMODE, &val) != -1) {
4839 		switch (val) {
4840 		case IEEE80211_AUTH_NONE:
4841 			LINE_CHECK("authmode NONE");
4842 			break;
4843 		case IEEE80211_AUTH_OPEN:
4844 			LINE_CHECK("authmode OPEN");
4845 			break;
4846 		case IEEE80211_AUTH_SHARED:
4847 			LINE_CHECK("authmode SHARED");
4848 			break;
4849 		case IEEE80211_AUTH_8021X:
4850 			LINE_CHECK("authmode 802.1x");
4851 			break;
4852 		case IEEE80211_AUTH_WPA:
4853 			if (get80211val(s, IEEE80211_IOC_WPA, &wpa) < 0)
4854 				wpa = 1;	/* default to WPA1 */
4855 			switch (wpa) {
4856 			case 2:
4857 				LINE_CHECK("authmode WPA2/802.11i");
4858 				break;
4859 			case 3:
4860 				LINE_CHECK("authmode WPA1+WPA2/802.11i");
4861 				break;
4862 			default:
4863 				LINE_CHECK("authmode WPA");
4864 				break;
4865 			}
4866 			break;
4867 		case IEEE80211_AUTH_AUTO:
4868 			LINE_CHECK("authmode AUTO");
4869 			break;
4870 		default:
4871 			LINE_CHECK("authmode UNKNOWN (0x%x)", val);
4872 			break;
4873 		}
4874 	}
4875 
4876 	if (wpa || verbose) {
4877 		if (get80211val(s, IEEE80211_IOC_WPS, &val) != -1) {
4878 			if (val)
4879 				LINE_CHECK("wps");
4880 			else if (verbose)
4881 				LINE_CHECK("-wps");
4882 		}
4883 		if (get80211val(s, IEEE80211_IOC_TSN, &val) != -1) {
4884 			if (val)
4885 				LINE_CHECK("tsn");
4886 			else if (verbose)
4887 				LINE_CHECK("-tsn");
4888 		}
4889 		if (ioctl(s, IEEE80211_IOC_COUNTERMEASURES, &val) != -1) {
4890 			if (val)
4891 				LINE_CHECK("countermeasures");
4892 			else if (verbose)
4893 				LINE_CHECK("-countermeasures");
4894 		}
4895 #if 0
4896 		/* XXX not interesting with WPA done in user space */
4897 		ireq.i_type = IEEE80211_IOC_KEYMGTALGS;
4898 		if (ioctl(s, SIOCG80211, &ireq) != -1) {
4899 		}
4900 
4901 		ireq.i_type = IEEE80211_IOC_MCASTCIPHER;
4902 		if (ioctl(s, SIOCG80211, &ireq) != -1) {
4903 			LINE_CHECK("mcastcipher ");
4904 			printcipher(s, &ireq, IEEE80211_IOC_MCASTKEYLEN);
4905 			spacer = ' ';
4906 		}
4907 
4908 		ireq.i_type = IEEE80211_IOC_UCASTCIPHER;
4909 		if (ioctl(s, SIOCG80211, &ireq) != -1) {
4910 			LINE_CHECK("ucastcipher ");
4911 			printcipher(s, &ireq, IEEE80211_IOC_UCASTKEYLEN);
4912 		}
4913 
4914 		if (wpa & 2) {
4915 			ireq.i_type = IEEE80211_IOC_RSNCAPS;
4916 			if (ioctl(s, SIOCG80211, &ireq) != -1) {
4917 				LINE_CHECK("RSN caps 0x%x", ireq.i_val);
4918 				spacer = ' ';
4919 			}
4920 		}
4921 
4922 		ireq.i_type = IEEE80211_IOC_UCASTCIPHERS;
4923 		if (ioctl(s, SIOCG80211, &ireq) != -1) {
4924 		}
4925 #endif
4926 	}
4927 
4928 	if (get80211val(s, IEEE80211_IOC_WEP, &wepmode) != -1 &&
4929 	    wepmode != IEEE80211_WEP_NOSUP) {
4930 
4931 		switch (wepmode) {
4932 		case IEEE80211_WEP_OFF:
4933 			LINE_CHECK("privacy OFF");
4934 			break;
4935 		case IEEE80211_WEP_ON:
4936 			LINE_CHECK("privacy ON");
4937 			break;
4938 		case IEEE80211_WEP_MIXED:
4939 			LINE_CHECK("privacy MIXED");
4940 			break;
4941 		default:
4942 			LINE_CHECK("privacy UNKNOWN (0x%x)", wepmode);
4943 			break;
4944 		}
4945 
4946 		/*
4947 		 * If we get here then we've got WEP support so we need
4948 		 * to print WEP status.
4949 		 */
4950 
4951 		if (get80211val(s, IEEE80211_IOC_WEPTXKEY, &val) < 0) {
4952 			warn("WEP support, but no tx key!");
4953 			goto end;
4954 		}
4955 		if (val != -1)
4956 			LINE_CHECK("deftxkey %d", val+1);
4957 		else if (wepmode != IEEE80211_WEP_OFF || verbose)
4958 			LINE_CHECK("deftxkey UNDEF");
4959 
4960 		if (get80211val(s, IEEE80211_IOC_NUMWEPKEYS, &num) < 0) {
4961 			warn("WEP support, but no NUMWEPKEYS support!");
4962 			goto end;
4963 		}
4964 
4965 		for (i = 0; i < num; i++) {
4966 			struct ieee80211req_key ik;
4967 
4968 			memset(&ik, 0, sizeof(ik));
4969 			ik.ik_keyix = i;
4970 			if (get80211(s, IEEE80211_IOC_WPAKEY, &ik, sizeof(ik)) < 0) {
4971 				warn("WEP support, but can get keys!");
4972 				goto end;
4973 			}
4974 			if (ik.ik_keylen != 0) {
4975 				if (verbose)
4976 					LINE_BREAK();
4977 				printkey(&ik);
4978 			}
4979 		}
4980 end:
4981 		;
4982 	}
4983 
4984 	if (get80211val(s, IEEE80211_IOC_POWERSAVE, &val) != -1 &&
4985 	    val != IEEE80211_POWERSAVE_NOSUP ) {
4986 		if (val != IEEE80211_POWERSAVE_OFF || verbose) {
4987 			switch (val) {
4988 			case IEEE80211_POWERSAVE_OFF:
4989 				LINE_CHECK("powersavemode OFF");
4990 				break;
4991 			case IEEE80211_POWERSAVE_CAM:
4992 				LINE_CHECK("powersavemode CAM");
4993 				break;
4994 			case IEEE80211_POWERSAVE_PSP:
4995 				LINE_CHECK("powersavemode PSP");
4996 				break;
4997 			case IEEE80211_POWERSAVE_PSP_CAM:
