bes2600: drop kernel_write() persistence from factory cali save

Following the conversion of the factory-calibration READ path to
request_firmware() (earlier in this series), the factory-calibration
WRITE path in factory_section_write_file() was still using
filp_open(O_CREAT | O_TRUNC | O_RDWR) + kernel_write() to persist
updated calibration data back to FACTORY_PATH
(default /lib/firmware/bes2600/bes2600_factory.txt).

Writing to files under /lib/firmware/ from kernel code is a
standing upstream blocker for staging and for drivers/net/wireless/
submission generally:

 - filp_open()/kernel_write() bypass the firmware-class abstraction,
   the LSM framework, and user/group/mode enforcement that governs
   the firmware search paths. They have been repeatedly called out
   in staging-prep reviews.
 - The kernel runs with capabilities that userspace does not (CAP_
   DAC_OVERRIDE effectively); quietly rewriting firmware blobs that
   userspace owns is a surprise contract.
 - A module unload / reboot immediately after the write races the
   writeback and can leave a truncated calibration file on disk.

Remove factory_section_write_file() and its two call sites in
bes2600_wifi_cali_table_save(). The in-memory factory_save_p
remains authoritative for the duration of the session: the WSM
command handlers that triggered this path (power-cali-table,
freq-cali, efuse-flag, power-cali-flag) already update the live
struct factory_t, and reads served from file_buffer pick up the
rebuilt serialised form immediately. On the next probe the
firmware-class file is re-read read-only via request_firmware(),
as set up by the earlier patch.

If cross-reboot persistence of runtime-updated calibration becomes
a requirement, the expected route is a userspace-visible dump
interface -- a read-only debugfs file exporting the serialised
blob, or an nl80211 vendor command -- that lets userspace copy the
values to a chosen location under its own privileges. Such a
facility can land as a follow-up without touching the core driver
write path again.

Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>

bes2600/Makefile

@@ -28,6 +28,7 @@ CONFIG_BES2600_WIFI_BOOT_ON             ?= y
 CONFIG_BES2600_BT_BOOT_ON               ?= n
 
 BES2600_GPIO_WAKEUP_AP                  ?= n
+BES2600_WRITE_DPD_TO_FILE               ?= n
 BES2600_TX_MORE_RETRY                   ?= n
 
 # bes evb
@@ -92,6 +93,12 @@ ccflags-y += -DBES_UNIFIED_PM
 ccflags-y += -DBES_SDIO_OPTIMIZED_LEN
 ccflags-y += -DBES2600_HOST_TIMESTAMP_DEBUG
 
+ifeq ($(BES2600_WRITE_DPD_TO_FILE),y)
+BES2600_DPD_PATH ?= /data/cfg/bes2600_dpd.bin
+BES2600_DEFAULT_DPD_PATH ?= /lib/firmware/bes2600_dpd.bin
+BES2600_DPD_GOLDEN_PATH ?= /data/cfg/bes2600_dpd_golden.bin
+endif
+
 ifeq ($(BES2600_DUMP_FW_DPD_LOG),y)
 BES2600_DPD_LOG_PATH ?= /data/applog/bes2600_dpd_log.log
 endif
@@ -128,6 +135,9 @@ ccflags-y += $(call boolen_flag,BSS_LOSS_CHECK,y)
 ccflags-y += $(call string_flag,BES2600_LOAD_FW_TOOL_PATH)
 ccflags-y += $(call string_flag,BES2600_LOAD_FW_TOOL_DEVICE)
 ccflags-y += $(call string_flag,BES2600_DRV_VERSION)
+ccflags-y += $(call string_flag,BES2600_DPD_PATH)
+ccflags-y += $(call string_flag,BES2600_DEFAULT_DPD_PATH)
+ccflags-y += $(call string_flag,BES2600_DPD_GOLDEN_PATH)
 
 ccflags-y += $(call boolen_flag,BES2600_INDEPENDENT_EVB,y)
 ccflags-y += $(call boolen_flag,BES2600_INTEGRATED_MODULE_V1,y)
@@ -149,6 +159,8 @@ ccflags-y += $(call boolen_flag,FACTORY_SAVE_MULTI_PATH,y)
 ccflags-y += $(call boolen_flag,FACTORY_CRC_CHECK,y)
 
