bes2600: default STANDARD_FACTORY_EFUSE_FLAG off for PineTab2 factory.txt format

The shipped factory calibration file bes2600_factory.txt on PineTab2
(danctnix linux-firmware 0.3.5_2023.0209) contains 30 calibration
fields: head (3), iq/xtal (3), 2.4G power 11n (5), 5G power 11n (15),
bt (4). The file terminates with '%%\n' directly after edr_power.

When STANDARD_FACTORY_EFUSE_FLAG is defined at compile time the driver
assembles STANDARD_FACTORY with an extra select_efuse_flag section
appended and expects 31 sscanf matches (FACTORY_MEMBER_NUM=31):

    __STANDARD_FACTORY + \"##select_efuse_flag\\nselect_efuse:%hx\\n\"
                      + \"%%%%\\n\"

The PineTab2 factory.txt has no select_efuse_flag section, so sscanf
stops after field 30 and factory_parse() returns -1 with:

    bes2600_factory.txt parse fail
    read and check bes2600/bes2600_factory.txt error
    factory cali data get failed.

This was latent until the preceding patch (use request_firmware() for
factory.txt read) fixed the path bug that masked the parse failure.

Default STANDARD_FACTORY_EFUSE_FLAG to n. The flag remains overridable
at build time (make STANDARD_FACTORY_EFUSE_FLAG=y ...) for chips /
firmware packages that do ship the select_efuse_flag section.

Also: the wsm_save_factory_txt_to_mcu() prototype in wsm.h was
inconsistently wrapped in a conditional that keyed on
STANDARD_FACTORY_EFUSE_FLAG, but the function definition in wsm.c and
the call site in sta.c are ungated. With the flag now defaulting to
n, the gcc -Werror=missing-prototypes flag breaks the build. Drop the
conditional wrapper around the prototype — the function exists and is
used regardless of the factory-parse flag.

Tested-on: PineTab2 (BES2600WM + RK3566) running linux-pinetab2
6.19.10-danctnix1-1. With the flag defaulted off, factory_parse()
succeeds on the shipped factory.txt, factory_cali_data is populated,
and dmesg no longer shows the parse-fail / read-and-check-error /
factory-cali-data-get-failed sequence.

Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>

bes2600/Makefile

@@ -65,8 +65,8 @@ BES2600_DRV_VERSION := bes2600_0.3.5_2024.0116
 
 ifeq ($(CONFIG_BES2600_CALIB_FROM_LINUX),y)
 FACTORY_CRC_CHECK                    ?= n
-STANDARD_FACTORY_EFUSE_FLAG          ?= y
-FACTORY_PATH                 ?= /lib/firmware/bes2600_factory.txt
+STANDARD_FACTORY_EFUSE_FLAG          ?= n
+FACTORY_PATH                 ?= bes2600/bes2600_factory.txt
 endif
 
 # basic function

bes2600/ap.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * AP mode for BES2600 mac80211 driver
+ * mac80211 STA and AP API for mac80211 BES2600 drivers
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include "bes2600.h"
@@ -14,7 +17,6 @@
 #include <linux/umh.h>
 #include "epta_request.h"
 #include "epta_coex.h"
-#include "txrx_opt.h"
 
 #ifdef AP_HT_CAP_UPDATE
 #define HT_INFO_OFFSET 4
@@ -63,11 +65,8 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct bes2600_vif *priv = cw12xx_get_vif_from_ieee80211(vif);
 	struct bes2600_link_entry *entry;
 	struct sk_buff *skb;
-	struct sk_buff_head local_drain;
 	struct bes2600_common *hw_priv = hw->priv;
 
-	__skb_queue_head_init(&local_drain);
-
 #ifdef P2P_MULTIVIF
 	WARN_ON(priv->if_id == CW12XX_GENERIC_IF_ID);
 #endif
@@ -96,17 +95,9 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 					IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
 		priv->sta_asleep_mask |= BIT(sta_priv->link_id);
 	entry->status = BES2600_LINK_HARD;
-	/*
-	 * Patch C2: splice the rx_queue out under the lock then deliver
-	 * after unlock.  ieee80211_rx_ni() runs the mac80211 RX path
-	 * synchronously (formerly ieee80211_rx_irqsafe deferred to a
-	 * tasklet); calling it from inside spin_lock_bh would hold the
-	 * lock across mac80211's full RX dispatch.
-	 */
-	skb_queue_splice_init(&entry->rx_queue, &local_drain);
+	while ((skb = skb_dequeue(&entry->rx_queue)))
+		ieee80211_rx_irqsafe(priv->hw, skb);
 	spin_unlock_bh(&priv->ps_state_lock);
-	while ((skb = __skb_dequeue(&local_drain)))
-		ieee80211_rx_ni(priv->hw, skb);
 #ifdef AP_AGGREGATE_FW_FIX
 	hw_priv->connected_sta_cnt++;
 	if(hw_priv->connected_sta_cnt>1) {
@@ -1163,7 +1154,7 @@ void bes2600_multicast_stop_work(struct work_struct *work)
 		container_of(work, struct bes2600_vif, multicast_stop_work);
 
 	if (priv->aid0_bit_set) {
-		timer_delete_sync(&priv->mcast_timeout);
+		del_timer_sync(&priv->mcast_timeout);
 		wsm_lock_tx(priv->hw_priv);
 		priv->aid0_bit_set = false;
 		bes2600_set_tim_impl(priv, false);
@@ -1173,7 +1164,7 @@ void bes2600_multicast_stop_work(struct work_struct *work)
 
 void bes2600_mcast_timeout(struct timer_list *t)
 {
-	struct bes2600_vif *priv = timer_container_of(priv, t, mcast_timeout);
+	struct bes2600_vif *priv = from_timer(priv, t, mcast_timeout);
 
 	wiphy_warn(priv->hw->wiphy,
 		"Multicast delivery timeout.\n");
@@ -1247,7 +1238,7 @@ void bes2600_suspend_resume(struct bes2600_vif *priv,
 		}
 		spin_unlock_bh(&priv->ps_state_lock);
 		if (cancel_tmo)
-			timer_delete_sync(&priv->mcast_timeout);
+			del_timer_sync(&priv->mcast_timeout);
 	} else {
 		spin_lock_bh(&priv->ps_state_lock);
 		bes2600_ps_notify(priv, arg->link_id, arg->stop);

bes2600/ap.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * AP mode interface for BES2600 mac80211 driver
+ * mac80211 STA and AP API for mac80211 BES2600 drivers
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include <linux/version.h>
 #ifndef AP_H_INCLUDED

bes2600/bes2600.h

@@ -1,15 +1,18 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Common private data for BES2600 mac80211 driver
+ * Common private data for BES2600 drivers
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
  * Based on the mac80211 Prism54 code, which is
  * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
  *
- * Based on the islsm (softmac prism54) driver, which is
+ * Based on the islsm (softmac prism54) driver, which is:
  * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_H
@@ -353,23 +356,15 @@ struct bes2600_common {
 	* Keeping in common structure for the time being. Will be moved to VIFF
 	* after the mechanism is clear */
 	u8				ba_tid_mask;
-	/*
-	 * Patch D: ba_lock removed.  Per-frame TX/RX hot-path bumped these
-	 * counters under spin_lock_bh; the lock did not protect any
-	 * compound invariant that atomic ops can't satisfy.  Counters are
-	 * now atomic_t; ba_armed gates the once-per-window mod_timer
-	 * arm via cmpxchg so concurrent TX/RX at a fresh window each
-	 * try to claim the arm and exactly one succeeds.
-	 */
-	atomic_t			ba_acc;
-	atomic_t			ba_cnt;
-	atomic_t			ba_cnt_rx;
-	atomic_t			ba_acc_rx;
-	atomic_t			ba_armed;
-	int				ba_hist;
-	struct timer_list		ba_timer;
-	atomic_t			ba_ena;
-	struct work_struct              ba_work;
+	int				ba_acc; /*TODO: Same as above */
+	int				ba_cnt; /*TODO: Same as above */
+	int				ba_cnt_rx; /*TODO: Same as above */
+	int				ba_acc_rx; /*TODO: Same as above */
+	int				ba_hist; /*TODO: Same as above */
+	struct timer_list		ba_timer;/*TODO: Same as above */
+	spinlock_t			ba_lock; /*TODO: Same as above */
+	bool				ba_ena; /*TODO: Same as above */
+	struct work_struct              ba_work; /*TODO: Same as above */
 	bool				is_BT_Present;
 	bool				is_go_thru_go_neg;
 	u8				conf_listen_interval;
@@ -516,9 +511,6 @@ struct bes2600_common {
 	struct list_head coex_event_list;
 	spinlock_t coex_event_lock;
 
-	/* Connection-loss-storm fast-recover (Trigger A). See sta.c. */
-	struct work_struct connection_loss_storm_recover_work;
-
 	/* member for low power */
 	struct bes2600_pwr_t bes_power;
 
@@ -604,11 +596,6 @@ struct bes2600_vif {
         unsigned long           rx_timestamp;
         u32                     cipherType;
 
-	/* Decrypt-storm fast-recover (Trigger B). See txrx.c. */
-	unsigned long			decrypt_storm_window_start;
-	unsigned int			decrypt_storm_count;
-	unsigned int			decrypt_storm_recoveries;
-	struct work_struct		decrypt_storm_recover_work;
 
 	/* AP powersave */
 	u32			link_id_map;
@@ -635,10 +622,6 @@ struct bes2600_vif {
 	/* CQM Implementation */
 	struct delayed_work	bss_loss_work;
 	struct delayed_work	connection_loss_work;
-	/* Connection-loss-storm fast-recover (Trigger A). See sta.c. */
-	unsigned long		connection_loss_storm_window_start;
-	unsigned int		connection_loss_storm_count;
-	unsigned int		connection_loss_storm_recoveries;
 	struct work_struct	tx_failure_work;
 	int			delayed_link_loss;
 	spinlock_t		bss_loss_lock;
@@ -873,13 +856,4 @@ int bes2600_btusb_setup_pipes(struct sbus_priv *sbus_priv);
 void bes2600_btusb_uninit(struct usb_interface *interface);
 #endif
 
-/* Decrypt-storm fast-recover helpers — see txrx.c. */
-void bes2600_decrypt_storm_init(struct bes2600_vif *priv);
-void bes2600_decrypt_storm_account(struct bes2600_vif *priv);
-
-/* Connection-loss-storm fast-recover helpers — see sta.c. */
-void bes2600_connection_loss_storm_init(struct bes2600_vif *priv);
-bool bes2600_connection_loss_storm_account(struct bes2600_vif *priv);
-void bes2600_connection_loss_storm_recover(struct work_struct *work);
-
 #endif /* BES2600_H */

bes2600/bes2600_btuart.c

@@ -1,509 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * Bestechnic BES2600 BT UART driver
- *
- * Copyright (c) 2025 Dang Huynh <dang.huynh@mainlining.org>
- */
-
-#include <linux/module.h>
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/skbuff.h>
-
-#include <linux/of.h>
-#include <linux/of_irq.h>
-
-#include <linux/device.h>
-#include <linux/pm.h>
-#include <linux/pm_wakeirq.h>
-
-#include <linux/gpio/consumer.h>
-#include <linux/pinctrl/consumer.h>
-#include <linux/serdev.h>
-
-#include <net/bluetooth/bluetooth.h>
-#include <net/bluetooth/hci_core.h>
-
-#include "bes2600.h"
-#include "bes_chardev.h"
-
-#include "h4_recv.h"
-
-struct bes2600_btuart_data {
-	struct serdev_device *serdev;
-	struct hci_dev *hdev;
-
-	struct pinctrl *pinctrl;
-	struct pinctrl_state *pinctrl_default;
-
-	/* Device tree properties */
-	struct gpio_desc *power;
-	struct gpio_desc *wakeup;
-	int speed;
-
-	unsigned long state;
-
-	int wake_irq;
-	bool opened;
-
-	int err_count; /* workaround for broken firmware */
-
-	struct sk_buff_head txq;
-	struct work_struct tx_work;
-	rwlock_t lock;
-
-	struct sk_buff *rx_skb;
-};
-
-static const struct h4_recv_pkt bes2600_btuart_recv_pkts[] = {
-	{ H4_RECV_ACL,      .recv = hci_recv_frame },
-	{ H4_RECV_SCO,      .recv = hci_recv_frame },
-	{ H4_RECV_EVENT,    .recv = hci_recv_frame },
-};
-
-static int bes2600_btuart_power(struct bes2600_btuart_data *data, bool enable)
-{
-	int ret, val;
-
-	if (enable)
-		val = 1;
-	else
-		val = 0;
-
-	ret = gpiod_set_value_cansleep(data->power, val);
-	if (ret)
-		return ret;
-
-	ret = bes2600_chrdev_switch_subsys_glb(-1, val);
-	if (ret)
-		return ret;
-
-	return 0;
-}
-
-/*
- * HACK: Potential DOS issue, not sure if the firmware can filter it but
- * there needs to be a better way to detect this. Even better, fix the firmware.
- */
-static int bes2600_btuart_bug_recovery(struct bes2600_btuart_data *data)
-{
-	struct hci_dev *hdev = data->hdev;
-	struct serdev_device *serdev = data->serdev;
-
-	bt_dev_info(hdev, "Attempting to recover from Firmware bug (might not work)");
-
-	serdev_device_set_flow_control(serdev, false);
-	bes2600_btuart_power(data, false);
-	msleep(20);
-	bes2600_btuart_power(data, true);
-	serdev_device_set_flow_control(serdev, true);
-	msleep(100);
-
-	hci_reset_dev(hdev);
-
-	return 0;
-}
-
-static int bes2600_btuart_recv(struct bes2600_btuart_data *data, const void *buffer, int count)
-{
-	struct hci_dev *hdev = data->hdev;
-	int err = 0;
-
-	data->rx_skb = h4_recv_buf(hdev, data->rx_skb, buffer, count,
-				   bes2600_btuart_recv_pkts, ARRAY_SIZE(bes2600_btuart_recv_pkts));
-	if (IS_ERR(data->rx_skb))
-		err = PTR_ERR(data->rx_skb);
-
-	return err;
-}
-
-static size_t bes2600_btuart_receive_buf(struct serdev_device *serdev,
-					 const u8 *buf, size_t count)
-{
-	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
-	struct hci_dev *hdev = data->hdev;
-	int ret;
-
-	read_lock(&data->lock);
-	ret = bes2600_btuart_recv(data, buf, count);
-	if (ret) {
-		bt_dev_err(hdev, "Failed to receive packet (%d)", ret);
-		data->err_count++;
-		ret = 0;
-	} else {
-		hdev->stat.byte_rx += count;
-		ret = count;
-	}
-	read_unlock(&data->lock);
-
-	/* Attempting to recovery from a bugged firmware */
-	if (data->err_count > 10) {
-		bes2600_btuart_bug_recovery(data);
-		data->err_count = 0;
-	}
-
-	return ret;
-}
-
-static const struct serdev_device_ops bes2600_btuart_serdev_client_ops = {
-	.receive_buf = bes2600_btuart_receive_buf,
-	.write_wakeup = serdev_device_write_wakeup,
-};
-
-static void bes2600_btuart_wake(struct hci_dev *hdev, bool enable)
-{
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-
-	if (enable)
-		gpiod_set_value_cansleep(data->wakeup, 1);
-	else
-		gpiod_set_value_cansleep(data->wakeup, 0);
-}
-
-static int bes2600_btuart_open(struct hci_dev *hdev)
-{
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-	struct serdev_device *serdev = data->serdev;
-	int ret;
-
-	ret = serdev_device_open(serdev);
-	if (ret < 0) {
-		bt_dev_err(hdev, "Failed to open serial device");
-		return ret;
-	}
-
-	serdev_device_set_flow_control(serdev, false);
-
-	ret = serdev_device_set_baudrate(serdev, data->speed);
-	if (ret < 0) {
-		bt_dev_err(hdev, "Failed to set baud rate");
-		return ret;
-	}
-
-	serdev_device_set_flow_control(serdev, true);
-
-	data->opened = true;
-
-	bes2600_btuart_wake(hdev, true);
-	return 0;
-}
-
-static int bes2600_btuart_flush(struct hci_dev *hdev)
-{
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-	struct serdev_device *serdev = data->serdev;
-
-	serdev_device_write_flush(serdev);
-
-	read_lock(&data->lock);
-	skb_queue_purge(&data->txq);
-	cancel_work_sync(&data->tx_work);
-	read_unlock(&data->lock);
-
-	return 0;
-}
-
-static int bes2600_btuart_close(struct hci_dev *hdev)
-{
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-	struct serdev_device *serdev = data->serdev;
-
-	bes2600_btuart_wake(hdev, false);
-
-	serdev_device_set_flow_control(serdev, false);
-	serdev_device_close(serdev);
-
-	data->opened = false;
-
-	return 0;
-}
-
-static int bes2600_btuart_setup(struct hci_dev *hdev)
-{
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-	int ret;
-
-	if (bes2600_chrdev_is_bus_error())
-		return -EFAULT;
-
-	/* Set pinctrl state to default */
-	ret = pinctrl_select_state(data->pinctrl, data->pinctrl_default);
-	if (ret < 0) {
-		bt_dev_err(hdev, "Failed to setup pinctrl state");
-		return ret;
-	}
-
-	/* Set power GPIO to high and tell chardev to switch to BT */
-	bes2600_btuart_power(data, true);
-
-	return 0;
-}
-
-static int bes2600_btuart_shutdown(struct hci_dev *hdev)
-{
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-
-	if (bes2600_chrdev_is_bus_error())
-		return -EFAULT;
-
-	bes2600_btuart_power(data, false);
-
-	return 0;
-}
-
-static int bes2600_btuart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
-{
-	char *pkt_type = NULL;
-	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
-
-	switch (hci_skb_pkt_type(skb)) {
-	case HCI_COMMAND_PKT:
-		hdev->stat.cmd_tx++;
-		break;
-	case HCI_ACLDATA_PKT:
-		hdev->stat.acl_tx++;
-		break;
-	case HCI_SCODATA_PKT:
-		hdev->stat.sco_tx++;
-		break;
-	default:
-		return -EILSEQ;
-	}
-	pkt_type = skb_push(skb, 1);
-	pkt_type[0] = hci_skb_pkt_type(skb);
-	read_lock(&data->lock);
-	skb_queue_tail(&data->txq, skb);
-	read_unlock(&data->lock);
-
-	schedule_work(&data->tx_work);
-	return 0;
-}
-
-static ssize_t bes2600_btuart_send(struct bes2600_btuart_data *data, struct sk_buff *skb)
-{
-	struct hci_dev *hdev = data->hdev;
-	int len;
-
-	len = serdev_device_write_buf(data->serdev, skb->data, skb->len);
-	if (len < 0) {
-		bt_dev_err(data->hdev, "Failed to write buffer to TTY");
-		return -EIO;
-	}
-	serdev_device_wait_until_sent(data->serdev, 0);
-
-	hdev->stat.byte_tx += len;
-
-	skb_pull(skb, len);
-
-	return skb->len;
-}
-
-static void bes2600_btuart_work(struct work_struct *work)
-{
-	struct bes2600_btuart_data *data = container_of(work, struct bes2600_btuart_data, tx_work);
-	struct sk_buff *skb;
-
-	while ((skb = skb_dequeue(&data->txq))) {
-		if (bes2600_btuart_send(data, skb) > 0) {
-			skb_queue_head(&data->txq, skb);
-			break;
-		}
-
-		kfree_skb(skb);
-	}
-}
-
-static void bes2600_btuart_parse_dt(struct serdev_device *serdev)
-{
-	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
-	struct device_node *node = serdev->dev.of_node;
-	int speed = 1500000;
-
-	of_property_read_u32(node, "current-speed", &speed);
-	data->speed = speed;
-}
-
-static irqreturn_t bes2600_btuart_wakeup_handler(int irq, void *priv)
-{
-	struct bes2600_btuart_data *data = (struct bes2600_btuart_data *)priv;
-
-	dev_info(&data->serdev->dev, "IRQ wake\n");
-
-	return IRQ_HANDLED;
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int bes2600_btuart_suspend(struct device *dev)
-{
-	struct serdev_device *serdev = to_serdev_device(dev);
-	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
-
-	if (data->opened) {
-		bes2600_btuart_wake(data->hdev, false);
-
-		if (device_may_wakeup(dev) && data->wake_irq)
-			enable_irq_wake(data->wake_irq);
-	}
-
-	return 0;
-}
-
-static int bes2600_btuart_resume(struct device *dev)
-{
-	struct serdev_device *serdev = to_serdev_device(dev);
-	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
-
-	if (data->opened) {
-		bes2600_btuart_wake(data->hdev, true);
-
-		if (device_may_wakeup(dev) && data->wake_irq)
-			disable_irq_wake(data->wake_irq);
-	}
-
-	return 0;
-}
-#endif
-
-static SIMPLE_DEV_PM_OPS(bes2600_btuart_pm_ops,
-			bes2600_btuart_suspend, bes2600_btuart_resume);
-
-static int bes2600_btuart_probe(struct serdev_device *serdev)
-{
-	struct device *dev = &serdev->dev;
-	struct bes2600_btuart_data *data;
-	struct hci_dev *hdev;
-	int ret;
-
-	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
-	if (!data)
-		return -ENOMEM;
-
-	skb_queue_head_init(&data->txq);
-
-	data->pinctrl = devm_pinctrl_get(dev);
-	if (IS_ERR(data->pinctrl))
-		return dev_err_probe(dev, PTR_ERR(data->pinctrl), "Cannot get pinctrl\n");
-
-	data->pinctrl_default = pinctrl_lookup_state(data->pinctrl, PINCTRL_STATE_DEFAULT);
-	if (IS_ERR(data->pinctrl_default))
-		return dev_err_probe(dev, PTR_ERR(data->pinctrl_default),
-				"Cannot get default pinctrl state\n");
-
-	data->power = devm_gpiod_get_index(dev, "power", 0, GPIOD_OUT_HIGH);
-	if (IS_ERR(data->power))
-		return dev_err_probe(dev, PTR_ERR(data->power), "Failed to get power gpio\n");
-
-	data->wakeup = devm_gpiod_get_index_optional(dev, "wakeup", 0, GPIOD_OUT_HIGH);
-	if (!data->wakeup)
-		dev_err(dev, "Failed to get wakeup gpio\n");
-
-	data->wake_irq = of_irq_get_byname(dev->of_node, "wakeup");
-	if (data->wake_irq <= 0) {
-		ret = data->wake_irq;
-		dev_err(dev, "Failed to get IRQ number, host will not wake up (ret=%d)\n", ret);
-	}
-
-	if (data->wake_irq > 0) {
-		ret = devm_device_init_wakeup(dev);
-		if (ret)
-			return dev_err_probe(dev, ret, "Failed to initialize device wakeup\n");
-
-		ret = devm_request_threaded_irq(dev, data->wake_irq, NULL,
-						bes2600_btuart_wakeup_handler,
-						IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
-						"bes2600_btwakeup_irq", data);
-		if (ret < 0)
-			return dev_err_probe(dev, ret, "Cannot request IRQ\n");
-
-		ret = devm_pm_set_wake_irq(dev, data->wake_irq);
-		if (ret < 0)
-			return dev_err_probe(dev, ret, "Failed to set wake irq\n");
-	}
-
-	data->err_count = 0;
-
-	hdev = hci_alloc_dev();
-	if (!hdev)
-		return -ENOMEM;
-
-	rwlock_init(&data->lock);
-
-	data->serdev = serdev;
-	data->hdev = hdev;
-
-	serdev_device_set_drvdata(serdev, data);
-	serdev_device_set_client_ops(serdev, &bes2600_btuart_serdev_client_ops);
-
-	bes2600_btuart_parse_dt(serdev);
-
-	INIT_WORK(&data->tx_work, bes2600_btuart_work);
-
-	hdev->bus = HCI_UART;
-	hci_set_drvdata(hdev, data);
-
-	hdev->open = bes2600_btuart_open;
-	hdev->close = bes2600_btuart_close;
-	hdev->flush = bes2600_btuart_flush;
-	hdev->setup = bes2600_btuart_setup;
-	hdev->shutdown = bes2600_btuart_shutdown;
-	hdev->send = bes2600_btuart_send_frame;
-	hdev->manufacturer = 0x02B0;
-
-	SET_HCIDEV_DEV(hdev, &serdev->dev);
-
-	hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY);
-
-	/* Firmware claims to support HCI_OP_LE_READ_BUFFER_SIZE_V2 but broken */
-	hci_set_quirk(hdev, HCI_QUIRK_BROKEN_BUFFER_SIZE_V2);
-
-	/*
-	 * Once shutdown() is ran, it turns off the Bluetooth regulator and
-	 * would not power back on unless setup() is run again.
-	 */
-	hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP);
-
-	ret = hci_register_dev(hdev);
-	if (ret < 0) {
-		hci_free_dev(hdev);
-		return dev_err_probe(dev, ret, "Failed to register HCI device\n");
-	}
-
-	return 0;
-}
-
-static void bes2600_btuart_remove(struct serdev_device *serdev)
-{
-	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
-	struct hci_dev *hdev = data->hdev;
-
-	cancel_work_sync(&data->tx_work);
-	if (hdev) {
-		hci_unregister_dev(hdev);
-		hci_free_dev(hdev);
-	}
-}
-
-static const struct of_device_id bes2600_btuart_of_match[] = {
-	{ .compatible = "bestechnic,bes2600-btuart", },
-	{},
-};
-MODULE_DEVICE_TABLE(of, bes2600_btuart_of_match);
-
-static struct serdev_device_driver bes2600_btuart_driver = {
-	.probe = bes2600_btuart_probe,
-	.remove = bes2600_btuart_remove,
-	.driver = {
-		.name = "bes2600_btuart",
-		.pm = &bes2600_btuart_pm_ops,
-		.of_match_table = of_match_ptr(bes2600_btuart_of_match),
-	},
-};
-module_serdev_device_driver(bes2600_btuart_driver);
-
-MODULE_AUTHOR("Dang Huynh <dang.huynh@mainlining.org>");
-MODULE_DESCRIPTION("BES2600 BT UART driver");
-MODULE_LICENSE("GPL");

bes2600/bes2600_factory.c

@@ -1,14 +1,18 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Factory calibration loader for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
+#include <linux/firmware.h>
 #include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/crc32.h>
@@ -134,38 +138,32 @@ static int bes2600_factory_crc_check(struct factory_t *factory_data)
  */
 static int factory_section_read_file(char *path, void *buffer)
 {
-	int ret = 0;
-	struct file *fp;
+	const struct firmware *fw;
+	int ret;
 
 	if (!path || !buffer) {
 		bes_err("%s NULL pointer err\n", __func__);
 		return -1;
 	}
 