4998 				LINE_CHECK("powersavemode PSP-CAM");
4999 				break;
5000 			}
5001 			if (get80211val(s, IEEE80211_IOC_POWERSAVESLEEP, &val) != -1)
5002 				LINE_CHECK("powersavesleep %d", val);
5003 		}
5004 	}
5005 
5006 	if (get80211val(s, IEEE80211_IOC_TXPOWER, &val) != -1) {
5007 		if (val & 1)
5008 			LINE_CHECK("txpower %d.5", val/2);
5009 		else
5010 			LINE_CHECK("txpower %d", val/2);
5011 	}
5012 	if (verbose) {
5013 		if (get80211val(s, IEEE80211_IOC_TXPOWMAX, &val) != -1)
5014 			LINE_CHECK("txpowmax %.1f", val/2.);
5015 	}
5016 
5017 	if (get80211val(s, IEEE80211_IOC_DOTD, &val) != -1) {
5018 		if (val)
5019 			LINE_CHECK("dotd");
5020 		else if (verbose)
5021 			LINE_CHECK("-dotd");
5022 	}
5023 
5024 	if (get80211val(s, IEEE80211_IOC_RTSTHRESHOLD, &val) != -1) {
5025 		if (val != IEEE80211_RTS_MAX || verbose)
5026 			LINE_CHECK("rtsthreshold %d", val);
5027 	}
5028 
5029 	if (get80211val(s, IEEE80211_IOC_FRAGTHRESHOLD, &val) != -1) {
5030 		if (val != IEEE80211_FRAG_MAX || verbose)
5031 			LINE_CHECK("fragthreshold %d", val);
5032 	}
5033 	if (opmode == IEEE80211_M_STA || verbose) {
5034 		if (get80211val(s, IEEE80211_IOC_BMISSTHRESHOLD, &val) != -1) {
5035 			if (val != IEEE80211_HWBMISS_MAX || verbose)
5036 				LINE_CHECK("bmiss %d", val);
5037 		}
5038 	}
5039 
5040 	if (!verbose) {
5041 		gettxparams(s);
5042 		tp = &txparams.params[chan2mode(c)];
5043 		printrate("ucastrate", tp->ucastrate,
5044 		    IEEE80211_FIXED_RATE_NONE, IEEE80211_FIXED_RATE_NONE);
5045 		printrate("mcastrate", tp->mcastrate, 2*1,
5046 		    IEEE80211_RATE_MCS|0);
5047 		printrate("mgmtrate", tp->mgmtrate, 2*1,
5048 		    IEEE80211_RATE_MCS|0);
5049 		if (tp->maxretry != 6)		/* XXX */
5050 			LINE_CHECK("maxretry %d", tp->maxretry);
5051 	} else {
5052 		LINE_BREAK();
5053 		list_txparams(s);
5054 	}
5055 
5056 	bgscaninterval = -1;
5057 	(void) get80211val(s, IEEE80211_IOC_BGSCAN_INTERVAL, &bgscaninterval);
5058 
5059 	if (get80211val(s, IEEE80211_IOC_SCANVALID, &val) != -1) {
5060 		if (val != bgscaninterval || verbose)
5061 			LINE_CHECK("scanvalid %u", val);
5062 	}
5063 
5064 	bgscan = 0;
5065 	if (get80211val(s, IEEE80211_IOC_BGSCAN, &bgscan) != -1) {
5066 		if (bgscan)
5067 			LINE_CHECK("bgscan");
5068 		else if (verbose)
5069 			LINE_CHECK("-bgscan");
5070 	}
5071 	if (bgscan || verbose) {
5072 		if (bgscaninterval != -1)
5073 			LINE_CHECK("bgscanintvl %u", bgscaninterval);
5074 		if (get80211val(s, IEEE80211_IOC_BGSCAN_IDLE, &val) != -1)
5075 			LINE_CHECK("bgscanidle %u", val);
5076 		if (!verbose) {
5077 			getroam(s);
5078 			rp = &roamparams.params[chan2mode(c)];
5079 			if (rp->rssi & 1)
5080 				LINE_CHECK("roam:rssi %u.5", rp->rssi/2);
5081 			else
5082 				LINE_CHECK("roam:rssi %u", rp->rssi/2);
5083 			LINE_CHECK("roam:rate %s%u",
5084 			    (rp->rate & IEEE80211_RATE_MCS) ? "MCS " : "",
5085 			    get_rate_value(rp->rate));
5086 		} else {
5087 			LINE_BREAK();
5088 			list_roam(s);
5089 			LINE_BREAK();
5090 		}
5091 	}
5092 
5093 	if (IEEE80211_IS_CHAN_ANYG(c) || verbose) {
5094 		if (get80211val(s, IEEE80211_IOC_PUREG, &val) != -1) {
5095 			if (val)
5096 				LINE_CHECK("pureg");
5097 			else if (verbose)
5098 				LINE_CHECK("-pureg");
5099 		}
5100 		if (get80211val(s, IEEE80211_IOC_PROTMODE, &val) != -1) {
5101 			switch (val) {
5102 			case IEEE80211_PROTMODE_OFF:
5103 				LINE_CHECK("protmode OFF");
5104 				break;
5105 			case IEEE80211_PROTMODE_CTS:
5106 				LINE_CHECK("protmode CTS");
5107 				break;
5108 			case IEEE80211_PROTMODE_RTSCTS:
5109 				LINE_CHECK("protmode RTSCTS");
5110 				break;
5111 			default:
5112 				LINE_CHECK("protmode UNKNOWN (0x%x)", val);
5113 				break;
5114 			}
5115 		}
5116 	}
5117 
5118 	if (IEEE80211_IS_CHAN_HT(c) || verbose) {
5119 		gethtconf(s);
5120 		switch (htconf & 3) {
5121 		case 0:
5122 		case 2:
5123 			LINE_CHECK("-ht");
5124 			break;
5125 		case 1:
5126 			LINE_CHECK("ht20");
5127 			break;
5128 		case 3:
5129 			if (verbose)
5130 				LINE_CHECK("ht");
5131 			break;
5132 		}
5133 		if (get80211val(s, IEEE80211_IOC_HTCOMPAT, &val) != -1) {
5134 			if (!val)
5135 				LINE_CHECK("-htcompat");
5136 			else if (verbose)
5137 				LINE_CHECK("htcompat");
5138 		}
5139 		if (get80211val(s, IEEE80211_IOC_AMPDU, &val) != -1) {
5140 			switch (val) {
5141 			case 0:
5142 				LINE_CHECK("-ampdu");
5143 				break;
5144 			case 1:
5145 				LINE_CHECK("ampdutx -ampdurx");
5146 				break;
5147 			case 2:
5148 				LINE_CHECK("-ampdutx ampdurx");
5149 				break;
5150 			case 3:
5151 				if (verbose)
5152 					LINE_CHECK("ampdu");
