[PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Bradley Morgan]

This is v4 of the two byte cmpxchg emulation series, wiring
cmpxchg_emu_u16() into arc, csky, sh and xtensa.

v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
a 16-bit mask in the 8-bit function, and a dead one at that, since the
compare guarantees the low 8 bits of old are the byte being returned.
David Laight asked where that cast came from. v4 returns old unmasked,
the exact behaviour the one-byte emulator always had, so nothing that
uses cmpxchg_emu_u8() through the widened prototypes sees a change.

David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
check to csky and sh but not arc and xtensa. v4 adds it there too, so a
cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
verified with each architecture's macro instantiated standalone.

While adding the type check to arc, the switch subject turned out to be
sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
arc the switch was always 4, so the size 1 and size 2 cases were dead
code and every sub-word cmpxchg() went through the 32-bit llock/scond
pair, comparing whole words against sub-word values, so the compare
almost never succeeded. The switch now tests the pointee, and the u8
path it was always meant to dispatch actually runs, so the one-byte
emulation works on arc for the first time since the sizeof bug landed
with the original cmpxchg_emu_u8() wiring.

The host test of 972 cases across both halfword offsets against a byte
level reference model still passes, and a 20000 case randomized run
checking the masked compare and return against a hardware cmpxchg r16
model passes with zero mismatches.

David pointed out on v1 that a u16 prototype does not compile warning
free when exchanging a pointer type, because the switch statements in
the architecture macros instantiate every size case, so a pointer
cmpxchg() type checks the two byte case, and the (u16) casts there
warn. v4 keeps taking the old and new values as unsigned long and
casting to u16 inside the function, so the call sites need no narrowing
casts and pointer exchanges compile clean. The function still compares
and returns exactly the 16 bits the caller asked for, which matches
hardware cmpxchg r16 behaviour.

The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.

Bradley Morgan (5):
  lib: Add two-byte cmpxchg emulation function
  ARC: Emulate two-byte cmpxchg
  sh: Emulate two-byte cmpxchg
  csky: Emulate two-byte cmpxchg
  xtensa: Emulate two-byte cmpxchg

[PATCH 1/5] lib: Add two-byte cmpxchg emulation function

[Bradley Morgan]

cmpxchg_emu_u8() emulates one-byte cmpxchg() in terms of four-byte
cmpxchg() for the architectures lacking native one-byte atomics.
The same architectures also lack native two-byte cmpxchg(), where
such an operation is not supported and either fails to compile via
BUILD_BUG() or fails to link, because the bad pointer sentinels
these architectures declare are never defined.

Add cmpxchg_emu_u16(), the two-byte sibling. It reads the enclosing
word with READ_ONCE(), splices the two target bytes through a union
and loops on cmpxchg() of the full word until the compare succeeds.
Like cmpxchg_emu_u8() it is fully ordered.

Unlike cmpxchg_emu_u8() it casts the old and new values to u16
internally and returns unsigned long, taking the old and new values
as unsigned long, per the suggestion from David Laight. The switch
statements in the architecture macros instantiate every size case,
so a cmpxchg() on a pointer type checks the two-byte case as well,
and a u16 parameter or return would make the macro casts and return
conversions warn there. With unsigned long parameters and return the
call sites need no narrowing casts, pointer exchanges compile warning
free, and the function still compares and returns exactly the 16 bits
the caller asked for, which matches the hardware cmpxchg r16
behaviour where a 16-bit compare only looks at the low 16 bits of
the register.

cmpxchg_emu_u8() keeps returning the old value unmasked, so a caller
that passes a wider old than 8 bits still gets it back as passed,
matching the behaviour the one-byte emulator always had.

The Kconfig symbol gating this file is renamed from
ARCH_NEED_CMPXCHG_1_EMU to ARCH_NEED_CMPXCHG_1_2_EMU, as it now
selects both the one-byte and the two-byte emulation.

Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 arch/Kconfig                |  2 +-
 arch/arc/Kconfig            |  2 +-
 arch/csky/Kconfig           |  2 +-
 arch/sh/Kconfig             |  2 +-
 arch/xtensa/Kconfig         |  2 +-
 include/linux/cmpxchg-emu.h |  4 +++-
 lib/Makefile                |  2 +-
 lib/cmpxchg-emu.c           | 38 +++++++++++++++++++++++++++++++++----
 8 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index 3bb2e568f5b1..d56064797e09 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -1817,7 +1817,7 @@ config CC_HAS_SANE_FUNCTION_ALIGNMENT
 	# strict alignment always, even with -falign-functions.
 	def_bool CC_HAS_MIN_FUNCTION_ALIGNMENT || CC_IS_CLANG
 
-config ARCH_NEED_CMPXCHG_1_EMU
+config ARCH_NEED_CMPXCHG_1_2_EMU
 	bool
 
 config ARCH_WANTS_PRE_LINK_VMLINUX
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 80e61175bf52..0e91d254eccb 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -14,7 +14,7 @@ config ARC
 	select ARCH_HAS_SETUP_DMA_OPS
 	select ARCH_HAS_SYNC_DMA_FOR_CPU
 	select ARCH_HAS_SYNC_DMA_FOR_DEVICE
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select ARCH_SUPPORTS_ATOMIC_RMW if ARC_HAS_LLSC
 	select ARCH_32BIT_OFF_T
 	select BUILDTIME_TABLE_SORT
diff --git a/arch/csky/Kconfig b/arch/csky/Kconfig
index 4331313a42ff..5f26e8615d7d 100644
--- a/arch/csky/Kconfig
+++ b/arch/csky/Kconfig
@@ -37,7 +37,7 @@ config CSKY
 	select ARCH_INLINE_SPIN_UNLOCK_BH if !PREEMPTION
 	select ARCH_INLINE_SPIN_UNLOCK_IRQ if !PREEMPTION
 	select ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE if !PREEMPTION
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select ARCH_WANT_FRAME_POINTERS if !CPU_CK610 && $(cc-option,-mbacktrace)
 	select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT
 	select COMMON_CLK
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index d60f1d5a94c0..09e556fced01 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -14,7 +14,7 @@ config SUPERH
 	select ARCH_HIBERNATION_POSSIBLE if MMU
 	select ARCH_MIGHT_HAVE_PC_PARPORT
 	select ARCH_WANT_IPC_PARSE_VERSION
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select CPU_NO_EFFICIENT_FFS
 	select DMA_DECLARE_COHERENT
 	select GENERIC_ATOMIC64
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index f2f9cd9cde50..62019fd444d4 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -14,7 +14,7 @@ config XTENSA
 	select ARCH_HAS_DMA_SET_UNCACHED if MMU
 	select ARCH_HAS_STRNCPY_FROM_USER if !KASAN
 	select ARCH_HAS_STRNLEN_USER
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select ARCH_USE_MEMTEST
 	select ARCH_USE_QUEUED_RWLOCKS
 	select ARCH_USE_QUEUED_SPINLOCKS
diff --git a/include/linux/cmpxchg-emu.h b/include/linux/cmpxchg-emu.h
index 998deec67740..2db70f1e3925 100644
--- a/include/linux/cmpxchg-emu.h
+++ b/include/linux/cmpxchg-emu.h
@@ -4,12 +4,14 @@
  * lacking direct support for these sizes.  These are implemented in terms
  * of 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #ifndef __LINUX_CMPXCHG_EMU_H
 #define __LINUX_CMPXCHG_EMU_H
 
 uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new);
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new);
 
