216 lines
12 KiB
Markdown
216 lines
12 KiB
Markdown
# BES2600 driver — upstream submission prep
|
||
|
||
## Status
|
||
|
||
Six patches, all checkpatch-clean, all deployed and verified on a PineTab2
|
||
(BES2600WM + Rockchip RK3566) running linux-pinetab2 6.19.10-danctnix1.
|
||
Ready for Mobian DKMS merge requests and as the basis for a future
|
||
`drivers/staging/bes2600/` submission to linux-wireless.
|
||
|
||
## The series
|
||
|
||
Recommended submission order (dependency-clean, bisectable):
|
||
|
||
| # | Branch | Commit | Intent |
|
||
|---|--------|--------|--------|
|
||
| 01 | `bes2600/factory-request-firmware` | `1a5d54a` | c1 — Replace `filp_open` + `kernel_read` in the factory-read path with `request_firmware()`. Repoint `FACTORY_PATH` macro to the firmware-class name. Kills a kernel-mainline anti-pattern and the `(NULL device *)` `read and check /lib/firmware/bes2600_factory.txt error` boot spam on PineTab2. |
|
||
| 02 | `bes2600/factory-no-efuse-flag` | `82ba594` | c5 — Default `STANDARD_FACTORY_EFUSE_FLAG` from y to n. The shipped `bes2600_factory.txt` has 30 calibration fields; the driver was expecting 31 (incl. a `##select_efuse_flag` section this firmware doesn't ship). Also drops an inconsistent `#if defined(STANDARD_FACTORY_EFUSE_FLAG)` wrapper around the `wsm_save_factory_txt_to_mcu()` prototype — the definition and call site are always ungated, so the gate broke the build once EFUSE_FLAG=n. |
|
||
| 03 | `bes2600/factory-thread-dev` | `8732881` | c1.1 — Thread `struct device *` through `factory_section_read_file()` via a module-local setter invoked at SDIO probe, so `request_firmware()` gets proper per-device context instead of NULL. Removes the `(NULL device *)` log prefix from factory-related diagnostics. |
|
||
| 04 | `bes2600/pm-gate-on-handshake` | `80178ec` | c2 — Gate the device-end of the LP transition on successful per-VIF firmware handshake. Before: `bes2600_pwr_device_enter_lp_mode()` was called unconditionally even when `wait_for_completion_timeout()` returned 0 (firmware never ack'd). On PineTab2 this produced `bes2600_pwr_enter_lp_mode, wait pm ind timeout` every 5-10s and cascaded into `sdio_tx_work` WARN splats. After: `-ETIMEDOUT` returned cleanly, dmesg silent, SDIO stable. |
|
||
| 05 | `bes2600/remove-chardev-user-interface` | `f43bcc5` | c3 — Remove the custom `/dev/bes2600` character-device interface (fops, command dispatcher, `bes2600_op_*` handlers, `bes2600_load_uevent`, `alloc_chrdev_region`/`class_create`/`device_create` registration, cdev fields in struct bes_cdev). 519-line deletion. Keeps all in-kernel accessor functions (13 callers) and the `fw_type` module parameter as the user-facing replacement. |
|
||
| 06 | `bes2600/enable-testmode` | `9398d30` | c4 — Flip `CONFIG_BES2600_TESTMODE` default from n to y, exposing the driver's mac80211 testmode_cmd surface (dispatches to the firmware's `patch_wifi_testMode` path) through the standard nl80211 testmode interface. Also fixes accumulated bit-rot revealed by enabling the flag: adds compat shim macros in `bes_log.h` for the legacy `bes2600_info()` / `bes2600_err()` / `bes2600_warn()` / `bes2600_dbg()` / `bes2600_err_with_cond()` family (which had no definition anywhere, despite ~41 call sites in testmode code), defines `BES2600_DBG_*` subsystem ids as 0 constants, and marks 3 TSM/roam-delay helpers in sta.c as `static` for `-Werror=missing-prototypes`. |
|
||
|
||
Total: +45 / −576 lines excluding commit messages.
