bfe-core1106-sdk/kernel/rv1106-enablement/wifi/PORT-PLAN.md

AIC8800 WiFi+BT SDIO driver — 5.10 → 6.18 port plan

Target: the M5 milestone of ../PORT-STATUS.md / ../../docs/bringup.md — port the AIC8800 SDIO WiFi+BT driver onto the self-built Linux 6.18.46 kernel that already boots WardenOS on warden-c8a3 (M0–M3 done; M4 display in progress). No plan44 code (per the 2026-08-23 decision in bringup.md) — this is a direct forward-port of our own vendor source, same method already proven for clk/pinctrl/mach/mmc.

0. Source recommendation

Port from our own vendor SDK source, not from any external fork: flare-edge/sdk/sysdrv/drv_ko/wifi/aic8800dc/ (§1 below is the full map). This is not a default-to-what-we-have choice — it's the correct one on the evidence:

• Nothing more upstream exists. AICSemi has no public upstream driver repo with a stable, discoverable URL, and there is no aic8800 code in Linux staging or any LKML patch series (mainline/staging status: absent — confirmed by a dedicated web-research pass; no counter-evidence found). There is nothing more "canonical" to port from than the vendor source we already have.
• Our tree already carries two hardware-verified fixes newer forks don't have: the queue_sz-zero console-flood clamp (flare-edge/*/sdk-patches/wifi/patches/0001-aic8800dc-no-zero-timeout-spin-and-ratelimit.patch) and the SDIO-wakeup busy-spin→sleep Tier-1 hardening (live in the vendor tree today per luckfox-pico-86-panel/wifi-bluetooth-aic8800.md, tracked as future-features-2/sdk-patches/wifi/patches/0002-aic8800dc-sdio-wakeup-sleep-not-spin.patch — not yet copied into this branch's sdk-patches/; carry both forward into the ported tree, and file the housekeeping gap separately). Starting from a third-party fork would mean re-discovering and re-fixing both bugs on hardware.
• The vendor source already anticipates part of the delta. rwnx_compat.h has #if LINUX_VERSION_CODE shims up to KERNEL_VERSION(5, 15, 60) — e.g. rwnx_main.c's net_device_ops already switches between .ndo_do_ioctl and .ndo_siocdevprivate at the 5.15 boundary (rwnx_main.c:1457–1474). That removes one whole item from the delta checklist below at zero cost.
• A cleaner community fork exists but is not itself a base — it's a reference. radxa-pkg/aic8800 (github.com/radxa-pkg/aic8800) is an actively maintained, GPL-3.0, DKMS-packaged build of the same AICSemi driver family, explicitly patched for kernel 6.12/6.13 on Rockchip SDIO boards (Rock 3C/5C), and is the only community effort found that has already absorbed the post-5.15 cfg80211/netdev/timer churn this port needs. Use it the same way the pinctrl port used the upstream RV1106 patch series — as a correctness oracle to diff against, not as code we vendor: it targets AIC8800D80 SDIO/USB/PCIe variants generically, not our AIC8800DC + our two local hardening patches, and an Armbian forum thread reports open regressions on it at the 6.12+ boundary — so treat its fixes as a second opinion on the wiphy-lock and timer-rename hunks, verify each independently.
• No mainline/staging path exists to lean on instead. Confirmed by the research pass: no aic8800 in drivers/net/wireless/, staging/, or any LKML series. This matches the driver-parity table's row (AIC8800 wifi (bsp/fdrv) | out-of-tree) and the bring-up doc's framing: "AIC8800 wifi (plan44 has none; ours)."

1. SDK source map

Vendor tree root: flare-edge/sdk/sysdrv/drv_ko/wifi/aic8800dc/ (an out-of-tree external-module build against KDIR := ../../../source/kernel, i.e. the vendor 5.10.160 tree at flare-edge/sdk/sysdrv/source/kernel/). Selected by RK_ENABLE_WIFI_CHIP=AIC8800DC in flare-edge/sdk/project/cfg/BoardConfig_IPC/BoardConfig-EMMC-Buildroot-RV1106_Luckfox_Pico_86Panel-IPC.mk:138, dispatched by sdk/sysdrv/drv_ko/wifi/Makefile's build-sdio target (ifneq ($(findstring $(RK_ENABLE_WIFI_CHIP),"AIC8800DC"),) @make -C aic8800dc/). 88,601 total lines across the three sub-drivers.

