From: Jason McIntyre Subject: Re: urtwn(4) firmware commands, what should get vs. what is written To: tech@openbsd.org Date: Tue, 20 Oct 2026 07:10:06 +0100 On Mon, Oct 19, 2026 at 06:42:38PM +0000, Mikolaj Kucharski wrote: > Hi. > > I'm trying to figure out issues with urtwn(4) stalls and timeouts. I am > getting huge help from Claude. > hi. i am also using a similar device for internet (unfortunately): urtwn0 at uhub0 port 2 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 2 urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 80:1f:02:f1:fe:ed urtwn0: device timeout urtwn0 detached urtwn0 at uhub0 port 2 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 2 urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 80:1f:02:f1:fe:ed i also have these timeouts - they happen always just after cold boot. if i remove the device then reinsert it, it continues on its merry way. no more timeouts. but it did use to work without timeouts, so at some point i think a change introduced them. i could never figure out where/when. because the speed of these devices is so awful, i've raked around for better usb ifs, but not found one. because of that, i know that using speedtest-cli i get reported speeds of about 8Mbit/s (a kingdom for my iwx!). using your diff that speed seems to have effectively doubled to about 15-18. jmc OpenBSD 8.0-current (GENERIC.MP) #82: Tue Oct 20 06:49:09 BST 2026 jmc@lima.kerhand.co.uk:/usr/src/sys/arch/arm64/compile/GENERIC.MP real mem = 33760067584 (32196MB) avail mem = 32576126976 (31067MB) random: good seed from bootblocks mainbus0 at root: ASUS Zenbook A14 (UX3407QA) psci0 at mainbus0: PSCI 1.1, SMCCC 1.3, SYSTEM_SUSPEND efi0 at mainbus0: UEFI 2.9 efi0: INSYDE Corp. rev 0x0 smbios0 at efi0: SMBIOS 3.6.0 smbios0: vendor Insyde version "UX3407QA.315" date 03/26/2026 smbios0: ASUSTeK COMPUTER INC. ASUS Zenbook A14 UX3407QA_UX3407QA cpu0 at mainbus0 mpidr 0: Qualcomm Oryon r2p1 cpu0: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu0: 12288KB 64b/line 12-way L2 cache cpu0: RNDR,TLBIOS+IRANGE,TS+AXFLAG,FHM,DP,SM4,SM3,SHA3,RDM,Atomic,CRC32,SHA2+SHA512,SHA1,AES+PMULL,I8MM,BF16,SPECRES,SB,FRINTTS,GPA,LRCPC+LDAPUR,FCMA,JSCVT,APA+EPAC2+FPAC+COMBINED,DPB+DCCVADP,CLRBHB,RPRES,ECV+CNTHCTL,ASID16,AFP,SpecSEI,PAN+ATS1E1+EPAN,LO,HPDS,VH,IDS,AT,CSV3,CSV2,DIT,AMUv1p1,RASv1p1,AdvSIMD+HP,FP+HP,BT,SSBS+MSR cpu1 at mainbus0 mpidr 100: Qualcomm Oryon r2p1 cpu1: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu1: 12288KB 64b/line 12-way L2 cache cpu2 at mainbus0 mpidr 200: Qualcomm Oryon r2p1 cpu2: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu2: 12288KB 64b/line 12-way L2 cache cpu3 at mainbus0 mpidr 300: Qualcomm Oryon r2p1 cpu3: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu3: 12288KB 64b/line 12-way L2 cache cpu4 at mainbus0 mpidr 10000: Qualcomm Oryon r1p1 cpu4: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu4: 12288KB 64b/line 12-way L2 cache cpu5 at mainbus0 mpidr 10100: Qualcomm Oryon r1p1 cpu5: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu5: 12288KB 64b/line 12-way L2 cache cpu6 at mainbus0 mpidr 10200: Qualcomm Oryon r1p1 cpu6: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu6: 12288KB 64b/line 12-way L2 cache cpu7 at mainbus0 mpidr 10300: Qualcomm Oryon r1p1 cpu7: 192KB 64b/line 6-way L1 PIPT I-cache, 96KB 64b/line 6-way L1 D-cache cpu7: 12288KB 64b/line 12-way L2 cache qcscm0 at mainbus0 