|
||
|
||
## Driver lineage (for the cover letter)
|
||
|
||
The BES2600 Linux driver is a descendant of the ST-Ericsson CW1200 driver
|
||
already in mainline at `drivers/net/wireless/st/cw1200/`. Evidence:
|
||
|
||
- Same author on both: `Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>`
|
||
(visible in the running `modinfo` on ohm and in the mainline cw1200
|
||
commit history).
|
||
- Kconfig option names carry the ancestry: `CONFIG_BES2600_USE_STE_EXTENSIONS`
|
||
(STE = ST-Ericsson), `CONFIG_BES2600_WSM_DEBUG` (WSM = CW1200's host
|
||
↔ firmware Wireless Sensor Module protocol).
|
||
- File-layout parallel: `bh.c`, `hwio.c`, `fwio.c`, `queue.c`, `scan.c`,
|
||
`sta.c`, `txrx.c`, `wsm.c`, `pm.c`, `main.c` — same spine as CW1200,
|
||
plus BES-specific additions (ePTA coexistence, `bes2600_btuart`,
|
||
5 GHz support, `bes_pwr`, `bes2600_factory`, `itp`, `bes_chardev`).
|
||
|
||
ST-Ericsson wound down in 2013; Bestechnic (founded 2015) appears to have
|
||
licensed or acquired the CW1200 IP. No public LKML/linux-wireless RFC
|
||
linking the two has been filed. Bestechnic has never contributed the
|
||
BES2600 driver upstream.
|
||
|
||
## Background on which fork this series lands
|
||
|
||
Upstream today for BES2600 is fragmented:
|
||
|
||
- **`salsa.debian.org/Mobian-team/devices/bes2600-dkms`** — Mobian DKMS
|
||
package, actively maintained (last commit 2025-12). Primary PR target.
|
||
- **`codeberg.org/DanctNIX/linux-pinetab2`** — danctnix kernel fork; ships
|
||
the driver in-tree at `drivers/staging/bes2600/` at tag
|
||
`v6.19.10-danctnix1`.
|
||
- **`gitlab.com/arjanvlek/bes2600`** — original community fork; master was
|
||
sanitized in 2024-10 (`e5055a3 "Removed sources from main branch"`).
|
||
`gitlab.com/TuxThePenguin0/bes2600` preserves the pre-sanitization
|
||
snapshot.
|
||
|
||
The Mobian DKMS tree and the danctnix in-kernel tree have converged — 0-
|
||
hunk diff on `bes_pwr.c`, `bes2600_factory.c`, `wsm.c` between them. This
|
||
series lands on Mobian first (branches already pushed to
|
||
`git.reauktion.de/marfrit/bes2600-dkms`).
|
||
|
||
## Testing
|
||
|
||
Reference hardware: Pine64 PineTab2 (BES2600WM + Rockchip RK3566,
|
||
`8a:2e:77:1f:ec:05`, AP `newton` @ 2.4 GHz ch11 / `TelekomHotspot@ERGO`
|
||
@ 5 GHz ch36).
|
||
|
||
Host kernel: `linux-pinetab2 6.19.10-danctnix1-1-pinetab2` with
|
||
`CONFIG_NL80211_TESTMODE=y`.
|
||
|
||
Per-patch:
|
||
- **c1**: post-reboot dmesg no longer shows `read and check /lib/firmware/
|
||
bes2600_factory.txt error`; `request_firmware()` reads the file cleanly.
|
||
- **c5**: `factory_parse()` now succeeds on the shipped 30-field
|
||
`bes2600_factory.txt`; no `parse fail` / `factory cali data get failed.`
|
||
- **c1.1**: factory-related log lines no longer carry the
|
||
`(NULL device *):` prefix.
|
||
- **c2**: pre-patch dmesg carried ~20-30 `wait pm ind timeout` messages
|
||
per 5 min and 2+ `sdio_tx_work` WARN splats; post-patch both counts are
|
||
0 in the same window. `[RX] Receive failure: 4.` disappears too.
|
||
- **c3**: `/dev/bes2600` character device node is absent post-reboot;
|
||
`lsmod | grep bes2600` still shows both `bes2600` and `bes2600_btuart`
|
||
loaded and associated; WiFi continues to function.
