From b04c8cd501be4cced3f7b2e4c81f959bab549e0b Mon Sep 17 00:00:00 2001
From: "Claude (noether)" <claude@reauktion.de>
Date: Tue, 19 May 2026 23:44:29 +0200
Subject: [PATCH] patches/driver/bes2600/*-danctnix + arch/arm64/scs-...:
 rebased on danctnix baseline (#29 redo)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #33's per-series mirrors were generated against the bes2600-dkms
cleanups branch (rooted at fe73571) without rebasing onto the
v7.0-danctnix1 kernel baseline. Result: per-commit diffs carried
stale baseline context (e.g. from_timer rather than the new
timer_container_of API), so the cumulative no longer applied cleanly
to ohm's actual base. pkgrel=6 build #1 failed with 'Hunk #3 FAILED'
in Patch D's sta.c.

Fix: in marfrit/bes2600-dkms, create danctnix-sync branch
(fe73571 + drop-in replace bes2600/ with v7.0-danctnix1's
drivers/staging/bes2600/), rebase cleanups onto it as
cleanups-rebased-on-danctnix, manually resolve the resulting conflicts
keeping each commit's intent + the new baseline context, rebase
Patch H accordingly. Format-patch and re-route to the same series-dir
names as PR #33.

Conflict resolution notes:
- 'remove userspace /dev/bes2600 character device interface' commit:
  the chardev wrapper was removed but two utility funcs that danctnix's
  bes2600_btuart.c depends on (bes2600_chrdev_is_bus_error,
  bes2600_chrdev_switch_subsys_glb) were re-added with EXPORT_SYMBOL_GPL.
  bes2600_switch_bt re-added as static (file-local, called only from
  bes2600_chrdev_switch_subsys_glb).
- Patch D (atomicize ba_lock): re-resolved bes2600_ba_timer's
  timer_container_of() vs from_timer() to keep the new API.
- SCS Makefile @@ hunk counts corrected from -9,6 +9,10 to -9,6 +9,11
  (the original was actually wrong; build-via-fuzz was masking it).

Cumulative b2sum: ka-promote ohm now emits
  eb179c03f35a4dbaec2e40036f0033ef04985bb6b14ab22419d68e5caaa5874f...
  (279 554 bytes, 32 patches resolved).

pkgrel=6 built from this manifest + installed on ohm 2026-05-19 ~23:39.
Functional verification: bes2600 + bes2600_btuart both load, Pattern A
0 over fresh boot, wlan0 associates to newton. srcversion
1A919EED0E6DC2478559B17 differs from pkgrel=5's BEB625FA... — the
reconstruction is functionally equivalent (5 GHz working, no
firmware/driver race conditions) but NOT byte-equivalent (the chardev
utility re-add chose different formatting than the original danctnix
code). Byte-equivalence is not a goal; per-series traceability and
working hardware are.

Closes (proper this time): #29.
Refs: #28, #30, #33 (the half-working attempt), #31, #32.
---
 ...-arm64-xor-neon-ffixed-x18-build-fix.patch |   2 +-
 ...e-ba_lock-counters-drop-the-spinlock.patch |  30 ++--
 ...leanup-drop-fossil-blocks-dead-stubs.patch |  14 +-
 ...rm-to-dodge-assoc-comeback-blackhole.patch |  18 +--
 ..._add-with-atomic_inc-cw1200-backport.patch |  14 +-
 ...oy_workqueue-on-error-in-init_common.patch |   8 +-
 ...AF-in-bes2600_hw_scan-and-sched_scan.patch |   4 +-
 ...c80211-reassoc-on-decrypt-fail-storm.patch |  16 +--
 ..._WRITE_DPD_TO_FILE-kernel-file-paths.patch |   2 +-
 ...DATA_DUMP_OBSERVE-and-access_file-IO.patch |   6 +-
 ...S2600_TESTMODE-by-default-fix-bitrot.patch |  10 +-
 ...e-persistence-from-factory-cali-save.patch |   2 +-
 ...equest_firmware-for-factory.txt-read.patch |   2 +-
 ..._FACTORY_EFUSE_FLAG-off-for-PineTab2.patch |   2 +-
 ...ice-through-factory-request_firmware.patch |   4 +-
 ...-identifiers-ST-Ericsson-attribution.patch |  22 +--
 ...mware-via-mmc_hw_reset-on-link-break.patch |   6 +-
 ...SDIO-cards-in-mmc_hw_reset-bus_reset.patch |   4 +-
 ...rmware-does-not-honor-PSM-skip-cycle.patch |   2 +-
 ...P-mode-entry-on-successful-handshake.patch |   2 +-
 ...n-on-pending-request-and-track-state.patch |   2 +-
 ...nd-timeout-from-bes_err-to-bes_devel.patch |   2 +-
 ...handshake-when-chip-confirmed-ACTIVE.patch |   4 +-
 ...s_state_lock-when-PSM-known-disabled.patch |   6 +-
 ...v-bes2600-character-device-interface.patch | 134 ++++++++++++++----
 ...0211_rx_irqsafe-with-ieee80211_rx_ni.patch |  85 +++++++++--
 ...defer-backoff-30s-and-decay-on-quiet.patch |   4 +-
 ...n-and-soften-WARN-on-firmware-reject.patch |   6 +-
 ...-IRQ-bh-direct-no-relay-architecture.patch |  12 +-
 ...DIO-TX-buffers-to-avoid-DMA-OOB-read.patch |   6 +-
 30 files changed, 285 insertions(+), 146 deletions(-)

diff --git a/patches/arch/arm64/scs-arm-neon-build-fix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch b/patches/arch/arm64/scs-arm-neon-build-fix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
index a264806..01966c8 100644
--- a/patches/arch/arm64/scs-arm-neon-build-fix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
+++ b/patches/arch/arm64/scs-arm-neon-build-fix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
@@ -22,7 +22,7 @@ diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
 index 1234567..2345678 100644
 --- a/arch/arm64/lib/Makefile
 +++ b/arch/arm64/lib/Makefile
-@@ -9,6 +9,10 @@ ifeq ($(CONFIG_KERNEL_MODE_NEON), y)
+@@ -9,6 +9,11 @@ ifeq ($(CONFIG_KERNEL_MODE_NEON), y)
  obj-$(CONFIG_XOR_BLOCKS)	+= xor-neon.o
  CFLAGS_xor-neon.o		+= $(CC_FLAGS_FPU)
  CFLAGS_REMOVE_xor-neon.o	+= $(CC_FLAGS_NO_FPU)
diff --git a/patches/driver/bes2600/ba-lock-atomic-danctnix/0001-bes2600-Patch-D-atomicize-ba_lock-counters-drop-the-spinlock.patch b/patches/driver/bes2600/ba-lock-atomic-danctnix/0001-bes2600-Patch-D-atomicize-ba_lock-counters-drop-the-spinlock.patch
index 7947458..fbd7c2a 100644
--- a/patches/driver/bes2600/ba-lock-atomic-danctnix/0001-bes2600-Patch-D-atomicize-ba_lock-counters-drop-the-spinlock.patch
+++ b/patches/driver/bes2600/ba-lock-atomic-danctnix/0001-bes2600-Patch-D-atomicize-ba_lock-counters-drop-the-spinlock.patch
@@ -1,4 +1,4 @@
-From 44b296647be9246c6802a86c082c6507669810b0 Mon Sep 17 00:00:00 2001
+From 8fd20308ed53678c863a0ef52fb2c754e3adc63c Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 8 May 2026 00:17:46 +0200
 Subject: [PATCH 27/29] =?UTF-8?q?bes2600:=20Patch=20D=20=E2=80=94=20atomic?=
@@ -58,10 +58,10 @@ Bestechnic addition rather than the upstream tree.
  5 files changed, 85 insertions(+), 56 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bes2600.h b/drivers/staging/bes2600/bes2600.h
-index ec41141..31a411b 100644
+index 84059c7..32bce5e 100644
 --- a/drivers/staging/bes2600/bes2600.h
 +++ b/drivers/staging/bes2600/bes2600.h
-@@ -356,15 +356,23 @@ struct bes2600_common {
+@@ -353,15 +353,23 @@ struct bes2600_common {
  	* Keeping in common structure for the time being. Will be moved to VIFF
  	* after the mechanism is clear */
  	u8				ba_tid_mask;
@@ -95,7 +95,7 @@ index ec41141..31a411b 100644
  	bool				is_go_thru_go_neg;
  	u8				conf_listen_interval;
 diff --git a/drivers/staging/bes2600/debug.c b/drivers/staging/bes2600/debug.c
-index 0d68392..2d144ac 100644
+index 47e27be..0ab79c0 100644
 --- a/drivers/staging/bes2600/debug.c
 +++ b/drivers/staging/bes2600/debug.c
 @@ -110,17 +110,20 @@ static int bes2600_status_show_common(struct seq_file *seq, void *v)
@@ -125,10 +125,10 @@ index 0d68392..2d144ac 100644
  	seq_puts(seq,   "BES2600 Wireless LAN driver status\n");
  	seq_printf(seq, "Hardware:   %d.%d\n",
 diff --git a/drivers/staging/bes2600/main.c b/drivers/staging/bes2600/main.c
-index 90a8ff8..be375f5 100644
+index 71dc4ae..8fc37b4 100644
 --- a/drivers/staging/bes2600/main.c
 +++ b/drivers/staging/bes2600/main.c
-@@ -490,7 +490,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
+@@ -501,7 +501,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
  	INIT_LIST_HEAD(&hw_priv->event_queue);
  	INIT_WORK(&hw_priv->event_handler, bes2600_event_handler);
  	INIT_WORK(&hw_priv->ba_work, bes2600_ba_work);
@@ -138,10 +138,10 @@ index 90a8ff8..be375f5 100644
  
  	if (unlikely(bes2600_queue_stats_init(&hw_priv->tx_queue_stats,
 diff --git a/drivers/staging/bes2600/sta.c b/drivers/staging/bes2600/sta.c
-index 81f88ed..d94dd2e 100644
+index 70b12f9..8af8150 100644
 --- a/drivers/staging/bes2600/sta.c
 +++ b/drivers/staging/bes2600/sta.c
-@@ -2342,14 +2342,19 @@ void bes2600_join_work(struct work_struct *work)
+@@ -2362,14 +2362,19 @@ void bes2600_join_work(struct work_struct *work)
  		//WARN_ON(wsm_reset(hw_priv, &reset, priv->if_id));
  		WARN_ON(wsm_set_block_ack_policy(hw_priv,
  			0, hw_priv->ba_tid_mask, priv->if_id));
@@ -168,7 +168,7 @@ index 81f88ed..d94dd2e 100644
  
  		mgmt_policy.protectedMgmtEnable = 0;
  		mgmt_policy.unprotectedMgmtFramesAllowed = 1;
-@@ -2629,10 +2634,11 @@ void bes2600_ba_work(struct work_struct *work)
+@@ -2649,10 +2654,11 @@ void bes2600_ba_work(struct work_struct *work)
  		return;*/
  
  	bes_devel("BA work****\n");
@@ -183,12 +183,12 @@ index 81f88ed..d94dd2e 100644
  
  	wsm_lock_tx(hw_priv);
  
