From: Mikolaj Kucharski Subject: urtwn: power the RTL8188CU/8192CU off in urtwn_stop() To: tech@openbsd.org Date: Thu, 29 Oct 2026 20:04:34 +0000 Hi. Below diff was tested together with fw-cmd fix from thread: https://marc.info/?t=179243536000002&r=1&w=2 Together those diffs make my urtwn(4) very reliable. For my hardware it is a day and night difference. I cannot break it. There are still many things to be backported or borrowed from FreeBSD, however. urtwn0 at uhub0 port 4 configuration 1 interface 0 "Realtek 802.11n WLAN Adapter" rev 2.00/2.00 addr 3 urtwn0: poweroff fix v1 (2026-10-27) applied urtwn0: MAC/BB RTL8188CUS, RF 6052 1T1R, address 00:13:ef:40:51:2a I have more bugs discovered and exposed by testing which I did on my urtwn(4) card with athn(4) access point, but that is for another time. I would appreciated review of both diffs. Those diffs were heavily assisted by Claude. urtwn: power the RTL8188CU/8192CU off in urtwn_stop() urtwn_stop() only aborted the USB transfers and left the chip running, so every later init (ENETRESET, ifconfig down/up, the Tx watchdog) reprogrammed a live chip: no BB/RF reset, MAC Tx queues and page accounting kept stale state, firmware reloaded into a running 8051. Under Tx load the device could wedge with "device timeout", and the watchdog's reinit did not recover it; only a replug did. Power the chip off on stop, ported from FreeBSD urtwn_r92c_power_off() (6e2ab416930, R92C path mostly from NetBSD), so each init starts from the same state as after a replug. Bring back the APSD_CTRL "Initialize MAC" step in urtwn_r92c_power_on(), removed in r1.85 when nothing turned the MAC off; FreeBSD still has it. RTL8188E/8188F/8192E are left alone. Tested on RTL8188CUS with an athn(4) hostap AP. Index: sys/dev/ic/r92creg.h =================================================================== RCS file: /cvs/src/sys/dev/ic/r92creg.h,v diff -u -p -r1.31 r92creg.h --- sys/dev/ic/r92creg.h 1 Sep 2024 03:14:48 -0000 1.31 +++ sys/dev/ic/r92creg.h 29 Oct 2026 19:52:32 -0000 @@ -52,6 +52,7 @@ #define R92C_GPIO_IO_SEL 0x042 #define R92C_MAC_PINMUX_CFG 0x043 #define R92C_GPIO_PIN_CTRL 0x044 +#define R92C_GPIO_IOSEL 0x046 #define R92C_GPIO_INTM 0x048 #define R92C_LEDCFG0 0x04c #define R92C_LEDCFG1 0x04d @@ -346,6 +347,12 @@ #define R92C_RF_CTRL_EN 0x01 #define R92C_RF_CTRL_RSTB 0x02 #define R92C_RF_CTRL_SDMRSTB 0x04 + +/* Bits for R92C_LDOA15_CTRL. */ +#define R92C_LDOA15_CTRL_EN 0x01 +#define R92C_LDOA15_CTRL_STBY 0x02 +#define R92C_LDOA15_CTRL_OBUF 0x04 +#define R92C_LDOA15_CTRL_REG_VOS 0x08 /* Bits for R92C_LDOV12D_CTRL. */ #define R92C_LDOV12D_CTRL_LDV12_EN 0x01 Index: sys/dev/ic/rtwnvar.h =================================================================== RCS file: /cvs/src/sys/dev/ic/rtwnvar.h,v diff -u -p -r1.16 rtwnvar.h --- sys/dev/ic/rtwnvar.h 28 Apr 2023 01:24:14 -0000 1.16 +++ sys/dev/ic/rtwnvar.h 29 Oct 2026 19:52:32 -0000 @@ -135,3 +135,4 @@ void rtwn_delete_key(struct ieee80211co int rtwn_ioctl(struct ifnet *, u_long, caddr_t); void rtwn_start(struct ifnet *); void rtwn_fw_reset(struct rtwn_softc *); +void rtwn_rf_write(struct rtwn_softc *, int, uint16_t, uint32_t); Index: sys/dev/usb/if_urtwn.c =================================================================== RCS file: /cvs/src/sys/dev/usb/if_urtwn.c,v diff -u -p -r1.114 if_urtwn.c --- sys/dev/usb/if_urtwn.c 18 Jun 2025 13:48:23 -0000 1.114 +++ sys/dev/usb/if_urtwn.c 29 Oct 2026 19:52:32 -0000 @@ -399,6 +399,7 @@ int urtwn_ioctl(struct ifnet *, u_long, int urtwn_power_on(void *); int urtwn_alloc_buffers(void *); int urtwn_r92c_power_on(struct urtwn_softc *); +void urtwn_r92c_power_off(struct urtwn_softc *); int urtwn_r92e_power_on(struct urtwn_softc *); int urtwn_r88e_power_on(struct urtwn_softc *); int urtwn_r88f_power_on(struct urtwn_softc *); @@ -452,6 +453,9 @@ urtwn_attach(struct device *parent, stru sc->sc_iface = uaa->iface; sc->sc_sc.chip = urtwn_lookup(uaa->vendor, uaa->product)->chip; + /* POWEROFF TEST: banner, remove before commit. */ + printf("%s: poweroff fix v1 (2026-10-27) applied\n", + sc->sc_dev.dv_xname); usb_init_task(&sc->sc_task, urtwn_task, sc, USB_TASK_TYPE_GENERIC); timeout_set(&sc->scan_to, urtwn_scan_to, sc); @@ -1822,6 +1826,21 @@ urtwn_r92c_power_on(struct urtwn_softc * urtwn_write_2(sc, R92C_SYS_ISO_CTRL, urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR); + /* Initialize MAC (urtwn_r92c_power_off() turns it off). */ + urtwn_write_1(sc, R92C_APSD_CTRL, + urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF); + for (ntries = 0; ntries < 1000; ntries++) { + if (!