scmi0 at mainbus0 "gunyah-hyp" at mainbus0 not configured "hyp-elf-package" at mainbus0 not configured "ncc" at mainbus0 not configured "cpucp-log" at mainbus0 not configured "cpucp" at mainbus0 not configured "reserved-region" at mainbus0 not configured "tags-region" at mainbus0 not configured "xbl-dtlog" at mainbus0 not configured "xbl-ramdump" at mainbus0 not configured "aop-image" at mainbus0 not configured "aop-cmd-db" at mainbus0 not configured "aop-config" at mainbus0 not configured "tme-crash-dump" at mainbus0 not configured "tme-log" at mainbus0 not configured "uefi-log" at mainbus0 not configured "secdata-apss" at mainbus0 not configured "pdp-ns-shared" at mainbus0 not configured "gpu-prr" at mainbus0 not configured "tpm-control" at mainbus0 not configured "usb-ucsi-shared" at mainbus0 not configured "pld-pep" at mainbus0 not configured "pld-gmu" at mainbus0 not configured "pld-pdp" at mainbus0 not configured "tz-stat" at mainbus0 not configured "xbl-tmp-buffer" at mainbus0 not configured "adsp-rpc-remote-heap" at mainbus0 not configured "spu-secure-shared-memory" at mainbus0 not configured "adsp-boot-dtb" at mainbus0 not configured "spss-region" at mainbus0 not configured "adsp-boot" at mainbus0 not configured "video" at mainbus0 not configured "adspslpi" at mainbus0 not configured "q6-adsp-dtb" at mainbus0 not configured "cdsp" at mainbus0 not configured "q6-cdsp-dtb" at mainbus0 not configured "gpu-microcode" at mainbus0 not configured "cvp" at mainbus0 not configured "camera" at mainbus0 not configured "av1-encoder" at mainbus0 not configured "reserved-region" at mainbus0 not configured "wpss" at mainbus0 not configured "q6-wpss-dtb" at mainbus0 not configured "xbl-sc" at mainbus0 not configured "reserved-region" at mainbus0 not configured "qtee" at mainbus0 not configured "ta" at mainbus0 not configured "tags" at mainbus0 not configured "llcc-lpi" at mainbus0 not configured qcsmem0 at mainbus0 "linux,cma" at mainbus0 not configured apm0 at mainbus0 "clocks" at mainbus0 not configured "dummy-sink" at mainbus0 not configured "firmware" at mainbus0 not configured "interconnect-0" at mainbus0 not configured "interconnect-1" at mainbus0 not configured "pmu" at mainbus0 not configured "opp-table-qup100mhz" at mainbus0 not configured "opp-table-qup120mhz" at mainbus0 not configured qcsmptp0 at mainbus0 qcsmptp1 at mainbus0 simplebus0 at mainbus0: "soc" qcmtx0 at simplebus0 syscon0 at simplebus0: "clock-controller" qcgpio0 at simplebus0 agintc0 at simplebus0 shift 4:4 nirq 1024 nredist 12 ipi 0: "interrupt-controller" agintcmsi0 at agintc0 "clock-controller" at simplebus0 not configured qcipcc0 at simplebus0 simplebus1 at simplebus0: "geniqup" qcuart0 at simplebus1 simplebus2 at simplebus0: "geniqup" qciic0 at simplebus2 iic0 at qciic0 ihidev0 at iic0 addr 0x15 irq, vendor 0xb05 product 0x220, hid-over-i2c ihidev0: 90 report ids ikbd0 at ihidev0 reportid 2: 8 variable keys, 6 key codes wskbd0 at ikbd0: console keyboard icc0 at ihidev0 reportid 3: 573 usages, 20 keys, array wskbd1 at icc0 mux 1 iasuskbd0 at ihidev0 reportid 90 wskbd2 at iasuskbd0 mux 1 "serial" at simplebus2 not configured simplebus3 at simplebus0: "geniqup" qciic1 at simplebus3 iic1 at qciic1 ihidev1 at iic1 addr 0x15 irq, vendor 0x4f3 product 0x3315, hid-over-i2c ihidev1: 84 report ids imt0 at ihidev1: clickpad, 5 contacts wsmouse0 at imt0 mux 0 ims0 at ihidev1 