aic8800dc/
  Kconfig                  # AIC_WLAN_SUPPORT, AIC_FW_PATH (default "/oem/usr/ko/aic8800dc_fw")
                            #   sources drivers/net/wireless/aic8800/{aic8800_fdrv,aic8800_btlpm}/Kconfig
                            #   -- note this path is ALREADY the mainline drivers/net/wireless/
                            #   convention; the vendor Kconfig assumes it, easing the in-tree move.
  Makefile                 # obj-$(CONFIG_AIC8800_BTLPM_SUPPORT) += aic8800_btlpm/
                            # obj-$(CONFIG_AIC8800_WLAN_SUPPORT) += aic8800_fdrv/
                            # obj-$(CONFIG_AIC_WLAN_SUPPORT)     += aic8800_bsp/
                            # (link order = bsp, fdrv, btlpm — matches the insmod order below)
  aic8800_bsp/              # SDIO bus glue + firmware bootstrap ("bsp" = board support package)
    aic_bsp_main.c           # module_init/exit; per-chip firmware filename tables (fw_u02,
                              #   fw_8800dc_u01, fw_8800dc_u02, ...); aicbsp_probe_semaphore
    aicsdio.c                 # struct sdio_driver aicbsp_sdio_driver; SDIO_DEVICE_CLASS(WLAN)
                              #   wildcard match + internal vendor/device ID probe:
                              #   SDIO_VENDOR_ID_AIC8800DC=0xc8a1, SDIO_DEVICE_ID_AIC8800DC=0xc08d
                              #   (aicsdio.c:75,80); calls rockchip_wifi_power()/
                              #   rockchip_wifi_set_carddetect() (aicsdio.c:515-580) — see §3.7
    aic8800dc_compat.c/.h, aic8800d80_compat.c/.h   # per-chip-variant glue
    aicwf_txq_prealloc.c, md5.c, aic_bsp_driver.c/.h, aicwf_firmware_array.c/.h
  aic8800_fdrv/              # the actual cfg80211 full-MAC driver ("fdrv" = fullmac driver)
    rwnx_main.c               # struct cfg80211_ops rwnx_cfg80211_ops (line 5365); wiphy_new()
                              #   (5732), wiphy_register() (6035); struct net_device_ops
                              #   rwnx_netdev_ops (1457) / rwnx_netdev_monitor_ops (1477);
                              #   3 rtnl_lock()/rtnl_unlock() pairs (5429,6063,6097)
    rwnx_msg_rx.c             # firmware→driver event handling incl. cfg80211_connect_result()
                              #   (line 958) and cfg80211_roamed() (1006,1010)
    rwnx_cfgfile.c, rwnx_tx.c, rwnx_rx.c, rwnx_txq.c    # datapath
    aicwf_sdio.c              # the actual SDIO transport (`aicwf_sdio_driver`, line 1216) —
                              #   THIS is the file the task's "aicwf_sdio" driver name refers to;
                              #   it lives inside aic8800_fdrv/, not a separate directory. Also
                              #   calls rockchip_wifi_power()/set_carddetect() (1260-1331) and
                              #   contains the Tier-1 wakeup-sleep hardening (§0) around the
                              #   `aicwf_sdio_wakeup()` retry loop (~line 1363 in the older
                              #   line numbering cited by the wiki; grep for `usleep_range`).
    aicwf_tcp_ack.c, aicwf_rx_prealloc.c, aic_priv_cmd.c, aic_vendor.c
    rwnx_compat.h             # vendor compat shim layer, #if LINUX_VERSION_CODE guards up to
                              #   5.15.60 ONLY — everything past that (timer renames, wiphy
                              #   locking, netif_rx_ni removal) is new territory, not covered.
    usb_host.c/.h, rwnx_pci.*, rwnx_mesh.*   # dead code on this board (no USB/PCI variant used)
  aic8800_btlpm/              # Bluetooth low-power-mode / HCI wake companion module
    aic8800_btlpm.c, aic_bluetooth_main.c, lpm.c, rfkill.c   # standard rfkill_register(), no
                              #   Rockchip-specific RFKILL_RK dependency (checked, none found)
  aic8800dc_fw/                # firmware blobs, see §5

Modules actually insmoded on the running 5.10 panel (from sdk/sysdrv/drv_ko/wifi/insmod_wifi.sh:109-124, the #aic8800 stanza gated on /proc/device-tree/model containing "W" or an SDIO uevent match):

cfg80211.ko → libarc4.ko → ctr.ko → ccm.ko → libaes.ko → aes_generic.ko
  → aic8800_bsp.ko (sleep 0.2s) → aic8800_fdrv.ko (sleep 2s) → aic8800_btlpm.ko (sleep 0.1s)

rkwifi_server is deliberately never started (WardenOS owns wlan0 directly — see insmod_wifi.sh:126-137 and wifi-bluetooth-aic8800.md); nothing to replicate there. The crypto modules (arc4/ctr/ccm/aes) are dependencies of the driver's internal key-handling, not aic8800-specific — confirm they're already =y/reachable in the 6.18 config (crypto is currently listed as "[ ] batch2" in ../DRIVER-PARITY.md; flip alongside this work).

