[PATCH 0/5] Provide two-byte cmpxchg() emulation

[PATCH 0/5] Provide two-byte cmpxchg() emulation

[Paul E. McKenney]

Hello!

This series provides emulation of two-byte cmpxchg().  Note that this
does not (yet) allow free use of atomic operations on two-byte operands
in core code because there are still a few supported systems that do not
have two-byte store instructions.  However, this emulation does permit use
of wide range of two-byte atomic operations, so is worth putting forward.

This series is being reposted on request in order to ease testing efforts.

The individual patches are as follows:

1.	Add two-byte cmpxchg emulation function, courtesy of Bradley
	Morgan.

2.	sh: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

3.	ARC: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

4.	csky: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

5.	xtensa: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

#1 and #2 have the acks required to go into the upcoming v7.4 merge
window.

						Thanx, Paul

------------------------------------------------------------------------

 arch/arc/include/asm/cmpxchg.h    |    3 +++
 arch/csky/include/asm/cmpxchg.h   |    9 +++++++++
 arch/sh/include/asm/cmpxchg.h     |    2 ++
 arch/xtensa/include/asm/cmpxchg.h |    1 +
 include/linux/cmpxchg-emu.h       |    4 +++-
 lib/cmpxchg-emu.c                 |   38 ++++++++++++++++++++++++++++++++++----
 6 files changed, 52 insertions(+), 5 deletions(-)

[PATCH 1/5] lib: Add two-byte cmpxchg emulation function

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

cmpxchg_emu_u8() emulates one-byte cmpxchg() in terms of four-byte
cmpxchg() for the architectures lacking native one-byte atomics.
The same architectures also lack native two-byte cmpxchg(), where
such an operation is not supported and either fails to compile via
BUILD_BUG() or fails to link, because the bad pointer sentinels
these architectures declare are never defined.

Add cmpxchg_emu_u16(), the two-byte sibling. It reads the enclosing
word with READ_ONCE(), splices the two target bytes through a union
and loops on cmpxchg() of the full word until the compare succeeds.
Like cmpxchg_emu_u8() it is fully ordered.

Unlike cmpxchg_emu_u8() it casts the old and new values to u16
internally and returns unsigned long, taking the old and new values
as unsigned long, per the suggestion from David Laight. The switch
statements in the architecture macros instantiate every size case,
so a cmpxchg() on a pointer type checks the two-byte case as well,
and a u16 parameter or return would make the macro casts and return
conversions warn there. With unsigned long parameters and return the
call sites need no narrowing casts, pointer exchanges compile warning
free, and the function still compares and returns exactly the 16 bits
the caller asked for, which matches the hardware cmpxchg r16
behaviour where a 16-bit compare only looks at the low 16 bits of
the register.

cmpxchg_emu_u8() keeps returning the old value unmasked, so a caller
that passes a wider old than 8 bits still gets it back as passed,
matching the behaviour the one-byte emulator always had.

The Kconfig symbol gating this file is renamed from
ARCH_NEED_CMPXCHG_1_EMU to ARCH_NEED_CMPXCHG_1_2_EMU, as it now
selects both the one-byte and the two-byte emulation.

[ paulmck: Apply kernel test robot feedback. ]

Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: David Laight <david.laight.linux@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@kernel.org>
---
 include/linux/cmpxchg-emu.h |  4 +++-
 lib/cmpxchg-emu.c           | 38 +++++++++++++++++++++++++++++++++----
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/include/linux/cmpxchg-emu.h b/include/linux/cmpxchg-emu.h
index 998deec67740a..2db70f1e39253 100644
--- a/include/linux/cmpxchg-emu.h
+++ b/include/linux/cmpxchg-emu.h
@@ -4,12 +4,14 @@
  * lacking direct support for these sizes.  These are implemented in terms
  * of 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #ifndef __LINUX_CMPXCHG_EMU_H
 #define __LINUX_CMPXCHG_EMU_H
 
 uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new);
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new);
 