reportid 1: 2 buttons, Z and W dir wsmouse1 at ims0 mux 0 hid at ihidev1 reportid 5 not configured hid at ihidev1 reportid 6 not configured hid at ihidev1 reportid 7 not configured hid at ihidev1 reportid 11 not configured hid at ihidev1 reportid 12 not configured hid at ihidev1 reportid 13 not configured ims1 at ihidev1 reportid 14: 0 buttons wsmouse2 at ims1 mux 0 qciic2 at simplebus3 iic2 at qciic2 "parade,ps8833" at iic2 addr 0x8 not configured qciic3 at simplebus3 iic3 at qciic3 ihidev2 at iic3 addr 0x17, failed fetching initial HID descriptor qciic4 at simplebus3 iic4 at qciic4 "nxp,ptn3222" at iic4 addr 0x4f not configured qciic5 at simplebus3 iic5 at qciic5 "parade,ps8833" at iic5 addr 0x8 not configured qctsens0 at simplebus0 qctsens1 at simplebus0 qctsens2 at simplebus0 "phy" at simplebus0 not configured "phy" at simplebus0 not configured "phy" at simplebus0 not configured "phy" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured dwpcie0 at simplebus0 "phy" at simplebus0 not configured dwpcie1 at simplebus0 "phy" at simplebus0 not configured "crypto" at simplebus0 not configured "gmu" at simplebus0 not configured "clock-controller" at simplebus0 not configured smmu0 at simplebus0: disabled "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured qcpas0 at simplebus0 "codec" at simplebus0 not configured "codec" at simplebus0 not configured "soundwire" at simplebus0 not configured "codec" at simplebus0 not configured "codec" at simplebus0 not configured "soundwire" at simplebus0 not configured "clock-controller" at simplebus0 not configured "soundwire" at simplebus0 not configured "codec" at simplebus0 not configured "pinctrl" at simplebus0 not configured "clock-controller" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "interconnect" at simplebus0 not configured "phy" at simplebus0 not configured "phy" at simplebus0 not configured "phy" at simplebus0 not configured "phy" at simplebus0 not configured qcdwusb0 at simplebus0: "usb" xhci0 at qcdwusb0, xHCI 1.10 usb0 at xhci0: USB revision 3.0 uhub0 at usb0 configuration 1 interface 0 "Generic xHCI root hub" rev 3.00/1.00 addr 1 qcdwusb1 at simplebus0: "usb" xhci1 at qcdwusb1, xHCI 1.10 usb1 at xhci1: USB revision 3.0 uhub1 at usb1 configuration 1 interface 0 "Generic xHCI root hub" rev 3.00/1.00 addr 1 qcdwusb2 at simplebus0: "usb" xhci2 at qcdwusb2, xHCI 1.10 usb2 at xhci2: USB revision 3.0 uhub2 at usb2 configuration 1 interface 0 "Generic xHCI root hub" rev 3.00/1.00 addr 1 qcdrm0 at simplebus0: "display-subsystem" "display-controller" at qcdrm0 not configured qcdpc0 at qcdrm0 qcdpc1 at qcdrm0 qcdpc2 at qcdrm0 simplepanel0 at qcdpc2 "phy" at simplebus0 not configured "clock-controller" at simplebus0 not configured qcpdc0 at simplebus0 qcaoss0 at simplebus0 "sram" at simplebus0 not configured qcspmi0 at simplebus0 qcpmic0 at qcspmi0 sid 0x0 qcpon0 at qcpmic0 qcrtc0 at qcpmic0 qcsdam0 at qcpmic0 qcpmicgpio0 at qcpmic0: no pins qcpwm0 at qcpmic0 qcpmic1 at qcspmi0 sid 0x1 qcpmicgpio1 at qcpmic1: no pins qcpwm1 at qcpmic1 qcpmic2 at qcspmi0 sid 0x2 qcpmicgpio2 at qcpmic2: no pins qcpmic3 at qcspmi0 sid 0x3 qcpmicgpio3 at qcpmic3 qcpmic4 at qcspmi0 sid 0x4 qcpmicgpio4 at qcpmic4 qcpmic5 at qcspmi0 sid 0x5 qcpmicgpio5 at qcpmic5 qcpmic6 at qcspmi0 sid 0x8 qcpmicgpio6 at qcpmic6: no pins qcpmic7 at qcspmi0 sid 0x9 qcpmicgpio7 at qcpmic7: no pins qcpmic8 at qcspmi0 sid 0xc "stm" at