From: Stefan Sperling <stsp@stsp.name>
Subject: qwx vdev start command fix
To: tech@openbsd.org
Date: Thu, 24 Jul 2025 14:54:01 +0200

If ic->ic_curmode is not set to a mode which suite the channel our AP is on,
the driver generates an invalid firmware command and the firmware will signal
a fatal error. For example, if the current AP is on 5 GHz but ic_curmode is
set to mode 11G, we will trigger a fatal firmware error.

This problem never happens with in-tree code, but it will start happening
once roaming support is added to qwx.

Fix below.

ok?

diff /usr/src
path + /usr/src
commit - 4995bfa49b0aa3de3992e0d9a7faf4efb0942e4b
blob - cf5a90c95a4be03f57030a23d6b9d3ef0e804a2c
file + sys/dev/ic/qwx.c
--- sys/dev/ic/qwx.c
+++ sys/dev/ic/qwx.c
@@ -23002,21 +23002,13 @@ qwx_mac_vdev_start_restart(struct qwx_softc *sc, struc
 	arg.channel.band_center_freq1 = chan->ic_freq;
 	arg.channel.band_center_freq2 = chan->ic_freq;
 
-	switch (ic->ic_curmode) {
-	case IEEE80211_MODE_11A:
+	/* Deduce a legacy mode based on the channel characteristics. */
+	if (IEEE80211_IS_CHAN_5GHZ(chan))
 		arg.channel.mode = MODE_11A;
-		break;
-	case IEEE80211_MODE_11B:
-		arg.channel.mode = MODE_11B;
-		break;
-	case IEEE80211_MODE_11G:
+	else if (ieee80211_iserp_sta(ic->ic_bss))
 		arg.channel.mode = MODE_11G;
-		break;
-	default:
-		printf("%s: unsupported phy mode %d\n",
-		    sc->sc_dev.dv_xname, ic->ic_curmode);
-		return ENOTSUP;
-	}
+	else
+		arg.channel.mode = MODE_11B;
 
 	arg.channel.min_power = 0;
 	arg.channel.max_power = 20; /* XXX */
commit - 4995bfa49b0aa3de3992e0d9a7faf4efb0942e4b
blob - eed65d09e51ef0c8a5872ec98c4674cf8fdde220
file + sys/net80211/ieee80211_node.c
--- sys/net80211/ieee80211_node.c
+++ sys/net80211/ieee80211_node.c
@@ -2684,9 +2684,8 @@ ieee80211_node_addba_request_ac_vo_to(void *arg)
 	ieee80211_node_addba_request(ni, EDCA_AC_VO);
 }
 
-#ifndef IEEE80211_STA_ONLY
 /*
- * Check if the specified node supports ERP.
+ * Check if the specified node supports ERP / 802.11g.
  */
 int
 ieee80211_iserp_sta(const struct ieee80211_node *ni)
@@ -2710,6 +2709,7 @@ ieee80211_iserp_sta(const struct ieee80211_node *ni)
 	return 1;
 }
 
+#ifndef IEEE80211_STA_ONLY
 /*
  * This function is called to notify the 802.1X PACP machine that a new
  * 802.1X port is enabled and must be authenticated. For 802.11, a port