[PATCH 0/5] Provide two-byte cmpxchg() emulation

[PATCH 0/5] Provide two-byte cmpxchg() emulation

[Paul E. McKenney]

Hello!

This series provides emulation of two-byte cmpxchg().  Note that this
does not (yet) allow free use of atomic operations on two-byte operands
in core code because there are still a few supported systems that do not
have two-byte store instructions.  However, this emulation does permit use
of wide range of two-byte atomic operations, so is worth putting forward.

This series is being reposted on request in order to ease testing efforts.

The individual patches are as follows:

1.	Add two-byte cmpxchg emulation function, courtesy of Bradley
	Morgan.

2.	sh: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

3.	ARC: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

4.	csky: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

5.	xtensa: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.

#1 and #2 have the acks required to go into the upcoming v7.4 merge
window.

						Thanx, Paul

------------------------------------------------------------------------

 arch/arc/include/asm/cmpxchg.h    |    3 +++
 arch/csky/include/asm/cmpxchg.h   |    9 +++++++++
 arch/sh/include/asm/cmpxchg.h     |    2 ++
 arch/xtensa/include/asm/cmpxchg.h |    1 +
 include/linux/cmpxchg-emu.h       |    4 +++-
 lib/cmpxchg-emu.c                 |   38 ++++++++++++++++++++++++++++++++++----
 6 files changed, 52 insertions(+), 5 deletions(-)

[PATCH 1/5] lib: Add two-byte cmpxchg emulation function

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

cmpxchg_emu_u8() emulates one-byte cmpxchg() in terms of four-byte
cmpxchg() for the architectures lacking native one-byte atomics.
The same architectures also lack native two-byte cmpxchg(), where
such an operation is not supported and either fails to compile via
BUILD_BUG() or fails to link, because the bad pointer sentinels
these architectures declare are never defined.

Add cmpxchg_emu_u16(), the two-byte sibling. It reads the enclosing
word with READ_ONCE(), splices the two target bytes through a union
and loops on cmpxchg() of the full word until the compare succeeds.
Like cmpxchg_emu_u8() it is fully ordered.

Unlike cmpxchg_emu_u8() it casts the old and new values to u16
internally and returns unsigned long, taking the old and new values
as unsigned long, per the suggestion from David Laight. The switch
statements in the architecture macros instantiate every size case,
so a cmpxchg() on a pointer type checks the two-byte case as well,
and a u16 parameter or return would make the macro casts and return
conversions warn there. With unsigned long parameters and return the
call sites need no narrowing casts, pointer exchanges compile warning
free, and the function still compares and returns exactly the 16 bits
the caller asked for, which matches the hardware cmpxchg r16
behaviour where a 16-bit compare only looks at the low 16 bits of
the register.

cmpxchg_emu_u8() keeps returning the old value unmasked, so a caller
that passes a wider old than 8 bits still gets it back as passed,
matching the behaviour the one-byte emulator always had.

The Kconfig symbol gating this file is renamed from
ARCH_NEED_CMPXCHG_1_EMU to ARCH_NEED_CMPXCHG_1_2_EMU, as it now
selects both the one-byte and the two-byte emulation.

[ paulmck: Apply kernel test robot feedback. ]

Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: David Laight <david.laight.linux@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@kernel.org>
---
 include/linux/cmpxchg-emu.h |  4 +++-
 lib/cmpxchg-emu.c           | 38 +++++++++++++++++++++++++++++++++----
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/include/linux/cmpxchg-emu.h b/include/linux/cmpxchg-emu.h
index 998deec67740a..2db70f1e39253 100644
--- a/include/linux/cmpxchg-emu.h
+++ b/include/linux/cmpxchg-emu.h
@@ -4,12 +4,14 @@
  * lacking direct support for these sizes.  These are implemented in terms
  * of 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #ifndef __LINUX_CMPXCHG_EMU_H
 #define __LINUX_CMPXCHG_EMU_H
 
 uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new);
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new);
 
 #endif /* __LINUX_CMPXCHG_EMU_H */
diff --git a/lib/cmpxchg-emu.c b/lib/cmpxchg-emu.c
index 27f6f97cb60dd..25c69224a7597 100644
--- a/lib/cmpxchg-emu.c
+++ b/lib/cmpxchg-emu.c
@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
- * Emulated 1-byte cmpxchg operation for architectures lacking direct
- * support for this size.  This is implemented in terms of 4-byte cmpxchg
- * operations.
+ * Emulated 1-byte and 2-byte cmpxchg operations for architectures lacking
+ * direct support for these sizes.  These are implemented in terms of
+ * 4-byte cmpxchg operations.
  *
- * Copyright (C) 2024 Paul E. McKenney.
+ * Copyright (C) 2024 Paul E. McKenney <paulmck@kernel.org>
+ * Copyright (C) 2026 Bradley Morgan <brads@mainlining.org>
  */
 