DT node — correction to the task's framing. The task description assumed sdio: mmc@ff9a0000. That is wrong for this board. The AIC8800 is wired to sdmmc: mmc@ffaa0000 (mmc1), not sdio: mmc@ff9a0000 (mmc2) — confirmed directly in rv1106g-luckfox-pico-86panel.dts:83-97 (comment literally reads /**********SDIO-WIFI**********/ over the &sdmmc node) and independently in luckfox-pico-86-panel/wifi-bluetooth-aic8800.md:11/hardware-86-panel.md:69. &sdio (mmc@ff9a0000) stays status = "disabled" and is unused on this board. There is no separate DT child node for the aic8800 chip itself — it's discovered purely by SDIO bus-scan + vendor/device ID match inside the driver (aicsdio.c, no of_match_table anywhere in the tree — checked, none found); the only DT surface is the MMC controller node plus the power-sequencing node:

sdio_pwrseq: sdio-pwrseq {                      /* rv1106g-luckfox-pico-86panel.dts:20-23 */
    compatible = "mmc-pwrseq-simple";
    reset-gpios = <&gpio1 RK_PA2 GPIO_ACTIVE_LOW>;
};
&sdmmc {                                        /* rv1106g-luckfox-pico-86panel.dts:83-97 */
    max-frequency = <50000000>;
    bus-width = <4>;
    cap-sd-highspeed;
    cap-sdio-irq;
    keep-power-in-suspend;
    non-removable;
    rockchip,default-sample-phase = <90>;
    supports-sdio;
    mmc-pwrseq = <&sdio_pwrseq>;
    pinctrl-names = "default";
    pinctrl-0 = <&sdmmc0_clk &sdmmc0_cmd &sdmmc0_bus4 &sdmmc0_det>;
    status = "okay";
};

The sdmmc0_{clk,cmd,bus4,det} pin groups are defined in sdk/sysdrv/source/kernel/arch/arm/boot/dts/rv1106-pinctrl.dtsi:700-731 (a separate include from rv1106.dtsi) — port that block, it isn't in the DT files the M1–M3 work already ported.

2. Open-source landscape (web research)

• AICSemi upstream: no discoverable, stable public GitHub org/repo carrying aic8800_bsp/fdrv/btlpm as canonical upstream — vendor releases exist only as SoC-vendor SDK drops (Rockchip's, in our case). Nothing more upstream to point at than what we have.
• Mainline/staging: absent. No aic8800 anywhere in drivers/net/wireless/, drivers/staging/, or any LKML/patchwork series as of this research pass.
• Cleanest newer-kernel fork found: radxa-pkg/aic8800 (github.com/radxa-pkg/aic8800) — actively maintained, GPL-3.0, DKMS-packaged, patched for kernel 6.12/6.13 on Rockchip SDIO boards (Radxa Rock 3C/5C), covering SDIO/USB/PCIe AIC8800D80 variants. Firmware ships as a companion aic8800-firmware package into /lib/firmware/aic8800_fw/. Treat as a reference/oracle for the API-delta hunks (§3), not a vendoring source — see §0 for why. An Armbian forum thread ("AIC8800 wifi sdio module not working with kernel 6.12+") reports it has its own open regressions at that boundary, so cross-check rather than trust each hunk blindly.
• Other community efforts (Armbian, LuckFox's own OpenWrt branch, generic BananaPi/OpenWrt feeds): no aic8800 kmod bundled by default even where the DT wiring exists — luckfox-pico-86-panel/alternative-bsps.md:20 documents this exact gap for LuckFox's own OpenWrt target (cortexa7.mk ships kmod-rknpu-rockchip only, no kmod-aic8800). Confirms there is no ready-made newer-kernel package to pull instead of porting.
• plan44's OpenWrt RV1106 fork (flare-edge/research/plan44-openwrt/, Linux 6.6, 152 RV1106 patches): checked directly — contains no aic8800 code at all (find ... -ipath '*aic8800*' empty). Confirms bringup.md's "AIC8800 wifi (plan44 has none; ours)" and the "no plan44 code" decision doesn't cost us anything here — there's nothing to take.

3. 5.10 → 6.18 API-delta checklist

Grounded in two passes: (a) direct kernel.org/bootlin/LWN research on 5.10→6.18 API history, (b) grep evidence from the actual vendor source (file:line cited below) so this is a checklist against our code, not a generic survey.

3.1 Timers — confirmed hard breaks, exact call sites found

del_timer_sync/del_timer → timer_delete_sync/timer_delete: renamed in 9b13df3fb64e (landed v6.2-rc1) as a compat-wrapped rename; the compat wrapper was removed in v6.15-rc1, so by 6.18 the old names do not exist. from_timer() → timer_container_of(): a real mainline rename (~6.14–6.15 treewide timer-API cleanup; exact tag unconfirmed, verify against the actual 6.18.46 headers already unpacked at flare-edge/research/linux-6.18.46/include/linux/timer.h). Every call site in the driver, found by direct grep (not estimated):

