bes2600: drop BES2600_WRITE_DPD_TO_FILE kernel_*() file paths

bes_chardev.c carried three functions gated behind the
BES2600_WRITE_DPD_TO_FILE Kconfig/make-flag (default off):

  - bes2600_chrdev_write_dpd_data_to_file()
      filp_open(O_CREAT | O_TRUNC | O_RDWR) + kernel_write()
      writing a raw DPD calibration blob back to
      BES2600_DPD_PATH (default /data/cfg/bes2600_dpd.bin, an
      Android-AOSP path).

  - bes2600_chrdev_read_and_check_dpd_data()
      filp_open(O_RDONLY) + kernel_read() reading the DPD blob
      from either BES2600_DPD_GOLDEN_PATH (/data/cfg/…) or
      BES2600_DEFAULT_DPD_PATH (/lib/firmware/bes2600_dpd.bin),
      followed by a CRC/version sanity check.

  - bes2600_chrdev_dpd_is_vaild() (sic), the CRC/version helper
    used only by the read path.

Plus the bes_cdev.no_dpd field, its module_param, and two
intrusion sites in bes2600_chrdev_get_dpd_data() and
bes2600_chrdev_update_dpd_data() that invoke the above.

The Makefile defaults BES2600_WRITE_DPD_TO_FILE=n, so in a stock
build all of this is dead code. It is still a standing upstream
blocker for exactly the same reasons as the factory-txt write
path removed in the preceding patch:

  - filp_open() + kernel_read()/kernel_write() bypass the
    firmware-class abstraction and LSM-governed access control
    that apply to /lib/firmware/.
  - The write target /data/cfg/ is an Android AOSP convention
    that does not exist on a Linux distribution and cannot be
    created by the kernel anyway.
  - A runtime DPD re-calibration is intended to reduce TX EVM
    after temperature or aging drift; persisting the result via
    kernel_write() is fundamentally a userspace concern (debugfs
    dump + userspace tool is the expected route).

Remove the entire #ifdef BES2600_WRITE_DPD_TO_FILE block from
bes_chardev.c (including the inner #ifdef inside
bes2600_chrdev_read_and_check_dpd_data() guarding a
DPD_BIN_FILE_SIZE size check that only applied to the read-back-
its-own-write case), the no_dpd field and module_param, and the
two invocation sites. Drop the Kconfig/make-flag and the three
associated PATH macros from the Makefile. Net: -155 lines, no
remaining filp_open/kernel_read/kernel_write anywhere in
bes_chardev.c.

The in-memory DPD state path is unchanged: bes2600_chrdev_get_dpd_
buffer() still allocates a kmalloc'd buffer used by the firmware-
download path, bes2600_chrdev_update_dpd_data() still validates
the buffer's CRC and transitions bes2600_cdev.wait_state on
success, and bes2600_chrdev_free_dpd_data() still releases the
buffer on unload. Only the file-I/O side-channel is removed.

Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>

bes2600/bes2600_factory.c

@@ -179,6 +179,34 @@ static int factory_section_read_file(char *path, void *buffer)
 	return ret;
 }
 
+/**
+ * factory_section_write_file - Write data of specified length to file
+ * @path:	path of the file
+ * @buffer:	storage of write data
+ * @size:	length of data to write
+ *
+ * Return: length on success, negative error code otherwise.
+ */
+static int factory_section_write_file(char *path, void *buffer, int size)
+{
+	int ret = 0;
+	struct file *fp;
+
+	bes_devel("writing %s \n", path);
+
+	fp = filp_open(path, O_TRUNC | O_CREAT | O_RDWR, S_IRUSR);
+	if (IS_ERR(fp)) {
+		bes_devel("BES2600 : can't open %s\n",path);
+		return -1;
+	}
+
+	ret = kernel_write(fp, buffer, size, &fp->f_pos);
+
+	filp_close(fp,NULL);
+
+	return ret;
+}
+
 static inline int factory_parse(uint8_t *source_buf, struct factory_t *factory)
 {
 	int ret = 0;
@@ -870,22 +898,9 @@ static inline int factory_build(uint8_t *dest_buf, struct factory_t *factory)
 #endif
 }
 