-@@ -2645,37 +2651,49 @@ void bes2600_ba_work(struct work_struct *work)
+@@ -2665,37 +2671,49 @@ void bes2600_ba_work(struct work_struct *work)
  void bes2600_ba_timer(struct timer_list *t)
  {
  	bool ba_ena;
 +	int cnt, acc, cnt_rx, acc_rx;
- 	struct bes2600_common *hw_priv = from_timer(hw_priv, t, ba_timer);
+ 	struct bes2600_common *hw_priv = timer_container_of(hw_priv, t, ba_timer);
  
 -	spin_lock_bh(&hw_priv->ba_lock);
 -	bes2600_debug_ba(hw_priv, hw_priv->ba_cnt, hw_priv->ba_acc,
@@ -251,7 +251,7 @@ index 81f88ed..d94dd2e 100644
  			hw_priv->ba_hist = 0;
  #if 0
  			bes_devel("[STA] %s block ACK:\n",
-@@ -2685,9 +2703,6 @@ void bes2600_ba_timer(struct timer_list *t)
+@@ -2705,9 +2723,6 @@ void bes2600_ba_timer(struct timer_list *t)
  		}
  	} else if (hw_priv->ba_hist)
  		--hw_priv->ba_hist;
@@ -262,10 +262,10 @@ index 81f88ed..d94dd2e 100644
  
  int bes2600_vif_setup(struct bes2600_vif *priv)
 diff --git a/drivers/staging/bes2600/txrx.c b/drivers/staging/bes2600/txrx.c
-index 346312c..82ef6fa 100644
+index 3aef009..536b198 100644
 --- a/drivers/staging/bes2600/txrx.c
 +++ b/drivers/staging/bes2600/txrx.c
-@@ -995,14 +995,18 @@ bes2600_tx_h_ba_stat(struct bes2600_vif *priv,
+@@ -996,14 +996,18 @@ bes2600_tx_h_ba_stat(struct bes2600_vif *priv,
  	if (!ieee80211_is_data(t->hdr->frame_control))
  		return;
  
@@ -289,7 +289,7 @@ index 346312c..82ef6fa 100644
  }
  
  static int
-@@ -1629,14 +1633,13 @@ bes2600_rx_h_ba_stat(struct bes2600_vif *priv,
+@@ -1651,14 +1655,13 @@ bes2600_rx_h_ba_stat(struct bes2600_vif *priv,
  	if (!priv->setbssparams_done)
  		return;
  
diff --git a/patches/driver/bes2600/bh-c-fossil-cleanup-danctnix/0001-bes2600-Patch-H-bh.c-hygiene-cleanup-drop-fossil-blocks-dead-stubs.patch b/patches/driver/bes2600/bh-c-fossil-cleanup-danctnix/0001-bes2600-Patch-H-bh.c-hygiene-cleanup-drop-fossil-blocks-dead-stubs.patch
index 330c2d6..f9658b9 100644
--- a/patches/driver/bes2600/bh-c-fossil-cleanup-danctnix/0001-bes2600-Patch-H-bh.c-hygiene-cleanup-drop-fossil-blocks-dead-stubs.patch
+++ b/patches/driver/bes2600/bh-c-fossil-cleanup-danctnix/0001-bes2600-Patch-H-bh.c-hygiene-cleanup-drop-fossil-blocks-dead-stubs.patch
@@ -1,4 +1,4 @@
-From f68fd5530f3bc3c2dc33cc5e3408047ff21a7676 Mon Sep 17 00:00:00 2001
+From 1b5374d35bcc75e0f393e3d841288f91812eb7dc Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 8 May 2026 08:23:20 +0200
 Subject: [PATCH] =?UTF-8?q?bes2600:=20Patch=20H=20=E2=80=94=20bh.c=20hygie?=
@@ -73,10 +73,10 @@ no semantic risk; the deleted code was either #if 0-gated
  3 files changed, 28 insertions(+), 564 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bh.c b/drivers/staging/bes2600/bh.c
-index 0e0888e..e419e35 100644
+index 61f6991..67dfad4 100644
 --- a/drivers/staging/bes2600/bh.c
 +++ b/drivers/staging/bes2600/bh.c
-@@ -316,83 +316,6 @@ int wsm_release_buffer_to_fw(struct bes2600_vif *priv, int count)
+@@ -317,83 +317,6 @@ int wsm_release_buffer_to_fw(struct bes2600_vif *priv, int count)
  }
  #endif
  
@@ -160,7 +160,7 @@ index 0e0888e..e419e35 100644
  
  /* Must be called from BH thraed. */
  void bes2600_enable_powersave(struct bes2600_vif *priv,
-@@ -402,475 +325,6 @@ void bes2600_enable_powersave(struct bes2600_vif *priv,
+@@ -403,475 +326,6 @@ void bes2600_enable_powersave(struct bes2600_vif *priv,
  	priv->powersave_enabled = enable;
  }
  
@@ -636,7 +636,7 @@ index 0e0888e..e419e35 100644
  
  extern int bes2600_bh_read_ctrl_reg(struct bes2600_common *priv, u32 *ctrl_reg);
  
-@@ -1592,7 +1046,15 @@ static int bes2600_bh(void *arg)
+@@ -1599,7 +1053,15 @@ static int bes2600_bh(void *arg)
  
  			tx = 0;
  
@@ -653,7 +653,7 @@ index 0e0888e..e419e35 100644
  			tx_burst = hw_priv->wsm_caps.numInpChBufs - hw_priv->hw_bufs_used;
  			tx_allowed = tx_burst > 0;
  
-@@ -1636,18 +1098,19 @@ static int bes2600_bh(void *arg)
+@@ -1643,18 +1105,19 @@ static int bes2600_bh(void *arg)
  			goto tx;
  
  	done:
@@ -683,7 +683,7 @@ index 0e0888e..e419e35 100644
  	if (!term) {
  		bes_err("[BH] Fatal error, exiting.\n");
  		sdio_work_debug(hw_priv->sbus_priv);
-@@ -1656,4 +1119,3 @@ static int bes2600_bh(void *arg)
+@@ -1663,4 +1126,3 @@ static int bes2600_bh(void *arg)
  	}
  	return 0;
  }
diff --git a/patches/driver/bes2600/connection-loss-fast-recover-danctnix/0001-bes2600-bus_reset-on-connection-loss-storm-to-dodge-assoc-comeback-blackhole.patch b/patches/driver/bes2600/connection-loss-fast-recover-danctnix/0001-bes2600-bus_reset-on-connection-loss-storm-to-dodge-assoc-comeback-blackhole.patch
index b16d98e..7067c87 100644
--- a/patches/driver/bes2600/connection-loss-fast-recover-danctnix/0001-bes2600-bus_reset-on-connection-loss-storm-to-dodge-assoc-comeback-blackhole.patch
+++ b/patches/driver/bes2600/connection-loss-fast-recover-danctnix/0001-bes2600-bus_reset-on-connection-loss-storm-to-dodge-assoc-comeback-blackhole.patch
@@ -1,4 +1,4 @@
-From f2cf586f89d31e297228fabec92dcea5c3fb7165 Mon Sep 17 00:00:00 2001
+From 06fab777454d36ec5178730d8423285c2457d3ba Mon Sep 17 00:00:00 2001
 From: "Claude (noether)" <claude@reauktion.de>
 Date: Thu, 7 May 2026 11:30:09 +0200
 Subject: [PATCH 21/29] bes2600: bus_reset on connection-loss storm to dodge
@@ -122,7 +122,7 @@ index d1375bc..224c62d 100644
  {
  	bool wifi_opened = false;
 diff --git a/drivers/staging/bes2600/bes_chardev.h b/drivers/staging/bes2600/bes_chardev.h
-index 3f0c59b..310ab81 100644
+index ca8419e..2a7cad7 100644
 --- a/drivers/staging/bes2600/bes_chardev.h
 +++ b/drivers/staging/bes2600/bes_chardev.h
 @@ -61,6 +61,7 @@ struct sbus_priv *bes2600_chrdev_get_sbus_priv_data(void);
@@ -147,10 +147,10 @@ index ca223dd..0d68392 100644
  		seq_puts(seq,   "Filter:     promisc\n");
  	else if (priv->rx_filter.fcs)
 diff --git a/drivers/staging/bes2600/main.c b/drivers/staging/bes2600/main.c
-index 9d2aac5..d6da84a 100644
+index 7cbb3a9..ff82f4d 100644
 --- a/drivers/staging/bes2600/main.c
 +++ b/drivers/staging/bes2600/main.c
-@@ -484,6 +484,8 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
+@@ -489,6 +489,8 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
  	spin_lock_init(&hw_priv->rtsvalue_lock);
  	INIT_WORK(&hw_priv->dynamic_opt_txrx_work, bes2600_dynamic_opt_txrx_work);
  	INIT_WORK(&hw_priv->tx_policy_upload_work, tx_policy_upload_work);
@@ -160,10 +160,10 @@ index 9d2aac5..d6da84a 100644
  	INIT_LIST_HEAD(&hw_priv->event_queue);
  	INIT_WORK(&hw_priv->event_handler, bes2600_event_handler);
 diff --git a/drivers/staging/bes2600/sta.c b/drivers/staging/bes2600/sta.c
-index 1b78051..81f88ed 100644
+index 139bdae..5868757 100644
 --- a/drivers/staging/bes2600/sta.c
 +++ b/drivers/staging/bes2600/sta.c
-@@ -266,6 +266,7 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
+@@ -268,6 +268,7 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
  	cancel_work_sync(&hw_priv->coex_work);
  	coex_stop(hw_priv);
  #endif
@@ -171,7 +171,7 @@ index 1b78051..81f88ed 100644
  
  	bes2600_wifi_stop(hw_priv);
  
-@@ -1659,6 +1660,70 @@ report:
+@@ -1675,6 +1676,70 @@ report:
  	spin_unlock(&priv->bss_loss_lock);
  }
  
