bes2600: Patch C2 — replace ieee80211_rx_irqsafe with ieee80211_rx_ni

Per Phase 4 plan PR #14 + kerneldoc audit (Task #19). Six call sites deferred per-RX-frame mac80211 dispatch via tasklet; replace with the synchronous-from-process-context API ieee80211_rx_ni() which does its own local_bh_disable wrap. Why _ni and not _list: Phase 4 plan originally targeted ieee80211_rx_list for batch delivery. Mining mt76 mainline (the only driver using _list) showed the canonical pattern requires threading a struct list_head through the per-frame call chain. bes2600s WSM dispatcher (wsm_handle_rx -> bes2600_rx_cb / wsm.c beacon path) sits between the bh threads SDIO read and the mac80211 hand-off; threading a list_head through the dispatcher is a non-trivial refactor. ieee80211_rx_ni() is the simpler drop-in: no list management, still removes the tasklet hop. Per-call local_bh_disable cost is trivial vs the saved tasklet schedule. Future refactor can revisit _list if measurements warrant. Sites converted: - ap.c:96 (bes2600_sta_add link-id rx_queue drain on AP-mode STA add). Was inside spin_lock_bh(&ps_state_lock); refactored to splice the queue under the lock then deliver after unlock — _ni runs the synchronous mac80211 RX path inline, would otherwise hold the lock across mac80211 dispatch. splice via skb_queue_splice_init into a local sk_buff_head. - sta.c:1487 (deauth-frame inject in inactivity-event handler). Not under any lock; direct conversion. - txrx.c:1960 (early-data + pm_unsupported branch from Patch E). - txrx.c:1967 (early-data + LINK_SOFT-not-set branch). - txrx.c:1971 (normal RX path in bes2600_rx_cb). - wsm.c:2415 (beacon delivery in scan-complete WSM handler). beacon SKB ownership is preserved by the existing skb_copy(beacon, GFP_ATOMIC) -> beacon_bkp pattern; no lifecycle change needed. Mixing constraint (kerneldoc include/net/mac80211.h:5399-5430): ieee80211_rx_ni() cannot mix with ieee80211_rx_irqsafe() for a single hardware. All 6 sites convert atomically; no mixed state. Build verified clean on ohm sandbox: srcversion 619A51E61BF5479AAC146E6. Predicted Phase 7 delta: +5-15% over v3+D+E baseline (2.35 MB/s mean on v3 alone; D+E single-rep was 3.22 MB/s). Modest improvement expected from removing the tasklet schedule per RX frame. Smaller deltas would still be a net win for upstream-cleanliness — the kernel.org submission story benefits from not using _irqsafe from process context.
bes2600: Patch E — skip ps_state_lock when PSM-known-disabled
2026-05-19 15:05:45 +02:00 · 2026-05-19 09:07:00 +02:00 · 2026-05-19 09:07:00 +02:00 · 2026-05-19 09:06:07 +02:00 · 2026-05-19 09:06:07 +02:00 · 2026-05-19 09:06:07 +02:00
52 changed files with 1910 additions and 530 deletions
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * mac80211 STA and AP API for mac80211 BES2600 drivers
+ * AP mode for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include "bes2600.h"
@@ -17,6 +14,7 @@
 #include <linux/umh.h>
 #include "epta_request.h"
 #include "epta_coex.h"
+#include "txrx_opt.h"

 #ifdef AP_HT_CAP_UPDATE
 #define HT_INFO_OFFSET 4
@@ -65,8 +63,11 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct bes2600_vif *priv = cw12xx_get_vif_from_ieee80211(vif);
 	struct bes2600_link_entry *entry;
 	struct sk_buff *skb;
+	struct sk_buff_head local_drain;
 	struct bes2600_common *hw_priv = hw->priv;

+	__skb_queue_head_init(&local_drain);
+
 #ifdef P2P_MULTIVIF
 	WARN_ON(priv->if_id == CW12XX_GENERIC_IF_ID);
 #endif
@@ -95,9 +96,17 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 					IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
 		priv->sta_asleep_mask |= BIT(sta_priv->link_id);
 	entry->status = BES2600_LINK_HARD;
-	while ((skb = skb_dequeue(&entry->rx_queue)))
-		ieee80211_rx_irqsafe(priv->hw, skb);
+	/*
+	 * Patch C2: splice the rx_queue out under the lock then deliver
+	 * after unlock.  ieee80211_rx_ni() runs the mac80211 RX path
+	 * synchronously (formerly ieee80211_rx_irqsafe deferred to a
+	 * tasklet); calling it from inside spin_lock_bh would hold the
+	 * lock across mac80211's full RX dispatch.
+	 */
+	skb_queue_splice_init(&entry->rx_queue, &local_drain);
 	spin_unlock_bh(&priv->ps_state_lock);
+	while ((skb = __skb_dequeue(&local_drain)))
+		ieee80211_rx_ni(priv->hw, skb);
 #ifdef AP_AGGREGATE_FW_FIX
 	hw_priv->connected_sta_cnt++;
 	if(hw_priv->connected_sta_cnt>1) {
@@ -1154,7 +1163,7 @@ void bes2600_multicast_stop_work(struct work_struct *work)
 		container_of(work, struct bes2600_vif, multicast_stop_work);

 	if (priv->aid0_bit_set) {
-		del_timer_sync(&priv->mcast_timeout);
+		timer_delete_sync(&priv->mcast_timeout);
 		wsm_lock_tx(priv->hw_priv);
 		priv->aid0_bit_set = false;
 		bes2600_set_tim_impl(priv, false);
@@ -1164,7 +1173,7 @@ void bes2600_multicast_stop_work(struct work_struct *work)

 void bes2600_mcast_timeout(struct timer_list *t)
 {
-	struct bes2600_vif *priv = from_timer(priv, t, mcast_timeout);
+	struct bes2600_vif *priv = timer_container_of(priv, t, mcast_timeout);

