diff options
| author | Halil Pasic | 2020-06-16 06:50:34 +0200 |
|---|---|---|
| committer | Cornelia Huck | 2020-07-03 11:15:59 +0200 |
| commit | 1a8242f7c3f53341dd66253b142ecd06ce1d2a97 (patch) | |
| tree | d1b0e9ee27fbfbbfd9dc8caa7cc0265207de1225 /hw/riscv/sifive_clint.c | |
| parent | target/s390x: Fix SQXBR (diff) | |
| download | qemu-1a8242f7c3f53341dd66253b142ecd06ce1d2a97.tar.gz qemu-1a8242f7c3f53341dd66253b142ecd06ce1d2a97.tar.xz qemu-1a8242f7c3f53341dd66253b142ecd06ce1d2a97.zip | |
virtio-ccw: fix virtio_set_ind_atomic
The atomic_cmpxchg() loop is broken because we occasionally end up with
old and _old having different values (a legit compiler can generate code
that accessed *ind_addr again to pick up a value for _old instead of
using the value of old that was already fetched according to the
rules of the abstract machine). This means the underlying CS instruction
may use a different old (_old) than the one we intended to use if
atomic_cmpxchg() performed the xchg part.
Let us use volatile to force the rules of the abstract machine for
accesses to *ind_addr. Let us also rewrite the loop so, we that the
new old is used to compute the new desired value if the xchg part
is not performed.
Fixes: 7e7494627f ("s390x/virtio-ccw: Adapter interrupt support.")
Reported-by: Andre Wild <Andre.Wild1@ibm.com>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <20200616045035.51641-2-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Diffstat (limited to 'hw/riscv/sifive_clint.c')
0 files changed, 0 insertions, 0 deletions