-	bes_devel("reading %s \n", path);
+	bes_devel("requesting firmware-class %s\n", path);
 
-	fp = filp_open(path, O_RDONLY, 0); //S_IRUSR
-	if (IS_ERR(fp)) {
-		bes_devel("BES2600 : can't open %s\n",path);
+	ret = request_firmware(&fw, path, NULL);
+	if (ret) {
+		bes_devel("BES2600: request_firmware(%s) failed: %d\n", path, ret);
 		return -1;
 	}
 
-	if (fp->f_inode->i_size <= 0 || fp->f_inode->i_size > FACTORY_MAX_SIZE) {
-		bes_err(			"bes2600_factory.txt size check failed, read_size: %lld max_size: %d\n",
-			fp->f_inode->i_size, FACTORY_MAX_SIZE);
-		filp_close(fp, NULL);
+	if (fw->size == 0 || fw->size > FACTORY_MAX_SIZE) {
+		bes_err("bes2600_factory.txt size check failed, read_size: %zu max_size: %d\n",
+			fw->size, FACTORY_MAX_SIZE);
+		release_firmware(fw);
 		return -1;
 	}
 
-	ret = kernel_read(fp, buffer, fp->f_inode->i_size, &fp->f_pos);
-
-	filp_close(fp, NULL);
-
-	if (ret != fp->f_inode->i_size) {
-		bes_err("bes2600_factory.txt read fail\n");
-		ret = -1;
-	}
-
+	memcpy(buffer, fw->data, fw->size);
+	ret = (int)fw->size;
+	release_firmware(fw);
 	return ret;
 }
 

bes2600/bes2600_factory.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Factory calibration loader interface
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef __FACTORY_H__
 #define __FACTORY_H__

bes2600/bes2600_plat.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Platform data for BES2600 SDIO bus
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef BES2600_PLAT_H_INCLUDED
 #define BES2600_PLAT_H_INCLUDED

bes2600/bes2600_sdio.c

@@ -1,13 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * SDIO bus glue for BES2600 mac80211 driver
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
- * Derived from drivers/net/wireless/st/cw1200/cw1200_sdio.c
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ * Mac80211 SDIO driver for BES2600 device
  *
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
  #define DEBUG 1
 #include <linux/version.h>
@@ -17,7 +16,6 @@
 #include <linux/mmc/host.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/card.h>
-#include <linux/mmc/core.h>
 #include <linux/mmc/sdio.h>
 #include <linux/spinlock.h>
 #include <net/mac80211.h>
@@ -30,7 +28,6 @@
 #include <linux/of_gpio.h>
 
 #include "bes2600.h"
-#include "bh.h"
 #include "sbus.h"
 #include "bes2600_plat.h"
 #include "hwio.h"
@@ -73,12 +70,10 @@ struct sbus_priv {
 	int rx_data_toggle;
 #endif
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	/*
-	 * Patch C v3: rx_queue, rx_queue_lock, rx_work removed (no relay).
-	 * The bh thread now reads RX inline; the rx_buffer scratch area
-	 * stays.  Counters/timestamps stay for debugfs visibility.
-	 */
+	spinlock_t rx_queue_lock;
+	struct sk_buff_head rx_queue;
 	u8 *rx_buffer;
+	struct work_struct rx_work;
 	u32 rx_last_ctrl;
 	u32 rx_valid_ctrl;
 	u32 rx_total_ctrl_cnt;
@@ -99,7 +94,6 @@ struct sbus_priv {
 	struct work_struct tx_work;
 	struct scatterlist tx_sg[BES_SDIO_TX_MULTIPLE_NUM + 1];
 	struct scatterlist tx_sg_nosignal[BES_SDIO_TX_MULTIPLE_NUM_NOSIGNAL + 1];
-	u8 *tx_bounce;
 	u32 tx_data_cnt;
 	u32 tx_xfer_cnt;
 	u32 tx_proc_cnt;
@@ -415,19 +409,10 @@ static void bes2600_sdio_irq_handler(struct sdio_func *func)
 
 	bes_devel("%s called, fw_started:%d \n",
 			 __func__, self->fw_started);
-	/*
-	 * Patch C v3: no more sdio_rx_work relay.  Wake the bh thread
-	 * directly via self->irq_handler (bes2600_irq_handler in bh.c
-	 * which bumps bh_rx atomic + wakes bh_wq).  The bh thread will
-	 * then call sbus_ops->bus_rx_batch() to do the SDIO read inline.
-	 * Matches cw1200 mainline IRQ → bh-direct architecture.
-	 */
-	if (likely(self->fw_started && self->core && self->irq_handler)) {
-		spin_lock_irqsave(&self->lock, flags);
-		self->irq_handler(self->irq_priv);
-		spin_unlock_irqrestore(&self->lock, flags);
+	if (likely(self->fw_started && self->core)) {
+		queue_work(self->sdio_wq, &self->rx_work);
 		self->last_irq_timestamp = jiffies;
-	} else if (self->irq_handler) {
+	} else if(self->irq_handler) {
 		spin_lock_irqsave(&self->lock, flags);
 		self->irq_handler(self->irq_priv);
 		spin_unlock_irqrestore(&self->lock, flags);
@@ -824,15 +809,10 @@ static int bes2600_sdio_extract_packets(struct sbus_priv *self, u32 ctrl_reg, u8
 		skb_put(skb, packet_len);
 		memcpy(skb->data, &data[pos], packet_len);
 		bes_devel("%s, %d,%d\n", __func__, packet_len, pos);
+		spin_lock(&self->rx_queue_lock);
+		skb_queue_tail(&self->rx_queue, skb);
 		self->rx_data_cnt++;
-		/*
-		 * Patch C v3: deliver the SKB directly into the WSM/mac80211
-		 * stack from the bh thread.  No rx_queue, no inter-thread
-		 * handoff, no atomic_t needed on the counters that
-		 * wsm_release_tx_buffer touches — single-writer-from-bh is
-		 * preserved by construction.  See bh.c for the contract block.
-		 */
-		bes2600_bh_handle_rx_skb(self->core, skb);
+		spin_unlock(&self->rx_queue_lock);
 		packet_len = (packet_len + 3) & (~0x3);
 		pos += packet_len;
 		#ifdef BES_SDIO_OPTIMIZED_LEN
@@ -843,31 +823,17 @@ static int bes2600_sdio_extract_packets(struct sbus_priv *self, u32 ctrl_reg, u8
 	return 0;
 }
 
-/*
- * Patch C v3: bh thread calls this directly via sbus_ops->bus_rx_batch.
- * No more sdio_rx_work workqueue.  SDIO read sequence (lock →
- * read_ctrl → memcpy_fromio → packets_check → extract_packets) runs
- * inline in bh-thread context.  Each parsed SKB is delivered via
- * bes2600_bh_handle_rx_skb() from extract_packets — no rx_queue, no
- * second worker, no inter-thread handoff.
- *
- * Architecture matches cw1200 mainline.  Single-writer-from-bh
- * invariant on hw_bufs_used preserved by construction.
- *
- * Returns 0 on success (caller's bh outer loop decides whether to
- * continue), negative on bus read error.  On error: triggers
- * wifi_force_close (same as the old sdio_rx_work).
- */
-static int bes2600_sdio_read_rx_batch(struct sbus_priv *self)
+static void sdio_rx_work(struct work_struct *work)
 {
-	int ret = 0, again = 0, retry = 0, crc_retry = 0;
+	int ret, again = 0, retry = 0, crc_retry = 0;
 	u32 ctrl_reg = 0;
 	int total_len;
+	struct sbus_priv *self = container_of(work, struct sbus_priv, rx_work);
 	u8 *buf = self->rx_buffer;
 
 	/* don't read/write sdio when sdio error */
 	if (bes2600_chrdev_is_bus_error())
-		return 0;
+		return;
 
 	bes2600_gpio_wakeup_mcu(self, GPIO_WAKE_FLAG_SDIO_RX);
 
@@ -922,10 +888,6 @@ static int bes2600_sdio_read_rx_batch(struct sbus_priv *self)
 			goto failed;
 		}
 
-		/*
-		 * extract_packets parses the multi-RX buffer and calls
-		 * bes2600_bh_handle_rx_skb() per SKB.  No queueing.
-		 */
 		if ((ret = bes2600_sdio_extract_packets(self, ctrl_reg, buf))) {
 			bes_err("%s,%d error=%d\n", __func__, __LINE__, ret);
 			goto failed;
@@ -933,16 +895,22 @@ static int bes2600_sdio_read_rx_batch(struct sbus_priv *self)
 
 		ctrl_reg = 0;
 
+		if (likely(self->irq_handler)) {
+			self->irq_handler(self->irq_priv);
+		} else {
+			bes_err("%s,%d\n", __func__, __LINE__);
+			goto failed;
+		}
+
 	} while (again);
 
 	bes2600_gpio_allow_mcu_sleep(self, GPIO_WAKE_FLAG_SDIO_RX);
-	return 0;
+	return;
 
 failed:
 	bes2600_gpio_allow_mcu_sleep(self, GPIO_WAKE_FLAG_SDIO_RX);
 	bes2600_chrdev_wifi_force_close(self->core, false);
 	WARN_ON(1);
-	return -1;
 }
 
 static void sdio_scan_work(struct work_struct *work)
@@ -950,11 +918,26 @@ static void sdio_scan_work(struct work_struct *work)
 	bes_warn("%s: this function does nothing\n", __FUNCTION__);
 }
 
-/* Patch C v3: bes2600_sdio_pipe_read deleted.  bh thread reads the
- * SDIO bus inline via bes2600_sdio_read_rx_batch (sbus_ops->bus_rx_batch).
- * No rx_queue, no skb_dequeue, no relay.  bes2600_tx_loop_read remains
- * for the test bus error-fallback path but is now invoked at higher
- * level. */
+static void *bes2600_sdio_pipe_read(struct sbus_priv *self)
+{
+	struct sk_buff *skb;
+
+	if (bes2600_chrdev_is_bus_error()) {
+		return bes2600_tx_loop_read(self->core);
+	}
+
+	spin_lock(&self->rx_queue_lock);
+	skb = skb_dequeue(&self->rx_queue);
+	if (skb)
+		self->rx_proc_cnt++;
+	spin_unlock(&self->rx_queue_lock);
+	if (likely(self->fw_started == true &&
+		!bes2600_pwr_device_is_idle(self->core) &&
+		self->core->hw_bufs_used > 0))
+		if (!skb)
+			queue_work(self->sdio_wq, &self->rx_work);
+	return skb;
+}
 
 #endif
 
@@ -1152,26 +1135,7 @@ static void sdio_tx_work(struct work_struct *work)
 				}
 			}
 
-			/*
-			 * The transfer length is rounded up to the SDIO block
-			 * size, but tx_buffer->buf is only tx_buffer->len bytes
-			 * long (it usually aliases into an skb linear head).
-			 * Copy into a driver-owned bounce buffer and zero-pad
-			 * to the aligned size; otherwise DMA reads past the
-			 * skb and leaks adjacent kernel memory on the wire --
-			 * observed as KFENCE OOB reads from
-			 * bes_sdio_memcpy_to_io_helper via dma_map_sg.
-			 */
-			if (WARN_ON_ONCE(total_len + align > MAX_SDIO_TRANSFER_LEN))
-				goto flush_previous;
-			memcpy(self->tx_bounce + total_len,
-			       tx_buffer->buf, tx_buffer->len);
-			if (align > tx_buffer->len)
-				memset(self->tx_bounce + total_len +
-				       tx_buffer->len, 0,
-				       align - tx_buffer->len);
-			sg_set_buf(&sg[scatters],
-				   self->tx_bounce + total_len, align);
+			sg_set_buf(&sg[scatters], tx_buffer->buf, align);
 			total_len += align;
 			++scatters;
 /*del_node:*/
@@ -1210,14 +1174,7 @@ flush_previous:
 				}
 			} while (crc_retry <= 10);
 			sdio_release_host(self->func);
-			/*
-			 * Patch C v3: wake the bh thread to check for any RX
-			 * that piggybacked on this TX window.  Bumps bh_rx
-			 * atomic; bh's wait_event will pick it up and call
-			 * sbus_ops->bus_rx_batch().
-			 */
-			if (likely(self->irq_handler))
-				self->irq_handler(self->irq_priv);
+			queue_work(self->sdio_wq, &self->rx_work);
 			if (ret) {
 				bes_err("%s,%d err=%d,%d,%d\n", __func__, __LINE__, ret, scatters, cur_blk);
 				sdio_work_debug(self);
@@ -1268,11 +1225,12 @@ static int bes2600_sdio_misc_init(struct sbus_priv *self, struct bes2600_common
 	self->next_toggle = 0;
 #endif
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	/* Patch C v3: rx_queue / rx_queue_lock removed (no relay). */
+	spin_lock_init(&self->rx_queue_lock);
+	skb_queue_head_init(&self->rx_queue);
 	self->rx_buffer = (u8 *)__get_dma_pages(GFP_KERNEL, get_order(1632 * BES_SDIO_RX_MULTIPLE_NUM));
 	if (!self->rx_buffer)
 		return -ENOMEM;
-	/* Patch C v3: sdio_rx_work removed; bh thread does the read. */
+	INIT_WORK(&self->rx_work, sdio_rx_work);
 #endif
 #ifdef BES_SDIO_TX_MULTIPLE_ENABLE
 	INIT_LIST_HEAD(&self->tx_bufferlist);
@@ -1409,14 +1367,7 @@ static void bes2600_gpio_wakeup_mcu(struct sbus_priv *self, int flag)
 
 	/* error check */
 	if((self->gpio_wakup_flags & BIT(flag)) != 0) {
-		/*
-		 * Multiple subsystems holding wake is the steady-state case
-		 * (e.g. WIFI + BT both want MCU awake). Demoted from bes_err
-		 * to bes_devel since it isn't an error - the GPIO is already
-		 * asserted high and the subsystem is now also tracked.
-		 */
-		bes_devel("repeat set gpio_wake_flag, sub_sys:%d\n", flag);
-		self->gpio_wakup_flags |= BIT(flag);
+		bes_err(			"repeat set gpio_wake_flag, sub_sys:%d", flag);
 		mutex_unlock(&self->io_mutex);
 		return;
 	}
@@ -1448,11 +1399,7 @@ static void bes2600_gpio_allow_mcu_sleep(struct sbus_priv *self, int flag)
 
 	/* error check */
 	if((self->gpio_wakup_flags & BIT(flag)) == 0) {
-		/*
-		 * Mirror of the wake path: a clear when the bit is already
-		 * clear is racy bookkeeping, not a hardware error.
-		 */
-		bes_devel("repeat clear gpio_wake_flag, sub_sys:%d\n", flag);
+		bes_err(			"repeat clear gpio_wake_flag, sub_sys:%d", flag);
 		mutex_unlock(&self->io_mutex);
 		return;
 	}
@@ -1601,15 +1548,22 @@ err:
 
 static void bes2600_sdio_empty_work(struct sbus_priv *self)
 {
+#ifdef BES_SDIO_RX_MULTIPLE_ENABLE
+	struct sk_buff *skb;
+#endif
 #ifdef BES_SDIO_TX_MULTIPLE_ENABLE
 	struct bes_sdio_tx_list_t *tx_buffer, *temp;
 #endif
 
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	/*
-	 * Patch C v3: rx_work and rx_queue removed.  Counters still
-	 * reset for the next attach cycle.
-	 */
+	cancel_work_sync(&self->rx_work);
+	while (1) {
+		skb = skb_dequeue(&self->rx_queue);
+		if (skb)
+			dev_kfree_skb(skb);
+		else
+			break;
+	}
 	self->rx_last_ctrl = 0;
 	self->rx_total_ctrl_cnt = 0;
 	self->rx_continuous_ctrl_cnt = 0;
@@ -1802,55 +1756,6 @@ static void bes2600_sdio_halt_device(struct sbus_priv *self)
 	sdio_work_debug(self);
 }
 
-/*
- * Trigger an SDIO bus reset via mmc_hw_reset().
- *
- * With multiple SDIO functions probed (PineTab2 binds func 1 for WLAN and
- * func 2 for the BT-companion path) mmc_sdio_hw_reset() takes the
- * remove-and-rescan path: it marks the card removed and schedules
- * mmc_rescan, which tears down the bound function drivers and re-detects
- * the card on the next sweep, in turn reinvoking bes2600_sdio_probe().
- *
- * With a single function probed it instead invokes mmc_power_cycle()
- * directly, which on PineTab2 toggles the wifi-reset GPIO via sdio_pwrseq.
- *
- * In both cases the chip ends up in a freshly reset state, which is the
- * goal of the recovery path.
- *
- * mmc_hw_reset() must be called without holding the SDIO host claim --
- * the multi-func remove-and-rescan path acquires the host claim via the
- * mmc workqueue.
- */
-static int bes2600_sdio_bus_reset(struct sbus_priv *self)
-{
-	struct mmc_host *host;
-	int ret;
-
-	if (!self || !self->func || !self->func->card)
-		return -EINVAL;
-
-	host = self->func->card->host;
-	ret = mmc_hw_reset(self->func->card);
-
-	/*
-	 * On multi-function SDIO cards (BES2600 has WLAN func 1 + BT
-	 * companion func 2), mmc_sdio_hw_reset() removes the card and
-	 * returns 1 to signal "remove happened, caller must trigger
-	 * rescan". The kernel does NOT auto-rescan in this case;
-	 * single-function cards take the rescan path inline and return 0.
-	 * Treat any non-negative return as success and force a rescan if
-	 * mmc_hw_reset signalled the multi-function path - otherwise the
-	 * card stays removed indefinitely after a wedge recovery,
-	 * leaving wifi (and the BT companion) silent until reboot.
-	 */
-	if (ret > 0) {
-		bes_info("multi-func mmc_hw_reset removed card; scheduling rescan\n");
-		mmc_detect_change(host, 0);
-		ret = 0;
-	}
-	return ret;
-}
-
 static bool bes2600_sdio_wakeup_source(struct sbus_priv *self)
 {
 	struct bes2600_platform_data_sdio *pdata = bes2600_get_platform_data();
@@ -1877,8 +1782,7 @@ static struct sbus_ops bes2600_sdio_sbus_ops = {
 	.sbus_reg_write		= bes2600_sdio_reg_write,
 	.init			= bes2600_sdio_misc_init,
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	/* Patch C v3: .pipe_read removed; bus_rx_batch replaces it. */
-	.bus_rx_batch		= bes2600_sdio_read_rx_batch,
+	.pipe_read		= bes2600_sdio_pipe_read,
 #endif
 #ifdef BES_SDIO_TX_MULTIPLE_ENABLE
 	.pipe_send		= bes2600_sdio_pipe_send,
@@ -1890,7 +1794,6 @@ static struct sbus_ops bes2600_sdio_sbus_ops = {
 	.gpio_sleep		= bes2600_gpio_allow_mcu_sleep,
 	.halt_device		= bes2600_sdio_halt_device,
 	.wakeup_source		= bes2600_sdio_wakeup_source,
-	.bus_reset		= bes2600_sdio_bus_reset,
 };
 
 static void bes2600_sdio_en_lp_cb(struct bes2600_common *hw_priv)
@@ -1898,15 +1801,9 @@ static void bes2600_sdio_en_lp_cb(struct bes2600_common *hw_priv)
 	long unsigned int old_ts, new_ts;
 	struct sbus_priv *self = hw_priv->sbus_priv;
 
-	/*
-	 * Patch C v3: rx_work removed.  Wait for IRQ-timestamp activity
-	 * to settle by polling self->last_irq_timestamp via msleep
-	 * (best-effort).  The caller already knows the bh thread will
-	 * process pending bh_rx during its next wait_event round.
-	 */
 	do {
 		old_ts = self->last_irq_timestamp;
-		msleep(2);
+		flush_work(&self->rx_work);
 		new_ts = self->last_irq_timestamp;
 	} while(old_ts != new_ts);
 }
@@ -1956,17 +1853,6 @@ static int bes2600_sdio_probe(struct sdio_func *func,
 	if (!self->single_gathered_buffer)
 		return -ENOMEM;
 #endif
-#ifdef BES_SDIO_TX_MULTIPLE_ENABLE
-	self->tx_bounce = (u8 *)__get_dma_pages(GFP_KERNEL,
-					get_order(MAX_SDIO_TRANSFER_LEN));
-	if (!self->tx_bounce) {
-#ifndef SDIO_HOST_ADMA_SUPPORT
-		free_pages((unsigned long)self->single_gathered_buffer,
-			   get_order(MAX_SDIO_TRANSFER_LEN));
-#endif
-		return -ENOMEM;
-	}
-#endif
 #ifdef BES_SDIO_RXTX_TOGGLE
 	self->fw_started = false;
 #endif
@@ -1993,6 +1879,7 @@ static int bes2600_sdio_probe(struct sdio_func *func,
 
 out:
 	bes2600_chrdev_set_sbus_priv_data(self, false);
+	bes2600_switch_bt(true);
 	bes2600_gpio_allow_mcu_sleep(self, GPIO_WAKE_FLAG_SDIO_PROBE);
 	return 0;
 
@@ -2027,8 +1914,8 @@ int bes2600_unregister_net_dev(struct sbus_priv *bus_priv)
 	BUG_ON(!bus_priv);
 	if (bus_priv->core && !bus_priv->unregister_in_process) {
 		bus_priv->unregister_in_process = true;
-		bes2600_pwr_unregister_en_lp_cb(bus_priv->core, bes2600_sdio_en_lp_cb);
 		bes2600_core_release(bus_priv->core);
+		bes2600_pwr_unregister_en_lp_cb(bus_priv->core, bes2600_sdio_en_lp_cb);
 		bus_priv->core = NULL;
 
 		if (bus_priv->sdio_wq) {
@@ -2094,12 +1981,6 @@ static void bes2600_sdio_remove(struct sdio_func *func)
 		if (self->single_gathered_buffer) {
 			free_pages((unsigned long)self->single_gathered_buffer, get_order(MAX_SDIO_TRANSFER_LEN));
 		}
-#endif
-#ifdef BES_SDIO_TX_MULTIPLE_ENABLE
-		if (self->tx_bounce) {
-			free_pages((unsigned long)self->tx_bounce,
-				   get_order(MAX_SDIO_TRANSFER_LEN));
-		}
 #endif
 		kfree(self);
 	}
@@ -2260,12 +2141,8 @@ static int bes2600_sdio_suspend_noirq(struct device *dev)
 	if (func->num > 1)
 		return 0;
 
