From 6f966d80c1a7361124f44d796e04362ba0a53570 Mon Sep 17 00:00:00 2001
From: Damien Bergamini <damien@cvs.openbsd.org>
Date: Sun, 22 Oct 2006 12:27:57 +0000
Subject: make sure ni->ni_txrate is always initialized to a meaningful value
 by redefining ic->ic_newassoc. this should prevent "bogus xmit rate" panics
 when operating in HostAP mode.

---
 sys/dev/usb/if_ral.c | 24 +++++++++++++++++++-----
 sys/dev/usb/if_rum.c | 28 ++++++++++++++++++----------
 2 files changed, 37 insertions(+), 15 deletions(-)

(limited to 'sys/dev/usb')

diff --git a/sys/dev/usb/if_ral.c b/sys/dev/usb/if_ral.c
index 2cba8840604..59f013ae06d 100644
--- a/sys/dev/usb/if_ral.c
+++ b/sys/dev/usb/if_ral.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ral.c,v 1.80 2006/09/18 16:20:20 damien Exp $	*/
+/*	$OpenBSD: if_ral.c,v 1.81 2006/10/22 12:27:56 damien Exp $	*/
 
 /*-
  * Copyright (c) 2005, 2006
@@ -165,6 +165,8 @@ Static void		ural_set_txantenna(struct ural_softc *, int);
 Static void		ural_set_rxantenna(struct ural_softc *, int);
 Static int		ural_init(struct ifnet *);
 Static void		ural_stop(struct ifnet *, int);
+Static void		ural_newassoc(struct ieee80211com *,
+			    struct ieee80211_node *, int);
 Static void		ural_amrr_start(struct ural_softc *,
 			    struct ieee80211_node *);
 Static void		ural_amrr_timeout(void *);
@@ -362,6 +364,7 @@ USB_ATTACH(ural)
 
 	if_attach(ifp);
 	ieee80211_ifattach(ifp);
+	ic->ic_newassoc = ural_newassoc;
 
 	/* override state transition machine */
 	sc->sc_newstate = ic->ic_newstate;
@@ -662,10 +665,14 @@ ural_task(void *arg)
 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
 			ural_enable_tsf_sync(sc);
 
-		/* enable automatic rate adaptation in STA mode */
-		if (ic->ic_opmode == IEEE80211_M_STA &&
-		    ic->ic_fixed_rate == -1)
-			ural_amrr_start(sc, ic->ic_bss);
+		if (ic->ic_opmode == IEEE80211_M_STA) {
+			/* fake a join to init the tx rate */
+			ural_newassoc(ic, ic->ic_bss, 1);
+
+			/* enable automatic rate control in STA mode */
+			if (ic->ic_fixed_rate == -1)
+				ural_amrr_start(sc, ic->ic_bss);
+		}
 
 		break;
 	}
@@ -2091,6 +2098,13 @@ ural_stop(struct ifnet *ifp, int disable)
 	ural_free_tx_list(sc);
 }
 
+Static void
+ural_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
+{
+	/* start with lowest Tx rate */
+	ni->ni_txrate = 0;
+}
+
 Static void
 ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
 {
diff --git a/sys/dev/usb/if_rum.c b/sys/dev/usb/if_rum.c
index 4de38f80340..b2e294ab8a9 100644
--- a/sys/dev/usb/if_rum.c
+++ b/sys/dev/usb/if_rum.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_rum.c,v 1.41 2006/10/19 16:53:48 jsg Exp $	*/
+/*	$OpenBSD: if_rum.c,v 1.42 2006/10/22 12:27:56 damien Exp $	*/
 
 /*-
  * Copyright (c) 2005, 2006 Damien Bergamini <damien.bergamini@free.fr>
@@ -169,6 +169,8 @@ Static void		rum_stop(struct ifnet *, int);
 Static int		rum_load_microcode(struct rum_softc *, const u_char *,
 			    size_t);
 Static int		rum_prepare_beacon(struct rum_softc *);
+Static void		rum_newassoc(struct ieee80211com *,
+			    struct ieee80211_node *, int);
 Static void		rum_amrr_start(struct rum_softc *,
 			    struct ieee80211_node *);
 Static void		rum_amrr_timeout(void *);
@@ -402,6 +404,7 @@ USB_ATTACH(rum)
 
 	if_attach(ifp);
 	ieee80211_ifattach(ifp);
+	ic->ic_newassoc = rum_newassoc;
 
 	/* override state transition machine */
 	sc->sc_newstate = ic->ic_newstate;
@@ -685,11 +688,14 @@ rum_task(void *arg)
 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
 			rum_enable_tsf_sync(sc);
 
-		/* enable automatic rate adaptation in STA mode */
-		if (ic->ic_opmode == IEEE80211_M_STA &&
-		    ic->ic_fixed_rate == -1)
-			rum_amrr_start(sc, ni);
+		if (ic->ic_opmode == IEEE80211_M_STA) {
+			/* fake a join to init the tx rate */
+			rum_newassoc(ic, ic->ic_bss, 1);
 
+			/* enable automatic rate control in STA mode */
+			if (ic->ic_fixed_rate == -1)
+				rum_amrr_start(sc, ni);
+		}
 		break;
 	}
 
@@ -2101,6 +2107,13 @@ rum_prepare_beacon(struct rum_softc *sc)
 	return 0;
 }
 
+Static void
+rum_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
+{
+	/* start with lowest Tx rate */
+	ni->ni_txrate = 0;
+}
+
 Static void
 rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
 {
@@ -2125,9 +2138,6 @@ rum_amrr_timeout(void *arg)
 {
 	struct rum_softc *sc = arg;
 	usb_device_request_t req;
-	int s;
-
-	s = splusb();
 
 	/*
 	 * Asynchronously read statistic registers (cleared by read).
@@ -2142,8 +2152,6 @@ rum_amrr_timeout(void *arg)
 	    USBD_DEFAULT_TIMEOUT, &req, sc->sta, sizeof sc->sta, 0,
 	    rum_amrr_update);
 	(void)usbd_transfer(sc->amrr_xfer);
-
-	splx(s);
 }
 
 Static void
-- 
cgit v1.2.3