 ccflags-y += $(call boolen_flag,BES2600_GPIO_WAKEUP_AP,y)
+ccflags-y += $(call boolen_flag,BES2600_WRITE_DPD_TO_FILE,y)
+
 ccflags-y += $(call boolen_flag,BES2600_DUMP_FW_DPD_LOG,y)
 ccflags-y += $(call string_flag,BES2600_DPD_LOG_PATH)
 

bes2600/bes_chardev.c

@@ -63,6 +63,9 @@ struct bes_cdev {
 	struct delayed_work probe_timeout_work;
 	enum bus_probe_state bus_probe;
 	struct work_struct wifi_force_close_work;
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	int no_dpd;
+#endif
 	enum pend_read_op read_flag;
 	enum wakeup_event wakeup_by_event;	/* used to filter unwanted event wakeup reason report */
 	u16 wakeup_state; /* for userspace check wakeup reason */
@@ -82,6 +85,9 @@ struct bes2600_op_map {
 
 static struct bes_cdev bes2600_cdev;
 module_param_named(fw_type, bes2600_cdev.fw_type, int, 0644);
+#ifdef BES2600_WRITE_DPD_TO_FILE
+module_param_named(no_dpd, bes2600_cdev.no_dpd, int, 0644);
+#endif
 
 extern int bes2600_register_net_dev(struct sbus_priv *bus_priv);
 extern int bes2600_unregister_net_dev(struct sbus_priv *bus_priv);
@@ -263,8 +269,137 @@ static int bes2600_chrdev_check_system_close_internal(void)
 
 
 
+#ifdef BES2600_WRITE_DPD_TO_FILE
+static int bes2600_chrdev_write_dpd_data_to_file(const char *path, void *buffer, int size)
+{
+	int ret = 0;
+	struct file *fp;
+
+	if (buffer == NULL || size == 0)
+		return 0;
+
+	fp = filp_open(path, O_TRUNC | O_CREAT | O_RDWR, S_IRUSR);
+	if (IS_ERR(fp)) {
+		bes_err("BES2600 : can't open %s\n",path);
+		return -1;
+	}
+
+	ret = kernel_write(fp, buffer, size, &fp->f_pos);
+	if (ret < 0)
+		bes_err("write dpd to file failed\n");
+
+	filp_close(fp,NULL);
+
+	bes_devel("write dpd to %s\n", path);
+
+	return ret;
+}
+
+static bool bes2600_chrdev_dpd_is_vaild(u8 *dpd_data)
+{
+	u32 cal_crc = 0;
+	u32 dpd_crc = le32_to_cpup((__le32 *)(dpd_data));
+	u32 dpd_ver = le32_to_cpup((__le32 *)(dpd_data + DPD_VERSION_OFFSET));
+
+	/* check version */
+	if (dpd_ver < DPD_CUR_VERSION)
+		return false;
+
+	cal_crc ^= 0xffffffffL;
+	cal_crc = crc32_le(cal_crc, dpd_data + 4, DPD_BIN_SIZE - 4);
+	cal_crc ^= 0xffffffffL;
+
+	/* check if the dpd data is valid */
+	if (cal_crc != dpd_crc) {
+		bes_err(
+			"bes2600 dpd data from file check failed, calc_crc:0x%08x dpd_crc: 0x%08x\n",
+			cal_crc, dpd_crc);
+		return false;
+	}
+
+	return true;
+}
+
+static int bes2600_chrdev_read_and_check_dpd_data(const char *file, u8 **data, u32 *len)
+{
+	int ret = 0;
+	u8* read_data = NULL;
+	struct file *fp;
+
+	/* open file */
+	fp = filp_open(file, O_RDONLY, 0);//S_IRUSR
+	if (IS_ERR(fp)) {
+		bes_devel("BES2600 : can't open %s\n",file);
+		return -1;
+	}
+
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	if (fp->f_inode->i_size != DPD_BIN_FILE_SIZE) {
+		bes_err(
+			"bes2600 dpd data file size check failed, read_size: %lld file_size: %d\n",
+			fp->f_inode->i_size, DPD_BIN_FILE_SIZE);
+		filp_close(fp, NULL);
+		return -1;
+	}
+#endif
+
+	/* allocate memory for storing reading data */
+	read_data = kmalloc(fp->f_inode->i_size, GFP_KERNEL);
+	if (read_data == NULL) {
+		bes_devel("%s alloc mem fail\n", __func__);
+		goto err1;
+	}
+
+	/* read data  from file */
+	ret = kernel_read(fp, read_data, fp->f_inode->i_size, &fp->f_pos);
+	if (ret < DPD_BIN_SIZE) {
+		bes_err("%s read fail, ret=%d\n", __func__, ret);
+		goto err2;
+	}
+
+	/* check dpd version and crc */
+	if (!bes2600_chrdev_dpd_is_vaild(read_data))
+		goto err2;
+
+	/* close file */
+	filp_close(fp, NULL);
+
+	/* copy data to external */
+	*data = read_data;
+	*len = DPD_BIN_SIZE;;
+
+	/* output debug information */
+	bes_devel("read dpd data from %s\n", file);
+
+	return 0;
+
+err2:
+	kfree(read_data);
+err1:
+	filp_close(fp, NULL);
+	*data = NULL;
+	*len = 0;
+	return -1;
+}
+#endif
+
 const u8* bes2600_chrdev_get_dpd_data(u32 *len)
 {
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	if (!bes2600_cdev.dpd_calied && bes2600_cdev.no_dpd) {
+		/* read dpd data from file that stores factory dpd calibration data */
+		if ((bes2600_chrdev_read_and_check_dpd_data(BES2600_DPD_GOLDEN_PATH,
+		   	&bes2600_cdev.dpd_data, &bes2600_cdev.dpd_len) < 0) &&
+		   (bes2600_chrdev_read_and_check_dpd_data(BES2600_DEFAULT_DPD_PATH,
+			&bes2600_cdev.dpd_data, &bes2600_cdev.dpd_len) < 0)) {
+			bes_err("%s read dpd data fail\n", __func__);
+			return NULL;
+		} else {
+			bes2600_cdev.dpd_calied = true;
+		}
+	}
+#endif
+
 	if (!bes2600_cdev.dpd_calied)
 		return NULL;
 	if (len)
@@ -325,6 +460,14 @@ int bes2600_chrdev_update_dpd_data(void)
 	}
 	spin_unlock(&bes2600_cdev.status_lock);
 