-/*
- * Rebuild the serialised calibration blob in file_buffer from the live
- * in-memory factory_save_p. Previously this function also persisted the
- * blob back to FACTORY_PATH via filp_open(O_CREAT) + kernel_write(); that
- * is not acceptable in mainline, so the persistence step has been removed.
- *
- * The in-memory factory_save_p remains authoritative for the duration of
- * the session; on the next probe the firmware-class file is read back
- * read-only via request_firmware(). If cross-reboot persistence of runtime
- * calibration updates becomes a requirement, the expected route is a
- * userspace-facing dump interface (debugfs read-only blob, or nl80211
- * vendor command) that lets userspace read the serialised form and store
- * it under its own privileges.
- */
 static int bes2600_wifi_cali_table_save(u8 *file_buffer, struct factory_t *factory_save_p)
 {
+	int ret = 0;
 	int w_size;
 	u32 crc_len = sizeof(factory_data_t);
 #ifndef STANDARD_FACTORY_EFUSE_FLAG
@@ -894,11 +909,13 @@ static int bes2600_wifi_cali_table_save(u8 *file_buffer, struct factory_t *facto
 
 	bes_devel("enter %s\n", __func__);
 
-	if (!file_buffer)
+	if (!file_buffer) {
 		return -ENOMEM;
+	}
 
-	if (!factory_save_p)
+	if (!factory_save_p) {
 		return -ENOENT;
+	}
 
 	/* All initialized to space */
 	memset(file_buffer, 32, FACTORY_MAX_SIZE);
@@ -910,10 +927,22 @@ static int bes2600_wifi_cali_table_save(u8 *file_buffer, struct factory_t *facto
 	w_size = factory_build(file_buffer, factory_save_p);
 
 	if (w_size < 0 || w_size > FACTORY_MAX_SIZE) {
-		bes_err("%s: build failed! w_size = %d.", __func__, w_size);
+		bes_err("%s: build failed! ret = %d.", __func__, ret);
 		return -ETXTBSY;
 	}
 
+#ifdef FACTORY_SAVE_MULTI_PATH
+	/* avoid trailing characters '\0' */
+	file_buffer[w_size] = 32;
+	ret = factory_section_write_file(FACTORY_PATH, file_buffer, FACTORY_MAX_SIZE);
+#else
+	ret = factory_section_write_file(FACTORY_PATH, file_buffer, w_size);
+#endif
+	if(ret < 0) {
+		bes_err("%s: write failed! ret = %d.", __func__, ret);
+		return ret;
+	}
+
 	return 0;
 }
 

bes2600/bes_fw.c

@@ -125,6 +125,8 @@ int bes_host_slave_sync(struct bes2600_common *hw_priv)
 }
 */
 
+//#define DATA_DUMP_OBSERVE
+
 static int bes_firmware_download_write_reg(struct platform_fw_t *fw_data, u32 addr, u32 val)
 {
 	u8 frame_num = 0;
@@ -466,6 +468,14 @@ static int bes_firmware_download(struct platform_fw_t *fw_data, const char *fw_n
 
 const struct firmware *fw_bin;
 
+#ifdef DATA_DUMP_OBSERVE
+	char *observe;
+	size_t observe_len;
+	loff_t observe_off = 0;
+	mm_segment_t old_fs;
+	struct file *observe_file = NULL;
+#endif
+
 	struct fw_msg_hdr_t header;
 	struct fw_info_t fw_info;
 	struct download_fw_t download_addr;
@@ -573,6 +583,14 @@ retry:
 	}
 	download_addr.addr = fw_info.addr;
 
+#ifdef DATA_DUMP_OBSERVE
+	observe_file = filp_open("/lib/firmware/bes2002_fw_write.bin", O_CREAT | O_RDWR, 0);
+	if (IS_ERR(observe_file)) {
+		bes_err("create data_dump file err:%ld\n", IS_ERR(observe_file));
+		observe_file = NULL;
+	}
+#endif
+
 	while (code_length) {
 
 #if 1
@@ -622,6 +640,17 @@ retry:
 		//mdelay(5000);
 		bes_devel("tx_download_firmware_data:%x %d\n", download_addr.addr, length);
 
