bes2600: gate device LP-mode entry on successful per-VIF firmware handshake

bes2600_pwr_enter_lp_mode() drives the transition to low-power for each
associated STA VIF: it pushes wsm_set_pm(), waits up to 5 seconds on
pm_enter_cmpl for the firmware to acknowledge, then unconditionally
calls bes2600_pwr_device_enter_lp_mode() to drop the device end of the
bus.

Two bugs:

1. A failed wsm_set_pm() only logs an error, then still falls into
   wait_for_completion_timeout() on a completion the firmware will
   never post (the set-mode command never reached it). The loop
   therefore always blocks the full 5 s, logs a second error, and
   proceeds.

2. A genuine wait-timeout (firmware received the set-mode command but
   never posted the indication) also only logs a warning. The code
   then drops to bes2600_pwr_device_enter_lp_mode(), handing the
   device subsystem an inconsistent view of mac-layer state.

On PineTab2 (BES2600WM + RK3566) the second bug is the recurring
root-cause of the 'bes2600_pwr_enter_lp_mode, wait pm ind timeout'
message flooding dmesg every 5-10 s when the interface is associated
and idle. Sending the device to LP in that state cascades into the
SDIO TX path as the 'bes_sdio_memcpy_to_io_helper / sdio_tx_work'
WARN splat.

Fix:
  - Add a 'timeouts' counter; bump it on both failure paths.
  - Skip the wait_for_completion entirely when wsm_set_pm() failed
    (there is no completion to wait for).
  - Only call bes2600_pwr_device_enter_lp_mode() when every per-VIF
    handshake reached firmware-ACKed completion; otherwise return
    -ETIMEDOUT and leave the device in its current power state.

Tested-on: PineTab2 running linux-pinetab2 6.19.10-danctnix1-1.
Post-patch the handshake still fails on this particular firmware
revision (separate root-cause investigation outside this patch), but
the driver now returns -ETIMEDOUT cleanly instead of flooding dmesg
and destabilising the SDIO path.

Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>

bes2600/bes2600_sdio.c

@@ -94,7 +94,6 @@ struct sbus_priv {
 	struct work_struct tx_work;
 	struct scatterlist tx_sg[BES_SDIO_TX_MULTIPLE_NUM + 1];
 	struct scatterlist tx_sg_nosignal[BES_SDIO_TX_MULTIPLE_NUM_NOSIGNAL + 1];
-	u8 *tx_bounce;
 	u32 tx_data_cnt;
 	u32 tx_xfer_cnt;
 	u32 tx_proc_cnt;
@@ -1136,26 +1135,7 @@ static void sdio_tx_work(struct work_struct *work)
 				}
 			}
 
-			/*
-			 * The transfer length is rounded up to the SDIO block
-			 * size, but tx_buffer->buf is only tx_buffer->len bytes
-			 * long (it usually aliases into an skb linear head).
-			 * Copy into a driver-owned bounce buffer and zero-pad
-			 * to the aligned size; otherwise DMA reads past the
-			 * skb and leaks adjacent kernel memory on the wire --
-			 * observed as KFENCE OOB reads from
-			 * bes_sdio_memcpy_to_io_helper via dma_map_sg.
-			 */
-			if (WARN_ON_ONCE(total_len + align > MAX_SDIO_TRANSFER_LEN))
-				goto flush_previous;
-			memcpy(self->tx_bounce + total_len,
-			       tx_buffer->buf, tx_buffer->len);
-			if (align > tx_buffer->len)
-				memset(self->tx_bounce + total_len +
-				       tx_buffer->len, 0,
-				       align - tx_buffer->len);
-			sg_set_buf(&sg[scatters],
-				   self->tx_bounce + total_len, align);
+			sg_set_buf(&sg[scatters], tx_buffer->buf, align);
 			total_len += align;
 			++scatters;
 /*del_node:*/
@@ -1873,17 +1853,6 @@ static int bes2600_sdio_probe(struct sdio_func *func,
 	if (!self->single_gathered_buffer)
 		return -ENOMEM;
 #endif
-#ifdef BES_SDIO_TX_MULTIPLE_ENABLE
-	self->tx_bounce = (u8 *)__get_dma_pages(GFP_KERNEL,
-					get_order(MAX_SDIO_TRANSFER_LEN));
-	if (!self->tx_bounce) {
-#ifndef SDIO_HOST_ADMA_SUPPORT
-		free_pages((unsigned long)self->single_gathered_buffer,
-			   get_order(MAX_SDIO_TRANSFER_LEN));
-#endif
-		return -ENOMEM;
-	}
-#endif
 #ifdef BES_SDIO_RXTX_TOGGLE
 	self->fw_started = false;
 #endif
@@ -2012,12 +1981,6 @@ static void bes2600_sdio_remove(struct sdio_func *func)
 		if (self->single_gathered_buffer) {
 			free_pages((unsigned long)self->single_gathered_buffer, get_order(MAX_SDIO_TRANSFER_LEN));
 		}
-#endif
-#ifdef BES_SDIO_TX_MULTIPLE_ENABLE
-		if (self->tx_bounce) {
-			free_pages((unsigned long)self->tx_bounce,
-				   get_order(MAX_SDIO_TRANSFER_LEN));
-		}
 #endif
 		kfree(self);
 	}

bes2600/bes_pwr.c

@@ -472,6 +472,7 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 	int i = 0;
 	struct bes2600_vif *priv;
 	int ret = 0;
+	int timeouts = 0;
 	char ip_str[20];
 	unsigned long status = 0;
 
@@ -528,22 +529,35 @@ static int bes2600_pwr_enter_lp_mode(struct bes2600_common *hw_priv)
 				if (ret) {
 					atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
 					bes_err("%s, set operation mode fail\n", __func__);
+					timeouts++;
+					continue;
 				}
 
 				/* wait power save mode changed indication */
 				status = wait_for_completion_timeout(&hw_priv->bes_power.pm_enter_cmpl, 5 * HZ);
 				atomic_set(&hw_priv->bes_power.pm_set_in_process, 0);
 				reinit_completion(&hw_priv->bes_power.pm_enter_cmpl);
-				if (!status)
+				if (!status) {
 					bes_err("%s, wait pm ind timeout\n", __func__);
+					timeouts++;
+				}
 			} else {
 				bes_devel("skip enter lp mode\n");
 			}
 		}
 	}
 
-	/* set device low power configuration */
-	bes2600_pwr_device_enter_lp_mode(hw_priv);
+	/*
+	 * Enter the device-end of the LP transition only if every per-VIF
+	 * mac80211 handshake reached firmware-ACKed completion. Doing the
+	 * device-LP setup while any VIF is still pending leaves the driver
+	 * in an inconsistent state that cascades into SDIO TX errors on
+	 * the BES2600.
+	 */
+	if (timeouts == 0)
+		bes2600_pwr_device_enter_lp_mode(hw_priv);
+	else
+		ret = -ETIMEDOUT;
 
 	return ret;
 }