5153 				break;
5154 			}
5155 		}
5156 		/* XXX 11ac density/size is different */
5157 		if (get80211val(s, IEEE80211_IOC_AMPDU_LIMIT, &val) != -1) {
5158 			switch (val) {
5159 			case IEEE80211_HTCAP_MAXRXAMPDU_8K:
5160 				LINE_CHECK("ampdulimit 8k");
5161 				break;
5162 			case IEEE80211_HTCAP_MAXRXAMPDU_16K:
5163 				LINE_CHECK("ampdulimit 16k");
5164 				break;
5165 			case IEEE80211_HTCAP_MAXRXAMPDU_32K:
5166 				LINE_CHECK("ampdulimit 32k");
5167 				break;
5168 			case IEEE80211_HTCAP_MAXRXAMPDU_64K:
5169 				LINE_CHECK("ampdulimit 64k");
5170 				break;
5171 			}
5172 		}
5173 		/* XXX 11ac density/size is different */
5174 		if (get80211val(s, IEEE80211_IOC_AMPDU_DENSITY, &val) != -1) {
5175 			switch (val) {
5176 			case IEEE80211_HTCAP_MPDUDENSITY_NA:
5177 				if (verbose)
5178 					LINE_CHECK("ampdudensity NA");
5179 				break;
5180 			case IEEE80211_HTCAP_MPDUDENSITY_025:
5181 				LINE_CHECK("ampdudensity .25");
5182 				break;
5183 			case IEEE80211_HTCAP_MPDUDENSITY_05:
5184 				LINE_CHECK("ampdudensity .5");
5185 				break;
5186 			case IEEE80211_HTCAP_MPDUDENSITY_1:
5187 				LINE_CHECK("ampdudensity 1");
5188 				break;
5189 			case IEEE80211_HTCAP_MPDUDENSITY_2:
5190 				LINE_CHECK("ampdudensity 2");
5191 				break;
5192 			case IEEE80211_HTCAP_MPDUDENSITY_4:
5193 				LINE_CHECK("ampdudensity 4");
5194 				break;
5195 			case IEEE80211_HTCAP_MPDUDENSITY_8:
5196 				LINE_CHECK("ampdudensity 8");
5197 				break;
5198 			case IEEE80211_HTCAP_MPDUDENSITY_16:
5199 				LINE_CHECK("ampdudensity 16");
5200 				break;
5201 			}
5202 		}
5203 		if (get80211val(s, IEEE80211_IOC_AMSDU, &val) != -1) {
5204 			switch (val) {
5205 			case 0:
5206 				LINE_CHECK("-amsdu");
5207 				break;
5208 			case 1:
5209 				LINE_CHECK("amsdutx -amsdurx");
5210 				break;
5211 			case 2:
5212 				LINE_CHECK("-amsdutx amsdurx");
5213 				break;
5214 			case 3:
5215 				if (verbose)
5216 					LINE_CHECK("amsdu");
5217 				break;
5218 			}
5219 		}
5220 		/* XXX amsdu limit */
5221 		if (get80211val(s, IEEE80211_IOC_SHORTGI, &val) != -1) {
5222 			if (val)
5223 				LINE_CHECK("shortgi");
5224 			else if (verbose)
5225 				LINE_CHECK("-shortgi");
5226 		}
5227 		if (get80211val(s, IEEE80211_IOC_HTPROTMODE, &val) != -1) {
5228 			if (val == IEEE80211_PROTMODE_OFF)
5229 				LINE_CHECK("htprotmode OFF");
5230 			else if (val != IEEE80211_PROTMODE_RTSCTS)
5231 				LINE_CHECK("htprotmode UNKNOWN (0x%x)", val);
5232 			else if (verbose)
5233 				LINE_CHECK("htprotmode RTSCTS");
5234 		}
5235 		if (get80211val(s, IEEE80211_IOC_PUREN, &val) != -1) {
5236 			if (val)
5237 				LINE_CHECK("puren");
5238 			else if (verbose)
5239 				LINE_CHECK("-puren");
5240 		}
5241 		if (get80211val(s, IEEE80211_IOC_SMPS, &val) != -1) {
5242 			if (val == IEEE80211_HTCAP_SMPS_DYNAMIC)
5243 				LINE_CHECK("smpsdyn");
5244 			else if (val == IEEE80211_HTCAP_SMPS_ENA)
5245 				LINE_CHECK("smps");
5246 			else if (verbose)
5247 				LINE_CHECK("-smps");
5248 		}
5249 		if (get80211val(s, IEEE80211_IOC_RIFS, &val) != -1) {
5250 			if (val)
5251 				LINE_CHECK("rifs");
5252 			else if (verbose)
5253 				LINE_CHECK("-rifs");
5254 		}
5255 
5256 		/* XXX VHT STBC? */
5257 		if (get80211val(s, IEEE80211_IOC_STBC, &val) != -1) {
5258 			switch (val) {
5259 			case 0:
5260 				LINE_CHECK("-stbc");
5261 				break;
5262 			case 1:
5263 				LINE_CHECK("stbctx -stbcrx");
5264 				break;
5265 			case 2:
5266 				LINE_CHECK("-stbctx stbcrx");
5267 				break;
5268 			case 3:
5269 				if (verbose)
5270 					LINE_CHECK("stbc");
5271 				break;
5272 			}
5273 		}
5274 		if (get80211val(s, IEEE80211_IOC_LDPC, &val) != -1) {
5275 			switch (val) {
5276 			case 0:
5277 				LINE_CHECK("-ldpc");
5278 				break;
5279 			case 1:
5280 				LINE_CHECK("ldpctx -ldpcrx");
5281 				break;
5282 			case 2:
5283 				LINE_CHECK("-ldpctx ldpcrx");
5284 				break;
5285 			case 3:
5286 				if (verbose)
5287 					LINE_CHECK("ldpc");
5288 				break;
5289 			}
5290 		}
5291 	}
5292 
5293 	if (IEEE80211_IS_CHAN_VHT(c) || verbose) {
5294 		getvhtconf(s);
5295 		if (vhtconf & 0x1)
5296 			LINE_CHECK("vht");
5297 		else
5298 			LINE_CHECK("-vht");
5299 		if (vhtconf & 0x2)
5300 			LINE_CHECK("vht40");
5301 		else
5302 			LINE_CHECK("-vht40");
5303 		if (vhtconf & 0x4)
5304 			LINE_CHECK("vht80");
5305 		else
5306 			LINE_CHECK("-vht80");
5307 		if (vhtconf & 0x8)
5308 			LINE_CHECK("vht80p80");
5309 		else
5310 			LINE_CHECK("-vht80p80");
5311 		if (vhtconf & 0x10)
5312 			LINE_CHECK("vht160");
5313 		else
5314 			LINE_CHECK("-vht160");