-	/*
-	 * Patch C v3: work_pending(&self->rx_work) check dropped (no
-	 * relay).  bh_rx atomic alone tells us whether the bh thread
-	 * has un-processed RX events queued.
-	 */
-	if (self->core && atomic_read(&self->core->bh_rx)) {
+	if(self->core &&
+	   (work_pending(&self->rx_work) || atomic_read(&self->core->bh_rx))) {
 		bes_devel("%s: Suspend interrupted.\n", __func__);
 		return -EAGAIN;
 	}

bes2600/bes_chardev.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Character device for BES2600 mac80211 driver
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include<linux/module.h>
 #include <linux/init.h>
@@ -193,7 +196,7 @@ static int bes2600_switch_wifi(bool on)
 	return ret;
 }
 
-static int bes2600_switch_bt(bool on)
+int bes2600_switch_bt(bool on)
 {
 	int ret = 0;
 	long status = 0;
@@ -226,11 +229,11 @@ static int bes2600_switch_bt(bool on)
 			/* check if there is a error when bootup */
 			ret = (status <= 0 || bes2600_chrdev_is_bus_error()) ? -1 : 0;
 		} else {
-			bes_devel("bes2600 activate bt.\n");
+			bes_info("enable BT\n");
 			ret = bes2600_chrdev_switch_subsys(GPIO_WAKE_FLAG_BT_ON, SUBSYSTEM_BT, true);
 		}
 	} else {
-		bes_devel("bes2600 deactivate bt.\n");
+		bes_info("disable BT\n");
 		bes2600_chrdev_switch_subsys(GPIO_WAKE_FLAG_BT_OFF, SUBSYSTEM_BT, false);
 	}
 
@@ -246,47 +249,6 @@ static int bes2600_switch_bt(bool on)
 	return ret;
 }
 
-/*
- * This is a global function so we don't have to make many changes to
- * the driver.
- *
- * @wifi: 1 to turn on, 0 to turn off. Otherwise, leave unchanged
- * @bt: 1 to turn on, 0 to turn off. Otherwise, leave unchanged
- */
-int bes2600_chrdev_switch_subsys_glb(int wifi, int bt)
-{
-	int ret = 0;
-
-	switch (wifi) {
-	case 0:
-		ret = bes2600_switch_wifi(false);
-		break;
-	case 1:
-		ret = bes2600_switch_wifi(true);
-		break;
-	default:
-		break;
-	}
-
-	if (ret)
-		goto result;
-
-	switch (bt) {
-	case 0:
-		ret = bes2600_switch_bt(false);
-		break;
-	case 1:
-		ret = bes2600_switch_bt(true);
-		break;
-	default:
-		break;
-	}
-
-result:
-	return ret;
-}
-EXPORT_SYMBOL_GPL(bes2600_chrdev_switch_subsys_glb);
-
 static int bes2600_get_cmd_and_ifname(const char *str, char **result)
 {
 	int cmd_len = 0;
@@ -1075,62 +1037,6 @@ int bes2600_chrdev_do_system_close(const struct sbus_ops *sbus_ops, struct sbus_
 	return ret;
 }
 
-/*
- * Hard-reset the bus and wait for the bus core to remove the chip.
- *
- * Used by the firmware-wedge recovery path on platforms where the normal
- * power_switch(0) sequence has no effective chip-reset signal. The bus
- * implementation triggers an asynchronous re-detect; this helper waits for
- * the resulting remove() callback to clear bes2600_cdev.sbus_priv so that a
- * subsequent bes2600_switch_wifi(true) sees a clean state and can wait on
- * the fresh probe.
- */
-int bes2600_chrdev_do_bus_reset(const struct sbus_ops *sbus_ops, struct sbus_priv *priv)
-{
-	int ret;
-	long status;
-
-	if (!sbus_ops || !priv)
-		return -EINVAL;
-
-	if (!sbus_ops->bus_reset)
-		return -EOPNOTSUPP;
-
-	bes_info("trigger bus reset to recover wedged firmware.\n");
-
-	ret = sbus_ops->bus_reset(priv);
-	if (ret) {
-		bes_err("bus_reset failed: %d\n", ret);
-		return ret;
-	}
-
-	/*
-	 * The bus reset is asynchronous: the bus core schedules a rescan
-	 * which removes the bound function drivers and then re-detects the
-	 * chip. Wait for the remove callback to clear sbus_priv. Do not
-	 * dereference 'priv' after this point -- it may already be freed.
-	 */
-	status = wait_event_timeout(bes2600_cdev.probe_done_wq,
-				    !bes2600_cdev.sbus_priv, HZ * 3);
-	WARN_ON(status <= 0);
-
-	return 0;
-}
-EXPORT_SYMBOL_GPL(bes2600_chrdev_do_bus_reset);
-
-/*
- * Trigger bes2600_chrdev_do_bus_reset() against the file-global
- * bes2600_cdev. Used by host-side recovery paths outside this
- * compilation unit (e.g. sta.c connection-loss-storm fast-recover) so
- * those callers do not need to reach the static bes2600_cdev directly.
- */
-int bes2600_chrdev_trigger_bus_reset(void)
-{
-	return bes2600_chrdev_do_bus_reset(bes2600_cdev.sbus_ops,
-					   bes2600_cdev.sbus_priv);
-}
-EXPORT_SYMBOL_GPL(bes2600_chrdev_trigger_bus_reset);
-
 bool bes2600_chrdev_is_wifi_opened(void)
 {
 	bool wifi_opened = false;
@@ -1179,7 +1085,6 @@ void bes2600_chrdev_wakeup_bt(void)
 			bes_err("Wakeup BT fail in resume\n");
 	}
 }
-EXPORT_SYMBOL_GPL(bes2600_chrdev_wakeup_bt);
 
 int bes2600_chrdev_get_fw_type(void)
 {
@@ -1201,7 +1106,6 @@ bool bes2600_chrdev_is_bus_error(void)
 
 	return error;
 }
-EXPORT_SYMBOL_GPL(bes2600_chrdev_is_bus_error);
 
 void bes2600_chrdev_update_signal_mode(void)
 {
@@ -1237,21 +1141,8 @@ static void bes2600_chrdev_wifi_force_close_work(struct work_struct *work)
 		/* unregister wifi */
 		bes2600_switch_wifi(0);
 
-		/*
-		 * Hard exception with a bus_reset implementation: tear the
-		 * bus down via mmc_hw_reset() (or equivalent) so the next
-		 * bringup probes a freshly reset chip. On PineTab2 this is
-		 * the only effective recovery path -- the existing
-		 * power_switch(0)/(1) sequence has no chip-reset signal of
-		 * its own (sdio_pwrseq owns wifi_reset).
-		 *
-		 * Soft close, or hard close on a board without bus_reset:
-		 * fall back to the legacy power_switch(0) sequence.
-		 */
-		if (bes2600_cdev.halt_dev && bes2600_cdev.sbus_ops->bus_reset) {
-			bes2600_chrdev_do_bus_reset(bes2600_cdev.sbus_ops,
-						    bes2600_cdev.sbus_priv);
-		} else if (bes2600_chrdev_check_system_close()) {
+		/* power down device if wifi is only opened */
+		if (bes2600_chrdev_check_system_close()) {
 			bes2600_chrdev_do_system_close(bes2600_cdev.sbus_ops,
 						bes2600_cdev.sbus_priv);
 		}

bes2600/bes_chardev.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Character device interface for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef __BES_CHARDEV_H__
 #define __BES_CHARDEV_H__
@@ -57,12 +60,9 @@ struct sbus_priv *bes2600_chrdev_get_sbus_priv_data(void);
 /* used to control device power down */
 int bes2600_chrdev_check_system_close(void);
 int bes2600_chrdev_do_system_close(const struct sbus_ops *sbus_ops, struct sbus_priv *priv);
-int bes2600_chrdev_do_bus_reset(const struct sbus_ops *sbus_ops, struct sbus_priv *priv);
-int bes2600_chrdev_trigger_bus_reset(void);
 void bes2600_chrdev_wakeup_bt(void);
 void bes2600_chrdev_wifi_force_close(struct bes2600_common *hw_priv, bool halt_dev);
 void bes2600_chrdev_usb_remove(struct bes2600_common *hw_priv);
-int bes2600_chrdev_switch_subsys_glb(int wifi, int bt);
 
 /* get and set internal state */
 bool bes2600_chrdev_is_wifi_opened(void);
@@ -91,4 +91,6 @@ u8* bes2600_alloc_dpd_log_buffer(u16 len);
 void bes2600_get_dpd_log(char **data, size_t *len);
 #endif
 
+int bes2600_switch_bt(bool);
+
 #endif /* __BES_CHARDEV_H__ */

bes2600/bes_fw.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Firmware download for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include "bes_fw_common.h"
 #include "bes2600.h"

bes2600/bes_fw_common.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Firmware download common code for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include "bes_fw_common.h"
 #include "bes_log.h"

bes2600/bes_fw_common.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Firmware download common interface
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef __BES_FW_COMMON_H__
 #define __BES_FW_COMMON_H__

bes2600/bes_log.h

@@ -1,10 +1,3 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * printk wrappers for BES2600
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
- *
- */
 extern struct device *global_dev;
 
 #ifdef CONFIG_BES2600_ENABLE_DEVEL_LOGS

bes2600/bes_nl80211_testmode_msg.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Vendor testmode messages for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES_NL80211_TESTMODE_MSG_H

bes2600/bes_pwr.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Chip-side power state machine for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include <linux/list.h>
 #include <linux/pm.h>
@@ -464,65 +467,14 @@ static void bes2600_pwr_device_enter_lp_mode(struct bes2600_common *hw_priv)
 	bes_devel("device enter sleep\n");
 }
 
-/*
- * Number of consecutive bes2600_pwr_enter_lp_mode timeouts (with zero
- * PM_INDICATIONs received) before we conclude the firmware does not
- * honor host-driven PSM and switch to a sticky skip path.
- */
-#define BES2600_PM_UNSUPPORTED_THRESHOLD	3
-
-/*
- * Latch pm_unsupported = true and force chip_pm_state = ACTIVE so the
- * c6.2 wake-side skip branch covers bes2600_pwr_device_exit_lp_mode.
- * Called after BES2600_PM_UNSUPPORTED_THRESHOLD consecutive enter_lp_mode
- * timeouts with zero PM_INDICATIONs.
- */
-static void bes2600_pwr_latch_pm_unsupported(struct bes2600_common *hw_priv)
-{
-	bes_warn("PSM not honored (%u timeouts), switching to skip mode\n",
-		 hw_priv->bes_power.pm_consecutive_timeouts);
-	hw_priv->bes_power.pm_unsupported = true;
-	atomic_set(&hw_priv->bes_power.chip_pm_state,
-		   BES2600_CHIP_PM_ACTIVE);
-
-	/*
-	 * Hold the MCU wake-flag bit permanently. Without this, every
-	 * sdio_rx_work invocation hits bes2600_gpio_wakeup_mcu(SDIO_RX)
-	 * when gpio_wakup_flags == 0, drives the GPIO high and msleeps
-	 * 10 ms per RX. With ~50 RX/s of beacons + multicast that's
-	 * ~50%% of the bes_sdio workqueue thread blocked in msleep,
-	 * which directly caps RX throughput. Holding the MCU bit makes
-	 * those calls bit-only bookkeeping (gpio_wakeup = (flags == 0)
-	 * stays false, no GPIO toggle, no msleep). The bit is never
-	 * cleared once pm_unsupported is set because
-	 * bes2600_pwr_device_enter_lp_mode is unreachable under the
-	 * early-return.
-	 */
-	if (hw_priv->sbus_ops->gpio_wake)
-		hw_priv->sbus_ops->gpio_wake(hw_priv->sbus_priv,
-					     GPIO_WAKE_FLAG_MCU);
-}
-
 static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 {
 	int i = 0;
 	struct bes2600_vif *priv;
 	int ret = 0;
-	int timeouts = 0;
 	char ip_str[20];
 	unsigned long status = 0;
 
-	/*
-	 * Sticky early-return when we've previously concluded the firmware
-	 * doesn't honor PSM. Each attempt would otherwise burn 5s on a
-	 * doomed wait_for_completion_timeout and produce a noisy three-line
-	 * cascade in dmesg every time power_down_work retries (every
-	 * ~10s). The chip stays in active mode, which on this firmware is
-	 * the de-facto state anyway.
-	 */
-	if (hw_priv->bes_power.pm_unsupported)
-		return -EOPNOTSUPP;
-
 	/* set interface low power configuration */
 	bes2600_for_each_vif(hw_priv, priv, i) {
 #ifdef P2P_MULTIVIF
@@ -571,17 +523,7 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 				bes_devel("%s, psMode:%s, fastPsmIdlePeriod:%d apPsmChangePeriod:%d minAutoPsPollPeriod:%d\n",
 						__func__, bes2600_get_ps_mode_str(priv->powersave_mode.pmMode), priv->powersave_mode.fastPsmIdlePeriod,
 						priv->powersave_mode.apPsmChangePeriod, priv->powersave_mode.minAutoPsPollPeriod);
-				/*
-				 * Reinit BEFORE the WSM goes out, so a stale
-				 * indication from a previous cycle cannot have
-				 * primed pm_enter_cmpl. From here until the
-				 * indication callback's cmpxchg(1->0) on
-				 * pm_set_in_process, only the indication for
-				 * THIS request can complete the wait.
-				 */
-				reinit_completion(&hw_priv->bes_power.pm_enter_cmpl);
 				atomic_set(&hw_priv->bes_power.pm_set_in_process, 1);
-
 				ret = bes2600_set_pm(priv, &priv->powersave_mode);
 				if (ret) {
 					atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
@@ -590,79 +532,18 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 
 				/* wait power save mode changed indication */
 				status = wait_for_completion_timeout(&hw_priv->bes_power.pm_enter_cmpl, 5 * HZ);
-				if (!status) {
-					/*
-					 * The indication callback only fires
-					 * complete() when it observes
-					 * pm_set_in_process == 1; cmpxchg it
-					 * to 0 here so a late indication
-					 * cannot prime the next wait.
-					 *
-					 * If we win the cmpxchg, this is a
-					 * real timeout: the firmware's PS
-					 * state is unknown to us. Mark it as
-					 * such so the next wake path can
-					 * probe before assuming the chip is
-					 * still active.
-					 *
-					 * If we lose the cmpxchg, the
-					 * indication arrived between the
-					 * wait timing out and us getting
-					 * here; treat as success.
-					 */
-					if (atomic_cmpxchg(&hw_priv->bes_power.pm_set_in_process,
-							   1, 0) == 1) {
-						bes_devel("%s, wait pm ind timeout\n", __func__);
-						atomic_set(&hw_priv->bes_power.chip_pm_state,
-							   BES2600_CHIP_PM_UNKNOWN);
-						timeouts++;
-						if (++hw_priv->bes_power.pm_consecutive_timeouts
-						    >= BES2600_PM_UNSUPPORTED_THRESHOLD)
-							bes2600_pwr_latch_pm_unsupported(hw_priv);
-					}
-				}
+				atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
+				reinit_completion(&hw_priv->bes_power.pm_enter_cmpl);
+				if (!status)
+					bes_err("%s, wait pm ind timeout\n", __func__);
 			} else {
 				bes_devel("skip enter lp mode\n");
 			}
 		}
 	}
 
-	/*
-	 * Enter the device-end of the LP transition only if every per-VIF
-	 * mac80211 handshake reached firmware-ACKed completion. Doing the
-	 * device-LP setup while any VIF is still pending leaves the driver
-	 * in an inconsistent state that cascades into SDIO TX errors on
-	 * the BES2600.
-	 */
-	if (timeouts == 0) {
+	/* set device low power configuration */
 	bes2600_pwr_device_enter_lp_mode(hw_priv);
-	} else {
-		/*
-		 * device_enter_lp_mode() was skipped (one or more VIFs
-		 * timed out waiting for the firmware indication) so its
-		 * gpio_sleep(MCU) - which drops the wake-flag bit and, if
-		 * no other subsystem holds the wake, drives the GPIO low -
-		 * never ran. Without it the bit stays asserted, and the
-		 * next bes2600_pwr_device_exit_lp_mode() calls
-		 * gpio_wake(MCU) into a "bit already set" no-op: the GPIO
-		 * never re-edges, sbus_active() exhausts its 200x2ms
-		 * MCU_WAKEUP_READY budget against an unwoken chip, and
-		 * the first TX after idle stalls for several seconds.
-		 *
-		 * Drop the MCU wake-flag bit explicitly here so the next
-		 * wake injects a real GPIO edge. gpio_allow_mcu_sleep
-		 * preserves multi-subsystem semantics: it only drives the
-		 * GPIO low when no other subsystem still holds wake; if
-		 * BT or another holder is keeping the chip awake, the
-		 * GPIO stays high and the bit clear here is purely
-		 * bookkeeping (so the next gpio_wake doesn't no-op).
-		 */
-		if (!hw_priv->bes_power.pm_unsupported &&
-		    hw_priv->sbus_ops->gpio_sleep)
-			hw_priv->sbus_ops->gpio_sleep(hw_priv->sbus_priv,
-						      GPIO_WAKE_FLAG_MCU);
-		ret = -ETIMEDOUT;
-	}
 
 	return ret;
 }
@@ -670,61 +551,19 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 static void bes2600_pwr_device_exit_lp_mode(struct bes2600_common *hw_priv)
 {
 	int ret = 0;
-	enum bes2600_chip_pm_state state;
 	struct wsm_operational_mode mode = {
 		.power_mode = wsm_power_mode_active,
 		.disableMoreFlagUsage = true,
 	};
 
-	/*
-	 * Consult chip_pm_state set by bes2600_pwr_notify_ps_changed().
-	 * If we last saw the firmware confirm ACTIVE, skip ONLY the
-	 * gpio_wake + sbus_active wake handshake - the GPIO is already
-	 * asserted high and the SDIO MCU subsystem is already running,
-	 * so another sbus_active() round-trip just hits its 200x2ms
-	 * timeout because the firmware has nothing to do.
-	 *
-	 * wsm_set_operational_mode() below is NOT part of the wake
-	 * handshake; it is the operational-mode setter the firmware
-	 * tracks per call. Skipping it leaves the chip's SDIO state
-	 * machine without a fresh operational-mode update, which on
-	 * PineTab2 wedges the bus (-EBUSY on next sdio_rx_work read)
-	 * within a few seconds of probe completion. So it must run
-	 * unconditionally.
-	 */
-	state = atomic_read(&hw_priv->bes_power.chip_pm_state);
-	if (state == BES2600_CHIP_PM_ACTIVE) {
-		bes_devel("device_exit_lp_mode: chip already ACTIVE, skipping wake handshake\n");
-	} else {
 	bes_devel("host lock lmac\n");
-		if (hw_priv->sbus_ops->gpio_wake)
-			hw_priv->sbus_ops->gpio_wake(hw_priv->sbus_priv,
-						      GPIO_WAKE_FLAG_MCU);
+	if(hw_priv->sbus_ops->gpio_wake)
+		hw_priv->sbus_ops->gpio_wake(hw_priv->sbus_priv, GPIO_WAKE_FLAG_MCU);
 
-		if (hw_priv->sbus_ops->sbus_active) {
-			ret = hw_priv->sbus_ops->sbus_active(hw_priv->sbus_priv,
-							     SUBSYSTEM_MCU);
-			if (ret) {
-				/*
-				 * MCU_WAKEUP_READY did not arrive within
-				 * the SDIO handshake window. Record state
-				 * as UNKNOWN so the next exit_lp_mode call
-				 * also runs the full wake sequence (no
-				 * skip), but still send operational_mode
-				 * below to match pre-c6 behaviour - the
-				 * WSM may succeed even if the SDIO active
-				 * confirm was lost, and if it fails too,
-				 * we just emit a second devel-level error.
-				 * Repeated UNKNOWN is the signal for the
-				 * LMAC active-monitor to eventually
-				 * escalate to bus_reset (c5.2's
-				 * mmc_hw_reset path).
-				 */
+	if(hw_priv->sbus_ops->sbus_active) {
+		ret = hw_priv->sbus_ops->sbus_active(hw_priv->sbus_priv, SUBSYSTEM_MCU);
+		if (ret)
 			bes_err("%s, active mcu fail\n", __func__);
-				atomic_set(&hw_priv->bes_power.chip_pm_state,
-					   BES2600_CHIP_PM_UNKNOWN);
-			}
-		}
 	}
 
 	ret = wsm_set_operational_mode(hw_priv, &mode, 0);
@@ -980,9 +819,6 @@ void bes2600_pwr_init(struct bes2600_common *hw_priv)
         hw_priv->bes_power.power_up_task = NULL;
         mutex_init(&hw_priv->bes_power.pwr_mutex);
         atomic_set(&hw_priv->bes_power.dev_state, 0);
-	atomic_set(&hw_priv->bes_power.chip_pm_state, BES2600_CHIP_PM_UNKNOWN);
-	hw_priv->bes_power.pm_unsupported = false;
-	hw_priv->bes_power.pm_consecutive_timeouts = 0;
         init_completion(&hw_priv->bes_power.pm_enter_cmpl);
         sema_init(&hw_priv->bes_power.sync_lock, 1);
         device_set_wakeup_capable(hw_priv->pdev, true);
@@ -1363,40 +1199,9 @@ int bes2600_pwr_clear_busy_event(struct bes2600_common *hw_priv, u32 event)
 
 void bes2600_pwr_notify_ps_changed(struct bes2600_common *hw_priv, u8 psmode)
 {
-	/*
-	 * The firmware sends a PM-changed indication for every transition,
-	 * including ones we didn't ask for (firmware-internal coex moves,
-	 * idle-driven aging). Update chip_pm_state unconditionally so the
-	 * wake path can use it, but only fire pm_enter_cmpl when a host-
-	 * initiated set_pm is actually in flight - otherwise a stale
-	 * indication can prime a future wait against a freshly
-	 * reinit_completion()'ed state.
-	 */
-	/*
-	 * Any PM indication, whatever its psmode, proves the firmware is
-	 * actually emitting them. Reset the consecutive-timeout counter
-	 * so a transient stall doesn't permanently disable PSM, and clear
-	 * pm_unsupported if a previous run had latched it.
-	 */
-	hw_priv->bes_power.pm_consecutive_timeouts = 0;
-	if (hw_priv->bes_power.pm_unsupported) {
-		bes_warn("PM indication arrived after pm_unsupported was set; re-enabling PSM transitions\n");
-		hw_priv->bes_power.pm_unsupported = false;
-	}
-
-	if ((psmode & 0x01) != WSM_PSM_ACTIVE) {
-		atomic_set(&hw_priv->bes_power.chip_pm_state,
-			   BES2600_CHIP_PM_LP);
-		if (atomic_cmpxchg(&hw_priv->bes_power.pm_set_in_process,
-				   1, 0) == 1) {
+	if((psmode & 0x01) != WSM_PSM_ACTIVE) {
 		bes_devel("complete pm_enter_cmpl\n");
 		complete(&hw_priv->bes_power.pm_enter_cmpl);
-		} else {
-			bes_devel("PM ind (LP) without pending wait; state recorded\n");
-		}
-	} else {
-		atomic_set(&hw_priv->bes_power.chip_pm_state,
-			   BES2600_CHIP_PM_ACTIVE);
 	}
 }
 

bes2600/bes_pwr.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Chip-side power state machine interface
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef __BES_PWR_H__
 #define __BES_PWR_H__
@@ -61,20 +64,6 @@ enum power_down_state
         POWER_DOWN_STATE_UNLOCKED,
 };
 
-/*
- * Confirmed PM state of the firmware-side chip. Tracks what the host
- * has *seen* the firmware acknowledge, not what the host has
- * requested. UNKNOWN means a host-initiated transition timed out
- * before the firmware indication arrived; the next wake path should
- * treat it as "we don't know" and probe before issuing GPIO/SDIO
- * wakeup ops.
- */
-enum bes2600_chip_pm_state {
-	BES2600_CHIP_PM_ACTIVE = 0,
-	BES2600_CHIP_PM_LP,
-	BES2600_CHIP_PM_UNKNOWN,
-};
-
 typedef void (*bes_pwr_enter_lp_cb)(struct bes2600_common *hw_priv);
 typedef void (*bes_pwr_exit_lp_cb)(struct bes2600_common *hw_priv);
 
@@ -117,16 +106,6 @@ struct bes2600_pwr_t
         bool ap_lp_bad;
         struct bes2600_pwr_event_t pwr_events[BES2600_DELAY_EVENT_NUM];
         atomic_t pm_set_in_process;
-	atomic_t chip_pm_state;
-	/*
-	 * Sticky flag set after BES2600_PM_UNSUPPORTED_THRESHOLD
-	 * consecutive enter_lp_mode timeouts with zero PM_INDICATIONs
-	 * received from firmware. Indicates this chip's firmware does
-	 * not honor host-driven PSM transitions; further attempts are
-	 * skipped to avoid the 5s timeout cascade.
-	 */
-	bool pm_unsupported;
-	unsigned int pm_consecutive_timeouts;
 };
 
