x86: GEODE: MFGPT: fix a potential race when disabling a timer

We *really* don't want to be reading MFGPTx_SETUP and writing back those
values.  What we want to be doing is clearing CMP1 and CMP2 unconditionally;
otherwise, we have races where CMP1 and/or CMP2 fire after we've read
MFGPTx_SETUP.  They can also fire between when we've written ~CNTEN to
the register, and when the new register values get copied to the timer's
version of the register.  By clearing both fields, we're okay.

Signed-off-by: Andres Salomon <dilinger@debian.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

1 files changed, 3 insertions, 2 deletions

diff --git a/arch/x86/kernel/mfgpt_32.c b/arch/x86/kernel/mfgpt_32.c
index abdb7c71199a..81aa9db01f5f 100644
--- a/arch/x86/kernel/mfgpt_32.c
+++ b/arch/x86/kernel/mfgpt_32.c
@@ -249,8 +249,9 @@ __setup("mfgpt_irq=", mfgpt_setup);
 
 static void mfgpt_disable_timer(u16 clock)
 {
-        u16 val = geode_mfgpt_read(clock, MFGPT_REG_SETUP);
-        geode_mfgpt_write(clock, MFGPT_REG_SETUP, val & ~MFGPT_SETUP_CNTEN);
+        /* avoid races by clearing CMP1 and CMP2 unconditionally */
+        geode_mfgpt_write(clock, MFGPT_REG_SETUP, (u16) ~MFGPT_SETUP_CNTEN |
+                        MFGPT_SETUP_CMP1 | MFGPT_SETUP_CMP2);
 }
 
 static int mfgpt_next_event(unsigned long, struct clock_event_device *);