5315 	}
5316 
5317 	if (get80211val(s, IEEE80211_IOC_WME, &wme) != -1) {
5318 		if (wme)
5319 			LINE_CHECK("wme");
5320 		else if (verbose)
5321 			LINE_CHECK("-wme");
5322 	} else
5323 		wme = 0;
5324 
5325 	if (get80211val(s, IEEE80211_IOC_BURST, &val) != -1) {
5326 		if (val)
5327 			LINE_CHECK("burst");
5328 		else if (verbose)
5329 			LINE_CHECK("-burst");
5330 	}
5331 
5332 	if (get80211val(s, IEEE80211_IOC_FF, &val) != -1) {
5333 		if (val)
5334 			LINE_CHECK("ff");
5335 		else if (verbose)
5336 			LINE_CHECK("-ff");
5337 	}
5338 	if (get80211val(s, IEEE80211_IOC_TURBOP, &val) != -1) {
5339 		if (val)
5340 			LINE_CHECK("dturbo");
5341 		else if (verbose)
5342 			LINE_CHECK("-dturbo");
5343 	}
5344 	if (get80211val(s, IEEE80211_IOC_DWDS, &val) != -1) {
5345 		if (val)
5346 			LINE_CHECK("dwds");
5347 		else if (verbose)
5348 			LINE_CHECK("-dwds");
5349 	}
5350 
5351 	if (opmode == IEEE80211_M_HOSTAP) {
5352 		if (get80211val(s, IEEE80211_IOC_HIDESSID, &val) != -1) {
5353 			if (val)
5354 				LINE_CHECK("hidessid");
5355 			else if (verbose)
5356 				LINE_CHECK("-hidessid");
5357 		}
5358 		if (get80211val(s, IEEE80211_IOC_APBRIDGE, &val) != -1) {
5359 			if (!val)
5360 				LINE_CHECK("-apbridge");
5361 			else if (verbose)
5362 				LINE_CHECK("apbridge");
5363 		}
5364 		if (get80211val(s, IEEE80211_IOC_DTIM_PERIOD, &val) != -1)
5365 			LINE_CHECK("dtimperiod %u", val);
5366 
5367 		if (get80211val(s, IEEE80211_IOC_DOTH, &val) != -1) {
5368 			if (!val)
5369 				LINE_CHECK("-doth");
5370 			else if (verbose)
5371 				LINE_CHECK("doth");
5372 		}
5373 		if (get80211val(s, IEEE80211_IOC_DFS, &val) != -1) {
5374 			if (!val)
5375 				LINE_CHECK("-dfs");
5376 			else if (verbose)
5377 				LINE_CHECK("dfs");
5378 		}
5379 		if (get80211val(s, IEEE80211_IOC_INACTIVITY, &val) != -1) {
5380 			if (!val)
5381 				LINE_CHECK("-inact");
5382 			else if (verbose)
5383 				LINE_CHECK("inact");
5384 		}
5385 	} else {
5386 		if (get80211val(s, IEEE80211_IOC_ROAMING, &val) != -1) {
5387 			if (val != IEEE80211_ROAMING_AUTO || verbose) {
5388 				switch (val) {
5389 				case IEEE80211_ROAMING_DEVICE:
5390 					LINE_CHECK("roaming DEVICE");
5391 					break;
5392 				case IEEE80211_ROAMING_AUTO:
5393 					LINE_CHECK("roaming AUTO");
5394 					break;
5395 				case IEEE80211_ROAMING_MANUAL:
5396 					LINE_CHECK("roaming MANUAL");
5397 					break;
5398 				default:
5399 					LINE_CHECK("roaming UNKNOWN (0x%x)",
5400 						val);
5401 					break;
5402 				}
5403 			}
5404 		}
5405 	}
5406 
5407 	if (opmode == IEEE80211_M_AHDEMO) {
5408 		if (get80211val(s, IEEE80211_IOC_TDMA_SLOT, &val) != -1)
5409 			LINE_CHECK("tdmaslot %u", val);
5410 		if (get80211val(s, IEEE80211_IOC_TDMA_SLOTCNT, &val) != -1)
5411 			LINE_CHECK("tdmaslotcnt %u", val);
5412 		if (get80211val(s, IEEE80211_IOC_TDMA_SLOTLEN, &val) != -1)
5413 			LINE_CHECK("tdmaslotlen %u", val);
5414 		if (get80211val(s, IEEE80211_IOC_TDMA_BINTERVAL, &val) != -1)
5415 			LINE_CHECK("tdmabintval %u", val);
5416 	} else if (get80211val(s, IEEE80211_IOC_BEACON_INTERVAL, &val) != -1) {
5417 		/* XXX default define not visible */
5418 		if (val != 100 || verbose)
5419 			LINE_CHECK("bintval %u", val);
5420 	}
5421 
5422 	if (wme && verbose) {
5423 		LINE_BREAK();
5424 		list_wme(s);
5425 	}
5426 
5427 	if (opmode == IEEE80211_M_MBSS) {
5428 		if (get80211val(s, IEEE80211_IOC_MESH_TTL, &val) != -1) {
5429 			LINE_CHECK("meshttl %u", val);
5430 		}
5431 		if (get80211val(s, IEEE80211_IOC_MESH_AP, &val) != -1) {
5432 			if (val)
5433 				LINE_CHECK("meshpeering");
5434 			else
5435 				LINE_CHECK("-meshpeering");
5436 		}
5437 		if (get80211val(s, IEEE80211_IOC_MESH_FWRD, &val) != -1) {
5438 			if (val)
5439 				LINE_CHECK("meshforward");
5440 			else
5441 				LINE_CHECK("-meshforward");
5442 		}
5443 		if (get80211val(s, IEEE80211_IOC_MESH_GATE, &val) != -1) {
5444 			if (val)
5445 				LINE_CHECK("meshgate");
5446 			else
5447 				LINE_CHECK("-meshgate");
5448 		}
5449 		if (get80211len(s, IEEE80211_IOC_MESH_PR_METRIC, data, 12,
5450 		    &len) != -1) {
5451 			data[len] = '\0';
5452 			LINE_CHECK("meshmetric %s", data);
5453 		}
5454 		if (get80211len(s, IEEE80211_IOC_MESH_PR_PATH, data, 12,
5455 		    &len) != -1) {
5456 			data[len] = '\0';
5457 			LINE_CHECK("meshpath %s", data);
5458 		}
5459 		if (get80211val(s, IEEE80211_IOC_HWMP_ROOTMODE, &val) != -1) {
5460 			switch (val) {
5461 			case IEEE80211_HWMP_ROOTMODE_DISABLED:
5462 				LINE_CHECK("hwmprootmode DISABLED");
5463 				break;