 	wiphy_warn(priv->hw->wiphy,
 		"Multicast delivery timeout.\n");
@@ -1238,7 +1247,7 @@ void bes2600_suspend_resume(struct bes2600_vif *priv,
 		}
 		spin_unlock_bh(&priv->ps_state_lock);
 		if (cancel_tmo)
-			del_timer_sync(&priv->mcast_timeout);
+			timer_delete_sync(&priv->mcast_timeout);
 	} else {
 		spin_lock_bh(&priv->ps_state_lock);
 		bes2600_ps_notify(priv, arg->link_id, arg->stop);
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * mac80211 STA and AP API for mac80211 BES2600 drivers
+ * AP mode interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include <linux/version.h>
 #ifndef AP_H_INCLUDED
@@ -1,18 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Common private data for BES2600 drivers
+ * Common private data for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
 * Based on the mac80211 Prism54 code, which is
 * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
 *
- * Based on the islsm (softmac prism54) driver, which is:
+ * Based on the islsm (softmac prism54) driver, which is
 * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_H
@@ -356,15 +353,23 @@ struct bes2600_common {
 	* Keeping in common structure for the time being. Will be moved to VIFF
 	* after the mechanism is clear */
 	u8				ba_tid_mask;
-	int				ba_acc; /*TODO: Same as above */
-	int				ba_cnt; /*TODO: Same as above */
-	int				ba_cnt_rx; /*TODO: Same as above */
-	int				ba_acc_rx; /*TODO: Same as above */
-	int				ba_hist; /*TODO: Same as above */
-	struct timer_list		ba_timer;/*TODO: Same as above */
-	spinlock_t			ba_lock; /*TODO: Same as above */
-	bool				ba_ena; /*TODO: Same as above */
-	struct work_struct              ba_work; /*TODO: Same as above */
+	/*
+	 * Patch D: ba_lock removed.  Per-frame TX/RX hot-path bumped these
+	 * counters under spin_lock_bh; the lock did not protect any
+	 * compound invariant that atomic ops can't satisfy.  Counters are
+	 * now atomic_t; ba_armed gates the once-per-window mod_timer
+	 * arm via cmpxchg so concurrent TX/RX at a fresh window each
+	 * try to claim the arm and exactly one succeeds.
+	 */
+	atomic_t			ba_acc;
+	atomic_t			ba_cnt;
+	atomic_t			ba_cnt_rx;
+	atomic_t			ba_acc_rx;
+	atomic_t			ba_armed;
+	int				ba_hist;
+	struct timer_list		ba_timer;
+	atomic_t			ba_ena;
+	struct work_struct              ba_work;
 	bool				is_BT_Present;
 	bool				is_go_thru_go_neg;
 	u8				conf_listen_interval;
@@ -0,0 +1,509 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Bestechnic BES2600 BT UART driver
+ *
+ * Copyright (c) 2025 Dang Huynh <dang.huynh@mainlining.org>
+ */
+
+#include <linux/module.h>
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+
+#include <linux/of.h>
+#include <linux/of_irq.h>
+
+#include <linux/device.h>
+#include <linux/pm.h>
+#include <linux/pm_wakeirq.h>
+
+#include <linux/gpio/consumer.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/serdev.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#include "bes2600.h"
+#include "bes_chardev.h"
+
+#include "h4_recv.h"
+
+struct bes2600_btuart_data {
+	struct serdev_device *serdev;
+	struct hci_dev *hdev;
+
+	struct pinctrl *pinctrl;
+	struct pinctrl_state *pinctrl_default;
+
+	/* Device tree properties */
+	struct gpio_desc *power;
+	struct gpio_desc *wakeup;
+	int speed;
+
+	unsigned long state;
+
+	int wake_irq;
+	bool opened;
+
+	int err_count; /* workaround for broken firmware */
+
+	struct sk_buff_head txq;
+	struct work_struct tx_work;
+	rwlock_t lock;
+
+	struct sk_buff *rx_skb;
+};
+
+static const struct h4_recv_pkt bes2600_btuart_recv_pkts[] = {
+	{ H4_RECV_ACL,      .recv = hci_recv_frame },
+	{ H4_RECV_SCO,      .recv = hci_recv_frame },
+	{ H4_RECV_EVENT,    .recv = hci_recv_frame },
+};
+
+static int bes2600_btuart_power(struct bes2600_btuart_data *data, bool enable)
+{
+	int ret, val;
+
+	if (enable)
+		val = 1;
+	else
+		val = 0;
+
+	ret = gpiod_set_value_cansleep(data->power, val);
+	if (ret)
+		return ret;
+
+	ret = bes2600_chrdev_switch_subsys_glb(-1, val);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ * HACK: Potential DOS issue, not sure if the firmware can filter it but
+ * there needs to be a better way to detect this. Even better, fix the firmware.
+ */
+static int bes2600_btuart_bug_recovery(struct bes2600_btuart_data *data)
+{
+	struct hci_dev *hdev = data->hdev;
+	struct serdev_device *serdev = data->serdev;
+
+	bt_dev_info(hdev, "Attempting to recover from Firmware bug (might not work)");
+
+	serdev_device_set_flow_control(serdev, false);
+	bes2600_btuart_power(data, false);
+	msleep(20);
+	bes2600_btuart_power(data, true);
+	serdev_device_set_flow_control(serdev, true);
+	msleep(100);
+
+	hci_reset_dev(hdev);
+
+	return 0;
+}
+
+static int bes2600_btuart_recv(struct bes2600_btuart_data *data, const void *buffer, int count)
+{
+	struct hci_dev *hdev = data->hdev;
+	int err = 0;
+
+	data->rx_skb = h4_recv_buf(hdev, data->rx_skb, buffer, count,
+				   bes2600_btuart_recv_pkts, ARRAY_SIZE(bes2600_btuart_recv_pkts));
+	if (IS_ERR(data->rx_skb))
+		err = PTR_ERR(data->rx_skb);
+
+	return err;
+}
+
+static size_t bes2600_btuart_receive_buf(struct serdev_device *serdev,
+					 const u8 *buf, size_t count)
+{
+	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
+	struct hci_dev *hdev = data->hdev;
+	int ret;
+
+	read_lock(&data->lock);
+	ret = bes2600_btuart_recv(data, buf, count);
+	if (ret) {
+		bt_dev_err(hdev, "Failed to receive packet (%d)", ret);
+		data->err_count++;
+		ret = 0;
+	} else {
+		hdev->stat.byte_rx += count;
+		ret = count;
+	}
+	read_unlock(&data->lock);
+
+	/* Attempting to recovery from a bugged firmware */
+	if (data->err_count > 10) {
+		bes2600_btuart_bug_recovery(data);
+		data->err_count = 0;
+	}
+
+	return ret;
+}
+
+static const struct serdev_device_ops bes2600_btuart_serdev_client_ops = {
+	.receive_buf = bes2600_btuart_receive_buf,
+	.write_wakeup = serdev_device_write_wakeup,
+};
+
+static void bes2600_btuart_wake(struct hci_dev *hdev, bool enable)
+{
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+
+	if (enable)
+		gpiod_set_value_cansleep(data->wakeup, 1);
+	else
+		gpiod_set_value_cansleep(data->wakeup, 0);
+}
+
+static int bes2600_btuart_open(struct hci_dev *hdev)
+{
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+	struct serdev_device *serdev = data->serdev;
+	int ret;
+
+	ret = serdev_device_open(serdev);
+	if (ret < 0) {
+		bt_dev_err(hdev, "Failed to open serial device");
+		return ret;
+	}
+
+	serdev_device_set_flow_control(serdev, false);
+
+	ret = serdev_device_set_baudrate(serdev, data->speed);
+	if (ret < 0) {
+		bt_dev_err(hdev, "Failed to set baud rate");
+		return ret;
+	}
+
+	serdev_device_set_flow_control(serdev, true);
+
+	data->opened = true;
+
+	bes2600_btuart_wake(hdev, true);
+	return 0;
+}
+
+static int bes2600_btuart_flush(struct hci_dev *hdev)
+{
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+	struct serdev_device *serdev = data->serdev;
+
+	serdev_device_write_flush(serdev);
+
+	read_lock(&data->lock);
+	skb_queue_purge(&data->txq);
+	cancel_work_sync(&data->tx_work);
+	read_unlock(&data->lock);
+
+	return 0;
+}
+
+static int bes2600_btuart_close(struct hci_dev *hdev)
+{
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+	struct serdev_device *serdev = data->serdev;
+
+	bes2600_btuart_wake(hdev, false);
+
+	serdev_device_set_flow_control(serdev, false);
+	serdev_device_close(serdev);
+
+	data->opened = false;
+
+	return 0;
+}
+
+static int bes2600_btuart_setup(struct hci_dev *hdev)
+{
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+	int ret;
+
+	if (bes2600_chrdev_is_bus_error())
+		return -EFAULT;
+
+	/* Set pinctrl state to default */
+	ret = pinctrl_select_state(data->pinctrl, data->pinctrl_default);
+	if (ret < 0) {
+		bt_dev_err(hdev, "Failed to setup pinctrl state");
+		return ret;
+	}
+
+	/* Set power GPIO to high and tell chardev to switch to BT */
+	bes2600_btuart_power(data, true);
+
+	return 0;
+}
+
+static int bes2600_btuart_shutdown(struct hci_dev *hdev)
+{
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+
+	if (bes2600_chrdev_is_bus_error())
+		return -EFAULT;
+
+	bes2600_btuart_power(data, false);
+
+	return 0;
+}
+
+static int bes2600_btuart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
+{
+	char *pkt_type = NULL;
+	struct bes2600_btuart_data *data = hci_get_drvdata(hdev);
+
+	switch (hci_skb_pkt_type(skb)) {
+	case HCI_COMMAND_PKT:
+		hdev->stat.cmd_tx++;
+		break;
+	case HCI_ACLDATA_PKT:
+		hdev->stat.acl_tx++;
+		break;
+	case HCI_SCODATA_PKT:
+		hdev->stat.sco_tx++;
+		break;
+	default:
+		return -EILSEQ;
+	}
+	pkt_type = skb_push(skb, 1);
+	pkt_type[0] = hci_skb_pkt_type(skb);
+	read_lock(&data->lock);
+	skb_queue_tail(&data->txq, skb);
+	read_unlock(&data->lock);
+
+	schedule_work(&data->tx_work);
+	return 0;
+}
+
+static ssize_t bes2600_btuart_send(struct bes2600_btuart_data *data, struct sk_buff *skb)
+{
+	struct hci_dev *hdev = data->hdev;
+	int len;
+
+	len = serdev_device_write_buf(data->serdev, skb->data, skb->len);
+	if (len < 0) {
+		bt_dev_err(data->hdev, "Failed to write buffer to TTY");
+		return -EIO;
+	}
+	serdev_device_wait_until_sent(data->serdev, 0);
+
+	hdev->stat.byte_tx += len;
+
+	skb_pull(skb, len);
+
+	return skb->len;
+}
+
+static void bes2600_btuart_work(struct work_struct *work)
+{
+	struct bes2600_btuart_data *data = container_of(work, struct bes2600_btuart_data, tx_work);
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(&data->txq))) {
+		if (bes2600_btuart_send(data, skb) > 0) {
+			skb_queue_head(&data->txq, skb);
+			break;
+		}
+
+		kfree_skb(skb);
+	}
+}
+
+static void bes2600_btuart_parse_dt(struct serdev_device *serdev)
+{
+	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
+	struct device_node *node = serdev->dev.of_node;
+	int speed = 1500000;
+
+	of_property_read_u32(node, "current-speed", &speed);
+	data->speed = speed;
+}
+
+static irqreturn_t bes2600_btuart_wakeup_handler(int irq, void *priv)
+{
+	struct bes2600_btuart_data *data = (struct bes2600_btuart_data *)priv;
+
+	dev_info(&data->serdev->dev, "IRQ wake\n");
+
+	return IRQ_HANDLED;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int bes2600_btuart_suspend(struct device *dev)
+{
+	struct serdev_device *serdev = to_serdev_device(dev);
+	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
+
+	if (data->opened) {
+		bes2600_btuart_wake(data->hdev, false);
+
+		if (device_may_wakeup(dev) && data->wake_irq)
+			enable_irq_wake(data->wake_irq);
+	}
+
+	return 0;
+}
+
+static int bes2600_btuart_resume(struct device *dev)
+{
+	struct serdev_device *serdev = to_serdev_device(dev);
+	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
+
+	if (data->opened) {
+		bes2600_btuart_wake(data->hdev, true);
+
+		if (device_may_wakeup(dev) && data->wake_irq)
+			disable_irq_wake(data->wake_irq);
+	}
+
+	return 0;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(bes2600_btuart_pm_ops,
+			bes2600_btuart_suspend, bes2600_btuart_resume);
+
+static int bes2600_btuart_probe(struct serdev_device *serdev)
+{
+	struct device *dev = &serdev->dev;
+	struct bes2600_btuart_data *data;
+	struct hci_dev *hdev;
+	int ret;
+
+	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	skb_queue_head_init(&data->txq);
+
+	data->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR(data->pinctrl))
+		return dev_err_probe(dev, PTR_ERR(data->pinctrl), "Cannot get pinctrl\n");
+
+	data->pinctrl_default = pinctrl_lookup_state(data->pinctrl, PINCTRL_STATE_DEFAULT);
+	if (IS_ERR(data->pinctrl_default))
+		return dev_err_probe(dev, PTR_ERR(data->pinctrl_default),
+				"Cannot get default pinctrl state\n");
+
+	data->power = devm_gpiod_get_index(dev, "power", 0, GPIOD_OUT_HIGH);
+	if (IS_ERR(data->power))
+		return dev_err_probe(dev, PTR_ERR(data->power), "Failed to get power gpio\n");
+
+	data->wakeup = devm_gpiod_get_index_optional(dev, "wakeup", 0, GPIOD_OUT_HIGH);
+	if (!data->wakeup)
+		dev_err(dev, "Failed to get wakeup gpio\n");
+
+	data->wake_irq = of_irq_get_byname(dev->of_node, "wakeup");
+	if (data->wake_irq <= 0) {
+		ret = data->wake_irq;
+		dev_err(dev, "Failed to get IRQ number, host will not wake up (ret=%d)\n", ret);
+	}
+
+	if (data->wake_irq > 0) {
+		ret = devm_device_init_wakeup(dev);
+		if (ret)
+			return dev_err_probe(dev, ret, "Failed to initialize device wakeup\n");
+
+		ret = devm_request_threaded_irq(dev, data->wake_irq, NULL,
+						bes2600_btuart_wakeup_handler,
+						IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
+						"bes2600_btwakeup_irq", data);
+		if (ret < 0)
+			return dev_err_probe(dev, ret, "Cannot request IRQ\n");
+
+		ret = devm_pm_set_wake_irq(dev, data->wake_irq);
+		if (ret < 0)
+			return dev_err_probe(dev, ret, "Failed to set wake irq\n");
+	}
+
+	data->err_count = 0;
+
+	hdev = hci_alloc_dev();
+	if (!hdev)
+		return -ENOMEM;
+
+	rwlock_init(&data->lock);
+
+	data->serdev = serdev;
+	data->hdev = hdev;
+
+	serdev_device_set_drvdata(serdev, data);
+	serdev_device_set_client_ops(serdev, &bes2600_btuart_serdev_client_ops);
+
+	bes2600_btuart_parse_dt(serdev);
+
+	INIT_WORK(&data->tx_work, bes2600_btuart_work);
+
+	hdev->bus = HCI_UART;
+	hci_set_drvdata(hdev, data);
+
+	hdev->open = bes2600_btuart_open;
+	hdev->close = bes2600_btuart_close;
+	hdev->flush = bes2600_btuart_flush;
+	hdev->setup = bes2600_btuart_setup;
+	hdev->shutdown = bes2600_btuart_shutdown;
+	hdev->send = bes2600_btuart_send_frame;
+	hdev->manufacturer = 0x02B0;
+
+	SET_HCIDEV_DEV(hdev, &serdev->dev);
+
+	hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY);
+
+	/* Firmware claims to support HCI_OP_LE_READ_BUFFER_SIZE_V2 but broken */
+	hci_set_quirk(hdev, HCI_QUIRK_BROKEN_BUFFER_SIZE_V2);
+
+	/*
+	 * Once shutdown() is ran, it turns off the Bluetooth regulator and
+	 * would not power back on unless setup() is run again.
+	 */
+	hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP);
+
+	ret = hci_register_dev(hdev);
+	if (ret < 0) {
+		hci_free_dev(hdev);
+		return dev_err_probe(dev, ret, "Failed to register HCI device\n");
+	}
+
+	return 0;
+}
+
+static void bes2600_btuart_remove(struct serdev_device *serdev)
+{
+	struct bes2600_btuart_data *data = serdev_device_get_drvdata(serdev);
+	struct hci_dev *hdev = data->hdev;
+
+	cancel_work_sync(&data->tx_work);
+	if (hdev) {
+		hci_unregister_dev(hdev);
+		hci_free_dev(hdev);
+	}
+}
+
+static const struct of_device_id bes2600_btuart_of_match[] = {
+	{ .compatible = "bestechnic,bes2600-btuart", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, bes2600_btuart_of_match);
+
+static struct serdev_device_driver bes2600_btuart_driver = {
+	.probe = bes2600_btuart_probe,
+	.remove = bes2600_btuart_remove,
+	.driver = {
+		.name = "bes2600_btuart",
+		.pm = &bes2600_btuart_pm_ops,
+		.of_match_table = of_match_ptr(bes2600_btuart_of_match),
+	},
+};
+module_serdev_device_driver(bes2600_btuart_driver);
+
+MODULE_AUTHOR("Dang Huynh <dang.huynh@mainlining.org>");
+MODULE_DESCRIPTION("BES2600 BT UART driver");
+MODULE_LICENSE("GPL");
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Factory calibration loader for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/module.h>
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Factory calibration loader interface
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef __FACTORY_H__
 #define __FACTORY_H__
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Platform data for BES2600 SDIO bus
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef BES2600_PLAT_H_INCLUDED
 #define BES2600_PLAT_H_INCLUDED
@@ -1,12 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 SDIO driver for BES2600 device
+ * SDIO bus glue for BES2600 mac80211 driver
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Derived from drivers/net/wireless/st/cw1200/cw1200_sdio.c
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #define DEBUG 1
 #include <linux/version.h>
@@ -73,10 +74,12 @@ struct sbus_priv {
 	int rx_data_toggle;
 #endif
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	spinlock_t rx_queue_lock;
-	struct sk_buff_head rx_queue;
+	/*
+	 * Patch C v3: rx_queue, rx_queue_lock, rx_work removed (no relay).
+	 * The bh thread now reads RX inline; the rx_buffer scratch area
+	 * stays.  Counters/timestamps stay for debugfs visibility.
+	 */
 	u8 *rx_buffer;
-	struct work_struct rx_work;
 	u32 rx_last_ctrl;
 	u32 rx_valid_ctrl;
 	u32 rx_total_ctrl_cnt;
@@ -413,10 +416,19 @@ static void bes2600_sdio_irq_handler(struct sdio_func *func)

 	bes_devel("%s called, fw_started:%d \n",
 			 __func__, self->fw_started);
-	if (likely(self->fw_started && self->core)) {
-		queue_work(self->sdio_wq, &self->rx_work);
+	/*
+	 * Patch C v3: no more sdio_rx_work relay.  Wake the bh thread
+	 * directly via self->irq_handler (bes2600_irq_handler in bh.c
+	 * which bumps bh_rx atomic + wakes bh_wq).  The bh thread will
+	 * then call sbus_ops->bus_rx_batch() to do the SDIO read inline.
+	 * Matches cw1200 mainline IRQ → bh-direct architecture.
+	 */
+	if (likely(self->fw_started && self->core && self->irq_handler)) {
+		spin_lock_irqsave(&self->lock, flags);
+		self->irq_handler(self->irq_priv);
+		spin_unlock_irqrestore(&self->lock, flags);
 		self->last_irq_timestamp = jiffies;
-	} else if(self->irq_handler) {
+	} else if (self->irq_handler) {
 		spin_lock_irqsave(&self->lock, flags);
 		self->irq_handler(self->irq_priv);
 		spin_unlock_irqrestore(&self->lock, flags);
@@ -815,19 +827,11 @@ static int bes2600_sdio_extract_packets(struct sbus_priv *self, u32 ctrl_reg, u8
 		bes_devel("%s, %d,%d\n", __func__, packet_len, pos);
 		self->rx_data_cnt++;
 		/*
-		 * Patch C: deliver SKB directly into the WSM/mac80211 stack
-		 * instead of skb_queue_tail-ing onto self->rx_queue for later
-		 * pickup by the bh thread.  Removes two spinlock acquires
-		 * (rx_queue->lock at queue-tail + at dequeue) per RX frame
-		 * and one bh wait-queue wake-up per IRQ batch.
-		 *
-		 * bes2600_bh_handle_rx_skb owns the SKB on every path.
-		 * Contract: process context, sleepable, caller holds no
-		 * bes2600 spinlock.  See bh.c for the contract block.
-		 *
-		 * Pre-condition satisfied here: bes2600_sdio_unlock(self)
-		 * was called at the bottom of the SDIO read sequence in
-		 * sdio_rx_work, so we hold no bes2600 mutex either.
+		 * Patch C v3: deliver the SKB directly into the WSM/mac80211
+		 * stack from the bh thread.  No rx_queue, no inter-thread
+		 * handoff, no atomic_t needed on the counters that
+		 * wsm_release_tx_buffer touches — single-writer-from-bh is
+		 * preserved by construction.  See bh.c for the contract block.
 		 */
 		bes2600_bh_handle_rx_skb(self->core, skb);
 		packet_len = (packet_len + 3) & (~0x3);
@@ -840,17 +844,31 @@ static int bes2600_sdio_extract_packets(struct sbus_priv *self, u32 ctrl_reg, u8
 	return 0;
 }

-static void sdio_rx_work(struct work_struct *work)
+/*
+ * Patch C v3: bh thread calls this directly via sbus_ops->bus_rx_batch.
+ * No more sdio_rx_work workqueue.  SDIO read sequence (lock →
+ * read_ctrl → memcpy_fromio → packets_check → extract_packets) runs
+ * inline in bh-thread context.  Each parsed SKB is delivered via
+ * bes2600_bh_handle_rx_skb() from extract_packets — no rx_queue, no
+ * second worker, no inter-thread handoff.
+ *
+ * Architecture matches cw1200 mainline.  Single-writer-from-bh
+ * invariant on hw_bufs_used preserved by construction.
+ *
+ * Returns 0 on success (caller's bh outer loop decides whether to
+ * continue), negative on bus read error.  On error: triggers
+ * wifi_force_close (same as the old sdio_rx_work).
+ */
+static int bes2600_sdio_read_rx_batch(struct sbus_priv *self)
 {
-	int ret, again = 0, retry = 0, crc_retry = 0;
+	int ret = 0, again = 0, retry = 0, crc_retry = 0;
 	u32 ctrl_reg = 0;
 	int total_len;
-	struct sbus_priv *self = container_of(work, struct sbus_priv, rx_work);
 	u8 *buf = self->rx_buffer;

 	/* don't read/write sdio when sdio error */
 	if (bes2600_chrdev_is_bus_error())
-		return;
+		return 0;

 	bes2600_gpio_wakeup_mcu(self, GPIO_WAKE_FLAG_SDIO_RX);

@@ -905,6 +923,10 @@ static void sdio_rx_work(struct work_struct *work)
 			goto failed;
 		}

+		/*
+		 * extract_packets parses the multi-RX buffer and calls
+		 * bes2600_bh_handle_rx_skb() per SKB.  No queueing.
+		 */
 		if ((ret = bes2600_sdio_extract_packets(self, ctrl_reg, buf))) {
 			bes_err("%s,%d error=%d\n", __func__, __LINE__, ret);
 			goto failed;
@@ -912,27 +934,16 @@ static void sdio_rx_work(struct work_struct *work)

 		ctrl_reg = 0;

