Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

["Christophe Leroy (CS GROUP)" <chleroy@kernel.org>]

Le 09/09/2026 à 07:28, Venkat a écrit :
> 
> 
>> On 8 Sep 2026, at 3:24 AM, Thibault Ferrante <thibault.ferrante@canonical.com> wrote:
>>
>> tcheck() is used to check the current transaction state (active,
>> suspended, doomed) via the "tcheck" instruction, which writes its
>> result into CR field 0. The inline asm declared a GPR output operand
>> for this result but never actually moved the CR into it.
>>
>> Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
>> tcheck_transactional()) has effectively been testing bits of an unrelated,
>> arbitrary register value since this helper was introduced.
>> The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
>> they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
>> can never return true, and tcheck_transactional() degrades to being
>> equivalent to tcheck_active().
>>
>> Fix tcheck() to actually move CR into the output register with mfcr,
>> and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
>> (TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.
>>
>> This bug has been present since tcheck() was introduced.
>>
>> Link: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.launchpad.net%2Fbugs%2F2107442&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C4805edfd01004fae88bf08df0e334066%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C639245285430142903%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ho9uy5Jyj7SnKtiSZibCDfMR22FhBIuUSkgmguhENts%3D&reserved=0
>> Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
>> Signed-off-by: Thibault Ferrante <thibault.ferrante@canonical.com>
>> ---
> 
>> tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
>> 1 file changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
>> index c03c6e778876..6024ce4ba6ff 100644
>> --- a/tools/testing/selftests/powerpc/tm/tm.h
>> +++ b/tools/testing/selftests/powerpc/tm/tm.h
>> @@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
>> static inline int tcheck(void)
>> {
>> long cr;
>> - asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
>> - return (cr >> 28) & 4;
>> + asm volatile("tcheck 0;"

Why not use cr7 instead of using cr0 and doing cr >> 28 below ?

>> +     "mfcr %0;"
>> +     : "=r"(cr)
>> +     :
>> +     : "cr0");
>> + return (cr >> 28) & 0xf;
>> }
>>
>> static inline bool tcheck_doomed(void)
>> -- 
>> 2.55.0
>>
>