5464 			case IEEE80211_HWMP_ROOTMODE_NORMAL:
5465 				LINE_CHECK("hwmprootmode NORMAL");
5466 				break;
5467 			case IEEE80211_HWMP_ROOTMODE_PROACTIVE:
5468 				LINE_CHECK("hwmprootmode PROACTIVE");
5469 				break;
5470 			case IEEE80211_HWMP_ROOTMODE_RANN:
5471 				LINE_CHECK("hwmprootmode RANN");
5472 				break;
5473 			default:
5474 				LINE_CHECK("hwmprootmode UNKNOWN(%d)", val);
5475 				break;
5476 			}
5477 		}
5478 		if (get80211val(s, IEEE80211_IOC_HWMP_MAXHOPS, &val) != -1) {
5479 			LINE_CHECK("hwmpmaxhops %u", val);
5480 		}
5481 	}
5482 
5483 	LINE_BREAK();
5484 }
5485 
5486 static int
5487 get80211(int s, int type, void *data, int len)
5488 {
5489 
5490 	return (lib80211_get80211(s, name, type, data, len));
5491 }
5492 
5493 static int
5494 get80211len(int s, int type, void *data, int len, int *plen)
5495 {
5496 
5497 	return (lib80211_get80211len(s, name, type, data, len, plen));
5498 }
5499 
5500 static int
5501 get80211val(int s, int type, int *val)
5502 {
5503 
5504 	return (lib80211_get80211val(s, name, type, val));
5505 }
5506 
5507 static void
5508 set80211(int s, int type, int val, int len, void *data)
5509 {
5510 	int ret;
5511 
5512 	ret = lib80211_set80211(s, name, type, val, len, data);
5513 	if (ret < 0)
5514 		err(1, "SIOCS80211");
5515 }
5516 
5517 static const char *
5518 get_string(const char *val, const char *sep, u_int8_t *buf, int *lenp)
5519 {
5520 	int len;
5521 	int hexstr;
5522 	u_int8_t *p;
5523 
5524 	len = *lenp;
5525 	p = buf;
5526 	hexstr = (val[0] == '0' && tolower((u_char)val[1]) == 'x');
5527 	if (hexstr)
5528 		val += 2;
5529 	for (;;) {
5530 		if (*val == '\0')
5531 			break;
5532 		if (sep != NULL && strchr(sep, *val) != NULL) {
5533 			val++;
5534 			break;
5535 		}
5536 		if (hexstr) {
5537 			if (!isxdigit((u_char)val[0])) {
5538 				warnx("bad hexadecimal digits");
5539 				return NULL;
5540 			}
5541 			if (!isxdigit((u_char)val[1])) {
5542 				warnx("odd count hexadecimal digits");
5543 				return NULL;
5544 			}
5545 		}
5546 		if (p >= buf + len) {
5547 			if (hexstr)
5548 				warnx("hexadecimal digits too long");
5549 			else
5550 				warnx("string too long");
5551 			return NULL;
5552 		}
5553 		if (hexstr) {
5554 #define	tohex(x)	(isdigit(x) ? (x) - '0' : tolower(x) - 'a' + 10)
5555 			*p++ = (tohex((u_char)val[0]) << 4) |
5556 			    tohex((u_char)val[1]);
5557 #undef tohex
5558 			val += 2;
5559 		} else
5560 			*p++ = *val++;
5561 	}
5562 	len = p - buf;
5563 	/* The string "-" is treated as the empty string. */
5564 	if (!hexstr && len == 1 && buf[0] == '-') {
5565 		len = 0;
5566 		memset(buf, 0, *lenp);
5567 	} else if (len < *lenp)
5568 		memset(p, 0, *lenp - len);
5569 	*lenp = len;
5570 	return val;
5571 }
5572 
5573 static void
5574 print_string(const u_int8_t *buf, int len)
5575 {
5576 	int i;
5577 	int hasspc;
5578 	int utf8;
5579 
5580 	i = 0;
5581 	hasspc = 0;
5582 
5583 	setlocale(LC_CTYPE, "");
5584 	utf8 = strncmp("UTF-8", nl_langinfo(CODESET), 5) == 0;
5585 
5586 	for (; i < len; i++) {
5587 		if (!isprint(buf[i]) && buf[i] != '\0' && !utf8)
5588 			break;
5589 		if (isspace(buf[i]))
5590 			hasspc++;
5591 	}
5592 	if (i == len || utf8) {
5593 		if (hasspc || len == 0 || buf[0] == '\0')
5594 			printf("\"%.*s\"", len, buf);
5595 		else
5596 			printf("%.*s", len, buf);
5597 	} else {
5598 		printf("0x");
5599 		for (i = 0; i < len; i++)
5600 			printf("%02x", buf[i]);
5601 	}
5602 }
5603 
5604 static void
5605 setdefregdomain(int s)
5606 {
5607 	struct regdata *rdp = getregdata();
5608 	const struct regdomain *rd;
5609 
5610 	/* Check if regdomain/country was already set by a previous call. */
5611 	/* XXX is it possible? */
5612 	if (regdomain.regdomain != 0 ||
5613 	    regdomain.country != CTRY_DEFAULT)
5614 		return;
5615 
5616 	getregdomain(s);
5617 
5618 	/* Check if it was already set by the driver. */
5619 	if (regdomain.regdomain != 0 ||
5620 	    regdomain.country != CTRY_DEFAULT)
5621 		return;
5622 
5623 	/* Set FCC/US as default. */
5624 	rd = lib80211_regdomain_findbysku(rdp, SKU_FCC);
5625 	if (rd == NULL)
5626 		errx(1, "FCC regdomain was not found");
5627 
5628 	regdomain.regdomain = rd->sku;
5629 	if (rd->cc != NULL)
5630 		defaultcountry(rd);
5631 
5632 	/* Send changes to net80211. */
5633 	setregdomain_cb(s, &regdomain);
5634 
5635 	/* Cleanup (so it can be overriden by subsequent parameters). */
5636 	regdomain.regdomain = 0;
5637 	regdomain.country = CTRY_DEFAULT;
5638 	regdomain.isocc[0] = 0;
5639 	regdomain.isocc[1] = 0;
5640 }
5641 
5642 /*
5643  * Virtual AP cloning support.
