bes2600/txrx.c

@@ -1942,6 +1942,23 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
 	if (unlikely(bes2600_itp_rxed(hw_priv, skb)))
 		consume_skb(skb);
 	else if (unlikely(early_data)) {
+		/*
+		 * Patch E: when c7 has latched pm_unsupported (firmware
+		 * doesn't honour PSM, see feedback_bes2600_firmware_no_psm),
+		 * AP-side power-save state machine is dead and link entries
+		 * never transition to BES2600_LINK_SOFT.  The double-check
+		 * branch under ps_state_lock is unreachable in that case,
+		 * so skip the per-frame lock acquisition entirely and
+		 * deliver to mac80211 directly.
+		 *
+		 * On firmware that does honour PSM (the latch self-clears
+		 * if a real PM_INDICATION ever arrives — see c7), this
+		 * predicate flips back to false and the original locked
+		 * path is taken.
+		 */
+		if (hw_priv->bes_power.pm_unsupported) {
+			ieee80211_rx_irqsafe(priv->hw, skb);
+		} else {
 			spin_lock_bh(&priv->ps_state_lock);
 			/* Double-check status with lock held */
 			if (entry->status == BES2600_LINK_SOFT)
@@ -1949,6 +1966,7 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
 			else
 				ieee80211_rx_irqsafe(priv->hw, skb);
 			spin_unlock_bh(&priv->ps_state_lock);
+		}
 	} else {
 		ieee80211_rx_irqsafe(priv->hw, skb);
 	}