From owner-svn-src-all@FreeBSD.ORG  Sat Oct 31 17:59:25 2009
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 31E171065670;
	Sat, 31 Oct 2009 17:59:25 +0000 (UTC)
	(envelope-from nwhitehorn@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 205DE8FC0C;
	Sat, 31 Oct 2009 17:59:25 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n9VHxPYb098124;
	Sat, 31 Oct 2009 17:59:25 GMT
	(envelope-from nwhitehorn@svn.freebsd.org)
Received: (from nwhitehorn@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id n9VHxP4U098122;
	Sat, 31 Oct 2009 17:59:25 GMT
	(envelope-from nwhitehorn@svn.freebsd.org)
Message-Id: <200910311759.n9VHxP4U098122@svn.freebsd.org>
From: Nathan Whitehorn <nwhitehorn@FreeBSD.org>
Date: Sat, 31 Oct 2009 17:59:25 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r198724 - head/sys/powerpc/aim
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 31 Oct 2009 17:59:25 -0000

Author: nwhitehorn
Date: Sat Oct 31 17:59:24 2009
New Revision: 198724
URL: http://svn.freebsd.org/changeset/base/198724

Log:
  Fix a race in casuword() exposed by csup. casuword() non-atomically read
  the current value of its argument before atomically replacing it, which
  could occasionally return the wrong value on an SMP system. This resulted
  in user mutex operations hanging when using threaded applications.

Modified:
  head/sys/powerpc/aim/copyinout.c

Modified: head/sys/powerpc/aim/copyinout.c
==============================================================================
--- head/sys/powerpc/aim/copyinout.c	Sat Oct 31 17:55:48 2009	(r198723)
+++ head/sys/powerpc/aim/copyinout.c	Sat Oct 31 17:59:24 2009	(r198724)
@@ -347,8 +347,19 @@ casuword(volatile u_long *addr, u_long o
 		return (-1);
 	}
 
-	val = *p;
-	(void) atomic_cmpset_32((volatile uint32_t *)p, old, new);
+	__asm __volatile (
+		"1:\tlwarx %0, 0, %2\n\t"	/* load old value */
+		"cmplw %3, %0\n\t"		/* compare */
+		"bne 2f\n\t"			/* exit if not equal */
+		"stwcx. %4, 0, %2\n\t"      	/* attempt to store */
+		"bne- 1b\n\t"			/* spin if failed */
+		"b 3f\n\t"			/* we've succeeded */
+		"2:\n\t"
+		"stwcx. %0, 0, %2\n\t"       	/* clear reservation (74xx) */
+		"3:\n\t"
+		: "=&r" (val), "=m" (*p)
+		: "r" (p), "r" (old), "r" (new), "m" (*p)
+		: "cc", "memory");
 
 	td->td_pcb->pcb_onfault = NULL;