API	File:line(s)
from_timer()	aic8800_bsp/aicsdio.c:1442; aic8800_fdrv/aicwf_sdio.c:279,317,2933; aic8800_fdrv/rwnx_main.c:1724; aic8800_fdrv/rwnx_rx.c:1751,2027
del_timer_sync()	aic8800_bsp/aicsdio.c:1677; aic8800_fdrv/aicwf_sdio.c:1048,1054,1297,1303,3152; aic8800_fdrv/rwnx_main.c:2181; aic8800_fdrv/rwnx_rx.c:1501,1526
del_timer() (non-sync)	aic8800_fdrv/aicwf_tcp_ack.c:108,367,401,462; aic8800_fdrv/rwnx_rx.c:1921,2607; aic8800_btlpm/aic8800_btlpm.c:580,603,951; aic8800_btlpm/lpm.c:558,581,935
setup_timer() (pre-4.14 dead branch)	aic8800_fdrv/aicwf_tcp_ack.c:84 — already #if LINUX_VERSION_CODE < KERNEL_VERSION(4,14,0) guarded against a live timer_setup() branch; delete the dead #if branch, don't port it
timer_setup() calls (unaffected, just listed for completeness)	aicsdio.c:2059; aicwf_sdio.c:3564,3589,3590; rwnx_main.c:1841,6118; rwnx_rx.c:1433,2510; aicwf_tcp_ack.c:87; both btlpm files:1104/1054

Mechanical fix: sed-rename from_timer→timer_container_of, del_timer_sync→ timer_delete_sync, del_timer→timer_delete across the ~20 call sites above. timer_setup() itself is unchanged.

3.2 netdev

• ndo_do_ioctl removal (~6.7-era, split into ndo_eth_ioctl/ndo_siocdevprivate around 5.14/5.15): already handled by the vendor. rwnx_main.c:1457-1474 already has #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0) / #else .ndo_siocdevprivate = rwnx_do_ioctl, for both rwnx_netdev_ops and rwnx_netdev_monitor_ops. Zero work needed — the guard picks the 6.18-correct member automatically. Verify only that rwnx_do_ioctl's body (line 1368) still compiles against the ndo_siocdevprivate signature (int (*)(struct net_device *, struct ifreq *, void __user *, int) vs the old ioctl signature) — check on the actual 6.18.46 headers.
• netif_rx_ni() removed (5.18, merged into plain netif_rx(), safe from any context): three call sites, not version-guarded: rwnx_rx.c:404,598,1651. Mechanical fix: netif_rx_ni(rx_skb) → netif_rx(rx_skb).
• netif_napi_add() weight arg dropped (~6.1): not used anywhere in this driver (checked, no netif_napi_add/NAPI in the tree — the driver does its own kthread-based RX processing, not NAPI polling). No action.

3.3 cfg80211 — the hard, non-mechanical part

Verified directly against flare-edge/research/linux-6.18.46/include/net/cfg80211.h (the actual target tree, not a guess from release notes):

• cfg80211_connect_result(): confirmed unchanged and safe. In 6.18.46 it's a static inline that just forwards to cfg80211_connect_bss() (cfg80211.h:8654-8661), with the exact same 8-argument signature the driver already calls at rwnx_msg_rx.c:958. cfg80211_roamed() — also confirmed unchanged: 6.18.46 signature is cfg80211_roamed(struct net_device *dev, struct cfg80211_roam_info *info, gfp_t gfp) (cfg80211.h:8748), matching the driver's call at rwnx_msg_rx.c:1006,1010 (cfg80211_roamed(dev, &info, GFP_ATOMIC) against a local struct cfg80211_roam_info info). No code change required here; migrating to cfg80211_connect_bss() directly is optional cleanup, not a requirement.
• wiphy_new()/wiphy_new_nm(): confirmed unchanged. wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv) (cfg80211.h:6250-6253, inline wrapper over wiphy_new_nm(ops, sizeof_priv, NULL)) — matches rwnx_main.c:5732's wiphy_new(&rwnx_cfg80211_ops, sizeof(struct rwnx_hw)) exactly. No signature-driven work needed.
• Wiphy locking overhaul — real, confirmed present, and now precisely scoped (not a guess). cfg80211.h (~6266, 6325-6362) confirms wiphy_lock()/ wiphy_unlock()/lockdep_assert_wiphy() and a struct wiphy_work deferred-work mechanism all exist in 6.18.46, and — the load-bearing sentence, directly from the wiphy_lock() doc comment — "When cfg80211 ops are called, the wiphy is already locked." That means:
  • The driver's cfg80211_ops callbacks themselves (rwnx_cfg80211_scan, _connect, _disconnect, _add_key, _mgmt_tx, etc., rwnx_main.c:5365-5382) need no new locking — cfg80211 core now takes the wiphy mutex before calling into any of them, where 5.10-era cfg80211 relied on the caller holding RTNL instead.
  • The real risk is the other direction: this driver calls cfg80211_scan_done() / cfg80211_connect_result() / cfg80211_roamed() from firmware-event handling, not from inside an ops callback — rwnx_msg_rx.c (async, driven by SDIO RX) and rwnx_main.c:1212,2082,2168 (also async paths, not the ops entry points). Multiple cfg80211.h doc comments for adjacent notification APIs state "the caller must hold ... wiphy mutex" (e.g. cfg80211.h:9428: "Caller must hold wiphy mutex, therefore must only be called from sleepable context") — the pattern that replaced the old "hold RTNL" requirement. Concretely: every cfg80211_* notification call reached from rwnx_msg_rx.c / the async paths in rwnx_main.c needs wiphy_lock(wiphy) / wiphy_unlock(wiphy) wrapped around it that wasn't there before (5.10 only needed rtnl_lock(), which this driver's 3 existing rtnl_lock()/rtnl_unlock() sites at rwnx_main.c:5429/5433, 6063/6075, 6097/6102 already show it knows how to take defensively — the fix is adding the wiphy-mutex equivalent at the async notification sites, not at those 3 sites, which are netdev-registration paths and likely stay RTNL-only).
  • This is still the single highest-effort item in the port — not because the contract is unknown (it's now confirmed above), but because applying it correctly means auditing every async→cfg80211 call site in rwnx_msg_rx.c and the async branches of rwnx_main.c (1212, 2082, 2168, 2445-2645) one by one, and because a wrong lock order (wiphy mutex vs. RTNL vs. this driver's own internal locks/semaphores) produces lockdep splats or deadlocks that only show up under real traffic, not at compile time. Cross- check each hunk against how radxa-pkg/aic8800 (§0) handled the same transition on its 6.12/6.13 port — it hit this exact wall first.