 #ifdef CONFIG_BES2600_WOWLAN

bes2600/bh.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Bottom-half thread for BES2600 mac80211 driver
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include <net/mac80211.h>
 #include <linux/kthread.h>
@@ -22,7 +22,6 @@
 #include "debug.h"
 #include "epta_coex.h"
 #include "bes_chardev.h"
-#include "txrx_opt.h"
 #include "sta.h"
 #include "bes_log.h"
 
@@ -102,7 +101,7 @@ void bes2600_unregister_bh(struct bes2600_common *hw_priv)
 	coex_deinit_mode(hw_priv);
 #endif
 
-	atomic_inc(&hw_priv->bh_term);
+	atomic_add(1, &hw_priv->bh_term);
 	wake_up(&hw_priv->bh_wq);
 
 	flush_workqueue(hw_priv->bh_workqueue);
@@ -317,6 +316,83 @@ int wsm_release_buffer_to_fw(struct bes2600_vif *priv, int count)
 }
 #endif
 
+#if 0
+static struct sk_buff *bes2600_get_skb(struct bes2600_common *hw_priv, size_t len)
+{
+	struct sk_buff *skb;
+	size_t alloc_len = (len > SDIO_BLOCK_SIZE) ? len : SDIO_BLOCK_SIZE;
+
+	if (len > SDIO_BLOCK_SIZE || !hw_priv->skb_cache) {
+		skb = dev_alloc_skb(alloc_len
+				+ WSM_TX_EXTRA_HEADROOM
+				+ 8  /* TKIP IV */
+				+ 12 /* TKIP ICV + MIC */
+				- 2  /* Piggyback */);
+		/* In AP mode RXed SKB can be looped back as a broadcast.
+		 * Here we reserve enough space for headers. */
+		skb_reserve(skb, WSM_TX_EXTRA_HEADROOM
+				+ 8 /* TKIP IV */
+				- WSM_RX_EXTRA_HEADROOM);
+	} else {
+		skb = hw_priv->skb_cache;
+		hw_priv->skb_cache = NULL;
+	}
+	return skb;
+}
+
+static void bes2600_put_skb(struct bes2600_common *hw_priv, struct sk_buff *skb)
+{
+	if (hw_priv->skb_cache)
+		dev_kfree_skb(skb);
+	else
+		hw_priv->skb_cache = skb;
+}
+
+static int bes2600_bh_read_ctrl_reg(struct bes2600_common *hw_priv,
+					  u16 *ctrl_reg)
+{
+	int ret;
+
+	ret = bes2600_reg_read_16(hw_priv,
+			ST90TDS_CONTROL_REG_ID, ctrl_reg);
+	if (ret) {
+		ret = bes2600_reg_read_16(hw_priv,
+				ST90TDS_CONTROL_REG_ID, ctrl_reg);
+		if (ret)
+			bes_err("[BH] Failed to read control register.\n");
+	}
+
+	return ret;
+}
+
+static int bes2600_device_wakeup(struct bes2600_common *hw_priv)
+{
+	u16 ctrl_reg;
+	int ret;
+
+	bes_devel("[BH] Device wakeup.\n");
+
+	/* To force the device to be always-on, the host sets WLAN_UP to 1 */
+	ret = bes2600_reg_write_16(hw_priv, ST90TDS_CONTROL_REG_ID,
+			ST90TDS_CONT_WUP_BIT);
+	if (WARN_ON(ret))
+		return ret;
+
+	ret = bes2600_bh_read_ctrl_reg(hw_priv, &ctrl_reg);
+	if (WARN_ON(ret))
+		return ret;
+
+	/* If the device returns WLAN_RDY as 1, the device is active and will
+	 * remain active. */
+	if (ctrl_reg & ST90TDS_CONT_RDY_BIT) {
+		bes_devel("[BH] Device awake.\n");
+		return 1;
+	}
+
+	return 0;
+}
+
+#endif
 
 /* Must be called from BH thraed. */
 void bes2600_enable_powersave(struct bes2600_vif *priv,
@@ -326,6 +402,475 @@ void bes2600_enable_powersave(struct bes2600_vif *priv,
 	priv->powersave_enabled = enable;
 }
 
+#if 0
+#define INTERRUPT_WORKAROUND
+static int bes2600_bh(void *arg)
+{
+	struct bes2600_common *hw_priv = arg;
+	struct bes2600_vif *priv = NULL;
+	struct sk_buff *skb_rx = NULL;
+	size_t read_len = 0;
+	int rx, tx, term, suspend;
+	struct wsm_hdr *wsm;
+	size_t wsm_len;
+	int wsm_id;
+	u8 wsm_seq;
+	int rx_resync = 1;
+	u16 ctrl_reg = 0;
+	int tx_allowed;
+	int pending_tx = 0;
+	int tx_burst;
+	int rx_burst = 0;
+	long status;
+#if defined(CONFIG_BES2600_WSM_DUMPS)
+	size_t wsm_dump_max = -1;
+#endif
+	u32 dummy;
+	bool powersave_enabled;
+	int i;
+	int vif_selected;
+
+	for (;;) {
+		powersave_enabled = 1;
+		spin_lock(&hw_priv->vif_list_lock);
+		bes2600_for_each_vif(hw_priv, priv, i) {
+#ifdef P2P_MULTIVIF
+			if ((i = (CW12XX_MAX_VIFS - 1)) || !priv)
+#else
+			if (!priv)
+#endif
+				continue;
+			powersave_enabled &= !!priv->powersave_enabled;
+		}
+		spin_unlock(&hw_priv->vif_list_lock);
+		if (!hw_priv->hw_bufs_used
+				&& powersave_enabled
+				&& !hw_priv->device_can_sleep
+				&& !atomic_read(&hw_priv->recent_scan)) {
+			status = HZ/8;
+			bes_devel("[BH] No Device wakedown.\n");
+#ifndef FPGA_SETUP
+			WARN_ON(bes2600_reg_write_16(hw_priv,
+						ST90TDS_CONTROL_REG_ID, 0));
+			hw_priv->device_can_sleep = true;
+#endif
+		} else if (hw_priv->hw_bufs_used)
+			/* Interrupt loss detection */
+			status = HZ/8;
+		else
+			status = HZ/8;
+
+		/* Dummy Read for SDIO retry mechanism*/
+		if (((atomic_read(&hw_priv->bh_rx) == 0) &&
+				(atomic_read(&hw_priv->bh_tx) == 0)))
+			bes2600_reg_read(hw_priv, ST90TDS_CONFIG_REG_ID,
+					&dummy, sizeof(dummy));
+#if defined(CONFIG_BES2600_WSM_DUMPS_SHORT)
+		wsm_dump_max = hw_priv->wsm_dump_max_size;
+#endif /* CONFIG_BES2600_WSM_DUMPS_SHORT */
+
+#ifdef INTERRUPT_WORKAROUND
+				/* If a packet has already been txed to the device then read the
+				   control register for a probable interrupt miss before going
+				   further to wait for interrupt; if the read length is non-zero
+				   then it means there is some data to be received */
+				if (hw_priv->hw_bufs_used) {
+					bes2600_bh_read_ctrl_reg(hw_priv, &ctrl_reg);
+					if(ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK)
+					{
+						rx = 1;
+						goto test;
+					}
+				}
+#endif
+
+		status = wait_event_interruptible_timeout(hw_priv->bh_wq, ({
+				rx = atomic_xchg(&hw_priv->bh_rx, 0);
+				tx = atomic_xchg(&hw_priv->bh_tx, 0);
+				term = atomic_xchg(&hw_priv->bh_term, 0);
+				suspend = pending_tx ?
+					0 : atomic_read(&hw_priv->bh_suspend);
+				(rx || tx || term || suspend || hw_priv->bh_error);
+			}), status);
+
+		if (status < 0 || term || hw_priv->bh_error)
+			break;
+
+#ifdef INTERRUPT_WORKAROUND
+		if (!status) {
+			bes2600_bh_read_ctrl_reg(hw_priv, &ctrl_reg);
+			if(ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK)
+			{
+				bes_err("MISS 1\n");
+				rx = 1;
+				goto test;
+			}
+		}
+#endif
+		if (!status && hw_priv->hw_bufs_used) {
+			unsigned long timestamp = jiffies;
+			long timeout;
+			bool pending = false;
+			int i;
+
+			wiphy_warn(hw_priv->hw->wiphy, "Missed interrupt?\n");
+			rx = 1;
+
+			/* Get a timestamp of "oldest" frame */
+			for (i = 0; i < 4; ++i)
+				pending |= bes2600_queue_get_xmit_timestamp(
+						&hw_priv->tx_queue[i],
+						&timestamp, -1,
+						hw_priv->pending_frame_id);
+
+			/* Check if frame transmission is timed out.
+			 * Add an extra second with respect to possible
+			 * interrupt loss. */
+			timeout = timestamp +
+					WSM_CMD_LAST_CHANCE_TIMEOUT +
+					1 * HZ  -
+					jiffies;
+
+			/* And terminate BH tread if the frame is "stuck" */
+			if (pending && timeout < 0) {
+				//wiphy_warn(priv->hw->wiphy,
+				//	"Timeout waiting for TX confirm.\n");
+				bes_devel("bes2600_bh: Timeout waiting for TX confirm.\n");
+				break;
+			}
+
+#if defined(CONFIG_BES2600_DUMP_ON_ERROR)
+			BUG_ON(1);
+#endif /* CONFIG_BES2600_DUMP_ON_ERROR */
+		} else if (!status) {
+			if (!hw_priv->device_can_sleep
+					&& !atomic_read(&hw_priv->recent_scan)) {
+				bes_devel("[BH] Device wakedown. Timeout.\n");
+#ifndef FPGA_SETUP
+				WARN_ON(bes2600_reg_write_16(hw_priv,
+						ST90TDS_CONTROL_REG_ID, 0));
+				hw_priv->device_can_sleep = true;
+#endif
+			}
+			continue;
+		} else if (suspend) {
+			bes_devel("[BH] Device suspend.\n");
+			powersave_enabled = 1;
+			spin_lock(&hw_priv->vif_list_lock);
+			bes2600_for_each_vif(hw_priv, priv, i) {
+#ifdef P2P_MULTIVIF
+				if ((i = (CW12XX_MAX_VIFS - 1)) || !priv)
+#else
+				if (!priv)
+#endif
+					continue;
+				powersave_enabled &= !!priv->powersave_enabled;
+			}
+			spin_unlock(&hw_priv->vif_list_lock);
+			if (powersave_enabled) {
+				bes_devel("[BH] No Device wakedown. Suspend.\n");
+#ifndef FPGA_SETUP
+				WARN_ON(bes2600_reg_write_16(hw_priv,
+						ST90TDS_CONTROL_REG_ID, 0));
+				hw_priv->device_can_sleep = true;
+#endif
+			}
+
+			atomic_set(&hw_priv->bh_suspend, BES2600_BH_SUSPENDED);
+			wake_up(&hw_priv->bh_evt_wq);
+			status = wait_event_interruptible(hw_priv->bh_wq,
+					BES2600_BH_RESUME == atomic_read(
+						&hw_priv->bh_suspend));
+			if (status < 0) {
+				wiphy_err(hw_priv->hw->wiphy,
+					"%s: Failed to wait for resume: %ld.\n",
+					__func__, status);
+				break;
+			}
+			bes_devel("[BH] Device resume.\n");
+			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
+			wake_up(&hw_priv->bh_evt_wq);
+			atomic_add(1, &hw_priv->bh_rx);
+			continue;
+		}
+
+test:
+		tx += pending_tx;
+		pending_tx = 0;
+
+		if (rx) {
+			size_t alloc_len;
+			u8 *data;
+
+#ifdef INTERRUPT_WORKAROUND
+			if(!(ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK))
+#endif
+			if (WARN_ON(bes2600_bh_read_ctrl_reg(
+					hw_priv, &ctrl_reg)))
+				break;
+rx:
+			read_len = (ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK) * 2;
+			if (!read_len) {
+				rx_burst = 0;
+				goto tx;
+			}
+
+			if (WARN_ON((read_len < sizeof(struct wsm_hdr)) ||
+					(read_len > EFFECTIVE_BUF_SIZE))) {
+				bes_devel("Invalid read len: %d", read_len);
+				break;
+			}
+
+			/* Add SIZE of PIGGYBACK reg (CONTROL Reg)
+			 * to the NEXT Message length + 2 Bytes for SKB */
+			read_len = read_len + 2;
+
+#if defined(CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES)
+			alloc_len = hw_priv->sbus_ops->align_size(
+					hw_priv->sbus_priv, read_len);
+#else /* CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES */
+			/* Platform's SDIO workaround */
+			alloc_len = read_len & ~(SDIO_BLOCK_SIZE - 1);
+			if (read_len & (SDIO_BLOCK_SIZE - 1))
+				alloc_len += SDIO_BLOCK_SIZE;
+#endif /* CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES */
+
+			/* Check if not exceeding BES2600 capabilities */
+			if (WARN_ON_ONCE(alloc_len > EFFECTIVE_BUF_SIZE))
+				bes_devel("Read aligned len: %d\n", alloc_len);
+
+			skb_rx = bes2600_get_skb(hw_priv, alloc_len);
+			if (WARN_ON(!skb_rx))
+				break;
+
+			skb_trim(skb_rx, 0);
+			skb_put(skb_rx, read_len);
+			data = skb_rx->data;
+			if (WARN_ON(!data))
+				break;
+
+			if (WARN_ON(bes2600_data_read(hw_priv, data, alloc_len)))
+				break;
+
+			/* Piggyback */
+			ctrl_reg = __le16_to_cpu(
+				((__le16 *)data)[alloc_len / 2 - 1]);
+
+			wsm = (struct wsm_hdr *)data;
+			wsm_len = __le32_to_cpu(wsm->len);
+			if (WARN_ON(wsm_len > read_len))
+				break;
+
+#if defined(CONFIG_BES2600_WSM_DUMPS)
+			if (unlikely(hw_priv->wsm_enable_wsm_dumps)) {
+				u16 msgid, ifid;
+				u16 *p = (u16 *)data;
+				msgid = (*(p + 1)) & 0xC3F;
+				ifid  = (*(p + 1)) >> 6;
+				ifid &= 0xF;
+				bes_devel("[DUMP] <<< msgid 0x%.4X ifid %d len %d\n", msgid, ifid, *p);
+				print_hex_dump(KERN_DEBUG, "<-- ", DUMP_PREFIX_NONE, data, min(wsm_len, wsm_dump_max));
+			}
+#endif /* CONFIG_BES2600_WSM_DUMPS */
+
+			wsm_id  = __le32_to_cpu(wsm->id) & 0xFFF;
+			wsm_seq = (__le32_to_cpu(wsm->id) >> 13) & 7;
+
+			skb_trim(skb_rx, wsm_len);
+
+			if (unlikely(wsm_id == 0x0800)) {
+				wsm_handle_exception(hw_priv,
+					 &data[sizeof(*wsm)],
+					wsm_len - sizeof(*wsm));
+				break;
+			} else if (unlikely(!rx_resync)) {
+				if (WARN_ON(wsm_seq != hw_priv->wsm_rx_seq)) {
+#if defined(CONFIG_BES2600_DUMP_ON_ERROR)
+					BUG_ON(1);
+#endif /* CONFIG_BES2600_DUMP_ON_ERROR */
+					break;
+				}
+			}
+			hw_priv->wsm_rx_seq = (wsm_seq + 1) & 7;
+			rx_resync = 0;
+
+			if (wsm_id & 0x0400) {
+				int rc = wsm_release_tx_buffer(hw_priv, 1);
+				if (WARN_ON(rc < 0))
+					break;
+				else if (rc > 0)
+					tx = 1;
+			}
+
+			/* bes2600_wsm_rx takes care on SKB livetime */
+			if (WARN_ON(wsm_handle_rx(hw_priv, wsm_id, wsm,
+						  &skb_rx)))
+				break;
+
+			if (skb_rx) {
+				bes2600_put_skb(hw_priv, skb_rx);
+				skb_rx = NULL;
+			}
+
+			read_len = 0;
+
+			if (rx_burst) {
+				bes2600_debug_rx_burst(hw_priv);
+				--rx_burst;
+				goto rx;
+			}
+		}
+
+tx:
+		BUG_ON(hw_priv->hw_bufs_used > hw_priv->wsm_caps.numInpChBufs);
+		tx_burst = hw_priv->wsm_caps.numInpChBufs -
+			hw_priv->hw_bufs_used;
+		tx_allowed = tx_burst > 0;
+		if (tx && tx_allowed) {
+			size_t tx_len;
+			u8 *data;
+			int ret;
+
+			if (hw_priv->device_can_sleep) {
+				ret = bes2600_device_wakeup(hw_priv);
+				if (WARN_ON(ret < 0))
+					break;
+				else if (ret)
+					hw_priv->device_can_sleep = false;
+				else {
+					/* Wait for "awake" interrupt */
+					pending_tx = tx;
+					continue;
+				}
+			}
+
+			wsm_alloc_tx_buffer(hw_priv);
+			ret = wsm_get_tx(hw_priv, &data, &tx_len, &tx_burst,
+						&vif_selected);
+			if (ret <= 0) {
+				wsm_release_tx_buffer(hw_priv, 1);
+				if (WARN_ON(ret < 0))
+					break;
+			} else {
+				wsm = (struct wsm_hdr *)data;
+				BUG_ON(tx_len < sizeof(*wsm));
+				BUG_ON(__le32_to_cpu(wsm->len) != tx_len);
+
+#if 0 /* count is not implemented */
+				if (ret > 1)
+					atomic_add(1, &hw_priv->bh_tx);
+#else
+				atomic_add(1, &hw_priv->bh_tx);
+#endif
+
+#if defined(CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES)
+				if (tx_len <= 8)
+					tx_len = 16;
+				tx_len = hw_priv->sbus_ops->align_size(
+						hw_priv->sbus_priv, tx_len);
+#else /* CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES */
+				/* HACK!!! Platform limitation.
+				* It is also supported by upper layer:
+				* there is always enough space at the
+				* end of the buffer. */
+				if (tx_len & (SDIO_BLOCK_SIZE - 1)) {
+					tx_len &= ~(SDIO_BLOCK_SIZE - 1);
+					tx_len += SDIO_BLOCK_SIZE;
+				}
+#endif /* CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES */
+
+				/* Check if not exceeding BES2600
+				    capabilities */
+				if (WARN_ON_ONCE(tx_len > EFFECTIVE_BUF_SIZE))
+					bes_devel("Write aligned len: %d\n", tx_len);
+
+				wsm->id &= __cpu_to_le32(
+						~WSM_TX_SEQ(WSM_TX_SEQ_MAX));
+				wsm->id |= cpu_to_le32(WSM_TX_SEQ(
+						hw_priv->wsm_tx_seq));
+
+				if (WARN_ON(bes2600_data_write(hw_priv,
+				    data, tx_len))) {
+					wsm_release_tx_buffer(hw_priv, 1);
+					break;
+				}
+
+				if (vif_selected != -1) {
+					hw_priv->hw_bufs_used_vif[
+							vif_selected]++;
+				}
+
+#if defined(CONFIG_BES2600_WSM_DUMPS)
+				if (unlikely(hw_priv->wsm_enable_wsm_dumps)) {
+					u16 msgid, ifid;
+					u16 *p = (u16 *)data;
+					msgid = (*(p + 1)) & 0x3F;
+					ifid  = (*(p + 1)) >> 6;
+					ifid &= 0xF;
+					if (msgid == 0x0006)
+						bes_devel("[DUMP] >>> msgid 0x%.4X ifid %d len %d MIB 0x%.4X\n", msgid, ifid, *p, *(p + 2));
+					else
+						bes_devel("[DUMP] >>> msgid 0x%.4X ifid %d len %d\n", msgid, ifid, *p);
+					print_hex_dump(KERN_DEBUG, "--> ", DUMP_PREFIX_NONE, data, min(__le32_to_cpu(wsm->len), wsm_dump_max));
+				}
+#endif /* CONFIG_BES2600_WSM_DUMPS */
+
+				wsm_txed(hw_priv, data);
+				hw_priv->wsm_tx_seq = (hw_priv->wsm_tx_seq + 1)
+						& WSM_TX_SEQ_MAX;
+
+				if (tx_burst > 1) {
+					bes2600_debug_tx_burst(hw_priv);
+					++rx_burst;
+					goto tx;
+				}
+			}
+		}
+
+		if (ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK)
+			goto rx;
+	}
+
+	if (skb_rx) {
+		bes2600_put_skb(hw_priv, skb_rx);
+		skb_rx = NULL;
+	}
+
+
+	if (!term) {
+		bes_devel("[BH] Fatal error, exitting.\n");
+#if defined(CONFIG_BES2600_DUMP_ON_ERROR)
+		BUG_ON(1);
+#endif /* CONFIG_BES2600_DUMP_ON_ERROR */
+		hw_priv->bh_error = 1;
+#if defined(CONFIG_BES2600_USE_STE_EXTENSIONS)
+		spin_lock(&hw_priv->vif_list_lock);
+		bes2600_for_each_vif(hw_priv, priv, i) {
+			if (!priv)
+				continue;
+			ieee80211_driver_hang_notify(priv->vif, GFP_KERNEL);
+		}
+		spin_unlock(&hw_priv->vif_list_lock);
+		bes2600_pm_stay_awake(&hw_priv->pm_state, 3*HZ);
+#endif
+		/* TODO: schedule_work(recovery) */
+#ifndef HAS_PUT_TASK_STRUCT
+		/* The only reason of having this stupid code here is
+		 * that __put_task_struct is not exported by kernel. */
+		for (;;) {
+			int status = wait_event_interruptible(hw_priv->bh_wq, ({
+				term = atomic_xchg(&hw_priv->bh_term, 0);
+				(term);
+				}));
+
+			if (status || term)
+				break;
+		}
+#endif
+	}
+	return 0;
+}
+#else
 
 extern int bes2600_bh_read_ctrl_reg(struct bes2600_common *priv, u32 *ctrl_reg);
 
@@ -413,119 +958,6 @@ static void bes2600_bh_parse_wakeup_event(struct bes2600_common *hw_priv, struct
 	}
 }
 