simplebus0 not configured "tpda" at simplebus0 not configured "tpdm" at simplebus0 not configured "funnel" at simplebus0 not configured "funnel" at simplebus0 not configured "funnel" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "funnel" at simplebus0 not configured "cti" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpda" at simplebus0 not configured "funnel" at simplebus0 not configured "funnel" at simplebus0 not configured "tmc" at simplebus0 not configured "replicator" at simplebus0 not configured "tpda" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "funnel" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpda" at simplebus0 not configured "funnel" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpda" at simplebus0 not configured "funnel" at simplebus0 not configured "tpda" at simplebus0 not configured "funnel" at simplebus0 not configured "funnel" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpdm" at simplebus0 not configured "tpda" at simplebus0 not configured "funnel" at simplebus0 not configured smmu1 at simplebus0: disabled qccpucp0 at simplebus0 "rsc" at simplebus0 not configured "timer" at simplebus0 not configured "sram" at simplebus0 not configured "watchdog" at simplebus0 not configured "pmu" at simplebus0 not configured "pmu" at simplebus0 not configured "pmu" at simplebus0 not configured "system-cache-controller" at simplebus0 not configured "remoteproc" at simplebus0 not configured pci0 at dwpcie0 ppb0 at pci0 dev 0 function 0 "Qualcomm X1E80100 PCIe" rev 0x00: msi pci1 at ppb0 bus 1 nvme0 at pci1 dev 0 function 0 vendor "Micron Technology", unknown product 0x5425 rev 0x01: msix, NVMe 1.4 nvme0: MTFDKBA1T0QGN-1BN1AABGA, firmware V8MA001, serial 25094E7621CB scsibus0 at nvme0: 2 targets, initiator 0 sd0 at scsibus0 targ 1 lun 0: sd0: 976762MB, 512 bytes/sector, 2000409264 sectors pci2 at dwpcie1 ppb1 at pci2 dev 0 function 0 "Qualcomm X1E80100 PCIe" rev 0x00: msi pci3 at ppb1 bus 1 qwx0 at pci3 dev 0 function 0 "Qualcomm QCNFA765" rev 0x01: msi agtimer0 at mainbus0: 19200 kHz "audio-codec" at mainbus0 not configured gpiokeys0 at mainbus0: "lid" gpioleds0 at mainbus0: "indicator" "pmic-glink" at mainbus0 not configured "sound" at mainbus0 not configured "regulator-edp-3p3" at mainbus0 not configured "regulator-misc-3p3" at mainbus0 not configured "regulator-nvme" at mainbus0 not configured "regulator-rtmr0-1p15" at mainbus0 not configured "regulator-rtmr0-1p8" at mainbus0 not configured "regulator-rtmr0-3p3" at mainbus0 not configured "regulator-rtmr1-1p15" at mainbus0 not configured "regulator-rtmr1-1p8" at mainbus0 not configured "regulator-rtmr1-3p3" at mainbus0 not configured "regulator-vph-pwr" at mainbus0 not configured "regulator-wcn-0p95" at mainbus0 not configured "regulator-wcn-1p9" at mainbus0 not configured "regulator-wcn-3p3" at mainbus0 not configured "wcn6855-pmu" at mainbus0 not configured scmi0: SCMI 2.0 scmi0: SCMI_PERF_DESCRIBE_LEVELS failed scmi0: SCMI_PERF_LEVEL_SET failed urtwn0 at uhub0 port 2 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 2 urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 80:1f:02:f1:fe:ed uhidev0 at uhub1 port 1 configuration 1 interface 0 "Yubico YubiKey OTP+FIDO+CCID" rev 2.00/5.71 addr 2 uhidev0: iclass 3/1 ukbd0 at uhidev0: 8 variable keys, 6 key codes wskbd3 at ukbd0 mux 1 uhidev1 at uhub1 port 1 configuration 1 interface 1 "Yubico YubiKey