bes2600: recover wedged firmware via mmc_hw_reset on link break

When the LMAC active monitor detects 'link break between lmac and host'
(the hw_buf_used==pending watchdog in bes2600_bh_lmac_active_monitor),
bes2600_chrdev_wifi_force_close(hw_priv, true) is invoked to tear the
device down and prepare for a fresh probe. On the wifi_force_close_work
side this calls bes2600_chrdev_do_system_close() which dispatches
sbus_ops->power_switch(0).

On PineTab2 (RK3566 + BES2600WM over SDIO) this recovery path is a
no-op:

  * bes2600_sdio_power_down() writes a SYSTEM_CLOSE host-int message,
    clears MMC_CAP_NONREMOVABLE, and schedules sdio_scan_work, which is
    the literal one-line stub bes_warn("...this function does
    nothing\n").
  * bes2600_sdio_on() (the eventual power_switch(1) counterpart)
    toggles pdata->powerup, which is NULL on PineTab2 because the
    wifi-reset GPIO is owned by sdio_pwrseq, not the bes2600 device
    tree node (see arch/arm64/boot/dts/rockchip/rk3566-pinetab2.dtsi:
    'The reset pin is claimed by sdio_mmcseq, It is better to move it
    to U-Boot so the OS can use it.').

Net result: the chip is never reset. The function drivers are not
removed (the SDIO core has no signal that the card is gone), the
firmware stays wedged, and a subsequent rmmod bes2600 leaves the SDIO
function in a half-torn-down state. modprobe bes2600 then fails with
'probe with driver bes2600_wlan failed with error -123' (-ENOMEDIUM)
on both functions (:1 wifi, :2 BT-companion) until a full system
reboot.

Observed on PineTab2 (linux-pinetab2 6.19.10-danctnix1-1) after ~150
minutes of background-scan rejects (wsm_generic_confirm 0x0007,
[SCAN] Scan failed (-22)) accumulating until the LMAC stopped
acknowledging TX buffers (hw_buf_used:24 pending:24). Reproducible
under sustained scan pressure.

Add a sbus operation bus_reset() that the recovery path can call when
power_switch() has no effective chip-reset signal of its own. Provide
an SDIO implementation that calls mmc_hw_reset(self->func->card),
which on a multi-function SDIO card (PineTab2 binds func 1 for WLAN
and func 2 for the BT-companion path) takes the remove-and-rescan
path: mmc_sdio_hw_reset() marks the card removed and schedules
mmc_rescan, which tears down the bound function drivers and re-detects
the card on the next sweep, in turn reinvoking bes2600_sdio_probe().
With a single function probed it instead invokes mmc_power_cycle()
directly, which on PineTab2 toggles the wifi-reset GPIO via
sdio_pwrseq.

Add bes2600_chrdev_do_bus_reset() as the chrdev-side helper. It
invokes the bus op and then waits on probe_done_wq for the SDIO
remove() callback to clear sbus_priv, mirroring the wait pattern
already used by bes2600_chrdev_do_system_close() so that a subsequent
bes2600_switch_wifi(true) sees a clean state and can wait on the
fresh probe.

Wire it into bes2600_chrdev_wifi_force_close_work(): when halt_dev is
set (the hard-exception path used by both
bes2600_bh_lmac_active_monitor and bes2600_bh_mcu_active_monitor) and
the underlying bus implements bus_reset, take the new recovery path;
otherwise fall back to the legacy power_switch(0) sequence so this
patch is a no-op on USB or any other future bus that does not provide
bus_reset.

mmc_hw_reset() is exported by the MMC core and is the canonical
recovery primitive; calling it without holding the SDIO host claim is
correct because the multi-func remove-and-rescan path acquires the
host claim via the mmc workqueue, and the single-func mmc_power_cycle
path does not require the host claim.

No DT change is required: this works against the existing PineTab2
DTS, where the wifi-reset GPIO and the optional sdio_pwrkey GPIO (on
v2.0 boards) are both already configured as MMC pwrseq resets.

Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>

bes2600/Makefile

@@ -28,7 +28,6 @@ CONFIG_BES2600_WIFI_BOOT_ON             ?= y
 CONFIG_BES2600_BT_BOOT_ON               ?= n
 
 BES2600_GPIO_WAKEUP_AP                  ?= n
-BES2600_WRITE_DPD_TO_FILE               ?= n
 BES2600_TX_MORE_RETRY                   ?= n
 
 # bes evb
@@ -93,12 +92,6 @@ ccflags-y += -DBES_UNIFIED_PM
 ccflags-y += -DBES_SDIO_OPTIMIZED_LEN
 ccflags-y += -DBES2600_HOST_TIMESTAMP_DEBUG
 
-ifeq ($(BES2600_WRITE_DPD_TO_FILE),y)
-BES2600_DPD_PATH ?= /data/cfg/bes2600_dpd.bin
-BES2600_DEFAULT_DPD_PATH ?= /lib/firmware/bes2600_dpd.bin
-BES2600_DPD_GOLDEN_PATH ?= /data/cfg/bes2600_dpd_golden.bin
-endif
-
 ifeq ($(BES2600_DUMP_FW_DPD_LOG),y)
 BES2600_DPD_LOG_PATH ?= /data/applog/bes2600_dpd_log.log
 endif
@@ -135,9 +128,6 @@ ccflags-y += $(call boolen_flag,BSS_LOSS_CHECK,y)
 ccflags-y += $(call string_flag,BES2600_LOAD_FW_TOOL_PATH)
 ccflags-y += $(call string_flag,BES2600_LOAD_FW_TOOL_DEVICE)
 ccflags-y += $(call string_flag,BES2600_DRV_VERSION)
-ccflags-y += $(call string_flag,BES2600_DPD_PATH)
-ccflags-y += $(call string_flag,BES2600_DEFAULT_DPD_PATH)
-ccflags-y += $(call string_flag,BES2600_DPD_GOLDEN_PATH)
 
 ccflags-y += $(call boolen_flag,BES2600_INDEPENDENT_EVB,y)
 ccflags-y += $(call boolen_flag,BES2600_INTEGRATED_MODULE_V1,y)
@@ -159,8 +149,6 @@ ccflags-y += $(call boolen_flag,FACTORY_SAVE_MULTI_PATH,y)
 ccflags-y += $(call boolen_flag,FACTORY_CRC_CHECK,y)
 
 ccflags-y += $(call boolen_flag,BES2600_GPIO_WAKEUP_AP,y)
-ccflags-y += $(call boolen_flag,BES2600_WRITE_DPD_TO_FILE,y)
-
 ccflags-y += $(call boolen_flag,BES2600_DUMP_FW_DPD_LOG,y)
 ccflags-y += $(call string_flag,BES2600_DPD_LOG_PATH)
 

bes2600/bes2600_sdio.c

@@ -16,6 +16,7 @@
 #include <linux/mmc/host.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/card.h>
+#include <linux/mmc/core.h>
 #include <linux/mmc/sdio.h>
 #include <linux/spinlock.h>
 #include <net/mac80211.h>
@@ -1777,6 +1778,33 @@ static void bes2600_sdio_halt_device(struct sbus_priv *self)
 	sdio_work_debug(self);
 }
 
+/*
+ * Trigger an SDIO bus reset via mmc_hw_reset().
+ *
+ * With multiple SDIO functions probed (PineTab2 binds func 1 for WLAN and
+ * func 2 for the BT-companion path) mmc_sdio_hw_reset() takes the
+ * remove-and-rescan path: it marks the card removed and schedules
+ * mmc_rescan, which tears down the bound function drivers and re-detects
+ * the card on the next sweep, in turn reinvoking bes2600_sdio_probe().
+ *
+ * With a single function probed it instead invokes mmc_power_cycle()
+ * directly, which on PineTab2 toggles the wifi-reset GPIO via sdio_pwrseq.
+ *
+ * In both cases the chip ends up in a freshly reset state, which is the
+ * goal of the recovery path.
+ *
+ * mmc_hw_reset() must be called without holding the SDIO host claim --
+ * the multi-func remove-and-rescan path acquires the host claim via the
+ * mmc workqueue.
+ */
+static int bes2600_sdio_bus_reset(struct sbus_priv *self)
+{
+	if (!self || !self->func || !self->func->card)
+		return -EINVAL;
+
+	return mmc_hw_reset(self->func->card);
+}
+
 static bool bes2600_sdio_wakeup_source(struct sbus_priv *self)
 {
 	struct bes2600_platform_data_sdio *pdata = bes2600_get_platform_data();
@@ -1815,6 +1843,7 @@ static struct sbus_ops bes2600_sdio_sbus_ops = {
 	.gpio_sleep		= bes2600_gpio_allow_mcu_sleep,
 	.halt_device		= bes2600_sdio_halt_device,
 	.wakeup_source		= bes2600_sdio_wakeup_source,
+	.bus_reset		= bes2600_sdio_bus_reset,
 };
 