 #endif /* __LINUX_CMPXCHG_EMU_H */
diff --git a/lib/cmpxchg-emu.c b/lib/cmpxchg-emu.c
index 27f6f97cb60dd..25c69224a7597 100644
--- a/lib/cmpxchg-emu.c
+++ b/lib/cmpxchg-emu.c
@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
- * Emulated 1-byte cmpxchg operation for architectures lacking direct
- * support for this size.  This is implemented in terms of 4-byte cmpxchg
- * operations.
+ * Emulated 1-byte and 2-byte cmpxchg operations for architectures lacking
+ * direct support for these sizes.  These are implemented in terms of
+ * 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #include <linux/types.h>
@@ -43,3 +44,32 @@ uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new)
 	return old;
 }
 EXPORT_SYMBOL_GPL(cmpxchg_emu_u8);
+
+union u16_32 {
+	u16 h[2];
+	u32 w;
+};
+
+/* Emulate two-byte cmpxchg() in terms of 4-byte cmpxchg. */
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new)
+{
+	u32 *p32 = (u32 *)(((uintptr_t)p) & ~0x3);
+	int i = (((uintptr_t)p) & 0x2) / 2;
+	union u16_32 old32;
+	union u16_32 new32;
+	u32 ret;
+
+	WARN_ON_ONCE(((uintptr_t)p) & 0x1);
+	ret = READ_ONCE(*p32);
+	do {
+		old32.w = ret;
+		if (old32.h[i] != (u16)old)
+			return (unsigned long)old32.h[i];
+		new32.w = old32.w;
+		new32.h[i] = (u16)new;
+		instrument_atomic_read_write(p, 2);
+		ret = data_race(cmpxchg(p32, old32.w, new32.w)); // Overridden above.
+	} while (ret != old32.w);
+	return (u16)old;
+}
+EXPORT_SYMBOL_GPL(cmpxchg_emu_u16);
-- 
2.40.1

[PATCH 2/5] sh: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

SH has no byte or halfword atomic memory operations, so the __cmpxchg()
switch routes case 1 through cmpxchg_emu_u8() and lets case 2 fall
through to __cmpxchg_called_with_bad_pointer(), which is declared but
never defined, so a two-byte cmpxchg() fails at link time. Route case
2 through the new cmpxchg_emu_u16(), which takes the old and new
values as unsigned long, so the (unsigned long) casts move off the
call and into _old_ and _new_ declarations that type check the old
and new arguments against *ptr through (unsigned long)(0 ? *ptr : _o_),
the idiom David Laight suggested, so cmpxchg(&p, 4, 5) no longer
compiles silently.

[ paulmck: Apply kernel test robot feedback. ]

Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: <linux-sh@vger.kernel.org>
---
 arch/sh/include/asm/cmpxchg.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/sh/include/asm/cmpxchg.h b/arch/sh/include/asm/cmpxchg.h
index 1e5dc5ccf7bf5..477d3025a441c 100644
--- a/arch/sh/include/asm/cmpxchg.h
+++ b/arch/sh/include/asm/cmpxchg.h
@@ -59,6 +59,8 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
 	switch (size) {
 	case 1:
 		return cmpxchg_emu_u8(ptr, old, new);
+	case 2:
+		return cmpxchg_emu_u16(ptr, old, new);
 	case 4:
 		return __cmpxchg_u32(ptr, old, new);
 	}
-- 
2.40.1

[PATCH 3/5] ARC: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

ARC has no two-byte atomic compare and swap, so the
arch_cmpxchg_relaxed() macro switch lets case 2 fall through to
BUILD_BUG() via default, and a two-byte cmpxchg() fails the build.

Route case 2 through the new cmpxchg_emu_u16(), which narrows the
old and new values itself, so the dispatch keeps the (uintptr_t)
casts the case 1 path already uses.