-		/*
-		 * Patch C: with direct delivery in extract_packets, the bh
-		 * thread no longer drives RX consumption — there is no
-		 * rx_queue to drain.  Calling self->irq_handler() here would
-		 * wake the bh thread for nothing on every IRQ batch.  TX
-		 * wakes still flow through bes2600_bh_wakeup() from TX
-		 * submitters and from bes2600_bh_handle_rx_skb when a
-		 * confirm releases a TX buffer; early-boot IRQs (before
-		 * fw_started) still go through self->irq_handler from the
-		 * GPIO IRQ handler's fallback branch.
-		 */
-
 	} while (again);

 	bes2600_gpio_allow_mcu_sleep(self, GPIO_WAKE_FLAG_SDIO_RX);
-	return;
+	return 0;

 failed:
 	bes2600_gpio_allow_mcu_sleep(self, GPIO_WAKE_FLAG_SDIO_RX);
 	bes2600_chrdev_wifi_force_close(self->core, false);
 	WARN_ON(1);
+	return -1;
 }

 static void sdio_scan_work(struct work_struct *work)
@@ -940,26 +951,11 @@ static void sdio_scan_work(struct work_struct *work)
 	bes_warn("%s: this function does nothing\n", __FUNCTION__);
 }

-static void *bes2600_sdio_pipe_read(struct sbus_priv *self)
-{
-	struct sk_buff *skb;
-
-	if (bes2600_chrdev_is_bus_error()) {
-		return bes2600_tx_loop_read(self->core);
-	}
-
-	spin_lock(&self->rx_queue_lock);
-	skb = skb_dequeue(&self->rx_queue);
-	if (skb)
-		self->rx_proc_cnt++;
-	spin_unlock(&self->rx_queue_lock);
-	if (likely(self->fw_started == true &&
-		!bes2600_pwr_device_is_idle(self->core) &&
-		self->core->hw_bufs_used > 0))
-		if (!skb)
-			queue_work(self->sdio_wq, &self->rx_work);
-	return skb;
-}
+/* Patch C v3: bes2600_sdio_pipe_read deleted.  bh thread reads the
+ * SDIO bus inline via bes2600_sdio_read_rx_batch (sbus_ops->bus_rx_batch).
+ * No rx_queue, no skb_dequeue, no relay.  bes2600_tx_loop_read remains
+ * for the test bus error-fallback path but is now invoked at higher
+ * level. */

 #endif

@@ -1215,7 +1211,14 @@ flush_previous:
 				}
 			} while (crc_retry <= 10);
 			sdio_release_host(self->func);
-			queue_work(self->sdio_wq, &self->rx_work);
+			/*
+			 * Patch C v3: wake the bh thread to check for any RX
+			 * that piggybacked on this TX window.  Bumps bh_rx
+			 * atomic; bh's wait_event will pick it up and call
+			 * sbus_ops->bus_rx_batch().
+			 */
+			if (likely(self->irq_handler))
+				self->irq_handler(self->irq_priv);
 			if (ret) {
 				bes_err("%s,%d err=%d,%d,%d\n", __func__, __LINE__, ret, scatters, cur_blk);
 				sdio_work_debug(self);
@@ -1266,12 +1269,11 @@ static int bes2600_sdio_misc_init(struct sbus_priv *self, struct bes2600_common
 	self->next_toggle = 0;
 #endif
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	spin_lock_init(&self->rx_queue_lock);
-	skb_queue_head_init(&self->rx_queue);
+	/* Patch C v3: rx_queue / rx_queue_lock removed (no relay). */
 	self->rx_buffer = (u8 *)__get_dma_pages(GFP_KERNEL, get_order(1632 * BES_SDIO_RX_MULTIPLE_NUM));
 	if (!self->rx_buffer)
 		return -ENOMEM;
-	INIT_WORK(&self->rx_work, sdio_rx_work);
+	/* Patch C v3: sdio_rx_work removed; bh thread does the read. */
 #endif
 #ifdef BES_SDIO_TX_MULTIPLE_ENABLE
 	INIT_LIST_HEAD(&self->tx_bufferlist);
@@ -1600,22 +1602,15 @@ err:

 static void bes2600_sdio_empty_work(struct sbus_priv *self)
 {
-#ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	struct sk_buff *skb;
-#endif
 #ifdef BES_SDIO_TX_MULTIPLE_ENABLE
 	struct bes_sdio_tx_list_t *tx_buffer, *temp;
 #endif

 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	cancel_work_sync(&self->rx_work);
-	while (1) {
-		skb = skb_dequeue(&self->rx_queue);
-		if (skb)
-			dev_kfree_skb(skb);
-		else
-			break;
-	}
+	/*
+	 * Patch C v3: rx_work and rx_queue removed.  Counters still
+	 * reset for the next attach cycle.
+	 */
 	self->rx_last_ctrl = 0;
 	self->rx_total_ctrl_cnt = 0;
 	self->rx_continuous_ctrl_cnt = 0;
@@ -1883,7 +1878,8 @@ static struct sbus_ops bes2600_sdio_sbus_ops = {
 	.sbus_reg_write		= bes2600_sdio_reg_write,
 	.init			= bes2600_sdio_misc_init,
 #ifdef BES_SDIO_RX_MULTIPLE_ENABLE
-	.pipe_read		= bes2600_sdio_pipe_read,
+	/* Patch C v3: .pipe_read removed; bus_rx_batch replaces it. */
+	.bus_rx_batch		= bes2600_sdio_read_rx_batch,
 #endif
 #ifdef BES_SDIO_TX_MULTIPLE_ENABLE
 	.pipe_send		= bes2600_sdio_pipe_send,
@@ -1903,9 +1899,15 @@ static void bes2600_sdio_en_lp_cb(struct bes2600_common *hw_priv)
 	long unsigned int old_ts, new_ts;
 	struct sbus_priv *self = hw_priv->sbus_priv;

+	/*
+	 * Patch C v3: rx_work removed.  Wait for IRQ-timestamp activity
+	 * to settle by polling self->last_irq_timestamp via msleep
+	 * (best-effort).  The caller already knows the bh thread will
+	 * process pending bh_rx during its next wait_event round.
+	 */
 	do {
 		old_ts = self->last_irq_timestamp;
-		flush_work(&self->rx_work);
+		msleep(2);
 		new_ts = self->last_irq_timestamp;
 	} while(old_ts != new_ts);
 }
@@ -1995,7 +1997,6 @@ static int bes2600_sdio_probe(struct sdio_func *func,

 out:
 	bes2600_chrdev_set_sbus_priv_data(self, false);
-	bes2600_switch_bt(true);
 	bes2600_gpio_allow_mcu_sleep(self, GPIO_WAKE_FLAG_SDIO_PROBE);
 	return 0;

@@ -2030,8 +2031,8 @@ int bes2600_unregister_net_dev(struct sbus_priv *bus_priv)
 	BUG_ON(!bus_priv);
 	if (bus_priv->core && !bus_priv->unregister_in_process) {
 		bus_priv->unregister_in_process = true;
-		bes2600_core_release(bus_priv->core);
 		bes2600_pwr_unregister_en_lp_cb(bus_priv->core, bes2600_sdio_en_lp_cb);
+		bes2600_core_release(bus_priv->core);
 		bus_priv->core = NULL;

 		if (bus_priv->sdio_wq) {
@@ -2263,8 +2264,12 @@ static int bes2600_sdio_suspend_noirq(struct device *dev)
 	if (func->num > 1)
 		return 0;

-	if(self->core &&
-	   (work_pending(&self->rx_work) || atomic_read(&self->core->bh_rx))) {
+	/*
+	 * Patch C v3: work_pending(&self->rx_work) check dropped (no
+	 * relay).  bh_rx atomic alone tells us whether the bh thread
+	 * has un-processed RX events queued.
+	 */
+	if (self->core && atomic_read(&self->core->bh_rx)) {
 		bes_devel("%s: Suspend interrupted.\n", __func__);
 		return -EAGAIN;
 	}
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Character device for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include<linux/module.h>
 #include <linux/init.h>
@@ -184,7 +181,7 @@ static int bes2600_switch_wifi(bool on)
 	return ret;
 }

-int bes2600_switch_bt(bool on)
+static int bes2600_switch_bt(bool on)
 {
 	int ret = 0;
 	long status = 0;
@@ -237,6 +234,36 @@ int bes2600_switch_bt(bool on)
 	return ret;
 }

+/*
+ * Re-added for danctnix's bes2600_btuart.c (a danctnix-only file) which
+ * relies on the chardev utility API for BT power switching and bus-error
+ * checks. The userspace /dev/bes2600 chardev itself is removed by the
+ * remove-chardev-user-interface series; these in-kernel helpers stay.
+ *
+ * @wifi: 1 to turn on, 0 to turn off. Otherwise, leave unchanged
+ * @bt:   1 to turn on, 0 to turn off. Otherwise, leave unchanged
+ */
+int bes2600_chrdev_switch_subsys_glb(int wifi, int bt)
+{
+	int ret = 0;
+
+	switch (wifi) {
+	case 0: ret = bes2600_switch_wifi(false); break;
+	case 1: ret = bes2600_switch_wifi(true);  break;
+	default: break;
+	}
+	if (ret)
+		return ret;
+
+	switch (bt) {
+	case 0: ret = bes2600_switch_bt(false); break;
+	case 1: ret = bes2600_switch_bt(true);  break;
+	default: break;
+	}
+	return ret;
+}
+EXPORT_SYMBOL_GPL(bes2600_chrdev_switch_subsys_glb);
+



@@ -565,6 +592,7 @@ bool bes2600_chrdev_is_bus_error(void)

 	return error;
 }
+EXPORT_SYMBOL_GPL(bes2600_chrdev_is_bus_error);

 void bes2600_chrdev_update_signal_mode(void)
 {
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Character device interface for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef __BES_CHARDEV_H__
 #define __BES_CHARDEV_H__
@@ -65,6 +62,7 @@ int bes2600_chrdev_trigger_bus_reset(void);
 void bes2600_chrdev_wakeup_bt(void);
 void bes2600_chrdev_wifi_force_close(struct bes2600_common *hw_priv, bool halt_dev);
 void bes2600_chrdev_usb_remove(struct bes2600_common *hw_priv);
+int bes2600_chrdev_switch_subsys_glb(int wifi, int bt);

 /* get and set internal state */
 bool bes2600_chrdev_is_wifi_opened(void);
@@ -93,6 +91,4 @@ u8* bes2600_alloc_dpd_log_buffer(u16 len);
 void bes2600_get_dpd_log(char **data, size_t *len);
 #endif

-int bes2600_switch_bt(bool);
-
 #endif /* __BES_CHARDEV_H__ */
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Firmware download for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include "bes_fw_common.h"
 #include "bes2600.h"
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Firmware download common code for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include "bes_fw_common.h"
 #include "bes_log.h"
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Firmware download common interface
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef __BES_FW_COMMON_H__
 #define __BES_FW_COMMON_H__
@@ -1,3 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * printk wrappers for BES2600
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ *
+ */
 extern struct device *global_dev;

 #ifdef CONFIG_BES2600_ENABLE_DEVEL_LOGS
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Vendor testmode messages for BES2600
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES_NL80211_TESTMODE_MSG_H
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Chip-side power state machine for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include <linux/list.h>
 #include <linux/pm.h>
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Chip-side power state machine interface
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef __BES_PWR_H__
 #define __BES_PWR_H__
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Bottom-half thread for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include <net/mac80211.h>
 #include <linux/kthread.h>
@@ -22,6 +22,7 @@
 #include "debug.h"
 #include "epta_coex.h"
 #include "bes_chardev.h"
+#include "txrx_opt.h"
 #include "sta.h"
 #include "bes_log.h"

@@ -101,7 +102,7 @@ void bes2600_unregister_bh(struct bes2600_common *hw_priv)
 	coex_deinit_mode(hw_priv);
 #endif

-	atomic_add(1, &hw_priv->bh_term);
+	atomic_inc(&hw_priv->bh_term);
 	wake_up(&hw_priv->bh_wq);

 	flush_workqueue(hw_priv->bh_workqueue);
@@ -590,7 +591,7 @@ static int bes2600_bh(void *arg)
 			bes_devel("[BH] Device resume.\n");
 			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
 			wake_up(&hw_priv->bh_evt_wq);
-			atomic_add(1, &hw_priv->bh_rx);
+			atomic_inc(&hw_priv->bh_rx);
 			continue;
 		}

@@ -758,9 +759,9 @@ tx:

 #if 0 /* count is not implemented */
 				if (ret > 1)
-					atomic_add(1, &hw_priv->bh_tx);
+					atomic_inc(&hw_priv->bh_tx);
 #else
-				atomic_add(1, &hw_priv->bh_tx);
+				atomic_inc(&hw_priv->bh_tx);
 #endif

 #if defined(CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES)
@@ -961,28 +962,26 @@ static void bes2600_bh_parse_wakeup_event(struct bes2600_common *hw_priv, struct
 /*
 * Direct-deliver an RX SKB into the WSM/mac80211 stack.
 *
- * Patch C (sdio_rx_work direct delivery): this function does the
- * per-SKB bookkeeping (sequence-number check, exception handling,
- * tx-confirm accounting, mac80211 hand-off via wsm_handle_rx) that
- * previously ran inside bes2600_bh_rx_helper after pipe_read dequeued
- * an SKB from sbus_priv->rx_queue.  It is now called inline from
- * bes2600_sdio_extract_packets, eliminating the queue + bh-wakeup
- * relay (one wait-queue wake-up + two rx_queue->lock acquires per
- * RX frame).
+ * Patch C v3 (no-relay architecture, matches cw1200): the bh thread
+ * calls bes2600_sdio_read_rx_batch which calls
+ * bes2600_sdio_extract_packets which calls THIS function per parsed
+ * SKB.  No rx_queue, no sdio_rx_work, no inter-thread handoff.
+ *
+ * Single-writer-from-bh invariant on hw_priv->hw_bufs_used,
+ * hw_priv->hw_bufs_used_vif[] and hw_priv->wsm_tx_pending[] is
+ * preserved BY CONSTRUCTION — there is now only one writer (the bh
+ * thread itself), same as cw1200's design.  No atomic_t conversion
+ * needed.
 *
 * Contract:
- *   - process context, sleepable.  wsm_handle_rx (wsm.c:2211, exported
- *     at wsm.c:2463) acquires wsm_cmd.lock, may call into mac80211
- *     and may sleep on wait_event_timeout (wsm.c:2036, 2091).
- *   - caller MUST hold no bes2600 spinlock.  Reference precedent:
- *     bes2600_bh_rx_helper (this file) called from the bh thread.
- *     The SDIO mutex is released at bes2600_sdio.c before
- *     extract_packets is called, so this is satisfied.
- *   - SKB ownership: function frees on every path (success and error).
- *   - Returns 0 on success, negative on error.  When the SKB carries
- *     a confirm that releases a TX buffer, the function asynchronously
- *     wakes the bh thread to drain TX (matches the in-bh tx=1
- *     signaling that bh_rx_helper used).
+ *   - process context, sleepable.  wsm_handle_rx (wsm.c, EXPORT_SYMBOL)
+ *     acquires wsm_cmd.lock and may sleep on wait_event_timeout.
+ *   - caller holds no bes2600 spinlock.  bes2600_sdio_unlock(self) is
+ *     called inside read_rx_batch before extract_packets is invoked.
+ *   - SKB ownership: function frees on every path (success + error).
+ *   - No need to wake the bh thread on TX-confirm — we ARE the bh
+ *     thread; tx_burst is signalled by returning *tx_out = 1 to the
+ *     caller (bh_rx_helper), which propagates it to bh's outer loop.
 */
 int bes2600_bh_handle_rx_skb(struct bes2600_common *priv, struct sk_buff *skb)
 {
@@ -1060,8 +1059,14 @@ int bes2600_bh_handle_rx_skb(struct bes2600_common *priv, struct sk_buff *skb)
 	if (skb)
 		dev_kfree_skb(skb);