@@ -242,7 +242,7 @@ index 1b78051..81f88ed 100644
  void bes2600_connection_loss_work(struct work_struct *work)
  {
  	struct bes2600_vif *priv =
-@@ -1668,9 +1733,21 @@ void bes2600_connection_loss_work(struct work_struct *work)
+@@ -1684,9 +1749,21 @@ void bes2600_connection_loss_work(struct work_struct *work)
  
  	bes_devel("[CQM] Reporting connection loss.\n");
  	bes2600_pwr_clear_busy_event(priv->hw_priv, BES_PWR_LOCK_ON_BSS_LOST);
@@ -266,7 +266,7 @@ index 1b78051..81f88ed 100644
  		ieee80211_connection_loss(priv->vif);
  #ifdef WIFI_BT_COEXIST_EPTA_ENABLE
  	// set disconnected in BSS_CHANGED_ASSOC
-@@ -2621,6 +2698,7 @@ int bes2600_vif_setup(struct bes2600_vif *priv)
+@@ -2641,6 +2718,7 @@ int bes2600_vif_setup(struct bes2600_vif *priv)
  	/* Setup per vif workitems and locks */
  	spin_lock_init(&priv->vif_lock);
  	bes2600_decrypt_storm_init(priv);
diff --git a/patches/driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch b/patches/driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch
index 076eb44..6edfd6d 100644
--- a/patches/driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch
+++ b/patches/driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch
@@ -1,4 +1,4 @@
-From 4bc0a34c94094d9e896c5a2f45b54d8be6c0fca7 Mon Sep 17 00:00:00 2001
+From 737f28e29c4b8253939e24b1d6b97d5605bb7ac4 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 21:19:49 +0200
 Subject: [PATCH 22/29] bes2600: replace a set of atomic_add()
@@ -23,10 +23,10 @@ Cherry-picked from upstream Linux:
  2 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bh.c b/drivers/staging/bes2600/bh.c
-index 6385312..1d2773c 100644
+index 175ab5e..fab3bf0 100644
 --- a/drivers/staging/bes2600/bh.c
 +++ b/drivers/staging/bes2600/bh.c
-@@ -101,7 +101,7 @@ void bes2600_unregister_bh(struct bes2600_common *hw_priv)
+@@ -102,7 +102,7 @@ void bes2600_unregister_bh(struct bes2600_common *hw_priv)
  	coex_deinit_mode(hw_priv);
  #endif
  
@@ -35,7 +35,7 @@ index 6385312..1d2773c 100644
  	wake_up(&hw_priv->bh_wq);
  
  	flush_workqueue(hw_priv->bh_workqueue);
-@@ -590,7 +590,7 @@ static int bes2600_bh(void *arg)
+@@ -591,7 +591,7 @@ static int bes2600_bh(void *arg)
  			bes_devel("[BH] Device resume.\n");
  			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
  			wake_up(&hw_priv->bh_evt_wq);
@@ -44,7 +44,7 @@ index 6385312..1d2773c 100644
  			continue;
  		}
  
-@@ -758,9 +758,9 @@ tx:
+@@ -759,9 +759,9 @@ tx:
  
  #if 0 /* count is not implemented */
  				if (ret > 1)
@@ -56,7 +56,7 @@ index 6385312..1d2773c 100644
  #endif
  
  #if defined(CONFIG_BES2600_NON_POWER_OF_TWO_BLOCKSIZES)
-@@ -1134,7 +1134,7 @@ static int bes2600_bh_tx_helper(struct bes2600_common *hw_priv,
+@@ -1135,7 +1135,7 @@ static int bes2600_bh_tx_helper(struct bes2600_common *hw_priv,
  	tx_len += 4;
  #endif
  
@@ -65,7 +65,7 @@ index 6385312..1d2773c 100644
  
  	tx_len = hw_priv->sbus_ops->align_size(
  		hw_priv->sbus_priv, tx_len);
-@@ -1435,7 +1435,7 @@ static int bes2600_bh(void *arg)
+@@ -1442,7 +1442,7 @@ static int bes2600_bh(void *arg)
  			bes_devel("[BH] Device resume.\n");
  			atomic_set(&hw_priv->bh_suspend, BES2600_BH_RESUMED);
  			wake_up(&hw_priv->bh_evt_wq);
diff --git a/patches/driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch b/patches/driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch
index a8e53b6..03f5649 100644
--- a/patches/driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch
+++ b/patches/driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch
@@ -1,4 +1,4 @@
-From 65a4c39914f07bcb0fc01ea78b974e6901d3377d Mon Sep 17 00:00:00 2001
+From 2fb72f06e54172479662257ae4ef9a61d6ba7092 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 21:20:46 +0200
 Subject: [PATCH 23/29] bes2600: fix missing destroy_workqueue() on error in
@@ -34,10 +34,10 @@ Cherry-picked from upstream Linux:
  1 file changed, 2 insertions(+)
 
 diff --git a/drivers/staging/bes2600/main.c b/drivers/staging/bes2600/main.c
-index d6da84a..90a8ff8 100644
+index ff82f4d..89b5e2d 100644
 --- a/drivers/staging/bes2600/main.c
 +++ b/drivers/staging/bes2600/main.c
-@@ -497,6 +497,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
+@@ -502,6 +502,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
  			WLAN_LINK_ID_MAX,
  			bes2600_skb_dtor,
  			hw_priv))) {
@@ -45,7 +45,7 @@ index d6da84a..90a8ff8 100644
  		ieee80211_free_hw(hw);
  		return NULL;
  	}
-@@ -508,6 +509,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
+@@ -513,6 +514,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
  			for (; i > 0; i--)
  				bes2600_queue_deinit(&hw_priv->tx_queue[i - 1]);
  			bes2600_queue_stats_deinit(&hw_priv->tx_queue_stats);
diff --git a/patches/driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch b/patches/driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch
index b3d34d1..9412572 100644
--- a/patches/driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch
+++ b/patches/driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch
@@ -1,4 +1,4 @@
-From b717251598c95bb7ce7822ffa103216598f19b67 Mon Sep 17 00:00:00 2001
+From d9e6361cf0c273f07aee94f24533a5f19e7ed4c0 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 21:24:01 +0200
 Subject: [PATCH 24/29] bes2600: fix concurrency UAF in bes2600_hw_scan and
@@ -38,7 +38,7 @@ Cherry-picked from upstream Linux:
  1 file changed, 22 insertions(+), 15 deletions(-)
 
 diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
-index ad5033b..16b5d0f 100644
+index b944adc..3cd7b64 100644
 --- a/drivers/staging/bes2600/scan.c
 +++ b/drivers/staging/bes2600/scan.c
 @@ -257,18 +257,21 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
diff --git a/patches/driver/bes2600/decrypt-storm-fast-recover-danctnix/0001-bes2600-pre-empt-AP-deauth-6-mac80211-reassoc-on-decrypt-fail-storm.patch b/patches/driver/bes2600/decrypt-storm-fast-recover-danctnix/0001-bes2600-pre-empt-AP-deauth-6-mac80211-reassoc-on-decrypt-fail-storm.patch
index 1195522..d421dee 100644
--- a/patches/driver/bes2600/decrypt-storm-fast-recover-danctnix/0001-bes2600-pre-empt-AP-deauth-6-mac80211-reassoc-on-decrypt-fail-storm.patch
+++ b/patches/driver/bes2600/decrypt-storm-fast-recover-danctnix/0001-bes2600-pre-empt-AP-deauth-6-mac80211-reassoc-on-decrypt-fail-storm.patch
@@ -1,4 +1,4 @@
-From d0f14e3ba7408e81ed4c76941b8a4c7abda0c61b Mon Sep 17 00:00:00 2001
+From 91640bd96d36dd5769b1325e1b2130a95277e0e7 Mon Sep 17 00:00:00 2001
 From: "Claude (noether)" <claude@reauktion.de>
 Date: Wed, 6 May 2026 19:50:52 +0200
 Subject: [PATCH 20/29] bes2600: pre-empt AP-deauth-6 with mac80211 reassoc on
@@ -105,18 +105,18 @@ index 5228b22..ca223dd 100644
  		seq_puts(seq,   "Filter:     promisc\n");
  	else if (priv->rx_filter.fcs)
 diff --git a/drivers/staging/bes2600/sta.c b/drivers/staging/bes2600/sta.c
-index 5f1a456..1b78051 100644
+index bc6d483..139bdae 100644
 --- a/drivers/staging/bes2600/sta.c
 +++ b/drivers/staging/bes2600/sta.c
-@@ -448,6 +448,7 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
+@@ -464,6 +464,7 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
  	cancel_delayed_work_sync(&priv->join_timeout);
  	cancel_delayed_work_sync(&priv->set_cts_work);
  	cancel_delayed_work_sync(&priv->pending_offchanneltx_work);
 +	cancel_work_sync(&priv->decrypt_storm_recover_work);
  
- 	del_timer_sync(&priv->mcast_timeout);
+ 	timer_delete_sync(&priv->mcast_timeout);
  	/* TODO:COMBO: May be reset of these variables "delayed_link_loss and
-@@ -2619,6 +2620,7 @@ int bes2600_vif_setup(struct bes2600_vif *priv)
+@@ -2639,6 +2640,7 @@ int bes2600_vif_setup(struct bes2600_vif *priv)
  
  	/* Setup per vif workitems and locks */
  	spin_lock_init(&priv->vif_lock);
@@ -125,10 +125,10 @@ index 5f1a456..1b78051 100644
  	INIT_DELAYED_WORK(&priv->join_timeout, bes2600_join_timeout);
  	INIT_WORK(&priv->unjoin_work, bes2600_unjoin_work);
 diff --git a/drivers/staging/bes2600/txrx.c b/drivers/staging/bes2600/txrx.c
-index dbd1b23..346312c 100644
+index 017f0d8..f6a66d6 100644
 --- a/drivers/staging/bes2600/txrx.c
 +++ b/drivers/staging/bes2600/txrx.c
-@@ -25,6 +25,78 @@
+@@ -26,6 +26,78 @@
  
  #define BES2600_INVALID_RATE_ID (0xFF)
  