The sizeof(*(_p_)) fix that v4 folded in here landed separately
through Vineet's f050c3e61d2a, so this patch is now only the
case 2 wiring.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
 arch/arc/include/asm/cmpxchg.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
index 76f43db0890fc..7157718f147c1 100644
--- a/arch/arc/include/asm/cmpxchg.h
+++ b/arch/arc/include/asm/cmpxchg.h
@@ -50,6 +50,9 @@
 	case 1:								\
 		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
 		break;							\
+	case 2:								\
+		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, (unsigned long)_o_, (unsigned long)_n_);	\
+		break;							\
 	case 4:								\
 		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
 		break;							\
-- 
2.40.1

Re: [PATCH 3/5] ARC: Emulate two-byte cmpxchg

[Vineet Gupta]

On 10/7/26 22:36, Paul E. McKenney wrote:
> From: Bradley Morgan <brads@mainlining.org>
>
> ARC has no two-byte atomic compare and swap, so the
> arch_cmpxchg_relaxed() macro switch lets case 2 fall through to
> BUILD_BUG() via default, and a two-byte cmpxchg() fails the build.
>
> Route case 2 through the new cmpxchg_emu_u16(), which narrows the
> old and new values itself, so the dispatch keeps the (uintptr_t)
> casts the case 1 path already uses.
>
> The sizeof(*(_p_)) fix that v4 folded in here landed separately
> through Vineet's f050c3e61d2a, so this patch is now only the
> case 2 wiring.
>
> Signed-off-by: Bradley Morgan <brads@mainlining.org>
> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>

Acked-by: Vineet Gupta <vgupta@kernel.org>

Thx,
-Vineet

> ---
>   arch/arc/include/asm/cmpxchg.h | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
> index 76f43db0890fc..7157718f147c1 100644
> --- a/arch/arc/include/asm/cmpxchg.h
> +++ b/arch/arc/include/asm/cmpxchg.h
> @@ -50,6 +50,9 @@
>   	case 1:								\
>   		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
>   		break;							\
> +	case 2:								\
> +		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, (unsigned long)_o_, (unsigned long)_n_);	\
> +		break;							\
>   	case 4:								\
>   		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
>   		break;							\

Re: [PATCH 3/5] ARC: Emulate two-byte cmpxchg

[Paul E. McKenney]

On Wed, Oct 07, 2026 at 10:48:39PM +0200, Vineet Gupta wrote:
> On 10/7/26 22:36, Paul E. McKenney wrote:
> > From: Bradley Morgan <brads@mainlining.org>
> > 
> > ARC has no two-byte atomic compare and swap, so the
> > arch_cmpxchg_relaxed() macro switch lets case 2 fall through to
> > BUILD_BUG() via default, and a two-byte cmpxchg() fails the build.
> > 
> > Route case 2 through the new cmpxchg_emu_u16(), which narrows the
> > old and new values itself, so the dispatch keeps the (uintptr_t)
> > casts the case 1 path already uses.
> > 
> > The sizeof(*(_p_)) fix that v4 folded in here landed separately
> > through Vineet's f050c3e61d2a, so this patch is now only the
> > case 2 wiring.
> > 
> > Signed-off-by: Bradley Morgan <brads@mainlining.org>
> > Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
> 
> Acked-by: Vineet Gupta <vgupta@kernel.org>

Thank you!  I will apply this on my next rebase.  Unless something breaks,
I will include this in my pull request for the upcoming merge window.

							Thanx, Paul

> Thx,
> -Vineet
> 
> > ---
> >   arch/arc/include/asm/cmpxchg.h | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
> > index 76f43db0890fc..7157718f147c1 100644
> > --- a/arch/arc/include/asm/cmpxchg.h
> > +++ b/arch/arc/include/asm/cmpxchg.h
> > @@ -50,6 +50,9 @@
> >   	case 1:								\
> >   		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
> >   		break;							\
> > +	case 2:								\
> > +		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, (unsigned long)_o_, (unsigned long)_n_);	\
> > +		break;							\
> >   	case 4:								\
> >   		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
> >   		break;							\
> 

[PATCH 4/5] csky: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

C-SKY has no two-byte atomic compare and swap, so the __cmpxchg()
macros let case 2 fall through to BUILD_BUG() via default, and a
two-byte cmpxchg() fails the build.