 #endif /* __LINUX_CMPXCHG_EMU_H */
diff --git a/lib/Makefile b/lib/Makefile
index 43421c39d21b..d0e69312176a 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -202,7 +202,7 @@ obj-$(CONFIG_CODE_TAGGING) += codetag.o
 lib-$(CONFIG_GENERIC_BUG) += bug.o
 
 obj-$(CONFIG_HAVE_ARCH_TRACEHOOK) += syscall.o
-obj-$(CONFIG_ARCH_NEED_CMPXCHG_1_EMU) += cmpxchg-emu.o
+obj-$(CONFIG_ARCH_NEED_CMPXCHG_1_2_EMU) += cmpxchg-emu.o
 
 obj-$(CONFIG_DYNAMIC_DEBUG_CORE) += dynamic_debug.o
 #ensure exported functions have prototypes
diff --git a/lib/cmpxchg-emu.c b/lib/cmpxchg-emu.c
index 27f6f97cb60d..25c69224a759 100644
--- a/lib/cmpxchg-emu.c
+++ b/lib/cmpxchg-emu.c
@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
- * Emulated 1-byte cmpxchg operation for architectures lacking direct
- * support for this size.  This is implemented in terms of 4-byte cmpxchg
- * operations.
+ * Emulated 1-byte and 2-byte cmpxchg operations for architectures lacking
+ * direct support for these sizes.  These are implemented in terms of
+ * 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #include <linux/types.h>
@@ -43,3 +44,32 @@ uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new)
 	return old;
 }
 EXPORT_SYMBOL_GPL(cmpxchg_emu_u8);
+
+union u16_32 {
+	u16 h[2];
+	u32 w;
+};
+
+/* Emulate two-byte cmpxchg() in terms of 4-byte cmpxchg. */
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new)
+{
+	u32 *p32 = (u32 *)(((uintptr_t)p) & ~0x3);
+	int i = (((uintptr_t)p) & 0x2) / 2;
+	union u16_32 old32;
+	union u16_32 new32;
+	u32 ret;
+
+	WARN_ON_ONCE(((uintptr_t)p) & 0x1);
+	ret = READ_ONCE(*p32);
+	do {
+		old32.w = ret;
+		if (old32.h[i] != (u16)old)
+			return (unsigned long)old32.h[i];
+		new32.w = old32.w;
+		new32.h[i] = (u16)new;
+		instrument_atomic_read_write(p, 2);
+		ret = data_race(cmpxchg(p32, old32.w, new32.w)); // Overridden above.
+	} while (ret != old32.w);
+	return (u16)old;
+}
+EXPORT_SYMBOL_GPL(cmpxchg_emu_u16);
-- 
2.47.3

[PATCH 2/5] ARC: Emulate two-byte cmpxchg

[Bradley Morgan]

ARC has no two-byte atomic compare and swap, so the arch_cmpxchg_relaxed()
macro switch lets case 2 fall through to BUILD_BUG() via default. Route case
2 through the new cmpxchg_emu_u16(), which takes the old and new
values as unsigned long and narrows them itself, so the (uintptr_t)
casts on _o_ and _n_ are no longer needed and the case 2 call passes
them straight.

The switch also now tests sizeof(*(_p_)) instead of sizeof((_p_)),
which switched on the pointer and made the size 1 and size 2 cases
dead code, routing every sub-word cmpxchg() through the 32-bit
llock/scond pair and comparing whole words against sub-word values,
so the compare almost never succeeded. The old and new values are
now declared as unsigned long through (unsigned long)(0 ? *(_p_) :
(old)), the idiom David Laight suggested, which type checks the
arguments against the pointee, so cmpxchg(&p, 4, 5) no longer
compiles silently.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 arch/arc/include/asm/cmpxchg.h | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
index 76f43db0890f..4596edfefa95 100644
--- a/arch/arc/include/asm/cmpxchg.h
+++ b/arch/arc/include/asm/cmpxchg.h
@@ -42,16 +42,19 @@
 #define arch_cmpxchg_relaxed(ptr, old, new)				\
 ({									\
 	__typeof__(ptr) _p_ = (ptr);					\
-	__typeof__(*(ptr)) _o_ = (old);					\
-	__typeof__(*(ptr)) _n_ = (new);					\
+	unsigned long _old_ = (unsigned long)(0 ? *(_p_) : (old));		\
+	unsigned long _new_ = (unsigned long)(0 ? *(_p_) : (new));		\
 	__typeof__(*(ptr)) _prev_;					\
 									\
-	switch(sizeof((_p_))) {						\
+	switch (sizeof(*(_p_))) {						\
 	case 1:								\
-		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
+		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, _old_, _new_);	\
+		break;							\
+	case 2:								\
+		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, _old_, _new_);	\
 		break;							\
 	case 4:								\
-		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
+		_prev_ = (__typeof__(*(ptr)))__cmpxchg(_p_, _old_, _new_);			\
 		break;							\
 	default:							\
 		BUILD_BUG();						\
@@ -64,8 +67,8 @@
 #define arch_cmpxchg(ptr, old, new)				        \
 ({									\
 	volatile __typeof__(ptr) _p_ = (ptr);				\
-	__typeof__(*(ptr)) _o_ = (old);					\
-	__typeof__(*(ptr)) _n_ = (new);					\
+	unsigned long _old_ = (unsigned long)(0 ? *(_p_) : (old));		\
+	unsigned long _new_ = (unsigned long)(0 ? *(_p_) : (new));		\
 	__typeof__(*(ptr)) _prev_;					\
 	unsigned long __flags;						\
 									\
@@ -102,7 +105,7 @@
 	__typeof__(ptr) _p_ = (ptr);					\
 	__typeof__(*(ptr)) _val_ = (val);				\
 									\
-	switch(sizeof(*(_p_))) {					\
+	switch (sizeof(*(_p_))) {					\
 	case 4:								\
 		_val_ = __arch_xchg(_p_, _val_);			\
 		break;							\
-- 
2.47.3

Re: [PATCH 2/5] ARC: Emulate two-byte cmpxchg

[David Laight]

On Tue, 22 Sep 2026 17:33:51 +0000
Bradley Morgan <brads@mainlining.org> wrote:

> ARC has no two-byte atomic compare and swap, so the arch_cmpxchg_relaxed()
> macro switch lets case 2 fall through to BUILD_BUG() via default. Route case
> 2 through the new cmpxchg_emu_u16(), which takes the old and new
> values as unsigned long and narrows them itself, so the (uintptr_t)
> casts on _o_ and _n_ are no longer needed and the case 2 call passes
> them straight.
> 
> The switch also now tests sizeof(*(_p_)) instead of sizeof((_p_)),
> which switched on the pointer and made the size 1 and size 2 cases
> dead code, routing every sub-word cmpxchg() through the 32-bit
> llock/scond pair and comparing whole words against sub-word values,
> so the compare almost never succeeded.

Hmmm... that looks like it warrants a 'Fixes' tag.
Clearly no one uses 'arc'.