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	/* write dpd data to file */
+	memset(bes2600_cdev.dpd_data + DPD_BIN_SIZE, 0, DPD_BIN_FILE_SIZE - DPD_BIN_SIZE);
+	bes2600_chrdev_write_dpd_data_to_file(BES2600_DPD_PATH,
+		bes2600_cdev.dpd_data, DPD_BIN_FILE_SIZE);
+#endif
+
+
 	return 0;
 }
 

bes2600/bes_fw.c

@@ -125,6 +125,8 @@ int bes_host_slave_sync(struct bes2600_common *hw_priv)
 }
 */
 
+//#define DATA_DUMP_OBSERVE
+
 static int bes_firmware_download_write_reg(struct platform_fw_t *fw_data, u32 addr, u32 val)
 {
 	u8 frame_num = 0;
@@ -466,6 +468,14 @@ static int bes_firmware_download(struct platform_fw_t *fw_data, const char *fw_n
 
 const struct firmware *fw_bin;
 
+#ifdef DATA_DUMP_OBSERVE
+	char *observe;
+	size_t observe_len;
+	loff_t observe_off = 0;
+	mm_segment_t old_fs;
+	struct file *observe_file = NULL;
+#endif
+
 	struct fw_msg_hdr_t header;
 	struct fw_info_t fw_info;
 	struct download_fw_t download_addr;
@@ -573,6 +583,14 @@ retry:
 	}
 	download_addr.addr = fw_info.addr;
 
+#ifdef DATA_DUMP_OBSERVE
+	observe_file = filp_open("/lib/firmware/bes2002_fw_write.bin", O_CREAT | O_RDWR, 0);
+	if (IS_ERR(observe_file)) {
+		bes_err("create data_dump file err:%ld\n", IS_ERR(observe_file));
+		observe_file = NULL;
+	}
+#endif
+
 	while (code_length) {
 
 #if 1
@@ -622,6 +640,17 @@ retry:
 		//mdelay(5000);
 		bes_devel("tx_download_firmware_data:%x %d\n", download_addr.addr, length);
 
