rtw: btcoex: clean up style and documentation

From: Bubuworks <[email protected]>
Date: Thu, 05 Feb 2026 17:25:00 +0200
Subject: [PATCH] rtw: btcoex: clean up style and documentation

<start of patch>
From 0eca95cba2b7bf7b7b4f2fa90734a85fcaa72782 Mon Sep 17 00:00:00 2001
From: Tejun Heo <[email protected]>
Date: Wed, 4 Feb 2026 10:07:55 -1000
Subject: [PATCH] sched_ext: Short-circuit sched_class operations on dead tasks

7900aa699c34 ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()") moved sched_ext_free() to finish_task_switch() and renamed it to sched_ext_dead() to fix cgroup exit ordering issues. However, this created a race window where certain sched_class ops may be invoked on dead tasks leading to failures - e.g. sched_setscheduler() may try to switch a task which finished sched_ext_dead() back into SCX triggering invalid SCX task state transitions.

Add task_dead_and_done() which tests whether a task is TASK_DEAD and has completed its final context switch, and use it to short-circuit sched_class operations which may be called on dead tasks.

---
kernel/sched/ext.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 48 insertions(+)

index 8f6d8d7f895c..1a5ead4a476e 100644
@@ -194,6 +194,7 @@ MODULE_PARM_DESC(bypass_lb_intv_us, "bypass load balance interval in microsecond

#include <trace/events/sched_ext.h>

static void process_ddsp_deferred_locals(struct rq *rq);
+static bool task_dead_and_done(struct task_struct *p);
static u32 reenq_local(struct rq *rq);
static void scx_kick_cpu(struct scx_sched *sch, s32 cpu, u64 flags); static bool scx_vexit(struct scx_sched *sch, enum scx_exit_kind kind, @@ -2618,6 +2619,9 @@ static void set_cpus_allowed_scx(struct task_struct *p,

set_cpus_allowed_common(p, ac);

+ if (task_dead_and_done(p))
+ return;
+
/*
* The effective cpumask is stored in @p->cpus_ptr which may temporarily
* differ from the configured one in @p->cpus_mask. Always tell the bpf @@ -3033,10 +3037,45 @@ void scx_cancel_fork(struct task_struct *p) percpu_up_read(&scx_fork_rwsem);
}

+/**
+ * task_dead_and_done - Is a task dead and done running?
+ * @p: target task
+ *
+ * Once sched_ext_dead() removes the dead task from scx_tasks and exits it, the
+ * task no longer exists from SCX's POV. However, certain sched_class ops may be
+ * invoked on these dead tasks leading to failures - e.g. sched_setscheduler()
+ * may try to switch a task which finished sched_ext_dead() back into SCX
+ * triggering invalid SCX task state transitions and worse.
+ *
+ * Once a task has finished the final switch, sched_ext_dead() is the only thing
+ * that needs to happen on the task. Use this test to short-circuit sched_class
+ * operations which may be called on dead tasks.
+ */
+static bool task_dead_and_done(struct task_struct *p)
+{
+ struct rq *rq = task_rq(p);
+
+ lockdep_assert_rq_held(rq);
+
+ /*
+ * In do_task_dead(), a dying task sets %TASK_DEAD with preemption
+ * disabled and __schedule(). If @p has %TASK_DEAD set and off CPU, @p
+ * won't ever run again.
+ */
+ return unlikely(READ_ONCE(p->__state) == TASK_DEAD) &&
+ !task_on_cpu(rq, p);
+}
+
void sched_ext_dead(struct task_struct *p)
{
unsigned long flags;

+ /*
+ * By the time control reaches here, @p has %TASK_DEAD set, switched out
+ * for the last time and then dropped the rq lock - task_dead_and_done()
+ * should be returning %true nullifying the straggling sched_class ops.
+ * Remove from scx_tasks and exit @p.
+ */
raw_spin_lock_irqsave(&scx_tasks_lock, flags); list_del_init(&p->scx.tasks_node); raw_spin_unlock_irqrestore(&scx_tasks_lock, flags);
@@ -3062,6 +3101,9 @@ static void reweight_task_scx(struct rq *rq, struct task_struct *p,

lockdep_assert_rq_held(task_rq(p));

+ if (task_dead_and_done(p))
+ return;
+
p->scx.weight = sched_weight_to_cgroup(scale_load_down(lw->weight));
if (SCX_HAS_OP(sch, set_weight))
SCX_CALL_OP_TASK(sch, SCX_KF_REST, set_weight, rq,
@@ -3076,6 +3118,9 @@ static void switching_to_scx(struct rq *rq, struct task_struct *p) {
struct scx_sched *sch = scx_root;