Route case 2 through the new cmpxchg_emu_u16(), which narrows the
old and new values itself, so all three orderings, relaxed, acquire
and full, keep the (uintptr_t) casts the case 1 path already uses.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
 arch/csky/include/asm/cmpxchg.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/csky/include/asm/cmpxchg.h b/arch/csky/include/asm/cmpxchg.h
index db6dda47184e4..6f3ca79e54acf 100644
--- a/arch/csky/include/asm/cmpxchg.h
+++ b/arch/csky/include/asm/cmpxchg.h
@@ -64,6 +64,9 @@
 	switch (size) {						\
 	case 1:							\
 		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		break;							\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, (unsigned long)__old, (unsigned long)__new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
@@ -97,6 +100,9 @@
 	switch (size) {						\
 	case 1:							\
 		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		break;							\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, (unsigned long)__old, (unsigned long)__new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
@@ -131,6 +137,9 @@
 	switch (size) {						\
 	case 1:							\
 		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		break;							\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, (unsigned long)__old, (unsigned long)__new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
-- 
2.40.1

[PATCH 5/5] xtensa: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

Xtensa has no two-byte atomic compare and swap, so the __cmpxchg()
switch lets case 2 fall through to __cmpxchg_called_with_bad_pointer(),
which is declared but never defined, so a two-byte cmpxchg() fails
at link time.

Route case 2 through the new cmpxchg_emu_u16(), which takes the
old and new values as unsigned long and narrows them itself, so
the call needs no extra casts.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
 arch/xtensa/include/asm/cmpxchg.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/xtensa/include/asm/cmpxchg.h b/arch/xtensa/include/asm/cmpxchg.h
index b6db4838b175a..8dea8e357fc0f 100644
--- a/arch/xtensa/include/asm/cmpxchg.h
+++ b/arch/xtensa/include/asm/cmpxchg.h
@@ -76,6 +76,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 {
 	switch (size) {
 	case 1:  return cmpxchg_emu_u8(ptr, old, new);
+	case 2:  return cmpxchg_emu_u16(ptr, old, new);
 	case 4:  return __cmpxchg_u32(ptr, old, new);
 	default: __cmpxchg_called_with_bad_pointer();
 		 return old;
-- 
2.40.1

Re: [PATCH 0/5] Provide two-byte cmpxchg() emulation

[Bradley Morgan]

On 7 October 2026 21:36:01 BST, "Paul E. McKenney" <paulmck@kernel.org>
wrote:
>Hello!

[OFF-LIST]

I mean, I did what you wanted, hmm?

>
>This series provides emulation of two-byte cmpxchg().  Note that this
>does not (yet) allow free use of atomic operations on two-byte operands
>in core code because there are still a few supported systems that do not
>have two-byte store instructions.  However, this emulation does permit use
>of wide range of two-byte atomic operations, so is worth putting forward.
>
>This series is being reposted on request in order to ease testing efforts.
>
>The individual patches are as follows:
>
>1.	Add two-byte cmpxchg emulation function, courtesy of Bradley
>	Morgan.
>
>2.	sh: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>3.	ARC: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>4.	csky: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>5.	xtensa: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>#1 and #2 have the acks required to go into the upcoming v7.4 merge
>window.
>
>						Thanx, Paul
>
>------------------------------------------------------------------------
>
> arch/arc/include/asm/cmpxchg.h    |    3 +++
> arch/csky/include/asm/cmpxchg.h   |    9 +++++++++
> arch/sh/include/asm/cmpxchg.h     |    2 ++
> arch/xtensa/include/asm/cmpxchg.h |    1 +
> include/linux/cmpxchg-emu.h       |    4 +++-
> lib/cmpxchg-emu.c                 |   38
> ++++++++++++++++++++++++++++++++++----
> 6 files changed, 52 insertions(+), 5 deletions(-)

--- Thanks!
"I'm not a very positive person" - Linus torvalds

Re: [PATCH 0/5] Provide two-byte cmpxchg() emulation

[Paul E. McKenney]

On Wed, Oct 07, 2026 at 09:44:02PM +0100, Bradley Morgan wrote:
> On 7 October 2026 21:36:01 BST, "Paul E. McKenney" <paulmck@kernel.org>
> wrote:
> >Hello!
> 
> [OFF-LIST]

Well, off of most lists, anyway!  Been there, done that!  ;-)

> I mean, I did what you wanted, hmm?

You did just fine.

