rt2x00: Fix race condition when using inderect registers

Indirect registers require multiple calls to the CSR
register in order to access the indirect registers.
This must be protected under a lock to prevent race
conditions which could cause invalid data to
be returned when reading from the indirect register or silent
failures when writing data to the indirect register.

USB drivers where already protected under a mutex,
so rename the mutex and make PCI drivers use the mutex
as well.
This now means that BBP and RF registers are no longer
accessible in interrupt context. That is not a bad
situation since the slow behavior of accessing
those registers means we don't _want_ to access them
in interrupt context either.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 47 insertions, 19 deletions

diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index abfe33b5712a..89ac34fbadf2 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -75,14 +75,14 @@ static void rt61pci_bbp_write(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
+        mutex_lock(&rt2x00dev->csr_mutex);
+
         /*
          * Wait until the BBP becomes ready.
          */
         reg = rt61pci_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Write failed.\n");
-                return;
-        }
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
+                goto exit_fail;
 
         /*
          * Write the data into the BBP.
@@ -94,6 +94,14 @@ static void rt61pci_bbp_write(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, PHY_CSR3_READ_CONTROL, 0);
 
         rt2x00pci_register_write(rt2x00dev, PHY_CSR3, reg);
+        mutex_unlock(&rt2x00dev->csr_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->csr_mutex);
+
+        ERROR(rt2x00dev, "PHY_CSR3 register busy. Write failed.\n");
 }
 
 static void rt61pci_bbp_read(struct rt2x00_dev *rt2x00dev,
@@ -101,14 +109,14 @@ static void rt61pci_bbp_read(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
+        mutex_lock(&rt2x00dev->csr_mutex);
+
         /*
          * Wait until the BBP becomes ready.
          */
         reg = rt61pci_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
-                return;
-        }
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
+                goto exit_fail;
 
         /*
          * Write the request into the BBP.
@@ -124,13 +132,19 @@ static void rt61pci_bbp_read(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt61pci_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
-                *value = 0xff;
-                return;
-        }
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
+                goto exit_fail;
 
         *value = rt2x00_get_field32(reg, PHY_CSR3_VALUE);
+        mutex_unlock(&rt2x00dev->csr_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->csr_mutex);
+
+        ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
+        *value = 0xff;
 }
 
 static void rt61pci_rf_write(struct rt2x00_dev *rt2x00dev,
@@ -142,6 +156,8 @@ static void rt61pci_rf_write(struct rt2x00_dev *rt2x00dev,
         if (!word)
                 return;
 
+        mutex_lock(&rt2x00dev->csr_mutex);
+
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                 rt2x00pci_register_read(rt2x00dev, PHY_CSR4, &reg);
                 if (!rt2x00_get_field32(reg, PHY_CSR4_BUSY))
@@ -149,6 +165,7 @@ static void rt61pci_rf_write(struct rt2x00_dev *rt2x00dev,
                 udelay(REGISTER_BUSY_DELAY);
         }
 
+        mutex_unlock(&rt2x00dev->csr_mutex);
         ERROR(rt2x00dev, "PHY_CSR4 register busy. Write failed.\n");
         return;
 
@@ -161,6 +178,8 @@ rf_write:
 
         rt2x00pci_register_write(rt2x00dev, PHY_CSR4, reg);
         rt2x00_rf_write(rt2x00dev, word, value);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
 }
 
 #ifdef CONFIG_RT2X00_LIB_LEDS
@@ -175,14 +194,12 @@ static void rt61pci_mcu_request(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
+        mutex_lock(&rt2x00dev->csr_mutex);
+
         rt2x00pci_register_read(rt2x00dev, H2M_MAILBOX_CSR, &reg);
 
-        if (rt2x00_get_field32(reg, H2M_MAILBOX_CSR_OWNER)) {
-                ERROR(rt2x00dev, "mcu request error. "
-                      "Request 0x%02x failed for token 0x%02x.\n",
-                      command, token);
-                return;
-        }
+        if (rt2x00_get_field32(reg, H2M_MAILBOX_CSR_OWNER))
+                goto exit_fail;
 
         rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_OWNER, 1);
         rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
@@ -194,6 +211,17 @@ static void rt61pci_mcu_request(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
         rt2x00_set_field32(&reg, HOST_CMD_CSR_INTERRUPT_MCU, 1);
         rt2x00pci_register_write(rt2x00dev, HOST_CMD_CSR, reg);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->csr_mutex);
+
+        ERROR(rt2x00dev,
+              "mcu request error. Request 0x%02x failed for token 0x%02x.\n",
+              command, token);
 }
 #endif /* CONFIG_RT2X00_LIB_LEDS */