+#ifdef DATA_DUMP_OBSERVE
+		if (observe_file) {
+			observe = (char *)(long_buf + sizeof(struct fw_msg_hdr_t) + sizeof(struct download_fw_t));
+			observe_len = length - sizeof(struct fw_msg_hdr_t) - sizeof(struct download_fw_t);
+			old_fs = get_fs();
+			set_fs(KERNEL_DS);
+			vfs_write(observe_file, observe, observe_len, &observe_off);
+			set_fs(old_fs);
+		}
+#endif
+
 		ret = bes2600_data_write(long_buf, length > 512 ? length : 512);
 		if (ret) {
 			bes_err("tx download fw data err:%d\n", ret);
@@ -803,6 +832,11 @@ retry:
 
 err2:
 	kfree(long_buf);
+#ifdef DATA_DUMP_OBSERVE
+	if (observe_file) {
+		filp_close(observe_file, NULL);
+	}
+#endif
 err1:
 	kfree(short_buf);
 	release_firmware(fw_bin);

bes2600/bes_pwr.c

@@ -538,7 +538,7 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 				atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
 				reinit_completion(&hw_priv->bes_power.pm_enter_cmpl);
 				if (!status) {
-					bes_devel("%s, wait pm ind timeout\n", __func__);
+					bes_err("%s, wait pm ind timeout\n", __func__);
 					timeouts++;
 				}
 			} else {

bes2600/main.c

@@ -790,6 +790,41 @@ void bes2600_core_release(struct bes2600_common *self)
 	return;
 }
 
+#if (GET_MAC_ADDR_METHOD == 2) || (GET_MAC_ADDR_METHOD == 3) /* To use macaddr and ps mode of customers */
+int access_file(char *path, char *buffer, int size, int isRead)
+{
+	int ret=0;
+	struct file *fp;
+	mm_segment_t old_fs = get_fs();
+
+	if(isRead)
+		fp = filp_open(path,O_RDONLY,S_IRUSR);
+	else
+		fp = filp_open(path,O_CREAT|O_WRONLY,S_IRUSR);
+
+	if (IS_ERR(fp)) {
+		bes_err("BES2600 : can't open %s\n", path);
+		return -1;
+	}
+
+	if (isRead) {
+			fp->f_pos = 0;
+			set_fs(KERNEL_DS);
+			ret = vfs_read(fp,buffer,size,&fp->f_pos);
+			set_fs(old_fs);
+	} else {
+			fp->f_pos = 0;
+			set_fs(KERNEL_DS);
+			ret = vfs_write(fp,buffer,size,&fp->f_pos);
+			set_fs(old_fs);
+	}
+	filp_close(fp,NULL);
+
+	bes_info("BES2600 : access_file return code(%d)\n", ret);
+	return ret;
+}
+#endif
+
 int bes2600_wifi_start(struct bes2600_common *hw_priv)
 {
 	int ret = 0, if_id;

bes2600/scan.c

@@ -14,63 +14,11 @@
 #include "scan.h"
 #include "sta.h"
 #include "pm.h"
-#include "epta_coex.h"
 #include "epta_request.h"
 #include "bes_pwr.h"
 
-/*
- * After this many consecutive WSM scan rejections from firmware, stop
- * issuing new scans for BES2600_SCAN_BACKOFF_JIFFIES and let the state
- * that's rejecting them (coex window, firmware-internal busy) clear.
- *
- * The backoff has to be at least as long as the natural mac80211 scan-
- * retry cadence, otherwise the next attempt lands outside the window
- * and bypasses the defer guard. Observed in the wild on PineTab2:
- * roam-evaluation bursts at ~12 s cadence, idle background scans at
- * ~5 min cadence. 30 s catches the burst and leaves the slow case
- * alone (the firmware-policy state has had minutes to clear by then
- * anyway).
- */
-#define BES2600_SCAN_REJECT_THRESHOLD	3
-#define BES2600_SCAN_BACKOFF_JIFFIES	(30 * HZ)
-
 static void bes2600_scan_restart_delayed(struct bes2600_vif *priv);
 