 #include <linux/types.h>
@@ -43,3 +44,32 @@ uintptr_t cmpxchg_emu_u8(volatile u8 *p, uintptr_t old, uintptr_t new)
 	return old;
 }
 EXPORT_SYMBOL_GPL(cmpxchg_emu_u8);
+
+union u16_32 {
+	u16 h[2];
+	u32 w;
+};
+
+/* Emulate two-byte cmpxchg() in terms of 4-byte cmpxchg. */
+unsigned long cmpxchg_emu_u16(volatile u16 *p, unsigned long old, unsigned long new)
+{
+	u32 *p32 = (u32 *)(((uintptr_t)p) & ~0x3);
+	int i = (((uintptr_t)p) & 0x2) / 2;
+	union u16_32 old32;
+	union u16_32 new32;
+	u32 ret;
+
+	WARN_ON_ONCE(((uintptr_t)p) & 0x1);
+	ret = READ_ONCE(*p32);
+	do {
+		old32.w = ret;
+		if (old32.h[i] != (u16)old)
+			return (unsigned long)old32.h[i];
+		new32.w = old32.w;
+		new32.h[i] = (u16)new;
+		instrument_atomic_read_write(p, 2);
+		ret = data_race(cmpxchg(p32, old32.w, new32.w)); // Overridden above.
+	} while (ret != old32.w);
+	return (u16)old;
+}
+EXPORT_SYMBOL_GPL(cmpxchg_emu_u16);
-- 
2.40.1

[PATCH 2/5] sh: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

SH has no byte or halfword atomic memory operations, so the __cmpxchg()
switch routes case 1 through cmpxchg_emu_u8() and lets case 2 fall
through to __cmpxchg_called_with_bad_pointer(), which is declared but
never defined, so a two-byte cmpxchg() fails at link time. Route case
2 through the new cmpxchg_emu_u16(), which takes the old and new
values as unsigned long, so the (unsigned long) casts move off the
call and into _old_ and _new_ declarations that type check the old
and new arguments against *ptr through (unsigned long)(0 ? *ptr : _o_),
the idiom David Laight suggested, so cmpxchg(&p, 4, 5) no longer
compiles silently.

[ paulmck: Apply kernel test robot feedback. ]

Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: <linux-sh@vger.kernel.org>
---
 arch/sh/include/asm/cmpxchg.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/sh/include/asm/cmpxchg.h b/arch/sh/include/asm/cmpxchg.h
index 1e5dc5ccf7bf5..477d3025a441c 100644
--- a/arch/sh/include/asm/cmpxchg.h
+++ b/arch/sh/include/asm/cmpxchg.h
@@ -59,6 +59,8 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
 	switch (size) {
 	case 1:
 		return cmpxchg_emu_u8(ptr, old, new);
+	case 2:
+		return cmpxchg_emu_u16(ptr, old, new);
 	case 4:
 		return __cmpxchg_u32(ptr, old, new);
 	}
-- 
2.40.1

[PATCH 3/5] ARC: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

ARC has no two-byte atomic compare and swap, so the
arch_cmpxchg_relaxed() macro switch lets case 2 fall through to
BUILD_BUG() via default, and a two-byte cmpxchg() fails the build.

Route case 2 through the new cmpxchg_emu_u16(), which narrows the
old and new values itself, so the dispatch keeps the (uintptr_t)
casts the case 1 path already uses.

The sizeof(*(_p_)) fix that v4 folded in here landed separately
through Vineet's f050c3e61d2a, so this patch is now only the
case 2 wiring.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
 arch/arc/include/asm/cmpxchg.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
index 76f43db0890fc..7157718f147c1 100644
--- a/arch/arc/include/asm/cmpxchg.h
+++ b/arch/arc/include/asm/cmpxchg.h
@@ -50,6 +50,9 @@
 	case 1:								\
 		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
 		break;							\
+	case 2:								\
+		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, (unsigned long)_o_, (unsigned long)_n_);	\
+		break;							\
 	case 4:								\
 		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
 		break;							\
-- 
2.40.1

Re: [PATCH 3/5] ARC: Emulate two-byte cmpxchg

[Vineet Gupta]

On 10/7/26 22:36, Paul E. McKenney wrote:
> From: Bradley Morgan <brads@mainlining.org>
>
> ARC has no two-byte atomic compare and swap, so the
> arch_cmpxchg_relaxed() macro switch lets case 2 fall through to
> BUILD_BUG() via default, and a two-byte cmpxchg() fails the build.
>
> Route case 2 through the new cmpxchg_emu_u16(), which narrows the
> old and new values itself, so the dispatch keeps the (uintptr_t)
> casts the case 1 path already uses.
>
> The sizeof(*(_p_)) fix that v4 folded in here landed separately
> through Vineet's f050c3e61d2a, so this patch is now only the
> case 2 wiring.
>
> Signed-off-by: Bradley Morgan <brads@mainlining.org>
> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>