+	/*
+	 * Signal "tx side has new headroom" via atomic so the bh outer
+	 * loop's wait_event predicate notices on its next wait.  No
+	 * cross-thread wake needed because we are the bh thread; the
+	 * outer loop will pick this up after read_rx_batch returns.
+	 */
 	if (tx)
-		bes2600_bh_wakeup(priv);
+		atomic_inc(&priv->bh_tx);

 	return 0;
 }
@@ -1078,10 +1083,18 @@ static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
 	u32 confirm_label = 0x0; /* wsm to mcu cmd cnfirm label */

 #if defined(BES_SDIO_RX_MULTIPLE_ENABLE)
-	skb = (struct sk_buff *)priv->sbus_ops->pipe_read(priv->sbus_priv);
-	if (!skb)
-		return 0;
-	rx = 1; // always consider rx pipe not empty
+	/*
+	 * Patch C v3: the bh thread does the SDIO read inline via
+	 * sbus_ops->bus_rx_batch.  bes2600_sdio_read_rx_batch reads the
+	 * multi-RX coalesced frames out of the chip and delivers each
+	 * one inline via bes2600_bh_handle_rx_skb (no rx_queue, no
+	 * pipe_read, no inter-thread handoff).  Return value: 0 on
+	 * success (bh outer loop will check whether to continue),
+	 * negative on read error.
+	 */
+	if (priv->sbus_ops->bus_rx_batch)
+		return priv->sbus_ops->bus_rx_batch(priv->sbus_priv);
+	return 0;
 #else
 	u32 ctrl_reg = 0;
 	size_t read_len = 0;
@@ -1243,7 +1256,7 @@ static int bes2600_bh_tx_helper(struct bes2600_common *hw_priv,
 	tx_len += 4;
 #endif

-	atomic_add(1, &hw_priv->bh_tx);
+	atomic_inc(&hw_priv->bh_tx);

 	tx_len = hw_priv->sbus_ops->align_size(
 		hw_priv->sbus_priv, tx_len);
@@ -1368,6 +1381,8 @@ int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
 		delta_time = jiffies + ((unsigned long)0xffffffff - timestamp);
 	else
 		delta_time =  jiffies - timestamp;
+	bes2600_add_tx_delta_time(delta_time);
+	bes2600_add_tx_ac_delta_time(queue_id, delta_time);

 	if (bes2600_need_retry_type(skb, tx_confirm->status) == 0)
 		return -1;
@@ -1376,8 +1391,12 @@ int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
 		return -1;

 	if (txpriv->retry_count < CW1200_MAX_SW_RETRY_CNT ) {
+		struct bes2600_vif *priv =
+		__cw12xx_hwpriv_to_vifpriv(hw_priv, txpriv->if_id);
 		txpriv->retry_count++;

+		bes2600_tx_status(priv,skb);
+
 		bes2600_pwr_set_busy_event_with_timeout_async(
 			hw_priv, BES_PWR_LOCK_ON_TX, BES_PWR_EVENT_TX_TIMEOUT);

@@ -1413,14 +1432,14 @@ void bes2600_bh_dec_pending_count(struct bes2600_common *hw_priv, int idx)
 	}

 	if (--hw_priv->wsm_tx_pending[idx] == 0)
-		del_timer_sync(timer);
+		timer_delete_sync(timer);
 	else
 		mod_timer(timer, jiffies + 3 * HZ);
 }

 void bes2600_bh_mcu_active_monitor(struct timer_list* t)
 {
-	struct bes2600_common *hw_priv = from_timer(hw_priv, t, mcu_mon_timer);
+	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, mcu_mon_timer);

 	bes_err("link break between mcu and host, hw_buf_used:%d pending:%d\n", 
 				hw_priv->hw_bufs_used, hw_priv->wsm_tx_pending[1]);
@@ -1429,7 +1448,7 @@ void bes2600_bh_mcu_active_monitor(struct timer_list* t)

 void bes2600_bh_lmac_active_monitor(struct timer_list* t)
 {
-	struct bes2600_common *hw_priv = from_timer(hw_priv, t, lmac_mon_timer);
+	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, lmac_mon_timer);

 	bes_err("link break between lmac and host, hw_buf_used:%d pending:%d\n", 
 				hw_priv->hw_bufs_used, hw_priv->wsm_tx_pending[0]);
@@ -1544,7 +1563,7 @@ static int bes2600_bh(void *arg)
 			bes_devel("[BH] Device resume.\n");
 			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
 			wake_up(&hw_priv->bh_evt_wq);
-			atomic_add(1, &hw_priv->bh_rx);
+			atomic_inc(&hw_priv->bh_rx);
 			goto done;
 		}

@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Device handling thread interface for mac80211 BES2600 drivers
+ * Bottom-half thread interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_BH_H
@@ -36,15 +36,17 @@ void bes2600_enable_powersave(struct bes2600_vif *priv,
 int wsm_release_tx_buffer(struct bes2600_common *hw_priv, int count);
 int wsm_release_vif_tx_buffer(struct bes2600_common *hw_priv, int if_id,
 				int count);
+int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
+			 struct wsm_tx_confirm *tx_confirm);
+
 /*
- * Direct-deliver an RX SKB into the WSM/mac80211 stack.
+ * Direct-deliver an RX SKB into the WSM/mac80211 stack from the bh thread.
+ * Called by bes2600_sdio_extract_packets per RX frame, no queueing.
 * Process context, sleepable, caller holds no bes2600 spinlock.
 * Function frees skb on every path. See bh.c for full contract.
 */
 int bes2600_bh_handle_rx_skb(struct bes2600_common *hw_priv,
 			     struct sk_buff *skb);
-int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
-			 struct wsm_tx_confirm *tx_confirm);

 void bes2600_bh_inc_pending_count(struct bes2600_common *hw_priv, int idx);
 void bes2600_bh_dec_pending_count(struct bes2600_common *hw_priv, int idx);
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Debugging interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/module.h>
@@ -110,17 +110,20 @@ static int bes2600_status_show_common(struct seq_file *seq, void *v)
 	int ba_cnt, ba_acc, ba_cnt_rx, ba_acc_rx, ba_avg = 0, ba_avg_rx = 0;
 	bool ba_ena;

-	spin_lock_bh(&hw_priv->ba_lock);
-	ba_cnt = hw_priv->debug->ba_cnt;
-	ba_acc = hw_priv->debug->ba_acc;
+	/*
+	 * Patch D: ba_lock removed.  hw_priv->debug->ba_* are written only
+	 * by the timer callback (single writer); reading without a lock is
+	 * fine for stats.  ba_ena is atomic_t.
+	 */
+	ba_cnt    = hw_priv->debug->ba_cnt;
+	ba_acc    = hw_priv->debug->ba_acc;
 	ba_cnt_rx = hw_priv->debug->ba_cnt_rx;
 	ba_acc_rx = hw_priv->debug->ba_acc_rx;
-	ba_ena = hw_priv->ba_ena;
+	ba_ena    = !!atomic_read(&hw_priv->ba_ena);
 	if (ba_cnt)
 		ba_avg = ba_acc / ba_cnt;
 	if (ba_cnt_rx)
 		ba_avg_rx = ba_acc_rx / ba_cnt_rx;
-	spin_unlock_bh(&hw_priv->ba_lock);

 	seq_puts(seq,   "BES2600 Wireless LAN driver status\n");
 	seq_printf(seq, "Hardware:   %d.%d\n",
@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * DebugFS code for BES2600 mac80211 driver
+ * Debugging interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2011, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_DEBUG_H_INCLUDED
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * BT/WiFi coexistence (ePTA) for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include <linux/types.h>
 #include <linux/version.h>
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * BT/WiFi coexistence interface for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef __EPTA_COEX_H__
 #define __EPTA_COEX_H__
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * BT/WiFi coexistence request handling
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * BT/WiFi coexistence request interface
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef EPTA_REQUEST_H
 #define EPTA_REQUEST_H
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Firmware I/O for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/init.h>
@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Firmware I/O interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef FWIO_H_INCLUDED
 #define FWIO_H_INCLUDED
@@ -0,0 +1,154 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *  Copy of drivers/bluetooth/h4_recv.h
+ *
+ *  Generic Bluetooth HCI UART driver
+ *
+ *  Copyright (C) 2015-2018  Intel Corporation
+ */
+
+#include <linux/unaligned.h>
+
+struct h4_recv_pkt {
+	u8  type;	/* Packet type */
+	u8  hlen;	/* Header length */
+	u8  loff;	/* Data length offset in header */
+	u8  lsize;	/* Data length field size */
+	u16 maxlen;	/* Max overall packet length */
+	int (*recv)(struct hci_dev *hdev, struct sk_buff *skb);
+};
+
+#define H4_RECV_ACL \
+	.type = HCI_ACLDATA_PKT, \
+	.hlen = HCI_ACL_HDR_SIZE, \
+	.loff = 2, \
+	.lsize = 2, \
+	.maxlen = HCI_MAX_FRAME_SIZE \
+
+#define H4_RECV_SCO \
+	.type = HCI_SCODATA_PKT, \
+	.hlen = HCI_SCO_HDR_SIZE, \
+	.loff = 2, \
+	.lsize = 1, \
+	.maxlen = HCI_MAX_SCO_SIZE
+
+#define H4_RECV_EVENT \
+	.type = HCI_EVENT_PKT, \
+	.hlen = HCI_EVENT_HDR_SIZE, \
+	.loff = 1, \
+	.lsize = 1, \
+	.maxlen = HCI_MAX_EVENT_SIZE
+
+#define H4_RECV_ISO \
+	.type = HCI_ISODATA_PKT, \
+	.hlen = HCI_ISO_HDR_SIZE, \
+	.loff = 2, \
+	.lsize = 2, \
+	.maxlen = HCI_MAX_FRAME_SIZE
+
+static inline struct sk_buff *h4_recv_buf(struct hci_dev *hdev,
+					  struct sk_buff *skb,
+					  const unsigned char *buffer,
+					  int count,
+					  const struct h4_recv_pkt *pkts,
+					  int pkts_count)
+{
+	/* Check for error from previous call */
+	if (IS_ERR(skb))
+		skb = NULL;
+
+	while (count) {
+		int i, len;
+
+		if (!skb) {
+			for (i = 0; i < pkts_count; i++) {
+				if (buffer[0] != (&pkts[i])->type)
+					continue;
+
+				skb = bt_skb_alloc((&pkts[i])->maxlen,
+						   GFP_ATOMIC);
+				if (!skb)
+					return ERR_PTR(-ENOMEM);
+
+				hci_skb_pkt_type(skb) = (&pkts[i])->type;
+				hci_skb_expect(skb) = (&pkts[i])->hlen;
+				break;
+			}
+
+			/* Check for invalid packet type */
+			if (!skb)
+				return ERR_PTR(-EILSEQ);
+
+			count -= 1;
+			buffer += 1;
+		}
+
+		len = min_t(uint, hci_skb_expect(skb) - skb->len, count);
+		skb_put_data(skb, buffer, len);
+
+		count -= len;
+		buffer += len;
+
+		/* Check for partial packet */
+		if (skb->len < hci_skb_expect(skb))
+			continue;
+
+		for (i = 0; i < pkts_count; i++) {
+			if (hci_skb_pkt_type(skb) == (&pkts[i])->type)
+				break;
+		}
+
+		if (i >= pkts_count) {
+			kfree_skb(skb);
+			return ERR_PTR(-EILSEQ);
+		}
+
+		if (skb->len == (&pkts[i])->hlen) {
+			u16 dlen;
+
+			switch ((&pkts[i])->lsize) {
+			case 0:
+				/* No variable data length */
+				dlen = 0;
+				break;
+			case 1:
+				/* Single octet variable length */
+				dlen = skb->data[(&pkts[i])->loff];
+				hci_skb_expect(skb) += dlen;
+
+				if (skb_tailroom(skb) < dlen) {
+					kfree_skb(skb);
+					return ERR_PTR(-EMSGSIZE);
+				}
+				break;
+			case 2:
+				/* Double octet variable length */
+				dlen = get_unaligned_le16(skb->data +
+							  (&pkts[i])->loff);
+				hci_skb_expect(skb) += dlen;
+
+				if (skb_tailroom(skb) < dlen) {
+					kfree_skb(skb);
+					return ERR_PTR(-EMSGSIZE);
+				}
+				break;
+			default:
+				/* Unsupported variable length */
+				kfree_skb(skb);
+				return ERR_PTR(-EILSEQ);
+			}
+
+			if (!dlen) {
+				/* No more data, complete frame */
+				(&pkts[i])->recv(hdev, skb);
+				skb = NULL;
+			}
+		} else {
+			/* Complete frame */
+			(&pkts[i])->recv(hdev, skb);
+			skb = NULL;
+		}
+	}
+
+	return skb;
+}
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- *  HT-related code for BES2600 driver
+ * HT capability config for BES2600
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_HT_H_INCLUDED
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Low-level device IO routines for BES2600 drivers
+ * Low-level device I/O for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/types.h>
@@ -1,17 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Low-level API for mac80211 BES2600 drivers
+ * Low-level device I/O interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
 *
- * Based on:
- * UMAC BES2600 driver which is
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_HWIO_H_INCLUDED
@@ -1,13 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * mac80211 glue code for mac80211 BES2600 drivers
- * ITP code
+ * ITP (in-band test mode) for BES2600
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/module.h>
@@ -570,7 +566,7 @@ int bes2600_itp_get_tx(struct bes2600_common *priv, u8 **data,
 	*burst = 2;
 	atomic_set(&priv->bh_tx, 1);
 	ktime_get_ts(&itp->last_sent);
-	atomic_add(1, &itp->awaiting_confirm);
+	atomic_inc(&itp->awaiting_confirm);
 	spin_unlock_bh(&itp->tx_lock);
 	return 1;

@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * ITP code for BES2600 mac80211 driver
+ * ITP interface for BES2600
 *
- * Copyright (c) 2011, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_ITP_H_INCLUDED
@@ -1,12 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Main entry/init for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ *
+ * Based on the mac80211 Prism54 code, which is
+ * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
+ *
+ * Based on the islsm (softmac prism54) driver, which is
+ * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/module.h>
@@ -32,6 +38,7 @@
 #include "pm.h"
 #include "bes2600_factory.h"
 #include "bes_chardev.h"
+#include "txrx_opt.h"

 MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>");
 MODULE_DESCRIPTION("Softmac BES2600 common code");
@@ -198,7 +205,11 @@ static const struct ieee80211_iface_limit bes2600_if_limits[] = {
 			     BIT(NL80211_IFTYPE_P2P_CLIENT) |
 			     BIT(NL80211_IFTYPE_P2P_GO) },
 #ifdef P2P_MULTIVIF
-	{ .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
+	/*
+	 * HACK: Disable P2P_DEVICE implementation for BES2600
+	 *       as the code is a little buggy.
+	 */
+	//{ .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
 #endif
 };

@@ -490,13 +501,14 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
 	INIT_LIST_HEAD(&hw_priv->event_queue);
 	INIT_WORK(&hw_priv->event_handler, bes2600_event_handler);
 	INIT_WORK(&hw_priv->ba_work, bes2600_ba_work);
-	spin_lock_init(&hw_priv->ba_lock);
+	/* Patch D: ba_lock removed; ba_acc/ba_cnt/etc are atomic_t. */
 	timer_setup(&hw_priv->ba_timer, bes2600_ba_timer, 0);

 	if (unlikely(bes2600_queue_stats_init(&hw_priv->tx_queue_stats,
 			WLAN_LINK_ID_MAX,
 			bes2600_skb_dtor,
 			hw_priv))) {
+		destroy_workqueue(hw_priv->workqueue);
 		ieee80211_free_hw(hw);
 		return NULL;
 	}
@@ -508,6 +520,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
 			for (; i > 0; i--)
 				bes2600_queue_deinit(&hw_priv->tx_queue[i - 1]);
 			bes2600_queue_stats_deinit(&hw_priv->tx_queue_stats);
+			destroy_workqueue(hw_priv->workqueue);
 			ieee80211_free_hw(hw);
 			return NULL;
 		}
@@ -595,7 +608,7 @@ static void bes2600_unregister_common(struct ieee80211_hw *dev)

 	ieee80211_unregister_hw(dev);

-	del_timer_sync(&hw_priv->ba_timer);
+	timer_delete_sync(&hw_priv->ba_timer);

 	hw_priv->sbus_ops->irq_unsubscribe(hw_priv->sbus_priv);
 	bes2600_unregister_bh(hw_priv);
@@ -863,8 +876,8 @@ int bes2600_wifi_stop(struct bes2600_common *hw_priv)
 	hw_priv->wsm_tx_seq[1] = 0;
 	hw_priv->wsm_tx_pending[0] = 0;
 	hw_priv->wsm_tx_pending[1] = 0;
-	del_timer_sync(&hw_priv->mcu_mon_timer);
-	del_timer_sync(&hw_priv->lmac_mon_timer);
+	timer_delete_sync(&hw_priv->mcu_mon_timer);
+	timer_delete_sync(&hw_priv->lmac_mon_timer);
 #ifdef CONFIG_BES2600_STATIC_SDD
 	hw_priv->sdd = NULL;
 #else
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 power management API for BES2600 drivers
+ * Power management for BES2600 mac80211 driver
 *
- * Copyright (c) 2011, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/platform_device.h>
@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 power management interface for BES2600 mac80211 drivers
+ * Power management interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2011, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef PM_H_INCLUDED
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * O(1) TX queue with built-in allocator for BES2600 drivers
+ * O(1) TX queue for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <net/mac80211.h>
@@ -119,10 +119,9 @@ static void bes2600_queue_register_post_gc(struct list_head *gc_list,
 				     struct bes2600_queue_item *item)
 {
 	struct bes2600_queue_item *gc_item;
-	gc_item = kmalloc(sizeof(struct bes2600_queue_item),
+	gc_item = kmemdup(item, sizeof(struct bes2600_queue_item),
 			GFP_ATOMIC);
 	BUG_ON(!gc_item);
-	memcpy(gc_item, item, sizeof(struct bes2600_queue_item));
 	list_add_tail(&gc_item->head, gc_list);
 }

@@ -131,9 +130,9 @@ static void bes2600_queue_pending_record(struct list_head *pending_record_list,
 {
 	struct bes2600_queue_item *record_item;

-	record_item = kmalloc(sizeof(struct bes2600_queue_item),GFP_ATOMIC);
+	record_item = kmemdup(pending_item, sizeof(struct bes2600_queue_item),
+			GFP_ATOMIC);
 	BUG_ON(!record_item);
-	memcpy(record_item, pending_item, sizeof(struct bes2600_queue_item));
 	record_item->skb = skb_clone(pending_item->skb, GFP_ATOMIC);
 	list_add_tail(&record_item->head, pending_record_list);
 }
@@ -196,7 +195,7 @@ static void __bes2600_queue_gc(struct bes2600_queue *queue,
 static void bes2600_queue_gc(struct timer_list *t)
 {
 	LIST_HEAD(list);
-	struct bes2600_queue *queue = from_timer(queue, t, gc);
+	struct bes2600_queue *queue = timer_container_of(queue, t, gc);

 	spin_lock_bh(&queue->lock);
 	__bes2600_queue_gc(queue, &list, true);
@@ -218,7 +217,7 @@ int bes2600_queue_stats_init(struct bes2600_queue_stats *stats,
 	spin_lock_init(&stats->lock);
 	init_waitqueue_head(&stats->wait_link_id_empty);
 	for (i = 0; i < CW12XX_MAX_VIFS; i++) {
-		stats->link_map_cache[i] = kzalloc(map_capacity * sizeof(int),
+		stats->link_map_cache[i] = kcalloc(map_capacity, sizeof(int),
 			GFP_KERNEL);
 		if (!stats->link_map_cache[i]) {
 			for (; i >= 0; i--)
@@ -249,14 +248,14 @@ int bes2600_queue_init(struct bes2600_queue *queue,
 	queue->queue_all_lock = false;
 	spin_lock_init(&queue->lock);
 	timer_setup(&queue->gc, bes2600_queue_gc, 0);
-	queue->pool = kzalloc(sizeof(struct bes2600_queue_item) * capacity,
+	queue->pool = kcalloc(capacity, sizeof(struct bes2600_queue_item),
 			GFP_KERNEL);
 	if (!queue->pool)
 		return -ENOMEM;

 	for (i = 0; i < CW12XX_MAX_VIFS; i++) {
 		queue->link_map_cache[i] =
-				kzalloc(stats->map_capacity * sizeof(int),
+				kcalloc(stats->map_capacity, sizeof(int),
 			GFP_KERNEL);
 		if (!queue->link_map_cache[i]) {
 			for (; i >= 0; i--)
@@ -363,7 +362,7 @@ void bes2600_queue_deinit(struct bes2600_queue *queue)
 	int i;

 	bes2600_queue_clear(queue, CW12XX_ALL_IFS);
-	del_timer_sync(&queue->gc);
+	timer_delete_sync(&queue->gc);
 	INIT_LIST_HEAD(&queue->free_pool);
 	kfree(queue->pool);
 	for (i = 0; i < CW12XX_MAX_VIFS; i++) {
@@ -410,7 +409,6 @@ int bes2600_queue_put(struct bes2600_queue *queue,
 	struct timespec64 tmval;
 #endif /*CONFIG_BES2600_TESTMODE*/

-	LIST_HEAD(gc_list);
 	struct bes2600_queue_stats *stats = queue->stats;
 	/* TODO:COMBO: Add interface ID info to queue item */

@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * O(1) TX queue with built-in allocator for BES2600 drivers
+ * O(1) TX queue interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_QUEUE_H_INCLUDED
@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Common sbus abstraction layer interface for bes2600 wireless driver
+ * Bus abstraction interface for BES2600
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
+ * Replaces hwbus.h from drivers/net/wireless/st/cw1200/
+ * Copyright (c) 2010, ST-Ericsson
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_SBUS_H
@@ -83,6 +83,14 @@ struct sbus_ops {
 	 * Returns 0 on success or a negative errno.
 	 */
 	int (*bus_reset)(struct sbus_priv *self);
+	/*
+	 * Read a batch of RX frames inline from the bus and deliver each
+	 * one via bes2600_bh_handle_rx_skb().  Called from the bh thread
+	 * (process context, sleepable).  Replaces the
+	 * sdio_rx_work + rx_queue + pipe_read relay (Patch C v3, 2026).
+	 * Returns 0 on success, negative on read error.
+	 */
+	int (*bus_rx_batch)(struct sbus_priv *self);
 };

 void bes2600_irq_handler(struct bes2600_common *priv);
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Scan implementation for BES2600 mac80211 drivers
+ * Scan implementation for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/sched.h>
@@ -257,18 +257,21 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,

 	bes2600_pwr_set_busy_event(hw_priv, BES_PWR_LOCK_ON_SCAN);

-	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
-		req->ie_len);
-	if (!frame.skb)
-		return -ENOMEM;
-
-	if (req->ie_len)
-		skb_put_data(frame.skb, req->ie, req->ie_len);
-
 	/* will be unlocked in bes2600_scan_work() */
 	down(&hw_priv->scan.lock);
 	down(&hw_priv->conf_lock);

+	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
+		req->ie_len);
+	if (!frame.skb) {
+		up(&hw_priv->conf_lock);
+		up(&hw_priv->scan.lock);
+		return -ENOMEM;
+	}
+
+	if (req->ie_len)
+		skb_put_data(frame.skb, req->ie, req->ie_len);
+
 	if (frame.skb) {
 		int ret;
 		//if (priv->if_id == 0)
@@ -286,9 +289,9 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
 		}
 #endif
 		if (ret) {
+			dev_kfree_skb(frame.skb);
 			up(&hw_priv->conf_lock);
 			up(&hw_priv->scan.lock);
-			dev_kfree_skb(frame.skb);
 			return ret;
 		}
 	}
@@ -318,10 +321,10 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
 		++hw_priv->scan.n_ssids;
 	}

-	up(&hw_priv->conf_lock);
-
 	if (frame.skb)
 		dev_kfree_skb(frame.skb);
+
+	up(&hw_priv->conf_lock);
 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
 	bwifi_change_current_status(hw_priv, BWIFI_STATUS_SCANNING);
 #endif
@@ -362,14 +365,18 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
 	if (req->n_ssids > hw->wiphy->max_scan_ssids)
 		return -EINVAL;

-	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
-		req->ie_len);
-	if (!frame.skb)
-		return -ENOMEM;
-
 	/* will be unlocked in bes2600_scan_work() */
 	down(&hw_priv->scan.lock);
 	down(&hw_priv->conf_lock);
+
+	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
+		req->ie_len);
+	if (!frame.skb) {
+		up(&hw_priv->conf_lock);
+		up(&hw_priv->scan.lock);
+		return -ENOMEM;
+	}
+
 	if (frame.skb) {
 		int ret;
 		if (priv->if_id == 0)
@@ -380,9 +387,9 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
 			ret = wsm_set_probe_responder(priv, true);
 		}
 		if (ret) {
+			dev_kfree_skb(frame.skb);
 			up(&hw_priv->conf_lock);
 			up(&hw_priv->scan.lock);
-			dev_kfree_skb(frame.skb);
 			return ret;
 		}
 	}
@@ -414,10 +421,10 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
 		}
 	}

-	up(&hw_priv->conf_lock);
-
 	if (frame.skb)
 		dev_kfree_skb(frame.skb);
+
+	up(&hw_priv->conf_lock);
 	queue_work(hw_priv->workqueue, &hw_priv->scan.swork);
 	wiphy_warn(hw->wiphy, "<--[SCAN] Scheduled scan request.\n");
 	return 0;
@@ -585,10 +592,10 @@ void bes2600_scan_work(struct work_struct *work)
 					"[SCAN] Scan failed (%d).\n",
 					hw_priv->scan.status);
 		else if (hw_priv->scan.req)
-			wiphy_info(priv->hw->wiphy,
+			wiphy_dbg(priv->hw->wiphy,
 					"[SCAN] Scan completed.\n");
 		else
-			wiphy_info(priv->hw->wiphy,
+			wiphy_dbg(priv->hw->wiphy,
 					"[SCAN] Scan canceled.\n");

 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
@@ -673,8 +680,9 @@ void bes2600_scan_work(struct work_struct *work)
 			scan.scanType = WSM_SCAN_TYPE_BACKGROUND;
 			scan.scanFlags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
 		}
-		scan.ch = kzalloc((it - hw_priv->scan.curr) *
-			sizeof(struct wsm_scan_ch), GFP_KERNEL);
+		scan.ch = kcalloc((it - hw_priv->scan.curr),
+				   sizeof(struct wsm_scan_ch),
+				   GFP_KERNEL);
 		if (!scan.ch) {
 			hw_priv->scan.status = -ENOMEM;
 			goto fail;
@@ -976,7 +984,7 @@ void bes2600_scan_complete_cb(struct bes2600_common *hw_priv,
 	// recover EPTA timer after scan wsm msg complete, in case of epta state error
 	// bwifi_change_current_status(hw_priv, BWIFI_STATUS_SCANNING_COMP);
 #endif
-	wiphy_info(hw_priv->hw->wiphy, "bes2600_scan_complete_cb status: %u", arg->status);
+	wiphy_dbg(hw_priv->hw->wiphy, "bes2600_scan_complete_cb status: %u", arg->status);

 	if(hw_priv->scan.status == -ETIMEDOUT)
 		wiphy_warn(hw_priv->hw->wiphy,
@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Scan interface for BES2600 mac80211 drivers
+ * Scan interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef SCAN_H_INCLUDED
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 STA API for BES2600 drivers
+ * Mac80211 STA API for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/vmalloc.h>
@@ -42,6 +42,8 @@
 #include "bes2600_factory.h"
 #endif

+#include "txrx_opt.h"
+
 #define WEP_ENCRYPT_HDR_SIZE    4
 #define WEP_ENCRYPT_TAIL_SIZE   4
 #define WPA_ENCRYPT_HDR_SIZE    8
@@ -219,7 +221,7 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
 	cancel_delayed_work_sync(&hw_priv->advance_scan_timeout);
 #endif
 	flush_workqueue(hw_priv->workqueue);
-	del_timer_sync(&hw_priv->ba_timer);
+	timer_delete_sync(&hw_priv->ba_timer);

 	down(&hw_priv->conf_lock);

@@ -259,7 +261,7 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
 		cancel_delayed_work_sync(&priv->bss_loss_work);
 		cancel_delayed_work_sync(&priv->connection_loss_work);
 		cancel_delayed_work_sync(&priv->link_id_gc_work);
-		del_timer_sync(&priv->mcast_timeout);
+		timer_delete_sync(&priv->mcast_timeout);
 	}