@@ -207,7 +207,7 @@ index dbd1b23..346312c 100644
  #ifdef CONFIG_BES2600_TESTMODE
  #include "bes_nl80211_testmode_msg.h"
  #endif /* CONFIG_BES2600_TESTMODE */
-@@ -1672,6 +1744,8 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
+@@ -1694,6 +1766,8 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
  			goto drop;
  		} else {
  			bes_warn("[RX] Receive failure: %d.\n", arg->status);
diff --git a/patches/driver/bes2600/drop-dpd-file-paths-danctnix/0001-bes2600-drop-BES2600_WRITE_DPD_TO_FILE-kernel-file-paths.patch b/patches/driver/bes2600/drop-dpd-file-paths-danctnix/0001-bes2600-drop-BES2600_WRITE_DPD_TO_FILE-kernel-file-paths.patch
index b2cab67..daba677 100644
--- a/patches/driver/bes2600/drop-dpd-file-paths-danctnix/0001-bes2600-drop-BES2600_WRITE_DPD_TO_FILE-kernel-file-paths.patch
+++ b/patches/driver/bes2600/drop-dpd-file-paths-danctnix/0001-bes2600-drop-BES2600_WRITE_DPD_TO_FILE-kernel-file-paths.patch
@@ -1,4 +1,4 @@
-From ef24cdb8918b72006226ff18c4a8b9b504879510 Mon Sep 17 00:00:00 2001
+From 0768e11da638457b3455e426de924f9e2e551641 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 23 Apr 2026 20:04:11 +0200
 Subject: [PATCH 09/29] bes2600: drop BES2600_WRITE_DPD_TO_FILE kernel_*() file
diff --git a/patches/driver/bes2600/drop-orphan-file-io-danctnix/0001-bes2600-drop-orphan-DATA_DUMP_OBSERVE-and-access_file-IO.patch b/patches/driver/bes2600/drop-orphan-file-io-danctnix/0001-bes2600-drop-orphan-DATA_DUMP_OBSERVE-and-access_file-IO.patch
index dec48e0..27733e5 100644
--- a/patches/driver/bes2600/drop-orphan-file-io-danctnix/0001-bes2600-drop-orphan-DATA_DUMP_OBSERVE-and-access_file-IO.patch
+++ b/patches/driver/bes2600/drop-orphan-file-io-danctnix/0001-bes2600-drop-orphan-DATA_DUMP_OBSERVE-and-access_file-IO.patch
@@ -1,4 +1,4 @@
-From ebb5c579889e8cf98bdfe0f1b317e89cbb692948 Mon Sep 17 00:00:00 2001
+From c3d28aea4603fec51b66cfa438dd546722d53272 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 23 Apr 2026 20:19:27 +0200
 Subject: [PATCH 10/29] bes2600: drop orphan DATA_DUMP_OBSERVE and
@@ -118,10 +118,10 @@ index 133c945..d612c3c 100644
  	kfree(short_buf);
  	release_firmware(fw_bin);
 diff --git a/drivers/staging/bes2600/main.c b/drivers/staging/bes2600/main.c
-index 6ed6b15..9d2aac5 100644
+index 3b0b7a3..7cbb3a9 100644
 --- a/drivers/staging/bes2600/main.c
 +++ b/drivers/staging/bes2600/main.c
-@@ -790,41 +790,6 @@ void bes2600_core_release(struct bes2600_common *self)
+@@ -795,41 +795,6 @@ void bes2600_core_release(struct bes2600_common *self)
  	return;
  }
  
diff --git a/patches/driver/bes2600/enable-testmode/0001-bes2600-enable-CONFIG_BES2600_TESTMODE-by-default-fix-bitrot.patch b/patches/driver/bes2600/enable-testmode/0001-bes2600-enable-CONFIG_BES2600_TESTMODE-by-default-fix-bitrot.patch
index 5761984..86de395 100644
--- a/patches/driver/bes2600/enable-testmode/0001-bes2600-enable-CONFIG_BES2600_TESTMODE-by-default-fix-bitrot.patch
+++ b/patches/driver/bes2600/enable-testmode/0001-bes2600-enable-CONFIG_BES2600_TESTMODE-by-default-fix-bitrot.patch
@@ -1,4 +1,4 @@
-From 9012b74eea8d540c8637d7645093204d1e94e99a Mon Sep 17 00:00:00 2001
+From 789ab98e4cd4a0c2c43a54da6462b6b05f3af8f2 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Wed, 22 Apr 2026 13:04:27 +0200
 Subject: [PATCH 06/29] bes2600: enable CONFIG_BES2600_TESTMODE by default +
@@ -108,10 +108,10 @@ index 605cea8..65cf703 100644
 +			bes_err(fmt, ##__VA_ARGS__);		\
 +	} while (0)
 diff --git a/drivers/staging/bes2600/sta.c b/drivers/staging/bes2600/sta.c
-index aa69eb8..5f1a456 100644
+index ca1c77c..bc6d483 100644
 --- a/drivers/staging/bes2600/sta.c
 +++ b/drivers/staging/bes2600/sta.c
-@@ -3633,7 +3633,7 @@ static int bes2600_set_power_save(struct ieee80211_hw *hw,
+@@ -3654,7 +3654,7 @@ static int bes2600_set_power_save(struct ieee80211_hw *hw,
   *
   * Returns: 0 on success or non zero value on failure
   */
@@ -120,7 +120,7 @@ index aa69eb8..5f1a456 100644
  {
  	struct bes_msg_start_stop_tsm *start_stop_tsm =
  		(struct bes_msg_start_stop_tsm *) data;
-@@ -3663,7 +3663,7 @@ int bes2600_start_stop_tsm(struct ieee80211_hw *hw, void *data)
+@@ -3684,7 +3684,7 @@ int bes2600_start_stop_tsm(struct ieee80211_hw *hw, void *data)
   *
   * Returns: TSM parameters collected
   */
@@ -129,7 +129,7 @@ index aa69eb8..5f1a456 100644
  {
  	struct bes2600_common *hw_priv = hw->priv;
  	struct bes_tsm_stats tsm_stats;
-@@ -3703,7 +3703,7 @@ int bes2600_get_tsm_params(struct ieee80211_hw *hw)
+@@ -3724,7 +3724,7 @@ int bes2600_get_tsm_params(struct ieee80211_hw *hw)
   *
   * Returns: Returns the last measured roam delay
   */
diff --git a/patches/driver/bes2600/factory-drop-kernel-write-danctnix/0001-bes2600-drop-kernel_write-persistence-from-factory-cali-save.patch b/patches/driver/bes2600/factory-drop-kernel-write-danctnix/0001-bes2600-drop-kernel_write-persistence-from-factory-cali-save.patch
index 85491fe..5c65e84 100644
--- a/patches/driver/bes2600/factory-drop-kernel-write-danctnix/0001-bes2600-drop-kernel_write-persistence-from-factory-cali-save.patch
+++ b/patches/driver/bes2600/factory-drop-kernel-write-danctnix/0001-bes2600-drop-kernel_write-persistence-from-factory-cali-save.patch
@@ -1,4 +1,4 @@
-From 64eae76f4e237fa3149c858a7b1ac07b67559970 Mon Sep 17 00:00:00 2001
+From 0c1f98df59fc3c330b370f1b5b54e8d780278d2a Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 23 Apr 2026 19:31:25 +0200
 Subject: [PATCH 08/29] bes2600: drop kernel_write() persistence from factory
diff --git a/patches/driver/bes2600/factory-series/0001-bes2600-use-request_firmware-for-factory.txt-read.patch b/patches/driver/bes2600/factory-series/0001-bes2600-use-request_firmware-for-factory.txt-read.patch
index b8d66fd..6c188c4 100644
--- a/patches/driver/bes2600/factory-series/0001-bes2600-use-request_firmware-for-factory.txt-read.patch
+++ b/patches/driver/bes2600/factory-series/0001-bes2600-use-request_firmware-for-factory.txt-read.patch
@@ -1,4 +1,4 @@
-From b76c9904f88e3147644960925d8c9835341e99d7 Mon Sep 17 00:00:00 2001
+From 4a1bbc7444c94be044fae4377ccd612a6cd28460 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Wed, 22 Apr 2026 10:09:44 +0200
 Subject: [PATCH 01/29] bes2600: use request_firmware() for factory.txt read
diff --git a/patches/driver/bes2600/factory-series/0002-bes2600-default-STANDARD_FACTORY_EFUSE_FLAG-off-for-PineTab2.patch b/patches/driver/bes2600/factory-series/0002-bes2600-default-STANDARD_FACTORY_EFUSE_FLAG-off-for-PineTab2.patch
index 350ed82..60dce47 100644
--- a/patches/driver/bes2600/factory-series/0002-bes2600-default-STANDARD_FACTORY_EFUSE_FLAG-off-for-PineTab2.patch
+++ b/patches/driver/bes2600/factory-series/0002-bes2600-default-STANDARD_FACTORY_EFUSE_FLAG-off-for-PineTab2.patch
@@ -1,4 +1,4 @@
-From 98c6e363f0522ded02b06802f003f3c2f168e564 Mon Sep 17 00:00:00 2001
+From 13dd191defab19294d843218833860d0e1e33dcd Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Wed, 22 Apr 2026 12:17:56 +0200
 Subject: [PATCH 02/29] bes2600: default STANDARD_FACTORY_EFUSE_FLAG off for
diff --git a/patches/driver/bes2600/factory-thread-dev/0001-bes2600-thread-struct-device-through-factory-request_firmware.patch b/patches/driver/bes2600/factory-thread-dev/0001-bes2600-thread-struct-device-through-factory-request_firmware.patch
index a5595f6..de89ddf 100644
--- a/patches/driver/bes2600/factory-thread-dev/0001-bes2600-thread-struct-device-through-factory-request_firmware.patch
+++ b/patches/driver/bes2600/factory-thread-dev/0001-bes2600-thread-struct-device-through-factory-request_firmware.patch
@@ -1,4 +1,4 @@
-From 20d349e2b5bffe25c17af2612d179b42e27c7414 Mon Sep 17 00:00:00 2001
+From 40a0a1a0c72ae5b4ee538f6e8a5d0def522606af Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Wed, 22 Apr 2026 13:18:38 +0200
 Subject: [PATCH 03/29] bes2600: thread struct device * through factory
@@ -90,7 +90,7 @@ index 3835b0d..7dbe9f8 100644
  u8* bes2600_get_factory_cali_data(u8 *file_buffer, u32 *data_len, char *path);
  void factory_little_endian_cvrt(u8 *data);
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index b595365..371ef4f 100644
+index 13d4ff1..f172d53 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -30,6 +30,7 @@
diff --git a/patches/driver/bes2600/license-spdx-restore-attribution-danctnix/0001-bes2600-Patch-G-restore-SPDX-identifiers-ST-Ericsson-attribution.patch b/patches/driver/bes2600/license-spdx-restore-attribution-danctnix/0001-bes2600-Patch-G-restore-SPDX-identifiers-ST-Ericsson-attribution.patch
index 2f49393..f298122 100644
--- a/patches/driver/bes2600/license-spdx-restore-attribution-danctnix/0001-bes2600-Patch-G-restore-SPDX-identifiers-ST-Ericsson-attribution.patch
+++ b/patches/driver/bes2600/license-spdx-restore-attribution-danctnix/0001-bes2600-Patch-G-restore-SPDX-identifiers-ST-Ericsson-attribution.patch
@@ -1,4 +1,4 @@
-From 8dd79199f8a09ee3af6853e01a2ab3bab7684d81 Mon Sep 17 00:00:00 2001
+From b9e340c78cf7111dd29c9b31dae5fe73d8b5ceec Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 8 May 2026 00:03:50 +0200
 Subject: [PATCH 26/29] =?UTF-8?q?bes2600:=20Patch=20G=20=E2=80=94=20restor?=
@@ -103,7 +103,7 @@ copyrights is now resolved.
  48 files changed, 223 insertions(+), 292 deletions(-)
 