David

> The old and new values are
> now declared as unsigned long through (unsigned long)(0 ? *(_p_) :
> (old)), the idiom David Laight suggested, which type checks the
> arguments against the pointee, so cmpxchg(&p, 4, 5) no longer
> compiles silently.
> 
> Signed-off-by: Bradley Morgan <brads@mainlining.org>
> ---
>  arch/arc/include/asm/cmpxchg.h | 19 +++++++++++--------
>  1 file changed, 11 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
> index 76f43db0890f..4596edfefa95 100644
> --- a/arch/arc/include/asm/cmpxchg.h
> +++ b/arch/arc/include/asm/cmpxchg.h
> @@ -42,16 +42,19 @@
>  #define arch_cmpxchg_relaxed(ptr, old, new)				\
>  ({									\
>  	__typeof__(ptr) _p_ = (ptr);					\
> -	__typeof__(*(ptr)) _o_ = (old);					\
> -	__typeof__(*(ptr)) _n_ = (new);					\
> +	unsigned long _old_ = (unsigned long)(0 ? *(_p_) : (old));		\
> +	unsigned long _new_ = (unsigned long)(0 ? *(_p_) : (new));		\
>  	__typeof__(*(ptr)) _prev_;					\
>  									\
> -	switch(sizeof((_p_))) {						\
> +	switch (sizeof(*(_p_))) {						\
>  	case 1:								\
> -		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
> +		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, _old_, _new_);	\
> +		break;							\
> +	case 2:								\
> +		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, _old_, _new_);	\
>  		break;							\
>  	case 4:								\
> -		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
> +		_prev_ = (__typeof__(*(ptr)))__cmpxchg(_p_, _old_, _new_);			\
>  		break;							\
>  	default:							\
>  		BUILD_BUG();						\
> @@ -64,8 +67,8 @@
>  #define arch_cmpxchg(ptr, old, new)				        \
>  ({									\
>  	volatile __typeof__(ptr) _p_ = (ptr);				\
> -	__typeof__(*(ptr)) _o_ = (old);					\
> -	__typeof__(*(ptr)) _n_ = (new);					\
> +	unsigned long _old_ = (unsigned long)(0 ? *(_p_) : (old));		\
> +	unsigned long _new_ = (unsigned long)(0 ? *(_p_) : (new));		\
>  	__typeof__(*(ptr)) _prev_;					\
>  	unsigned long __flags;						\
>  									\
> @@ -102,7 +105,7 @@
>  	__typeof__(ptr) _p_ = (ptr);					\
>  	__typeof__(*(ptr)) _val_ = (val);				\
>  									\
> -	switch(sizeof(*(_p_))) {					\
> +	switch (sizeof(*(_p_))) {					\
>  	case 4:								\
>  		_val_ = __arch_xchg(_p_, _val_);			\
>  		break;							\

[PATCH 3/5] sh: Emulate two-byte cmpxchg

[Bradley Morgan]

SH has no byte or halfword atomic memory operations, so the __cmpxchg()
switch routes case 1 through cmpxchg_emu_u8() and lets case 2 fall
through to __cmpxchg_called_with_bad_pointer(), which is declared but
never defined, so a two-byte cmpxchg() fails at link time. Route case
2 through the new cmpxchg_emu_u16(), which takes the old and new
values as unsigned long, so the (unsigned long) casts move off the
call and into _old_ and _new_ declarations that type check the old
and new arguments against *ptr through (unsigned long)(0 ? *ptr : _o_),
the idiom David Laight suggested, so cmpxchg(&p, 4, 5) no longer
compiles silently.

Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 arch/sh/include/asm/cmpxchg.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/sh/include/asm/cmpxchg.h b/arch/sh/include/asm/cmpxchg.h
index 1e5dc5ccf7bf..b87f59107b4e 100644
--- a/arch/sh/include/asm/cmpxchg.h
+++ b/arch/sh/include/asm/cmpxchg.h
@@ -59,6 +59,8 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
 	switch (size) {
 	case 1:
 		return cmpxchg_emu_u8(ptr, old, new);
+	case 2:
+		return cmpxchg_emu_u16(ptr, old, new);
 	case 4:
 		return __cmpxchg_u32(ptr, old, new);
 	}
@@ -70,8 +72,10 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
   ({									 \
      __typeof__(*(ptr)) _o_ = (o);					 \
      __typeof__(*(ptr)) _n_ = (n);					 \
-     (__typeof__(*(ptr))) __cmpxchg((ptr), (unsigned long)_o_,		 \
-				    (unsigned long)_n_, sizeof(*(ptr))); \
+     unsigned long _old_ = (unsigned long)(0 ? *ptr : _o_);	 \
+     unsigned long _new_ = (unsigned long)(0 ? *ptr : _n_);	 \
+     (__typeof__(*(ptr))) __cmpxchg((ptr), _old_,				 \
+				    _new_, sizeof(*(ptr)));	 \
   })
 
 #include <asm-generic/cmpxchg-local.h>
-- 
2.47.3

Re: [PATCH 3/5] sh: Emulate two-byte cmpxchg

[David Laight]

On Tue, 22 Sep 2026 17:33:52 +0000
Bradley Morgan <brads@mainlining.org> wrote:

You missed v4 from the subject line of all the patches.

> SH has no byte or halfword atomic memory operations, so the __cmpxchg()
> switch routes case 1 through cmpxchg_emu_u8() and lets case 2 fall
> through to __cmpxchg_called_with_bad_pointer(), which is declared but
> never defined, so a two-byte cmpxchg() fails at link time. Route case
> 2 through the new cmpxchg_emu_u16(), which takes the old and new
> values as unsigned long, so the (unsigned long) casts move off the
> call and into _old_ and _new_ declarations that type check the old
> and new arguments against *ptr through (unsigned long)(0 ? *ptr : _o_),
> the idiom David Laight suggested, so cmpxchg(&p, 4, 5) no longer
> compiles silently.
> 
> Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
> Signed-off-by: Bradley Morgan <brads@mainlining.org>
> ---
>  arch/sh/include/asm/cmpxchg.h | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/sh/include/asm/cmpxchg.h b/arch/sh/include/asm/cmpxchg.h
> index 1e5dc5ccf7bf..b87f59107b4e 100644
> --- a/arch/sh/include/asm/cmpxchg.h
> +++ b/arch/sh/include/asm/cmpxchg.h
> @@ -59,6 +59,8 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
>  	switch (size) {
>  	case 1:
>  		return cmpxchg_emu_u8(ptr, old, new);
> +	case 2:
> +		return cmpxchg_emu_u16(ptr, old, new);
>  	case 4:
>  		return __cmpxchg_u32(ptr, old, new);
>  	}
> @@ -70,8 +72,10 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
>    ({									 \
>       __typeof__(*(ptr)) _o_ = (o);					 \
>       __typeof__(*(ptr)) _n_ = (n);					 \
> -     (__typeof__(*(ptr))) __cmpxchg((ptr), (unsigned long)_o_,		 \
> -				    (unsigned long)_n_, sizeof(*(ptr))); \
> +     unsigned long _old_ = (unsigned long)(0 ? *ptr : _o_);	 \
> +     unsigned long _new_ = (unsigned long)(0 ? *ptr : _n_);	 \
> +     (__typeof__(*(ptr))) __cmpxchg((ptr), _old_,				 \
> +				    _new_, sizeof(*(ptr)));	 \

Minor niggle if you have to do these again...
That line doesn't look long enough to need splitting.
More generally if you add 'unsigned long _rval_' and put a final cast
at the bottom the the #define the code will probably look neater.