 #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
@@ -376,9 +378,23 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
 	atomic_set(&priv->enabled, 0);
 	down(&hw_priv->scan.lock);
 	down(&hw_priv->conf_lock);
-	if (!__cw12xx_hwpriv_to_vifpriv(hw_priv, priv->if_id)) {
+
+	/*
+	 * There's a chance remove_interface will run again on the same
+	 * (already removed) interface.
+	 *
+	 * Currently this only happens when NetworkManager creates a P2P_DEVICE
+	 * alongside a STA.
+	 *
+	 * But there can be other cases where this may run as well. So if that
+	 * happens, let's throw a warning and decrease the vifs count by one.
+	 */
+	if (WARN_ON(!__cw12xx_hwpriv_to_vifpriv(hw_priv, priv->if_id))) {
 		bes_devel(" !!! %s: interface addr %pM already removed\n",
 			     __func__, vif->addr);
+
+		atomic_dec(&hw_priv->num_vifs);
+
 	        up(&hw_priv->conf_lock);
 	        up(&hw_priv->scan.lock);
 		return;
@@ -451,7 +467,7 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
 	cancel_delayed_work_sync(&priv->pending_offchanneltx_work);
 	cancel_work_sync(&priv->decrypt_storm_recover_work);

-	del_timer_sync(&priv->mcast_timeout);
+	timer_delete_sync(&priv->mcast_timeout);
 	/* TODO:COMBO: May be reset of these variables "delayed_link_loss and
 	 * join_status to default can be removed as dev_priv will be freed by
 	 * mac80211 */
@@ -504,7 +520,7 @@ int bes2600_change_interface(struct ieee80211_hw *dev,
 	return ret;
 }

-int bes2600_config(struct ieee80211_hw *dev, u32 changed)
+int bes2600_config(struct ieee80211_hw *dev, int radio_idx, u32 changed)
 {
 	int ret = 0;
 	struct bes2600_common *hw_priv = dev->priv;
@@ -1139,7 +1155,7 @@ void bes2600_wep_key_work(struct work_struct *work)
 	wsm_unlock_tx(hw_priv);
 }

-int bes2600_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+int bes2600_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx, u32 value)
 {
 	struct bes2600_common *hw_priv = hw->priv;
 	int ret;
@@ -1484,7 +1500,7 @@ void bes2600_event_handler(struct work_struct *work)
 						IEEE80211_STYPE_DEAUTH | IEEE80211_FCTL_TODS);
 				deauth->u.deauth.reason_code = WLAN_REASON_DEAUTH_LEAVING;
 				deauth->seq_ctrl = 0;
-				ieee80211_rx_irqsafe(priv->hw, skb);
+				ieee80211_rx_ni(priv->hw, skb);
 				bes_devel(" Inactivity Deauth Frame sent for MAC SA %pM \t and DA %pM\n", deauth->sa, deauth->da);
 				queue_work(priv->hw_priv->workqueue, &priv->set_tim_work);
 				break;
@@ -2247,6 +2263,8 @@ void bes2600_join_work(struct work_struct *work)
 		wsm_unlock_tx(hw_priv);
 		return;
 	}
+
+	rcu_read_lock();
 	ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
 	dtimie = ieee80211_bss_get_ie(bss, WLAN_EID_TIM);
 	if (dtimie)
@@ -2330,6 +2348,8 @@ void bes2600_join_work(struct work_struct *work)
 				bes2600_rate_mask_to_wsm(hw_priv, 0xFF0);
 		}

+		rcu_read_unlock();
+
 		bes2600_pwr_set_busy_event(hw_priv, BES_PWR_LOCK_ON_JOIN);
 		wsm_flush_tx(hw_priv);

@@ -2342,14 +2362,19 @@ void bes2600_join_work(struct work_struct *work)
 		//WARN_ON(wsm_reset(hw_priv, &reset, priv->if_id));
 		WARN_ON(wsm_set_block_ack_policy(hw_priv,
 			0, hw_priv->ba_tid_mask, priv->if_id));
-		spin_lock_bh(&hw_priv->ba_lock);
-		hw_priv->ba_ena = false;
-		hw_priv->ba_cnt = 0;
-		hw_priv->ba_acc = 0;
+		/*
+		 * Patch D: ba_lock removed.  Disconnect-reset clears the
+		 * counters and the arm flag; producers racing here cannot
+		 * cause harm — at worst they re-arm the timer and bump
+		 * counters that will be cleared on the next timer tick.
+		 */
+		atomic_set(&hw_priv->ba_ena, 0);
+		atomic_set(&hw_priv->ba_cnt, 0);
+		atomic_set(&hw_priv->ba_acc, 0);
 		hw_priv->ba_hist = 0;
-		hw_priv->ba_cnt_rx = 0;
-		hw_priv->ba_acc_rx = 0;
-		spin_unlock_bh(&hw_priv->ba_lock);
+		atomic_set(&hw_priv->ba_cnt_rx, 0);
+		atomic_set(&hw_priv->ba_acc_rx, 0);
+		atomic_set(&hw_priv->ba_armed, 0);

 		mgmt_policy.protectedMgmtEnable = 0;
 		mgmt_policy.unprotectedMgmtFramesAllowed = 1;
@@ -2436,7 +2461,7 @@ void bes2600_unjoin_work(struct work_struct *work)
 	int i;
 	struct bes2600_vif *tmp_priv;

-	del_timer_sync(&hw_priv->ba_timer);
+	timer_delete_sync(&hw_priv->ba_timer);
 	down(&hw_priv->conf_lock);
 	if (unlikely(atomic_read(&hw_priv->scan.in_progress)
 		|| atomic_read(&priv->connect_in_process))) {
@@ -2629,10 +2654,11 @@ void bes2600_ba_work(struct work_struct *work)
 		return;*/

 	bes_devel("BA work****\n");
-	spin_lock_bh(&hw_priv->ba_lock);
-//	tx_ba_tid_mask = hw_priv->ba_ena ? hw_priv->ba_tid_mask : 0;
+	/*
+	 * Patch D: ba_lock removed.  ba_tid_mask is u8 set once at init
+	 * (main.c); reading it without a lock is fine.
+	 */
 	tx_ba_tid_mask = hw_priv->ba_tid_mask;
-	spin_unlock_bh(&hw_priv->ba_lock);

 	wsm_lock_tx(hw_priv);

@@ -2645,37 +2671,49 @@ void bes2600_ba_work(struct work_struct *work)
 void bes2600_ba_timer(struct timer_list *t)
 {
 	bool ba_ena;
-	struct bes2600_common *hw_priv = from_timer(hw_priv, t, ba_timer);
+	int cnt, acc, cnt_rx, acc_rx;
+	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, ba_timer);

-	spin_lock_bh(&hw_priv->ba_lock);
-	bes2600_debug_ba(hw_priv, hw_priv->ba_cnt, hw_priv->ba_acc,
-			hw_priv->ba_cnt_rx, hw_priv->ba_acc_rx);
+	/*
+	 * Patch D: ba_lock removed.  Snapshot atomic counters into locals
+	 * for the predicate evaluation; producers may race incrementing
+	 * after the snapshot but the resulting decision is approximate
+	 * which the policy already tolerates (next timer tick re-evaluates).
+	 */
+	cnt    = atomic_read(&hw_priv->ba_cnt);
+	acc    = atomic_read(&hw_priv->ba_acc);
+	cnt_rx = atomic_read(&hw_priv->ba_cnt_rx);
+	acc_rx = atomic_read(&hw_priv->ba_acc_rx);
+
+	bes2600_debug_ba(hw_priv, cnt, acc, cnt_rx, acc_rx);

 	if (atomic_read(&hw_priv->scan.in_progress)) {
-		hw_priv->ba_cnt = 0;
-		hw_priv->ba_acc = 0;
-		hw_priv->ba_cnt_rx = 0;
-		hw_priv->ba_acc_rx = 0;
-		goto skip_statistic_update;
+		atomic_set(&hw_priv->ba_cnt, 0);
+		atomic_set(&hw_priv->ba_acc, 0);
+		atomic_set(&hw_priv->ba_cnt_rx, 0);
+		atomic_set(&hw_priv->ba_acc_rx, 0);
+		atomic_set(&hw_priv->ba_armed, 0);
+		return;
 	}

-	if (hw_priv->ba_cnt >= BES2600_BLOCK_ACK_CNT &&
-		(hw_priv->ba_acc / hw_priv->ba_cnt >= BES2600_BLOCK_ACK_THLD ||
-		(hw_priv->ba_cnt_rx >= BES2600_BLOCK_ACK_CNT &&
-		hw_priv->ba_acc_rx / hw_priv->ba_cnt_rx >=
+	if (cnt >= BES2600_BLOCK_ACK_CNT &&
+		(acc / cnt >= BES2600_BLOCK_ACK_THLD ||
+		(cnt_rx >= BES2600_BLOCK_ACK_CNT &&
+		acc_rx / cnt_rx >=
 			BES2600_BLOCK_ACK_THLD)))
 		ba_ena = true;
 	else
 		ba_ena = false;

-	hw_priv->ba_cnt = 0;
-	hw_priv->ba_acc = 0;
-	hw_priv->ba_cnt_rx = 0;
-	hw_priv->ba_acc_rx = 0;
+	atomic_set(&hw_priv->ba_cnt, 0);
+	atomic_set(&hw_priv->ba_acc, 0);
+	atomic_set(&hw_priv->ba_cnt_rx, 0);
+	atomic_set(&hw_priv->ba_acc_rx, 0);
+	atomic_set(&hw_priv->ba_armed, 0);

-	if (ba_ena != hw_priv->ba_ena) {
+	if (ba_ena != !!atomic_read(&hw_priv->ba_ena)) {
 		if (ba_ena || ++hw_priv->ba_hist >= BES2600_BLOCK_ACK_HIST) {
-			hw_priv->ba_ena = ba_ena;
+			atomic_set(&hw_priv->ba_ena, ba_ena ? 1 : 0);
 			hw_priv->ba_hist = 0;
 #if 0
 			bes_devel("[STA] %s block ACK:\n",
@@ -2685,9 +2723,6 @@ void bes2600_ba_timer(struct timer_list *t)
 		}
 	} else if (hw_priv->ba_hist)
 		--hw_priv->ba_hist;
-
-skip_statistic_update:
-	spin_unlock_bh(&hw_priv->ba_lock);
 }

 int bes2600_vif_setup(struct bes2600_vif *priv)
@@ -2869,6 +2904,7 @@ void bes2600_dynamic_opt_txrx_work(struct work_struct *work)
 	if (priv != NULL && priv->join_status > BES2600_JOIN_STATUS_MONITOR) {
 		multivif_connected = true;
 	}
+	bes2600_txrx_opt_multivif_connected_handler(hw_priv, multivif_connected);
 }


@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 STA interface for BES2600 mac80211 drivers
+ * Mac80211 STA API interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include <linux/version.h>
 #ifndef STA_H_INCLUDED
@@ -26,7 +26,7 @@ int bes2600_change_interface(struct ieee80211_hw *dev,
 				enum nl80211_iftype new_type,
 				bool p2p);

-int bes2600_config(struct ieee80211_hw *dev, u32 changed);
+int bes2600_config(struct ieee80211_hw *dev, int radio_idx, u32 changed);
 int bes2600_change_interface(struct ieee80211_hw *dev,
                                struct ieee80211_vif *vif,
                                enum nl80211_iftype new_type,
@@ -48,7 +48,7 @@ int bes2600_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
 		   struct ieee80211_vif *vif, struct ieee80211_sta *sta,
 		   struct ieee80211_key_conf *key);

-int bes2600_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
+int bes2600_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx, u32 value);

 void bes2600_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		  u32 queues, bool drop);
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * Test-mode TX loopback for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #include "bes2600.h"
 #include "wsm.h"
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Mac80211 driver for BES2600 device
+ * Test-mode TX loopback interface for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifndef __TX_LOOP_H__
 #define __TX_LOOP_H__
@@ -1,12 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Datapath implementation for BES2600 mac80211 drivers
+ * Datapath implementation for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <net/mac80211.h>
@@ -21,6 +21,7 @@
 #include "debug.h"
 #include "sta.h"
 #include "sbus.h"
+#include "txrx_opt.h"
 #include "bes_log.h"

 #define BES2600_INVALID_RATE_ID (0xFF)
@@ -995,14 +996,18 @@ bes2600_tx_h_ba_stat(struct bes2600_vif *priv,
 	if (!ieee80211_is_data(t->hdr->frame_control))
 		return;

-	spin_lock_bh(&hw_priv->ba_lock);
-	hw_priv->ba_acc += t->skb->len - t->hdrlen;
-	if (!(hw_priv->ba_cnt_rx || hw_priv->ba_cnt)) {
+	/*
+	 * Patch D: lock-free hot-path BA accounting.  atomic_inc + atomic_add
+	 * each per-frame; the once-per-window timer-arm uses cmpxchg on
+	 * ba_armed so concurrent TX/RX can't both try to set the timer and
+	 * we don't need cross-counter coherency on the ba_cnt/ba_cnt_rx pair.
+	 */
+	atomic_add(t->skb->len - t->hdrlen, &hw_priv->ba_acc);
+	atomic_inc(&hw_priv->ba_cnt);
+	if (atomic_cmpxchg(&hw_priv->ba_armed, 0, 1) == 0) {
 		mod_timer(&hw_priv->ba_timer,
 			jiffies + BES2600_BLOCK_ACK_INTERVAL);
 	}
-	hw_priv->ba_cnt++;
-	spin_unlock_bh(&hw_priv->ba_lock);
 }

 static int
@@ -1545,14 +1550,35 @@ void bes2600_skb_dtor(struct bes2600_common *hw_priv,
 	struct bes2600_vif *priv =
 		__cw12xx_hwpriv_to_vifpriv(hw_priv, txpriv->if_id);

+
+	if (!skb)
+		return;
+
+	/*
+	 * There should be no reason for skb buffer being larger
+	 * than the offset..
+	 */
+	if(WARN_ON(txpriv->offset > skb->len)) {
+		ieee80211_free_txskb(hw_priv->hw, skb);
+		return;
+	}
+
+	bes_devel("%s: txpriv->offset: %d - skb->len: %d\n",
+		  __func__, txpriv->offset, skb->len);
+
 	skb_pull(skb, txpriv->offset);
 	if (priv && txpriv->rate_id != BES2600_INVALID_RATE_ID) {
 		bes2600_notify_buffered_tx(priv, skb,
 				txpriv->raw_link_id, txpriv->tid);
 		tx_policy_put(hw_priv, txpriv->rate_id);
 	}
-	if (likely(!bes2600_is_itp(hw_priv)))
+	if (likely(!bes2600_is_itp(hw_priv))) {
+		if (priv) {
+			/* The interface may be already removed */
+			bes2600_tx_status(priv, skb);
+		}
 		ieee80211_tx_status_skb(hw_priv->hw, skb);
+	}

 }
 #ifdef CONFIG_BES2600_TESTMODE
@@ -1629,14 +1655,13 @@ bes2600_rx_h_ba_stat(struct bes2600_vif *priv,
 	if (!priv->setbssparams_done)
 		return;

