b43: Fix some TX/RX locking issues

This fixes some TX/RX related locking issues.
With this patch applied, some of the PHY transmission errors are fixed.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

2 files changed, 33 insertions, 14 deletions

diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index eff2a158a411..37783cdd301a 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -691,6 +691,10 @@ struct b43_wl {
 
         struct mutex mutex;
         spinlock_t irq_lock;
+        /* R/W lock for data transmission.
+         * Transmissions on 2+ queues can run concurrently, but somebody else
+         * might sync with TX by write_lock_irqsave()'ing. */
+        rwlock_t tx_lock;
         /* Lock for LEDs access. */
         spinlock_t leds_lock;
         /* Lock for SHM access. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 6c7db9a1a466..8fdba9415c04 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -729,6 +729,7 @@ static void b43_synchronize_irq(struct b43_wldev *dev)
  */
 void b43_dummy_transmission(struct b43_wldev *dev)
 {
+        struct b43_wl *wl = dev->wl;
         struct b43_phy *phy = &dev->phy;
         unsigned int i, max_loop;
         u16 value;
@@ -755,6 +756,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
                 return;
         }
 
+        spin_lock_irq(&wl->irq_lock);
+        write_lock(&wl->tx_lock);
+
         for (i = 0; i < 5; i++)
                 b43_ram_write(dev, i * 4, buffer[i]);
 
@@ -795,6 +799,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
         }
         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
                 b43_radio_write16(dev, 0x0051, 0x0037);
+
+        write_unlock(&wl->tx_lock);
+        spin_unlock_irq(&wl->irq_lock);
 }
 
 static void key_write(struct b43_wldev *dev,
@@ -2840,24 +2847,31 @@ static int b43_op_tx(struct ieee80211_hw *hw,
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev = wl->current_dev;
-        int err = -ENODEV;
+        unsigned long flags;
+        int err;
 
         if (unlikely(skb->len < 2 + 2 + 6)) {
                 /* Too short, this can't be a valid frame. */
-                return -EINVAL;
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
         }
         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
-
         if (unlikely(!dev))
-                goto out;
-        if (unlikely(b43_status(dev) < B43_STAT_STARTED))
-                goto out;
-        /* TX is done without a global lock. */
-        if (b43_using_pio_transfers(dev))
-                err = b43_pio_tx(dev, skb, ctl);
-        else
-                err = b43_dma_tx(dev, skb, ctl);
-out:
+                return NETDEV_TX_BUSY;
+
+        /* Transmissions on seperate queues can run concurrently. */
+        read_lock_irqsave(&wl->tx_lock, flags);
+
+        err = -ENODEV;
+        if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
+                if (b43_using_pio_transfers(dev))
+                        err = b43_pio_tx(dev, skb, ctl);
+                else
+                        err = b43_dma_tx(dev, skb, ctl);
+        }
+
+        read_unlock_irqrestore(&wl->tx_lock, flags);
+
         if (unlikely(err))
                 return NETDEV_TX_BUSY;
         return NETDEV_TX_OK;
@@ -3476,7 +3490,9 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
         spin_unlock_irqrestore(&wl->irq_lock, flags);
         b43_synchronize_irq(dev);
 
+        write_lock_irqsave(&wl->tx_lock, flags);
         b43_set_status(dev, B43_STAT_INITIALIZED);
+        write_unlock_irqrestore(&wl->tx_lock, flags);
 
         b43_pio_stop(dev);
         mutex_unlock(&wl->mutex);
@@ -3485,8 +3501,6 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
         cancel_delayed_work_sync(&dev->periodic_work);
         mutex_lock(&wl->mutex);
 
-        ieee80211_stop_queues(wl->hw);  //FIXME this could cause a deadlock, as mac80211 seems buggy.
-
         b43_mac_suspend(dev);
         free_irq(dev->dev->irq, dev);
         b43dbg(wl, "Wireless interface stopped\n");
@@ -4498,6 +4512,7 @@ static int b43_wireless_init(struct ssb_device *dev)
         memset(wl, 0, sizeof(*wl));
         wl->hw = hw;
         spin_lock_init(&wl->irq_lock);
+        rwlock_init(&wl->tx_lock);
         spin_lock_init(&wl->leds_lock);
         spin_lock_init(&wl->shm_lock);
         mutex_init(&wl->mutex);