David

>    })
>  
>  #include <asm-generic/cmpxchg-local.h>

[PATCH 4/5] csky: Emulate two-byte cmpxchg

[Bradley Morgan]

C-SKY has no two-byte atomic compare and swap, so the __cmpxchg()
macros let case 2 fall through to BUILD_BUG() via default. Route case
2 through the new cmpxchg_emu_u16(), which takes the old and new
values as unsigned long, so the (uintptr_t) casts on __old and __new
are no longer needed and the case 2 call passes them straight. The
old and new values are declared as unsigned long through
(unsigned long)(0 ? *(ptr) : (old)), the idiom David Laight
suggested, which type checks the arguments against the pointee, so
cmpxchg(&p, 4, 5) no longer compiles silently.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 arch/csky/include/asm/cmpxchg.h | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/arch/csky/include/asm/cmpxchg.h b/arch/csky/include/asm/cmpxchg.h
index db6dda47184e..29dc56e4b7f1 100644
--- a/arch/csky/include/asm/cmpxchg.h
+++ b/arch/csky/include/asm/cmpxchg.h
@@ -57,13 +57,16 @@
 #define __cmpxchg_relaxed(ptr, old, new, size)			\
 ({								\
 	__typeof__(ptr) __ptr = (ptr);				\
-	__typeof__(new) __new = (new);				\
-	__typeof__(new) __tmp;					\
-	__typeof__(old) __old = (old);				\
+	unsigned long __old = (unsigned long)(0 ? *(ptr) : (old));	\
+	unsigned long __new = (unsigned long)(0 ? *(ptr) : (new));	\
+	unsigned long __tmp;					\
 	__typeof__(*(ptr)) __ret;				\
 	switch (size) {						\
 	case 1:							\
-		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, __old, __new); \
+		break;						\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, __old, __new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
@@ -90,13 +93,16 @@
 #define __cmpxchg_acquire(ptr, old, new, size)			\
 ({								\
 	__typeof__(ptr) __ptr = (ptr);				\
-	__typeof__(new) __new = (new);				\
-	__typeof__(new) __tmp;					\
-	__typeof__(old) __old = (old);				\
+	unsigned long __old = (unsigned long)(0 ? *(ptr) : (old));	\
+	unsigned long __new = (unsigned long)(0 ? *(ptr) : (new));	\
+	unsigned long __tmp;					\
 	__typeof__(*(ptr)) __ret;				\
 	switch (size) {						\
 	case 1:							\
-		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, __old, __new); \
+		break;						\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, __old, __new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
@@ -124,13 +130,16 @@
 #define __cmpxchg(ptr, old, new, size)				\
 ({								\
 	__typeof__(ptr) __ptr = (ptr);				\
-	__typeof__(new) __new = (new);				\
-	__typeof__(new) __tmp;					\
-	__typeof__(old) __old = (old);				\
+	unsigned long __old = (unsigned long)(0 ? *(ptr) : (old));	\
+	unsigned long __new = (unsigned long)(0 ? *(ptr) : (new));	\
+	unsigned long __tmp;					\
 	__typeof__(*(ptr)) __ret;				\
 	switch (size) {						\
 	case 1:							\
-		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, __old, __new); \
+		break;						\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, __old, __new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
-- 
2.47.3

[PATCH 5/5] xtensa: Emulate two-byte cmpxchg

[Bradley Morgan]

Xtensa has no two-byte atomic compare and swap, so the __cmpxchg()
switch lets case 2 fall through to __cmpxchg_called_with_bad_pointer(),
which is declared but never defined, so a two-byte cmpxchg() fails at
link time. Route case 2 through the new cmpxchg_emu_u16(), which takes
the old and new values as unsigned long, so the (unsigned long) casts
on _o_ and _n_ move off the call and into _old_ and _new_ declarations
that type check the old and new arguments against *ptr through
(unsigned long)(0 ? *ptr : (o)), the idiom David Laight suggested,
so cmpxchg(&p, 4, 5) no longer compiles silently.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 arch/xtensa/include/asm/cmpxchg.h | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/xtensa/include/asm/cmpxchg.h b/arch/xtensa/include/asm/cmpxchg.h
index b6db4838b175..f6bed4221b43 100644
--- a/arch/xtensa/include/asm/cmpxchg.h
+++ b/arch/xtensa/include/asm/cmpxchg.h
@@ -76,6 +76,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 {
 	switch (size) {
 	case 1:  return cmpxchg_emu_u8(ptr, old, new);
+	case 2:  return cmpxchg_emu_u16(ptr, old, new);
 	case 4:  return __cmpxchg_u32(ptr, old, new);
 	default: __cmpxchg_called_with_bad_pointer();
 		 return old;
@@ -83,10 +84,10 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 }
 
 #define arch_cmpxchg(ptr,o,n)						      \
-	({ __typeof__(*(ptr)) _o_ = (o);				      \
-	   __typeof__(*(ptr)) _n_ = (n);				      \
-	   (__typeof__(*(ptr))) __cmpxchg((ptr), (unsigned long)_o_,	      \
-	   			        (unsigned long)_n_, sizeof (*(ptr))); \
+	({ unsigned long _old_ = (unsigned long)(0 ? *(ptr) : (o));	      \
+	unsigned long _new_ = (unsigned long)(0 ? *(ptr) : (n));	      \
+	(__typeof__(*(ptr))) __cmpxchg((ptr), _old_,		      \
+				_new_, sizeof (*(ptr))); \
 	})
 
 #include <asm-generic/cmpxchg-local.h>
-- 
2.47.3

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Paul E. McKenney]

On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
> This is v4 of the two byte cmpxchg emulation series, wiring
> cmpxchg_emu_u16() into arc, csky, sh and xtensa.
> 
> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
> a 16-bit mask in the 8-bit function, and a dead one at that, since the
> compare guarantees the low 8 bits of old are the byte being returned.
> David Laight asked where that cast came from. v4 returns old unmasked,
> the exact behaviour the one-byte emulator always had, so nothing that
> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
> 
> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
> check to csky and sh but not arc and xtensa. v4 adds it there too, so a
> cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
> verified with each architecture's macro instantiated standalone.
> 
> While adding the type check to arc, the switch subject turned out to be
> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
> arc the switch was always 4, so the size 1 and size 2 cases were dead
> code and every sub-word cmpxchg() went through the 32-bit llock/scond
> pair, comparing whole words against sub-word values, so the compare
> almost never succeeded. The switch now tests the pointee, and the u8
> path it was always meant to dispatch actually runs, so the one-byte
> emulation works on arc for the first time since the sizeof bug landed
> with the original cmpxchg_emu_u8() wiring.
> 
> The host test of 972 cases across both halfword offsets against a byte
> level reference model still passes, and a 20000 case randomized run
> checking the masked compare and return against a hardware cmpxchg r16
> model passes with zero mismatches.
> 
> David pointed out on v1 that a u16 prototype does not compile warning
> free when exchanging a pointer type, because the switch statements in
> the architecture macros instantiate every size case, so a pointer
> cmpxchg() type checks the two byte case, and the (u16) casts there
> warn. v4 keeps taking the old and new values as unsigned long and
> casting to u16 inside the function, so the call sites need no narrowing
> casts and pointer exchanges compile clean. The function still compares
> and returns exactly the 16 bits the caller asked for, which matches
> hardware cmpxchg r16 behaviour.
> 
> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.

I have pulled these in, but only to expose them to things like the kernel
test robot.  My guess is that they will go in by some other path.

And to that end:

Reviewed-by: Paul E. McKenney <paulmck@kernel.org>

But I could of course easily be missing subtle arch-specific bugs.