-	spin_lock_bh(&hw_priv->ba_lock);
-	hw_priv->ba_acc_rx += skb_len - hdrlen;
-	if (!(hw_priv->ba_cnt_rx || hw_priv->ba_cnt)) {
+	/* Patch D: lock-free hot-path BA accounting; see TX side comment. */
+	atomic_add(skb_len - hdrlen, &hw_priv->ba_acc_rx);
+	atomic_inc(&hw_priv->ba_cnt_rx);
+	if (atomic_cmpxchg(&hw_priv->ba_armed, 0, 1) == 0) {
 		mod_timer(&hw_priv->ba_timer,
 			jiffies + BES2600_BLOCK_ACK_INTERVAL);
 	}
-	hw_priv->ba_cnt_rx++;
-	spin_unlock_bh(&hw_priv->ba_lock);
 }

 void bes2600_rx_cb(struct bes2600_vif *priv,
@@ -1923,6 +1948,7 @@ void bes2600_rx_cb(struct bes2600_vif *priv,

 	if (ieee80211_is_data(frame->frame_control)) {
 		bes2600_rx_h_ba_stat(priv, hdrlen, skb->len);
+		bes2600_rx_status(priv, skb);
 	}

 #ifdef CONFIG_BES2600_TESTMODE
@@ -1939,15 +1965,33 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
 	if (unlikely(bes2600_itp_rxed(hw_priv, skb)))
 		consume_skb(skb);
 	else if (unlikely(early_data)) {
-		spin_lock_bh(&priv->ps_state_lock);
-		/* Double-check status with lock held */
-		if (entry->status == BES2600_LINK_SOFT)
-			skb_queue_tail(&entry->rx_queue, skb);
-		else
-			ieee80211_rx_irqsafe(priv->hw, skb);
-		spin_unlock_bh(&priv->ps_state_lock);
+		/*
+		 * Patch E: when c7 has latched pm_unsupported (firmware
+		 * doesn't honour PSM, see feedback_bes2600_firmware_no_psm),
+		 * AP-side power-save state machine is dead and link entries
+		 * never transition to BES2600_LINK_SOFT.  The double-check
+		 * branch under ps_state_lock is unreachable in that case,
+		 * so skip the per-frame lock acquisition entirely and
+		 * deliver to mac80211 directly.
+		 *
+		 * On firmware that does honour PSM (the latch self-clears
+		 * if a real PM_INDICATION ever arrives — see c7), this
+		 * predicate flips back to false and the original locked
+		 * path is taken.
+		 */
+		if (hw_priv->bes_power.pm_unsupported) {
+			ieee80211_rx_ni(priv->hw, skb);
+		} else {
+			spin_lock_bh(&priv->ps_state_lock);
+			/* Double-check status with lock held */
+			if (entry->status == BES2600_LINK_SOFT)
+				skb_queue_tail(&entry->rx_queue, skb);
+			else
+				ieee80211_rx_ni(priv->hw, skb);
+			spin_unlock_bh(&priv->ps_state_lock);
+		}
 	} else {
-		ieee80211_rx_irqsafe(priv->hw, skb);
+		ieee80211_rx_ni(priv->hw, skb);
 	}
 	*skb_p = NULL;