 static void bes2600_sdio_en_lp_cb(struct bes2600_common *hw_priv)

bes2600/bes_chardev.c

@@ -63,9 +63,6 @@ struct bes_cdev {
 	struct delayed_work probe_timeout_work;
 	enum bus_probe_state bus_probe;
 	struct work_struct wifi_force_close_work;
-#ifdef BES2600_WRITE_DPD_TO_FILE
-	int no_dpd;
-#endif
 	enum pend_read_op read_flag;
 	enum wakeup_event wakeup_by_event;	/* used to filter unwanted event wakeup reason report */
 	u16 wakeup_state; /* for userspace check wakeup reason */
@@ -85,9 +82,6 @@ struct bes2600_op_map {
 
 static struct bes_cdev bes2600_cdev;
 module_param_named(fw_type, bes2600_cdev.fw_type, int, 0644);
-#ifdef BES2600_WRITE_DPD_TO_FILE
-module_param_named(no_dpd, bes2600_cdev.no_dpd, int, 0644);
-#endif
 
 extern int bes2600_register_net_dev(struct sbus_priv *bus_priv);
 extern int bes2600_unregister_net_dev(struct sbus_priv *bus_priv);
@@ -269,137 +263,8 @@ static int bes2600_chrdev_check_system_close_internal(void)
 
 
 
-#ifdef BES2600_WRITE_DPD_TO_FILE
-static int bes2600_chrdev_write_dpd_data_to_file(const char *path, void *buffer, int size)
-{
-	int ret = 0;
-	struct file *fp;
-
-	if (buffer == NULL || size == 0)
-		return 0;
-
-	fp = filp_open(path, O_TRUNC | O_CREAT | O_RDWR, S_IRUSR);
-	if (IS_ERR(fp)) {
-		bes_err("BES2600 : can't open %s\n",path);
-		return -1;
-	}
-
-	ret = kernel_write(fp, buffer, size, &fp->f_pos);
-	if (ret < 0)
-		bes_err("write dpd to file failed\n");
-
-	filp_close(fp,NULL);
-
-	bes_devel("write dpd to %s\n", path);
-
-	return ret;
-}
-
-static bool bes2600_chrdev_dpd_is_vaild(u8 *dpd_data)
-{
-	u32 cal_crc = 0;
-	u32 dpd_crc = le32_to_cpup((__le32 *)(dpd_data));
-	u32 dpd_ver = le32_to_cpup((__le32 *)(dpd_data + DPD_VERSION_OFFSET));
-
-	/* check version */
-	if (dpd_ver < DPD_CUR_VERSION)
-		return false;
-
-	cal_crc ^= 0xffffffffL;
-	cal_crc = crc32_le(cal_crc, dpd_data + 4, DPD_BIN_SIZE - 4);
-	cal_crc ^= 0xffffffffL;
-
-	/* check if the dpd data is valid */
-	if (cal_crc != dpd_crc) {
-		bes_err(
-			"bes2600 dpd data from file check failed, calc_crc:0x%08x dpd_crc: 0x%08x\n",
-			cal_crc, dpd_crc);
-		return false;
-	}
-
-	return true;
-}
-
-static int bes2600_chrdev_read_and_check_dpd_data(const char *file, u8 **data, u32 *len)
-{
-	int ret = 0;
-	u8* read_data = NULL;
-	struct file *fp;
-
-	/* open file */
-	fp = filp_open(file, O_RDONLY, 0);//S_IRUSR
-	if (IS_ERR(fp)) {
-		bes_devel("BES2600 : can't open %s\n",file);
-		return -1;
-	}
-
-#ifdef BES2600_WRITE_DPD_TO_FILE
-	if (fp->f_inode->i_size != DPD_BIN_FILE_SIZE) {
-		bes_err(
-			"bes2600 dpd data file size check failed, read_size: %lld file_size: %d\n",
-			fp->f_inode->i_size, DPD_BIN_FILE_SIZE);
-		filp_close(fp, NULL);
-		return -1;
-	}
-#endif
-
-	/* allocate memory for storing reading data */
-	read_data = kmalloc(fp->f_inode->i_size, GFP_KERNEL);
-	if (read_data == NULL) {
-		bes_devel("%s alloc mem fail\n", __func__);
-		goto err1;
-	}
-
-	/* read data  from file */
-	ret = kernel_read(fp, read_data, fp->f_inode->i_size, &fp->f_pos);
-	if (ret < DPD_BIN_SIZE) {
-		bes_err("%s read fail, ret=%d\n", __func__, ret);
-		goto err2;
-	}
-
-	/* check dpd version and crc */
-	if (!bes2600_chrdev_dpd_is_vaild(read_data))
-		goto err2;
-
-	/* close file */
-	filp_close(fp, NULL);
-
-	/* copy data to external */
-	*data = read_data;
-	*len = DPD_BIN_SIZE;;
-
-	/* output debug information */
-	bes_devel("read dpd data from %s\n", file);
-
-	return 0;
-
-err2:
-	kfree(read_data);
-err1:
-	filp_close(fp, NULL);
-	*data = NULL;
-	*len = 0;
-	return -1;
-}
-#endif
-
 const u8* bes2600_chrdev_get_dpd_data(u32 *len)
 {
-#ifdef BES2600_WRITE_DPD_TO_FILE
-	if (!bes2600_cdev.dpd_calied && bes2600_cdev.no_dpd) {
-		/* read dpd data from file that stores factory dpd calibration data */
-		if ((bes2600_chrdev_read_and_check_dpd_data(BES2600_DPD_GOLDEN_PATH,
-		   	&bes2600_cdev.dpd_data, &bes2600_cdev.dpd_len) < 0) &&
-		   (bes2600_chrdev_read_and_check_dpd_data(BES2600_DEFAULT_DPD_PATH,
-			&bes2600_cdev.dpd_data, &bes2600_cdev.dpd_len) < 0)) {
-			bes_err("%s read dpd data fail\n", __func__);
-			return NULL;
-		} else {
-			bes2600_cdev.dpd_calied = true;
-		}
-	}
-#endif
-
 	if (!bes2600_cdev.dpd_calied)
 		return NULL;
 	if (len)
@@ -460,14 +325,6 @@ int bes2600_chrdev_update_dpd_data(void)
 	}
 	spin_unlock(&bes2600_cdev.status_lock);
 