|
||
- **c4**: `iw phy0` now lists `testmode` under *Supported commands*;
|
||
nl80211 testmode interface reachable via `iw phy0 testmode cmd <data>`
|
||
(not exercised end-to-end yet — depends on userspace tooling).
|
||
|
||
Full stack c1+c5+c1.1+c2+c3+c4: WiFi associates and passes traffic across
|
||
3+ reboots.
|
||
|
||
## Known limitations / not-in-this-series
|
||
|
||
- `factory_section_write_file()` in `bes2600_factory.c` still uses
|
||
`kernel_write()` + `filp_open(O_CREAT | O_TRUNC | O_RDWR)` to persist
|
||
per-channel calibration updates back to `/lib/firmware/bes2600_factory.txt`.
|
||
Converting the write-back path to a debugfs or nl80211 testmode
|
||
interface is out of scope here; upstream submission for
|
||
`drivers/staging/` will need to take that on.
|
||
|
||
- `bes_chardev.c` still carries `bes2600_chrdev_write_dpd_data_to_file()`
|
||
(gated `BES2600_WRITE_DPD_TO_FILE`, off by default so dead code in the
|
||
default build) and `bes2600_chrdev_read_and_check_dpd_data()`. Both use
|
||
`filp_open`/`kernel_read`/`kernel_write` and need the same treatment.
|
||
|
||
- `bes_fw.c:587` unconditionally creates `/lib/firmware/bes2002_fw_write.bin`
|
||
via `filp_open(O_CREAT | O_RDWR)` to capture firmware bytes as they are
|
||
sent to the chip. Pure debug helper; should be deleted or gated behind
|
||
a debugfs trigger.
|
||
|
||
- After c3, the `bes2600_chrdev_is_signal_mode()` / `_update_signal_mode()`
|
||
family still reads/writes a `bes_cdev` singleton. Threading
|
||
`struct bes2600_common *` through those call sites (13 files) requires
|
||
first replacing the `fw_type` module_param with a per-phy debugfs knob
|
||
or nl80211 testmode command — a migration that overlaps with c4's
|
||
testmode plumbing. Tracked as c3.1 (deferred).
|
||
|
||
- One residual dmesg notice after the full stack: `bes2600_wlan
|
||
mmc2:0001:1: PS Mode Error, Reason:1` at T+40s on fresh boot. Distinct
|
||
from the pre-c2 `wait pm ind timeout` cascade — benign, driver
|
||
recovers, WiFi stays up. Root cause not investigated; candidate for a
|
||
future c2.1 or firmware-RE follow-up.
|
||
|
||
- Firmware RE (task d) was pursued briefly. The shipped firmware keeps
|
||
many format-string literals (e.g. `patch_HI_Set_Coex_Params, hw_epta_
|
||
enable:0x%x, new_run_flag:0x%x, gEptaBypass: %d`) as dead data — the
|
||
string is in the blob but no code references it in any encoding. The
|
||
compiler kept the literal while dead-stripping the `TRACE()` /
|
||
`patch_*()` callers that would have used it. Takeaway: strings-mining
|
||
overstates the reachable feature surface. A proper firmware RE would
|
||
need function-graph analysis from the reset vector; out of scope here.
|
||
|
||
## Submission routes
|
||
|
||
### Near-term: Mobian DKMS merge request
|
||
|
||
All 6 branches are pushed to `git.reauktion.de/marfrit/bes2600-dkms` with
|
||
upstream set to `salsa.debian.org/Mobian-team/devices/bes2600-dkms`. To
|
||
open an MR against Mobian:
|
||
|
||
1. Create a salsa.debian.org account and add the Gitea-side SSH key.
|
||
2. Push the branches to a personal fork on salsa:
|
||
```
|
||
git remote add salsa git@salsa.debian.org:<user>/bes2600-dkms.git
|
||
for br in \
|
||
bes2600/factory-request-firmware \
|
||
bes2600/factory-no-efuse-flag \
|
||
bes2600/factory-thread-dev \
|
||
bes2600/pm-gate-on-handshake \
|
||
bes2600/remove-chardev-user-interface \
|
||
bes2600/enable-testmode; do
|
||
git push salsa $br
|
||
done
|
||
```
|
||
3. For each branch open an MR against `Mobian-team/devices/bes2600-dkms:mobian`.
|
||
Use the commit message as the MR description (it already reads as a
|
||
standalone rationale).