5644  */
5645 static struct ieee80211_clone_params params = {
5646 	.icp_opmode	= IEEE80211_M_STA,	/* default to station mode */
5647 };
5648 
5649 static void
5650 wlan_create(int s, struct ifreq *ifr)
5651 {
5652 	static const uint8_t zerobssid[IEEE80211_ADDR_LEN];
5653 	char orig_name[IFNAMSIZ];
5654 
5655 	if (params.icp_parent[0] == '\0')
5656 		errx(1, "must specify a parent device (wlandev) when creating "
5657 		    "a wlan device");
5658 	if (params.icp_opmode == IEEE80211_M_WDS &&
5659 	    memcmp(params.icp_bssid, zerobssid, sizeof(zerobssid)) == 0)
5660 		errx(1, "no bssid specified for WDS (use wlanbssid)");
5661 	ifr->ifr_data = (caddr_t) &params;
5662 	if (ioctl(s, SIOCIFCREATE2, ifr) < 0)
5663 		err(1, "SIOCIFCREATE2");
5664 
5665 	/* XXX preserve original name for ifclonecreate(). */
5666 	strlcpy(orig_name, name, sizeof(orig_name));
5667 	strlcpy(name, ifr->ifr_name, sizeof(name));
5668 
5669 	setdefregdomain(s);
5670 
5671 	strlcpy(name, orig_name, sizeof(name));
5672 }
5673 
5674 static
5675 DECL_CMD_FUNC(set80211clone_wlandev, arg, d)
5676 {
5677 	strlcpy(params.icp_parent, arg, IFNAMSIZ);
5678 }
5679 
5680 static
5681 DECL_CMD_FUNC(set80211clone_wlanbssid, arg, d)
5682 {
5683 	const struct ether_addr *ea;
5684 
5685 	ea = ether_aton(arg);
5686 	if (ea == NULL)
5687 		errx(1, "%s: cannot parse bssid", arg);
5688 	memcpy(params.icp_bssid, ea->octet, IEEE80211_ADDR_LEN);
5689 }
5690 
5691 static
5692 DECL_CMD_FUNC(set80211clone_wlanaddr, arg, d)
5693 {
5694 	const struct ether_addr *ea;
5695 
5696 	ea = ether_aton(arg);
5697 	if (ea == NULL)
5698 		errx(1, "%s: cannot parse address", arg);
5699 	memcpy(params.icp_macaddr, ea->octet, IEEE80211_ADDR_LEN);
5700 	params.icp_flags |= IEEE80211_CLONE_MACADDR;
5701 }
5702 
5703 static
5704 DECL_CMD_FUNC(set80211clone_wlanmode, arg, d)
5705 {
5706 #define	iseq(a,b)	(strncasecmp(a,b,sizeof(b)-1) == 0)
5707 	if (iseq(arg, "sta"))
5708 		params.icp_opmode = IEEE80211_M_STA;
5709 	else if (iseq(arg, "ahdemo") || iseq(arg, "adhoc-demo"))
5710 		params.icp_opmode = IEEE80211_M_AHDEMO;
5711 	else if (iseq(arg, "ibss") || iseq(arg, "adhoc"))
5712 		params.icp_opmode = IEEE80211_M_IBSS;
5713 	else if (iseq(arg, "ap") || iseq(arg, "host"))
5714 		params.icp_opmode = IEEE80211_M_HOSTAP;
5715 	else if (iseq(arg, "wds"))
5716 		params.icp_opmode = IEEE80211_M_WDS;
5717 	else if (iseq(arg, "monitor"))
5718 		params.icp_opmode = IEEE80211_M_MONITOR;
5719 	else if (iseq(arg, "tdma")) {
5720 		params.icp_opmode = IEEE80211_M_AHDEMO;
5721 		params.icp_flags |= IEEE80211_CLONE_TDMA;
5722 	} else if (iseq(arg, "mesh") || iseq(arg, "mp")) /* mesh point */
5723 		params.icp_opmode = IEEE80211_M_MBSS;
5724 	else
5725 		errx(1, "Don't know to create %s for %s", arg, name);
5726 #undef iseq
5727 }
5728 
5729 static void
5730 set80211clone_beacons(const char *val, int d, int s, const struct afswtch *rafp)
5731 {
5732 	/* NB: inverted sense */
5733 	if (d)
5734 		params.icp_flags &= ~IEEE80211_CLONE_NOBEACONS;
5735 	else
5736 		params.icp_flags |= IEEE80211_CLONE_NOBEACONS;
5737 }
5738 
5739 static void
5740 set80211clone_bssid(const char *val, int d, int s, const struct afswtch *rafp)
5741 {
5742 	if (d)
5743 		params.icp_flags |= IEEE80211_CLONE_BSSID;
5744 	else
5745 		params.icp_flags &= ~IEEE80211_CLONE_BSSID;
5746 }
5747 
5748 static void
5749 set80211clone_wdslegacy(const char *val, int d, int s, const struct afswtch *rafp)
5750 {
5751 	if (d)
5752 		params.icp_flags |= IEEE80211_CLONE_WDSLEGACY;
5753 	else
5754 		params.icp_flags &= ~IEEE80211_CLONE_WDSLEGACY;
5755 }
5756 
5757 static struct cmd ieee80211_cmds[] = {
5758 	DEF_CMD_ARG("ssid",		set80211ssid),
5759 	DEF_CMD_ARG("nwid",		set80211ssid),
5760 	DEF_CMD_ARG("meshid",		set80211meshid),
5761 	DEF_CMD_ARG("stationname",	set80211stationname),
5762 	DEF_CMD_ARG("station",		set80211stationname),	/* BSD/OS */
5763 	DEF_CMD_ARG("channel",		set80211channel),
5764 	DEF_CMD_ARG("authmode",		set80211authmode),
5765 	DEF_CMD_ARG("powersavemode",	set80211powersavemode),
5766 	DEF_CMD("powersave",	1,	set80211powersave),
5767 	DEF_CMD("-powersave",	0,	set80211powersave),
5768 	DEF_CMD_ARG("powersavesleep", 	set80211powersavesleep),
5769 	DEF_CMD_ARG("wepmode",		set80211wepmode),
5770 	DEF_CMD("wep",		1,	set80211wep),
5771 	DEF_CMD("-wep",		0,	set80211wep),
5772 	DEF_CMD_ARG("deftxkey",		set80211weptxkey),
5773 	DEF_CMD_ARG("weptxkey",		set80211weptxkey),
5774 	DEF_CMD_ARG("wepkey",		set80211wepkey),
5775 	DEF_CMD_ARG("nwkey",		set80211nwkey),		/* NetBSD */
5776 	DEF_CMD("-nwkey",	0,	set80211wep),		/* NetBSD */