OTP+FIDO+CCID" rev 2.00/5.71 addr 2 uhidev1: iclass 3/0 fido0 at uhidev1: input=64, output=64, feature=0 ugen0 at uhub1 port 1 configuration 1 "Yubico YubiKey OTP+FIDO+CCID" rev 2.00/5.71 addr 2 vscsi0 at root scsibus1 at vscsi0: 256 targets softraid0 at root scsibus2 at softraid0: 256 targets root on sd0a (18be7be403be90cf.a) swap on sd0b dump on sd0b scmi0: SCMI_PERF_LEVEL_SET failed wskbd3 detached ukbd0 detached uhidev0 detached fido0 detached uhidev1 detached ugen0 detached qcpas0: all intents in use qcpas_pmic_rtr_recv: unknown pmic glink owner 0x800e qwx_pci_intr_data_event_tx: unhandled event code 0x11 uhidev0 at uhub1 port 1 configuration 1 interface 0 "Yubico YubiKey OTP+FIDO+CCID" rev 2.00/5.71 addr 2 uhidev0: iclass 3/1 ukbd0 at uhidev0: 8 variable keys, 6 key codes wskbd3 at ukbd0 mux 1 uhidev1 at uhub1 port 1 configuration 1 interface 1 "Yubico YubiKey OTP+FIDO+CCID" rev 2.00/5.71 addr 2 uhidev1: iclass 3/0 fido0 at uhidev1: input=64, output=64, feature=0 ugen0 at uhub1 port 1 configuration 1 "Yubico YubiKey OTP+FIDO+CCID" rev 2.00/5.71 addr 2 qwx0: qrtr init timeout simplefb0 at mainbus0: 1920x1197, 32bpp wsdisplay0 at simplefb0 mux 1: console (std, vt100 emulation), using wskbd0 wskbd1: connecting to wsdisplay0 wskbd2: connecting to wsdisplay0 wskbd3: connecting to wsdisplay0 wsdisplay0: screen 1-5 added (std, vt100 emulation) urtwn0: device timeout urtwn0 detached urtwn0 at uhub0 port 2 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 2 urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 80:1f:02:f1:fe:ed > I'm used following patch for debugging: > > Index: sys/dev/ic/rtwn.c > =================================================================== > RCS file: /cvs/src/sys/dev/ic/rtwn.c,v > diff -u -p -r1.61 rtwn.c > --- sys/dev/ic/rtwn.c 20 Aug 2025 14:24:05 -0000 1.61 > +++ sys/dev/ic/rtwn.c 19 Oct 2026 16:10:35 -0000 > @@ -395,7 +395,8 @@ int > rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len) > { > struct r92c_fw_cmd cmd; > - int ntries; > + uint8_t *p; > + int ntries, i; > > /* Wait for current FW box to be empty. */ > for (ntries = 0; ntries < 100; ntries++) { > @@ -414,6 +415,17 @@ rtwn_fw_cmd(struct rtwn_softc *sc, uint8 > cmd.id |= R92C_CMD_FLAG_EXT; > KASSERT(len <= sizeof(cmd.msg)); > memcpy(cmd.msg, buf, len); > + > + /* DEBUG: what the FW should get vs. what is written below. */ > + p = (uint8_t *)&cmd; > + printf("%s: fw cmd 0x%02x len %d msg", sc->sc_pdev->dv_xname, > + cmd.id, len); > + for (i = 0; i < len; i++) > + printf(" %02x", cmd.msg[i]); > + printf(": EXT want 0x%04x wrote 0x%04x, BOX want 0x%08x wrote 0x%08x\n", > + p[4] | p[5] << 8, *((uint8_t *)&cmd + 4), > + p[0] | p[1] << 8 | p[2] << 16 | p[3] << 24, > + *((uint8_t *)&cmd + 0)); > > /* Write the first word last since that will trigger the FW. */ > if (sc->chip & RTWN_CHIP_92E) > > which produces following dmesg messages: > > urtwn0: fw cmd 0x86 len 5 msg 00 00 00 40 84: EXT want 0x8440 wrote 0x0040, BOX want 0x00000086 wrote 0x00000086 > urtwn0: fw cmd 0x86 len 5 msg f0 0f 00 40 80: EXT want 0x8040 wrote 0x0040, BOX want 0x000ff086 wrote 0x00000086 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 19: EXT want 0x0000 wrote 0x0000, BOX want 0x19000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1b: EXT want 0x0000 wrote 0x0000, BOX want 0x1b000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1b: EXT want 0x0000 wrote 