 diff --git a/drivers/staging/bes2600/ap.c b/drivers/staging/bes2600/ap.c
-index 71660d4..0a23790 100644
+index 7b1e3b4..8a17545 100644
 --- a/drivers/staging/bes2600/ap.c
 +++ b/drivers/staging/bes2600/ap.c
 @@ -1,12 +1,9 @@
@@ -230,7 +230,7 @@ index 63c3275..ebec635 100644
  #ifndef BES2600_PLAT_H_INCLUDED
  #define BES2600_PLAT_H_INCLUDED
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index b6b4e4e..3abda2a 100644
+index 3834032..e85c524 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -1,12 +1,13 @@
@@ -274,7 +274,7 @@ index 224c62d..02dcd43 100644
  #include<linux/module.h>
  #include <linux/init.h>
 diff --git a/drivers/staging/bes2600/bes_chardev.h b/drivers/staging/bes2600/bes_chardev.h
-index 310ab81..3e4eee6 100644
+index 2a7cad7..9edb206 100644
 --- a/drivers/staging/bes2600/bes_chardev.h
 +++ b/drivers/staging/bes2600/bes_chardev.h
 @@ -1,12 +1,9 @@
@@ -429,7 +429,7 @@ index 92de90b..49477b3 100644
  #ifndef __BES_PWR_H__
  #define __BES_PWR_H__
 diff --git a/drivers/staging/bes2600/bh.c b/drivers/staging/bes2600/bh.c
-index d5a8c77..0e0888e 100644
+index febcaf4..61f6991 100644
 --- a/drivers/staging/bes2600/bh.c
 +++ b/drivers/staging/bes2600/bh.c
 @@ -1,12 +1,12 @@
@@ -758,7 +758,7 @@ index 5cfba46..bec3647 100644
  
  #ifndef BES2600_ITP_H_INCLUDED
 diff --git a/drivers/staging/bes2600/main.c b/drivers/staging/bes2600/main.c
-index 90a8ff8..19f196f 100644
+index 89b5e2d..71dc4ae 100644
 --- a/drivers/staging/bes2600/main.c
 +++ b/drivers/staging/bes2600/main.c
 @@ -1,12 +1,18 @@
@@ -833,7 +833,7 @@ index 0f6943e..ae70453 100644
  
  #ifndef PM_H_INCLUDED
 diff --git a/drivers/staging/bes2600/queue.c b/drivers/staging/bes2600/queue.c
-index f050df6..cc606c1 100644
+index d1b407b..b56ca43 100644
 --- a/drivers/staging/bes2600/queue.c
 +++ b/drivers/staging/bes2600/queue.c
 @@ -1,12 +1,12 @@
@@ -902,7 +902,7 @@ index 96b1d4c..43c2dae 100644
  
  #ifndef BES2600_SBUS_H
 diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
-index 16b5d0f..fb1d298 100644
+index 3cd7b64..1905471 100644
 --- a/drivers/staging/bes2600/scan.c
 +++ b/drivers/staging/bes2600/scan.c
 @@ -1,12 +1,12 @@
@@ -948,7 +948,7 @@ index 1f3adea..295be18 100644
  
  #ifndef SCAN_H_INCLUDED
 diff --git a/drivers/staging/bes2600/sta.c b/drivers/staging/bes2600/sta.c
-index 81f88ed..bfd8ae9 100644
+index 5868757..70b12f9 100644
 --- a/drivers/staging/bes2600/sta.c
 +++ b/drivers/staging/bes2600/sta.c
 @@ -1,12 +1,12 @@
@@ -971,7 +971,7 @@ index 81f88ed..bfd8ae9 100644
  
  #include <linux/vmalloc.h>
 diff --git a/drivers/staging/bes2600/sta.h b/drivers/staging/bes2600/sta.h
-index e4e266c..6ea3b0f 100644
+index 39b4b1a..a174e04 100644
 --- a/drivers/staging/bes2600/sta.h
 +++ b/drivers/staging/bes2600/sta.h
 @@ -1,12 +1,12 @@
@@ -1034,7 +1034,7 @@ index de82b30..7f42c04 100644
  #ifndef __TX_LOOP_H__
  #define __TX_LOOP_H__
 diff --git a/drivers/staging/bes2600/txrx.c b/drivers/staging/bes2600/txrx.c
-index 346312c..7cdb7de 100644
+index f6a66d6..3aef009 100644
 --- a/drivers/staging/bes2600/txrx.c
 +++ b/drivers/staging/bes2600/txrx.c
 @@ -1,12 +1,12 @@
diff --git a/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0001-bes2600-recover-wedged-firmware-via-mmc_hw_reset-on-link-break.patch b/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0001-bes2600-recover-wedged-firmware-via-mmc_hw_reset-on-link-break.patch
index 076c244..913326e 100644
--- a/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0001-bes2600-recover-wedged-firmware-via-mmc_hw_reset-on-link-break.patch
+++ b/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0001-bes2600-recover-wedged-firmware-via-mmc_hw_reset-on-link-break.patch
@@ -1,4 +1,4 @@
-From 0dde479994a84f9e968b327d5409c3a926acb69c Mon Sep 17 00:00:00 2001
+From 22b799f5a21c0046aad46676519e5f03a0d105fd Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Sun, 26 Apr 2026 22:31:58 +0200
 Subject: [PATCH 15/29] bes2600: recover wedged firmware via mmc_hw_reset on
@@ -85,7 +85,7 @@ Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
  4 files changed, 95 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index 3e04e8c..e5840c8 100644
+index b9d836f..f7f86d7 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -16,6 +16,7 @@
@@ -216,7 +216,7 @@ index a02d6d9..d1375bc 100644
  						bes2600_cdev.sbus_priv);
  		}
 diff --git a/drivers/staging/bes2600/bes_chardev.h b/drivers/staging/bes2600/bes_chardev.h
-index 15602ba..3f0c59b 100644
+index c627bb7..ca8419e 100644
 --- a/drivers/staging/bes2600/bes_chardev.h
 +++ b/drivers/staging/bes2600/bes_chardev.h
 @@ -60,6 +60,7 @@ struct sbus_priv *bes2600_chrdev_get_sbus_priv_data(void);
diff --git a/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0002-bes2600-handle-multi-function-SDIO-cards-in-mmc_hw_reset-bus_reset.patch b/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0002-bes2600-handle-multi-function-SDIO-cards-in-mmc_hw_reset-bus_reset.patch
index c4a387d..dc55f3e 100644
--- a/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0002-bes2600-handle-multi-function-SDIO-cards-in-mmc_hw_reset-bus_reset.patch
+++ b/patches/driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0002-bes2600-handle-multi-function-SDIO-cards-in-mmc_hw_reset-bus_reset.patch
@@ -1,4 +1,4 @@
-From 80e5e68c223b676698288fde62e527b96e1ac8e2 Mon Sep 17 00:00:00 2001
+From 3942404ae16b134a55e48cb796d625b8b90e504f Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Tue, 28 Apr 2026 21:37:37 +0200
 Subject: [PATCH 19/29] bes2600: handle multi-function SDIO cards in
@@ -41,7 +41,7 @@ Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
  1 file changed, 23 insertions(+), 1 deletion(-)
 