5777 	DEF_CMD_ARG("rtsthreshold",	set80211rtsthreshold),
5778 	DEF_CMD_ARG("protmode",		set80211protmode),
5779 	DEF_CMD_ARG("txpower",		set80211txpower),
5780 	DEF_CMD_ARG("roaming",		set80211roaming),
5781 	DEF_CMD("wme",		1,	set80211wme),
5782 	DEF_CMD("-wme",		0,	set80211wme),
5783 	DEF_CMD("wmm",		1,	set80211wme),
5784 	DEF_CMD("-wmm",		0,	set80211wme),
5785 	DEF_CMD("hidessid",	1,	set80211hidessid),
5786 	DEF_CMD("-hidessid",	0,	set80211hidessid),
5787 	DEF_CMD("apbridge",	1,	set80211apbridge),
5788 	DEF_CMD("-apbridge",	0,	set80211apbridge),
5789 	DEF_CMD_ARG("chanlist",		set80211chanlist),
5790 	DEF_CMD_ARG("bssid",		set80211bssid),
5791 	DEF_CMD_ARG("ap",		set80211bssid),
5792 	DEF_CMD("scan",	0,		set80211scan),
5793 	DEF_CMD_ARG("list",		set80211list),
5794 	DEF_CMD_ARG2("cwmin",		set80211cwmin),
5795 	DEF_CMD_ARG2("cwmax",		set80211cwmax),
5796 	DEF_CMD_ARG2("aifs",		set80211aifs),
5797 	DEF_CMD_ARG2("txoplimit",	set80211txoplimit),
5798 	DEF_CMD_ARG("acm",		set80211acm),
5799 	DEF_CMD_ARG("-acm",		set80211noacm),
5800 	DEF_CMD_ARG("ack",		set80211ackpolicy),
5801 	DEF_CMD_ARG("-ack",		set80211noackpolicy),
5802 	DEF_CMD_ARG2("bss:cwmin",	set80211bsscwmin),
5803 	DEF_CMD_ARG2("bss:cwmax",	set80211bsscwmax),
5804 	DEF_CMD_ARG2("bss:aifs",	set80211bssaifs),
5805 	DEF_CMD_ARG2("bss:txoplimit",	set80211bsstxoplimit),
5806 	DEF_CMD_ARG("dtimperiod",	set80211dtimperiod),
5807 	DEF_CMD_ARG("bintval",		set80211bintval),
5808 	DEF_CMD("mac:open",	IEEE80211_MACCMD_POLICY_OPEN,	set80211maccmd),
5809 	DEF_CMD("mac:allow",	IEEE80211_MACCMD_POLICY_ALLOW,	set80211maccmd),
5810 	DEF_CMD("mac:deny",	IEEE80211_MACCMD_POLICY_DENY,	set80211maccmd),
5811 	DEF_CMD("mac:radius",	IEEE80211_MACCMD_POLICY_RADIUS,	set80211maccmd),
5812 	DEF_CMD("mac:flush",	IEEE80211_MACCMD_FLUSH,		set80211maccmd),
5813 	DEF_CMD("mac:detach",	IEEE80211_MACCMD_DETACH,	set80211maccmd),
5814 	DEF_CMD_ARG("mac:add",		set80211addmac),
5815 	DEF_CMD_ARG("mac:del",		set80211delmac),
5816 	DEF_CMD_ARG("mac:kick",		set80211kickmac),
5817 	DEF_CMD("pureg",	1,	set80211pureg),
5818 	DEF_CMD("-pureg",	0,	set80211pureg),
5819 	DEF_CMD("ff",		1,	set80211fastframes),
5820 	DEF_CMD("-ff",		0,	set80211fastframes),
5821 	DEF_CMD("dturbo",	1,	set80211dturbo),
5822 	DEF_CMD("-dturbo",	0,	set80211dturbo),
5823 	DEF_CMD("bgscan",	1,	set80211bgscan),
5824 	DEF_CMD("-bgscan",	0,	set80211bgscan),
5825 	DEF_CMD_ARG("bgscanidle",	set80211bgscanidle),
5826 	DEF_CMD_ARG("bgscanintvl",	set80211bgscanintvl),
5827 	DEF_CMD_ARG("scanvalid",	set80211scanvalid),
5828 	DEF_CMD("quiet",	1,	set80211quiet),
5829 	DEF_CMD("-quiet",	0,	set80211quiet),
5830 	DEF_CMD_ARG("quiet_count",	set80211quietcount),
5831 	DEF_CMD_ARG("quiet_period",	set80211quietperiod),
5832 	DEF_CMD_ARG("quiet_duration",	set80211quietduration),
5833 	DEF_CMD_ARG("quiet_offset",	set80211quietoffset),
5834 	DEF_CMD_ARG("roam:rssi",	set80211roamrssi),
5835 	DEF_CMD_ARG("roam:rate",	set80211roamrate),
5836 	DEF_CMD_ARG("mcastrate",	set80211mcastrate),
5837 	DEF_CMD_ARG("ucastrate",	set80211ucastrate),
5838 	DEF_CMD_ARG("mgtrate",		set80211mgtrate),
5839 	DEF_CMD_ARG("mgmtrate",		set80211mgtrate),
5840 	DEF_CMD_ARG("maxretry",		set80211maxretry),
5841 	DEF_CMD_ARG("fragthreshold",	set80211fragthreshold),
5842 	DEF_CMD("burst",	1,	set80211burst),
5843 	DEF_CMD("-burst",	0,	set80211burst),
5844 	DEF_CMD_ARG("bmiss",		set80211bmissthreshold),
5845 	DEF_CMD_ARG("bmissthreshold",	set80211bmissthreshold),
5846 	DEF_CMD("shortgi",	1,	set80211shortgi),
5847 	DEF_CMD("-shortgi",	0,	set80211shortgi),
5848 	DEF_CMD("ampdurx",	2,	set80211ampdu),
5849 	DEF_CMD("-ampdurx",	-2,	set80211ampdu),
5850 	DEF_CMD("ampdutx",	1,	set80211ampdu),
5851 	DEF_CMD("-ampdutx",	-1,	set80211ampdu),
5852 	DEF_CMD("ampdu",	3,	set80211ampdu),		/* NB: tx+rx */
5853 	DEF_CMD("-ampdu",	-3,	set80211ampdu),
5854 	DEF_CMD_ARG("ampdulimit",	set80211ampdulimit),
5855 	DEF_CMD_ARG("ampdudensity",	set80211ampdudensity),
5856 	DEF_CMD("amsdurx",	2,	set80211amsdu),
5857 	DEF_CMD("-amsdurx",	-2,	set80211amsdu),
5858 	DEF_CMD("amsdutx",	1,	set80211amsdu),
5859 	DEF_CMD("-amsdutx",	-1,	set80211amsdu),
5860 	DEF_CMD("amsdu",	3,	set80211amsdu),		/* NB: tx+rx */
5861 	DEF_CMD("-amsdu",	-3,	set80211amsdu),
5862 	DEF_CMD_ARG("amsdulimit",	set80211amsdulimit),
5863 	DEF_CMD("stbcrx",	2,	set80211stbc),
5864 	DEF_CMD("-stbcrx",	-2,	set80211stbc),
5865 	DEF_CMD("stbctx",	1,	set80211stbc),
5866 	DEF_CMD("-stbctx",	-1,	set80211stbc),
5867 	DEF_CMD("stbc",		3,	set80211stbc),		/* NB: tx+rx */
5868 	DEF_CMD("-stbc",	-3,	set80211stbc),