3.4 SDIO/MMC

No breaking changes found in sdio_driver, sdio_claim_host/release_host, sdio_readb/writesb, sdio_set_block_size between 5.10 and 6.18 (low research depth on this axis — treat as low-risk, smoke-test rather than line-audit). The mainline dw_mmc/dw_mmc-rockchip host driver is already proven on 6.18 for eMMC (../DRIVER-PARITY.md: dw_mmc (eMMC) | mainline | [x] M3) and CONFIG_MMC_DW_ROCKCHIP=y is already in the live .config — the SDIO controller side of this port is de-risked; only the AIC8800 card driver above the sdmmc bus is new work.

3.5 proc_ops

file_operations→proc_ops for procfs landed in 5.6 — already true at the 5.10 baseline this driver was written against, and no further proc_ops changes were found 5.10→6.18. The three files using proc_ops/proc_create (aicwf_sdio.c, aic8800_btlpm.c, lpm.c) should need no change here.

3.6 DMA

No breaking coherent/streaming DMA API changes found 5.10→6.18 relevant to this driver; SDIO drivers ride MMC-core DMA rather than calling dma_alloc_coherent/dma_map_single directly for the card-side data path. Low risk, not independently line-audited — flag if the build surfaces anything.

3.7 Vendor/Rockchip-only helpers — real mainline gap, not a version delta

rockchip_wifi_power() / rockchip_wifi_set_carddetect() (declared in include/linux/rfkill-wlan.h, implemented in net/rfkill/rfkill-wlan.c in the vendor 5.10 tree only — this is a Rockchip-BSP-vendor subsystem, not mainline Linux, and does not exist in flare-edge/research/linux-6.18.46/). Call sites: aic8800_bsp/aicsdio.c:515,517,556,580 and aic8800_fdrv/aicwf_sdio.c:1260,1262,1329,1331 (all under #ifdef CONFIG_PLATFORM_ROCKCHIP, which is true for this board). This is not a rename — there is nothing to rename to. Recommended fix: stub these calls out entirely rather than port rfkill-wlan.c. The DT already declares a standard mainline mmc-pwrseq-simple (sdio_pwrseq, §1) bound via mmc-pwrseq = <&sdio_pwrseq>, which the mainline MMC core already drives at bus-scan/power-up time through drivers/mmc/core/pwrseq_simple.c — a real mainline mechanism doing the same job (GPIO power/reset sequencing) these vendor calls were a pre-DT-pwrseq-era stand-in for. rockchip_wifi_set_carddetect() is likewise redundant for a non-removable MMC device, which mainline already auto-rescans. Treat every call site as #if 0/deleted, not ported. get_cpu_version/rockchip_soc_id-style helpers: not called anywhere in this driver (checked, no hits) — the task's assumption that this driver calls such a helper does not hold; no action needed. module_param, kthread_run/ kthread_should_stop: stable, unaffected — used extensively (RX/TX kthreads in aicwf_sdio.c), no changes needed.

3.8 Firmware loading

request_firmware/request_firmware_nowait/release_firmware: stable 5.10→6.18, no signature changes found. Note this driver's actual firmware load path is AIC_FW_PATH-relative direct file read via its own loader (aic_load_fw/CONFIG_USE_FW_REQUEST is ?= n in the Makefile — the vendor driver does not use the standard request_firmware() API by default, it reads firmware files from a configurable path itself). Confirm this stays true after the port; it's a deliberate vendor choice, not a version-driven gap.