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index c9cb073..b998381 100644
+index 5a0694a..c81c244 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -1810,10 +1810,32 @@ static void bes2600_sdio_halt_device(struct sbus_priv *self)
diff --git a/patches/driver/bes2600/pm-detect-firmware-unsupported-danctnix/0001-bes2600-self-detect-firmware-does-not-honor-PSM-skip-cycle.patch b/patches/driver/bes2600/pm-detect-firmware-unsupported-danctnix/0001-bes2600-self-detect-firmware-does-not-honor-PSM-skip-cycle.patch
index f662f60..670cc1c 100644
--- a/patches/driver/bes2600/pm-detect-firmware-unsupported-danctnix/0001-bes2600-self-detect-firmware-does-not-honor-PSM-skip-cycle.patch
+++ b/patches/driver/bes2600/pm-detect-firmware-unsupported-danctnix/0001-bes2600-self-detect-firmware-does-not-honor-PSM-skip-cycle.patch
@@ -1,4 +1,4 @@
-From 983bd62dd0ba9b25dfb986f39fc5a79145da6008 Mon Sep 17 00:00:00 2001
+From dc1505f5bab24c5f0960dcc612ce51cd2e5aeddf Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Tue, 28 Apr 2026 16:54:06 +0200
 Subject: [PATCH 18/29] bes2600: self-detect when firmware does not honor PSM
diff --git a/patches/driver/bes2600/pm-gate-on-handshake/0001-bes2600-gate-device-LP-mode-entry-on-successful-handshake.patch b/patches/driver/bes2600/pm-gate-on-handshake/0001-bes2600-gate-device-LP-mode-entry-on-successful-handshake.patch
index 49432f4..b6adb53 100644
--- a/patches/driver/bes2600/pm-gate-on-handshake/0001-bes2600-gate-device-LP-mode-entry-on-successful-handshake.patch
+++ b/patches/driver/bes2600/pm-gate-on-handshake/0001-bes2600-gate-device-LP-mode-entry-on-successful-handshake.patch
@@ -1,4 +1,4 @@
-From 19feb8181a75caa13442f5ac436b4014e68fe416 Mon Sep 17 00:00:00 2001
+From e8550e55fc7d3910ee690359d89d96c86cfb0347 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Wed, 22 Apr 2026 12:37:45 +0200
 Subject: [PATCH 04/29] bes2600: gate device LP-mode entry on successful
diff --git a/patches/driver/bes2600/pm-state-resync-danctnix/0001-bes2600-gate-PM-indication-completion-on-pending-request-and-track-state.patch b/patches/driver/bes2600/pm-state-resync-danctnix/0001-bes2600-gate-PM-indication-completion-on-pending-request-and-track-state.patch
index fcc8215..eb3f573 100644
--- a/patches/driver/bes2600/pm-state-resync-danctnix/0001-bes2600-gate-PM-indication-completion-on-pending-request-and-track-state.patch
+++ b/patches/driver/bes2600/pm-state-resync-danctnix/0001-bes2600-gate-PM-indication-completion-on-pending-request-and-track-state.patch
@@ -1,4 +1,4 @@
-From 6168e9d34036bb6586be9ecb4f67f15401471aa0 Mon Sep 17 00:00:00 2001
+From 40aec44a6e4de5aaf0066982601c99e648b0f1ec Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Tue, 28 Apr 2026 15:05:27 +0200
 Subject: [PATCH 16/29] bes2600: gate PM indication completion on pending
diff --git a/patches/driver/bes2600/pm-timeout-silence-danctnix/0001-bes2600-demote-wait-pm-ind-timeout-from-bes_err-to-bes_devel.patch b/patches/driver/bes2600/pm-timeout-silence-danctnix/0001-bes2600-demote-wait-pm-ind-timeout-from-bes_err-to-bes_devel.patch
index 277a001..e1305a6 100644
--- a/patches/driver/bes2600/pm-timeout-silence-danctnix/0001-bes2600-demote-wait-pm-ind-timeout-from-bes_err-to-bes_devel.patch
+++ b/patches/driver/bes2600/pm-timeout-silence-danctnix/0001-bes2600-demote-wait-pm-ind-timeout-from-bes_err-to-bes_devel.patch
@@ -1,4 +1,4 @@
-From 88557185112dafbfba0053e9b5229125a97f5154 Mon Sep 17 00:00:00 2001
+From 894c502cd541079a8a26d61cd4289af9001b3046 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 23 Apr 2026 20:35:17 +0200
 Subject: [PATCH 11/29] bes2600: demote 'wait pm ind timeout' from bes_err to
diff --git a/patches/driver/bes2600/pm-wake-consume-state-danctnix/0001-bes2600-short-circuit-wake-handshake-when-chip-confirmed-ACTIVE.patch b/patches/driver/bes2600/pm-wake-consume-state-danctnix/0001-bes2600-short-circuit-wake-handshake-when-chip-confirmed-ACTIVE.patch
index 6c477d7..7cba6b9 100644
--- a/patches/driver/bes2600/pm-wake-consume-state-danctnix/0001-bes2600-short-circuit-wake-handshake-when-chip-confirmed-ACTIVE.patch
+++ b/patches/driver/bes2600/pm-wake-consume-state-danctnix/0001-bes2600-short-circuit-wake-handshake-when-chip-confirmed-ACTIVE.patch
@@ -1,4 +1,4 @@
-From b7c4b0fc39f498376a38279b9745a55fc2141fc3 Mon Sep 17 00:00:00 2001
+From 7a65dc374c671e20bd6303959ff234a179bc9ff7 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Tue, 28 Apr 2026 15:23:34 +0200
 Subject: [PATCH 17/29] bes2600: short-circuit wake handshake when chip is
@@ -80,7 +80,7 @@ Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
  2 files changed, 62 insertions(+), 9 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index e5840c8..c9cb073 100644
+index f7f86d7..5a0694a 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -1389,7 +1389,14 @@ static void bes2600_gpio_wakeup_mcu(struct sbus_priv *self, int flag)
diff --git a/patches/driver/bes2600/ps-state-lock-skip-pm-disabled-danctnix/0001-bes2600-Patch-E-skip-ps_state_lock-when-PSM-known-disabled.patch b/patches/driver/bes2600/ps-state-lock-skip-pm-disabled-danctnix/0001-bes2600-Patch-E-skip-ps_state_lock-when-PSM-known-disabled.patch
index fe34fbc..24c920a 100644
--- a/patches/driver/bes2600/ps-state-lock-skip-pm-disabled-danctnix/0001-bes2600-Patch-E-skip-ps_state_lock-when-PSM-known-disabled.patch
+++ b/patches/driver/bes2600/ps-state-lock-skip-pm-disabled-danctnix/0001-bes2600-Patch-E-skip-ps_state_lock-when-PSM-known-disabled.patch
@@ -1,4 +1,4 @@
-From 4be43770fd03391df66f9043280d55764e477221 Mon Sep 17 00:00:00 2001
+From 445c619da88d69adf68e8cae08ad1b53f76fe57d Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 8 May 2026 00:22:14 +0200
 Subject: [PATCH 28/29] =?UTF-8?q?bes2600:=20Patch=20E=20=E2=80=94=20skip?=
@@ -37,10 +37,10 @@ Build verified: srcversion B5922B4933590F33207EE97 on ohm sandbox.
  1 file changed, 24 insertions(+), 6 deletions(-)
 
 diff --git a/drivers/staging/bes2600/txrx.c b/drivers/staging/bes2600/txrx.c
-index 84c34bc..bf17777 100644
+index 536b198..cb718ad 100644
 --- a/drivers/staging/bes2600/txrx.c
 +++ b/drivers/staging/bes2600/txrx.c
-@@ -1942,13 +1942,31 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
+@@ -1965,13 +1965,31 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
  	if (unlikely(bes2600_itp_rxed(hw_priv, skb)))
  		consume_skb(skb);
  	else if (unlikely(early_data)) {
diff --git a/patches/driver/bes2600/remove-chardev-user-interface/0001-bes2600-remove-userspace-dev-bes2600-character-device-interface.patch b/patches/driver/bes2600/remove-chardev-user-interface/0001-bes2600-remove-userspace-dev-bes2600-character-device-interface.patch
index 7c26b2c..aad3bfb 100644
--- a/patches/driver/bes2600/remove-chardev-user-interface/0001-bes2600-remove-userspace-dev-bes2600-character-device-interface.patch
+++ b/patches/driver/bes2600/remove-chardev-user-interface/0001-bes2600-remove-userspace-dev-bes2600-character-device-interface.patch
@@ -1,4 +1,4 @@
-From 8539460bf141f9362daf30b927150fedd08e5717 Mon Sep 17 00:00:00 2001
+From cd5f85e10480f02e289ea731b5eeec571000562c Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Wed, 22 Apr 2026 12:55:18 +0200
 Subject: [PATCH 05/29] bes2600: remove userspace /dev/bes2600 character device
@@ -73,11 +73,11 @@ Follow-ups:
 
 Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
 ---
- bes2600/bes_chardev.c | 519 ------------------------------------------
- 1 file changed, 519 deletions(-)
+ bes2600/bes_chardev.c | 568 +-----------------------------------------
+ 1 file changed, 3 insertions(+), 565 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bes_chardev.c b/drivers/staging/bes2600/bes_chardev.c
-index 9038e48..e2e4f1b 100644
+index f89dcb8..e2e4f1b 100644
 --- a/drivers/staging/bes2600/bes_chardev.c
 +++ b/drivers/staging/bes2600/bes_chardev.c
 @@ -43,12 +43,6 @@ enum bus_probe_state {
@@ -93,10 +93,74 @@ index 9038e48..e2e4f1b 100644
  	atomic_t num_proc;
  	wait_queue_head_t open_wq;
  	spinlock_t status_lock;
-@@ -249,351 +243,18 @@ int bes2600_switch_bt(bool on)
+@@ -196,7 +190,7 @@ static int bes2600_switch_wifi(bool on)
  	return ret;
  }
  
+-static int bes2600_switch_bt(bool on)
++int bes2600_switch_bt(bool on)
+ {
+ 	int ret = 0;
+ 	long status = 0;
+@@ -229,11 +223,11 @@ static int bes2600_switch_bt(bool on)
+ 			/* check if there is a error when bootup */
+ 			ret = (status <= 0 || bes2600_chrdev_is_bus_error()) ? -1 : 0;
+ 		} else {
+-			bes_devel("bes2600 activate bt.\n");
++			bes_info("enable BT\n");
+ 			ret = bes2600_chrdev_switch_subsys(GPIO_WAKE_FLAG_BT_ON, SUBSYSTEM_BT, true);
+ 		}
+ 	} else {
+-		bes_devel("bes2600 deactivate bt.\n");
++		bes_info("disable BT\n");
+ 		bes2600_chrdev_switch_subsys(GPIO_WAKE_FLAG_BT_OFF, SUBSYSTEM_BT, false);
+ 	}
+ 
+@@ -249,392 +243,18 @@ static int bes2600_switch_bt(bool on)
+ 	return ret;
+ }
+ 
+-/*
+- * This is a global function so we don't have to make many changes to
+- * the driver.
+- *
+- * @wifi: 1 to turn on, 0 to turn off. Otherwise, leave unchanged
+- * @bt: 1 to turn on, 0 to turn off. Otherwise, leave unchanged
+- */
+-int bes2600_chrdev_switch_subsys_glb(int wifi, int bt)
+-{
+-	int ret = 0;
+-
+-	switch (wifi) {
+-	case 0:
+-		ret = bes2600_switch_wifi(false);
+-		break;
+-	case 1:
+-		ret = bes2600_switch_wifi(true);
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	if (ret)
+-		goto result;
+-
+-	switch (bt) {
+-	case 0:
+-		ret = bes2600_switch_bt(false);
+-		break;
+-	case 1:
+-		ret = bes2600_switch_bt(true);
+-		break;
+-	default:
+-		break;
+-	}
+-
+-result:
+-	return ret;
+-}
+-EXPORT_SYMBOL_GPL(bes2600_chrdev_switch_subsys_glb);
+-
 -static int bes2600_get_cmd_and_ifname(const char *str, char **result)
 -{
 -	int cmd_len = 0;
@@ -192,11 +256,11 @@ index 9038e48..e2e4f1b 100644
 -	probe_state = bes2600_cdev.bus_probe;
 -	wait_state = bes2600_cdev.wait_state;
 -	spin_unlock(&bes2600_cdev.status_lock);
--
+ 
 -	/* only work for wifi signal mode */
 -	if (bes2600_cdev.fw_type != BES2600_FW_TYPE_WIFI_SIGNAL)
 -		return -EFAULT;
--
+ 
 -	/* wait bus probe operation end */
 -	if (probe_state == BES2600_BUS_PROBE_START) {
 -		bes_devel("wait bus probe operation end\n");
@@ -205,7 +269,7 @@ index 9038e48..e2e4f1b 100644
 -					HZ);
 -		WARN_ON(status <= 0);
 -	}
--
+ 
 -	/* must wait previous operation end in critical section */
 -	if (wait_state != BES2600_BOOT_WAIT_NONE) {
 -		bes_devel("wait previous operation end\n");
@@ -214,7 +278,7 @@ index 9038e48..e2e4f1b 100644
 -					HZ * 8);
 -		WARN_ON(status <= 0);
 -	}
--
+ 
 -	/* if dpd calibration is doing, modify wifi and bt state directly */
 -	spin_lock(&bes2600_cdev.status_lock);
 -	if (bes2600_cdev.bus_probe == BES2600_BUS_PROBE_OK && !bes2600_cdev.dpd_calied) {
@@ -233,16 +297,16 @@ index 9038e48..e2e4f1b 100644
 -		}
 -		bes2600_recyle_cmd_and_ifname_mem(info);
 -		spin_unlock(&bes2600_cdev.status_lock);
--
+ 
 -		/* wait probe done event */
 -		status = wait_event_timeout(bes2600_cdev.probe_done_wq,
 -				bes2600_bootup_end(), HZ * 8);
 -		WARN_ON(status <= 0);
--
+ 
 -		return (status <= 0 || bes2600_chrdev_is_bus_error()) ? -EFAULT : 0;
 -	}
 -	spin_unlock(&bes2600_cdev.status_lock);
--
+ 
 -	/* process wifi/bt on/off operation */
 -	if (bes2600_get_cmd_and_ifname(str, info) == 0) {
 -		if (strncmp(info[1], "WIFI_ON", 7) == 0) {
@@ -255,7 +319,7 @@ index 9038e48..e2e4f1b 100644
 -			ret = bes2600_switch_bt(0);
 -		}
 -	}
--
+ 
 -	if (!ret && bes2600_chrdev_check_system_close())
 -		ret = bes2600_chrdev_do_system_close(bes2600_cdev.sbus_ops,
 -						bes2600_cdev.sbus_priv);
@@ -344,8 +408,8 @@ index 9038e48..e2e4f1b 100644
 -	WARN_ON(status <= 0);
 -
 -	ret = (status <= 0 || bes2600_chrdev_is_bus_error()) ? -1 : 0;
- 
- 
+-
+-
 -	return ret;
 -}
 -
@@ -360,7 +424,7 @@ index 9038e48..e2e4f1b 100644
 -		return -EFAULT;
 -	}
 -	spin_unlock(&bes2600_cdev.status_lock);
- 
+-
 -	/* wait probe done event */
 -	status = wait_event_timeout(bes2600_cdev.probe_done_wq,
 -			bes2600_bootup_end(), HZ * 8);
@@ -384,26 +448,26 @@ index 9038e48..e2e4f1b 100644
 -		return -EFAULT;
 -	}
 -	spin_unlock(&bes2600_cdev.status_lock);
- 
+-
 -	/* wait probe done event */
 -	status = wait_event_timeout(bes2600_cdev.probe_done_wq,
 -			bes2600_bootup_end(), HZ * 8);
 -	if (status <= 0 || bes2600_chrdev_is_bus_error())
 -		return -EFAULT;
- 
+-
 -	bes_devel("bes2600 allow bt sleep.\n");
 -	ret = bes2600_chrdev_switch_subsys(GPIO_WAKE_FLAG_BT_LP_OFF, SUBSYSTEM_BT_LP, false);
- 
+-
 -	return ret;
 -}
- 
+-
 -static int bes2600_op_set_wakeup_read_flag(const char *str)
 -{
 -	bes_devel("%s is called, arg:%s\n", __func__, str);
 -	spin_lock(&bes2600_cdev.status_lock);
 -	bes2600_cdev.read_flag = BES_CDEV_READ_WAKEUP_STATE;
 -	spin_unlock(&bes2600_cdev.status_lock);
- 
+-
 -	return 0;
 -}
  