5869 	DEF_CMD("ldpcrx",	2,	set80211ldpc),
5870 	DEF_CMD("-ldpcrx",	-2,	set80211ldpc),
5871 	DEF_CMD("ldpctx",	1,	set80211ldpc),
5872 	DEF_CMD("-ldpctx",	-1,	set80211ldpc),
5873 	DEF_CMD("ldpc",		3,	set80211ldpc),		/* NB: tx+rx */
5874 	DEF_CMD("-ldpc",	-3,	set80211ldpc),
5875 	DEF_CMD("puren",	1,	set80211puren),
5876 	DEF_CMD("-puren",	0,	set80211puren),
5877 	DEF_CMD("doth",		1,	set80211doth),
5878 	DEF_CMD("-doth",	0,	set80211doth),
5879 	DEF_CMD("dfs",		1,	set80211dfs),
5880 	DEF_CMD("-dfs",		0,	set80211dfs),
5881 	DEF_CMD("htcompat",	1,	set80211htcompat),
5882 	DEF_CMD("-htcompat",	0,	set80211htcompat),
5883 	DEF_CMD("dwds",		1,	set80211dwds),
5884 	DEF_CMD("-dwds",	0,	set80211dwds),
5885 	DEF_CMD("inact",	1,	set80211inact),
5886 	DEF_CMD("-inact",	0,	set80211inact),
5887 	DEF_CMD("tsn",		1,	set80211tsn),
5888 	DEF_CMD("-tsn",		0,	set80211tsn),
5889 	DEF_CMD_ARG("regdomain",	set80211regdomain),
5890 	DEF_CMD_ARG("country",		set80211country),
5891 	DEF_CMD("indoor",	'I',	set80211location),
5892 	DEF_CMD("-indoor",	'O',	set80211location),
5893 	DEF_CMD("outdoor",	'O',	set80211location),
5894 	DEF_CMD("-outdoor",	'I',	set80211location),
5895 	DEF_CMD("anywhere",	' ',	set80211location),
5896 	DEF_CMD("ecm",		1,	set80211ecm),
5897 	DEF_CMD("-ecm",		0,	set80211ecm),
5898 	DEF_CMD("dotd",		1,	set80211dotd),
5899 	DEF_CMD("-dotd",	0,	set80211dotd),
5900 	DEF_CMD_ARG("htprotmode",	set80211htprotmode),
5901 	DEF_CMD("ht20",		1,	set80211htconf),
5902 	DEF_CMD("-ht20",	0,	set80211htconf),
5903 	DEF_CMD("ht40",		3,	set80211htconf),	/* NB: 20+40 */
5904 	DEF_CMD("-ht40",	0,	set80211htconf),
5905 	DEF_CMD("ht",		3,	set80211htconf),	/* NB: 20+40 */
5906 	DEF_CMD("-ht",		0,	set80211htconf),
5907 	DEF_CMD("vht",		1,	set80211vhtconf),
5908 	DEF_CMD("-vht",		0,	set80211vhtconf),
5909 	DEF_CMD("vht40",		2,	set80211vhtconf),
5910 	DEF_CMD("-vht40",		-2,	set80211vhtconf),
5911 	DEF_CMD("vht80",		4,	set80211vhtconf),
5912 	DEF_CMD("-vht80",		-4,	set80211vhtconf),
5913 	DEF_CMD("vht80p80",		8,	set80211vhtconf),
5914 	DEF_CMD("-vht80p80",		-8,	set80211vhtconf),
5915 	DEF_CMD("vht160",		16,	set80211vhtconf),
5916 	DEF_CMD("-vht160",		-16,	set80211vhtconf),
5917 	DEF_CMD("rifs",		1,	set80211rifs),
5918 	DEF_CMD("-rifs",	0,	set80211rifs),
5919 	DEF_CMD("smps",		IEEE80211_HTCAP_SMPS_ENA,	set80211smps),
5920 	DEF_CMD("smpsdyn",	IEEE80211_HTCAP_SMPS_DYNAMIC,	set80211smps),
5921 	DEF_CMD("-smps",	IEEE80211_HTCAP_SMPS_OFF,	set80211smps),
5922 	/* XXX for testing */
5923 	DEF_CMD_ARG("chanswitch",	set80211chanswitch),
5924 
5925 	DEF_CMD_ARG("tdmaslot",		set80211tdmaslot),
5926 	DEF_CMD_ARG("tdmaslotcnt",	set80211tdmaslotcnt),
5927 	DEF_CMD_ARG("tdmaslotlen",	set80211tdmaslotlen),
5928 	DEF_CMD_ARG("tdmabintval",	set80211tdmabintval),
5929 
5930 	DEF_CMD_ARG("meshttl",		set80211meshttl),
5931 	DEF_CMD("meshforward",	1,	set80211meshforward),
5932 	DEF_CMD("-meshforward",	0,	set80211meshforward),
5933 	DEF_CMD("meshgate",	1,	set80211meshgate),
5934 	DEF_CMD("-meshgate",	0,	set80211meshgate),
5935 	DEF_CMD("meshpeering",	1,	set80211meshpeering),
5936 	DEF_CMD("-meshpeering",	0,	set80211meshpeering),
5937 	DEF_CMD_ARG("meshmetric",	set80211meshmetric),
5938 	DEF_CMD_ARG("meshpath",		set80211meshpath),
5939 	DEF_CMD("meshrt:flush",	IEEE80211_MESH_RTCMD_FLUSH,	set80211meshrtcmd),
5940 	DEF_CMD_ARG("meshrt:add",	set80211addmeshrt),
5941 	DEF_CMD_ARG("meshrt:del",	set80211delmeshrt),
5942 	DEF_CMD_ARG("hwmprootmode",	set80211hwmprootmode),
5943 	DEF_CMD_ARG("hwmpmaxhops",	set80211hwmpmaxhops),
5944 
5945 	/* vap cloning support */
5946 	DEF_CLONE_CMD_ARG("wlanaddr",	set80211clone_wlanaddr),
5947 	DEF_CLONE_CMD_ARG("wlanbssid",	set80211clone_wlanbssid),
5948 	DEF_CLONE_CMD_ARG("wlandev",	set80211clone_wlandev),
5949 	DEF_CLONE_CMD_ARG("wlanmode",	set80211clone_wlanmode),
5950 	DEF_CLONE_CMD("beacons", 1,	set80211clone_beacons),
5951 	DEF_CLONE_CMD("-beacons", 0,	set80211clone_beacons),
5952 	DEF_CLONE_CMD("bssid",	1,	set80211clone_bssid),
5953 	DEF_CLONE_CMD("-bssid",	0,	set80211clone_bssid),
5954 	DEF_CLONE_CMD("wdslegacy", 1,	set80211clone_wdslegacy),
5955 	DEF_CLONE_CMD("-wdslegacy", 0,	set80211clone_wdslegacy),
5956 };
5957 static struct afswtch af_ieee80211 = {
5958 	.af_name	= "af_ieee80211",
5959 	.af_af		= AF_UNSPEC,
5960 	.af_other_status = ieee80211_status,
5961 };
5962 
5963 static __constructor void
5964 ieee80211_ctor(void)
5965 {
5966 	int i;
5967 
5968 	for (i = 0; i < nitems(ieee80211_cmds);  i++)
5969 		cmd_register(&ieee80211_cmds[i]);
5970 	af_register(&af_ieee80211);
5971 	clone_setdefcallback("wlan", wlan_create);
5972 }
5973