4. File / config / DT port plan

4.1 Files to bring into the 6.18 tree

Copy aic8800dc/{aic8800_bsp,aic8800_fdrv,aic8800_btlpm}/*.{c,h} (source only — exclude every generated .o/.ko/.mod.*/.cmd/Module.symvers/ modules.order artifact already sitting in the vendor tree from prior out-of-tree builds) into the 6.18 tree at:

flare-edge/research/linux-6.18.46/drivers/net/wireless/aic8800/
  Kconfig                    # new: top-level "source" wrapper, see 4.2
  Makefile                   # obj-y for the 3 subdirs, preserving bsp→fdrv→btlpm link order
  aic8800_bsp/    (from aic8800dc/aic8800_bsp/)
  aic8800_fdrv/   (from aic8800dc/aic8800_fdrv/, minus usb_host.c/rwnx_pci.*/rwnx_mesh.* — dead
                   code on this board's SDIO-only, non-mesh config; keep out unless a build
                   error proves them referenced elsewhere)
  aic8800_btlpm/  (from aic8800dc/aic8800_btlpm/)

This is exactly the path the vendor's own Kconfig already assumes (source "drivers/net/wireless/aic8800/aic8800_fdrv/Kconfig", §1) — no path rewriting needed inside the sub-Kconfigs. Firmware blobs (§5) go to aic8800dc_fw/ under the rootfs firmware path, not into the kernel tree.

Apply, in this order, on top of the copied source: the 0001 queue_sz clamp patch, and the Tier-1 SDIO-wakeup-sleep patch (currently only tracked under flare-edge/future-features-2/sdk-patches/wifi/patches/0002-aic8800dc-sdio-wakeup-sleep-not-spin.patch — pull it from there; it is not in this branch's own sdk-patches/wifi/, a separate housekeeping gap worth closing regardless of this port). Then apply the API-delta fixes from §3.

4.2 Kconfig wiring

Add one line to flare-edge/research/linux-6.18.46/drivers/net/wireless/Kconfig (alongside the existing source "drivers/net/wireless/broadcom/Kconfig" etc. list, Kconfig:22-38):

source "drivers/net/wireless/aic8800/Kconfig"

New drivers/net/wireless/aic8800/Kconfig — carry the vendor's aic8800dc/Kconfig content forward nearly verbatim (it already has the right shape: an AIC_WLAN_SUPPORT bool gate, an AIC_FW_PATH string default, and source lines for the fdrv/btlpm sub-Kconfigs) but change the two tristate symbols in aic8800_fdrv/Kconfig (AIC8800_WLAN_SUPPORT) and aic8800_btlpm/Kconfig (AIC8800_BTLPM_SUPPORT) to default y, and set AIC_WLAN_SUPPORT default y — per the task's requirement, everything built in, not modular, since the 6.18 rootfs has no working module-loading pipeline yet (../PORT-STATUS.md M3 note: the old 5.10 .kos already fail on 6.18 from vermagic mismatch, and a rebuilt 6.18 module tree for Buildroot doesn't exist yet either).

4.3 Config symbols (=y, built-in)

CONFIG_WIRELESS=y          # already =y in the live 6.18 .config
CONFIG_CFG80211=y          # already =y — flipped in "batch2" per ../DRIVER-PARITY.md
CONFIG_WLAN=y               # already =y
CONFIG_MMC=y                 # already =y
CONFIG_MMC_DW_ROCKCHIP=y     # already =y
CONFIG_RFKILL=y              # already =y
CONFIG_AIC_WLAN_SUPPORT=y        # new
CONFIG_AIC8800_WLAN_SUPPORT=y    # new
CONFIG_AIC8800_BTLPM_SUPPORT=y   # new
CONFIG_BT=y                  # currently =m in the live .config — flip to =y for the same
                              #   no-working-module-pipeline reason as the aic8800 pieces
CONFIG_BT_HCIUART=y          # currently =m — flip alongside CONFIG_BT
CONFIG_BT_HCIUART_H4=y       # already =y (H4 is the transport this board's BT actually uses,
                              #   per hardware-86-panel.md: UART1/ttyS1, hciattach -s 1500000
                              #   ... any 1500000 flow nosleep)
CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_CTR=y CONFIG_CRYPTO_CCM=y CONFIG_CRYPTO_AES=y  # driver's
                              #   internal key-handling deps, currently "[ ] batch2" in
                              #   ../DRIVER-PARITY.md — confirm =y, not =m, alongside this work

Do not enable CONFIG_MAC80211 for this driver — confirmed by source inspection (§3.3 note, no ieee80211_hw/mac80211 symbol usage anywhere in aic8800_fdrv/) that this is a pure cfg80211_ops full-MAC driver; mac80211 was only ever needed for the other vendor WiFi chips in the shared sdk/sysdrv/drv_ko/wifi/ tree (RTL8189FS etc.), not this one. Leaving it out avoids pulling in a subsystem this port doesn't need. Do not carry CONFIG_RFKILL_RK — confirmed unused (aic8800_btlpm/rfkill.c calls the standard mainline rfkill_register(), no Rockchip-specific rfkill hook).