							Thanx, Paul

> Bradley Morgan (5):
>   lib: Add two-byte cmpxchg emulation function
>   ARC: Emulate two-byte cmpxchg
>   sh: Emulate two-byte cmpxchg
>   csky: Emulate two-byte cmpxchg
>   xtensa: Emulate two-byte cmpxchg

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Bradley Morgan]

On 22 September 2026 19:29:32 BST, "Paul E. McKenney" <paulmck@kernel.org>
wrote:
>On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
>> This is v4 of the two byte cmpxchg emulation series, wiring
>> cmpxchg_emu_u16() into arc, csky, sh and xtensa.
>> 
>> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
>> a 16-bit mask in the 8-bit function, and a dead one at that, since the
>> compare guarantees the low 8 bits of old are the byte being returned.
>> David Laight asked where that cast came from. v4 returns old unmasked,
>> the exact behaviour the one-byte emulator always had, so nothing that
>> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
>> 
>> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
>> check to csky and sh but not arc and xtensa. v4 adds it there too, so a
>> cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
>> verified with each architecture's macro instantiated standalone.
>> 
>> While adding the type check to arc, the switch subject turned out to be
>> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
>> arc the switch was always 4, so the size 1 and size 2 cases were dead
>> code and every sub-word cmpxchg() went through the 32-bit llock/scond
>> pair, comparing whole words against sub-word values, so the compare
>> almost never succeeded. The switch now tests the pointee, and the u8
>> path it was always meant to dispatch actually runs, so the one-byte
>> emulation works on arc for the first time since the sizeof bug landed
>> with the original cmpxchg_emu_u8() wiring.
>> 
>> The host test of 972 cases across both halfword offsets against a byte
>> level reference model still passes, and a 20000 case randomized run
>> checking the masked compare and return against a hardware cmpxchg r16
>> model passes with zero mismatches.
>> 
>> David pointed out on v1 that a u16 prototype does not compile warning
>> free when exchanging a pointer type, because the switch statements in
>> the architecture macros instantiate every size case, so a pointer
>> cmpxchg() type checks the two byte case, and the (u16) casts there
>> warn. v4 keeps taking the old and new values as unsigned long and
>> casting to u16 inside the function, so the call sites need no narrowing
>> casts and pointer exchanges compile clean. The function still compares
>> and returns exactly the 16 bits the caller asked for, which matches
>> hardware cmpxchg r16 behaviour.
>> 
>> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
>> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
>
>I have pulled these in, but only to expose them to things like the kernel
>test robot.  My guess is that they will go in by some other path.
>
>And to that end:
>
>Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
>
>But I could of course easily be missing subtle arch-specific bugs.

There are, according to sashiko, but I can't seem to make that thing happy
no matter what I do

>
>							Thanx, Paul
>
>> Bradley Morgan (5):
>>   lib: Add two-byte cmpxchg emulation function
>>   ARC: Emulate two-byte cmpxchg
>>   sh: Emulate two-byte cmpxchg
>>   csky: Emulate two-byte cmpxchg
>>   xtensa: Emulate two-byte cmpxchg

--- Thanks!
"I'm not a very positive person" - Linus torvalds

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Paul E. McKenney]

On Tue, Sep 22, 2026 at 07:37:54PM +0100, Bradley Morgan wrote:
> On 22 September 2026 19:29:32 BST, "Paul E. McKenney" <paulmck@kernel.org>
> wrote:
> >On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
> >> This is v4 of the two byte cmpxchg emulation series, wiring
> >> cmpxchg_emu_u16() into arc, csky, sh and xtensa.
> >> 
> >> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
> >> a 16-bit mask in the 8-bit function, and a dead one at that, since the
> >> compare guarantees the low 8 bits of old are the byte being returned.
> >> David Laight asked where that cast came from. v4 returns old unmasked,
> >> the exact behaviour the one-byte emulator always had, so nothing that
> >> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
> >> 
> >> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
> >> check to csky and sh but not arc and xtensa. v4 adds it there too, so a
> >> cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
> >> verified with each architecture's macro instantiated standalone.
> >> 
> >> While adding the type check to arc, the switch subject turned out to be
> >> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
> >> arc the switch was always 4, so the size 1 and size 2 cases were dead
> >> code and every sub-word cmpxchg() went through the 32-bit llock/scond
> >> pair, comparing whole words against sub-word values, so the compare
> >> almost never succeeded. The switch now tests the pointee, and the u8
> >> path it was always meant to dispatch actually runs, so the one-byte
> >> emulation works on arc for the first time since the sizeof bug landed
> >> with the original cmpxchg_emu_u8() wiring.
> >> 
> >> The host test of 972 cases across both halfword offsets against a byte
> >> level reference model still passes, and a 20000 case randomized run
> >> checking the masked compare and return against a hardware cmpxchg r16
> >> model passes with zero mismatches.
> >> 
> >> David pointed out on v1 that a u16 prototype does not compile warning
> >> free when exchanging a pointer type, because the switch statements in
> >> the architecture macros instantiate every size case, so a pointer
> >> cmpxchg() type checks the two byte case, and the (u16) casts there
> >> warn. v4 keeps taking the old and new values as unsigned long and
> >> casting to u16 inside the function, so the call sites need no narrowing
> >> casts and pointer exchanges compile clean. The function still compares
> >> and returns exactly the 16 bits the caller asked for, which matches
> >> hardware cmpxchg r16 behaviour.
> >> 
> >> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
> >> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
> >
> >I have pulled these in, but only to expose them to things like the kernel
> >test robot.  My guess is that they will go in by some other path.
> >
> >And to that end:
> >
> >Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
> >
> >But I could of course easily be missing subtle arch-specific bugs.
> 
> There are, according to sashiko, but I can't seem to make that thing happy
> no matter what I do

Hahahahaha!!!

We forgot to CC the architecture maintainers.

For the changes to lib/cmpxchg-emu.c:

	Cc: Andrew Morton <akpm@linux-foundation.org>
	Cc: Arnd Bergmann <arnd@kernel.org>

For ARC:

	Cc: Vineet Gupta <vgupta@kernel.org>
	linux-snps-arc@lists.infradead.org

For sh:

	Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
	Cc: Rich Felker <dalias@libc.org>
	Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
	Cc: <linux-sh@vger.kernel.org>

For csky:

	Cc: Guo Ren <guoren@kernel.org>
	Cc: <linux-csky@vger.kernel.org>
	Cc: <linux-kernel@vger.kernel.org>

For xtensa:

	Cc: Chris Zankel <chris@zankel.net>
	Cc: Max Filippov <jcmvbkbc@gmail.com>

They might be willing to help.  ;-)

							Thanx, Paul

> >> Bradley Morgan (5):
> >>   lib: Add two-byte cmpxchg emulation function
> >>   ARC: Emulate two-byte cmpxchg
> >>   sh: Emulate two-byte cmpxchg
> >>   csky: Emulate two-byte cmpxchg
> >>   xtensa: Emulate two-byte cmpxchg
> 
> --- Thanks!
> "I'm not a very positive person" - Linus torvalds

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Bradley Morgan]