|
||
4. Consider bundling into a single MR with all 6 commits if the Mobian
|
||
reviewer prefers series review.
|
||
|
||
### Near-term alt: danctnix linux-pinetab2 (codeberg)
|
||
|
||
Danctnix is the de-facto upstream for PineTab2 Arch-ARM images
|
||
(maintainer Danct12). The driver ships in-tree at
|
||
`drivers/staging/bes2600/` in `codeberg.org/DanctNIX/linux-pinetab2`.
|
||
|
||
A danctnix-layout variant of the series (same content, paths rooted at
|
||
`drivers/staging/bes2600/` instead of Mobian's `bes2600/`) is at
|
||
`marfrit/besser/patches/staging-prep-series-danctnix/`. Verified to
|
||
apply cleanly against tag `v6.19.10-danctnix1` and checkpatch-clean.
|
||
|
||
Submission route:
|
||
1. Create a codeberg.org account + add your SSH key.
|
||
2. Fork `DanctNIX/linux-pinetab2` on codeberg; push the 6 commits as a
|
||
branch `bes2600/staging-prep-series`.
|
||
3. Open a codeberg PR against `DanctNIX/linux-pinetab2:master` with
|
||
the cover-letter content as PR description.
|
||
4. Alt: ping Danct12 directly (Matrix / IRC `#pine64` / mastodon
|
||
`@danctnix@social.treehouse.systems`). Their merge workflow may
|
||
be more casual than formal PR review.
|
||
|
||
Mobian and danctnix share the bes2600 source — `bes_pwr.c`,
|
||
`bes2600_factory.c`, `wsm.c` all 0-hunk diff at the patched files.
|
||
Landing in either benefits users of both.
|
||
|
||
### Longer-term: linux-wireless RFC for drivers/staging/bes2600/
|
||
|
||
This series cleans up the Mobian DKMS tree. A proper mainline staging
|
||
submission is bigger work — new Kconfig + Makefile integration under
|
||
`drivers/staging/`, a MAINTAINERS entry for Markus Fritsche + CC Dmitry
|
||
Tarnyagin for CW1200 lineage ack, cover-letter framing the driver as a
|
||
new staging submission with the CW1200 ancestry cited so reviewers can
|
||
contextualise the structural parallels.
|
||
|
||
Gate: the `kernel_write()` / `filp_open()` leftovers (factory write-back,
|
||
DPD-to-file, observe_file debug path) must all go before staging will
|
||
accept it — drivers/staging still has a nominal filter against direct
|
||
filesystem manipulation. Plan those as follow-up patches (c1.2, c1.3,
|
||
c1.4) and include them in the staging series.
|
||
|
||
Recommended linux-wireless CC list for a future RFC:
|
||
- Johannes Berg `<johannes@sipsolutions.net>` (wireless maintainer)
|
||
- Kalle Valo `<kvalo@kernel.org>` (wireless drivers maintainer)
|
||
- Dmitry Tarnyagin (CW1200 author; email may be stale post-ST-Ericsson)
|
||
- Dang Huynh `<dang.huynh@mainlining.org>` (bes2600_btuart.c author)
|
||
- Julian `<mail@julianfairfax.ch>` (Mobian DKMS maintainer)
|
||
- Danct12 (dreemurrs-embedded, PineTab2 kernel maintainer)
|
||
- `linux-wireless@vger.kernel.org`
|
||
- `linux-arm-kernel@lists.infradead.org` (PineTab2 RK3566 context)
|
||
- `linux-staging@lists.linux.dev` (if targeting drivers/staging/)
|
||
|
||
Signed-off-by chain: every patch has one. Tested-on: PineTab2 (BES2600WM +
|
||
RK3566) line on each patch.
|