patches/driver/bes2600/*-danctnix + arch/arm64/scs-...: rebased on danctnix baseline (#29 redo)

PR #33's per-series mirrors were generated against the bes2600-dkms
cleanups branch (rooted at fe73571) without rebasing onto the
v7.0-danctnix1 kernel baseline. Result: per-commit diffs carried
stale baseline context (e.g. from_timer rather than the new
timer_container_of API), so the cumulative no longer applied cleanly
to ohm's actual base. pkgrel=6 build #1 failed with 'Hunk #3 FAILED'
in Patch D's sta.c.

Fix: in marfrit/bes2600-dkms, create danctnix-sync branch
(fe73571 + drop-in replace bes2600/ with v7.0-danctnix1's
drivers/staging/bes2600/), rebase cleanups onto it as
cleanups-rebased-on-danctnix, manually resolve the resulting conflicts
keeping each commit's intent + the new baseline context, rebase
Patch H accordingly. Format-patch and re-route to the same series-dir
names as PR #33.

Conflict resolution notes:
- 'remove userspace /dev/bes2600 character device interface' commit:
  the chardev wrapper was removed but two utility funcs that danctnix's
  bes2600_btuart.c depends on (bes2600_chrdev_is_bus_error,
  bes2600_chrdev_switch_subsys_glb) were re-added with EXPORT_SYMBOL_GPL.
  bes2600_switch_bt re-added as static (file-local, called only from
  bes2600_chrdev_switch_subsys_glb).
- Patch D (atomicize ba_lock): re-resolved bes2600_ba_timer's
  timer_container_of() vs from_timer() to keep the new API.
- SCS Makefile @@ hunk counts corrected from -9,6 +9,10 to -9,6 +9,11
  (the original was actually wrong; build-via-fuzz was masking it).

Cumulative b2sum: ka-promote ohm now emits
  eb179c03f35a4dbaec2e40036f0033ef04985bb6b14ab22419d68e5caaa5874f...
  (279 554 bytes, 32 patches resolved).

pkgrel=6 built from this manifest + installed on ohm 2026-05-19 ~23:39.
Functional verification: bes2600 + bes2600_btuart both load, Pattern A
0 over fresh boot, wlan0 associates to newton. srcversion
1A919EED0E6DC2478559B17 differs from pkgrel=5's BEB625FA... — the
reconstruction is functionally equivalent (5 GHz working, no
firmware/driver race conditions) but NOT byte-equivalent (the chardev
utility re-add chose different formatting than the original danctnix
code). Byte-equivalence is not a goal; per-series traceability and
working hardware are.

Closes (proper this time): #29.
Refs: #28, #30, #33 (the half-working attempt), #31, #32.

patches/driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch

@@ -1,4 +1,4 @@
-From 4bc0a34c94094d9e896c5a2f45b54d8be6c0fca7 Mon Sep 17 00:00:00 2001
+From 737f28e29c4b8253939e24b1d6b97d5605bb7ac4 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 21:19:49 +0200
 Subject: [PATCH 22/29] bes2600: replace a set of atomic_add()
@@ -23,10 +23,10 @@ Cherry-picked from upstream Linux:
  2 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bh.c b/drivers/staging/bes2600/bh.c
-index 6385312..1d2773c 100644
+index 175ab5e..fab3bf0 100644
 --- a/drivers/staging/bes2600/bh.c
 +++ b/drivers/staging/bes2600/bh.c
-@@ -101,7 +101,7 @@ void bes2600_unregister_bh(struct bes2600_common *hw_priv)
+@@ -102,7 +102,7 @@ void bes2600_unregister_bh(struct bes2600_common *hw_priv)
  	coex_deinit_mode(hw_priv);
  #endif
  
@@ -35,7 +35,7 @@ index 6385312..1d2773c 100644
  	wake_up(&hw_priv->bh_wq);
  
  	flush_workqueue(hw_priv->bh_workqueue);
-@@ -590,7 +590,7 @@ static int bes2600_bh(void *arg)
+@@ -591,7 +591,7 @@ static int bes2600_bh(void *arg)
  			bes_devel("[BH] Device resume.\n");
  			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
  			wake_up(&hw_priv->bh_evt_wq);
@@ -44,7 +44,7 @@ index 6385312..1d2773c 100644
  			continue;
  		}
  
-@@ -758,9 +758,9 @@ tx:
+@@ -759,9 +759,9 @@ tx:
  
  #if 0 /* count is not implemented */
  				if (ret > 1)
@@ -56,7 +56,7 @@ index 6385312..1d2773c 100644
  #endif
  
  #if defined(CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES)
-@@ -1134,7 +1134,7 @@ static int bes2600_bh_tx_helper(struct bes2600_common *hw_priv,
+@@ -1135,7 +1135,7 @@ static int bes2600_bh_tx_helper(struct bes2600_common *hw_priv,
  	tx_len += 4;
  #endif
  
@@ -65,7 +65,7 @@ index 6385312..1d2773c 100644
  
  	tx_len = hw_priv->sbus_ops->align_size(
  		hw_priv->sbus_priv, tx_len);
-@@ -1435,7 +1435,7 @@ static int bes2600_bh(void *arg)
+@@ -1442,7 +1442,7 @@ static int bes2600_bh(void *arg)
  			bes_devel("[BH] Device resume.\n");
  			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
  			wake_up(&hw_priv->bh_evt_wq);

patches/driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch

@@ -1,4 +1,4 @@
-From 65a4c39914f07bcb0fc01ea78b974e6901d3377d Mon Sep 17 00:00:00 2001
+From 2fb72f06e54172479662257ae4ef9a61d6ba7092 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 21:20:46 +0200
 Subject: [PATCH 23/29] bes2600: fix missing destroy_workqueue() on error in
@@ -34,10 +34,10 @@ Cherry-picked from upstream Linux:
  1 file changed, 2 insertions(+)
 
 diff --git a/drivers/staging/bes2600/main.c b/drivers/staging/bes2600/main.c
-index d6da84a..90a8ff8 100644
+index ff82f4d..89b5e2d 100644
 --- a/drivers/staging/bes2600/main.c
 +++ b/drivers/staging/bes2600/main.c
-@@ -497,6 +497,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
+@@ -502,6 +502,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
  			WLAN_LINK_ID_MAX,
  			bes2600_skb_dtor,
  			hw_priv))) {
@@ -45,7 +45,7 @@ index d6da84a..90a8ff8 100644
  		ieee80211_free_hw(hw);
  		return NULL;
  	}
-@@ -508,6 +509,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
+@@ -513,6 +514,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
  			for (; i > 0; i--)
  				bes2600_queue_deinit(&hw_priv->tx_queue[i - 1]);
  			bes2600_queue_stats_deinit(&hw_priv->tx_queue_stats);

patches/driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch

@@ -1,4 +1,4 @@
-From b717251598c95bb7ce7822ffa103216598f19b67 Mon Sep 17 00:00:00 2001
+From d9e6361cf0c273f07aee94f24533a5f19e7ed4c0 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 21:24:01 +0200
 Subject: [PATCH 24/29] bes2600: fix concurrency UAF in bes2600_hw_scan and
@@ -38,7 +38,7 @@ Cherry-picked from upstream Linux:
  1 file changed, 22 insertions(+), 15 deletions(-)
 
 diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
-index ad5033b..16b5d0f 100644
+index b944adc..3cd7b64 100644
 --- a/drivers/staging/bes2600/scan.c
 +++ b/drivers/staging/bes2600/scan.c
 @@ -257,18 +257,21 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,