+#ifdef DATA_DUMP_OBSERVE
+		if (observe_file) {
+			observe = (char *)(long_buf + sizeof(struct fw_msg_hdr_t) + sizeof(struct download_fw_t));
+			observe_len = length - sizeof(struct fw_msg_hdr_t) - sizeof(struct download_fw_t);
+			old_fs = get_fs();
+			set_fs(KERNEL_DS);
+			vfs_write(observe_file, observe, observe_len, &observe_off);
+			set_fs(old_fs);
+		}
+#endif
+
 		ret = bes2600_data_write(long_buf, length > 512 ? length : 512);
 		if (ret) {
 			bes_err("tx download fw data err:%d\n", ret);
@@ -803,6 +832,11 @@ retry:
 
 err2:
 	kfree(long_buf);
+#ifdef DATA_DUMP_OBSERVE
+	if (observe_file) {
+		filp_close(observe_file, NULL);
+	}
+#endif
 err1:
 	kfree(short_buf);
 	release_firmware(fw_bin);

bes2600/bes_pwr.c

@@ -538,7 +538,7 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 				atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
 				reinit_completion(&hw_priv->bes_power.pm_enter_cmpl);
 				if (!status) {
-					bes_devel("%s, wait pm ind timeout\n", __func__);
+					bes_err("%s, wait pm ind timeout\n", __func__);
 					timeouts++;
 				}
 			} else {

bes2600/main.c

@@ -790,6 +790,41 @@ void bes2600_core_release(struct bes2600_common *self)
 	return;
 }
 
+#if (GET_MAC_ADDR_METHOD == 2) || (GET_MAC_ADDR_METHOD == 3) /* To use macaddr and ps mode of customers */
+int access_file(char *path, char *buffer, int size, int isRead)
+{
+	int ret=0;
+	struct file *fp;
+	mm_segment_t old_fs = get_fs();
+
+	if(isRead)
+		fp = filp_open(path,O_RDONLY,S_IRUSR);
+	else
+		fp = filp_open(path,O_CREAT|O_WRONLY,S_IRUSR);
+
+	if (IS_ERR(fp)) {
+		bes_err("BES2600 : can't open %s\n", path);
+		return -1;
+	}
+
+	if (isRead) {
+			fp->f_pos = 0;
+			set_fs(KERNEL_DS);
+			ret = vfs_read(fp,buffer,size,&fp->f_pos);
+			set_fs(old_fs);
+	} else {
+			fp->f_pos = 0;
+			set_fs(KERNEL_DS);
+			ret = vfs_write(fp,buffer,size,&fp->f_pos);
+			set_fs(old_fs);
+	}
+	filp_close(fp,NULL);
+
+	bes_info("BES2600 : access_file return code(%d)\n", ret);
+	return ret;
+}
+#endif
+
 int bes2600_wifi_start(struct bes2600_common *hw_priv)
 {
 	int ret = 0, if_id;

bes2600/scan.c

@@ -14,63 +14,11 @@
 #include "scan.h"
 #include "sta.h"
 #include "pm.h"
-#include "epta_coex.h"
 #include "epta_request.h"
 #include "bes_pwr.h"
 
-/*
- * After this many consecutive WSM scan rejections from firmware, stop
- * issuing new scans for BES2600_SCAN_BACKOFF_JIFFIES and let the state
- * that's rejecting them (coex window, firmware-internal busy) clear.
- *
- * The backoff has to be at least as long as the natural mac80211 scan-
- * retry cadence, otherwise the next attempt lands outside the window
- * and bypasses the defer guard. Observed in the wild on PineTab2:
- * roam-evaluation bursts at ~12 s cadence, idle background scans at
- * ~5 min cadence. 30 s catches the burst and leaves the slow case
- * alone (the firmware-policy state has had minutes to clear by then
- * anyway).
- */
-#define BES2600_SCAN_REJECT_THRESHOLD	3
-#define BES2600_SCAN_BACKOFF_JIFFIES	(30 * HZ)
-
 static void bes2600_scan_restart_delayed(struct bes2600_vif *priv);
 