							Thanx, Paul

> >This series provides emulation of two-byte cmpxchg().  Note that this
> >does not (yet) allow free use of atomic operations on two-byte operands
> >in core code because there are still a few supported systems that do not
> >have two-byte store instructions.  However, this emulation does permit use
> >of wide range of two-byte atomic operations, so is worth putting forward.
> >
> >This series is being reposted on request in order to ease testing efforts.
> >
> >The individual patches are as follows:
> >
> >1.	Add two-byte cmpxchg emulation function, courtesy of Bradley
> >	Morgan.
> >
> >2.	sh: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >3.	ARC: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >4.	csky: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >5.	xtensa: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >#1 and #2 have the acks required to go into the upcoming v7.4 merge
> >window.
> >
> >						Thanx, Paul
> >
> >------------------------------------------------------------------------
> >
> > arch/arc/include/asm/cmpxchg.h    |    3 +++
> > arch/csky/include/asm/cmpxchg.h   |    9 +++++++++
> > arch/sh/include/asm/cmpxchg.h     |    2 ++
> > arch/xtensa/include/asm/cmpxchg.h |    1 +
> > include/linux/cmpxchg-emu.h       |    4 +++-
> > lib/cmpxchg-emu.c                 |   38
> > ++++++++++++++++++++++++++++++++++----
> > 6 files changed, 52 insertions(+), 5 deletions(-)
> 
> --- Thanks!
> "I'm not a very positive person" - Linus torvalds

[PATCH v4 0/5] Add two-byte cmpxchg emulation and wire it into the architectures

[Bradley Morgan]

This is v4 of the two byte cmpxchg emulation series, wiring
cmpxchg_emu_u16() into arc, csky, sh and xtensa.

v3 had changed cmpxchg_emu_u8()'s success return to (u16)old, which was
a 16-bit mask in the 8-bit function, and a dead one at that, since the
compare guarantees the low 8 bits of old are the byte being returned.
David Laight asked where that cast came from. v4 returns old unmasked,
the exact behaviour the one-byte emulator always had, so nothing that
uses cmpxchg_emu_u8() through the widened prototypes sees a change.

David also noted v3 extended the (unsigned long)(0 ? *ptr : (old)) type
check to csky and sh but not arc and xtensa. v4 adds it there too, so a
cmpxchg(&p, 4, 5) fails to compile on every architecture in the series,
verified with each architecture's macro instantiated standalone.

While adding the type check to arc, the switch subject turned out to be
sizeof((_p_)), the pointer, not sizeof(*(_p_)), the pointee. On 32-bit
arc the switch was always 4, so the size 1 and size 2 cases were dead
code and every sub-word cmpxchg() went through the 32-bit llock/scond
pair, comparing whole words against sub-word values, so the compare
almost never succeeded. The switch now tests the pointee, and the u8
path it was always meant to dispatch actually runs, so the one-byte
emulation works on arc for the first time since the sizeof bug landed
with the original cmpxchg_emu_u8() wiring.

The host test of 972 cases across both halfword offsets against a byte
level reference model still passes, and a 20000 case randomized run
checking the masked compare and return against a hardware cmpxchg r16
model passes with zero mismatches.

David pointed out on v1 that a u16 prototype does not compile warning
free when exchanging a pointer type, because the switch statements in
the architecture macros instantiate every size case, so a pointer
cmpxchg() type checks the two byte case, and the (u16) casts there
warn. v4 keeps taking the old and new values as unsigned long and
casting to u16 inside the function, so the call sites need no narrowing
casts and pointer exchanges compile clean. The function still compares
and returns exactly the 16 bits the caller asked for, which matches
hardware cmpxchg r16 behaviour.

The ARMv6 wiring stays dropped from v1, per Arnd Bergmann's offer to
take the INTEGRATOR_CM1136JFS cleanup in his platform removal series.

