BPI-CM4 IO: RTW88: Realtek 8822CS SDIO Wireless Support

Additional driver support:
Realtek 8822BS SDIO wireless network adapter
Realtek 8822BU USB wireless network adapter
Realtek 8822CS SDIO wireless network adapter
Realtek 8822CU USB wireless network adapter
Realtek 8821CS SDIO wireless network adapter
Realtek 8821CU USB wireless network adapter

Signed-off-by: Patrick Yavitz <pyavitz@gmail.com>

config/kernel/linux-meson64-current.config

@@ -3552,6 +3552,8 @@ CONFIG_RTW88_8821C=m
 # CONFIG_RTW88_8822CE is not set
 # CONFIG_RTW88_8723DE is not set
 CONFIG_RTW88_8821CE=m
+CONFIG_RTW88_8821CS=m
+CONFIG_RTW88_8822CS=m
 # CONFIG_RTW88_DEBUG is not set
 # CONFIG_RTW88_DEBUGFS is not set
 # CONFIG_RTW89 is not set

config/kernel/linux-meson64-edge.config

@@ -3571,6 +3571,8 @@ CONFIG_RTW88_8821C=m
 # CONFIG_RTW88_8723DE is not set
 # CONFIG_RTW88_8723DU is not set
 CONFIG_RTW88_8821CE=m
+CONFIG_RTW88_8821CS=m
+CONFIG_RTW88_8822CS=m
 # CONFIG_RTW88_8821CU is not set
 # CONFIG_RTW88_DEBUG is not set
 # CONFIG_RTW88_DEBUGFS is not set

lib/functions/compilation/patch/drivers-harness.sh

@@ -81,6 +81,7 @@ function kernel_drivers_prepare_harness() {
 		driver_rtl8811CU_rtl8821C
 		driver_rtl8188EU_rtl8188ETV
 		driver_rtl88x2bu
+		driver_rtw88
 		driver_rtl88x2cs
 		driver_rtl8822cs_bt
 		driver_rtl8723DS

lib/functions/compilation/patch/drivers_network.sh

@@ -387,11 +387,27 @@ driver_rtl88x2bu() {
 
 }
 
+driver_rtw88() {
+	# Upstream wireless RTW88 drivers
+	if linux-version compare "${version}" ge 6.1 && [ $EXTRAWIFI == yes ]; then
+		display_alert "Adding" "Upstream wireless RTW88 drivers" "info"
+		process_patch_file "${SRC}/patch/misc/rtw88/6.1/001-rtw88-linux-next-backport.patch" "applying"
+		process_patch_file "${SRC}/patch/misc/rtw88/6.1/002-rtw88-fix-rcu-lock.patch" "applying"
+		process_patch_file "${SRC}/patch/misc/rtw88/6.1/003-rtw88-rfc.patch" "applying"
+		process_patch_file "${SRC}/patch/misc/rtw88/6.1/004-rtw88-usb-fixes.patch" "applying"
+		process_patch_file "${SRC}/patch/misc/rtw88/6.1/005-rtw88-mac-c-fix.patch" "applying"
+	fi
+	if linux-version compare "${version}" ge 6.3 && [ $EXTRAWIFI == yes ]; then
+		display_alert "Adding" "Upstream wireless drivers for RTW88" "info"
+		process_patch_file "${SRC}/patch/misc/rtw88/6.3/001-rtw88-sdio-rfc.patch" "applying"
+	fi
+}
+
 driver_rtl88x2cs() {
 
 	# Wireless drivers for Realtek 88x2cs chipsets
 
-	if linux-version compare "${version}" ge 5.9 && [ "$EXTRAWIFI" == yes ]; then
+	if linux-version compare "${version}" ge 5.9 && [ "$EXTRAWIFI" == no ]; then
 
