Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

[Christophe Leroy (CS GROUP)]

Le 09/09/2026 à 07:28, Venkat a écrit :
> > On 8 Sep 2026, at 3:24 AM, Thibault Ferrante <thibault.ferrante@xxxxxxxxxxxxx> wrote:
> >
> > tcheck() is used to check the current transaction state (active,
> > suspended, doomed) via the "tcheck" instruction, which writes its
> > result into CR field 0. The inline asm declared a GPR output operand
> > for this result but never actually moved the CR into it.
> >
> > Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
> > tcheck_transactional()) has effectively been testing bits of an unrelated,
> > arbitrary register value since this helper was introduced.
> > The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
> > they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
> > can never return true, and tcheck_transactional() degrades to being
> > equivalent to tcheck_active().
> >
> > Fix tcheck() to actually move CR into the output register with mfcr,
> > and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
> > (TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.
> >
> > This bug has been present since tcheck() was introduced.
> >
> > Link: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.launchpad.net%2Fbugs%2F2107442&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C4805edfd01004fae88bf08df0e334066%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C639245285430142903%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ho9uy5Jyj7SnKtiSZibCDfMR22FhBIuUSkgmguhENts%3D&reserved=0
> > Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
> > Signed-off-by: Thibault Ferrante <thibault.ferrante@xxxxxxxxxxxxx>
> > ---
>
> > tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
> > 1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
> > index c03c6e778876..6024ce4ba6ff 100644
> > --- a/tools/testing/selftests/powerpc/tm/tm.h
> > +++ b/tools/testing/selftests/powerpc/tm/tm.h
> > @@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
> > static inline int tcheck(void)
> > {
> > long cr;
> > - asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
> > - return (cr >> 28) & 4;
> > + asm volatile("tcheck 0;"

Why not use cr7 instead of using cr0 and doing cr >> 28 below ?

> > +     "mfcr %0;"
> > +     : "=r"(cr)
> > +     :
> > +     : "cr0");
> > + return (cr >> 28) & 0xf;
> > }
> >
> > static inline bool tcheck_doomed(void)
> > --
> > 2.55.0