On 22 September 2026 19:59:39 BST, "Paul E. McKenney" <paulmck@kernel.org>
wrote:
>On Tue, Sep 22, 2026 at 07:37:54PM +0100, Bradley Morgan wrote:
>> On 22 September 2026 19:29:32 BST, "Paul E. McKenney"
><paulmck@kernel.org>
>> wrote:
>> >On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
>> >> This is v4 of the two byte cmpxchg emulation series, wiring
>> >> cmpxchg_emu_u16() into arc, csky, sh and xtensa.
>> >> 
>> >> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which
>was
>> >> a 16-bit mask in the 8-bit function, and a dead one at that, since
>the
>> >> compare guarantees the low 8 bits of old are the byte being returned.
>> >> David Laight asked where that cast came from. v4 returns old
>unmasked,
>> >> the exact behaviour the one-byte emulator always had, so nothing that
>> >> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
>> >> 
>> >> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old))
>type
>> >> check to csky and sh but not arc and xtensa. v4 adds it there too, so
>a
>> >> cmpxchg(&p, 4, 5) fails to compile on every architecture in the
>series,
>> >> verified with each architecture's macro instantiated standalone.
>> >> 
>> >> While adding the type check to arc, the switch subject turned out to
>be
>> >> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On
>32-bit
>> >> arc the switch was always 4, so the size 1 and size 2 cases were dead
>> >> code and every sub-word cmpxchg() went through the 32-bit llock/scond
>> >> pair, comparing whole words against sub-word values, so the compare
>> >> almost never succeeded. The switch now tests the pointee, and the u8
>> >> path it was always meant to dispatch actually runs, so the one-byte
>> >> emulation works on arc for the first time since the sizeof bug landed
>> >> with the original cmpxchg_emu_u8() wiring.
>> >> 
>> >> The host test of 972 cases across both halfword offsets against a
>byte
>> >> level reference model still passes, and a 20000 case randomized run
>> >> checking the masked compare and return against a hardware cmpxchg r16
>> >> model passes with zero mismatches.
>> >> 
>> >> David pointed out on v1 that a u16 prototype does not compile warning
>> >> free when exchanging a pointer type, because the switch statements in
>> >> the architecture macros instantiate every size case, so a pointer
>> >> cmpxchg() type checks the two byte case, and the (u16) casts there
>> >> warn. v4 keeps taking the old and new values as unsigned long and
>> >> casting to u16 inside the function, so the call sites need no
>narrowing
>> >> casts and pointer exchanges compile clean. The function still
>compares
>> >> and returns exactly the 16 bits the caller asked for, which matches
>> >> hardware cmpxchg r16 behaviour.
>> >> 
>> >> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
>> >> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
>> >
>> >I have pulled these in, but only to expose them to things like the
>kernel
>> >test robot.  My guess is that they will go in by some other path.
>> >
>> >And to that end:
>> >
>> >Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
>> >
>> >But I could of course easily be missing subtle arch-specific bugs.
>> 
>> There are, according to sashiko, but I can't seem to make that thing
>happy
>> no matter what I do
>
>Hahahahaha!!!
>
>We forgot to CC the architecture maintainers.
>
>For the changes to lib/cmpxchg-emu.c:
>
>	Cc: Andrew Morton <akpm@linux-foundation.org>
>	Cc: Arnd Bergmann <arnd@kernel.org>
>
>For ARC:
>
>	Cc: Vineet Gupta <vgupta@kernel.org>
>	linux-snps-arc@lists.infradead.org
>
>For sh:
>
>	Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
>	Cc: Rich Felker <dalias@libc.org>
>	Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
>	Cc: <linux-sh@vger.kernel.org>
>
>For csky:
>
>	Cc: Guo Ren <guoren@kernel.org>
>	Cc: <linux-csky@vger.kernel.org>
>	Cc: <linux-kernel@vger.kernel.org>
>
>For xtensa:
>
>	Cc: Chris Zankel <chris@zankel.net>
>	Cc: Max Filippov <jcmvbkbc@gmail.com>
>
>They might be willing to help.  ;-)
>
>							Thanx, Paul
>
>> >> Bradley Morgan (5):
>> >>   lib: Add two-byte cmpxchg emulation function
>> >>   ARC: Emulate two-byte cmpxchg
>> >>   sh: Emulate two-byte cmpxchg
>> >>   csky: Emulate two-byte cmpxchg
>> >>   xtensa: Emulate two-byte cmpxchg
>> 
>> --- Thanks!
>> "I'm not a very positive person" - Linus torvalds
If I have to do another 100 revisions I'll die, I'm suggesting getting the
new function in first, then converting arches later? Or does this break
arches.
--- Thanks!
https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@grrlz.net/

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Paul E. McKenney]

On Tue, Sep 22, 2026 at 08:03:51PM +0100, Bradley Morgan wrote:
> On 22 September 2026 19:59:39 BST, "Paul E. McKenney" <paulmck@kernel.org>
> wrote:
> >On Tue, Sep 22, 2026 at 07:37:54PM +0100, Bradley Morgan wrote:
> >> On 22 September 2026 19:29:32 BST, "Paul E. McKenney"
> ><paulmck@kernel.org>
> >> wrote:
> >> >On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
> >> >> This is v4 of the two byte cmpxchg emulation series, wiring
> >> >> cmpxchg_emu_u16() into arc, csky, sh and xtensa.
> >> >> 
> >> >> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which
> >was
> >> >> a 16-bit mask in the 8-bit function, and a dead one at that, since
> >the
> >> >> compare guarantees the low 8 bits of old are the byte being returned.
> >> >> David Laight asked where that cast came from. v4 returns old
> >unmasked,
> >> >> the exact behaviour the one-byte emulator always had, so nothing that
> >> >> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
> >> >> 
> >> >> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old))
> >type
> >> >> check to csky and sh but not arc and xtensa. v4 adds it there too, so
> >a
> >> >> cmpxchg(&p, 4, 5) fails to compile on every architecture in the
> >series,
> >> >> verified with each architecture's macro instantiated standalone.
> >> >> 
> >> >> While adding the type check to arc, the switch subject turned out to
> >be
> >> >> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On
> >32-bit
> >> >> arc the switch was always 4, so the size 1 and size 2 cases were dead
> >> >> code and every sub-word cmpxchg() went through the 32-bit llock/scond
> >> >> pair, comparing whole words against sub-word values, so the compare
> >> >> almost never succeeded. The switch now tests the pointee, and the u8
> >> >> path it was always meant to dispatch actually runs, so the one-byte
> >> >> emulation works on arc for the first time since the sizeof bug landed
> >> >> with the original cmpxchg_emu_u8() wiring.
> >> >> 
> >> >> The host test of 972 cases across both halfword offsets against a
> >byte
> >> >> level reference model still passes, and a 20000 case randomized run
> >> >> checking the masked compare and return against a hardware cmpxchg r16
> >> >> model passes with zero mismatches.
> >> >> 
> >> >> David pointed out on v1 that a u16 prototype does not compile warning
> >> >> free when exchanging a pointer type, because the switch statements in
> >> >> the architecture macros instantiate every size case, so a pointer
> >> >> cmpxchg() type checks the two byte case, and the (u16) casts there
> >> >> warn. v4 keeps taking the old and new values as unsigned long and
> >> >> casting to u16 inside the function, so the call sites need no
> >narrowing
> >> >> casts and pointer exchanges compile clean. The function still
> >compares
> >> >> and returns exactly the 16 bits the caller asked for, which matches
> >> >> hardware cmpxchg r16 behaviour.
> >> >> 
> >> >> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
> >> >> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
> >> >
> >> >I have pulled these in, but only to expose them to things like the
> >kernel
> >> >test robot.  My guess is that they will go in by some other path.
> >> >
> >> >And to that end:
> >> >
> >> >Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
> >> >
> >> >But I could of course easily be missing subtle arch-specific bugs.
> >> 
> >> There are, according to sashiko, but I can't seem to make that thing
> >happy
> >> no matter what I do
> >
> >Hahahahaha!!!
> >
> >We forgot to CC the architecture maintainers.
> >
> >For the changes to lib/cmpxchg-emu.c:
> >
> >	Cc: Andrew Morton <akpm@linux-foundation.org>
> >	Cc: Arnd Bergmann <arnd@kernel.org>
> >
> >For ARC:
> >
> >	Cc: Vineet Gupta <vgupta@kernel.org>
> >	linux-snps-arc@lists.infradead.org
> >
> >For sh:
> >
> >	Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
> >	Cc: Rich Felker <dalias@libc.org>
> >	Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
> >	Cc: <linux-sh@vger.kernel.org>
> >
> >For csky:
> >
> >	Cc: Guo Ren <guoren@kernel.org>
> >	Cc: <linux-csky@vger.kernel.org>
> >	Cc: <linux-kernel@vger.kernel.org>
> >
> >For xtensa:
> >
> >	Cc: Chris Zankel <chris@zankel.net>
> >	Cc: Max Filippov <jcmvbkbc@gmail.com>
> >
> >They might be willing to help.  ;-)
> >
> >							Thanx, Paul
> >
> >> >> Bradley Morgan (5):
> >> >>   lib: Add two-byte cmpxchg emulation function
> >> >>   ARC: Emulate two-byte cmpxchg
> >> >>   sh: Emulate two-byte cmpxchg
> >> >>   csky: Emulate two-byte cmpxchg
> >> >>   xtensa: Emulate two-byte cmpxchg
> >> 
> >> --- Thanks!
> >> "I'm not a very positive person" - Linus torvalds
> If I have to do another 100 revisions I'll die, I'm suggesting getting the
> new function in first, then converting arches later? Or does this break
> arches.