 		# attach to specifics tag or branch
 		local rtl88x2csver="branch:tune_for_jethub"
@@ -672,6 +688,7 @@ patch_drivers_network() {
 	driver_rtl8811CU_rtl8821C
 	driver_rtl8188EU_rtl8188ETV
 	driver_rtl88x2bu
+	driver_rtw88
 	driver_rtl88x2cs
 	driver_rtl8822cs_bt
 	driver_rtl8723DS

patch/misc/rtw88/6.1/002-rtw88-fix-rcu-lock.patch

@@ -0,0 +1,302 @@
+From:   Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+To:     linux-wireless@vger.kernel.org
+Cc:     tony0620emma@gmail.com, kvalo@kernel.org, pkshih@realtek.com,
+        s.hauer@pengutronix.de, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org,
+        Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Subject: [PATCH v3 0/3] wifi: rtw88: Three locking fixes for existing code
+Date:   Sun,  8 Jan 2023 22:13:21 +0100
+Message-Id: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+X-Mailer: git-send-email 2.39.0
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+This series consists of three patches which are fixing existing
+behavior (meaning: it either affects PCIe or USB or both) in the rtw88
+driver.
+We previously had discussed patches for these locking issues while
+working on SDIO support, but the problem never ocurred while testing
+USB cards. It turns out that these are still needed and I think that
+they also fix the same problems for USB users (it's not clear how often
+it happens there though) - and possibly even PCIe card users.
+
+The issue fixed by the second and third patches have been spotted by a
+user who tested rtw88 SDIO support. Everything is working fine for him
+but there are warnings [1] and [2] in the kernel log stating "Voluntary
+context switch within RCU read-side critical section!".
+
+The solution in the third and fourth patch was actually suggested by
+Ping-Ke in [3]. Thanks again!
+
+These fixes are indepdent of my other series adding SDIO support to the
+rtw88 driver, meaning they can be added to the wireless driver tree on
+top of Linux 6.2-rc1 or linux-next.
+
+
+Changes since v1 at [4]:
+- Keep the u8 bitfields in patch 1 but split the res2 field into res2_1
+  and res2_2 as suggested by Ping-Ke
+- Added Ping-Ke's reviewed-by to patches 2-4 - thank you!
+- Added a paragraph in the cover-letter to avoid confusion whether
+  these patches depend on the rtw88 SDIO support series
+
+Changes since v2 at [5]:
+- Added Ping-Ke's Reviewed-by and Sascha's Tested-by (thanks to both of
+  you!)
+- Dropped patch 1/4 "rtw88: Add packed attribute to the eFuse structs"
+  This requires more discussion. I'll send a separate patch for this.
+- Updated cover letter title so it's clear that this is independent of
+  SDIO support code
+
+
+[0] https://lore.kernel.org/linux-wireless/695c976e02ed44a2b2345a3ceb226fc4@realtek.com/
+[1] https://github.com/LibreELEC/LibreELEC.tv/pull/7301#issuecomment-1366421445
+[2] https://github.com/LibreELEC/LibreELEC.tv/pull/7301#issuecomment-1366610249
+[3] https://lore.kernel.org/lkml/e0aa1ba4336ab130712e1fcb425e6fd0adca4145.camel@realtek.com/
+[4] https://lore.kernel.org/linux-wireless/20221228133547.633797-1-martin.blumenstingl@googlemail.com/
+[5] https://lore.kernel.org/linux-wireless/20221229124845.1155429-1-martin.blumenstingl@googlemail.com/
+
+
+Martin Blumenstingl (3):
+  wifi: rtw88: Move register access from rtw_bf_assoc() outside the RCU
+  wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
+  wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
+
+ drivers/net/wireless/realtek/rtw88/bf.c       | 13 +++++++------
+ drivers/net/wireless/realtek/rtw88/mac80211.c |  4 +++-
+ drivers/net/wireless/realtek/rtw88/main.c     |  6 ++++--
+ 3 files changed, 14 insertions(+), 9 deletions(-)
+
+-- 
+2.39.0
+
+From:   Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+To:     linux-wireless@vger.kernel.org