-#ifdef BES2600_WRITE_DPD_TO_FILE
-	/* write dpd data to file */
-	memset(bes2600_cdev.dpd_data + DPD_BIN_SIZE, 0, DPD_BIN_FILE_SIZE - DPD_BIN_SIZE);
-	bes2600_chrdev_write_dpd_data_to_file(BES2600_DPD_PATH,
-		bes2600_cdev.dpd_data, DPD_BIN_FILE_SIZE);
-#endif
-
-
 	return 0;
 }
 
@@ -585,6 +442,48 @@ int bes2600_chrdev_do_system_close(const struct sbus_ops *sbus_ops, struct sbus_
 	return ret;
 }
 
+/*
+ * Hard-reset the bus and wait for the bus core to remove the chip.
+ *
+ * Used by the firmware-wedge recovery path on platforms where the normal
+ * power_switch(0) sequence has no effective chip-reset signal. The bus
+ * implementation triggers an asynchronous re-detect; this helper waits for
+ * the resulting remove() callback to clear bes2600_cdev.sbus_priv so that a
+ * subsequent bes2600_switch_wifi(true) sees a clean state and can wait on
+ * the fresh probe.
+ */
+int bes2600_chrdev_do_bus_reset(const struct sbus_ops *sbus_ops, struct sbus_priv *priv)
+{
+	int ret;
+	long status;
+
+	if (!sbus_ops || !priv)
+		return -EINVAL;
+
+	if (!sbus_ops->bus_reset)
+		return -EOPNOTSUPP;
+
+	bes_info("trigger bus reset to recover wedged firmware.\n");
+
+	ret = sbus_ops->bus_reset(priv);
+	if (ret) {
+		bes_err("bus_reset failed: %d\n", ret);
+		return ret;
+	}
+
+	/*
+	 * The bus reset is asynchronous: the bus core schedules a rescan
+	 * which removes the bound function drivers and then re-detects the
+	 * chip. Wait for the remove callback to clear sbus_priv. Do not
+	 * dereference 'priv' after this point -- it may already be freed.
+	 */
+	status = wait_event_timeout(bes2600_cdev.probe_done_wq,
+				    !bes2600_cdev.sbus_priv, HZ * 3);
+	WARN_ON(status <= 0);
+
+	return 0;
+}
+
 bool bes2600_chrdev_is_wifi_opened(void)
 {
 	bool wifi_opened = false;
@@ -683,8 +582,21 @@ static void bes2600_chrdev_wifi_force_close_work(struct work_struct *work)
 		/* unregister wifi */
 		bes2600_switch_wifi(0);
 