4.4 DT changes

On the board DT that M4/M5 work extends (warden-sdk/kernel/rv1106-enablement/dts/rv1106-warden.dts or its successor — follow the pattern of the M3 &emmc addition in rv1106-warden-m2.dts:126-142):

1. Port the sdmmc0_{clk,cmd,bus4,det} pinctrl group from sdk/sysdrv/source/kernel/arch/arm/boot/dts/rv1106-pinctrl.dtsi:700-731 (not yet in the ported tree — M1–M3 only needed the eMMC/uart2/eth pin groups).
2. Add the sdmmc: mmc@ffaa0000 node (clocks HCLK_SDMMC/CCLK_SRC_SDMMC off &cru, SCLK_SDMMC_DRV/SCLK_SDMMC_SAMPLE off &grf_cru — the same grf_cru dependency the M2 eMMC fix already established, so no new prerequisite) and the sdio_pwrseq node, both transplanted verbatim from §1's block (interrupt GIC_SPI 52, per rv1106.dtsi:1403-1412 in the vendor tree).
3. status = "okay" on &sdmmc, matching the vendor board DT exactly (§1).
4. Do not touch &sdio (mmc@ff9a0000) — leave disabled, it's genuinely unused hardware on this board (§1 correction).

4.5 Driver init-order note

The 5.10 module load order (insmod_wifi.sh, §1) is aic8800_bsp → (200ms) → aic8800_fdrv → (2s!) → aic8800_btlpm, with real sleep delays between each. Built-in (=y), there is no equivalent explicit delay — initcall order is controlled by link order (the vendor Makefile's obj-y list is already aic8800_btlpm/ aic8800_fdrv/ aic8800_bsp/ in Makefile-declaration order but Kbuild links obj-y in Makefile order regardless of which appears first in the ifeq block — preserve aic8800_bsp before aic8800_fdrv before aic8800_btlpm in the new drivers/net/wireless/aic8800/Makefile's obj-y list, mirroring the working insmod order) and by each subsystem's declared module_init()/initcall level (all three currently use plain module_init(), which becomes device_initcall level when built-in — same level for all three, so link order is what decides relative sequencing among them). The observed 2-second gap between aic8800_bsp and aic8800_fdrv on the running 5.10 system is suspicious enough (firmware download + chip bring-up time) that if the built-in probe races ahead of firmware readiness, watch for it specifically during bring-up (§6) — this is a real risk the static-link change introduces that modular loading didn't have, not just a formality.

5. Firmware notes

Firmware is not open source (binary blobs, as expected for WiFi/BT RF/PHY patches) but is freely redistributable — no export-control/NDA marking found on the files themselves or in the vendor tree's licensing. 21 files, sdk/sysdrv/drv_ko/wifi/aic8800dc/aic8800dc_fw/ (484 KB total):

aic_userconfig_8800dc.txt, aic_userconfig_8800dw.txt      # text config, not firmware
fmacfw_calib_8800dc_{u02,h_u02,hbt_u02}.bin                # full-MAC calibration firmware
fmacfw_patch_8800dc_{u02,h_u02,hbt_u02,ipc_u02}.bin        # full-MAC patch firmware
fmacfw_patch_tbl_8800dc_{u02,h_u02,hbt_u02,ipc_u02}.bin    # patch tables
fw_adid_8800dc_{u02,u02h}.bin                              # analog/RF ADID cal data
fw_patch_{8800dc_u02,8800dc_u02_ext0,8800dc_u02h}.bin      # BT patch firmware
fw_patch_table_8800dc_{u02,u02h}.bin                       # BT patch tables
lmacfw_rf_8800dc.bin                                       # RF test-mode firmware

Per aic_bsp_main.c's fw_8800dc_u02[] table (§1), the exact subset loaded at runtime depends on AICBSP_CPMODE_WORK vs _TEST and on CONFIG_SDIO_BT (=n in the vendor Makefile — WiFi and BT firmware are loaded/attached separately, not as one combo blob, despite the combo chip). Firmware load path: AIC_FW_PATH Kconfig default is /oem/usr/ko/aic8800dc_fw — this is a 5.10-era Buildroot-rootfs-layout artifact (the /oem partition), not a kernel concept; on the 6.18 rootfs, point this at wherever WardenOS's 6.18 Buildroot userspace places firmware (likely /lib/firmware/aic8800dc/ if following standard mainline convention, or keep /oem/usr/ko/aic8800dc_fw if the 6.18 rootfs partition layout is unchanged from 5.10 — confirm against whatever the M4/M5 rootfs build actually produces, this is a rootfs-layout decision, not a kernel one). Not found in linux-firmware.git (the mainline firmware project) — AIC8800 firmware has not been upstreamed there; continue shipping it the way the vendor tree already does (bundled alongside the driver, loaded by direct file read per §3.8, not request_firmware()).

Chip variant: AIC8800DC, confirmed authoritative by the board config (RK_ENABLE_WIFI_CHIP=AIC8800DC) and the SDIO device ID match in source (aicsdio.c:75,80: vendor 0xc8a1, device 0xc08d) — not the dual-band AIC8800D80 seen on other LuckFox boards. 2.4 GHz only in practice (confirmed on hardware per wifi-bluetooth-aic8800.md:10: iw phy shows 1 band, 0 5 GHz channels, despite AIC8800DC being marketed dual-band-capable elsewhere). "AIC8800DW" appears loosely in some sources for the same part; the board .mk is authoritative.