@@ -445,7 +509,7 @@ index 9038e48..e2e4f1b 100644
  
  static int bes2600_chrdev_check_system_close_internal(void)
  {
-@@ -603,123 +264,10 @@ static int bes2600_chrdev_check_system_close_internal(void)
+@@ -644,123 +264,10 @@ static int bes2600_chrdev_check_system_close_internal(void)
  		&& (bes2600_cdev.wifi_opened == false);
  }
  
@@ -569,7 +633,23 @@ index 9038e48..e2e4f1b 100644
  
  #ifdef BES2600_WRITE_DPD_TO_FILE
  static int bes2600_chrdev_write_dpd_data_to_file(const char *path, void *buffer, int size)
-@@ -1124,12 +672,6 @@ void bes2600_chrdev_update_signal_mode(void)
+@@ -1126,7 +633,6 @@ void bes2600_chrdev_wakeup_bt(void)
+ 			bes_err("Wakeup BT fail in resume\n");
+ 	}
+ }
+-EXPORT_SYMBOL_GPL(bes2600_chrdev_wakeup_bt);
+ 
+ int bes2600_chrdev_get_fw_type(void)
+ {
+@@ -1148,7 +654,6 @@ bool bes2600_chrdev_is_bus_error(void)
+ 
+ 	return error;
+ }
+-EXPORT_SYMBOL_GPL(bes2600_chrdev_is_bus_error);
+ 
+ void bes2600_chrdev_update_signal_mode(void)
+ {
+@@ -1167,12 +672,6 @@ void bes2600_chrdev_update_signal_mode(void)
  
  static void bes2600_chrdev_wifi_force_close_work(struct work_struct *work)
  {
@@ -582,7 +662,7 @@ index 9038e48..e2e4f1b 100644
  	if (bes2600_chrdev_is_wifi_opened()) {
  		bes_devel("system exeception, force wifi down\n");
  
-@@ -1146,14 +688,6 @@ static void bes2600_chrdev_wifi_force_close_work(struct work_struct *work)
+@@ -1189,14 +688,6 @@ static void bes2600_chrdev_wifi_force_close_work(struct work_struct *work)
  			bes2600_chrdev_do_system_close(bes2600_cdev.sbus_ops,
  						bes2600_cdev.sbus_priv);
  		}
@@ -597,7 +677,7 @@ index 9038e48..e2e4f1b 100644
  	}
  }
  
-@@ -1247,46 +781,6 @@ int bes2600_chrdev_wakeup_by_event_get(void)
+@@ -1290,46 +781,6 @@ int bes2600_chrdev_wakeup_by_event_get(void)
  
  int bes2600_chrdev_init(struct sbus_ops *ops)
  {
@@ -644,7 +724,7 @@ index 9038e48..e2e4f1b 100644
  	/* initialise global variable */
  	atomic_set(&bes2600_cdev.num_proc, 0);
  	init_waitqueue_head(&bes2600_cdev.open_wq);
-@@ -1318,15 +812,6 @@ int bes2600_chrdev_init(struct sbus_ops *ops)
+@@ -1361,15 +812,6 @@ int bes2600_chrdev_init(struct sbus_ops *ops)
  	bes_devel("%s done\n", __func__);
  
  	return 0;
@@ -660,7 +740,7 @@ index 9038e48..e2e4f1b 100644
  }
  
  void bes2600_chrdev_free(void)
-@@ -1336,9 +821,5 @@ void bes2600_chrdev_free(void)
+@@ -1379,9 +821,5 @@ void bes2600_chrdev_free(void)
  	bes2600_free_dpd_log_buffer();
  #endif
  	bes2600_chrdev_free_dpd_data();
diff --git a/patches/driver/bes2600/rx-list-batch-delivery-danctnix/0001-bes2600-Patch-C2-replace-ieee80211_rx_irqsafe-with-ieee80211_rx_ni.patch b/patches/driver/bes2600/rx-list-batch-delivery-danctnix/0001-bes2600-Patch-C2-replace-ieee80211_rx_irqsafe-with-ieee80211_rx_ni.patch
index 1ce259b..02d9932 100644
--- a/patches/driver/bes2600/rx-list-batch-delivery-danctnix/0001-bes2600-Patch-C2-replace-ieee80211_rx_irqsafe-with-ieee80211_rx_ni.patch
+++ b/patches/driver/bes2600/rx-list-batch-delivery-danctnix/0001-bes2600-Patch-C2-replace-ieee80211_rx_irqsafe-with-ieee80211_rx_ni.patch
@@ -1,4 +1,4 @@
-From 0ec58c0ad539e1e8d347b5527ce66cf847782338 Mon Sep 17 00:00:00 2001
+From a70e882f3d5f4f9148206675562dddeecd3f4404 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 8 May 2026 06:40:00 +0200
 Subject: [PATCH 29/29] =?UTF-8?q?bes2600:=20Patch=20C2=20=E2=80=94=20repla?=
@@ -58,17 +58,18 @@ deltas would still be a net win for upstream-cleanliness — the
 kernel.org submission story benefits from not using _irqsafe from
 process context.
 ---
- bes2600/ap.c   | 15 +++++++++++++--
- bes2600/sta.c  |  2 +-
- bes2600/txrx.c |  6 +++---
- bes2600/wsm.c  |  2 +-
- 4 files changed, 18 insertions(+), 7 deletions(-)
+ bes2600/ap.c          | 15 +++++++++++++--
+ bes2600/bes_chardev.c | 33 ++++++++++++++++++++++++++++++++-
+ bes2600/sta.c         |  2 +-
+ bes2600/txrx.c        |  6 +++---
+ bes2600/wsm.c         |  2 +-
+ 5 files changed, 50 insertions(+), 8 deletions(-)
 