-		/* power down device if wifi is only opened */
-		if (bes2600_chrdev_check_system_close()) {
+		/*
+		 * Hard exception with a bus_reset implementation: tear the
+		 * bus down via mmc_hw_reset() (or equivalent) so the next
+		 * bringup probes a freshly reset chip. On PineTab2 this is
+		 * the only effective recovery path -- the existing
+		 * power_switch(0)/(1) sequence has no chip-reset signal of
+		 * its own (sdio_pwrseq owns wifi_reset).
+		 *
+		 * Soft close, or hard close on a board without bus_reset:
+		 * fall back to the legacy power_switch(0) sequence.
+		 */
+		if (bes2600_cdev.halt_dev && bes2600_cdev.sbus_ops->bus_reset) {
+			bes2600_chrdev_do_bus_reset(bes2600_cdev.sbus_ops,
+						    bes2600_cdev.sbus_priv);
+		} else if (bes2600_chrdev_check_system_close()) {
 			bes2600_chrdev_do_system_close(bes2600_cdev.sbus_ops,
 						bes2600_cdev.sbus_priv);
 		}

bes2600/bes_chardev.h

@@ -60,6 +60,7 @@ struct sbus_priv *bes2600_chrdev_get_sbus_priv_data(void);
 /* used to control device power down */
 int bes2600_chrdev_check_system_close(void);
 int bes2600_chrdev_do_system_close(const struct sbus_ops *sbus_ops, struct sbus_priv *priv);
+int bes2600_chrdev_do_bus_reset(const struct sbus_ops *sbus_ops, struct sbus_priv *priv);
 void bes2600_chrdev_wakeup_bt(void);
 void bes2600_chrdev_wifi_force_close(struct bes2600_common *hw_priv, bool halt_dev);
 void bes2600_chrdev_usb_remove(struct bes2600_common *hw_priv);

bes2600/bes_fw.c

@@ -125,8 +125,6 @@ int bes_host_slave_sync(struct bes2600_common *hw_priv)
 }
 */
 
-//#define DATA_DUMP_OBSERVE
-
 static int bes_firmware_download_write_reg(struct platform_fw_t *fw_data, u32 addr, u32 val)
 {
 	u8 frame_num = 0;
@@ -468,14 +466,6 @@ static int bes_firmware_download(struct platform_fw_t *fw_data, const char *fw_n
 
 const struct firmware *fw_bin;
 
-#ifdef DATA_DUMP_OBSERVE
-	char *observe;
-	size_t observe_len;
-	loff_t observe_off = 0;
-	mm_segment_t old_fs;
-	struct file *observe_file = NULL;
-#endif
-
 	struct fw_msg_hdr_t header;
 	struct fw_info_t fw_info;
 	struct download_fw_t download_addr;
@@ -583,14 +573,6 @@ retry:
 	}
 	download_addr.addr = fw_info.addr;
 
-#ifdef DATA_DUMP_OBSERVE
-	observe_file = filp_open("/lib/firmware/bes2002_fw_write.bin", O_CREAT | O_RDWR, 0);
-	if (IS_ERR(observe_file)) {
-		bes_err("create data_dump file err:%ld\n", IS_ERR(observe_file));
-		observe_file = NULL;
-	}
-#endif
-
 	while (code_length) {
 
 #if 1
@@ -640,17 +622,6 @@ retry:
 		//mdelay(5000);
 		bes_devel("tx_download_firmware_data:%x %d\n", download_addr.addr, length);
 
