danctnix-besser: pkgrel=3 — refine Patch I, add SCS-off + GCC15 workaround

Three things bundled because they were verified together in the same
deploy cycle on ohm (kernel built fresh on boltzmann 2026-05-18):

1. 0002 (Patch I) refined: refuse only multi-channel 5 GHz scans
   (n_channels > 1).  Original Patch I refused everything, which
   blocked NM's per-frequency BSS discovery and made 5 GHz association
   impossible.  Tighter guard preserves the storm fix and unblocks
   5 GHz attachment via NM 802-11-wireless.band=a profiles.

   Verified on ohm with pkgrel=3: associated to BSSID
   c0:25:06:e6:5b:33 on 5240 MHz (ch.48), TX 150 Mbit/s MCS 7
   HT40 short-GI vs 72.2 Mbit/s on 2.4 GHz.  Pattern A still 0.

   Source-of-truth: marfrit/bes2600-dkms branch bes2600/scan-filter-5ghz
   commits 093a503 + 8cd10f4 (squashed into this single 0002 file).

2. 0003 (new): arm64 xor-neon Makefile workaround for GCC 15.2.1
   strict pragma validator vs arm_neon.h target() blocks losing
   -ffixed-x18 under SCS=y.  This is a defensive workaround;
   currently dead-coded (SCS=n below) but in place for the day SCS
   re-enable becomes possible (tracked in besser#20).

3. config: CONFIG_SHADOW_CALL_STACK=n override for the current GCC
   15.2.1 toolchain issue.  Restore to =y once GCC upstream fixes
   the arm_neon.h pragma interaction (besser#20).

pkgrel bumped 2 -> 3.

Refs: besser#1 (closed), besser#20, kernel-agent#25 (PR mirroring
this into the kernel-agent patch tree — needs follow-up to pick
up the refinement).

danctnix-besser-pkgbuild/kernel/0002-bes2600-filter-5ghz-scan.patch

@@ -1,7 +1,8 @@
 From 093a5038b8b68f316d976b7cb69609ca7f24f322 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Mon, 18 May 2026 11:27:40 +0200
-Subject: [PATCH] bes2600: filter 5 GHz scans at the driver boundary (besser#1)
+Subject: [PATCH 1/2] bes2600: filter 5 GHz scans at the driver boundary
+ (besser#1)
 
 The BES2600 firmware refuses WSM start-scan for 5 GHz with status 2
 ("rejected by policy").  This shows up in dmesg as the recurring
@@ -89,3 +90,79 @@ index fb1d298..a81afb6 100644
 -- 
 2.54.0
 