-/*
- * Direct-deliver an RX SKB into the WSM/mac80211 stack.
- *
- * Patch C v3 (no-relay architecture, matches cw1200): the bh thread
- * calls bes2600_sdio_read_rx_batch which calls
- * bes2600_sdio_extract_packets which calls THIS function per parsed
- * SKB.  No rx_queue, no sdio_rx_work, no inter-thread handoff.
- *
- * Single-writer-from-bh invariant on hw_priv->hw_bufs_used,
- * hw_priv->hw_bufs_used_vif[] and hw_priv->wsm_tx_pending[] is
- * preserved BY CONSTRUCTION — there is now only one writer (the bh
- * thread itself), same as cw1200's design.  No atomic_t conversion
- * needed.
- *
- * Contract:
- *   - process context, sleepable.  wsm_handle_rx (wsm.c, EXPORT_SYMBOL)
- *     acquires wsm_cmd.lock and may sleep on wait_event_timeout.
- *   - caller holds no bes2600 spinlock.  bes2600_sdio_unlock(self) is
- *     called inside read_rx_batch before extract_packets is invoked.
- *   - SKB ownership: function frees on every path (success + error).
- *   - No need to wake the bh thread on TX-confirm — we ARE the bh
- *     thread; tx_burst is signalled by returning *tx_out = 1 to the
- *     caller (bh_rx_helper), which propagates it to bh's outer loop.
- */
-int bes2600_bh_handle_rx_skb(struct bes2600_common *priv, struct sk_buff *skb)
-{
-	struct wsm_hdr *wsm;
-	size_t wsm_len;
-	u16 wsm_id;
-	u8 wsm_seq;
-	int tx = 0;
-	u32 confirm_label = 0x0;
-
-	if (!skb)
-		return 0;
-
-	wsm = (struct wsm_hdr *)skb->data;
-	wsm_len = __le16_to_cpu(wsm->len);
-	if (WARN_ON(wsm_len > skb->len)) {
-		bes_err("wsm_len err %d %d\n", (int)wsm_len, (int)skb->len);
-		dev_kfree_skb(skb);
-		return -1;
-	}
-
-	if (priv->wsm_enable_wsm_dumps)
-		print_hex_dump(KERN_DEBUG, "<-- ", DUMP_PREFIX_NONE, 16, 1,
-			       skb->data, wsm_len, false);
-
-	wsm_id  = __le16_to_cpu(wsm->id) & 0xFFF;
-	wsm_seq = (__le16_to_cpu(wsm->id) >> 13) & 7;
-	bes_devel("bes2600_bh_handle_rx_skb wsm_id:0x%04x seq:%d\n",
-		  wsm_id, wsm_seq);
-
-	skb_trim(skb, wsm_len);
-
-	if (wsm_id == 0x0800) {
-		wsm_handle_exception(priv,
-				     &skb->data[sizeof(*wsm)],
-				     wsm_len - sizeof(*wsm));
-		bes_err("wsm exception\n");
-		dev_kfree_skb(skb);
-		return -1;
-	} else if ((wsm_seq != priv->wsm_rx_seq[WSM_TXRX_SEQ_IDX(wsm_id)])) {
-		bes_err("seq error! %u. %u. 0x%x.", wsm_seq,
-			priv->wsm_rx_seq[WSM_TXRX_SEQ_IDX(wsm_id)], wsm_id);
-		dev_kfree_skb(skb);
-		return -1;
-	}
-
-	bes2600_bh_parse_wakeup_event(priv, skb);
-
-	priv->wsm_rx_seq[WSM_TXRX_SEQ_IDX(wsm_id)] = (wsm_seq + 1) & 7;
-
-	if (IS_DRIVER_TO_MCU_CMD(wsm_id))
-		confirm_label = __le32_to_cpu(((struct wsm_mcu_hdr *)wsm)->handle_label);
-
-	if (WSM_CONFIRM_CONDITION(wsm_id, confirm_label)) {
-		int rc = wsm_release_tx_buffer(priv, 1);
-		bes2600_bh_dec_pending_count(priv, WSM_TXRX_SEQ_IDX(wsm->id));
-
-		if (rc < 0) {
-			bes_err("wsm_release_tx_buffer failed: %d\n", rc);
-			dev_kfree_skb(skb);
-			return rc;
-		} else if (rc > 0) {
-			tx = 1;
-		}
-	}
-
-	/* wsm_handle_rx takes care of SKB lifetime: zeroes *skb_p if consumed. */
-	if (wsm_handle_rx(priv, wsm_id, wsm, &skb)) {
-		bes_err("wsm_handle_rx failed (id=0x%04x)\n", wsm_id);
-		if (skb)
-			dev_kfree_skb(skb);
-		return -1;
-	}
-
-	if (skb)
-		dev_kfree_skb(skb);
-
-	/*
-	 * Signal "tx side has new headroom" via atomic so the bh outer
-	 * loop's wait_event predicate notices on its next wait.  No
-	 * cross-thread wake needed because we are the bh thread; the
-	 * outer loop will pick this up after read_rx_batch returns.
-	 */
-	if (tx)
-		atomic_inc(&priv->bh_tx);
-
-	return 0;
-}
-EXPORT_SYMBOL(bes2600_bh_handle_rx_skb);
-
 static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
 {
 	struct sk_buff *skb = NULL;
@@ -537,18 +969,10 @@ static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
 	u32 confirm_label = 0x0; /* wsm to mcu cmd cnfirm label */
 
 #if defined(BES_SDIO_RX_MULTIPLE_ENABLE)
-	/*
-	 * Patch C v3: the bh thread does the SDIO read inline via
-	 * sbus_ops->bus_rx_batch.  bes2600_sdio_read_rx_batch reads the
-	 * multi-RX coalesced frames out of the chip and delivers each
-	 * one inline via bes2600_bh_handle_rx_skb (no rx_queue, no
-	 * pipe_read, no inter-thread handoff).  Return value: 0 on
-	 * success (bh outer loop will check whether to continue),
-	 * negative on read error.
-	 */
-	if (priv->sbus_ops->bus_rx_batch)
-		return priv->sbus_ops->bus_rx_batch(priv->sbus_priv);
+	skb = (struct sk_buff *)priv->sbus_ops->pipe_read(priv->sbus_priv);
+	if (!skb)
 		return 0;
+	rx = 1; // always consider rx pipe not empty
 #else
 	u32 ctrl_reg = 0;
 	size_t read_len = 0;
@@ -710,7 +1134,7 @@ static int bes2600_bh_tx_helper(struct bes2600_common *hw_priv,
 	tx_len += 4;
 #endif
 
-	atomic_inc(&hw_priv->bh_tx);
+	atomic_add(1, &hw_priv->bh_tx);
 
 	tx_len = hw_priv->sbus_ops->align_size(
 		hw_priv->sbus_priv, tx_len);
@@ -835,8 +1259,6 @@ int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
 		delta_time = jiffies + ((unsigned long)0xffffffff - timestamp);
 	else
 		delta_time =  jiffies - timestamp;
-	bes2600_add_tx_delta_time(delta_time);
-	bes2600_add_tx_ac_delta_time(queue_id, delta_time);
 
 	if (bes2600_need_retry_type(skb, tx_confirm->status) == 0)
 		return -1;
@@ -845,12 +1267,8 @@ int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
 		return -1;
 
 	if (txpriv->retry_count < CW1200_MAX_SW_RETRY_CNT ) {
-		struct bes2600_vif *priv =
-		__cw12xx_hwpriv_to_vifpriv(hw_priv, txpriv->if_id);
 		txpriv->retry_count++;
 
-		bes2600_tx_status(priv,skb);
-
 		bes2600_pwr_set_busy_event_with_timeout_async(
 			hw_priv, BES_PWR_LOCK_ON_TX, BES_PWR_EVENT_TX_TIMEOUT);
 
@@ -886,14 +1304,14 @@ void bes2600_bh_dec_pending_count(struct bes2600_common *hw_priv, int idx)
 	}
 
 	if (--hw_priv->wsm_tx_pending[idx] == 0)
-		timer_delete_sync(timer);
+		del_timer_sync(timer);
 	else
 		mod_timer(timer, jiffies + 3 * HZ);
 }
 
 void bes2600_bh_mcu_active_monitor(struct timer_list* t)
 {
-	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, mcu_mon_timer);
+	struct bes2600_common *hw_priv = from_timer(hw_priv, t, mcu_mon_timer);
 
 	bes_err("link break between mcu and host, hw_buf_used:%d pending:%d\n", 
 				hw_priv->hw_bufs_used, hw_priv->wsm_tx_pending[1]);
@@ -902,7 +1320,7 @@ void bes2600_bh_mcu_active_monitor(struct timer_list* t)
 
 void bes2600_bh_lmac_active_monitor(struct timer_list* t)
 {
-	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, lmac_mon_timer);
+	struct bes2600_common *hw_priv = from_timer(hw_priv, t, lmac_mon_timer);
 
 	bes_err("link break between lmac and host, hw_buf_used:%d pending:%d\n", 
 				hw_priv->hw_bufs_used, hw_priv->wsm_tx_pending[0]);
@@ -1017,7 +1435,7 @@ static int bes2600_bh(void *arg)
 			bes_devel("[BH] Device resume.\n");
 			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
 			wake_up(&hw_priv->bh_evt_wq);
-			atomic_inc(&hw_priv->bh_rx);
+			atomic_add(1, &hw_priv->bh_rx);
 			goto done;
 		}
 
@@ -1053,15 +1471,7 @@ static int bes2600_bh(void *arg)
 
 			tx = 0;
 
-			/*
-			 * Patch H: BUG_ON -> WARN_ON_ONCE in the steady-state
-			 * hot path.  The original BUG_ON ran every bh-loop
-			 * iteration; tripping it on a bookkeeping bug locks
-			 * the kernel up during normal operation, which is
-			 * the wrong response.  WARN_ON_ONCE surfaces the
-			 * issue without taking the system down.
-			 */
-			WARN_ON_ONCE(hw_priv->hw_bufs_used > hw_priv->wsm_caps.numInpChBufs);
+			BUG_ON(hw_priv->hw_bufs_used > hw_priv->wsm_caps.numInpChBufs);
 			tx_burst = hw_priv->wsm_caps.numInpChBufs - hw_priv->hw_bufs_used;
 			tx_allowed = tx_burst > 0;
 
@@ -1105,19 +1515,18 @@ static int bes2600_bh(void *arg)
 			goto tx;
 
 	done:
-		/*
-		 * Patch H: dropped the dead `__bes2600_irq_enable(1)` /
-		 * `asm volatile("nop")` placeholder that used to sit here.
-		 * `__bes2600_irq_enable()` is a stub that returns 0 on
-		 * bes2600 silicon — the IRQ is managed by sdio_claim_irq
-		 * and chip-side firmware, not by a driver-side enable bit.
-		 * (cw1200 inherited the function from a different chip
-		 * shape; bes2600 kept the stub but the call sites are
-		 * meaningless.)
-		 */
-		;
+		/* Re-enable device interrupts */
+		//hw_priv->sbus_ops->lock(hw_priv->sbus_priv);
+		//__bes2600_irq_enable(1);
+		//hw_priv->sbus_ops->unlock(hw_priv->sbus_priv);
+		asm volatile ("nop");
 	}
 
+	/* Explicitly disable device interrupts */
+	hw_priv->sbus_ops->lock(hw_priv->sbus_priv);
+	__bes2600_irq_enable(0);
+	hw_priv->sbus_ops->unlock(hw_priv->sbus_priv);
+
 	if (!term) {
 		bes_err("[BH] Fatal error, exiting.\n");
 		sdio_work_debug(hw_priv->sbus_priv);
@@ -1126,3 +1535,4 @@ static int bes2600_bh(void *arg)
 	}
 	return 0;
 }
+#endif

bes2600/bh.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Bottom-half thread interface for BES2600 mac80211 driver
+ * Device handling thread interface for mac80211 BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_BH_H
@@ -39,15 +39,6 @@ int wsm_release_vif_tx_buffer(struct bes2600_common *hw_priv, int if_id,
 int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
 			 struct wsm_tx_confirm *tx_confirm);
 
-/*
- * Direct-deliver an RX SKB into the WSM/mac80211 stack from the bh thread.
- * Called by bes2600_sdio_extract_packets per RX frame, no queueing.
- * Process context, sleepable, caller holds no bes2600 spinlock.
- * Function frees skb on every path. See bh.c for full contract.
- */
-int bes2600_bh_handle_rx_skb(struct bes2600_common *hw_priv,
-			     struct sk_buff *skb);
-
 void bes2600_bh_inc_pending_count(struct bes2600_common *hw_priv, int idx);
 void bes2600_bh_dec_pending_count(struct bes2600_common *hw_priv, int idx);
 

bes2600/debug.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Debugging interface for BES2600 mac80211 driver
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/module.h>
@@ -110,20 +110,17 @@ static int bes2600_status_show_common(struct seq_file *seq, void *v)
 	int ba_cnt, ba_acc, ba_cnt_rx, ba_acc_rx, ba_avg = 0, ba_avg_rx = 0;
 	bool ba_ena;
 
-	/*
-	 * Patch D: ba_lock removed.  hw_priv->debug->ba_* are written only
-	 * by the timer callback (single writer); reading without a lock is
-	 * fine for stats.  ba_ena is atomic_t.
-	 */
+	spin_lock_bh(&hw_priv->ba_lock);
 	ba_cnt = hw_priv->debug->ba_cnt;
 	ba_acc = hw_priv->debug->ba_acc;
 	ba_cnt_rx = hw_priv->debug->ba_cnt_rx;
 	ba_acc_rx = hw_priv->debug->ba_acc_rx;
-	ba_ena    = !!atomic_read(&hw_priv->ba_ena);
+	ba_ena = hw_priv->ba_ena;
 	if (ba_cnt)
 		ba_avg = ba_acc / ba_cnt;
 	if (ba_cnt_rx)
 		ba_avg_rx = ba_acc_rx / ba_cnt_rx;
+	spin_unlock_bh(&hw_priv->ba_lock);
 
 	seq_puts(seq,   "BES2600 Wireless LAN driver status\n");
 	seq_printf(seq, "Hardware:   %d.%d\n",
@@ -545,10 +542,6 @@ static int bes2600_status_show_priv(struct seq_file *seq, void *v)
 		priv->listening ? " (listening)" : "");
 	seq_printf(seq, "Assoc:      %s\n",
 		bes2600_debug_join_status[priv->join_status]);
-	seq_printf(seq, "DecryptStormRecoveries: %u\n",
-		   priv->decrypt_storm_recoveries);
-	seq_printf(seq, "ConnectionLossStormRecoveries: %u\n",
-		   priv->connection_loss_storm_recoveries);
 	if (priv->rx_filter.promiscuous)
 		seq_puts(seq,   "Filter:     promisc\n");
 	else if (priv->rx_filter.fcs)

bes2600/debug.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Debugging interface for BES2600 mac80211 driver
+ * DebugFS code for BES2600 mac80211 driver
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2011, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_DEBUG_H_INCLUDED

bes2600/epta_coex.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * BT/WiFi coexistence (ePTA) for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include <linux/types.h>
 #include <linux/version.h>

bes2600/epta_coex.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * BT/WiFi coexistence interface for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef __EPTA_COEX_H__
 #define __EPTA_COEX_H__

bes2600/epta_request.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * BT/WiFi coexistence request handling
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include <linux/types.h>
 #include <linux/kernel.h>

bes2600/epta_request.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * BT/WiFi coexistence request interface
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef EPTA_REQUEST_H
 #define EPTA_REQUEST_H

bes2600/fwio.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Firmware I/O for BES2600 mac80211 driver
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/init.h>

bes2600/fwio.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Firmware I/O interface for BES2600 mac80211 driver
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef FWIO_H_INCLUDED
 #define FWIO_H_INCLUDED

bes2600/h4_recv.h

@@ -1,154 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-/*
- *  Copy of drivers/bluetooth/h4_recv.h
- *
- *  Generic Bluetooth HCI UART driver
- *
- *  Copyright (C) 2015-2018  Intel Corporation
- */
-
-#include <linux/unaligned.h>
-
-struct h4_recv_pkt {
-	u8  type;	/* Packet type */
-	u8  hlen;	/* Header length */
-	u8  loff;	/* Data length offset in header */
-	u8  lsize;	/* Data length field size */
-	u16 maxlen;	/* Max overall packet length */
-	int (*recv)(struct hci_dev *hdev, struct sk_buff *skb);
-};
-
-#define H4_RECV_ACL \
-	.type = HCI_ACLDATA_PKT, \
-	.hlen = HCI_ACL_HDR_SIZE, \
-	.loff = 2, \
-	.lsize = 2, \
-	.maxlen = HCI_MAX_FRAME_SIZE \
-
-#define H4_RECV_SCO \
-	.type = HCI_SCODATA_PKT, \
-	.hlen = HCI_SCO_HDR_SIZE, \
-	.loff = 2, \
-	.lsize = 1, \
-	.maxlen = HCI_MAX_SCO_SIZE
-
-#define H4_RECV_EVENT \
-	.type = HCI_EVENT_PKT, \
-	.hlen = HCI_EVENT_HDR_SIZE, \
-	.loff = 1, \
-	.lsize = 1, \
-	.maxlen = HCI_MAX_EVENT_SIZE
-
-#define H4_RECV_ISO \
-	.type = HCI_ISODATA_PKT, \
-	.hlen = HCI_ISO_HDR_SIZE, \
-	.loff = 2, \
-	.lsize = 2, \
-	.maxlen = HCI_MAX_FRAME_SIZE
-
-static inline struct sk_buff *h4_recv_buf(struct hci_dev *hdev,
-					  struct sk_buff *skb,
-					  const unsigned char *buffer,
-					  int count,
-					  const struct h4_recv_pkt *pkts,
-					  int pkts_count)
-{
-	/* Check for error from previous call */
-	if (IS_ERR(skb))
-		skb = NULL;
-
-	while (count) {
-		int i, len;
-
-		if (!skb) {
-			for (i = 0; i < pkts_count; i++) {
-				if (buffer[0] != (&pkts[i])->type)
-					continue;
-
-				skb = bt_skb_alloc((&pkts[i])->maxlen,
-						   GFP_ATOMIC);
-				if (!skb)
-					return ERR_PTR(-ENOMEM);
-
-				hci_skb_pkt_type(skb) = (&pkts[i])->type;
-				hci_skb_expect(skb) = (&pkts[i])->hlen;
-				break;
-			}
-
-			/* Check for invalid packet type */
-			if (!skb)
-				return ERR_PTR(-EILSEQ);
-
-			count -= 1;
-			buffer += 1;
-		}
-
-		len = min_t(uint, hci_skb_expect(skb) - skb->len, count);
-		skb_put_data(skb, buffer, len);
-
-		count -= len;
-		buffer += len;
-
-		/* Check for partial packet */
-		if (skb->len < hci_skb_expect(skb))
-			continue;
-
-		for (i = 0; i < pkts_count; i++) {
-			if (hci_skb_pkt_type(skb) == (&pkts[i])->type)
-				break;
-		}
-
-		if (i >= pkts_count) {
-			kfree_skb(skb);
-			return ERR_PTR(-EILSEQ);
-		}
-
-		if (skb->len == (&pkts[i])->hlen) {
-			u16 dlen;
-
-			switch ((&pkts[i])->lsize) {
-			case 0:
-				/* No variable data length */
-				dlen = 0;
-				break;
-			case 1:
-				/* Single octet variable length */
-				dlen = skb->data[(&pkts[i])->loff];
-				hci_skb_expect(skb) += dlen;
-
-				if (skb_tailroom(skb) < dlen) {
-					kfree_skb(skb);
-					return ERR_PTR(-EMSGSIZE);
-				}
-				break;
-			case 2:
-				/* Double octet variable length */
-				dlen = get_unaligned_le16(skb->data +
-							  (&pkts[i])->loff);
-				hci_skb_expect(skb) += dlen;
-
-				if (skb_tailroom(skb) < dlen) {
-					kfree_skb(skb);
-					return ERR_PTR(-EMSGSIZE);
-				}
-				break;
-			default:
-				/* Unsupported variable length */
-				kfree_skb(skb);
-				return ERR_PTR(-EILSEQ);
-			}
-
-			if (!dlen) {
-				/* No more data, complete frame */
-				(&pkts[i])->recv(hdev, skb);
-				skb = NULL;
-			}
-		} else {
-			/* Complete frame */
-			(&pkts[i])->recv(hdev, skb);
-			skb = NULL;
-		}
-	}
-
-	return skb;
-}

bes2600/ht.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * HT capability config for BES2600
+ *  HT-related code for BES2600 driver
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_HT_H_INCLUDED

bes2600/hwio.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Low-level device I/O for BES2600 mac80211 driver
+ * Low-level device IO routines for BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/types.h>
@@ -324,10 +324,7 @@ out:
 }
 #endif
 
-/*
- * Patch H: __bes2600_irq_enable stub removed.  It was a no-op
- * (always returned 0) inherited from cw1200 where the analogous
- * function manipulates the chip's IRQ-enable register.  bes2600
- * silicon manages SDIO IRQ via sdio_claim_irq and chip-side
- * firmware — there is no driver-side enable register to write.
- */
+int __bes2600_irq_enable(int enable)
+{
+	return 0;
+}

bes2600/hwio.h

@@ -1,12 +1,17 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Low-level device I/O interface for BES2600 mac80211 driver
+ * Low-level API for mac80211 BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Based on:
+ * UMAC BES2600 driver which is
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_HWIO_H_INCLUDED

bes2600/itp.c

@@ -1,9 +1,13 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * ITP (in-band test mode) for BES2600
+ * mac80211 glue code for mac80211 BES2600 drivers
+ * ITP code
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/module.h>
@@ -566,7 +570,7 @@ int bes2600_itp_get_tx(struct bes2600_common *priv, u8 **data,
 	*burst = 2;
 	atomic_set(&priv->bh_tx, 1);
 	ktime_get_ts(&itp->last_sent);
-	atomic_inc(&itp->awaiting_confirm);
+	atomic_add(1, &itp->awaiting_confirm);
 	spin_unlock_bh(&itp->tx_lock);
 	return 1;
 

bes2600/itp.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * ITP interface for BES2600
+ * ITP code for BES2600 mac80211 driver
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2011, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_ITP_H_INCLUDED

bes2600/main.c

@@ -1,18 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Main entry/init for BES2600 mac80211 driver
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
- *
- * Based on the mac80211 Prism54 code, which is
- * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
- *
- * Based on the islsm (softmac prism54) driver, which is
- * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/module.h>
@@ -38,7 +32,6 @@
 #include "pm.h"
 #include "bes2600_factory.h"
 #include "bes_chardev.h"
-#include "txrx_opt.h"
 
 MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>");
 MODULE_DESCRIPTION("Softmac BES2600 common code");
@@ -205,11 +198,7 @@ static const struct ieee80211_iface_limit bes2600_if_limits[] = {
 			     BIT(NL80211_IFTYPE_P2P_CLIENT) |
 			     BIT(NL80211_IFTYPE_P2P_GO) },
 #ifdef P2P_MULTIVIF
-	/*
-	 * HACK: Disable P2P_DEVICE implementation for BES2600
-	 *       as the code is a little buggy.
-	 */
-	//{ .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
+	{ .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
 #endif
 };
 
@@ -495,20 +484,17 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
 	spin_lock_init(&hw_priv->rtsvalue_lock);
 	INIT_WORK(&hw_priv->dynamic_opt_txrx_work, bes2600_dynamic_opt_txrx_work);
 	INIT_WORK(&hw_priv->tx_policy_upload_work, tx_policy_upload_work);
-	INIT_WORK(&hw_priv->connection_loss_storm_recover_work,
-		  bes2600_connection_loss_storm_recover);
 	spin_lock_init(&hw_priv->event_queue_lock);
 	INIT_LIST_HEAD(&hw_priv->event_queue);
 	INIT_WORK(&hw_priv->event_handler, bes2600_event_handler);
 	INIT_WORK(&hw_priv->ba_work, bes2600_ba_work);
-	/* Patch D: ba_lock removed; ba_acc/ba_cnt/etc are atomic_t. */
+	spin_lock_init(&hw_priv->ba_lock);
 	timer_setup(&hw_priv->ba_timer, bes2600_ba_timer, 0);
 
 	if (unlikely(bes2600_queue_stats_init(&hw_priv->tx_queue_stats,
 			WLAN_LINK_ID_MAX,
 			bes2600_skb_dtor,
 			hw_priv))) {
-		destroy_workqueue(hw_priv->workqueue);
 		ieee80211_free_hw(hw);
 		return NULL;
 	}
@@ -520,7 +506,6 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
 			for (; i > 0; i--)
 				bes2600_queue_deinit(&hw_priv->tx_queue[i - 1]);
 			bes2600_queue_stats_deinit(&hw_priv->tx_queue_stats);
-			destroy_workqueue(hw_priv->workqueue);
 			ieee80211_free_hw(hw);
 			return NULL;
 		}
@@ -608,7 +593,7 @@ static void bes2600_unregister_common(struct ieee80211_hw *dev)
 
 	ieee80211_unregister_hw(dev);
 
-	timer_delete_sync(&hw_priv->ba_timer);
+	del_timer_sync(&hw_priv->ba_timer);
 
 	hw_priv->sbus_ops->irq_unsubscribe(hw_priv->sbus_priv);
 	bes2600_unregister_bh(hw_priv);
@@ -911,8 +896,8 @@ int bes2600_wifi_stop(struct bes2600_common *hw_priv)
 	hw_priv->wsm_tx_seq[1] = 0;
 	hw_priv->wsm_tx_pending[0] = 0;
 	hw_priv->wsm_tx_pending[1] = 0;
-	timer_delete_sync(&hw_priv->mcu_mon_timer);
-	timer_delete_sync(&hw_priv->lmac_mon_timer);
+	del_timer_sync(&hw_priv->mcu_mon_timer);
+	del_timer_sync(&hw_priv->lmac_mon_timer);
 #ifdef CONFIG_BES2600_STATIC_SDD
 	hw_priv->sdd = NULL;
 #else

bes2600/pm.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Power management for BES2600 mac80211 driver
+ * Mac80211 power management API for BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2011, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/platform_device.h>

bes2600/pm.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Power management interface for BES2600 mac80211 driver
+ * Mac80211 power management interface for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2011, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef PM_H_INCLUDED

bes2600/queue.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * O(1) TX queue for BES2600 mac80211 driver
+ * O(1) TX queue with built-in allocator for BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <net/mac80211.h>
@@ -119,9 +119,10 @@ static void bes2600_queue_register_post_gc(struct list_head *gc_list,
 				     struct bes2600_queue_item *item)
 {
 	struct bes2600_queue_item *gc_item;
-	gc_item = kmemdup(item, sizeof(struct bes2600_queue_item),
+	gc_item = kmalloc(sizeof(struct bes2600_queue_item),
 			GFP_ATOMIC);
 	BUG_ON(!gc_item);
+	memcpy(gc_item, item, sizeof(struct bes2600_queue_item));
 	list_add_tail(&gc_item->head, gc_list);
 }
 