-#ifdef DATA_DUMP_OBSERVE
-		if (observe_file) {
-			observe = (char *)(long_buf + sizeof(struct fw_msg_hdr_t) + sizeof(struct download_fw_t));
-			observe_len = length - sizeof(struct fw_msg_hdr_t) - sizeof(struct download_fw_t);
-			old_fs = get_fs();
-			set_fs(KERNEL_DS);
-			vfs_write(observe_file, observe, observe_len, &observe_off);
-			set_fs(old_fs);
-		}
-#endif
-
 		ret = bes2600_data_write(long_buf, length > 512 ? length : 512);
 		if (ret) {
 			bes_err("tx download fw data err:%d\n", ret);
@@ -832,11 +803,6 @@ retry:
 
 err2:
 	kfree(long_buf);
-#ifdef DATA_DUMP_OBSERVE
-	if (observe_file) {
-		filp_close(observe_file, NULL);
-	}
-#endif
 err1:
 	kfree(short_buf);
 	release_firmware(fw_bin);

bes2600/bes_pwr.c

@@ -538,7 +538,7 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 				atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
 				reinit_completion(&hw_priv->bes_power.pm_enter_cmpl);
 				if (!status) {
-					bes_err("%s, wait pm ind timeout\n", __func__);
+					bes_devel("%s, wait pm ind timeout\n", __func__);
 					timeouts++;
 				}
 			} else {

bes2600/main.c

@@ -790,41 +790,6 @@ void bes2600_core_release(struct bes2600_common *self)
 	return;
 }
 
-#if (GET_MAC_ADDR_METHOD == 2) || (GET_MAC_ADDR_METHOD == 3) /* To use macaddr and ps mode of customers */
-int access_file(char *path, char *buffer, int size, int isRead)
-{
-	int ret=0;
-	struct file *fp;
-	mm_segment_t old_fs = get_fs();
-
-	if(isRead)
-		fp = filp_open(path,O_RDONLY,S_IRUSR);
-	else
-		fp = filp_open(path,O_CREAT|O_WRONLY,S_IRUSR);
-
-	if (IS_ERR(fp)) {
-		bes_err("BES2600 : can't open %s\n", path);
-		return -1;
-	}
-
-	if (isRead) {
-			fp->f_pos = 0;
-			set_fs(KERNEL_DS);
-			ret = vfs_read(fp,buffer,size,&fp->f_pos);
-			set_fs(old_fs);
-	} else {
-			fp->f_pos = 0;
-			set_fs(KERNEL_DS);
-			ret = vfs_write(fp,buffer,size,&fp->f_pos);
-			set_fs(old_fs);
-	}
-	filp_close(fp,NULL);
-
-	bes_info("BES2600 : access_file return code(%d)\n", ret);
-	return ret;
-}
-#endif
-
 int bes2600_wifi_start(struct bes2600_common *hw_priv)
 {
 	int ret = 0, if_id;

bes2600/sbus.h

@@ -75,6 +75,14 @@ struct sbus_ops {
 	void (*halt_device)(struct sbus_priv *self);
 	bool (*wakeup_source)(struct sbus_priv *self);
 	int (*reboot)(struct sbus_priv *self);
+	/*
+	 * Force the host bus to re-detect and re-probe the chip. Called
+	 * from the firmware-wedge recovery path when power_switch() has no
+	 * effective chip-reset signal of its own (e.g. PineTab2, where the
+	 * wifi-reset GPIO is owned by sdio_pwrseq, not the bes2600 node).
+	 * Returns 0 on success or a negative errno.
+	 */
+	int (*bus_reset)(struct sbus_priv *self);
 };
 
 void bes2600_irq_handler(struct bes2600_common *priv);

bes2600/scan.c

@@ -14,11 +14,50 @@
 #include "scan.h"
 #include "sta.h"
 #include "pm.h"
+#include "epta_coex.h"
 #include "epta_request.h"
 #include "bes_pwr.h"
 
+/*
+ * After this many consecutive WSM scan rejections from firmware, stop
+ * issuing new scans for BES2600_SCAN_BACKOFF_JIFFIES and let the state
+ * that's rejecting them (coex window, firmware-internal busy) clear.
+ */
+#define BES2600_SCAN_REJECT_THRESHOLD	3
+#define BES2600_SCAN_BACKOFF_JIFFIES	(10 * HZ)
+
 static void bes2600_scan_restart_delayed(struct bes2600_vif *priv);
 