-/*
- * Decide whether to skip sending the next WSM scan command without
- * bothering the firmware. Two triggers:
- *
- *  1. BT A2DP is streaming in non-FDD coex mode. The firmware is
- *     known to reject scan requests during that window; short-
- *     circuiting here saves a WSM round-trip and avoids the
- *     wsm_generic_confirm / scan_work warning cascade that follows.
- *
- *  2. We already saw >= BES2600_SCAN_REJECT_THRESHOLD consecutive
- *     rejections on recent scan attempts and the backoff window has
- *     not yet elapsed. Whatever was rejecting them is likely still
- *     rejecting them; give it time. If the backoff has elapsed without
- *     a fresh reject refreshing it, the burst is over and we reset the
- *     count so an isolated reject doesn't immediately re-trip.
- *
- * Returns true if the caller should abandon the scan iteration.
- */
-static bool bes2600_scan_should_defer(struct bes2600_common *hw_priv)
-{
-#ifdef WIFI_BT_COEXIST_EPTA_ENABLE
-	if (!coex_is_fdd_mode() && coex_is_bt_a2dp())
-		return true;
-#endif
-
-	if (time_after(jiffies, hw_priv->scan.backoff_until))
-		hw_priv->scan.reject_count = 0;
-
-	if (hw_priv->scan.reject_count >= BES2600_SCAN_REJECT_THRESHOLD &&
-	    time_before(jiffies, hw_priv->scan.backoff_until))
-		return true;
-
-	return false;
-}
-
 #ifdef CONFIG_BES2600_TESTMODE
 static int bes2600_advance_scan_start(struct bes2600_common *hw_priv)
 {
@@ -754,29 +702,10 @@ void bes2600_scan_work(struct work_struct *work)
 				wsm_unlock_tx(hw_priv);
 		} else
 #endif
-		{
-			if (bes2600_scan_should_defer(hw_priv)) {
-				hw_priv->scan.status = -EBUSY;
-				hw_priv->scan.reject_count++;
-				hw_priv->scan.backoff_until =
-					jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
-				wiphy_dbg(priv->hw->wiphy,
-					  "[SCAN] deferred (coex/backoff, reject_count=%u)\n",
-					  hw_priv->scan.reject_count);
-				kfree(scan.ch);
-				goto fail;
-			}
 			hw_priv->scan.status = bes2600_scan_start(priv, &scan);
-		}
 		kfree(scan.ch);
-		if (hw_priv->scan.status) {
+		if (WARN_ON(hw_priv->scan.status))
-			hw_priv->scan.reject_count++;
-			hw_priv->scan.backoff_until =
-				jiffies + BES2600_SCAN_BACKOFF_JIFFIES;
-			/* Lower callers already logged the reason at wiphy_warn. */
 			goto fail;
-		}
-		hw_priv->scan.reject_count = 0;
 		hw_priv->scan.curr = it;
 	}
 	up(&hw_priv->conf_lock);

bes2600/scan.h

@@ -42,17 +42,6 @@ struct bes2600_scan {
 	struct delayed_work probe_work;
 	int direct_probe;
 	u8 if_id;
-	/*
-	 * Track consecutive firmware-side WSM scan rejections so we can
-	 * back off briefly instead of re-issuing the same scan on every
-	 * mac80211 background-scan tick. Firmware returns WSM status != 0
-	 * for a handful of transient conditions (BT A2DP active in non-
-	 * FDD coex, firmware-internal busy windows) and keeps rejecting
-	 * until the state clears; retrying at full cadence just floods
-	 * dmesg.
-	 */
-	unsigned int reject_count;
-	unsigned long backoff_until;
 };
 
 int bes2600_hw_scan(struct ieee80211_hw *hw,

bes2600/wsm.c

@@ -134,20 +134,8 @@ static int wsm_generic_confirm(struct bes2600_common *hw_priv,
 				 struct wsm_buf *buf)
 {
 	u32 status = WSM_GET32(buf);
-
+	if (WARN(status != WSM_STATUS_SUCCESS, "wsm_generic_confirm ret %u", status))
-	/*
-	 * A non-SUCCESS status here is a firmware-side policy decision for
-	 * the command whose confirm this is -- commonly WSM status 2 for
-	 * scan (0x0407) rejected because of a coex window or transient
-	 * firmware-busy state. It is not a driver/kernel bug, so avoid the
-	 * WARN()/stack-trace treatment; the caller already emits a
-	 * wiphy_warn identifying the request id and will propagate the
-	 * error to mac80211.
-	 */
-	if (status != WSM_STATUS_SUCCESS) {
-		bes_devel("%s ret %u\n", __func__, status);
 		return -EINVAL;
-	}
 	return 0;
 
 underflow:

debian/copyright

@@ -18,7 +18,8 @@ License: LGPL-2.1
  License for more details.
  .
  You should have received a copy of the GNU Lesser General Public License
- along with this library; if not, see <https://www.gnu.org/licenses/>.
+ along with this library; if not, write to the Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  .
  On Debian systems, the full text of the GNU Lesser General Public License
  version 2.1 can be found in the file "/usr/share/common-licenses/LGPL-2.1".