When the value comparison fails in atomic_cmpxchg, the code branches
out without executing stxr, leaving the exclusive monitor in the
exclusive state set by ldxr.

Add `clrex` to the failure path to explicitly clear the exclusive
monitor.

Fixes: d2654a556835 ("xen: arm64: atomics")
Signed-off-by: Ryoji Okamoto <okamoto@valinux.co.jp>
---
 xen/arch/arm/include/asm/arm64/atomic.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/arm/include/asm/arm64/atomic.h b/xen/arch/arm/include/asm/arm64/atomic.h
index 4460165295..2c74ede740 100644
--- a/xen/arch/arm/include/asm/arm64/atomic.h
+++ b/xen/arch/arm/include/asm/arm64/atomic.h
@@ -118,7 +118,9 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
 "	b.ne	2f\n"
 "	stxr	%w0, %w4, %2\n"
 "	cbnz	%w0, 1b\n"
-"2:"
+"   b       3f\n"
+"2: clrex\n"
+"3:"
 	: "=&r" (tmp), "=&r" (oldval), "+Q" (v->counter)
 	: "Ir" (old), "r" (new)
 	: "cc");
-- 
2.43.0

On 09.09.2026 07:52, Ryoji Okamoto wrote:
> When the value comparison fails in atomic_cmpxchg, the code branches
> out without executing stxr, leaving the exclusive monitor in the
> exclusive state set by ldxr.
> 
> Add `clrex` to the failure path to explicitly clear the exclusive
> monitor.
> 
> Fixes: d2654a556835 ("xen: arm64: atomics")
> Signed-off-by: Ryoji Okamoto <okamoto@valinux.co.jp>

Reviewed-by: Jan Beulich <jbeulich@suse.com>
with ...

> --- a/xen/arch/arm/include/asm/arm64/atomic.h
> +++ b/xen/arch/arm/include/asm/arm64/atomic.h
> @@ -118,7 +118,9 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
>  "	b.ne	2f\n"
>  "	stxr	%w0, %w4, %2\n"
>  "	cbnz	%w0, 1b\n"
> -"2:"
> +"   b       3f\n"
> +"2: clrex\n"
> +"3:"

... padding changed to match that of surrounding code (hard tabs).

I have to admit though that I'm uncertain of the usefulness of the
new B that you insert. If CLREX is cheap enough, avoiding the extra
branch may be better.

Jan