+Cc:     tony0620emma@gmail.com, kvalo@kernel.org, pkshih@realtek.com,
+        s.hauer@pengutronix.de, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org,
+        Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Subject: [PATCH v3 1/3] wifi: rtw88: Move register access from rtw_bf_assoc() outside the RCU
+Date:   Sun,  8 Jan 2023 22:13:22 +0100
+Message-Id: <20230108211324.442823-2-martin.blumenstingl@googlemail.com>
+X-Mailer: git-send-email 2.39.0
+In-Reply-To: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+References: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+USB and (upcoming) SDIO support may sleep in the read/write handlers.
+Shrink the RCU critical section so it only cover the call to
+ieee80211_find_sta() and finding the ic_vht_cap/vht_cap based on the
+found station. This moves the chip's BFEE configuration outside the
+rcu_read_lock section and thus prevent "scheduling while atomic" or
+"Voluntary context switch within RCU read-side critical section!"
+warnings when accessing the registers using an SDIO card (which is
+where this issue has been spotted in the real world - but it also
+affects USB cards).
+
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+---
+v1 -> v2:
+- Added Ping-Ke's Reviewed-by (thank you!)
+
+v2 -> v3:
+- Added Sascha's Tested-by (thank you!)
+- added "wifi" prefix to the subject and reworded the title accordingly
+
+
+ drivers/net/wireless/realtek/rtw88/bf.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/bf.c b/drivers/net/wireless/realtek/rtw88/bf.c
+index 038a30b170ef..c827c4a2814b 100644
+--- a/drivers/net/wireless/realtek/rtw88/bf.c
++++ b/drivers/net/wireless/realtek/rtw88/bf.c
+@@ -49,19 +49,23 @@ void rtw_bf_assoc(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
+ 
+ 	sta = ieee80211_find_sta(vif, bssid);
+ 	if (!sta) {
++		rcu_read_unlock();
++
+ 		rtw_warn(rtwdev, "failed to find station entry for bss %pM\n",
+ 			 bssid);
+-		goto out_unlock;
++		return;
+ 	}
+ 
+ 	ic_vht_cap = &hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap;
+ 	vht_cap = &sta->deflink.vht_cap;
+ 
++	rcu_read_unlock();
++
+ 	if ((ic_vht_cap->cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
+ 	    (vht_cap->cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
+ 		if (bfinfo->bfer_mu_cnt >= chip->bfer_mu_max_num) {
+ 			rtw_dbg(rtwdev, RTW_DBG_BF, "mu bfer number over limit\n");
+-			goto out_unlock;
++			return;
+ 		}
+ 
+ 		ether_addr_copy(bfee->mac_addr, bssid);
+@@ -75,7 +79,7 @@ void rtw_bf_assoc(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
+ 		   (vht_cap->cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)) {
+ 		if (bfinfo->bfer_su_cnt >= chip->bfer_su_max_num) {
+ 			rtw_dbg(rtwdev, RTW_DBG_BF, "su bfer number over limit\n");
+-			goto out_unlock;
++			return;
+ 		}
+ 
+ 		sound_dim = vht_cap->cap &
+@@ -98,9 +102,6 @@ void rtw_bf_assoc(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
+ 
+ 		rtw_chip_config_bfee(rtwdev, rtwvif, bfee, true);
+ 	}
+-
+-out_unlock:
+-	rcu_read_unlock();
+ }
+ 
+ void rtw_bf_init_bfer_entry_mu(struct rtw_dev *rtwdev,
+-- 
+2.39.0
+
+From:   Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+To:     linux-wireless@vger.kernel.org
+Cc:     tony0620emma@gmail.com, kvalo@kernel.org, pkshih@realtek.com,
+        s.hauer@pengutronix.de, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org,
+        Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Subject: [PATCH v3 2/3] wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
+Date:   Sun,  8 Jan 2023 22:13:23 +0100
+Message-Id: <20230108211324.442823-3-martin.blumenstingl@googlemail.com>
+X-Mailer: git-send-email 2.39.0
+In-Reply-To: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+References: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+USB and (upcoming) SDIO support may sleep in the read/write handlers.