Well, you are only on v4.  ;-)

Adding a new function without uses is frowned upon.  After all, if it
wasn't frowned upon, there would be tons of unused code in the kernel.

But you are in luck.  John Paul Adrian Glaubitz noticed the sh patch
despite not being CCed and acked it.  And I happen to be the one who
committed the original lib/cmpxchg-emu.c commit.  Plus at least one of
the architecture-specific patches.  (Ah, yes, the problem was that RCU
had been using single-byte cmpxchg(), thus breaking the architectures
not supporting this, so I provided cmpxchg_emu_u8() as the fix.)

So what I have done is to queue the lib patch, but without the
arch/*/Kconfig pieces, and adding the CCs shown above.  I have also
queued the sh patch, with added CCs and with arch/sh/Kconfig.  The point
of moving the arch/*/Kconfig changes each to its respective patch is to
put all the arch-specific changes into the corresponding patch.

I will of course check with John Paul Adrian Glaubitz to make sure that
he is OK with relocating the arch/sh/Kconfig change to the patch that
he already acked, and I will of course adjust as needed if he isn't.

That means you only need to re-send the ARC, csky, and xtensa patches,
with CCs added as shown above.  No guarantees, but hopefully quite a
bit fewer than 100 times.  ;-)

							Thanx, Paul

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Vineet Gupta]

On 9/22/26 11:59, Paul E. McKenney wrote:
> On Tue, Sep 22, 2026 at 07:37:54PM +0100, Bradley Morgan wrote:
>> On 22 September 2026 19:29:32 BST, "Paul E. McKenney" <paulmck@kernel.org>
>> wrote:
>>> On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
>>>> This is v4 of the two byte cmpxchg emulation series, wiring
>>>> cmpxchg_emu_u16() into arc, csky, sh and xtensa.
>>>>
>>>> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
>>>> a 16-bit mask in the 8-bit function, and a dead one at that, since the
>>>> compare guarantees the low 8 bits of old are the byte being returned.
>>>> David Laight asked where that cast came from. v4 returns old unmasked,
>>>> the exact behaviour the one-byte emulator always had, so nothing that
>>>> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
>>>>
>>>> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
>>>> check to csky and sh but not arc and xtensa. v4 adds it there too, so a
>>>> cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
>>>> verified with each architecture's macro instantiated standalone.
>>>>
>>>> While adding the type check to arc, the switch subject turned out to be
>>>> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
>>>> arc the switch was always 4, so the size 1 and size 2 cases were dead
>>>> code and every sub-word cmpxchg() went through the 32-bit llock/scond
>>>> pair, comparing whole words against sub-word values, so the compare
>>>> almost never succeeded. The switch now tests the pointee, and the u8
>>>> path it was always meant to dispatch actually runs, so the one-byte
>>>> emulation works on arc for the first time since the sizeof bug landed
>>>> with the original cmpxchg_emu_u8() wiring.
>>>>
>>>> The host test of 972 cases across both halfword offsets against a byte
>>>> level reference model still passes, and a 20000 case randomized run
>>>> checking the masked compare and return against a hardware cmpxchg r16
>>>> model passes with zero mismatches.
>>>>
>>>> David pointed out on v1 that a u16 prototype does not compile warning
>>>> free when exchanging a pointer type, because the switch statements in
>>>> the architecture macros instantiate every size case, so a pointer
>>>> cmpxchg() type checks the two byte case, and the (u16) casts there
>>>> warn. v4 keeps taking the old and new values as unsigned long and
>>>> casting to u16 inside the function, so the call sites need no narrowing
>>>> casts and pointer exchanges compile clean. The function still compares
>>>> and returns exactly the 16 bits the caller asked for, which matches
>>>> hardware cmpxchg r16 behaviour.
>>>>
>>>> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
>>>> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
>>> I have pulled these in, but only to expose them to things like the kernel
>>> test robot.  My guess is that they will go in by some other path.
>>>
>>> And to that end:
>>>
>>> Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
>>>
>>> But I could of course easily be missing subtle arch-specific bugs.
>> There are, according to sashiko, but I can't seem to make that thing happy
>> no matter what I do
> Hahahahaha!!!
>
> We forgot to CC the architecture maintainers.

No you didn't - they were CC'ed all along.
I'll give this is a test run and report back later.

Both the cover letter and 1/5 explain what is being done and not clearly 
why ?
Is there an existing or proposed user for this API.
Otherwise it will just bit-rot. No big deal from arch code pov but just 
saying...

Thx,
-Vineet

>
> For the changes to lib/cmpxchg-emu.c:
>
> 	Cc: Andrew Morton <akpm@linux-foundation.org>
> 	Cc: Arnd Bergmann <arnd@kernel.org>
>
> For ARC:
>
> 	Cc: Vineet Gupta <vgupta@kernel.org>
> 	linux-snps-arc@lists.infradead.org
>
> For sh:
>
> 	Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
> 	Cc: Rich Felker <dalias@libc.org>
> 	Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
> 	Cc: <linux-sh@vger.kernel.org>
>
> For csky:
>
> 	Cc: Guo Ren <guoren@kernel.org>
> 	Cc: <linux-csky@vger.kernel.org>
> 	Cc: <linux-kernel@vger.kernel.org>
>
> For xtensa:
>
> 	Cc: Chris Zankel <chris@zankel.net>
> 	Cc: Max Filippov <jcmvbkbc@gmail.com>
>
> They might be willing to help.  ;-)
>
> 							Thanx, Paul
>
>>>> Bradley Morgan (5):
>>>>    lib: Add two-byte cmpxchg emulation function
>>>>    ARC: Emulate two-byte cmpxchg
>>>>    sh: Emulate two-byte cmpxchg
>>>>    csky: Emulate two-byte cmpxchg
>>>>    xtensa: Emulate two-byte cmpxchg
>> --- Thanks!
>> "I'm not a very positive person" - Linus torvalds

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Paul E. McKenney]