@@ -130,9 +131,9 @@ static void bes2600_queue_pending_record(struct list_head *pending_record_list,
 {
 	struct bes2600_queue_item *record_item;
 
-	record_item = kmemdup(pending_item, sizeof(struct bes2600_queue_item),
-			GFP_ATOMIC);
+	record_item = kmalloc(sizeof(struct bes2600_queue_item),GFP_ATOMIC);
 	BUG_ON(!record_item);
+	memcpy(record_item, pending_item, sizeof(struct bes2600_queue_item));
 	record_item->skb = skb_clone(pending_item->skb, GFP_ATOMIC);
 	list_add_tail(&record_item->head, pending_record_list);
 }
@@ -195,7 +196,7 @@ static void __bes2600_queue_gc(struct bes2600_queue *queue,
 static void bes2600_queue_gc(struct timer_list *t)
 {
 	LIST_HEAD(list);
-	struct bes2600_queue *queue = timer_container_of(queue, t, gc);
+	struct bes2600_queue *queue = from_timer(queue, t, gc);
 
 	spin_lock_bh(&queue->lock);
 	__bes2600_queue_gc(queue, &list, true);
@@ -217,7 +218,7 @@ int bes2600_queue_stats_init(struct bes2600_queue_stats *stats,
 	spin_lock_init(&stats->lock);
 	init_waitqueue_head(&stats->wait_link_id_empty);
 	for (i = 0; i < CW12XX_MAX_VIFS; i++) {
-		stats->link_map_cache[i] = kcalloc(map_capacity, sizeof(int),
+		stats->link_map_cache[i] = kzalloc(map_capacity * sizeof(int),
 			GFP_KERNEL);
 		if (!stats->link_map_cache[i]) {
 			for (; i >= 0; i--)
@@ -248,14 +249,14 @@ int bes2600_queue_init(struct bes2600_queue *queue,
 	queue->queue_all_lock = false;
 	spin_lock_init(&queue->lock);
 	timer_setup(&queue->gc, bes2600_queue_gc, 0);
-	queue->pool = kcalloc(capacity, sizeof(struct bes2600_queue_item),
+	queue->pool = kzalloc(sizeof(struct bes2600_queue_item) * capacity,
 			GFP_KERNEL);
 	if (!queue->pool)
 		return -ENOMEM;
 
 	for (i = 0; i < CW12XX_MAX_VIFS; i++) {
 		queue->link_map_cache[i] =
-				kcalloc(stats->map_capacity, sizeof(int),
+				kzalloc(stats->map_capacity * sizeof(int),
 			GFP_KERNEL);
 		if (!queue->link_map_cache[i]) {
 			for (; i >= 0; i--)
@@ -362,7 +363,7 @@ void bes2600_queue_deinit(struct bes2600_queue *queue)
 	int i;
 
 	bes2600_queue_clear(queue, CW12XX_ALL_IFS);
-	timer_delete_sync(&queue->gc);
+	del_timer_sync(&queue->gc);
 	INIT_LIST_HEAD(&queue->free_pool);
 	kfree(queue->pool);
 	for (i = 0; i < CW12XX_MAX_VIFS; i++) {
@@ -409,6 +410,7 @@ int bes2600_queue_put(struct bes2600_queue *queue,
 	struct timespec64 tmval;
 #endif /*CONFIG_BES2600_TESTMODE*/
 
+	LIST_HEAD(gc_list);
 	struct bes2600_queue_stats *stats = queue->stats;
 	/* TODO:COMBO: Add interface ID info to queue item */
 
@@ -827,19 +829,19 @@ int bes2600_queue_get_skb(struct bes2600_queue *queue, u32 packetID,
 	bes2600_queue_parse_id(packetID, &queue_generation, &queue_id,
 				&item_generation, &item_id, &if_id, &link_id);
 
-	spin_lock_bh(&queue->stats->hw_priv->tx_loop.pending_record_lock);
+	spin_lock(&queue->stats->hw_priv->tx_loop.pending_record_lock);
 	if (!list_empty(&queue->stats->hw_priv->tx_loop.pending_record_list)) {
 		list_for_each_entry_safe(record_item, temp_record_item, &queue->stats->hw_priv->tx_loop.pending_record_list, head) {
 			if (record_item->packetID == packetID) {
 				list_del(&record_item->head);
 				dev_kfree_skb(record_item->skb);
 				kfree(record_item);
-				spin_unlock_bh(&queue->stats->hw_priv->tx_loop.pending_record_lock);
+				spin_unlock(&queue->stats->hw_priv->tx_loop.pending_record_lock);
 				return -EINVAL;
 			}
 		}
 	}
-	spin_unlock_bh(&queue->stats->hw_priv->tx_loop.pending_record_lock);
+	spin_unlock(&queue->stats->hw_priv->tx_loop.pending_record_lock);
 
 	item = &queue->pool[item_id];
 

bes2600/queue.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * O(1) TX queue interface for BES2600 mac80211 driver
+ * O(1) TX queue with built-in allocator for BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_QUEUE_H_INCLUDED

bes2600/sbus.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Bus abstraction interface for BES2600
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
- * Replaces hwbus.h from drivers/net/wireless/st/cw1200/
- * Copyright (c) 2010, ST-Ericsson
+ * Common sbus abstraction layer interface for bes2600 wireless driver
  *
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_SBUS_H
@@ -75,26 +75,11 @@ struct sbus_ops {
 	void (*halt_device)(struct sbus_priv *self);
 	bool (*wakeup_source)(struct sbus_priv *self);
 	int (*reboot)(struct sbus_priv *self);
-	/*
-	 * Force the host bus to re-detect and re-probe the chip. Called
-	 * from the firmware-wedge recovery path when power_switch() has no
-	 * effective chip-reset signal of its own (e.g. PineTab2, where the
-	 * wifi-reset GPIO is owned by sdio_pwrseq, not the bes2600 node).
-	 * Returns 0 on success or a negative errno.
-	 */
-	int (*bus_reset)(struct sbus_priv *self);
-	/*
-	 * Read a batch of RX frames inline from the bus and deliver each
-	 * one via bes2600_bh_handle_rx_skb().  Called from the bh thread
-	 * (process context, sleepable).  Replaces the
-	 * sdio_rx_work + rx_queue + pipe_read relay (Patch C v3, 2026).
-	 * Returns 0 on success, negative on read error.
-	 */
-	int (*bus_rx_batch)(struct sbus_priv *self);
 };
 
 void bes2600_irq_handler(struct bes2600_common *priv);
 
-/* Patch H: __bes2600_irq_enable removed (was a stub). */
+/* This MUST be wrapped with hwbus_ops->lock/unlock! */
+int __bes2600_irq_enable(int enable);
 
 #endif /* BES2600_SBUS_H */

bes2600/scan.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Scan implementation for BES2600 mac80211 driver
+ * Scan implementation for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/sched.h>
@@ -14,63 +14,11 @@
 #include "scan.h"
 #include "sta.h"
 #include "pm.h"
-#include "epta_coex.h"
 #include "epta_request.h"
 #include "bes_pwr.h"
 
-/*
- * After this many consecutive WSM scan rejections from firmware, stop
- * issuing new scans for BES2600_SCAN_BACKOFF_JIFFIES and let the state
- * that's rejecting them (coex window, firmware-internal busy) clear.
- *
- * The backoff has to be at least as long as the natural mac80211 scan-
- * retry cadence, otherwise the next attempt lands outside the window
- * and bypasses the defer guard. Observed in the wild on PineTab2:
- * roam-evaluation bursts at ~12 s cadence, idle background scans at
- * ~5 min cadence. 30 s catches the burst and leaves the slow case
- * alone (the firmware-policy state has had minutes to clear by then
- * anyway).
- */
-#define BES2600_SCAN_REJECT_THRESHOLD	3
-#define BES2600_SCAN_BACKOFF_JIFFIES	(30 * HZ)
-
 static void bes2600_scan_restart_delayed(struct bes2600_vif *priv);
 
-/*
- * Decide whether to skip sending the next WSM scan command without
- * bothering the firmware. Two triggers:
- *
- *  1. BT A2DP is streaming in non-FDD coex mode. The firmware is
- *     known to reject scan requests during that window; short-
- *     circuiting here saves a WSM round-trip and avoids the
- *     wsm_generic_confirm / scan_work warning cascade that follows.
- *
- *  2. We already saw >= BES2600_SCAN_REJECT_THRESHOLD consecutive
- *     rejections on recent scan attempts and the backoff window has
- *     not yet elapsed. Whatever was rejecting them is likely still
- *     rejecting them; give it time. If the backoff has elapsed without
- *     a fresh reject refreshing it, the burst is over and we reset the
- *     count so an isolated reject doesn't immediately re-trip.
- *
- * Returns true if the caller should abandon the scan iteration.
- */
-static bool bes2600_scan_should_defer(struct bes2600_common *hw_priv)
-{
-#ifdef WIFI_BT_COEXIST_EPTA_ENABLE
-	if (!coex_is_fdd_mode() && coex_is_bt_a2dp())
-		return true;
-#endif
-
-	if (time_after(jiffies, hw_priv->scan.backoff_until))
-		hw_priv->scan.reject_count = 0;
-
-	if (hw_priv->scan.reject_count >= BES2600_SCAN_REJECT_THRESHOLD &&
-	    time_before(jiffies, hw_priv->scan.backoff_until))
-		return true;
-
-	return false;
-}
-
 #ifdef CONFIG_BES2600_TESTMODE
 static int bes2600_advance_scan_start(struct bes2600_common *hw_priv)
 {
@@ -257,21 +205,18 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
 
 	bes2600_pwr_set_busy_event(hw_priv, BES_PWR_LOCK_ON_SCAN);
 
-	/* will be unlocked in bes2600_scan_work() */
-	down(&hw_priv->scan.lock);
-	down(&hw_priv->conf_lock);
-
 	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
 		req->ie_len);
-	if (!frame.skb) {
-		up(&hw_priv->conf_lock);
-		up(&hw_priv->scan.lock);
+	if (!frame.skb)
 		return -ENOMEM;
-	}
 
 	if (req->ie_len)
 		skb_put_data(frame.skb, req->ie, req->ie_len);
 
+	/* will be unlocked in bes2600_scan_work() */
+	down(&hw_priv->scan.lock);
+	down(&hw_priv->conf_lock);
+
 	if (frame.skb) {
 		int ret;
 		//if (priv->if_id == 0)
@@ -289,9 +234,9 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
 		}
 #endif
 		if (ret) {
-			dev_kfree_skb(frame.skb);
 			up(&hw_priv->conf_lock);
 			up(&hw_priv->scan.lock);
+			dev_kfree_skb(frame.skb);
 			return ret;
 		}
 	}
@@ -321,10 +266,10 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
 		++hw_priv->scan.n_ssids;
 	}
 
+	up(&hw_priv->conf_lock);
+
 	if (frame.skb)
 		dev_kfree_skb(frame.skb);
-
-	up(&hw_priv->conf_lock);
 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
 	bwifi_change_current_status(hw_priv, BWIFI_STATUS_SCANNING);
 #endif
@@ -365,18 +310,14 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
 	if (req->n_ssids > hw->wiphy->max_scan_ssids)
 		return -EINVAL;
 
+	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
+		req->ie_len);
+	if (!frame.skb)
+		return -ENOMEM;
+
 	/* will be unlocked in bes2600_scan_work() */
 	down(&hw_priv->scan.lock);
 	down(&hw_priv->conf_lock);
-
-	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
-		req->ie_len);
-	if (!frame.skb) {
-		up(&hw_priv->conf_lock);
-		up(&hw_priv->scan.lock);
-		return -ENOMEM;
-	}
-
 	if (frame.skb) {
 		int ret;
 		if (priv->if_id == 0)
@@ -387,9 +328,9 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
 			ret = wsm_set_probe_responder(priv, true);
 		}
 		if (ret) {
-			dev_kfree_skb(frame.skb);
 			up(&hw_priv->conf_lock);
 			up(&hw_priv->scan.lock);
+			dev_kfree_skb(frame.skb);
 			return ret;
 		}
 	}
@@ -421,10 +362,10 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
 		}
 	}
 
+	up(&hw_priv->conf_lock);
+
 	if (frame.skb)
 		dev_kfree_skb(frame.skb);
-
-	up(&hw_priv->conf_lock);
 	queue_work(hw_priv->workqueue, &hw_priv->scan.swork);
 	wiphy_warn(hw->wiphy, "<--[SCAN] Scheduled scan request.\n");
 	return 0;
@@ -592,10 +533,10 @@ void bes2600_scan_work(struct work_struct *work)
 					"[SCAN] Scan failed (%d).\n",
 					hw_priv->scan.status);
 		else if (hw_priv->scan.req)
-			wiphy_dbg(priv->hw->wiphy,
+			wiphy_info(priv->hw->wiphy,
 					"[SCAN] Scan completed.\n");
 		else
-			wiphy_dbg(priv->hw->wiphy,
+			wiphy_info(priv->hw->wiphy,
 					"[SCAN] Scan canceled.\n");
 
 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
@@ -680,9 +621,8 @@ void bes2600_scan_work(struct work_struct *work)
 			scan.scanType = WSM_SCAN_TYPE_BACKGROUND;
 			scan.scanFlags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
 		}
-		scan.ch = kcalloc((it - hw_priv->scan.curr),
-				   sizeof(struct wsm_scan_ch),
-				   GFP_KERNEL);
+		scan.ch = kzalloc((it - hw_priv->scan.curr) *
+			sizeof(struct wsm_scan_ch), GFP_KERNEL);
 		if (!scan.ch) {
 			hw_priv->scan.status = -ENOMEM;
 			goto fail;
@@ -762,29 +702,10 @@ void bes2600_scan_work(struct work_struct *work)
 				wsm_unlock_tx(hw_priv);
 		} else
 #endif
-		{
-			if (bes2600_scan_should_defer(hw_priv)) {
-				hw_priv->scan.status = -EBUSY;
-				hw_priv->scan.reject_count++;
-				hw_priv->scan.backoff_until =
-					jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
-				wiphy_dbg(priv->hw->wiphy,
-					  "[SCAN] deferred (coex/backoff, reject_count=%u)\n",
-					  hw_priv->scan.reject_count);
-				kfree(scan.ch);
-				goto fail;
-			}
 			hw_priv->scan.status = bes2600_scan_start(priv, &scan);
-		}
 		kfree(scan.ch);
-		if (hw_priv->scan.status) {
-			hw_priv->scan.reject_count++;
-			hw_priv->scan.backoff_until =
-				jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
-			/* Lower callers already logged the reason at wiphy_warn. */
+		if (WARN_ON(hw_priv->scan.status))
 			goto fail;
-		}
-		hw_priv->scan.reject_count = 0;
 		hw_priv->scan.curr = it;
 	}
 	up(&hw_priv->conf_lock);
@@ -984,7 +905,7 @@ void bes2600_scan_complete_cb(struct bes2600_common *hw_priv,
 	// recover EPTA timer after scan wsm msg complete, in case of epta state error
 	// bwifi_change_current_status(hw_priv, BWIFI_STATUS_SCANNING_COMP);
 #endif
-	wiphy_dbg(hw_priv->hw->wiphy, "bes2600_scan_complete_cb status: %u", arg->status);
+	wiphy_info(hw_priv->hw->wiphy, "bes2600_scan_complete_cb status: %u", arg->status);
 
 	if(hw_priv->scan.status == -ETIMEDOUT)
 		wiphy_warn(hw_priv->hw->wiphy,

bes2600/scan.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Scan interface for BES2600 mac80211 driver
+ * Scan interface for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef SCAN_H_INCLUDED
@@ -42,17 +42,6 @@ struct bes2600_scan {
 	struct delayed_work probe_work;
 	int direct_probe;
 	u8 if_id;
-	/*
-	 * Track consecutive firmware-side WSM scan rejections so we can
-	 * back off briefly instead of re-issuing the same scan on every
-	 * mac80211 background-scan tick. Firmware returns WSM status != 0
-	 * for a handful of transient conditions (BT A2DP active in non-
-	 * FDD coex, firmware-internal busy windows) and keeps rejecting
-	 * until the state clears; retrying at full cadence just floods
-	 * dmesg.
-	 */
-	unsigned int reject_count;
-	unsigned long backoff_until;
 };
 
 int bes2600_hw_scan(struct ieee80211_hw *hw,

bes2600/sta.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 STA API for BES2600 mac80211 driver
+ * Mac80211 STA API for BES2600 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/vmalloc.h>
@@ -42,8 +42,6 @@
 #include "bes2600_factory.h"
 #endif
 
-#include "txrx_opt.h"
-
 #define WEP_ENCRYPT_HDR_SIZE    4
 #define WEP_ENCRYPT_TAIL_SIZE   4
 #define WPA_ENCRYPT_HDR_SIZE    8
@@ -221,7 +219,7 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
 	cancel_delayed_work_sync(&hw_priv->advance_scan_timeout);
 #endif
 	flush_workqueue(hw_priv->workqueue);
-	timer_delete_sync(&hw_priv->ba_timer);
+	del_timer_sync(&hw_priv->ba_timer);
 
 	down(&hw_priv->conf_lock);
 
@@ -261,14 +259,13 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
 		cancel_delayed_work_sync(&priv->bss_loss_work);
 		cancel_delayed_work_sync(&priv->connection_loss_work);
 		cancel_delayed_work_sync(&priv->link_id_gc_work);
-		timer_delete_sync(&priv->mcast_timeout);
+		del_timer_sync(&priv->mcast_timeout);
 	}
 
 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
 	cancel_work_sync(&hw_priv->coex_work);
 	coex_stop(hw_priv);
 #endif
-	cancel_work_sync(&hw_priv->connection_loss_storm_recover_work);
 
 	bes2600_wifi_stop(hw_priv);
 
@@ -378,23 +375,9 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
 	atomic_set(&priv->enabled, 0);
 	down(&hw_priv->scan.lock);
 	down(&hw_priv->conf_lock);
-
-	/*
-	 * There's a chance remove_interface will run again on the same
-	 * (already removed) interface.
-	 *
-	 * Currently this only happens when NetworkManager creates a P2P_DEVICE
-	 * alongside a STA.
-	 *
-	 * But there can be other cases where this may run as well. So if that
-	 * happens, let's throw a warning and decrease the vifs count by one.
-	 */
-	if (WARN_ON(!__cw12xx_hwpriv_to_vifpriv(hw_priv, priv->if_id))) {
+	if (!__cw12xx_hwpriv_to_vifpriv(hw_priv, priv->if_id)) {
 		bes_devel(" !!! %s: interface addr %pM already removed\n",
 			     __func__, vif->addr);
-
-		atomic_dec(&hw_priv->num_vifs);
-
 	        up(&hw_priv->conf_lock);
 	        up(&hw_priv->scan.lock);
 		return;
@@ -465,9 +448,8 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
 	cancel_delayed_work_sync(&priv->join_timeout);
 	cancel_delayed_work_sync(&priv->set_cts_work);
 	cancel_delayed_work_sync(&priv->pending_offchanneltx_work);
-	cancel_work_sync(&priv->decrypt_storm_recover_work);
 
-	timer_delete_sync(&priv->mcast_timeout);
+	del_timer_sync(&priv->mcast_timeout);
 	/* TODO:COMBO: May be reset of these variables "delayed_link_loss and
 	 * join_status to default can be removed as dev_priv will be freed by
 	 * mac80211 */
@@ -520,7 +502,7 @@ int bes2600_change_interface(struct ieee80211_hw *dev,
 	return ret;
 }
 
-int bes2600_config(struct ieee80211_hw *dev, int radio_idx, u32 changed)
+int bes2600_config(struct ieee80211_hw *dev, u32 changed)
 {
 	int ret = 0;
 	struct bes2600_common *hw_priv = dev->priv;
@@ -1155,7 +1137,7 @@ void bes2600_wep_key_work(struct work_struct *work)
 	wsm_unlock_tx(hw_priv);
 }
 
-int bes2600_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx, u32 value)
+int bes2600_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 {
 	struct bes2600_common *hw_priv = hw->priv;
 	int ret;
@@ -1500,7 +1482,7 @@ void bes2600_event_handler(struct work_struct *work)
 						IEEE80211_STYPE_DEAUTH | IEEE80211_FCTL_TODS);
 				deauth->u.deauth.reason_code = WLAN_REASON_DEAUTH_LEAVING;
 				deauth->seq_ctrl = 0;
-				ieee80211_rx_ni(priv->hw, skb);
+				ieee80211_rx_irqsafe(priv->hw, skb);
 				bes_devel(" Inactivity Deauth Frame sent for MAC SA %pM \t and DA %pM\n", deauth->sa, deauth->da);
 				queue_work(priv->hw_priv->workqueue, &priv->set_tim_work);
 				break;
@@ -1676,70 +1658,6 @@ report:
 	spin_unlock(&priv->bss_loss_lock);
 }
 
-/*
- * Connection-loss-storm fast-recover (Trigger A).
- *
- * bes2600_connection_loss_work below is the driver's own decision-point
- * to give up on a BSS (after bss-loss detection accumulates beyond
- * tolerance) and tell mac80211 via ieee80211_connection_loss(). On the
- * deployed pinetab2 stack a single ieee80211_connection_loss() event
- * sometimes triggers a userspace reauth blackhole (assoc-comeback
- * timeouts followed by AP unprotected-deauth-reason-6) that ends only
- * via cross-channel/cross-SSID fallback and can take 80+ s. Receipts at
- * https://git.reauktion.de/marfrit/besser, notes/phase4-2026-05-07.md.
- *
- * When N connection-loss decisions land within WINDOW on the same vif,
- * skip the ieee80211_connection_loss() path and trigger a chip-level
- * bus_reset (the c5.2-introduced bes2600_chrdev_do_bus_reset). The chip
- * is removed and re-probed; userspace re-associates from a fresh state,
- * dodging the assoc-comeback loop.
- *
- * Threshold (3 / 60 s) is chosen well above the steady-state per-vif
- * connection-loss rate observed in the patch-A Phase-7 rep
- * (0.86/h under sustained load), so a true storm is required.
- *
- * The recover work_struct lives on bes2600_common (hw_priv) so that
- * scheduling it does not race with vif teardown after bus_reset frees
- * the per-vif state.
- */
-#define BES2600_CONNECTION_LOSS_STORM_THRESHOLD	3
-#define BES2600_CONNECTION_LOSS_STORM_WINDOW_MS	60000
-
-void bes2600_connection_loss_storm_recover(struct work_struct *work)
-{
-	bes_warn("[bes2600] connection-loss-storm fast-recover: bus_reset\n");
-	bes2600_chrdev_trigger_bus_reset();
-	/*
-	 * After bes2600_chrdev_do_bus_reset() returns, the SDIO core has
-	 * scheduled a remove + rescan; per-vif state may already be gone.
-	 * Do not dereference any per-vif pointer here.
-	 */
-}
-
-void bes2600_connection_loss_storm_init(struct bes2600_vif *priv)
-{
-	priv->connection_loss_storm_window_start = 0;
-	priv->connection_loss_storm_count = 0;
-	priv->connection_loss_storm_recoveries = 0;
-}
-
-bool bes2600_connection_loss_storm_account(struct bes2600_vif *priv)
-{
-	unsigned long now = jiffies;
-	unsigned long window =
-		msecs_to_jiffies(BES2600_CONNECTION_LOSS_STORM_WINDOW_MS);
-
-	if (priv->connection_loss_storm_window_start == 0 ||
-	    time_after(now, priv->connection_loss_storm_window_start + window)) {
-		priv->connection_loss_storm_window_start = now;
-		priv->connection_loss_storm_count = 1;
-		return false;
-	}
-
-	return ++priv->connection_loss_storm_count >=
-	       BES2600_CONNECTION_LOSS_STORM_THRESHOLD;
-}
-
 void bes2600_connection_loss_work(struct work_struct *work)
 {
 	struct bes2600_vif *priv =
@@ -1749,21 +1667,9 @@ void bes2600_connection_loss_work(struct work_struct *work)
 
 	bes_devel("[CQM] Reporting connection loss.\n");
 	bes2600_pwr_clear_busy_event(priv->hw_priv, BES_PWR_LOCK_ON_BSS_LOST);
-
-	if (bes2600_connection_loss_storm_account(priv)) {
-		bes_warn("[bes2600] connection-loss storm: %u in %u s, scheduling bus reset\n",
-			 priv->connection_loss_storm_count,
-			 BES2600_CONNECTION_LOSS_STORM_WINDOW_MS / 1000);
-		priv->connection_loss_storm_count = 0;
-		priv->connection_loss_storm_recoveries++;
-		schedule_work(&hw_priv->connection_loss_storm_recover_work);
-		/* bus_reset will tear the chip down; skip the mac80211 path. */
-		return;
-	}
-
-	if (bes2600_suspend_status_get(hw_priv))
+	if(bes2600_suspend_status_get(hw_priv)) {
 		bes2600_pending_unjoin_set(hw_priv, priv->if_id);
-	else
+	} else
 		ieee80211_connection_loss(priv->vif);
 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
 	// set disconnected in BSS_CHANGED_ASSOC
@@ -2263,8 +2169,6 @@ void bes2600_join_work(struct work_struct *work)
 		wsm_unlock_tx(hw_priv);
 		return;
 	}
-
-	rcu_read_lock();
 	ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
 	dtimie = ieee80211_bss_get_ie(bss, WLAN_EID_TIM);
 	if (dtimie)
@@ -2348,8 +2252,6 @@ void bes2600_join_work(struct work_struct *work)
 				bes2600_rate_mask_to_wsm(hw_priv, 0xFF0);
 		}
 