+
+From 8cd10f487c8144d462a510812ba0fa717b3e24df Mon Sep 17 00:00:00 2001
+From: Markus Fritsche <fritsche.markus@gmail.com>
+Date: Mon, 18 May 2026 15:56:34 +0200
+Subject: [PATCH 2/2] bes2600: scan-filter-5ghz: allow targeted single-channel
+ scans (besser#1 follow-up)
+
+The original Patch I refused EVERY 5 GHz scan request unconditionally
+(req->n_channels > 0 && band == NL80211_BAND_5GHZ).  This eliminated
+the Pattern A storm but also broke 5 GHz association entirely:
+NM / wpa_supplicant iterates a freq_list when a connection profile
+specifies 802-11-wireless.band=a, issuing per-frequency single-channel
+scans to find the BSS before associating.  Those single-channel scans
+were also refused by our guard, so the BSS was never seen and
+'Wi-Fi network could not be found' was the only outcome.
+
+Tighten the guard: refuse only multi-channel 5 GHz scans (n_channels
+> 1), which is the per-band-sweep pattern mac80211 issues internally
+and the only one that triggers the firmware storm at the per-band
+loop boundary.  Single-channel 5 GHz scans pass through to firmware,
+which generally accepts them -- and when they happen to be rejected,
+the failure is isolated and doesn't cascade.
+
+Verified on ohm with pkgrel=3 (srcversion BEB625FA7443171EA8D55F7):
+  - Pattern A count since boot: 0 (Phase 7 prediction still holds)
+  - iw dev wlan0 scan freq 5180          -> allowed
+  - iw dev wlan0 scan freq 5180 5200 ... -> refused -EOPNOTSUPP
+  - NM 'nmcli connection up' with band=a -> associated to BSSID
+    c0:25:06:e6:5b:33 on 5240 MHz / ch.48 in ~1 second
+  - TX bitrate 150 Mbit/s MCS 7 40MHz short-GI (vs 72.2 Mbit/s
+    HT20 on 2.4 GHz) -- ~2x throughput recovered
+
+The change is a single byte (> 0 -> > 1) plus comment update; the
+test confirmation above is what motivates it.
+
+Refs: besser#1 (closed but tracked for follow-up like this), original
+Patch I sha 093a503.
+---
+ bes2600/scan.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
+index a81afb6..497523b 100644
+--- a/drivers/staging/bes2600/scan.c
++++ b/drivers/staging/bes2600/scan.c
+@@ -248,15 +248,23 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
+ 	 * has req->channels[] from one band only (see ieee80211_prep_hw_scan
+ 	 * in net/mac80211/scan.c).  Refuse the 5 GHz iteration at the driver
+ 	 * boundary so userspace gets a clean aborted-scan for that portion
+-	 * rather than waiting for the firmware reject to cascade up.  5 GHz
+-	 * band registration stays intact so direct-BSSID association to a
+-	 * known 5 GHz AP still works (no scan needed for that path).
++	 * rather than waiting for the firmware reject to cascade up.
++	 *
++	 * Only the multi-channel case is refused (n_channels > 1): that's
++	 * the per-band-sweep pattern mac80211 issues internally and the
++	 * one that triggers the firmware storm at the per-band loop
++	 * boundary.  Single-channel 5 GHz scans (BSS verification, NM's
++	 * per-freq iteration when 802-11-wireless.band=a is set) pass
++	 * through to firmware, which generally accepts them since the
++	 * storm is the back-to-back per-band issue, not a blanket 5 GHz
++	 * reject.  This preserves 5 GHz association via the
++	 * "wpa_supplicant iterates freq_list per channel" path.
+ 	 *
+ 	 * Contract: per include/net/mac80211.h struct ieee80211_ops.hw_scan
+ 	 * documentation, a negative return aborts the scan without requiring
+ 	 * ieee80211_scan_completed().
+ 	 */
+-	if (req->n_channels > 0 &&
++	if (req->n_channels > 1 &&
+ 	    req->channels[0]->band == NL80211_BAND_5GHZ)
+ 		return -EOPNOTSUPP;
+ 
+-- 
+2.54.0
+

danctnix-besser-pkgbuild/kernel/0003-arm64-xor-neon-ffixed-x18-build-fix.patch

@@ -0,0 +1,36 @@
+From: Markus Fritsche <fritsche.markus@gmail.com>
+Date: Mon, 18 May 2026 11:42:00 +0200
+Subject: [PATCH] arm64: xor-neon: restore -ffixed-x18 when SHADOW_CALL_STACK=y
+ (GCC 15+ build fix)
+
+GCC 15.2.1 enforces that -fsanitize=shadow-call-stack requires
+-ffixed-x18 inside arm_neon.h's #pragma GCC target() blocks.  The
+existing CFLAGS_REMOVE_xor-neon.o line strips the kernel-wide
+-ffixed-x18 (it's part of CC_FLAGS_NO_FPU) and CC_FLAGS_FPU does not
+restore it, so xor-neon.c fails to build on stricter GCC versions
+when CONFIG_SHADOW_CALL_STACK=y.
+
+Add an explicit -ffixed-x18 just for this object, gated on the
+SCS config so non-SCS builds are unaffected.
+
+Build environment workaround; not a kernel-runtime bug.
+---
+ arch/arm64/lib/Makefile | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
+index 1234567..2345678 100644
+--- a/arch/arm64/lib/Makefile
++++ b/arch/arm64/lib/Makefile
+@@ -9,6 +9,10 @@ ifeq ($(CONFIG_KERNEL_MODE_NEON), y)
+ obj-$(CONFIG_XOR_BLOCKS)	+= xor-neon.o
+ CFLAGS_xor-neon.o		+= $(CC_FLAGS_FPU)
+ CFLAGS_REMOVE_xor-neon.o	+= $(CC_FLAGS_NO_FPU)
++# GCC 15+ enforces that -fsanitize=shadow-call-stack requires -ffixed-x18
++# even after a #pragma GCC pop_options inside arm_neon.h.  CC_FLAGS_REMOVE
++# above strips the kernel-wide -ffixed-x18 (part of CC_FLAGS_NO_FPU); add
++# it back here so xor-neon.c still compiles when SHADOW_CALL_STACK=y.
++CFLAGS_xor-neon.o		+= $(if $(CONFIG_SHADOW_CALL_STACK),-ffixed-x18)
+ endif
+ 
+ lib-$(CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE) += uaccess_flushcache.o