+/*
+ * Decide whether to skip sending the next WSM scan command without
+ * bothering the firmware. Two triggers:
+ *
+ *  1. BT A2DP is streaming in non-FDD coex mode. The firmware is
+ *     known to reject scan requests during that window; short-
+ *     circuiting here saves a WSM round-trip and avoids the
+ *     wsm_generic_confirm / scan_work warning cascade that follows.
+ *
+ *  2. We already saw >= BES2600_SCAN_REJECT_THRESHOLD consecutive
+ *     rejections on recent scan attempts and the backoff window has
+ *     not yet elapsed. Whatever was rejecting them is likely still
+ *     rejecting them; give it time.
+ *
+ * Returns true if the caller should abandon the scan iteration.
+ */
+static bool bes2600_scan_should_defer(struct bes2600_common *hw_priv)
+{
+#ifdef WIFI_BT_COEXIST_EPTA_ENABLE
+	if (!coex_is_fdd_mode() && coex_is_bt_a2dp())
+		return true;
+#endif
+
+	if (hw_priv->scan.reject_count >= BES2600_SCAN_REJECT_THRESHOLD &&
+	    time_before(jiffies, hw_priv->scan.backoff_until))
+		return true;
+
+	return false;
+}
+
 #ifdef CONFIG_BES2600_TESTMODE
 static int bes2600_advance_scan_start(struct bes2600_common *hw_priv)
 {
@@ -702,10 +741,29 @@ void bes2600_scan_work(struct work_struct *work)
 				wsm_unlock_tx(hw_priv);
 		} else
 #endif
-			hw_priv->scan.status = bes2600_scan_start(priv, &scan);
+		{
+			if (bes2600_scan_should_defer(hw_priv)) {
+				hw_priv->scan.status = -EBUSY;
+				hw_priv->scan.reject_count++;
+				hw_priv->scan.backoff_until =
+					jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
+				wiphy_dbg(priv->hw->wiphy,
+					  "[SCAN] deferred (coex/backoff, reject_count=%u)\n",
+					  hw_priv->scan.reject_count);
 				kfree(scan.ch);
-		if (WARN_ON(hw_priv->scan.status))
 				goto fail;
+			}
+			hw_priv->scan.status = bes2600_scan_start(priv, &scan);
+		}
+		kfree(scan.ch);
+		if (hw_priv->scan.status) {
+			hw_priv->scan.reject_count++;
+			hw_priv->scan.backoff_until =
+				jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
+			/* Lower callers already logged the reason at wiphy_warn. */
+			goto fail;
+		}
+		hw_priv->scan.reject_count = 0;
 		hw_priv->scan.curr = it;
 	}
 	up(&hw_priv->conf_lock);

bes2600/scan.h

@@ -42,6 +42,17 @@ struct bes2600_scan {
 	struct delayed_work probe_work;
 	int direct_probe;
 	u8 if_id;
+	/*
+	 * Track consecutive firmware-side WSM scan rejections so we can
+	 * back off briefly instead of re-issuing the same scan on every
+	 * mac80211 background-scan tick. Firmware returns WSM status != 0
+	 * for a handful of transient conditions (BT A2DP active in non-
+	 * FDD coex, firmware-internal busy windows) and keeps rejecting
+	 * until the state clears; retrying at full cadence just floods
+	 * dmesg.
+	 */
+	unsigned int reject_count;
+	unsigned long backoff_until;
 };
 
 int bes2600_hw_scan(struct ieee80211_hw *hw,

bes2600/wsm.c

@@ -134,8 +134,20 @@ static int wsm_generic_confirm(struct bes2600_common *hw_priv,
 				 struct wsm_buf *buf)
 {
 	u32 status = WSM_GET32(buf);
-	if (WARN(status != WSM_STATUS_SUCCESS, "wsm_generic_confirm ret %u", status))
+
+	/*
+	 * A non-SUCCESS status here is a firmware-side policy decision for
+	 * the command whose confirm this is -- commonly WSM status 2 for
+	 * scan (0x0407) rejected because of a coex window or transient
+	 * firmware-busy state. It is not a driver/kernel bug, so avoid the
+	 * WARN()/stack-trace treatment; the caller already emits a
+	 * wiphy_warn identifying the request id and will propagate the
+	 * error to mac80211.
+	 */
+	if (status != WSM_STATUS_SUCCESS) {
+		bes_devel("%s ret %u\n", __func__, status);
 		return -EINVAL;
+	}
 	return 0;
 
 underflow:

debian/copyright

@@ -18,8 +18,7 @@ License: LGPL-2.1
  License for more details.
  .
  You should have received a copy of the GNU Lesser General Public License
- along with this library; if not, write to the Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ along with this library; if not, see <https://www.gnu.org/licenses/>.
  .
  On Debian systems, the full text of the GNU Lesser General Public License
  version 2.1 can be found in the file "/usr/share/common-licenses/LGPL-2.1".