-		rcu_read_unlock();
-
 		bes2600_pwr_set_busy_event(hw_priv, BES_PWR_LOCK_ON_JOIN);
 		wsm_flush_tx(hw_priv);
 
@@ -2362,19 +2264,14 @@ void bes2600_join_work(struct work_struct *work)
 		//WARN_ON(wsm_reset(hw_priv, &reset, priv->if_id));
 		WARN_ON(wsm_set_block_ack_policy(hw_priv,
 			0, hw_priv->ba_tid_mask, priv->if_id));
-		/*
-		 * Patch D: ba_lock removed.  Disconnect-reset clears the
-		 * counters and the arm flag; producers racing here cannot
-		 * cause harm — at worst they re-arm the timer and bump
-		 * counters that will be cleared on the next timer tick.
-		 */
-		atomic_set(&hw_priv->ba_ena, 0);
-		atomic_set(&hw_priv->ba_cnt, 0);
-		atomic_set(&hw_priv->ba_acc, 0);
+		spin_lock_bh(&hw_priv->ba_lock);
+		hw_priv->ba_ena = false;
+		hw_priv->ba_cnt = 0;
+		hw_priv->ba_acc = 0;
 		hw_priv->ba_hist = 0;
-		atomic_set(&hw_priv->ba_cnt_rx, 0);
-		atomic_set(&hw_priv->ba_acc_rx, 0);
-		atomic_set(&hw_priv->ba_armed, 0);
+		hw_priv->ba_cnt_rx = 0;
+		hw_priv->ba_acc_rx = 0;
+		spin_unlock_bh(&hw_priv->ba_lock);
 
 		mgmt_policy.protectedMgmtEnable = 0;
 		mgmt_policy.unprotectedMgmtFramesAllowed = 1;
@@ -2461,7 +2358,7 @@ void bes2600_unjoin_work(struct work_struct *work)
 	int i;
 	struct bes2600_vif *tmp_priv;
 
-	timer_delete_sync(&hw_priv->ba_timer);
+	del_timer_sync(&hw_priv->ba_timer);
 	down(&hw_priv->conf_lock);
 	if (unlikely(atomic_read(&hw_priv->scan.in_progress)
 		|| atomic_read(&priv->connect_in_process))) {
@@ -2654,11 +2551,10 @@ void bes2600_ba_work(struct work_struct *work)
 		return;*/
 
 	bes_devel("BA work****\n");
-	/*
-	 * Patch D: ba_lock removed.  ba_tid_mask is u8 set once at init
-	 * (main.c); reading it without a lock is fine.
-	 */
+	spin_lock_bh(&hw_priv->ba_lock);
+//	tx_ba_tid_mask = hw_priv->ba_ena ? hw_priv->ba_tid_mask : 0;
 	tx_ba_tid_mask = hw_priv->ba_tid_mask;
+	spin_unlock_bh(&hw_priv->ba_lock);
 
 	wsm_lock_tx(hw_priv);
 
@@ -2671,49 +2567,37 @@ void bes2600_ba_work(struct work_struct *work)
 void bes2600_ba_timer(struct timer_list *t)
 {
 	bool ba_ena;
-	int cnt, acc, cnt_rx, acc_rx;
-	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, ba_timer);
+	struct bes2600_common *hw_priv = from_timer(hw_priv, t, ba_timer);
 
-	/*
-	 * Patch D: ba_lock removed.  Snapshot atomic counters into locals
-	 * for the predicate evaluation; producers may race incrementing
-	 * after the snapshot but the resulting decision is approximate
-	 * which the policy already tolerates (next timer tick re-evaluates).
-	 */
-	cnt    = atomic_read(&hw_priv->ba_cnt);
-	acc    = atomic_read(&hw_priv->ba_acc);
-	cnt_rx = atomic_read(&hw_priv->ba_cnt_rx);
-	acc_rx = atomic_read(&hw_priv->ba_acc_rx);
-
-	bes2600_debug_ba(hw_priv, cnt, acc, cnt_rx, acc_rx);
+	spin_lock_bh(&hw_priv->ba_lock);
+	bes2600_debug_ba(hw_priv, hw_priv->ba_cnt, hw_priv->ba_acc,
+			hw_priv->ba_cnt_rx, hw_priv->ba_acc_rx);
 
 	if (atomic_read(&hw_priv->scan.in_progress)) {
-		atomic_set(&hw_priv->ba_cnt, 0);
-		atomic_set(&hw_priv->ba_acc, 0);
-		atomic_set(&hw_priv->ba_cnt_rx, 0);
-		atomic_set(&hw_priv->ba_acc_rx, 0);
-		atomic_set(&hw_priv->ba_armed, 0);
-		return;
+		hw_priv->ba_cnt = 0;
+		hw_priv->ba_acc = 0;
+		hw_priv->ba_cnt_rx = 0;
+		hw_priv->ba_acc_rx = 0;
+		goto skip_statistic_update;
 	}
 
-	if (cnt >= BES2600_BLOCK_ACK_CNT &&
-		(acc / cnt >= BES2600_BLOCK_ACK_THLD ||
-		(cnt_rx >= BES2600_BLOCK_ACK_CNT &&
-		acc_rx / cnt_rx >=
+	if (hw_priv->ba_cnt >= BES2600_BLOCK_ACK_CNT &&
+		(hw_priv->ba_acc / hw_priv->ba_cnt >= BES2600_BLOCK_ACK_THLD ||
+		(hw_priv->ba_cnt_rx >= BES2600_BLOCK_ACK_CNT &&
+		hw_priv->ba_acc_rx / hw_priv->ba_cnt_rx >=
 			BES2600_BLOCK_ACK_THLD)))
 		ba_ena = true;
 	else
 		ba_ena = false;
 
-	atomic_set(&hw_priv->ba_cnt, 0);
-	atomic_set(&hw_priv->ba_acc, 0);
-	atomic_set(&hw_priv->ba_cnt_rx, 0);
-	atomic_set(&hw_priv->ba_acc_rx, 0);
-	atomic_set(&hw_priv->ba_armed, 0);
+	hw_priv->ba_cnt = 0;
+	hw_priv->ba_acc = 0;
+	hw_priv->ba_cnt_rx = 0;
+	hw_priv->ba_acc_rx = 0;
 
-	if (ba_ena != !!atomic_read(&hw_priv->ba_ena)) {
+	if (ba_ena != hw_priv->ba_ena) {
 		if (ba_ena || ++hw_priv->ba_hist >= BES2600_BLOCK_ACK_HIST) {
-			atomic_set(&hw_priv->ba_ena, ba_ena ? 1 : 0);
+			hw_priv->ba_ena = ba_ena;
 			hw_priv->ba_hist = 0;
 #if 0
 			bes_devel("[STA] %s block ACK:\n",
@@ -2723,6 +2607,9 @@ void bes2600_ba_timer(struct timer_list *t)
 		}
 	} else if (hw_priv->ba_hist)
 		--hw_priv->ba_hist;
+
+skip_statistic_update:
+	spin_unlock_bh(&hw_priv->ba_lock);
 }
 
 int bes2600_vif_setup(struct bes2600_vif *priv)
@@ -2732,8 +2619,6 @@ int bes2600_vif_setup(struct bes2600_vif *priv)
 
 	/* Setup per vif workitems and locks */
 	spin_lock_init(&priv->vif_lock);
-	bes2600_decrypt_storm_init(priv);
-	bes2600_connection_loss_storm_init(priv);
 	INIT_WORK(&priv->join_work, bes2600_join_work);
 	INIT_DELAYED_WORK(&priv->join_timeout, bes2600_join_timeout);
 	INIT_WORK(&priv->unjoin_work, bes2600_unjoin_work);
@@ -2904,7 +2789,6 @@ void bes2600_dynamic_opt_txrx_work(struct work_struct *work)
 	if (priv != NULL && priv->join_status > BES2600_JOIN_STATUS_MONITOR) {
 		multivif_connected = true;
 	}
-	bes2600_txrx_opt_multivif_connected_handler(hw_priv, multivif_connected);
 }
 
 

bes2600/sta.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 STA API interface for BES2600 mac80211 driver
+ * Mac80211 STA interface for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include <linux/version.h>
 #ifndef STA_H_INCLUDED
@@ -26,7 +26,7 @@ int bes2600_change_interface(struct ieee80211_hw *dev,
 				enum nl80211_iftype new_type,
 				bool p2p);
 
-int bes2600_config(struct ieee80211_hw *dev, int radio_idx, u32 changed);
+int bes2600_config(struct ieee80211_hw *dev, u32 changed);
 int bes2600_change_interface(struct ieee80211_hw *dev,
                                 struct ieee80211_vif *vif,
                                 enum nl80211_iftype new_type,
@@ -48,7 +48,7 @@ int bes2600_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
 		   struct ieee80211_vif *vif, struct ieee80211_sta *sta,
 		   struct ieee80211_key_conf *key);
 
-int bes2600_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx, u32 value);
+int bes2600_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
 
 void bes2600_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		  u32 queues, bool drop);

bes2600/tx_loop.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Test-mode TX loopback for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #include "bes2600.h"
 #include "wsm.h"
@@ -109,9 +112,9 @@ void bes2600_tx_loop_set_enable(struct bes2600_common *hw_priv, bool need_warn)
                 bes2600_queue_iterate_pending_packet(&hw_priv->tx_queue[i],
 				                bes2600_tx_loop_item_pending_item);
         }
-	spin_lock_bh(&hw_priv->tx_loop.pending_record_lock);
+	spin_lock(&hw_priv->tx_loop.pending_record_lock);
         bes2600_queue_iterate_record_pending_packet(hw_priv, bes2600_tx_loop_item_pending_item);
-	spin_unlock_bh(&hw_priv->tx_loop.pending_record_lock);
+	spin_unlock(&hw_priv->tx_loop.pending_record_lock);
 
         if (atomic_read(&hw_priv->bh_rx) > 0)
 		wake_up(&hw_priv->bh_wq);

bes2600/tx_loop.h

@@ -1,9 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Test-mode TX loopback interface for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifndef __TX_LOOP_H__
 #define __TX_LOOP_H__

bes2600/txrx.c

@@ -1,12 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Datapath implementation for BES2600 mac80211 driver
+ * Datapath implementation for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <net/mac80211.h>
@@ -21,83 +21,10 @@
 #include "debug.h"
 #include "sta.h"
 #include "sbus.h"
-#include "txrx_opt.h"
 #include "bes_log.h"
 
 #define BES2600_INVALID_RATE_ID (0xFF)
 
-/*
- * Decrypt-storm fast-recover (Trigger B).
- *
- * When the BES2600 firmware reports WSM_STATUS_DECRYPTFAILURE for a
- * burst of received frames (typically because the host's PTK or GTK
- * has fallen out of sync with the AP), the AP eventually concludes that
- * the STA is not authenticated and emits an unprotected deauth-reason-6
- * ("Class 2 frame received from non-authenticated station"). On the
- * deployed pinetab2 + bes2600 stack this AP-initiated deauth has been
- * observed to leave the link blackholed for up to 109 s before
- * userspace finds a different SSID/channel to recover on. (Receipts at
- * https://git.reauktion.de/marfrit/besser, notes/phase5-2026-05-06.md.)
- *
- * Recovery here pre-empts the AP: when we see THRESHOLD decrypt
- * failures within WINDOW, we ask mac80211 for a clean reassoc via
- * ieee80211_connection_loss(), which causes immediate disassociation
- * and lets userspace auto-reconnect with fresh keys.
- *
- * mac80211 contract: ieee80211_connection_loss() may be called
- * regardless of IEEE80211_HW_CONNECTION_MONITOR; it causes immediate
- * disassociation without driver-side recovery attempts. See
- * include/net/mac80211.h for the canonical doc-comment.
- *
- * The threshold is set well above the steady-state per-vif
- * decrypt-fail rate observed in measurement (~1/min even under
- * sustained 1 MB/s load), so a true storm is required to trip it.
- */
-#define BES2600_DECRYPT_STORM_THRESHOLD	5
-#define BES2600_DECRYPT_STORM_WINDOW_MS	5000
-
-static void bes2600_decrypt_storm_recover_work(struct work_struct *work)
-{
-	struct bes2600_vif *priv = container_of(work, struct bes2600_vif,
-						decrypt_storm_recover_work);
-
-	if (!priv->vif)
-		return;
-
-	bes_warn("[bes2600] decrypt-storm fast-recover: forcing reassoc\n");
-	ieee80211_connection_loss(priv->vif);
-	priv->decrypt_storm_recoveries++;
-}
-
-void bes2600_decrypt_storm_init(struct bes2600_vif *priv)
-{
-	INIT_WORK(&priv->decrypt_storm_recover_work,
-		  bes2600_decrypt_storm_recover_work);
-	priv->decrypt_storm_window_start = 0;
-	priv->decrypt_storm_count = 0;
-	priv->decrypt_storm_recoveries = 0;
-}
-
-void bes2600_decrypt_storm_account(struct bes2600_vif *priv)
-{
-	unsigned long now = jiffies;
-	unsigned long window = msecs_to_jiffies(BES2600_DECRYPT_STORM_WINDOW_MS);
-
-	if (priv->decrypt_storm_window_start == 0 ||
-	    time_after(now, priv->decrypt_storm_window_start + window)) {
-		priv->decrypt_storm_window_start = now;
-		priv->decrypt_storm_count = 1;
-		return;
-	}
-
-	if (++priv->decrypt_storm_count >= BES2600_DECRYPT_STORM_THRESHOLD) {
-		priv->decrypt_storm_count = 0;
-		/* Skew the window so we don't re-fire on the same storm. */
-		priv->decrypt_storm_window_start = now + window;
-		schedule_work(&priv->decrypt_storm_recover_work);
-	}
-}
-
 #ifdef CONFIG_BES2600_TESTMODE
 #include "bes_nl80211_testmode_msg.h"
 #endif /* CONFIG_BES2600_TESTMODE */
@@ -996,18 +923,14 @@ bes2600_tx_h_ba_stat(struct bes2600_vif *priv,
 	if (!ieee80211_is_data(t->hdr->frame_control))
 		return;
 
-	/*
-	 * Patch D: lock-free hot-path BA accounting.  atomic_inc + atomic_add
-	 * each per-frame; the once-per-window timer-arm uses cmpxchg on
-	 * ba_armed so concurrent TX/RX can't both try to set the timer and
-	 * we don't need cross-counter coherency on the ba_cnt/ba_cnt_rx pair.
-	 */
-	atomic_add(t->skb->len - t->hdrlen, &hw_priv->ba_acc);
-	atomic_inc(&hw_priv->ba_cnt);
-	if (atomic_cmpxchg(&hw_priv->ba_armed, 0, 1) == 0) {
+	spin_lock_bh(&hw_priv->ba_lock);
+	hw_priv->ba_acc += t->skb->len - t->hdrlen;
+	if (!(hw_priv->ba_cnt_rx || hw_priv->ba_cnt)) {
 		mod_timer(&hw_priv->ba_timer,
 			jiffies + BES2600_BLOCK_ACK_INTERVAL);
 	}
+	hw_priv->ba_cnt++;
+	spin_unlock_bh(&hw_priv->ba_lock);
 }
 
 static int
@@ -1550,35 +1473,14 @@ void bes2600_skb_dtor(struct bes2600_common *hw_priv,
 	struct bes2600_vif *priv =
 		__cw12xx_hwpriv_to_vifpriv(hw_priv, txpriv->if_id);
 
-
-	if (!skb)
-		return;
-
-	/*
-	 * There should be no reason for skb buffer being larger
-	 * than the offset..
-	 */
-	if(WARN_ON(txpriv->offset > skb->len)) {
-		ieee80211_free_txskb(hw_priv->hw, skb);
-		return;
-	}
-
-	bes_devel("%s: txpriv->offset: %d - skb->len: %d\n",
-		  __func__, txpriv->offset, skb->len);
-
 	skb_pull(skb, txpriv->offset);
 	if (priv && txpriv->rate_id != BES2600_INVALID_RATE_ID) {
 		bes2600_notify_buffered_tx(priv, skb,
 				txpriv->raw_link_id, txpriv->tid);
 		tx_policy_put(hw_priv, txpriv->rate_id);
 	}
-	if (likely(!bes2600_is_itp(hw_priv))) {
-		if (priv) {
-			/* The interface may be already removed */
-			bes2600_tx_status(priv, skb);
-		}
+	if (likely(!bes2600_is_itp(hw_priv)))
 		ieee80211_tx_status_skb(hw_priv->hw, skb);
-	}
 
 }
 #ifdef CONFIG_BES2600_TESTMODE
@@ -1655,13 +1557,14 @@ bes2600_rx_h_ba_stat(struct bes2600_vif *priv,
 	if (!priv->setbssparams_done)
 		return;
 
-	/* Patch D: lock-free hot-path BA accounting; see TX side comment. */
-	atomic_add(skb_len - hdrlen, &hw_priv->ba_acc_rx);
-	atomic_inc(&hw_priv->ba_cnt_rx);
-	if (atomic_cmpxchg(&hw_priv->ba_armed, 0, 1) == 0) {
+	spin_lock_bh(&hw_priv->ba_lock);
+	hw_priv->ba_acc_rx += skb_len - hdrlen;
+	if (!(hw_priv->ba_cnt_rx || hw_priv->ba_cnt)) {
 		mod_timer(&hw_priv->ba_timer,
 			jiffies + BES2600_BLOCK_ACK_INTERVAL);
 	}
+	hw_priv->ba_cnt_rx++;
+	spin_unlock_bh(&hw_priv->ba_lock);
 }
 
 void bes2600_rx_cb(struct bes2600_vif *priv,
@@ -1769,8 +1672,6 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
 			goto drop;
 		} else {
 			bes_warn("[RX] Receive failure: %d.\n", arg->status);
-			if (arg->status == WSM_STATUS_DECRYPTFAILURE)
-				bes2600_decrypt_storm_account(priv);
 			goto drop;
 		}
 	}
@@ -1948,7 +1849,6 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
 
 	if (ieee80211_is_data(frame->frame_control)) {
 		bes2600_rx_h_ba_stat(priv, hdrlen, skb->len);
-		bes2600_rx_status(priv, skb);
 	}
 
 #ifdef CONFIG_BES2600_TESTMODE
@@ -1965,33 +1865,15 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
 	if (unlikely(bes2600_itp_rxed(hw_priv, skb)))
 		consume_skb(skb);
 	else if (unlikely(early_data)) {
-		/*
-		 * Patch E: when c7 has latched pm_unsupported (firmware
-		 * doesn't honour PSM, see feedback_bes2600_firmware_no_psm),
-		 * AP-side power-save state machine is dead and link entries
-		 * never transition to BES2600_LINK_SOFT.  The double-check
-		 * branch under ps_state_lock is unreachable in that case,
-		 * so skip the per-frame lock acquisition entirely and
-		 * deliver to mac80211 directly.
-		 *
-		 * On firmware that does honour PSM (the latch self-clears
-		 * if a real PM_INDICATION ever arrives — see c7), this
-		 * predicate flips back to false and the original locked
-		 * path is taken.
-		 */
-		if (hw_priv->bes_power.pm_unsupported) {
-			ieee80211_rx_ni(priv->hw, skb);
-		} else {
 		spin_lock_bh(&priv->ps_state_lock);
 		/* Double-check status with lock held */
 		if (entry->status == BES2600_LINK_SOFT)
 			skb_queue_tail(&entry->rx_queue, skb);
 		else
-				ieee80211_rx_ni(priv->hw, skb);
+			ieee80211_rx_irqsafe(priv->hw, skb);
 		spin_unlock_bh(&priv->ps_state_lock);
-		}
 	} else {
-		ieee80211_rx_ni(priv->hw, skb);
+		ieee80211_rx_irqsafe(priv->hw, skb);
 	}
 	*skb_p = NULL;
 

bes2600/txrx.h

@@ -1,12 +1,12 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Datapath interface for BES2600 mac80211 driver
+ * Datapath interface for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2010, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_TXRX_H