6. Verify steps

Follow the existing A/B _b-slot hardware-verification loop (warden-sdk/kernel/docs/m2-boot-on-c8a3.md), same method M1–M3 already used:

1. Build: driver compiles clean into the 6.18.46 tree (make ... modules is not the target — it's =y, so this is just make zImage/whatever M2's build-m2.sh wraps, succeeding with the new drivers/net/wireless/aic8800/ objects linked into vmlinux/the zImage).
2. Probe: boot on warden-c8a3, confirm in dmesg: the sdmmc MMC host binds (dwmmc_rockchip ffaa0000.mmc: ..., same pattern M3 already proved for ffa90000.mmc/eMMC), then an SDIO card enumerates on it, then aic8800_bsp's probe fires (vendor/device ID match, firmware file opens succeed — watch specifically for AIC_FW_PATH resolution failures, §5), then aic8800_fdrv attaches and wlan0 appears in ip link.
3. cfg80211 sanity: iw phy shows the expected single 2.4 GHz band/14 channels (matching the known-good 5.10 baseline in wifi-bluetooth-aic8800.md:10 — a mismatch here is a signal something in the cfg80211/wiphy port is wrong, not a chip regression).
4. Scan: iw dev wlan0 scan returns nearby APs — exercises rwnx_cfg80211_scan/cfg80211_scan_done() and, indirectly, whether the wiphy-locking port (§3.3) is functioning rather than deadlocking.
5. Connect: associate to a real AP (wpa_supplicant/wpa_cli, matching WardenOS's own wlan0 ownership model — do not start rkwifi_server, §1) and confirm COMPLETED state plus a DHCP lease — exercises rwnx_cfg80211_connect/cfg80211_connect_result().
6. Known-regression checks (carry forward, don't re-discover): confirm the two hardening patches (§0/§4.1) are actually effective — no console-flood "cmd timed-out" spam under load, and no CPU-pinning busy-spin if the SDIO link is stressed (aicwf_bustx_thr should sleep, not spin, on a wakeup failure). Confirm iw dev wlan0 set power_save off still behaves as expected (a wall-powered panel, no reason to want power-save — wifi-bluetooth-aic8800.md:41).
7. BT (secondary to WiFi but same milestone): confirm aic8800_btlpm attaches and hciattach -s 1500000 /dev/ttyS1 any 1500000 flow nosleep (the known-good invocation) brings up an HCI device.
8. Update on landing: mark the AIC8800 wifi (bsp/fdrv) and AIC8800 BT (btlpm) rows in ../DRIVER-PARITY.md [x], with the same "hardware-verified, not just compiled" bar every other row uses.

Sources

• Local (SDK/repo evidence, cited inline above by path:line): flare-edge/sdk/sysdrv/drv_ko/wifi/aic8800dc/**, flare-edge/sdk/sysdrv/drv_ko/wifi/Makefile, flare-edge/sdk/sysdrv/source/kernel/arch/arm/boot/dts/{rv1106.dtsi,rv1106-pinctrl.dtsi,rv1106g-luckfox-pico-86panel.dts}, flare-edge/sdk/sysdrv/source/kernel/arch/arm/configs/{rv1106-sdiowifi.config,luckfox_rv1106_linux_defconfig}, flare-edge/*/sdk-patches/wifi/patches/*.patch, flare-edge/research/linux-6.18.46/.config (live, post-M3, batch2 CFG80211=y), flare-edge/research/linux-6.18.46/include/net/cfg80211.h (directly read to verify wiphy_new, cfg80211_connect_result, wiphy_lock/lockdep_assert_wiphy against the actual target tree, not release notes — §3.3), flare-edge/research/plan44-openwrt/ (checked, no aic8800), warden-sdk/kernel/rv1106-enablement/{PORT-STATUS.md,DRIVER-PARITY.md,OVERNIGHT-PLAN.md}, warden-sdk/kernel/docs/{bringup.md,m2-boot-on-c8a3.md}, luckfox-pico-86-panel/{wifi-bluetooth-aic8800.md,hardware-86-panel.md,alternative-bsps.md,sdk-patches.md,boot-chain.md}.
• Web (via research pass, see §0/§2): github.com/radxa-pkg/aic8800 + deepwiki.com/radxa-pkg/aic8800; forum.armbian.com topic 50332 ("AIC8800 wifi sdio module not working with kernel 6.12+"); kernel.org/patchwork commits 9b13df3fb64e (timer_delete rename), 2655926aea9b (netif_rx_ni removal), a05829a7222e (wiphy-lock RTNL migration start); kernelnewbies.org/Linux_6.12; LKML/lkml.iu.edu mirrors for the timer-rename and wiphy-guard series. Patchwork/LWN direct fetches were partially blocked by anti-bot walls during research, so the exact commit/version the wiphy-lock migration landed in is not pinned precisely — but its presence and current contract in the actual 6.18.46 tree we're porting to is directly confirmed (previous paragraph), which is the fact that actually matters for this port.