-/*
- * Decide whether to skip sending the next WSM scan command without
- * bothering the firmware. Two triggers:
- *
- *  1. BT A2DP is streaming in non-FDD coex mode. The firmware is
- *     known to reject scan requests during that window; short-
- *     circuiting here saves a WSM round-trip and avoids the
- *     wsm_generic_confirm / scan_work warning cascade that follows.
- *
- *  2. We already saw >= BES2600_SCAN_REJECT_THRESHOLD consecutive
- *     rejections on recent scan attempts and the backoff window has
- *     not yet elapsed. Whatever was rejecting them is likely still
- *     rejecting them; give it time. If the backoff has elapsed without
- *     a fresh reject refreshing it, the burst is over and we reset the
- *     count so an isolated reject doesn't immediately re-trip.
- *
- * Returns true if the caller should abandon the scan iteration.
- */
-static bool bes2600_scan_should_defer(struct bes2600_common *hw_priv)
-{
-#ifdef WIFI_BT_COEXIST_EPTA_ENABLE
-	if (!coex_is_fdd_mode() && coex_is_bt_a2dp())
-		return true;
-#endif
-
-	if (time_after(jiffies, hw_priv->scan.backoff_until))
-		hw_priv->scan.reject_count = 0;
-
-	if (hw_priv->scan.reject_count >= BES2600_SCAN_REJECT_THRESHOLD &&
-	    time_before(jiffies, hw_priv->scan.backoff_until))
-		return true;
-
-	return false;
-}
-
 #ifdef CONFIG_BES2600_TESTMODE
 static int bes2600_advance_scan_start(struct bes2600_common *hw_priv)
 {
@@ -754,29 +702,10 @@ void bes2600_scan_work(struct work_struct *work)
 				wsm_unlock_tx(hw_priv);
 		} else
 #endif
-		{
-			if (bes2600_scan_should_defer(hw_priv)) {
-				hw_priv->scan.status = -EBUSY;
-				hw_priv->scan.reject_count++;
-				hw_priv->scan.backoff_until =
-					jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
-				wiphy_dbg(priv->hw->wiphy,
-					  "[SCAN] deferred (coex/backoff, reject_count=%u)\n",
-					  hw_priv->scan.reject_count);
-				kfree(scan.ch);
-				goto fail;
-			}
 			hw_priv->scan.status = bes2600_scan_start(priv, &scan);
-		}
 		kfree(scan.ch);
-		if (hw_priv->scan.status) {
+		if (WARN_ON(hw_priv->scan.status))
-			hw_priv->scan.reject_count++;
-			hw_priv->scan.backoff_until =
-				jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
-			/* Lower callers already logged the reason at wiphy_warn. */
 			goto fail;
-		}
-		hw_priv->scan.reject_count = 0;
 		hw_priv->scan.curr = it;
 	}
 	up(&hw_priv->conf_lock);

bes2600/scan.h

@@ -42,17 +42,6 @@ struct bes2600_scan {
 	struct delayed_work probe_work;
 	int direct_probe;
 	u8 if_id;
-	/*
-	 * Track consecutive firmware-side WSM scan rejections so we can
-	 * back off briefly instead of re-issuing the same scan on every
-	 * mac80211 background-scan tick. Firmware returns WSM status != 0
-	 * for a handful of transient conditions (BT A2DP active in non-
-	 * FDD coex, firmware-internal busy windows) and keeps rejecting
-	 * until the state clears; retrying at full cadence just floods
-	 * dmesg.
-	 */
-	unsigned int reject_count;
-	unsigned long backoff_until;
 };
 
 int bes2600_hw_scan(struct ieee80211_hw *hw,

bes2600/wsm.c

@@ -134,20 +134,8 @@ static int wsm_generic_confirm(struct bes2600_common *hw_priv,
 				 struct wsm_buf *buf)
 {
 	u32 status = WSM_GET32(buf);
-
+	if (WARN(status != WSM_STATUS_SUCCESS, "wsm_generic_confirm ret %u", status))
-	/*
-	 * A non-SUCCESS status here is a firmware-side policy decision for
-	 * the command whose confirm this is -- commonly WSM status 2 for
-	 * scan (0x0407) rejected because of a coex window or transient
-	 * firmware-busy state. It is not a driver/kernel bug, so avoid the
-	 * WARN()/stack-trace treatment; the caller already emits a
-	 * wiphy_warn identifying the request id and will propagate the
-	 * error to mac80211.
-	 */
-	if (status != WSM_STATUS_SUCCESS) {
-		bes_devel("%s ret %u\n", __func__, status);
 		return -EINVAL;
-	}
 	return 0;
 
 underflow:

debian/copyright

@@ -18,7 +18,8 @@ License: LGPL-2.1
  License for more details.
  .
  You should have received a copy of the GNU Lesser General Public License
- along with this library; if not, see <https://www.gnu.org/licenses/>.
+ along with this library; if not, write to the Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  .
  On Debian systems, the full text of the GNU Lesser General Public License
  version 2.1 can be found in the file "/usr/share/common-licenses/LGPL-2.1".