bes2600/txrx_opt.c

@@ -1,569 +0,0 @@
-/***************************************************************************
- *
- * Copyright 2015-2022 BES.
- * All rights reserved. All unpublished rights reserved.
- *
- * No part of this work may be used or reproduced in any form or by any
- * means, or stored in a database or retrieval system, without prior written
- * permission of BES.
- *
- * Use of this work is governed by a license granted by BES.
- * This work contains confidential and proprietary information of
- * BES. which is protected by copyright, trade secret,
- * trademark and other intellectual property rights.
- *
- ****************************************************************************/
-#include <net/mac80211.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/timer.h>
-
-#include "bes2600.h"
-#include "wsm.h"
-#include "bh.h"
-#include "ap.h"
-#include "debug.h"
-#include "sta.h"
-#include "sbus.h"
-#include "bes_pwr.h"
-#include "txrx_opt.h"
-
-#define TXRX_OPT_CLOSE_EDCA     0
-#define TXRX_OPT_EDCA_MAX_LEVEL 4
-#define TX_AVG_TIME_COUNT       10
-#define TXRX_OPT_PEROID         500
-#define TXRX_OPT_DEBUG          1
-
-#define TXRX_HIGH_TP_THRESHOLD_2G4    	30000   // unit is kbps
-#define TXRX_HIGH_TP_THRESHOLD_5G    	40000   // unit is kbps
-#define TXRX_HIGH_TP_DELTA_TIME_2G4   	8       // unit ms
-#define TXRX_HIGH_TP_DELTA_TIME_5G   	6       // unit ms
-
-#define TXRX_RTS_PROT_TRIG_THRESH		80		// percent * 100
-#define TXRX_RTS_PROT_DURATION			10		// unit second
-
-#define TXRX_RTS_PROT_OPEN(x)			(x = 512)
-#define TXRX_RTS_PROT_CLOSE(x)			(x = 2437)
-#define TXRX_RTS_PROT_OPENED(x)			(x < 1536)
-
-static uint32_t tx_delta_time_arr[4][TX_AVG_TIME_COUNT];
-static uint32_t tx_queue_arr[4] = {0};
-static uint32_t tx_delta_time_total = 0;
-static uint32_t tx_delta_time_total_cnt = 0;
-static u8 cur_pwr_tbl = 1;
-static u16 cur_rts_thres = 2437;
-static unsigned long last_rts_set_time = -1;
-
-void bes2600_add_tx_delta_time(uint32_t tx_delta_time)
-{
-	tx_delta_time_total += tx_delta_time;
-	tx_delta_time_total_cnt++;
-}
-
-static uint32_t bes2600_get_tx_delta_time(void)
-{
-	if (tx_delta_time_total_cnt != 0)
-		return tx_delta_time_total / tx_delta_time_total_cnt;
-	else
-		return 0;
-}
-
-static void bes2600_clear_tx_delta_time(void)
-{
-	tx_delta_time_total_cnt = 0;
-	tx_delta_time_total = 0;
-	return ;
-}
-
-static uint32_t bes2600_get_tx_ac_delta_time(int ac)
-{
-	uint32_t avg_time = 0;
-	int i = 0;
-	for (i = 0; i < TX_AVG_TIME_COUNT; i++) {
-		avg_time += tx_delta_time_arr[ac][i];
-	}
-	return avg_time / TX_AVG_TIME_COUNT;
-}
-
-static void bes2600_clear_tx_ac_delta_time(int ac)
-{
-	int i = 0;
-	for (i = 0; i < TX_AVG_TIME_COUNT; i++) {
-		tx_delta_time_arr[ac][i] = 0;
-	}
-	return ;
-}
-
-void bes2600_add_tx_ac_delta_time(int ac, uint32_t del_time)
-{
-#if 0
-	if (tx_queue_arr[ac] >= (TX_AVG_TIME_COUNT - 1)) {
-		static int num = 0;
-		if ((num ++ % 10) == 0)
-			bes_devel( "%s %d %d %d %d %d del=%d\n\r", __func__, tx_delta_time_arr[ac][0],
-				     tx_delta_time_arr[ac][2],  tx_delta_time_arr[ac][4],  tx_delta_time_arr[ac][6],
-				     tx_delta_time_arr[ac][8], del_time);
-	}
-#endif
-	tx_delta_time_arr[ac][tx_queue_arr[ac]] = del_time;
-	tx_queue_arr[ac] = (tx_queue_arr[ac] >= (TX_AVG_TIME_COUNT - 1)) ? 0 : (tx_queue_arr[ac] + 1);
-
-}
-
-
-static int bes2600_set_txrx_opt_param(struct bes2600_common *hw_priv,
-			       struct bes2600_vif *priv,
-			       MIB_TXRX_OPT_PARAM  *para)
-{
-
-	int ret = 0;
-	ret = WARN_ON(wsm_write_mib(hw_priv,
-				    WSM_MIB_ID_EXT_TXRX_OPT_PARAM,
-				    (u8 *)para,
-				    sizeof(MIB_TXRX_OPT_PARAM),
-				    priv->if_id));
-	return ret;
-}
-
-static int bes2600_enable_tx_shortgi(struct bes2600_common *hw_priv,
-			      struct bes2600_vif *priv,
-			      u8 onoff)
-{
-	int ret = 0;
-	static u8 en = 0xff;
-
-	bes_devel( "%s onoff=%d\n\r", __func__, onoff);
-
-	if (en != onoff) {
-		en = onoff;
-		ret = WARN_ON(wsm_write_mib(hw_priv,
-					    WSM_MIB_ID_EXT_TX_SHORT_GI_ENABLED,
-					    (u8 *)&onoff,
-					    sizeof(onoff),
-					    priv->if_id));
-	}
-	return ret;
-}
-
-void bes2600_rx_status(struct bes2600_vif *priv, struct sk_buff *skb)
-{
-	priv->dot11ReceivedFragmentCount++;
-	priv->dot11ReceivedDataBytes += skb->len;
-}
-
-void bes2600_tx_status(struct bes2600_vif *priv, struct sk_buff *skb)
-{
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-	int i;
-	int retry_count = -1;
-
-	if(WARN_ON(!priv->hw))
-		return;
-
-	if (!ieee80211_is_data(hdr->frame_control))
-		return;
-
-	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-		if (info->status.rates[i].idx < 0)
-			break;
-
-		retry_count += info->status.rates[i].count;
-	}
-	if (retry_count < 0)
-		retry_count = 0;
-
-	if (info->flags & IEEE80211_TX_STAT_ACK) {
-		priv->dot11TransmittedFrameCount++;
-		priv->dot11TransmittedDataBytes += (skb->len + 4);
-		if (retry_count > 0)
-			priv->dot11RetryCount += retry_count;
-
-	} else {
-		/* tx fail.*/
-		priv->dot11FailedCount++;
-	}
-}
-void bes2600_set_default_params(struct bes2600_common *hw_priv, struct bes2600_vif *priv);
-
-static int bes2600_set_high_edca_params(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int level)
-{
-	struct wsm_edca_params arg;
-	int i = 0;
-	static int lev = 0;
-	bes_devel( "set edca level=%d\n\r", level);
-
-	if (lev == level)
-		return 0;
-
-	lev = level;
-
-	memcpy(&arg, &(priv->edca), sizeof(struct wsm_edca_params));
-
-	if (level == 0) {
-		bes2600_set_default_params(hw_priv, priv);
-		return 0;
-	} else if (level == 1) {
-		for ( i = 0; i < 4; i++) {
-			arg.params[i].aifns = 2;
-			arg.params[i].cwMax = 7;
-			arg.params[i].cwMin = 3;
-			/*
-			 * tx op must set 0
-			 * set other, some AP may not response BA when rx data.
-			*/
-			arg.params[i].txOpLimit = 0;
-			arg.params[i].maxReceiveLifetime = 0xc8;
-		}
-	} else if (level == 2) {
-		for ( i = 0; i < 4; i++) {
-			arg.params[i].aifns = 2;
-			arg.params[i].cwMax = 5;
-			arg.params[i].cwMin = 1;
-			arg.params[i].txOpLimit = 0;
-			arg.params[i].maxReceiveLifetime = 0xc8;
-		}
-	} else if (level == 3) {
-		for ( i = 0; i < 4; i++) {
-			arg.params[i].aifns = 2;
-			arg.params[i].cwMax = 3;
-			arg.params[i].cwMin = 1;
-			arg.params[i].txOpLimit = 0;
-			arg.params[i].maxReceiveLifetime = 0xc8;
-		}
-	} else if (level == 4) {
-		for ( i = 0; i < 4; i++) {
-			arg.params[i].aifns = 1;
-			arg.params[i].cwMax = 3;
-			arg.params[i].cwMin = 1;
-			arg.params[i].txOpLimit = 0;
-			arg.params[i].maxReceiveLifetime = 0xc8;
-		}
-	}
-	wsm_set_edca_params(hw_priv, &arg, priv->if_id);
-	return 0;
-}
-void bes2600_set_default_params(struct bes2600_common *hw_priv, struct bes2600_vif *priv)
-{
-	bes_devel( "set edca default\n\r");
-	wsm_set_edca_params(hw_priv, &priv->edca, priv->if_id);
-}
-static void bes2600_set_cca_method(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int value)
-{
-// todo set cca alg
-}
-
-static void bes2600_set_dynamic_agc(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int value)
-{
-// todo set agc alg
-}
-
-static int bes2600_update_pwr_table(struct bes2600_common *hw_priv,
-			      struct bes2600_vif *priv,
-			      u8 pwr_tbl_idx)
-{
-	int ret = 0;
-	static u8 cur_pwr_tbl_idx = 0xff;
-
-	if (cur_pwr_tbl_idx != pwr_tbl_idx) {
-		cur_pwr_tbl_idx = pwr_tbl_idx;
-		ret = WARN_ON(wsm_write_mib(hw_priv,
-					    WSM_MIB_ID_EXT_PWR_TBL_UPDATE,
-					    (u8 *)&cur_pwr_tbl_idx,
-					    sizeof(cur_pwr_tbl_idx),
-					    priv->if_id));
-		bes_devel( "%s pwr_tbl_idx=%d\n\r", __func__, pwr_tbl_idx);
-	}
-	return ret;
-}
-
-static int bes2600_get_tx_av_max_delta_time(void)
-{
-	int max_avg = 0;
-	int i = 0;
-
-	for (i = 0; i < 4; i++) {
-		if (max_avg < bes2600_get_tx_ac_delta_time(i)) {
-			max_avg = bes2600_get_tx_ac_delta_time(i);
-		}
-		//bes2600_clear_tx_ac_delta_time(i);
-	}
-	return max_avg;
-}
-
-static bool bes2600_station_is_ap_ht40(struct bes2600_common *hw_priv)
-{
-
-	if (hw_priv->hw) {
-		struct ieee80211_conf *conf = &hw_priv->hw->conf;
-		if (conf !=  NULL)
-			if (conf->chandef.width == NL80211_CHAN_WIDTH_40)
-				return true;
-	}
-	return false;
-}
-
-void bes2600_dynamic_opt_rxtx(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int rssi)
-{
-	u32 succPro = 0, tx_cnt, tx_retry, rx_cnt, tx_fail;
-	static u32 l_tx_cnt = 0, l_tx_fail = 0, l_tx_retry = 0, l_rx_cnt = 0;
-	static u32 tx_bps = 0, rx_bps = 0;
-	u32 total_kbps = 0;
-	static int level;
-
-	/* calculate real time throughput */
-	if (hw_priv == NULL || priv == NULL) {
-		return;
-	}
-	tx_bps = abs (priv->dot11TransmittedDataBytes - tx_bps);
-	rx_bps = abs (priv->dot11ReceivedDataBytes  - rx_bps);
-	total_kbps = (tx_bps / 128 + rx_bps / 128);
-
-	total_kbps *= 1000;
-	total_kbps /= TXRX_OPT_PEROID;
-
-	/*  if tx/rx < 100k/s, close*/
-	if (total_kbps < 100) {
-		level = 0;
-		last_rts_set_time = -1;
-		TXRX_RTS_PROT_CLOSE(cur_rts_thres);
-		goto txrx_opt_clear;
-	}
-
-	/* calculate tx_cnt, tx_retry, rx_cnt */
-	tx_cnt = (priv->dot11TransmittedFrameCount - l_tx_cnt);
-	tx_fail = (priv->dot11FailedCount - l_tx_fail);
-	tx_retry = (priv->dot11RetryCount - l_tx_retry);
-	rx_cnt = (priv->dot11ReceivedFragmentCount - l_rx_cnt);
-	( (tx_cnt + tx_retry) > 0 ) ? (succPro = tx_cnt * 100 / (tx_cnt + tx_retry)) : (succPro = 0);
-
-	bes_devel( "%s, tx_cnt:%d prob:%d\n", __func__, tx_cnt, succPro);
-
-	/* set rts/cts protection dynamically */
-	if (tx_cnt > 50 && succPro != 0) {
-		if (succPro > TXRX_RTS_PROT_TRIG_THRESH &&
-			TXRX_RTS_PROT_OPENED(cur_rts_thres) &&
-		    time_after(jiffies, last_rts_set_time + TXRX_RTS_PROT_DURATION * HZ)) {
-			TXRX_RTS_PROT_CLOSE(cur_rts_thres);
-		} else if (succPro <= TXRX_RTS_PROT_TRIG_THRESH){
-			TXRX_RTS_PROT_OPEN(cur_rts_thres);
-			last_rts_set_time = jiffies;
-		}
-	}
-
-	/* dynamic set edca param */
-	if (succPro != 0) {
-		if (bes2600_station_is_ap_ht40(hw_priv)) {
-			if (bes2600_get_tx_delta_time() > 8 || bes2600_get_tx_av_max_delta_time() > 8) {
-				if (level < 4)
-					level++;
-			} else {
-				if (level > 0)
-					level--;
-			}
-			/* high throughput force level = 0 */
-			if (total_kbps > TXRX_HIGH_TP_THRESHOLD_5G && level > 0 && priv->hw_value > 19) {
-				level = 0;
-			}
-
-		} else {//shiled room 13, office 8
-			if (bes2600_get_tx_delta_time() > (TXRX_HIGH_TP_DELTA_TIME_5G + total_kbps / 8000)
-			    || bes2600_get_tx_av_max_delta_time() > (TXRX_HIGH_TP_DELTA_TIME_5G + total_kbps / 8000)) {
-				if (level < 4)
-					level++;
-			} else {
-				if (level > 0)
-					level--;
-			}
-			/* high throughput force level = 0 */
-			if (total_kbps > TXRX_HIGH_TP_THRESHOLD_2G4 && level > 0) {
-				level = 0;
-			}
-
-		}
-	}
-
-	/* dynamic set power table */
-	if (rssi <= BES2600_TX_RSSI_LOW)
-		cur_pwr_tbl = 2;	// use high power table
-	else if(rssi >= BES2600_TX_RSSI_HIGH)
-		cur_pwr_tbl = 1;	// use standard power table
-
-#if TXRX_OPT_CLOSE_EDCA
-	level = 0;
-#endif
-	if (level > TXRX_OPT_EDCA_MAX_LEVEL)
-		level = TXRX_OPT_EDCA_MAX_LEVEL;
-
-	bes_devel( "txrx_opt: tx(cnt=%d retry=%d psr=%d tx_fail=%d (wsm level=%d) tx=%dk/s)\n\r",
-	       tx_cnt, tx_retry, succPro, tx_fail, level, tx_bps / 128);
-	bes_devel( "txrx_opt: rx(cnt=%d  rx=%dk/s) total=%dk/s\n\r", rx_cnt, rx_bps / 128, total_kbps);
-	bes_devel( "txrx_opt: tx_delta_time=%d [%d %d %d %d] hw_value=%d ht=%d maxtxcnt=%d\n\r",
-	       bes2600_get_tx_delta_time(), bes2600_get_tx_ac_delta_time(0), bes2600_get_tx_ac_delta_time(1),
-	       bes2600_get_tx_ac_delta_time(2), bes2600_get_tx_ac_delta_time(3), priv->hw_value,
-	       bes2600_station_is_ap_ht40(hw_priv), hw_priv->long_frame_max_tx_count);
-
-
-	/* dynamic set cca */
-	bes2600_set_cca_method(hw_priv, priv, 0);
-	/* dynamic set agc */
-	bes2600_set_dynamic_agc(hw_priv, priv, 0);
-	bes2600_update_pwr_table(hw_priv, priv, cur_pwr_tbl);
-txrx_opt_clear:
-	bes2600_set_high_edca_params(hw_priv, priv, level);
-	bes2600_set_rts_threshold(hw_priv->hw, -1, cur_rts_thres);
-	bes2600_clear_tx_delta_time();
-	bes2600_clear_tx_ac_delta_time(0);
-	bes2600_clear_tx_ac_delta_time(1);
-	bes2600_clear_tx_ac_delta_time(2);
-	bes2600_clear_tx_ac_delta_time(3);
-	tx_bps = priv->dot11TransmittedDataBytes;
-	rx_bps = priv->dot11ReceivedDataBytes;
-	l_tx_cnt = priv->dot11TransmittedFrameCount;
-	l_tx_fail = priv->dot11FailedCount;
-	l_tx_retry = priv->dot11RetryCount;
-	l_rx_cnt = priv->dot11ReceivedFragmentCount;
-	return ;
-}
-
-static struct bes2600_common *txrx_hw_priv = NULL;
-
-static bool bes2600_is_sta_connected(void)
-{
-	if (txrx_hw_priv == NULL)
-		return false;
-	else
-		return true;
-}
-
-void bes2600_txrx_opt_timer_restore(void)
-{
-	if (bes2600_is_sta_connected()) {
-		mod_timer(&txrx_hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
-	}
-}
-
-static void txrx_opt_timer_callback(struct timer_list* data)
-{
-	bes_devel( "####Timer callback function Called time = %lu\n", jiffies);
-	queue_work(txrx_hw_priv->workqueue, &txrx_hw_priv->dynamic_opt_txrx_work);
-}
-
-static void txrx_opt_timer_start(struct bes2600_common *hw_priv)
-{
-	mod_timer(&hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
-}
-
-static void txrx_opt_timer_stop(struct bes2600_common *hw_priv)
-{
-	timer_delete_sync(&hw_priv->txrx_opt_timer);
-}
-
-static void bes2600_set_txrx_opt_default_param(struct bes2600_common * hw_priv)
-{
-	MIB_TXRX_OPT_PARAM g_txrx_param = {2, (PROCTECT_MODE_RTS_CTS | PROCTECT_MODE_RTS_CTS_RETRY), 3000};
-	struct bes2600_vif *priv = __cw12xx_hwpriv_to_vifpriv(hw_priv, 0);
-	struct ieee80211_sta *sta = NULL;
-	int shortgi = 0;
-
-	if (priv == NULL)
-		return;
-
-	/* reset states */
-	cur_pwr_tbl = 1;
-	TXRX_RTS_PROT_CLOSE(cur_rts_thres);
-	last_rts_set_time = -1;
-	memcpy(&hw_priv->txrx_opt_param, &g_txrx_param, sizeof(MIB_TXRX_OPT_PARAM));
-
-	/* reset device states */
-	bes2600_set_txrx_opt_param(hw_priv, priv, &hw_priv->txrx_opt_param);
-	bes2600_set_rts_threshold(hw_priv->hw, -1, cur_rts_thres);	// close rts/cts
-	bes2600_update_pwr_table(hw_priv, priv, cur_pwr_tbl);	// use standard pwr table
-
-	if (priv->join_status == BES2600_JOIN_STATUS_STA) {
-		rcu_read_lock();
-
-		sta = ieee80211_find_sta(priv->vif, priv->vif->bss_conf.bssid);
-		if (sta) {
-			if (sta->deflink.ht_cap.ht_supported &&
-			    ((priv->vif->bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20 &&
-				 sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
-				(priv->vif->bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_40 &&
-				 sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40))) {
-				shortgi = 1;
-			}
-		}
-
-		rcu_read_unlock();
-
-		bes_devel("short gi tx status: %d\n", shortgi);
-		bes2600_enable_tx_shortgi(hw_priv, priv, shortgi);
-	}
-}
-
-static int bes2600_set_txrx_opt_unjoin_param(struct bes2600_common * hw_priv)
-{
-	MIB_TXRX_OPT_PARAM g_txrx_param = {1, 0, 2002};
-	struct bes2600_vif *priv = __cw12xx_hwpriv_to_vifpriv(hw_priv, 0);
-	if (priv == NULL)
-		return 0;
-
-	/* reset states */
-	cur_pwr_tbl = 1;
-	bes2600_update_pwr_table(hw_priv, priv, cur_pwr_tbl);
-	memcpy(&hw_priv->txrx_opt_param, &g_txrx_param, sizeof(MIB_TXRX_OPT_PARAM));
-	bes2600_set_txrx_opt_param(hw_priv, priv, &hw_priv->txrx_opt_param);
-	return 0;
-}
-
-void bes2600_txrx_opt_multivif_connected_handler(struct bes2600_common *hw_priv, bool multivif_connected)
-{
-	struct bes2600_vif *priv = __cw12xx_hwpriv_to_vifpriv(hw_priv, 0);
-
-	if (multivif_connected) {
-		bes2600_set_txrx_opt_default_param(hw_priv);
-	} else {
-		bes_devel("%s, rssi:%d\n", __func__, priv->signal);
-		bes2600_dynamic_opt_rxtx(hw_priv, priv, priv->signal);
-		mod_timer(&hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
-	}
-}
-
-int txrx_opt_timer_init(struct bes2600_vif *priv)
-{
-	struct bes2600_common *hw_priv = cw12xx_vifpriv_to_hwpriv(priv);
-	bes_devel( "txrx_opt_timer_init:%p", txrx_hw_priv);
-	if (priv->if_id != 0)
-		return 0;
-
-	if (!txrx_hw_priv) {
-		txrx_hw_priv = hw_priv;
-		bes_devel( "####Timer init hw_priv = %p\n", txrx_hw_priv);
-		timer_setup(&hw_priv->txrx_opt_timer, txrx_opt_timer_callback, 0);
-		bes2600_set_txrx_opt_default_param(hw_priv);
-	}
-
-	mod_timer(&hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
-	bes2600_pwr_register_en_lp_cb(hw_priv, txrx_opt_timer_stop);
-	bes2600_pwr_register_exit_lp_cb(hw_priv, txrx_opt_timer_start);
-	return 0;
-}
-
-void txrx_opt_timer_exit(struct bes2600_vif *priv)
-{
-	struct bes2600_common *hw_priv = cw12xx_vifpriv_to_hwpriv(priv);
-	bes_devel( "txrx_opt_timer_exit");
-
-	if (priv->if_id == 0) {
-		timer_delete_sync(&hw_priv->txrx_opt_timer);
-		cancel_work_sync(&hw_priv->dynamic_opt_txrx_work);
-		bes2600_pwr_unregister_en_lp_cb(hw_priv, txrx_opt_timer_stop);
-		bes2600_pwr_unregister_exit_lp_cb(hw_priv, txrx_opt_timer_start);
-		txrx_hw_priv = NULL;
-		bes2600_set_txrx_opt_unjoin_param(hw_priv);
-	} else if (priv->if_id == 1) {
-		bes2600_txrx_opt_timer_restore();
-	}
-}
-
-

bes2600/txrx_opt.h

@@ -1,38 +0,0 @@
-
-/***************************************************************************
- *
- * Copyright 2015-2022 BES.
- * All rights reserved. All unpublished rights reserved.
- *
- * No part of this work may be used or reproduced in any form or by any
- * means, or stored in a database or retrieval system, without prior written
- * permission of BES.
- *
- * Use of this work is governed by a license granted by BES.
- * This work contains confidential and proprietary information of
- * BES. which is protected by copyright, trade secret,
- * trademark and other intellectual property rights.
- *
- ****************************************************************************/
-#ifndef bes2600_TXRX_OPT_H
-#define bes2600_TXRX_OPT_H
-#include <linux/list.h>
-/* open it for enhance wifi throughput */
-#define BES2600_TX_RX_OPT   1
-
-/* Threshold for powrt table switch */
-#define BES2600_TX_RSSI_LOW     -65
-#define BES2600_TX_RSSI_HIGH    -60
-
-void bes2600_add_tx_ac_delta_time(int ac, uint32_t del_time);
-void bes2600_add_tx_delta_time(uint32_t tx_time);
-void bes2600_rx_status(struct bes2600_vif *priv, struct sk_buff *skb);
-void bes2600_tx_status(struct bes2600_vif *priv, struct sk_buff *skb);
-void bes2600_dynamic_opt_rxtx(struct bes2600_common *hw_priv,struct bes2600_vif *priv, int rssi);
-void bes2600_txrx_opt_multivif_connected_handler(struct bes2600_common *hw_priv, bool multivif_connected);
-void bes2600_txrx_opt_timer_restore(void);
-int txrx_opt_timer_init(struct bes2600_vif *priv);
-void txrx_opt_timer_exit(struct bes2600_vif *priv);
-
-#endif
-

bes2600/wifi_testmode_cmd.c

@@ -1,9 +1,12 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * WiFi testmode commands for BES2600
+ * Mac80211 driver for BES2600 device
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 #ifdef CONFIG_BES2600_TESTMODE
 #include <net/netlink.h>

bes2600/wsm.c

@@ -1,12 +1,13 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
- * WSM host interface for BES2600 mac80211 driver
+ * WSM host interface (HI) implementation for
+ * BES2600 mac80211 drivers.
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
- *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/skbuff.h>
@@ -133,20 +134,8 @@ static int wsm_generic_confirm(struct bes2600_common *hw_priv,
 				 struct wsm_buf *buf)
 {
 	u32 status = WSM_GET32(buf);
-
-	/*
-	 * A non-SUCCESS status here is a firmware-side policy decision for
-	 * the command whose confirm this is -- commonly WSM status 2 for
-	 * scan (0x0407) rejected because of a coex window or transient
-	 * firmware-busy state. It is not a driver/kernel bug, so avoid the
-	 * WARN()/stack-trace treatment; the caller already emits a
-	 * wiphy_warn identifying the request id and will propagate the
-	 * error to mac80211.
-	 */
-	if (status != WSM_STATUS_SUCCESS) {
-		bes_devel("%s ret %u\n", __func__, status);
+	if (WARN(status != WSM_STATUS_SUCCESS, "wsm_generic_confirm ret %u", status))
 		return -EINVAL;
-	}
 	return 0;
 
 underflow:
@@ -2412,7 +2401,7 @@ int wsm_handle_rx(struct bes2600_common *hw_priv, int id,
 					if (!hw_priv->beacon_bkp)
 						hw_priv->beacon_bkp = \
 						skb_copy(hw_priv->beacon, GFP_ATOMIC);
-					ieee80211_rx_ni(hw_priv->hw, hw_priv->beacon);
+					ieee80211_rx_irqsafe(hw_priv->hw, hw_priv->beacon);
 					hw_priv->beacon = hw_priv->beacon_bkp;
 
 					hw_priv->beacon_bkp = NULL;

bes2600/wsm.h

@@ -1,12 +1,16 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * WSM host interface for BES2600 mac80211 driver
+ * WSM host interface (HI) interface for BES2600 mac80211 drivers
  *
- * Copyright (c) 2010, ST-Ericsson
- * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ * Copyright (c) 2022, Bestechnic
+ * Author:
  *
- * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Based on BES2600 UMAC WSM API, which is
+ * Copyright (C) SA 2010
+ * Author: Stewart Mathers <stewart.mathers@stericsson.com>
  *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #ifndef BES2600_WSM_H_INCLUDED
@@ -2232,7 +2236,5 @@ int wsm_cpu_usage_cmd(struct bes2600_common *hw_priv);
 
 int wsm_wifi_status_cmd(struct bes2600_common *hw_priv, uint32_t status);
 
-#if defined(STANDARD_FACTORY_EFUSE_FLAG)
 int wsm_save_factory_txt_to_mcu(struct bes2600_common *hw_priv, const u8 *data, int if_id, enum bes2600_rf_cmd_type cmd_type);
-#endif
 #endif /* BES2600_HWIO_H_INCLUDED */