danctnix-besser-pkgbuild/kernel/PKGBUILD

@@ -11,7 +11,7 @@
 
 pkgbase=linux-pinetab2-danctnix-besser
 pkgver=7.0.danctnix1
-pkgrel=2
+pkgrel=3
 pkgdesc='PineTab2 (BESser bes2600 driver patchset)'
 _srcname=linux-pinetab2
 _srctag=v${pkgver%.*}-${pkgver##*.}
@@ -40,6 +40,8 @@ source=(
   ${_url_git}/releases/download/${_srctag}/${_srctag}.patch.zst{,.sig}
   0001-bes2600-besser-cumulative-series.patch
   0002-bes2600-filter-5ghz-scan.patch
+  0003-arm64-xor-neon-ffixed-x18-build-fix.patch
+  0003-arm64-xor-neon-ffixed-x18-build-fix.patch
   config  # the main kernel config file
 )
 validpgpkeys=(
@@ -52,8 +54,10 @@ b2sums=('3d9795083c8938f80f480de0d10bfd9c525640e59d5c7f22983de3f12ee42c84c31be90
         '71fe98221e802b315e54b4b10d3e8c8f376695a36bae3541d876e5776a37f3fa33c8f8dfa6e51fcbd6f5396add02e5166634165f2351836a0ea0453c172fe56c'
         'SKIP'
         'fca0a5badf762d5dbc085261cccc07ddeef96384d2ae0a426fb0412acd7a180e068cabd59f01342b7575d41889afc0f47dfbc9256801ab809f746278e6dab510'
-        '7efbd3e09f2d37aa1ed185f24775fab76b31036c7eab76f7b0a7950a24b0439c5978afcae80feb248d3e7776fa04e34ffe412a3073cc40677679f77cb18be433'
+        '396acbdcf570eada62533c0b8f505ed18077e8432249bab5b8ac8d1107cabc9489bdb91a5780446237ec4fd9ba5fc57a49dff34c16ddab60dc30513fc535f00f'
-        '19c35c69a4ed40635fb6ad108d2e0ed3d0edc682972255b4a9b719d09e377aa916e533b2e29f4aed256d3a393d77df9e11b661b690acd96edcf61eafe016f55b')
+        '2714e3c0cd8ec978ce9431418f44f578220886fcabb738c9a0c43fc3c043753960b7c47ae96e1780154d8b266a2add6098407de4ffa7aee40d77ce17e8c70df9'
+        '2714e3c0cd8ec978ce9431418f44f578220886fcabb738c9a0c43fc3c043753960b7c47ae96e1780154d8b266a2add6098407de4ffa7aee40d77ce17e8c70df9'
+        '656a998ab40cb85ee4c00f087b071a91632a6c091da2c84b0f74236b51d2dea6e9db6886625f80ad81dc249d8494ec47cd79d6dd9ea4f5e44f3cde857f861e10')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=$pkgbase

danctnix-besser-pkgbuild/kernel/config

@@ -791,7 +791,7 @@ CONFIG_HAVE_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR_STRONG=y
 CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y
-CONFIG_SHADOW_CALL_STACK=y
+# CONFIG_SHADOW_CALL_STACK is not set
 CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
 CONFIG_LTO_NONE=y