@@ -1,12 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Datapath interface for BES2600 mac80211 drivers
+ * Datapath interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2010, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_TXRX_H
@@ -0,0 +1,569 @@
+/***************************************************************************
+ *
+ * Copyright 2015-2022 BES.
+ * All rights reserved. All unpublished rights reserved.
+ *
+ * No part of this work may be used or reproduced in any form or by any
+ * means, or stored in a database or retrieval system, without prior written
+ * permission of BES.
+ *
+ * Use of this work is governed by a license granted by BES.
+ * This work contains confidential and proprietary information of
+ * BES. which is protected by copyright, trade secret,
+ * trademark and other intellectual property rights.
+ *
+ ****************************************************************************/
+#include <net/mac80211.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/timer.h>
+
+#include "bes2600.h"
+#include "wsm.h"
+#include "bh.h"
+#include "ap.h"
+#include "debug.h"
+#include "sta.h"
+#include "sbus.h"
+#include "bes_pwr.h"
+#include "txrx_opt.h"
+
+#define TXRX_OPT_CLOSE_EDCA     0
+#define TXRX_OPT_EDCA_MAX_LEVEL 4
+#define TX_AVG_TIME_COUNT       10
+#define TXRX_OPT_PEROID         500
+#define TXRX_OPT_DEBUG          1
+
+#define TXRX_HIGH_TP_THRESHOLD_2G4    	30000   // unit is kbps
+#define TXRX_HIGH_TP_THRESHOLD_5G    	40000   // unit is kbps
+#define TXRX_HIGH_TP_DELTA_TIME_2G4   	8       // unit ms
+#define TXRX_HIGH_TP_DELTA_TIME_5G   	6       // unit ms
+
+#define TXRX_RTS_PROT_TRIG_THRESH		80		// percent * 100
+#define TXRX_RTS_PROT_DURATION			10		// unit second
+
+#define TXRX_RTS_PROT_OPEN(x)			(x = 512)
+#define TXRX_RTS_PROT_CLOSE(x)			(x = 2437)
+#define TXRX_RTS_PROT_OPENED(x)			(x < 1536)
+
+static uint32_t tx_delta_time_arr[4][TX_AVG_TIME_COUNT];
+static uint32_t tx_queue_arr[4] = {0};
+static uint32_t tx_delta_time_total = 0;
+static uint32_t tx_delta_time_total_cnt = 0;
+static u8 cur_pwr_tbl = 1;
+static u16 cur_rts_thres = 2437;
+static unsigned long last_rts_set_time = -1;
+
+void bes2600_add_tx_delta_time(uint32_t tx_delta_time)
+{
+	tx_delta_time_total += tx_delta_time;
+	tx_delta_time_total_cnt++;
+}
+
+static uint32_t bes2600_get_tx_delta_time(void)
+{
+	if (tx_delta_time_total_cnt != 0)
+		return tx_delta_time_total / tx_delta_time_total_cnt;
+	else
+		return 0;
+}
+
+static void bes2600_clear_tx_delta_time(void)
+{
+	tx_delta_time_total_cnt = 0;
+	tx_delta_time_total = 0;
+	return ;
+}
+
+static uint32_t bes2600_get_tx_ac_delta_time(int ac)
+{
+	uint32_t avg_time = 0;
+	int i = 0;
+	for (i = 0; i < TX_AVG_TIME_COUNT; i++) {
+		avg_time += tx_delta_time_arr[ac][i];
+	}
+	return avg_time / TX_AVG_TIME_COUNT;
+}
+
+static void bes2600_clear_tx_ac_delta_time(int ac)
+{
+	int i = 0;
+	for (i = 0; i < TX_AVG_TIME_COUNT; i++) {
+		tx_delta_time_arr[ac][i] = 0;
+	}
+	return ;
+}
+
+void bes2600_add_tx_ac_delta_time(int ac, uint32_t del_time)
+{
+#if 0
+	if (tx_queue_arr[ac] >= (TX_AVG_TIME_COUNT - 1)) {
+		static int num = 0;
+		if ((num ++ % 10) == 0)
+			bes_devel( "%s %d %d %d %d %d del=%d\n\r", __func__, tx_delta_time_arr[ac][0],
+				     tx_delta_time_arr[ac][2],  tx_delta_time_arr[ac][4],  tx_delta_time_arr[ac][6],
+				     tx_delta_time_arr[ac][8], del_time);
+	}
+#endif
+	tx_delta_time_arr[ac][tx_queue_arr[ac]] = del_time;
+	tx_queue_arr[ac] = (tx_queue_arr[ac] >= (TX_AVG_TIME_COUNT - 1)) ? 0 : (tx_queue_arr[ac] + 1);
+
+}
+
+
+static int bes2600_set_txrx_opt_param(struct bes2600_common *hw_priv,
+			       struct bes2600_vif *priv,
+			       MIB_TXRX_OPT_PARAM  *para)
+{
+
+	int ret = 0;
+	ret = WARN_ON(wsm_write_mib(hw_priv,
+				    WSM_MIB_ID_EXT_TXRX_OPT_PARAM,
+				    (u8 *)para,
+				    sizeof(MIB_TXRX_OPT_PARAM),
+				    priv->if_id));
+	return ret;
+}
+
+static int bes2600_enable_tx_shortgi(struct bes2600_common *hw_priv,
+			      struct bes2600_vif *priv,
+			      u8 onoff)
+{
+	int ret = 0;
+	static u8 en = 0xff;
+
+	bes_devel( "%s onoff=%d\n\r", __func__, onoff);
+
+	if (en != onoff) {
+		en = onoff;
+		ret = WARN_ON(wsm_write_mib(hw_priv,
+					    WSM_MIB_ID_EXT_TX_SHORT_GI_ENABLED,
+					    (u8 *)&onoff,
+					    sizeof(onoff),
+					    priv->if_id));
+	}
+	return ret;
+}
+
+void bes2600_rx_status(struct bes2600_vif *priv, struct sk_buff *skb)
+{
+	priv->dot11ReceivedFragmentCount++;
+	priv->dot11ReceivedDataBytes += skb->len;
+}
+
+void bes2600_tx_status(struct bes2600_vif *priv, struct sk_buff *skb)
+{
+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	int i;
+	int retry_count = -1;
+
+	if(WARN_ON(!priv->hw))
+		return;
+
+	if (!ieee80211_is_data(hdr->frame_control))
+		return;
+
+	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+		if (info->status.rates[i].idx < 0)
+			break;
+
+		retry_count += info->status.rates[i].count;
+	}
+	if (retry_count < 0)
+		retry_count = 0;
+
+	if (info->flags & IEEE80211_TX_STAT_ACK) {
+		priv->dot11TransmittedFrameCount++;
+		priv->dot11TransmittedDataBytes += (skb->len + 4);
+		if (retry_count > 0)
+			priv->dot11RetryCount += retry_count;
+
+	} else {
+		/* tx fail.*/
+		priv->dot11FailedCount++;
+	}
+}
+void bes2600_set_default_params(struct bes2600_common *hw_priv, struct bes2600_vif *priv);
+
+static int bes2600_set_high_edca_params(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int level)
+{
+	struct wsm_edca_params arg;
+	int i = 0;
+	static int lev = 0;
+	bes_devel( "set edca level=%d\n\r", level);
+
+	if (lev == level)
+		return 0;
+
+	lev = level;
+
+	memcpy(&arg, &(priv->edca), sizeof(struct wsm_edca_params));
+
+	if (level == 0) {
+		bes2600_set_default_params(hw_priv, priv);
+		return 0;
+	} else if (level == 1) {
+		for ( i = 0; i < 4; i++) {
+			arg.params[i].aifns = 2;
+			arg.params[i].cwMax = 7;
+			arg.params[i].cwMin = 3;
+			/*
+			 * tx op must set 0
+			 * set other, some AP may not response BA when rx data.
+			*/
+			arg.params[i].txOpLimit = 0;
+			arg.params[i].maxReceiveLifetime = 0xc8;
+		}
+	} else if (level == 2) {
+		for ( i = 0; i < 4; i++) {
+			arg.params[i].aifns = 2;
+			arg.params[i].cwMax = 5;
+			arg.params[i].cwMin = 1;
+			arg.params[i].txOpLimit = 0;
+			arg.params[i].maxReceiveLifetime = 0xc8;
+		}
+	} else if (level == 3) {
+		for ( i = 0; i < 4; i++) {
+			arg.params[i].aifns = 2;
+			arg.params[i].cwMax = 3;
+			arg.params[i].cwMin = 1;
+			arg.params[i].txOpLimit = 0;
+			arg.params[i].maxReceiveLifetime = 0xc8;
+		}
+	} else if (level == 4) {
+		for ( i = 0; i < 4; i++) {
+			arg.params[i].aifns = 1;
+			arg.params[i].cwMax = 3;
+			arg.params[i].cwMin = 1;
+			arg.params[i].txOpLimit = 0;
+			arg.params[i].maxReceiveLifetime = 0xc8;
+		}
+	}
+	wsm_set_edca_params(hw_priv, &arg, priv->if_id);
+	return 0;
+}
+void bes2600_set_default_params(struct bes2600_common *hw_priv, struct bes2600_vif *priv)
+{
+	bes_devel( "set edca default\n\r");
+	wsm_set_edca_params(hw_priv, &priv->edca, priv->if_id);
+}
+static void bes2600_set_cca_method(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int value)
+{
+// todo set cca alg
+}
+
+static void bes2600_set_dynamic_agc(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int value)
+{
+// todo set agc alg
+}
+
+static int bes2600_update_pwr_table(struct bes2600_common *hw_priv,
+			      struct bes2600_vif *priv,
+			      u8 pwr_tbl_idx)
+{
+	int ret = 0;
+	static u8 cur_pwr_tbl_idx = 0xff;
+
+	if (cur_pwr_tbl_idx != pwr_tbl_idx) {
+		cur_pwr_tbl_idx = pwr_tbl_idx;
+		ret = WARN_ON(wsm_write_mib(hw_priv,
+					    WSM_MIB_ID_EXT_PWR_TBL_UPDATE,
+					    (u8 *)&cur_pwr_tbl_idx,
+					    sizeof(cur_pwr_tbl_idx),
+					    priv->if_id));
+		bes_devel( "%s pwr_tbl_idx=%d\n\r", __func__, pwr_tbl_idx);
+	}
+	return ret;
+}
+
+static int bes2600_get_tx_av_max_delta_time(void)
+{
+	int max_avg = 0;
+	int i = 0;
+
+	for (i = 0; i < 4; i++) {
+		if (max_avg < bes2600_get_tx_ac_delta_time(i)) {
+			max_avg = bes2600_get_tx_ac_delta_time(i);
+		}
+		//bes2600_clear_tx_ac_delta_time(i);
+	}
+	return max_avg;
+}
+
+static bool bes2600_station_is_ap_ht40(struct bes2600_common *hw_priv)
+{
+
+	if (hw_priv->hw) {
+		struct ieee80211_conf *conf = &hw_priv->hw->conf;
+		if (conf !=  NULL)
+			if (conf->chandef.width == NL80211_CHAN_WIDTH_40)
+				return true;
+	}
+	return false;
+}
+
+void bes2600_dynamic_opt_rxtx(struct bes2600_common *hw_priv, struct bes2600_vif *priv, int rssi)
+{
+	u32 succPro = 0, tx_cnt, tx_retry, rx_cnt, tx_fail;
+	static u32 l_tx_cnt = 0, l_tx_fail = 0, l_tx_retry = 0, l_rx_cnt = 0;
+	static u32 tx_bps = 0, rx_bps = 0;
+	u32 total_kbps = 0;
+	static int level;
+
+	/* calculate real time throughput */
+	if (hw_priv == NULL || priv == NULL) {
+		return;
+	}
+	tx_bps = abs (priv->dot11TransmittedDataBytes - tx_bps);
+	rx_bps = abs (priv->dot11ReceivedDataBytes  - rx_bps);
+	total_kbps = (tx_bps / 128 + rx_bps / 128);
+
+	total_kbps *= 1000;
+	total_kbps /= TXRX_OPT_PEROID;
+
+	/*  if tx/rx < 100k/s, close*/
+	if (total_kbps < 100) {
+		level = 0;
+		last_rts_set_time = -1;
+		TXRX_RTS_PROT_CLOSE(cur_rts_thres);
+		goto txrx_opt_clear;
+	}
+
+	/* calculate tx_cnt, tx_retry, rx_cnt */
+	tx_cnt = (priv->dot11TransmittedFrameCount - l_tx_cnt);
+	tx_fail = (priv->dot11FailedCount - l_tx_fail);
+	tx_retry = (priv->dot11RetryCount - l_tx_retry);
+	rx_cnt = (priv->dot11ReceivedFragmentCount - l_rx_cnt);
+	( (tx_cnt + tx_retry) > 0 ) ? (succPro = tx_cnt * 100 / (tx_cnt + tx_retry)) : (succPro = 0);
+
+	bes_devel( "%s, tx_cnt:%d prob:%d\n", __func__, tx_cnt, succPro);
+
+	/* set rts/cts protection dynamically */
+	if (tx_cnt > 50 && succPro != 0) {
+		if (succPro > TXRX_RTS_PROT_TRIG_THRESH &&
+			TXRX_RTS_PROT_OPENED(cur_rts_thres) &&
+		    time_after(jiffies, last_rts_set_time + TXRX_RTS_PROT_DURATION * HZ)) {
+			TXRX_RTS_PROT_CLOSE(cur_rts_thres);
+		} else if (succPro <= TXRX_RTS_PROT_TRIG_THRESH){
+			TXRX_RTS_PROT_OPEN(cur_rts_thres);
+			last_rts_set_time = jiffies;
+		}
+	}
+
+	/* dynamic set edca param */
+	if (succPro != 0) {
+		if (bes2600_station_is_ap_ht40(hw_priv)) {
+			if (bes2600_get_tx_delta_time() > 8 || bes2600_get_tx_av_max_delta_time() > 8) {
+				if (level < 4)
+					level++;
+			} else {
+				if (level > 0)
+					level--;
+			}
+			/* high throughput force level = 0 */
+			if (total_kbps > TXRX_HIGH_TP_THRESHOLD_5G && level > 0 && priv->hw_value > 19) {
+				level = 0;
+			}
+
+		} else {//shiled room 13, office 8
+			if (bes2600_get_tx_delta_time() > (TXRX_HIGH_TP_DELTA_TIME_5G + total_kbps / 8000)
+			    || bes2600_get_tx_av_max_delta_time() > (TXRX_HIGH_TP_DELTA_TIME_5G + total_kbps / 8000)) {
+				if (level < 4)
+					level++;
+			} else {
+				if (level > 0)
+					level--;
+			}
+			/* high throughput force level = 0 */
+			if (total_kbps > TXRX_HIGH_TP_THRESHOLD_2G4 && level > 0) {
+				level = 0;
+			}
+
+		}
+	}
+
+	/* dynamic set power table */
+	if (rssi <= BES2600_TX_RSSI_LOW)
+		cur_pwr_tbl = 2;	// use high power table
+	else if(rssi >= BES2600_TX_RSSI_HIGH)
+		cur_pwr_tbl = 1;	// use standard power table
+
+#if TXRX_OPT_CLOSE_EDCA
+	level = 0;
+#endif
+	if (level > TXRX_OPT_EDCA_MAX_LEVEL)
+		level = TXRX_OPT_EDCA_MAX_LEVEL;
+
+	bes_devel( "txrx_opt: tx(cnt=%d retry=%d psr=%d tx_fail=%d (wsm level=%d) tx=%dk/s)\n\r",
+	       tx_cnt, tx_retry, succPro, tx_fail, level, tx_bps / 128);
+	bes_devel( "txrx_opt: rx(cnt=%d  rx=%dk/s) total=%dk/s\n\r", rx_cnt, rx_bps / 128, total_kbps);
+	bes_devel( "txrx_opt: tx_delta_time=%d [%d %d %d %d] hw_value=%d ht=%d maxtxcnt=%d\n\r",
+	       bes2600_get_tx_delta_time(), bes2600_get_tx_ac_delta_time(0), bes2600_get_tx_ac_delta_time(1),
+	       bes2600_get_tx_ac_delta_time(2), bes2600_get_tx_ac_delta_time(3), priv->hw_value,
+	       bes2600_station_is_ap_ht40(hw_priv), hw_priv->long_frame_max_tx_count);
+
+
+	/* dynamic set cca */
+	bes2600_set_cca_method(hw_priv, priv, 0);
+	/* dynamic set agc */
+	bes2600_set_dynamic_agc(hw_priv, priv, 0);
+	bes2600_update_pwr_table(hw_priv, priv, cur_pwr_tbl);
+txrx_opt_clear:
+	bes2600_set_high_edca_params(hw_priv, priv, level);
+	bes2600_set_rts_threshold(hw_priv->hw, -1, cur_rts_thres);
+	bes2600_clear_tx_delta_time();
+	bes2600_clear_tx_ac_delta_time(0);
+	bes2600_clear_tx_ac_delta_time(1);
+	bes2600_clear_tx_ac_delta_time(2);
+	bes2600_clear_tx_ac_delta_time(3);
+	tx_bps = priv->dot11TransmittedDataBytes;
+	rx_bps = priv->dot11ReceivedDataBytes;
+	l_tx_cnt = priv->dot11TransmittedFrameCount;
+	l_tx_fail = priv->dot11FailedCount;
+	l_tx_retry = priv->dot11RetryCount;
+	l_rx_cnt = priv->dot11ReceivedFragmentCount;
+	return ;
+}
+
+static struct bes2600_common *txrx_hw_priv = NULL;
+
+static bool bes2600_is_sta_connected(void)
+{
+	if (txrx_hw_priv == NULL)
+		return false;
+	else
+		return true;
+}
+
+void bes2600_txrx_opt_timer_restore(void)
+{
+	if (bes2600_is_sta_connected()) {
+		mod_timer(&txrx_hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
+	}
+}
+
+static void txrx_opt_timer_callback(struct timer_list* data)
+{
+	bes_devel( "####Timer callback function Called time = %lu\n", jiffies);
+	queue_work(txrx_hw_priv->workqueue, &txrx_hw_priv->dynamic_opt_txrx_work);
+}
+
+static void txrx_opt_timer_start(struct bes2600_common *hw_priv)
+{
+	mod_timer(&hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
+}
+
+static void txrx_opt_timer_stop(struct bes2600_common *hw_priv)
+{
+	timer_delete_sync(&hw_priv->txrx_opt_timer);
+}
+
+static void bes2600_set_txrx_opt_default_param(struct bes2600_common * hw_priv)
+{
+	MIB_TXRX_OPT_PARAM g_txrx_param = {2, (PROCTECT_MODE_RTS_CTS | PROCTECT_MODE_RTS_CTS_RETRY), 3000};
+	struct bes2600_vif *priv = __cw12xx_hwpriv_to_vifpriv(hw_priv, 0);
+	struct ieee80211_sta *sta = NULL;
+	int shortgi = 0;
+
+	if (priv == NULL)
+		return;
+
+	/* reset states */
+	cur_pwr_tbl = 1;
+	TXRX_RTS_PROT_CLOSE(cur_rts_thres);
+	last_rts_set_time = -1;
+	memcpy(&hw_priv->txrx_opt_param, &g_txrx_param, sizeof(MIB_TXRX_OPT_PARAM));
+
+	/* reset device states */
+	bes2600_set_txrx_opt_param(hw_priv, priv, &hw_priv->txrx_opt_param);
+	bes2600_set_rts_threshold(hw_priv->hw, -1, cur_rts_thres);	// close rts/cts
+	bes2600_update_pwr_table(hw_priv, priv, cur_pwr_tbl);	// use standard pwr table
+
+	if (priv->join_status == BES2600_JOIN_STATUS_STA) {
+		rcu_read_lock();
+
+		sta = ieee80211_find_sta(priv->vif, priv->vif->bss_conf.bssid);
+		if (sta) {
+			if (sta->deflink.ht_cap.ht_supported &&
+			    ((priv->vif->bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20 &&
+				 sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
+				(priv->vif->bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_40 &&
+				 sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40))) {
+				shortgi = 1;
+			}
+		}
+
+		rcu_read_unlock();
+
+		bes_devel("short gi tx status: %d\n", shortgi);
+		bes2600_enable_tx_shortgi(hw_priv, priv, shortgi);
+	}
+}
+
+static int bes2600_set_txrx_opt_unjoin_param(struct bes2600_common * hw_priv)
+{
+	MIB_TXRX_OPT_PARAM g_txrx_param = {1, 0, 2002};
+	struct bes2600_vif *priv = __cw12xx_hwpriv_to_vifpriv(hw_priv, 0);
+	if (priv == NULL)
+		return 0;
+
+	/* reset states */
+	cur_pwr_tbl = 1;
+	bes2600_update_pwr_table(hw_priv, priv, cur_pwr_tbl);
+	memcpy(&hw_priv->txrx_opt_param, &g_txrx_param, sizeof(MIB_TXRX_OPT_PARAM));
+	bes2600_set_txrx_opt_param(hw_priv, priv, &hw_priv->txrx_opt_param);
+	return 0;
+}
+
+void bes2600_txrx_opt_multivif_connected_handler(struct bes2600_common *hw_priv, bool multivif_connected)
+{
+	struct bes2600_vif *priv = __cw12xx_hwpriv_to_vifpriv(hw_priv, 0);
+
+	if (multivif_connected) {
+		bes2600_set_txrx_opt_default_param(hw_priv);
+	} else {
+		bes_devel("%s, rssi:%d\n", __func__, priv->signal);
+		bes2600_dynamic_opt_rxtx(hw_priv, priv, priv->signal);
+		mod_timer(&hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
+	}
+}
+
+int txrx_opt_timer_init(struct bes2600_vif *priv)
+{
+	struct bes2600_common *hw_priv = cw12xx_vifpriv_to_hwpriv(priv);
+	bes_devel( "txrx_opt_timer_init:%p", txrx_hw_priv);
+	if (priv->if_id != 0)
+		return 0;
+
+	if (!txrx_hw_priv) {
+		txrx_hw_priv = hw_priv;
+		bes_devel( "####Timer init hw_priv = %p\n", txrx_hw_priv);
+		timer_setup(&hw_priv->txrx_opt_timer, txrx_opt_timer_callback, 0);
+		bes2600_set_txrx_opt_default_param(hw_priv);
+	}
+
+	mod_timer(&hw_priv->txrx_opt_timer, jiffies + msecs_to_jiffies(TXRX_OPT_PEROID));
+	bes2600_pwr_register_en_lp_cb(hw_priv, txrx_opt_timer_stop);
+	bes2600_pwr_register_exit_lp_cb(hw_priv, txrx_opt_timer_start);
+	return 0;
+}
+
+void txrx_opt_timer_exit(struct bes2600_vif *priv)
+{
+	struct bes2600_common *hw_priv = cw12xx_vifpriv_to_hwpriv(priv);
+	bes_devel( "txrx_opt_timer_exit");
+
+	if (priv->if_id == 0) {
+		timer_delete_sync(&hw_priv->txrx_opt_timer);
+		cancel_work_sync(&hw_priv->dynamic_opt_txrx_work);
+		bes2600_pwr_unregister_en_lp_cb(hw_priv, txrx_opt_timer_stop);
+		bes2600_pwr_unregister_exit_lp_cb(hw_priv, txrx_opt_timer_start);
+		txrx_hw_priv = NULL;
+		bes2600_set_txrx_opt_unjoin_param(hw_priv);
+	} else if (priv->if_id == 1) {
+		bes2600_txrx_opt_timer_restore();
+	}
+}
+
+
@@ -0,0 +1,38 @@
+
+/***************************************************************************
+ *
+ * Copyright 2015-2022 BES.
+ * All rights reserved. All unpublished rights reserved.
+ *
+ * No part of this work may be used or reproduced in any form or by any
+ * means, or stored in a database or retrieval system, without prior written
+ * permission of BES.
+ *
+ * Use of this work is governed by a license granted by BES.
+ * This work contains confidential and proprietary information of
+ * BES. which is protected by copyright, trade secret,
+ * trademark and other intellectual property rights.
+ *
+ ****************************************************************************/
+#ifndef bes2600_TXRX_OPT_H
+#define bes2600_TXRX_OPT_H
+#include <linux/list.h>
+/* open it for enhance wifi throughput */
+#define BES2600_TX_RX_OPT   1
+
+/* Threshold for powrt table switch */
+#define BES2600_TX_RSSI_LOW     -65
+#define BES2600_TX_RSSI_HIGH    -60
+
+void bes2600_add_tx_ac_delta_time(int ac, uint32_t del_time);
+void bes2600_add_tx_delta_time(uint32_t tx_time);
+void bes2600_rx_status(struct bes2600_vif *priv, struct sk_buff *skb);
+void bes2600_tx_status(struct bes2600_vif *priv, struct sk_buff *skb);
+void bes2600_dynamic_opt_rxtx(struct bes2600_common *hw_priv,struct bes2600_vif *priv, int rssi);
+void bes2600_txrx_opt_multivif_connected_handler(struct bes2600_common *hw_priv, bool multivif_connected);
+void bes2600_txrx_opt_timer_restore(void);
+int txrx_opt_timer_init(struct bes2600_vif *priv);
+void txrx_opt_timer_exit(struct bes2600_vif *priv);
+
+#endif
+
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * Mac80211 driver for BES2600 device
+ * WiFi testmode commands for BES2600
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #ifdef CONFIG_BES2600_TESTMODE
 #include <net/netlink.h>
@@ -1,13 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
- * WSM host interface (HI) implementation for
- * BES2600 mac80211 drivers.
+ * WSM host interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #include <linux/skbuff.h>
@@ -2413,7 +2412,7 @@ int wsm_handle_rx(struct bes2600_common *hw_priv, int id,
 					if (!hw_priv->beacon_bkp)
 						hw_priv->beacon_bkp = \
 						skb_copy(hw_priv->beacon, GFP_ATOMIC);
-					ieee80211_rx_irqsafe(hw_priv->hw, hw_priv->beacon);
+					ieee80211_rx_ni(hw_priv->hw, hw_priv->beacon);
 					hw_priv->beacon = hw_priv->beacon_bkp;

 					hw_priv->beacon_bkp = NULL;
@@ -1,16 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * WSM host interface (HI) interface for BES2600 mac80211 drivers
+ * WSM host interface for BES2600 mac80211 driver
 *
- * Copyright (c) 2022, Bestechnic
- * Author:
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
 *
- * Based on BES2600 UMAC WSM API, which is
- * Copyright (C) SA 2010
- * Author: Stewart Mathers <stewart.mathers@stericsson.com>
+ * Copyright (c) 2022, Bestechnic (Beijing) Co., Ltd.
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */

 #ifndef BES2600_WSM_H_INCLUDED