+Make rtw_watch_dog_work() use rtw_iterate_vifs() to prevent "scheduling
+while atomic" or "Voluntary context switch within RCU read-side
+critical section!" warnings when accessing the registers using an SDIO
+card (which is where this issue has been spotted in the real world but
+it also affects USB cards).
+
+Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically")
+Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+---
+v1 -> v2:
+- no change
+
+v2 -> v3:
+- Added Ping-Ke's Reviewed-by (thank you!)
+- Added Sascha's Tested-by (thank you!)
+- added "wifi" prefix to the subject and reworded the title accordingly
+
+
+ drivers/net/wireless/realtek/rtw88/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 888427cf3bdf..b2e78737bd5d 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -241,8 +241,10 @@ static void rtw_watch_dog_work(struct work_struct *work)
+ 	rtw_phy_dynamic_mechanism(rtwdev);
+ 
+ 	data.rtwdev = rtwdev;
+-	/* use atomic version to avoid taking local->iflist_mtx mutex */
+-	rtw_iterate_vifs_atomic(rtwdev, rtw_vif_watch_dog_iter, &data);
++	/* rtw_iterate_vifs internally uses an atomic iterator which is needed
++	 * to avoid taking local->iflist_mtx mutex
++	 */
++	rtw_iterate_vifs(rtwdev, rtw_vif_watch_dog_iter, &data);
+ 
+ 	/* fw supports only one station associated to enter lps, if there are
+ 	 * more than two stations associated to the AP, then we can not enter
+-- 
+2.39.0
+
+From:   Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+To:     linux-wireless@vger.kernel.org
+Cc:     tony0620emma@gmail.com, kvalo@kernel.org, pkshih@realtek.com,
+        s.hauer@pengutronix.de, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org,
+        Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Subject: [PATCH v3 3/3] wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
+Date:   Sun,  8 Jan 2023 22:13:24 +0100
+Message-Id: <20230108211324.442823-4-martin.blumenstingl@googlemail.com>
+X-Mailer: git-send-email 2.39.0
+In-Reply-To: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+References: <20230108211324.442823-1-martin.blumenstingl@googlemail.com>
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+USB and (upcoming) SDIO support may sleep in the read/write handlers.
+Use non-atomic rtw_iterate_stas() in rtw_ra_mask_info_update() because
+the iterator function rtw_ra_mask_info_update_iter() needs to read and
+write registers from within rtw_update_sta_info(). Using the non-atomic
+iterator ensures that we can sleep during USB and SDIO register reads
+and writes. This fixes "scheduling while atomic" or "Voluntary context
+switch within RCU read-side critical section!" warnings as seen by SDIO
+card users (but it also affects USB cards).
+
+Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically")
+Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+---
+v1 -> v2:
+- Added Ping-Ke's Reviewed-by (thank you!)
+
+v2 -> v3:
+- Added Sascha's Tested-by (thank you!)
+- added "wifi" prefix to the subject and reworded the title accordingly
+
+
+ drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
+index 776a9a9884b5..3b92ac611d3f 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -737,7 +737,7 @@ static void rtw_ra_mask_info_update(struct rtw_dev *rtwdev,
+ 	br_data.rtwdev = rtwdev;
+ 	br_data.vif = vif;
+ 	br_data.mask = mask;
+-	rtw_iterate_stas_atomic(rtwdev, rtw_ra_mask_info_update_iter, &br_data);
++	rtw_iterate_stas(rtwdev, rtw_ra_mask_info_update_iter, &br_data);
+ }
+ 
+ static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw,
+@@ -746,7 +746,9 @@ static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw,
+ {
+ 	struct rtw_dev *rtwdev = hw->priv;
+ 
++	mutex_lock(&rtwdev->mutex);
+ 	rtw_ra_mask_info_update(rtwdev, vif, mask);
++	mutex_unlock(&rtwdev->mutex);
+ 
+ 	return 0;
+ }
+-- 
+2.39.0

