Download raw body.
urtwn: power the RTL8188CU/8192CU off in urtwn_stop()
Hi.
Below diff was tested together with fw-cmd fix from thread:
https://marc.info/?t=179243536000002&r=1&w=2
Together those diffs make my urtwn(4) very reliable. For my hardware it
is a day and night difference. I cannot break it. There are still many
things to be backported or borrowed from FreeBSD, however.
urtwn0 at uhub0 port 4 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 3
urtwn0: poweroff fix v1 (2026-10-27) applied
urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 00:13:ef:40:51:2a
I have more bugs discovered and exposed by testing which I did on my
urtwn(4) card with athn(4) access point, but that is for another time.
I would appreciated review of both diffs.
Those diffs were heavily assisted by Claude.
urtwn: power the RTL8188CU/8192CU off in urtwn_stop()
urtwn_stop() only aborted the USB transfers and left the chip
running, so every later init (ENETRESET, ifconfig down/up, the Tx
watchdog) reprogrammed a live chip: no BB/RF reset, MAC Tx queues
and page accounting kept stale state, firmware reloaded into a
running 8051. Under Tx load the device could wedge with "device
timeout", and the watchdog's reinit did not recover it; only a
replug did.
Power the chip off on stop, ported from FreeBSD
urtwn_r92c_power_off() (6e2ab416930, R92C path mostly from NetBSD),
so each init starts from the same state as after a replug. Bring
back the APSD_CTRL "Initialize MAC" step in urtwn_r92c_power_on(),
removed in r1.85 when nothing turned the MAC off; FreeBSD still has
it. RTL8188E/8188F/8192E are left alone.
Tested on RTL8188CUS with an athn(4) hostap AP.
Index: sys/dev/ic/r92creg.h
===================================================================
RCS file: /cvs/src/sys/dev/ic/r92creg.h,v
diff -u -p -r1.31 r92creg.h
--- sys/dev/ic/r92creg.h 1 Sep 2024 03:14:48 -0000 1.31
+++ sys/dev/ic/r92creg.h 29 Oct 2026 19:52:32 -0000
@@ -52,6 +52,7 @@
#define R92C_GPIO_IO_SEL 0x042
#define R92C_MAC_PINMUX_CFG 0x043
#define R92C_GPIO_PIN_CTRL 0x044
+#define R92C_GPIO_IOSEL 0x046
#define R92C_GPIO_INTM 0x048
#define R92C_LEDCFG0 0x04c
#define R92C_LEDCFG1 0x04d
@@ -346,6 +347,12 @@
#define R92C_RF_CTRL_EN 0x01
#define R92C_RF_CTRL_RSTB 0x02
#define R92C_RF_CTRL_SDMRSTB 0x04
+
+/* Bits for R92C_LDOA15_CTRL. */
+#define R92C_LDOA15_CTRL_EN 0x01
+#define R92C_LDOA15_CTRL_STBY 0x02
+#define R92C_LDOA15_CTRL_OBUF 0x04
+#define R92C_LDOA15_CTRL_REG_VOS 0x08
/* Bits for R92C_LDOV12D_CTRL. */
#define R92C_LDOV12D_CTRL_LDV12_EN 0x01
Index: sys/dev/ic/rtwnvar.h
===================================================================
RCS file: /cvs/src/sys/dev/ic/rtwnvar.h,v
diff -u -p -r1.16 rtwnvar.h
--- sys/dev/ic/rtwnvar.h 28 Apr 2023 01:24:14 -0000 1.16
+++ sys/dev/ic/rtwnvar.h 29 Oct 2026 19:52:32 -0000
@@ -135,3 +135,4 @@ void rtwn_delete_key(struct ieee80211co
int rtwn_ioctl(struct ifnet *, u_long, caddr_t);
void rtwn_start(struct ifnet *);
void rtwn_fw_reset(struct rtwn_softc *);
+void rtwn_rf_write(struct rtwn_softc *, int, uint16_t, uint32_t);
Index: sys/dev/usb/if_urtwn.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/if_urtwn.c,v
diff -u -p -r1.114 if_urtwn.c
--- sys/dev/usb/if_urtwn.c 18 Jun 2025 13:48:23 -0000 1.114
+++ sys/dev/usb/if_urtwn.c 29 Oct 2026 19:52:32 -0000
@@ -399,6 +399,7 @@ int urtwn_ioctl(struct ifnet *, u_long,
int urtwn_power_on(void *);
int urtwn_alloc_buffers(void *);
int urtwn_r92c_power_on(struct urtwn_softc *);
+void urtwn_r92c_power_off(struct urtwn_softc *);
int urtwn_r92e_power_on(struct urtwn_softc *);
int urtwn_r88e_power_on(struct urtwn_softc *);
int urtwn_r88f_power_on(struct urtwn_softc *);
@@ -452,6 +453,9 @@ urtwn_attach(struct device *parent, stru
sc->sc_iface = uaa->iface;
sc->sc_sc.chip = urtwn_lookup(uaa->vendor, uaa->product)->chip;
+ /* POWEROFF TEST: banner, remove before commit. */
+ printf("%s: poweroff fix v1 (2026-10-27) applied\n",
+ sc->sc_dev.dv_xname);
usb_init_task(&sc->sc_task, urtwn_task, sc, USB_TASK_TYPE_GENERIC);
timeout_set(&sc->scan_to, urtwn_scan_to, sc);
@@ -1822,6 +1826,21 @@ urtwn_r92c_power_on(struct urtwn_softc *
urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
+ /* Initialize MAC (urtwn_r92c_power_off() turns it off). */
+ urtwn_write_1(sc, R92C_APSD_CTRL,
+ urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
+ for (ntries = 0; ntries < 1000; ntries++) {
+ if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
+ R92C_APSD_CTRL_OFF_STATUS))
+ break;
+ DELAY(50);
+ }
+ if (ntries == 1000) {
+ printf("%s: timeout waiting for MAC initialization\n",
+ sc->sc_dev.dv_xname);
+ return (ETIMEDOUT);
+ }
+
/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
reg = urtwn_read_2(sc, R92C_CR);
reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
@@ -2592,6 +2611,118 @@ urtwn_stop(void *cookie)
/* Free Tx/Rx buffers. */
urtwn_free_tx_list(sc);
urtwn_free_rx_list(sc);
+
+ /*
+ * Power the chip off, so that the next init starts from the same
+ * state as after a replug. A warm init does not reset the BB, RF,
+ * MAC Tx queues or 8051.