Acked-by: Vineet Gupta <vgupta@kernel.org>

Thx,
-Vineet

> ---
>   arch/arc/include/asm/cmpxchg.h | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
> index 76f43db0890fc..7157718f147c1 100644
> --- a/arch/arc/include/asm/cmpxchg.h
> +++ b/arch/arc/include/asm/cmpxchg.h
> @@ -50,6 +50,9 @@
>   	case 1:								\
>   		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
>   		break;							\
> +	case 2:								\
> +		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, (unsigned long)_o_, (unsigned long)_n_);	\
> +		break;							\
>   	case 4:								\
>   		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
>   		break;							\

Re: [PATCH 3/5] ARC: Emulate two-byte cmpxchg

[Paul E. McKenney]

On Wed, Oct 07, 2026 at 10:48:39PM +0200, Vineet Gupta wrote:
> On 10/7/26 22:36, Paul E. McKenney wrote:
> > From: Bradley Morgan <brads@mainlining.org>
> > 
> > ARC has no two-byte atomic compare and swap, so the
> > arch_cmpxchg_relaxed() macro switch lets case 2 fall through to
> > BUILD_BUG() via default, and a two-byte cmpxchg() fails the build.
> > 
> > Route case 2 through the new cmpxchg_emu_u16(), which narrows the
> > old and new values itself, so the dispatch keeps the (uintptr_t)
> > casts the case 1 path already uses.
> > 
> > The sizeof(*(_p_)) fix that v4 folded in here landed separately
> > through Vineet's f050c3e61d2a, so this patch is now only the
> > case 2 wiring.
> > 
> > Signed-off-by: Bradley Morgan <brads@mainlining.org>
> > Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
> 
> Acked-by: Vineet Gupta <vgupta@kernel.org>

Thank you!  I will apply this on my next rebase.  Unless something breaks,
I will include this in my pull request for the upcoming merge window.

							Thanx, Paul

> Thx,
> -Vineet
> 
> > ---
> >   arch/arc/include/asm/cmpxchg.h | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
> > index 76f43db0890fc..7157718f147c1 100644
> > --- a/arch/arc/include/asm/cmpxchg.h
> > +++ b/arch/arc/include/asm/cmpxchg.h
> > @@ -50,6 +50,9 @@
> >   	case 1:								\
> >   		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_);	\
> >   		break;							\
> > +	case 2:								\
> > +		_prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *__force)_p_, (unsigned long)_o_, (unsigned long)_n_);	\
> > +		break;							\
> >   	case 4:								\
> >   		_prev_ = __cmpxchg(_p_, _o_, _n_);			\
> >   		break;							\
> 

[PATCH 4/5] csky: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

C-SKY has no two-byte atomic compare and swap, so the __cmpxchg()
macros let case 2 fall through to BUILD_BUG() via default, and a
two-byte cmpxchg() fails the build.

Route case 2 through the new cmpxchg_emu_u16(), which narrows the
old and new values itself, so all three orderings, relaxed, acquire
and full, keep the (uintptr_t) casts the case 1 path already uses.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
 arch/csky/include/asm/cmpxchg.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/csky/include/asm/cmpxchg.h b/arch/csky/include/asm/cmpxchg.h
index db6dda47184e4..6f3ca79e54acf 100644
--- a/arch/csky/include/asm/cmpxchg.h
+++ b/arch/csky/include/asm/cmpxchg.h
@@ -64,6 +64,9 @@
 	switch (size) {						\
 	case 1:							\
 		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		break;							\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, (unsigned long)__old, (unsigned long)__new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
@@ -97,6 +100,9 @@
 	switch (size) {						\
 	case 1:							\
 		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		break;							\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, (unsigned long)__old, (unsigned long)__new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
@@ -131,6 +137,9 @@
 	switch (size) {						\
 	case 1:							\
 		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *)__ptr, (uintptr_t)__old, (uintptr_t)__new); \
+		break;							\
+	case 2:							\
+		__ret = (__typeof__(*(ptr)))cmpxchg_emu_u16((volatile u16 *)__ptr, (unsigned long)__old, (unsigned long)__new); \
 		break;						\
 	case 4:							\
 		asm volatile (					\
-- 
2.40.1

[PATCH 5/5] xtensa: Emulate two-byte cmpxchg

[Paul E. McKenney]

From: Bradley Morgan <brads@mainlining.org>

Xtensa has no two-byte atomic compare and swap, so the __cmpxchg()
switch lets case 2 fall through to __cmpxchg_called_with_bad_pointer(),
which is declared but never defined, so a two-byte cmpxchg() fails
at link time.