0x0000, BOX want 0x1b000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 19: EXT want 0x0000 wrote 0x0000, BOX want 0x19000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 19: EXT want 0x0000 wrote 0x0000, BOX want 0x19000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 19: EXT want 0x0000 wrote 0x0000, BOX want 0x19000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1c: EXT want 0x0000 wrote 0x0000, BOX want 0x1c000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1d: EXT want 0x0000 wrote 0x0000, BOX want 0x1d000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1a: EXT want 0x0000 wrote 0x0000, BOX want 0x1a000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1d: EXT want 0x0000 wrote 0x0000, BOX want 0x1d000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 18: EXT want 0x0000 wrote 0x0000, BOX want 0x18000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1c: EXT want 0x0000 wrote 0x0000, BOX want 0x1c000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1c: EXT want 0x0000 wrote 0x0000, BOX want 0x1c000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1c: EXT want 0x0000 wrote 0x0000, BOX want 0x1c000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1d: EXT want 0x0000 wrote 0x0000, BOX want 0x1d000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1c: EXT want 0x0000 wrote 0x0000, BOX want 0x1c000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1c: EXT want 0x0000 wrote 0x0000, BOX want 0x1c000005 wrote 0x00000005 > urtwn0: fw cmd 0x05 len 3 msg 00 00 1e: EXT want 0x0000 wrote 0x0000, BOX want 0x1e000005 wrote 0x00000005 > urtwn0: fw cmd 0x86 len 5 msg 0f 00 00 40 84: EXT want 0x8440 wrote 0x0040, BOX want 0x00000f86 wrote 0x00000086 > > Based on above, the below diff addresses: > > - Extended commands (len > 3) use the wrong byte layout on R92C > - Command bytes are truncated > > --- sys/dev/ic/rtwn.c > +++ sys/dev/ic/rtwn.c > @@ -409,21 +409,33 @@ rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len) > return (ETIMEDOUT); > } > memset(&cmd, 0, sizeof(cmd)); > cmd.id = id; > - if (len > 3) > - cmd.id |= R92C_CMD_FLAG_EXT; > KASSERT(len <= sizeof(cmd.msg)); > - memcpy(cmd.msg, buf, len); > + if (len > 3 && > + !(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_88F | RTWN_CHIP_92E))) { > + /* > + * R92C firmware expects extended commands as > + * [id : byte2 : byte3 : byte4] [byte0 : byte1], > + * i.e. the first two payload bytes go into HMEBOX_EXT. > + */ > + cmd.id |= R92C_CMD_FLAG_EXT; > + memcpy(cmd.msg, (const uint8_t *)buf + 2, len - 2); > + memcpy(cmd.msg + 3, buf, 2); > + } else { > + if (len > 3) > + cmd.id |= R92C_CMD_FLAG_EXT; > + memcpy(cmd.msg, buf, len); > + } > > /* Write the first word last since that will trigger the FW. */ > if (sc->chip & RTWN_CHIP_92E) > rtwn_write_2(sc, R88E_HMEBOX_EXT(sc->fwcur), > - *((uint8_t *)&cmd + 4)); > + LE_READ_2((uint8_t *)&cmd + 4)); > else > rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur), > - *((uint8_t *)&cmd + 4)); > - rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0)); > + LE_READ_2((uint8_t *)&cmd + 4)); > + rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), LE_READ_4((uint8_t *)&cmd)); > > sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX; > > if (sc->chip & RTWN_CHIP_PCI) { > > > However I'm getting so often `urtwn0: device timeout` with my USB Wi-Fi > card, which I belive is not related to above code