 diff --git a/drivers/staging/bes2600/ap.c b/drivers/staging/bes2600/ap.c
-index 0a23790..6d4428c 100644
+index 8a17545..99e2da2 100644
 --- a/drivers/staging/bes2600/ap.c
 +++ b/drivers/staging/bes2600/ap.c
-@@ -62,8 +62,11 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -63,8 +63,11 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct bes2600_vif *priv = cw12xx_get_vif_from_ieee80211(vif);
  	struct bes2600_link_entry *entry;
  	struct sk_buff *skb;
@@ -80,7 +81,7 @@ index 0a23790..6d4428c 100644
  #ifdef P2P_MULTIVIF
  	WARN_ON(priv->if_id == CW12XX_GENERIC_IF_ID);
  #endif
-@@ -92,9 +95,17 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -93,9 +96,17 @@ int bes2600_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  					IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
  		priv->sta_asleep_mask |= BIT(sta_priv->link_id);
  	entry->status = BES2600_LINK_HARD;
@@ -100,11 +101,69 @@ index 0a23790..6d4428c 100644
  #ifdef AP_AGGREGATE_FW_FIX
  	hw_priv->connected_sta_cnt++;
  	if(hw_priv->connected_sta_cnt>1) {
+diff --git a/drivers/staging/bes2600/bes_chardev.c b/drivers/staging/bes2600/bes_chardev.c
+index 02dcd43..844f1d0 100644
+--- a/drivers/staging/bes2600/bes_chardev.c
++++ b/drivers/staging/bes2600/bes_chardev.c
+@@ -181,7 +181,7 @@ static int bes2600_switch_wifi(bool on)
+ 	return ret;
+ }
+ 
+-int bes2600_switch_bt(bool on)
++static int bes2600_switch_bt(bool on)
+ {
+ 	int ret = 0;
+ 	long status = 0;
+@@ -234,6 +234,36 @@ int bes2600_switch_bt(bool on)
+ 	return ret;
+ }
+ 
++/*
++ * Re-added for danctnix's bes2600_btuart.c (a danctnix-only file) which
++ * relies on the chardev utility API for BT power switching and bus-error
++ * checks. The userspace /dev/bes2600 chardev itself is removed by the
++ * remove-chardev-user-interface series; these in-kernel helpers stay.
++ *
++ * @wifi: 1 to turn on, 0 to turn off. Otherwise, leave unchanged
++ * @bt:   1 to turn on, 0 to turn off. Otherwise, leave unchanged
++ */
++int bes2600_chrdev_switch_subsys_glb(int wifi, int bt)
++{
++	int ret = 0;
++
++	switch (wifi) {
++	case 0: ret = bes2600_switch_wifi(false); break;
++	case 1: ret = bes2600_switch_wifi(true);  break;
++	default: break;
++	}
++	if (ret)
++		return ret;
++
++	switch (bt) {
++	case 0: ret = bes2600_switch_bt(false); break;
++	case 1: ret = bes2600_switch_bt(true);  break;
++	default: break;
++	}
++	return ret;
++}
++EXPORT_SYMBOL_GPL(bes2600_chrdev_switch_subsys_glb);
++
+ 
+ 
+ 
+@@ -562,6 +592,7 @@ bool bes2600_chrdev_is_bus_error(void)
+ 
+ 	return error;
+ }
++EXPORT_SYMBOL_GPL(bes2600_chrdev_is_bus_error);
+ 
+ void bes2600_chrdev_update_signal_mode(void)
+ {
 diff --git a/drivers/staging/bes2600/sta.c b/drivers/staging/bes2600/sta.c
-index 7caeb4b..e64841a 100644
+index 8af8150..2b63ff2 100644
 --- a/drivers/staging/bes2600/sta.c
 +++ b/drivers/staging/bes2600/sta.c
-@@ -1484,7 +1484,7 @@ void bes2600_event_handler(struct work_struct *work)
+@@ -1500,7 +1500,7 @@ void bes2600_event_handler(struct work_struct *work)
  						IEEE80211_STYPE_DEAUTH | IEEE80211_FCTL_TODS);
  				deauth->u.deauth.reason_code = WLAN_REASON_DEAUTH_LEAVING;
  				deauth->seq_ctrl = 0;
@@ -114,10 +173,10 @@ index 7caeb4b..e64841a 100644
  				queue_work(priv->hw_priv->workqueue, &priv->set_tim_work);
  				break;
 diff --git a/drivers/staging/bes2600/txrx.c b/drivers/staging/bes2600/txrx.c
-index bf17777..de521a3 100644
+index cb718ad..9074972 100644
 --- a/drivers/staging/bes2600/txrx.c
 +++ b/drivers/staging/bes2600/txrx.c
-@@ -1957,18 +1957,18 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
+@@ -1980,18 +1980,18 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
  		 * path is taken.
  		 */
  		if (hw_priv->bes_power.pm_unsupported) {
diff --git a/patches/driver/bes2600/scan-defer-backoff-tune-danctnix/0001-bes2600-widen-scan-defer-backoff-30s-and-decay-on-quiet.patch b/patches/driver/bes2600/scan-defer-backoff-tune-danctnix/0001-bes2600-widen-scan-defer-backoff-30s-and-decay-on-quiet.patch
index aa52c85..7e26be4 100644
--- a/patches/driver/bes2600/scan-defer-backoff-tune-danctnix/0001-bes2600-widen-scan-defer-backoff-30s-and-decay-on-quiet.patch
+++ b/patches/driver/bes2600/scan-defer-backoff-tune-danctnix/0001-bes2600-widen-scan-defer-backoff-30s-and-decay-on-quiet.patch
@@ -1,4 +1,4 @@
-From 8fc1bacdeda64feb751433ee827dc9647e23bee4 Mon Sep 17 00:00:00 2001
+From 179c2e0bf852734631acfc56b2478775215cc5f6 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Tue, 28 Apr 2026 14:32:18 +0200
 Subject: [PATCH 14/29] bes2600: widen scan-defer backoff to 30s and decay
@@ -61,7 +61,7 @@ Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
  1 file changed, 15 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
-index faa1c90..ad5033b 100644
+index 5f6af3b..b944adc 100644
 --- a/drivers/staging/bes2600/scan.c
 +++ b/drivers/staging/bes2600/scan.c
 @@ -22,9 +22,17 @@
diff --git a/patches/driver/bes2600/scan-defer-on-reject-danctnix/0001-bes2600-defer-scan-and-soften-WARN-on-firmware-reject.patch b/patches/driver/bes2600/scan-defer-on-reject-danctnix/0001-bes2600-defer-scan-and-soften-WARN-on-firmware-reject.patch
index d0c374f..279415c 100644
--- a/patches/driver/bes2600/scan-defer-on-reject-danctnix/0001-bes2600-defer-scan-and-soften-WARN-on-firmware-reject.patch
+++ b/patches/driver/bes2600/scan-defer-on-reject-danctnix/0001-bes2600-defer-scan-and-soften-WARN-on-firmware-reject.patch
@@ -1,4 +1,4 @@
-From aff632ea648092aabee6b735819152d4a09ec95e Mon Sep 17 00:00:00 2001
+From 844e2245a1ed517b3a0bc487fec1a100304f0b44 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Fri, 24 Apr 2026 21:31:45 +0200
 Subject: [PATCH 13/29] bes2600: defer scan and soften WARN on firmware reject
@@ -88,7 +88,7 @@ Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
  3 files changed, 83 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
-index b2c22e7..faa1c90 100644
+index 3bfa535..5f6af3b 100644
 --- a/drivers/staging/bes2600/scan.c
 +++ b/drivers/staging/bes2600/scan.c
 @@ -14,11 +14,50 @@
@@ -142,7 +142,7 @@ index b2c22e7..faa1c90 100644
  #ifdef CONFIG_BES2600_TESTMODE
  static int bes2600_advance_scan_start(struct bes2600_common *hw_priv)
  {
-@@ -702,10 +741,29 @@ void bes2600_scan_work(struct work_struct *work)
+@@ -703,10 +742,29 @@ void bes2600_scan_work(struct work_struct *work)
  				wsm_unlock_tx(hw_priv);
  		} else
  #endif
diff --git a/patches/driver/bes2600/sdio-rx-no-relay-danctnix/0001-bes2600-drop-sdio_rx_work-relay-IRQ-bh-direct-no-relay-architecture.patch b/patches/driver/bes2600/sdio-rx-no-relay-danctnix/0001-bes2600-drop-sdio_rx_work-relay-IRQ-bh-direct-no-relay-architecture.patch
index 67f7698..4b7a3d1 100644
--- a/patches/driver/bes2600/sdio-rx-no-relay-danctnix/0001-bes2600-drop-sdio_rx_work-relay-IRQ-bh-direct-no-relay-architecture.patch
+++ b/patches/driver/bes2600/sdio-rx-no-relay-danctnix/0001-bes2600-drop-sdio_rx_work-relay-IRQ-bh-direct-no-relay-architecture.patch
@@ -1,4 +1,4 @@
-From 1e9eb4581f113aa6cca2d0de325f9b61b80ebbee Mon Sep 17 00:00:00 2001
+From 0f185172b020818faec9572fd800867db623a40e Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 7 May 2026 22:34:11 +0200
 Subject: [PATCH 25/29] =?UTF-8?q?bes2600:=20drop=20sdio=5Frx=5Fwork=20rela?=
@@ -76,7 +76,7 @@ invalidated rep 2's throughput number).
  4 files changed, 226 insertions(+), 64 deletions(-)
 
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index b998381..b6b4e4e 100644
+index c81c244..3834032 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -29,6 +29,7 @@
@@ -334,7 +334,7 @@ index b998381..b6b4e4e 100644
  		new_ts = self->last_irq_timestamp;
  	} while(old_ts != new_ts);
  }
-@@ -2244,8 +2264,12 @@ static int bes2600_sdio_suspend_noirq(struct device *dev)
+@@ -2243,8 +2263,12 @@ static int bes2600_sdio_suspend_noirq(struct device *dev)
  	if (func->num > 1)
  		return 0;
  
@@ -350,10 +350,10 @@ index b998381..b6b4e4e 100644
  		return -EAGAIN;
  	}
 diff --git a/drivers/staging/bes2600/bh.c b/drivers/staging/bes2600/bh.c
-index 1d2773c..d5a8c77 100644
+index fab3bf0..febcaf4 100644
 --- a/drivers/staging/bes2600/bh.c
 +++ b/drivers/staging/bes2600/bh.c
-@@ -958,6 +958,119 @@ static void bes2600_bh_parse_wakeup_event(struct bes2600_common *hw_priv, struct
+@@ -959,6 +959,119 @@ static void bes2600_bh_parse_wakeup_event(struct bes2600_common *hw_priv, struct
  	}
  }
  
@@ -473,7 +473,7 @@ index 1d2773c..d5a8c77 100644
  static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
  {
  	struct sk_buff *skb = NULL;
-@@ -969,10 +1082,18 @@ static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
+@@ -970,10 +1083,18 @@ static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
  	u32 confirm_label = 0x0; /* wsm to mcu cmd cnfirm label */
  
  #if defined(BES_SDIO_RX_MULTIPLE_ENABLE)
diff --git a/patches/driver/bes2600/tx-sdio-dma-oob-danctnix/0001-bes2600-bounce-SDIO-TX-buffers-to-avoid-DMA-OOB-read.patch b/patches/driver/bes2600/tx-sdio-dma-oob-danctnix/0001-bes2600-bounce-SDIO-TX-buffers-to-avoid-DMA-OOB-read.patch
index 0e5866d..a324213 100644
--- a/patches/driver/bes2600/tx-sdio-dma-oob-danctnix/0001-bes2600-bounce-SDIO-TX-buffers-to-avoid-DMA-OOB-read.patch
+++ b/patches/driver/bes2600/tx-sdio-dma-oob-danctnix/0001-bes2600-bounce-SDIO-TX-buffers-to-avoid-DMA-OOB-read.patch
@@ -1,4 +1,4 @@
-From 315986ea27e7508275e71a070461d243ce1a1058 Mon Sep 17 00:00:00 2001
+From 2f9b4c719faf9563895c064439a7da25f35c8fc7 Mon Sep 17 00:00:00 2001
 From: Markus Fritsche <fritsche.markus@gmail.com>
 Date: Thu, 23 Apr 2026 11:58:31 +0200
 Subject: [PATCH 07/29] bes2600: bounce SDIO TX buffers to avoid DMA OOB read
@@ -48,7 +48,7 @@ Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>
  1 file changed, 38 insertions(+), 1 deletion(-)
 
 diff --git a/drivers/staging/bes2600/bes2600_sdio.c b/drivers/staging/bes2600/bes2600_sdio.c
-index 371ef4f..3e04e8c 100644
+index f172d53..b9d836f 100644
 --- a/drivers/staging/bes2600/bes2600_sdio.c
 +++ b/drivers/staging/bes2600/bes2600_sdio.c
 @@ -95,6 +95,7 @@ struct sbus_priv {
@@ -105,7 +105,7 @@ index 371ef4f..3e04e8c 100644
  #ifdef BES_SDIO_RXTX_TOGGLE
  	self->fw_started = false;
  #endif
-@@ -1985,6 +2016,12 @@ static void bes2600_sdio_remove(struct sdio_func *func)
+@@ -1984,6 +2015,12 @@ static void bes2600_sdio_remove(struct sdio_func *func)
  		if (self->single_gathered_buffer) {
  			free_pages((unsigned long)self->single_gathered_buffer, get_order(MAX_SDIO_TRANSFER_LEN));
  		}
-- 
2.47.3