Route case 2 through the new cmpxchg_emu_u16(), which takes the
old and new values as unsigned long and narrows them itself, so
the call needs no extra casts.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
 arch/xtensa/include/asm/cmpxchg.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/xtensa/include/asm/cmpxchg.h b/arch/xtensa/include/asm/cmpxchg.h
index b6db4838b175a..8dea8e357fc0f 100644
--- a/arch/xtensa/include/asm/cmpxchg.h
+++ b/arch/xtensa/include/asm/cmpxchg.h
@@ -76,6 +76,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 {
 	switch (size) {
 	case 1:  return cmpxchg_emu_u8(ptr, old, new);
+	case 2:  return cmpxchg_emu_u16(ptr, old, new);
 	case 4:  return __cmpxchg_u32(ptr, old, new);
 	default: __cmpxchg_called_with_bad_pointer();
 		 return old;
-- 
2.40.1

Re: [PATCH 0/5] Provide two-byte cmpxchg() emulation

[Bradley Morgan]

On 7 October 2026 21:36:01 BST, "Paul E. McKenney" <paulmck@kernel.org>
wrote:
>Hello!

[OFF-LIST]

I mean, I did what you wanted, hmm?

>
>This series provides emulation of two-byte cmpxchg().  Note that this
>does not (yet) allow free use of atomic operations on two-byte operands
>in core code because there are still a few supported systems that do not
>have two-byte store instructions.  However, this emulation does permit use
>of wide range of two-byte atomic operations, so is worth putting forward.
>
>This series is being reposted on request in order to ease testing efforts.
>
>The individual patches are as follows:
>
>1.	Add two-byte cmpxchg emulation function, courtesy of Bradley
>	Morgan.
>
>2.	sh: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>3.	ARC: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>4.	csky: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>5.	xtensa: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
>
>#1 and #2 have the acks required to go into the upcoming v7.4 merge
>window.
>
>						Thanx, Paul
>
>------------------------------------------------------------------------
>
> arch/arc/include/asm/cmpxchg.h    |    3 +++
> arch/csky/include/asm/cmpxchg.h   |    9 +++++++++
> arch/sh/include/asm/cmpxchg.h     |    2 ++
> arch/xtensa/include/asm/cmpxchg.h |    1 +
> include/linux/cmpxchg-emu.h       |    4 +++-
> lib/cmpxchg-emu.c                 |   38
> ++++++++++++++++++++++++++++++++++----
> 6 files changed, 52 insertions(+), 5 deletions(-)

--- Thanks!
"I'm not a very positive person" - Linus torvalds

Re: [PATCH 0/5] Provide two-byte cmpxchg() emulation

[Paul E. McKenney]

On Wed, Oct 07, 2026 at 09:44:02PM +0100, Bradley Morgan wrote:
> On 7 October 2026 21:36:01 BST, "Paul E. McKenney" <paulmck@kernel.org>
> wrote:
> >Hello!
> 
> [OFF-LIST]

Well, off of most lists, anyway!  Been there, done that!  ;-)

> I mean, I did what you wanted, hmm?

You did just fine.

							Thanx, Paul

> >This series provides emulation of two-byte cmpxchg().  Note that this
> >does not (yet) allow free use of atomic operations on two-byte operands
> >in core code because there are still a few supported systems that do not
> >have two-byte store instructions.  However, this emulation does permit use
> >of wide range of two-byte atomic operations, so is worth putting forward.
> >
> >This series is being reposted on request in order to ease testing efforts.
> >
> >The individual patches are as follows:
> >
> >1.	Add two-byte cmpxchg emulation function, courtesy of Bradley
> >	Morgan.
> >
> >2.	sh: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >3.	ARC: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >4.	csky: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >5.	xtensa: Emulate two-byte cmpxchg, courtesy of Bradley Morgan.
> >
> >#1 and #2 have the acks required to go into the upcoming v7.4 merge
> >window.
> >
> >						Thanx, Paul
> >
> >------------------------------------------------------------------------
> >
> > arch/arc/include/asm/cmpxchg.h    |    3 +++
> > arch/csky/include/asm/cmpxchg.h   |    9 +++++++++
> > arch/sh/include/asm/cmpxchg.h     |    2 ++
> > arch/xtensa/include/asm/cmpxchg.h |    1 +
> > include/linux/cmpxchg-emu.h       |    4 +++-
> > lib/cmpxchg-emu.c                 |   38
> > ++++++++++++++++++++++++++++++++++----
> > 6 files changed, 52 insertions(+), 5 deletions(-)
> 
> --- Thanks!
> "I'm not a very positive person" - Linus torvalds