patch/misc/rtw88/6.1/004-rtw88-usb-fixes.patch

@@ -0,0 +1,86 @@
+We have to extract qsel from the skb before doing skb_push() on it,
+otherwise qsel will always be 0.
+
+Fixes: a82dfd33d1237 ("wifi: rtw88: Add common USB chip support")
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
+index 4ef38279b64c9..d9e995544e405 100644
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -471,9 +471,9 @@ static int rtw_usb_tx_write(struct rtw_dev *rtwdev,
+ 	u8 *pkt_desc;
+ 	int ep;
+ 
++	pkt_info->qsel = rtw_usb_tx_queue_mapping_to_qsel(skb);
+ 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
+ 	memset(pkt_desc, 0, chip->tx_pkt_desc_sz);
+-	pkt_info->qsel = rtw_usb_tx_queue_mapping_to_qsel(skb);
+ 	ep = qsel_to_ep(rtwusb, pkt_info->qsel);
+ 	rtw_tx_fill_tx_desc(pkt_info, skb);
+ 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, skb->data);
+
+Zero length packets are necessary when sending URBs with size
+multiple of bulkout_size, otherwise the hardware just stalls.
+
+Fixes: a82dfd33d1237 ("wifi: rtw88: Add common USB chip support")
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
+index d9e995544e405..1a09c9288198a 100644
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -271,6 +271,7 @@ static int rtw_usb_write_port(struct rtw_dev *rtwdev, u8 qsel, struct sk_buff *s
+ 		return -ENOMEM;
+ 
+ 	usb_fill_bulk_urb(urb, usbd, pipe, skb->data, skb->len, cb, context);
++	urb->transfer_flags |= URB_ZERO_PACKET;
+ 	ret = usb_submit_urb(urb, GFP_ATOMIC);
+ 
+ 	usb_free_urb(urb);
+
+Now that we send URBs with the URB_ZERO_PACKET flag set we no longer
+need to make sure that the URB sizes are not multiple of the
+bulkout_size. Drop the check.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
+index 1a09c9288198a..2a8336b1847a5 100644
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -414,24 +414,11 @@ static int rtw_usb_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf,
+ 					u32 size)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+-	struct rtw_usb *rtwusb;
+ 	struct rtw_tx_pkt_info pkt_info = {0};
+-	u32 len, desclen;
+-
+-	rtwusb = rtw_get_usb_priv(rtwdev);
+ 
+ 	pkt_info.tx_pkt_size = size;
+ 	pkt_info.qsel = TX_DESC_QSEL_BEACON;
+-
+-	desclen = chip->tx_pkt_desc_sz;
+-	len = desclen + size;
+-	if (len % rtwusb->bulkout_size == 0) {
+-		len += RTW_USB_PACKET_OFFSET_SZ;
+-		pkt_info.offset = desclen + RTW_USB_PACKET_OFFSET_SZ;
+-		pkt_info.pkt_offset = 1;
+-	} else {
+-		pkt_info.offset = desclen;
+-	}
++	pkt_info.offset = chip->tx_pkt_desc_sz;
+ 
+ 	return rtw_usb_write_data(rtwdev, &pkt_info, buf);
+ }