+ */
+ if (!usbd_is_dying(sc->sc_udev) &&
+ !(sc->sc_sc.chip & (RTWN_CHIP_88E | RTWN_CHIP_88F | RTWN_CHIP_92E)))
+ urtwn_r92c_power_off(sc);
+}
+
+/*
+ * From FreeBSD urtwn_r92c_power_off(), commit 6e2ab416930 "urtwn: shutdown
+ * the device properly" (D5198; R92C path mostly from NetBSD).
+ */
+void
+urtwn_r92c_power_off(struct urtwn_softc *sc)
+{
+ uint32_t reg;
+
+ /* Block all Tx queues. */
+ urtwn_write_1(sc, R92C_TXPAUSE, R92C_TXPAUSE_ALL);
+
+ /* Disable RF. */
+ rtwn_rf_write(&sc->sc_sc, 0, 0, 0);
+
+ urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
+
+ /* Reset BB state machine. */
+ urtwn_write_1(sc, R92C_SYS_FUNC_EN,
+ R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA |
+ R92C_SYS_FUNC_EN_BB_GLB_RST);
+ urtwn_write_1(sc, R92C_SYS_FUNC_EN,
+ R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
+
+ /* Reset digital sequence. */
+ if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
+ /* Reset MCU ready status. */
+ urtwn_write_1(sc, R92C_MCUFWDL, 0);
+ /* If firmware in ram code, do reset. */
+ rtwn_fw_reset(&sc->sc_sc);
+ }
+
+ /* Reset MAC and enable 8051. */
+ urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1,
+ (R92C_SYS_FUNC_EN_CPUEN | R92C_SYS_FUNC_EN_ELDR |
+ R92C_SYS_FUNC_EN_HWPDN) >> 8);
+
+ /* Reset MCU ready status. */
+ urtwn_write_1(sc, R92C_MCUFWDL, 0);
+
+ /* Disable MAC clock. */
+ urtwn_write_2(sc, R92C_SYS_CLKR,
+ R92C_SYS_CLKR_ANAD16V_EN | R92C_SYS_CLKR_ANA8M |
+ R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_80M_SSC_DIS |
+ R92C_SYS_CLKR_SYS_EN | R92C_SYS_CLKR_RING_EN | 0x4000);
+
+ /* Disable AFE PLL. */
+ urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80);
+
+ /* Gated AFE DIG_CLOCK. */
+ urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880f);
+
+ /* Isolated digital to PON. */
+ urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
+ R92C_SYS_ISO_CTRL_MD2PP | R92C_SYS_ISO_CTRL_PA2PCIE |
+ R92C_SYS_ISO_CTRL_PD2CORE | R92C_SYS_ISO_CTRL_IP2MAC |
+ R92C_SYS_ISO_CTRL_DIOP | R92C_SYS_ISO_CTRL_DIOE);
+
+ /* Pull GPIO pins to balance level and LED control. */
+ /* 1. Disable GPIO[7:0]. */
+ urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000);
+ reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00;
+ reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000;
+ urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg);
+
+ /* 2. Disable GPIO[10:8]. */
+ urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00);
+ reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0;
+ reg |= (((reg & 0x000f) << 4) | 0x0780);
+ urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg);
+
+ /* 3. Disable LED0 & 1. */
+ urtwn_write_2(sc, R92C_LEDCFG0, 0x8080);
+
+ /* Reset digital sequence: disable ELDR clock. */
+ urtwn_write_2(sc, R92C_SYS_CLKR,
+ R92C_SYS_CLKR_ANAD16V_EN | R92C_SYS_CLKR_ANA8M |
+ R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_80M_SSC_DIS |
+ R92C_SYS_CLKR_SYS_EN | R92C_SYS_CLKR_RING_EN | 0x4000);
+
+ /* Isolated ELDR to PON. */
+ urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1,
+ (R92C_SYS_ISO_CTRL_DIOR | R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8);
+
+ /* Disable analog sequence: disable A15 power. */
+ urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF);
+ /* Disable digital core power. */
+ urtwn_write_1(sc, R92C_LDOV12D_CTRL,
+ urtwn_read_1(sc, R92C_LDOV12D_CTRL) &
+ ~R92C_LDOV12D_CTRL_LDV12_EN);
+
+ /* Enter PFM mode. */
+ urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
+
+ /* Set USB suspend. */
+ urtwn_write_2(sc, R92C_APS_FSMCO,
+ R92C_APS_FSMCO_APDM_HOST | R92C_APS_FSMCO_AFSM_HSUS |
+ R92C_APS_FSMCO_PFM_ALDN);
+
+ /* Lock ISO/CLK/Power control register. */
+ urtwn_write_1(sc, R92C_RSV_CTRL, 0x0e);
}
int
--
Regards,
Mikolaj
urtwn: power the RTL8188CU/8192CU off in urtwn_stop()