Bradley Morgan (5):
  lib: Add two-byte cmpxchg emulation function
  ARC: Emulate two-byte cmpxchg
  sh: Emulate two-byte cmpxchg
  csky: Emulate two-byte cmpxchg
  xtensa: Emulate two-byte cmpxchg

[PATCH 1/5] lib: Add two-byte cmpxchg emulation function

[Bradley Morgan]

cmpxchg_emu_u8() emulates one-byte cmpxchg() in terms of four-byte
cmpxchg() for the architectures lacking native one-byte atomics.
The same architectures also lack native two-byte cmpxchg(), where
such an operation is not supported and either fails to compile via
BUILD_BUG() or fails to link, because the bad pointer sentinels
these architectures declare are never defined.

Add cmpxchg_emu_u16(), the two-byte sibling. It reads the enclosing
word with READ_ONCE(), splices the two target bytes through a union
and loops on cmpxchg() of the full word until the compare succeeds.
Like cmpxchg_emu_u8() it is fully ordered.

Unlike cmpxchg_emu_u8() it casts the old and new values to u16
internally and returns unsigned long, taking the old and new values
as unsigned long, per the suggestion from David Laight. The switch
statements in the architecture macros instantiate every size case,
so a cmpxchg() on a pointer type checks the two-byte case as well,
and a u16 parameter or return would make the macro casts and return
conversions warn there. With unsigned long parameters and return the
call sites need no narrowing casts, pointer exchanges compile warning
free, and the function still compares and returns exactly the 16 bits
the caller asked for, which matches the hardware cmpxchg r16
behaviour where a 16-bit compare only looks at the low 16 bits of
the register.

cmpxchg_emu_u8() keeps returning the old value unmasked, so a caller
that passes a wider old than 8 bits still gets it back as passed,
matching the behaviour the one-byte emulator always had.

The Kconfig symbol gating this file is renamed from
ARCH_NEED_CMPXCHG_1_EMU to ARCH_NEED_CMPXCHG_1_2_EMU, as it now
selects both the one-byte and the two-byte emulation.

Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 arch/Kconfig                |  2 +-
 arch/arc/Kconfig            |  2 +-
 arch/csky/Kconfig           |  2 +-
 arch/sh/Kconfig             |  2 +-
 arch/xtensa/Kconfig         |  2 +-
 include/linux/cmpxchg-emu.h |  4 +++-
 lib/Makefile                |  2 +-
 lib/cmpxchg-emu.c           | 38 +++++++++++++++++++++++++++++++++----
 8 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index 3bb2e568f5b1..d56064797e09 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -1817,7 +1817,7 @@ config CC_HAS_SANE_FUNCTION_ALIGNMENT
 	# strict alignment always, even with -falign-functions.
 	def_bool CC_HAS_MIN_FUNCTION_ALIGNMENT || CC_IS_CLANG
 
-config ARCH_NEED_CMPXCHG_1_EMU
+config ARCH_NEED_CMPXCHG_1_2_EMU
 	bool
 
 config ARCH_WANTS_PRE_LINK_VMLINUX
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 80e61175bf52..0e91d254eccb 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -14,7 +14,7 @@ config ARC
 	select ARCH_HAS_SETUP_DMA_OPS
 	select ARCH_HAS_SYNC_DMA_FOR_CPU
 	select ARCH_HAS_SYNC_DMA_FOR_DEVICE
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select ARCH_SUPPORTS_ATOMIC_RMW if ARC_HAS_LLSC
 	select ARCH_32BIT_OFF_T
 	select BUILDTIME_TABLE_SORT
diff --git a/arch/csky/Kconfig b/arch/csky/Kconfig
index 4331313a42ff..5f26e8615d7d 100644
--- a/arch/csky/Kconfig
+++ b/arch/csky/Kconfig
@@ -37,7 +37,7 @@ config CSKY
 	select ARCH_INLINE_SPIN_UNLOCK_BH if !PREEMPTION
 	select ARCH_INLINE_SPIN_UNLOCK_IRQ if !PREEMPTION
 	select ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE if !PREEMPTION
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select ARCH_WANT_FRAME_POINTERS if !CPU_CK610 && $(cc-option,-mbacktrace)
 	select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT
 	select COMMON_CLK
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index d60f1d5a94c0..09e556fced01 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -14,7 +14,7 @@ config SUPERH
 	select ARCH_HIBERNATION_POSSIBLE if MMU
 	select ARCH_MIGHT_HAVE_PC_PARPORT
 	select ARCH_WANT_IPC_PARSE_VERSION
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select CPU_NO_EFFICIENT_FFS
 	select DMA_DECLARE_COHERENT
 	select GENERIC_ATOMIC64
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index f2f9cd9cde50..62019fd444d4 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -14,7 +14,7 @@ config XTENSA
 	select ARCH_HAS_DMA_SET_UNCACHED if MMU
 	select ARCH_HAS_STRNCPY_FROM_USER if !KASAN
 	select ARCH_HAS_STRNLEN_USER
-	select ARCH_NEED_CMPXCHG_1_EMU
+	select ARCH_NEED_CMPXCHG_1_2_EMU
 	select ARCH_USE_MEMTEST
 	select ARCH_USE_QUEUED_RWLOCKS
 	select ARCH_USE_QUEUED_SPINLOCKS
diff --git a/include/linux/cmpxchg-emu.h b/include/linux/cmpxchg-emu.h
index 998deec67740..2db70f1e3925 100644
--- a/include/linux/cmpxchg-emu.h
+++ b/include/linux/cmpxchg-emu.h
@@ -4,12 +4,14 @@
  * lacking direct support for these sizes.  These are implemented in terms
  * of 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #ifndef __LINUX_CMPXCHG_EMU_H
 #define __LINUX_CMPXCHG_EMU_H
 
 uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new);
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new);
 
 #endif /* __LINUX_CMPXCHG_EMU_H */
diff --git a/lib/Makefile b/lib/Makefile
index 43421c39d21b..d0e69312176a 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -202,7 +202,7 @@ obj-$(CONFIG_CODE_TAGGING) += codetag.o
 lib-$(CONFIG_GENERIC_BUG) += bug.o
 
 obj-$(CONFIG_HAVE_ARCH_TRACEHOOK) += syscall.o
-obj-$(CONFIG_ARCH_NEED_CMPXCHG_1_EMU) += cmpxchg-emu.o
+obj-$(CONFIG_ARCH_NEED_CMPXCHG_1_2_EMU) += cmpxchg-emu.o
 
 obj-$(CONFIG_DYNAMIC_DEBUG_CORE) += dynamic_debug.o
 #ensure exported functions have prototypes
diff --git a/lib/cmpxchg-emu.c b/lib/cmpxchg-emu.c
index 27f6f97cb60d..25c69224a759 100644
--- a/lib/cmpxchg-emu.c
+++ b/lib/cmpxchg-emu.c
@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
- * Emulated 1-byte cmpxchg operation for architectures lacking direct
- * support for this size.  This is implemented in terms of 4-byte cmpxchg
- * operations.
+ * Emulated 1-byte and 2-byte cmpxchg operations for architectures lacking
+ * direct support for these sizes.  These are implemented in terms of
+ * 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #include <linux/types.h>
@@ -43,3 +44,32 @@ uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new)
 	return old;
 }
 EXPORT_SYMBOL_GPL(cmpxchg_emu_u8);
+
+union u16_32 {
+	u16 h[2];
+	u32 w;
+};
+
+/* Emulate two-byte cmpxchg() in terms of 4-byte cmpxchg. */
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new)
+{
+	u32 *p32 = (u32 *)(((uintptr_t)p) & ~0x3);
+	int i = (((uintptr_t)p) & 0x2) / 2;
+	union u16_32 old32;
+	union u16_32 new32;
+	u32 ret;
+
+	WARN_ON_ONCE(((uintptr_t)p) & 0x1);
+	ret = READ_ONCE(*p32);
+	do {
+		old32.w = ret;
+		if (old32.h[i] != (u16)old)
+			return (unsigned long)old32.h[i];
+		new32.w = old32.w;
+		new32.h[i] = (u16)new;
+		instrument_atomic_read_write(p, 2);
+		ret = data_race(cmpxchg(p32, old32.w, new32.w)); // Overridden above.
+	} while (ret != old32.w);
+	return (u16)old;
+}
+EXPORT_SYMBOL_GPL(cmpxchg_emu_u16);
-- 
2.47.3