it's hard to teset. > > I'm planning to come back to it, when I figure out the device timeout > issues. However if you see this is correct, I would be glad to get this > committed, so this particular problem is out of my queue. > > With tcpdump on access point I see without my diff `1Mbit/s`, but with > my diff I see `1Mbit/s 6Mbit/s 9Mbit/s 12Mbit/s 18Mbit/s`. > > Rates are taken from > > accesspoint# tcpdump -l -c1000 -s4096 -vvv -nni athn0 -y IEEE802_11_RADIO \ > wlan addr2 00:13:ef:40:51:2a and type data > > so I think above diff does fix one small issue. > > Tested only on: > > urtwn0 at uhub0 port 4 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 3 > urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 00:13:ef:40:51:2a > > Short output of tcpdump without the diff: > > 18:22:15.893709 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 94 I (s=0,r=16,C) len=108, > 18:22:16.893635 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 95 I (s=0,r=16,C) len=108, > 18:22:17.896273 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 96 I (s=0,r=16,C) len=108, > 18:22:18.898270 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 97 I (s=0,r=16,C) len=108, > 18:22:19.894258 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 98 I (s=0,r=16,C) len=108, > 18:22:20.653136 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 99 I (s=0,r=16,C) len=100, > 18:22:20.893715 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 9a I (s=0,r=16,C) len=108, > 18:22:21.713099 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 9b I (s=0,r=16,C) len=100, > 18:22:21.714606 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 9c I (s=0,r=16,C) len=100, > 18:22:21.893617 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 9d I (s=0,r=16,C) len=108, > 18:22:22.893903 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 9e I (s=0,r=16,C) len=108, > 18:22:23.893799 802.11 flags=41: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 9f I (s=0,r=16,C) len=108, > > Short output of tcpdump with above diff: > > 18:06:27.196792 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > ff:ff:ff:ff:ff:ff sap 02 I (s=0,r=16,C) len=352, > 18:06:27.284422 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 03 I (s=0,r=16,C) len=108, > 18:06:27.292957 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 04 I (s=0,r=16,C) len=108, > 18:06:27.400987 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 05 I (s=0,r=16,C) len=164, > 18:06:27.500596 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 06 I (s=0,r=16,C) len=108, > 18:06:27.501732 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 07 I (s=0,r=16,C) len=164, > 18:06:27.694236 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 08 I (s=0,r=16,C) len=108, > 18:06:27.695056 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 09 I (s=0,r=16,C) len=108, > 18:06:27.778746 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 0a I (s=0,r=16,C) len=164, > 18:06:27.893757 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 0b I (s=0,r=16,C) len=108, > 18:06:28.091212 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 0c I (s=0,r=16,C) len=108, > 18:06:28.276489 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 0d I (s=0,r=16,C) len=108, > 18:06:28.293698 802.11 flags=49: data: 00:13:ef:40:51:2a sap 00 > 04:f0:21:45:6a:c4 sap 0e I (s=0,r=16,C) len=108, > > -- > Regards, > Mikolaj >