On Tue, Sep 22, 2026 at 12:13:42PM -0700, Vineet Gupta wrote:
> On 9/22/26 11:59, Paul E. McKenney wrote:
> > On Tue, Sep 22, 2026 at 07:37:54PM +0100, Bradley Morgan wrote:
> > > On 22 September 2026 19:29:32 BST, "Paul E. McKenney" <paulmck@kernel.org>
> > > wrote:
> > > > On Tue, Sep 22, 2026 at 05:33:49PM +0000, Bradley Morgan wrote:
> > > > > This is v4 of the two byte cmpxchg emulation series, wiring
> > > > > cmpxchg_emu_u16() into arc, csky, sh and xtensa.
> > > > > 
> > > > > v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
> > > > > a 16-bit mask in the 8-bit function, and a dead one at that, since the
> > > > > compare guarantees the low 8 bits of old are the byte being returned.
> > > > > David Laight asked where that cast came from. v4 returns old unmasked,
> > > > > the exact behaviour the one-byte emulator always had, so nothing that
> > > > > uses cmpxchg_emu_u8() through the widened prototypes sees a change.
> > > > > 
> > > > > David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
> > > > > check to csky and sh but not arc and xtensa. v4 adds it there too, so a
> > > > > cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
> > > > > verified with each architecture's macro instantiated standalone.
> > > > > 
> > > > > While adding the type check to arc, the switch subject turned out to be
> > > > > sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
> > > > > arc the switch was always 4, so the size 1 and size 2 cases were dead
> > > > > code and every sub-word cmpxchg() went through the 32-bit llock/scond
> > > > > pair, comparing whole words against sub-word values, so the compare
> > > > > almost never succeeded. The switch now tests the pointee, and the u8
> > > > > path it was always meant to dispatch actually runs, so the one-byte
> > > > > emulation works on arc for the first time since the sizeof bug landed
> > > > > with the original cmpxchg_emu_u8() wiring.
> > > > > 
> > > > > The host test of 972 cases across both halfword offsets against a byte
> > > > > level reference model still passes, and a 20000 case randomized run
> > > > > checking the masked compare and return against a hardware cmpxchg r16
> > > > > model passes with zero mismatches.
> > > > > 
> > > > > David pointed out on v1 that a u16 prototype does not compile warning
> > > > > free when exchanging a pointer type, because the switch statements in
> > > > > the architecture macros instantiate every size case, so a pointer
> > > > > cmpxchg() type checks the two byte case, and the (u16) casts there
> > > > > warn. v4 keeps taking the old and new values as unsigned long and
> > > > > casting to u16 inside the function, so the call sites need no narrowing
> > > > > casts and pointer exchanges compile clean. The function still compares
> > > > > and returns exactly the 16 bits the caller asked for, which matches
> > > > > hardware cmpxchg r16 behaviour.
> > > > > 
> > > > > The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
> > > > > take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
> > > > I have pulled these in, but only to expose them to things like the kernel
> > > > test robot.  My guess is that they will go in by some other path.
> > > > 
> > > > And to that end:
> > > > 
> > > > Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
> > > > 
> > > > But I could of course easily be missing subtle arch-specific bugs.
> > > There are, according to sashiko, but I can't seem to make that thing happy
> > > no matter what I do
> > Hahahahaha!!!
> > 
> > We forgot to CC the architecture maintainers.
> 
> No you didn't - they were CC'ed all along.
> I'll give this is a test run and report back later.
> 
> Both the cover letter and 1/5 explain what is being done and not clearly why
> ?
> Is there an existing or proposed user for this API.
> Otherwise it will just bit-rot. No big deal from arch code pov but just
> saying...

If I remember correctly, there are workarounds for lack of two-byte
cmpxchg() in various parts of the kernel, for example, _Q_PENDING_BITS.
So this might not be without uses for all that long.

							Thanx, Paul

> Thx,
> -Vineet
> 
> > 
> > For the changes to lib/cmpxchg-emu.c:
> > 
> > 	Cc: Andrew Morton <akpm@linux-foundation.org>
> > 	Cc: Arnd Bergmann <arnd@kernel.org>
> > 
> > For ARC:
> > 
> > 	Cc: Vineet Gupta <vgupta@kernel.org>
> > 	linux-snps-arc@lists.infradead.org
> > 
> > For sh:
> > 
> > 	Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
> > 	Cc: Rich Felker <dalias@libc.org>
> > 	Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
> > 	Cc: <linux-sh@vger.kernel.org>
> > 
> > For csky:
> > 
> > 	Cc: Guo Ren <guoren@kernel.org>
> > 	Cc: <linux-csky@vger.kernel.org>
> > 	Cc: <linux-kernel@vger.kernel.org>
> > 
> > For xtensa:
> > 
> > 	Cc: Chris Zankel <chris@zankel.net>
> > 	Cc: Max Filippov <jcmvbkbc@gmail.com>
> > 
> > They might be willing to help.  ;-)
> > 
> > 							Thanx, Paul
> > 
> > > > > Bradley Morgan (5):
> > > > >    lib: Add two-byte cmpxchg emulation function
> > > > >    ARC: Emulate two-byte cmpxchg
> > > > >    sh: Emulate two-byte cmpxchg
> > > > >    csky: Emulate two-byte cmpxchg
> > > > >    xtensa: Emulate two-byte cmpxchg
> > > --- Thanks!
> > > "I'm not a very positive person" - Linus torvalds
> 

Re: [PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[David Laight]

On Tue, 22 Sep 2026 17:33:49 +0000
Bradley Morgan <brads@mainlining.org> wrote:

> This is v4 of the two byte cmpxchg emulation series, wiring
> cmpxchg_emu_u16() into arc, csky, sh and xtensa.

Apart from a minor niggle, for the series.
Reviewed-by: David Laight <david.laight.linux@gmail.com>

> 
> v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
> a 16-bit mask in the 8-bit function, and a dead one at that, since the
> compare guarantees the low 8 bits of old are the byte being returned.
> David Laight asked where that cast came from. v4 returns old unmasked,
> the exact behaviour the one-byte emulator always had, so nothing that
> uses cmpxchg_emu_u8() through the widened prototypes sees a change.
> 
> David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
> check to csky and sh but not arc and xtensa. v4 adds it there too, so a
> cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
> verified with each architecture's macro instantiated standalone.
> 
> While adding the type check to arc, the switch subject turned out to be
> sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
> arc the switch was always 4, so the size 1 and size 2 cases were dead
> code and every sub-word cmpxchg() went through the 32-bit llock/scond
> pair, comparing whole words against sub-word values, so the compare
> almost never succeeded. The switch now tests the pointee, and the u8
> path it was always meant to dispatch actually runs, so the one-byte
> emulation works on arc for the first time since the sizeof bug landed
> with the original cmpxchg_emu_u8() wiring.
> 
> The host test of 972 cases across both halfword offsets against a byte
> level reference model still passes, and a 20000 case randomized run
> checking the masked compare and return against a hardware cmpxchg r16
> model passes with zero mismatches.
> 
> David pointed out on v1 that a u16 prototype does not compile warning
> free when exchanging a pointer type, because the switch statements in
> the architecture macros instantiate every size case, so a pointer
> cmpxchg() type checks the two byte case, and the (u16) casts there
> warn. v4 keeps taking the old and new values as unsigned long and
> casting to u16 inside the function, so the call sites need no narrowing
> casts and pointer exchanges compile clean. The function still compares
> and returns exactly the 16 bits the caller asked for, which matches
> hardware cmpxchg r16 behaviour.
> 
> The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
> take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.
> 
> Bradley Morgan (5):
>   lib: Add two-byte cmpxchg emulation function
>   ARC: Emulate two-byte cmpxchg
>   sh: Emulate two-byte cmpxchg
>   csky: Emulate two-byte cmpxchg
>   xtensa: Emulate two-byte cmpxchg