[PATCH 2/2] wifi: rsi: stop coexistence TX before bus teardown

[Zhao Li <enderaoelyther@gmail.com>]

The coexistence TX thread can continue using an RSI bus after disconnect
resets or disables it. On USB, interface cleanup can also free the shared
TX buffer before the final core cleanup stops the thread.

rsi_coex_detach() only stops the thread from rsi_91x_deinit(), after the
bus has been reset or disabled. Its stop wakeup first drains any queued
Bluetooth packets through that unavailable bus.

Check the stop request before each queued packet. Stop coexistence TX
once HCI unregister has completed and before USB reset. Also stop it in
interface cleanup before freeing the TX buffer so probe unwind is
covered. On SDIO, stop it before chip reset and function disable on
disconnect, and before function disable during probe unwind.

rsi_coex_detach() still purges and frees the queues. The repeated stops
are harmless after the previous patch.

LLM assistance was used to find the bug and review.

Fixes: 716b840c7641 ("rsi: handle BT traffic in driver")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Validation: W=1 module builds with MODPOST passed for every prefix with
CONFIG_RSI_COEX enabled and disabled. The series applies to v7.3.
Not reproduced; RS9113/RS9116 hardware was unavailable.
Sparse C=2 passed. Smatch across all configured translation units under
drivers/net/wireless/rsi introduced no new diagnostics.

 drivers/net/wireless/rsi/rsi_91x_coex.c |  3 +++
 drivers/net/wireless/rsi/rsi_91x_sdio.c |  3 +++
 drivers/net/wireless/rsi/rsi_91x_usb.c  |  2 ++
 drivers/net/wireless/rsi/rsi_coex.h     | 12 ++++++++++++
 4 files changed, 20 insertions(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c
index 023c539fc384..de2a973873ef 100644
--- a/drivers/net/wireless/rsi/rsi_91x_coex.c
+++ b/drivers/net/wireless/rsi/rsi_91x_coex.c
@@ -40,6 +40,9 @@ static void rsi_coex_sched_tx_pkts(struct rsi_coex_ctrl_block *coex_cb)
 	struct sk_buff *skb;
 
 	do {
+		if (atomic_read(&coex_cb->coex_tx_thread.thread_done))
+			break;
+
 		coex_q = rsi_coex_determine_coex_q(coex_cb);
 		rsi_dbg(INFO_ZONE, "queue = %d\n", coex_q);
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index c5619a34940d..87108f4a4326 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -1080,6 +1080,7 @@ static int rsi_probe(struct sdio_func *pfunction,
 	rsi_kill_thread(&sdev->rx_thread);
 fail_kill_thread:
 	rsi_kill_thread(&adapter->priv->tx_thread);
+	rsi_coex_stop_thread(adapter->priv);
 	sdio_claim_host(pfunction);
 	sdio_disable_func(pfunction);
 	sdio_release_host(pfunction);
@@ -1231,6 +1232,8 @@ static void rsi_disconnect(struct sdio_func *pfunction)
 		adapter->priv->bt_adapter = NULL;
 	}
 
+	rsi_coex_stop_thread(adapter->priv);
+
 	/* Reset Chip */
 	rsi_reset_chip(adapter);
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 99e029e66407..f8b5c264a8a9 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -563,6 +563,7 @@ static void rsi_deinit_usb_interface(struct rsi_hw *adapter)
 
 	rsi_kill_thread(&dev->rx_thread);
 	rsi_kill_thread(&adapter->priv->tx_thread);
+	rsi_coex_stop_thread(adapter->priv);
 
 	usb_free_urb(dev->rx_cb[0].rx_urb);
 	if (adapter->priv->coex_mode > 1)
@@ -896,6 +897,7 @@ static void rsi_disconnect(struct usb_interface *pfunction)
 		adapter->priv->bt_adapter = NULL;
 	}
 
+	rsi_coex_stop_thread(adapter->priv);
 	rsi_reset_card(adapter);
 	rsi_deinit_usb_interface(adapter);
 	rsi_91x_deinit(adapter);
diff --git a/drivers/net/wireless/rsi/rsi_coex.h b/drivers/net/wireless/rsi/rsi_coex.h
index 2c14e4c651b9..cdd83650c5f1 100644
--- a/drivers/net/wireless/rsi/rsi_coex.h
+++ b/drivers/net/wireless/rsi/rsi_coex.h
@@ -29,9 +29,21 @@ struct rsi_coex_ctrl_block {
 	struct rsi_thread coex_tx_thread;
 };
 
+static inline void rsi_coex_stop_thread(struct rsi_common *common)
+{
+	struct rsi_coex_ctrl_block *coex_cb = common->coex_cb;
+
+	if (common->coex_mode > 1)
+		rsi_kill_thread(&coex_cb->coex_tx_thread);
+}
+
 int rsi_coex_attach(struct rsi_common *common);
 void rsi_coex_detach(struct rsi_common *common);
 int rsi_coex_send_pkt(void *priv, struct sk_buff *skb, u8 proto_type);
 int rsi_coex_recv_pkt(struct rsi_common *common, u8 *msg);
+#else
+static inline void rsi_coex_stop_thread(struct rsi_common *common)
+{
+}
 #endif
 #endif
-- 
2.56.0