+ if (task_dead_and_done(p))
+ return;
+
scx_enable_task(p);

/*
@@ -3089,6 +3134,9 @@ static void switching_to_scx(struct rq *rq, struct task_struct *p)

static void switched_from_scx(struct rq *rq, struct task_struct *p) {
+ if (task_dead_and_done(p))
+ return;
+
scx_disable_task(p);
}

--
2.52.0.windows.1
<end of patch>

This looks very odd, are you sure it's correct, because:

That's not your patch :(

Something went wrong with your email system :(

Here's the correct patch.
// SPDX-License-Identifier: GPL-2.0 /****************************************************************************** *
* Copyright(c) 2013 Realtek Corporation. All rights reserved.
* ******************************************************************************/ #include <drv_types.h>
#include <rtw_btcoex.h>
#include <hal_btcoex.h>

#define BTCOEX_LPS_RF_ON_TIMEOUT 100

/**
* rtw_btcoex_media_status_notify() - Notify BT coexistence of media status
* @adpt: driver private adapter
* @media_status: connection state
*
* Context: process context
* Locking: caller ensures MLME state is stable
*/
void rtw_btcoex_media_status_notify(struct adapter *adpt, u8 media_status) {
if (media_status == RT_MEDIA_CONNECT && check_fwstate(&adpt->mlmepriv, WIFI_AP_STATE)) rtw_hal_set_hwreg(adpt, HW_VAR_DL_RSVD_PAGE, NULL);

hal_btcoex_MediaStatusNotify(adpt, media_status);
}

/**
* rtw_btcoex_halt_notify() - Notify BT coexistence of device halt
* @adpt: driver private adapter
*
* Context: process context
* Locking: device teardown serialization handled by caller */
void rtw_btcoex_halt_notify(struct adapter *adpt)
{
if (!adpt->bup || adpt->bSurpriseRemoved)
return;

hal_btcoex_HaltNotify(adpt);
}

/**
* rtw_btcoex_reject_ap_aggregated_packet() - Control AP-side AMPDU handling
* @adpt: driver private adapter
* @enable: reject aggregation when true
*
* Used by BT coexistence logic to reduce interference by disabling
* AP-side AMPDU negotiation.
*
* Context: process context
* Locking: caller holds appropriate MLME/STA protection
*/
void rtw_btcoex_reject_ap_aggregated_packet(struct adapter *adpt, bool enable) {
struct mlme_ext_info *mlmeinfo;
struct mlme_priv *mlme;
struct sta_info *sta;

mlme = &adpt->mlmepriv;
mlmeinfo = &adpt->mlmeextpriv.mlmext_info;

if (!enable) {
mlmeinfo->accept_addba_req = true;
return;
}

mlmeinfo->accept_addba_req = false;

sta = rtw_get_stainfo(&adpt->stapriv, get_bssid(mlme)); if (sta)
send_delba(adpt, 0, sta->hwaddr);
}

/**
* rtw_btcoex_lps_enter() - Enter low power state for BT coexistence
* @adpt: driver private adapter
*
* Context: process context
* Locking: power control serialized by caller
*
* This function transitions firmware into LPS mode. State flags are
* updated only after the transition request is issued. */
void rtw_btcoex_lps_enter(struct adapter *adpt)
{
struct pwrctrl_priv *pwrpriv;
u8 lps_val;

pwrpriv = adapter_to_pwrctl(adpt);

lps_val = hal_btcoex_LpsVal(adpt); rtw_set_ps_mode(adpt, PS_MODE_MIN, 0, lps_val, "BTCOEX");

pwrpriv->bpower_saving = true;
}

/**
* rtw_btcoex_lps_leave() - Leave low power state for BT coexistence
* @adpt: driver private adapter
*
* Context: process context
* Locking: power control serialized by caller
*
* Ensures RF is fully powered before clearing power-saving state. */
void rtw_btcoex_lps_leave(struct adapter *adpt)
{
struct pwrctrl_priv *pwrpriv;

pwrpriv = adapter_to_pwrctl(adpt);

if (pwrpriv->pwr_mode != PS_MODE_ACTIVE) {
rtw_set_ps_mode(adpt, PS_MODE_ACTIVE, 0, 0,
"BTCOEX");
LPS_RF_ON_check(adpt, BTCOEX_LPS_RF_ON_TIMEOUT);
}

pwrpriv->bpower_saving = false;
}

Nope. That's not a patch.

regards,
dan carpenter