patch/misc/rtw88/6.1/005-rtw88-mac-c-fix.patch

@@ -0,0 +1,146 @@
+diff -Naur a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+--- a/drivers/net/wireless/realtek/rtw88/mac.c	2023-05-17 05:54:00.000000000 -0400
++++ b/drivers/net/wireless/realtek/rtw88/mac.c	2023-05-22 12:58:36.127309015 -0400
+@@ -7,6 +7,7 @@
+ #include "reg.h"
+ #include "fw.h"
+ #include "debug.h"
++#include "sdio.h"
+ 
+ void rtw_set_channel_mac(struct rtw_dev *rtwdev, u8 channel, u8 bw,
+ 			 u8 primary_ch_idx)
+@@ -60,6 +61,7 @@
+ 
+ static int rtw_mac_pre_system_cfg(struct rtw_dev *rtwdev)
+ {
++	unsigned int retry;
+ 	u32 value32;
+ 	u8 value8;
+ 
+@@ -77,6 +79,26 @@
+ 	case RTW_HCI_TYPE_PCIE:
+ 		rtw_write32_set(rtwdev, REG_HCI_OPT_CTRL, BIT_USB_SUS_DIS);
+ 		break;
++	case RTW_HCI_TYPE_SDIO:
++		rtw_write8_clr(rtwdev, REG_SDIO_HSUS_CTRL, BIT(0));
++
++		for (retry = 0; retry < RTW_PWR_POLLING_CNT; retry++) {
++			if (rtw_read8(rtwdev, REG_SDIO_HSUS_CTRL) & BIT(1))
++				break;
++
++			usleep_range(10, 50);
++		}
++
++		if (retry == RTW_PWR_POLLING_CNT) {
++			rtw_err(rtwdev, "failed to poll REG_SDIO_HSUS_CTRL[1]");
++			return -ETIMEDOUT;
++		}
++
++		if (rtw_sdio_is_sdio30_supported(rtwdev))
++			rtw_write8_set(rtwdev, REG_HCI_OPT_CTRL + 2, BIT(2));
++		else
++			rtw_write8_clr(rtwdev, REG_HCI_OPT_CTRL + 2, BIT(2));
++		break;
+ 	case RTW_HCI_TYPE_USB:
+ 		break;
+ 	default:
+@@ -217,10 +239,13 @@
+ 	cut_mask = cut_version_to_mask(cut);
+ 	switch (rtw_hci_type(rtwdev)) {
+ 	case RTW_HCI_TYPE_PCIE:
+-		intf_mask = BIT(2);
++		intf_mask = RTW_PWR_INTF_PCI_MSK;
+ 		break;
+ 	case RTW_HCI_TYPE_USB:
+-		intf_mask = BIT(1);
++		intf_mask = RTW_PWR_INTF_USB_MSK;
++		break;
++	case RTW_HCI_TYPE_SDIO:
++		intf_mask = RTW_PWR_INTF_SDIO_MSK;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -245,6 +270,7 @@
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	const struct rtw_pwr_seq_cmd **pwr_seq;
++	u32 imr;
+ 	u8 rpwm;
+ 	bool cur_pwr;
+ 	int ret;
+@@ -270,16 +296,28 @@
+ 	if (pwr_on == cur_pwr)
+ 		return -EALREADY;
+ 
++	/* Always signal power off before power sequence. This way
++	 * read/write functions will take path which works in both
++	 * states. State will change in the middle of the sequence.
++	 */
++	rtw_hci_power_switch(rtwdev, false);
++
++	imr = rtw_read32(rtwdev, REG_SDIO_HIMR);
++	rtw_write32(rtwdev, REG_SDIO_HIMR, 0);
++
+ 	pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq;
+-	ret = rtw_pwr_seq_parser(rtwdev, pwr_seq);
+-	if (ret)
+-		return ret;
++	if (rtw_pwr_seq_parser(rtwdev, pwr_seq)) {
++		rtw_write32(rtwdev, REG_SDIO_HIMR, imr);
++ 		return -EINVAL;
++	}
+ 
+ 	if (pwr_on)
+ 		set_bit(RTW_FLAG_POWERON, rtwdev->flags);
+ 	else
+ 		clear_bit(RTW_FLAG_POWERON, rtwdev->flags);
+ 
++	rtw_hci_power_switch(rtwdev, pwr_on);
++
+ 	return 0;
+ }
+ 
+@@ -451,6 +489,9 @@
+ 	rtw_write16(rtwdev, REG_FIFOPAGE_INFO_1, 0x200);
+ 	rtw_write32(rtwdev, REG_RQPN_CTRL_2, bckp[bckp_idx - 1].val);
+ 
++	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_SDIO)
++		rtw_read32(rtwdev, REG_SDIO_FREE_TXPG);
++
+ 	/* Disable beacon related functions */
+ 	tmp = rtw_read8(rtwdev, REG_BCN_CTRL);
+ 	bckp[bckp_idx].len = 1;
+@@ -1026,6 +1067,9 @@
+ 		else
+ 			return -EINVAL;
+ 		break;
++	case RTW_HCI_TYPE_SDIO:
++		rqpn = &chip->rqpn_table[0];
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -1044,6 +1088,13 @@
+ 	if (rtw_chip_wcpu_11ac(rtwdev))
+ 		rtw_write32(rtwdev, REG_H2CQ_CSR, BIT_H2CQ_FULL);
+ 
++	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_SDIO) {
++		rtw_read32(rtwdev, REG_SDIO_FREE_TXPG);
++		rtw_write32(rtwdev, REG_SDIO_TX_CTRL, 0);
++	} else if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB) {
++		rtw_write8_set(rtwdev, REG_TXDMA_PQ_MAP, BIT_RXDMA_ARBBW_EN);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1185,6 +1236,9 @@
+ 		else
+ 			return -EINVAL;
+ 		break;
++	case RTW_HCI_TYPE_SDIO:
++		pg_tbl = &chip->page_table[0];
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}