[PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

[PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

[Thibault Ferrante]

tcheck() is used to check the current transaction state (active,
suspended, doomed) via the "tcheck" instruction, which writes its
result into CR field 0. The inline asm declared a GPR output operand
for this result but never actually moved the CR into it.

Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
tcheck_transactional()) has effectively been testing bits of an unrelated,
arbitrary register value since this helper was introduced.
The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
can never return true, and tcheck_transactional() degrades to being
equivalent to tcheck_active().

Fix tcheck() to actually move CR into the output register with mfcr,
and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
(TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.

This bug has been present since tcheck() was introduced.

Link: https://bugs.launchpad.net/bugs/2107442
Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
Signed-off-by: Thibault Ferrante <thibault.ferrante@canonical.com>
---
 tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
index c03c6e778876..6024ce4ba6ff 100644
--- a/tools/testing/selftests/powerpc/tm/tm.h
+++ b/tools/testing/selftests/powerpc/tm/tm.h
@@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
 static inline int tcheck(void)
 {
 	long cr;
-	asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
-	return (cr >> 28) & 4;
+	asm volatile("tcheck 0;"
+		     "mfcr %0;"
+		     : "=r"(cr)
+		     :
+		     : "cr0");
+	return (cr >> 28) & 0xf;
 }
 
 static inline bool tcheck_doomed(void)
-- 
2.55.0

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

[Venkat]

> On 8 Sep 2026, at 3:24 AM, Thibault Ferrante <thibault.ferrante@canonical.com> wrote:
> 
> tcheck() is used to check the current transaction state (active,
> suspended, doomed) via the "tcheck" instruction, which writes its
> result into CR field 0. The inline asm declared a GPR output operand
> for this result but never actually moved the CR into it.
> 
> Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
> tcheck_transactional()) has effectively been testing bits of an unrelated,
> arbitrary register value since this helper was introduced.
> The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
> they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
> can never return true, and tcheck_transactional() degrades to being
> equivalent to tcheck_active().
> 
> Fix tcheck() to actually move CR into the output register with mfcr,
> and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
> (TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.
> 
> This bug has been present since tcheck() was introduced.
> 
> Link: https://bugs.launchpad.net/bugs/2107442
> Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
> Signed-off-by: Thibault Ferrante <thibault.ferrante@canonical.com>
> ---

Applied this patch on top of latest mainline and all the signal selftests are passing.


Please add below tags.

Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Closes: https://lore.kernel.org/all/364996ce-aba2-4213-8d20-7dd481b43fe6@linux.ibm.com/

With this Patch:


# make run_tests 
# timeout set to 0
# selftests: powerpc/signal: signal
ok 1 selftests: powerpc/signal: signal
# timeout set to 0
# selftests: powerpc/signal: signal_tm
ok 2 selftests: powerpc/signal: signal_tm
# timeout set to 0
# selftests: powerpc/signal: sigfuz
ok 3 selftests: powerpc/signal: sigfuz
# timeout set to 0
# selftests: powerpc/signal: sigreturn_vdso
ok 4 selftests: powerpc/signal: sigreturn_vdso
# timeout set to 0
# selftests: powerpc/signal: sig_sc_double_restart
ok 5 selftests: powerpc/signal: sig_sc_double_restart
# timeout set to 0
# selftests: powerpc/signal: sigreturn_kernel
ok 6 selftests: powerpc/signal: sigreturn_kernel
# timeout set to 0
# selftests: powerpc/signal: sigreturn_unaligned
ok 7 selftests: powerpc/signal: sigreturn_unaligned

Regards,
Venkat.



> tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
> index c03c6e778876..6024ce4ba6ff 100644
> --- a/tools/testing/selftests/powerpc/tm/tm.h
> +++ b/tools/testing/selftests/powerpc/tm/tm.h
> @@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
> static inline int tcheck(void)
> {
> long cr;
> - asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
> - return (cr >> 28) & 4;
> + asm volatile("tcheck 0;"
> +     "mfcr %0;"
> +     : "=r"(cr)
> +     :
> +     : "cr0");
> + return (cr >> 28) & 0xf;
> }
> 
> static inline bool tcheck_doomed(void)
> -- 
> 2.55.0
> 

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

[Christophe Leroy (CS GROUP)]

Le 09/09/2026 à 07:28, Venkat a écrit :
> 
> 
>> On 8 Sep 2026, at 3:24 AM, Thibault Ferrante <thibault.ferrante@canonical.com> wrote:
>>
>> tcheck() is used to check the current transaction state (active,
>> suspended, doomed) via the "tcheck" instruction, which writes its
>> result into CR field 0. The inline asm declared a GPR output operand
>> for this result but never actually moved the CR into it.
>>
>> Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
>> tcheck_transactional()) has effectively been testing bits of an unrelated,
>> arbitrary register value since this helper was introduced.
>> The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
>> they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
>> can never return true, and tcheck_transactional() degrades to being
>> equivalent to tcheck_active().
>>
>> Fix tcheck() to actually move CR into the output register with mfcr,
>> and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
>> (TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.
>>
>> This bug has been present since tcheck() was introduced.
>>
>> Link: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.launchpad.net%2Fbugs%2F2107442&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C4805edfd01004fae88bf08df0e334066%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C639245285430142903%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ho9uy5Jyj7SnKtiSZibCDfMR22FhBIuUSkgmguhENts%3D&reserved=0
>> Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
>> Signed-off-by: Thibault Ferrante <thibault.ferrante@canonical.com>
>> ---
> 
>> tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
>> 1 file changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
>> index c03c6e778876..6024ce4ba6ff 100644
>> --- a/tools/testing/selftests/powerpc/tm/tm.h
>> +++ b/tools/testing/selftests/powerpc/tm/tm.h
>> @@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
>> static inline int tcheck(void)
>> {
>> long cr;
>> - asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
>> - return (cr >> 28) & 4;
>> + asm volatile("tcheck 0;"

Why not use cr7 instead of using cr0 and doing cr >> 28 below ?

>> +     "mfcr %0;"
>> +     : "=r"(cr)
>> +     :
>> +     : "cr0");
>> + return (cr >> 28) & 0xf;
>> }
>>
>> static inline bool tcheck_doomed(void)
>> -- 
>> 2.55.0
>>
> 

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

[Thibault Ferrante]

On 09/09/2026 10:56, Christophe Leroy (CS GROUP) wrote:
>>> diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
>>> index c03c6e778876..6024ce4ba6ff 100644
>>> --- a/tools/testing/selftests/powerpc/tm/tm.h
>>> +++ b/tools/testing/selftests/powerpc/tm/tm.h
>>> @@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
>>> static inline int tcheck(void)
>>> {
>>> long cr;
>>> - asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
>>> - return (cr >> 28) & 4;
>>> + asm volatile("tcheck 0;"
> 
> Why not use cr7 instead of using cr0 and doing cr >> 28 below ?

That would work, but that's not consistent with other asm in selftest/powerpc: tbegin./tend./tabort. and vas_paste() all target cr0 and shift as needed.