(urtwn_read_1(sc, R92C_APSD_CTRL) & + R92C_APSD_CTRL_OFF_STATUS)) + break; + DELAY(50); + } + if (ntries == 1000) { + printf("%s: timeout waiting for MAC initialization\n", + sc->sc_dev.dv_xname); + return (ETIMEDOUT); + } + /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */ reg = urtwn_read_2(sc, R92C_CR); reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN | @@ -2592,6 +2611,118 @@ urtwn_stop(void *cookie) /* Free Tx/Rx buffers. */ urtwn_free_tx_list(sc); urtwn_free_rx_list(sc); + + /* + * Power the chip off, so that the next init starts from the same + * state as after a replug. A warm init does not reset the BB, RF, + * MAC Tx queues or 8051. + */ + if (!usbd_is_dying(sc->sc_udev) && + !(sc->sc_sc.chip & (RTWN_CHIP_88E | RTWN_CHIP_88F | RTWN_CHIP_92E))) + urtwn_r92c_power_off(sc); +} + +/* + * From FreeBSD urtwn_r92c_power_off(), commit 6e2ab416930 "urtwn: shutdown + * the device properly" (D5198; R92C path mostly from NetBSD). + */ +void +urtwn_r92c_power_off(struct urtwn_softc *sc) +{ + uint32_t reg; + + /* Block all Tx queues. */ + urtwn_write_1(sc, R92C_TXPAUSE, R92C_TXPAUSE_ALL); + + /* Disable RF. */ + rtwn_rf_write(&sc->sc_sc, 0, 0, 0); + + urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF); + + /* Reset BB state machine. */ + urtwn_write_1(sc, R92C_SYS_FUNC_EN, + R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA | + R92C_SYS_FUNC_EN_BB_GLB_RST); + urtwn_write_1(sc, R92C_SYS_FUNC_EN, + R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA); + + /* Reset digital sequence. */ + if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) { + /* Reset MCU ready status. */ + urtwn_write_1(sc, R92C_MCUFWDL, 0); + /* If firmware in ram code, do reset. */ + rtwn_fw_reset(&sc->sc_sc); + } + + /* Reset MAC and enable 8051. */ + urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1, + (R92C_SYS_FUNC_EN_CPUEN | R92C_SYS_FUNC_EN_ELDR | + R92C_SYS_FUNC_EN_HWPDN) >> 8); + + /* Reset MCU ready status. */ + urtwn_write_1(sc, R92C_MCUFWDL, 0); + + /* Disable MAC clock. */ + urtwn_write_2(sc, R92C_SYS_CLKR, + R92C_SYS_CLKR_ANAD16V_EN | R92C_SYS_CLKR_ANA8M | + R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_80M_SSC_DIS | + R92C_SYS_CLKR_SYS_EN | R92C_SYS_CLKR_RING_EN | 0x4000); + + /* Disable AFE PLL. */ + urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80); + + /* Gated AFE DIG_CLOCK. */ + urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880f); + + /* Isolated digital to PON. */ + urtwn_write_1(sc, R92C_SYS_ISO_CTRL, + R92C_SYS_ISO_CTRL_MD2PP | R92C_SYS_ISO_CTRL_PA2PCIE | + R92C_SYS_ISO_CTRL_PD2CORE | R92C_SYS_ISO_CTRL_IP2MAC | + R92C_SYS_ISO_CTRL_DIOP | R92C_SYS_ISO_CTRL_DIOE); + + /* Pull GPIO pins to balance level and LED control. */ + /* 1. Disable GPIO[7:0]. */ + urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000); + reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00; + reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000; + urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg); + + /* 2. Disable GPIO[10:8]. */ + urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00); + reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0; + reg |= (((reg & 0x000f) << 4) | 0x0780); + urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg); + + /* 3. Disable LED0 & 1. */ + urtwn_write_2(sc, R92C_LEDCFG0, 0x8080); + + /* Reset digital sequence: disable ELDR clock. */ + urtwn_write_2(sc, R92C_SYS_CLKR, + R92C_SYS_CLKR_ANAD16V_EN | R92C_SYS_CLKR_ANA8M | + R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_80M_SSC_DIS | + R92C_SYS_CLKR_SYS_EN | R92C_SYS_CLKR_RING_EN | 0x4000); + + /* Isolated ELDR to PON. */ + urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1, + (R92C_SYS_ISO_CTRL_DIOR | R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8); + + /* Disable analog sequence: disable A15 power. */ + urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF); + /* Disable digital core power. */ + urtwn_write_1(sc, R92C_LDOV12D_CTRL, + urtwn_read_1(sc, R92C_LDOV12D_CTRL) & + ~R92C_LDOV12D_CTRL_LDV12_EN); + + /* Enter PFM mode. */ + urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23); + + /* Set USB suspend. */ + urtwn_write_2(sc, R92C_APS_FSMCO, + R92C_APS_FSMCO_APDM_HOST | R92C_APS_FSMCO_AFSM_HSUS | + R92C_APS_FSMCO_PFM_ALDN); + + /* Lock ISO/CLK/Power control register. */ + urtwn_write_1(sc, R92C_RSV_CTRL, 0x0e); } int -- Regards, Mikolaj