[PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

Subsystems: kernel selftest framework, the rest

COLD34d LANDED

Landed in mainline as ed28b16eab70 on 2026-09-10.

5 messages, 4 authors, 2026-09-14 · open the first message on its own page

[PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

From: Thibault Ferrante <hidden>
Date: 2026-09-07 21:54:36

tcheck() is used to check the current transaction state (active,
suspended, doomed) via the "tcheck" instruction, which writes its
result into CR field 0. The inline asm declared a GPR output operand
for this result but never actually moved the CR into it.

Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
tcheck_transactional()) has effectively been testing bits of an unrelated,
arbitrary register value since this helper was introduced.
The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
can never return true, and tcheck_transactional() degrades to being
equivalent to tcheck_active().

Fix tcheck() to actually move CR into the output register with mfcr,
and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
(TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.

This bug has been present since tcheck() was introduced.

Link: https://bugs.launchpad.net/bugs/2107442
Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
Signed-off-by: Thibault Ferrante <redacted>
---
 tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
index c03c6e778876..6024ce4ba6ff 100644
--- a/tools/testing/selftests/powerpc/tm/tm.h
+++ b/tools/testing/selftests/powerpc/tm/tm.h

@@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)
 static inline int tcheck(void)
 {
 	long cr;
-	asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
-	return (cr >> 28) & 4;
+	asm volatile("tcheck 0;"
+		     "mfcr %0;"
+		     : "=r"(cr)
+		     :
+		     : "cr0");
+	return (cr >> 28) & 0xf;
 }
 
 static inline bool tcheck_doomed(void)

-- 
2.55.0

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

From: Venkat <hidden>
Date: 2026-09-09 05:29:00

On 8 Sep 2026, at 3:24 AM, Thibault Ferrante [off-list ref] wrote:

tcheck() is used to check the current transaction state (active,
suspended, doomed) via the "tcheck" instruction, which writes its
result into CR field 0. The inline asm declared a GPR output operand
for this result but never actually moved the CR into it.

Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
tcheck_transactional()) has effectively been testing bits of an unrelated,
arbitrary register value since this helper was introduced.
The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
can never return true, and tcheck_transactional() degrades to being
equivalent to tcheck_active().

Fix tcheck() to actually move CR into the output register with mfcr,
and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
(TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.

This bug has been present since tcheck() was introduced.

Link: https://bugs.launchpad.net/bugs/2107442
Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
Signed-off-by: Thibault Ferrante <redacted>
---

Applied this patch on top of latest mainline and all the signal selftests are passing.


Please add below tags.

Reported-by: Venkat Rao Bagalkote <redacted>
Tested-by: Venkat Rao Bagalkote <redacted>
Closes: https://lore.kernel.org/all/364996ce-aba2-4213-8d20-7dd481b43fe6@linux.ibm.com/

With this Patch:


# make run_tests 
# timeout set to 0
# selftests: powerpc/signal: signal
ok 1 selftests: powerpc/signal: signal
# timeout set to 0
# selftests: powerpc/signal: signal_tm
ok 2 selftests: powerpc/signal: signal_tm
# timeout set to 0
# selftests: powerpc/signal: sigfuz
ok 3 selftests: powerpc/signal: sigfuz
# timeout set to 0
# selftests: powerpc/signal: sigreturn_vdso
ok 4 selftests: powerpc/signal: sigreturn_vdso
# timeout set to 0
# selftests: powerpc/signal: sig_sc_double_restart
ok 5 selftests: powerpc/signal: sig_sc_double_restart
# timeout set to 0
# selftests: powerpc/signal: sigreturn_kernel
ok 6 selftests: powerpc/signal: sigreturn_kernel
# timeout set to 0
# selftests: powerpc/signal: sigreturn_unaligned
ok 7 selftests: powerpc/signal: sigreturn_unaligned

Regards,
Venkat.

quoted hunk

tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
index c03c6e778876..6024ce4ba6ff 100644
--- a/tools/testing/selftests/powerpc/tm/tm.h
+++ b/tools/testing/selftests/powerpc/tm/tm.h

@@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)

static inline int tcheck(void)
{
long cr;
- asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
- return (cr >> 28) & 4;
+ asm volatile("tcheck 0;"
+     "mfcr %0;"
+     : "=r"(cr)
+     :
+     : "cr0");
+ return (cr >> 28) & 0xf;
}

static inline bool tcheck_doomed(void)
-- 
2.55.0

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

From: "Christophe Leroy (CS GROUP)" <chleroy@kernel.org>
Date: 2026-09-09 08:56:56


Le 09/09/2026 à 07:28, Venkat a écrit :

quoted

On 8 Sep 2026, at 3:24 AM, Thibault Ferrante [off-list ref] wrote:

tcheck() is used to check the current transaction state (active,
suspended, doomed) via the "tcheck" instruction, which writes its
result into CR field 0. The inline asm declared a GPR output operand
for this result but never actually moved the CR into it.

Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
tcheck_transactional()) has effectively been testing bits of an unrelated,
arbitrary register value since this helper was introduced.
The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
can never return true, and tcheck_transactional() degrades to being
equivalent to tcheck_active().

Fix tcheck() to actually move CR into the output register with mfcr,
and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble
(TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers.

This bug has been present since tcheck() was introduced.

Link: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.launchpad.net%2Fbugs%2F2107442&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C4805edfd01004fae88bf08df0e334066%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C639245285430142903%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ho9uy5Jyj7SnKtiSZibCDfMR22FhBIuUSkgmguhENts%3D&reserved=0
Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C")
Signed-off-by: Thibault Ferrante <redacted>
---

quoted

tools/testing/selftests/powerpc/tm/tm.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
index c03c6e778876..6024ce4ba6ff 100644
--- a/tools/testing/selftests/powerpc/tm/tm.h
+++ b/tools/testing/selftests/powerpc/tm/tm.h

@@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)

static inline int tcheck(void)
{
long cr;
- asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
- return (cr >> 28) & 4;
+ asm volatile("tcheck 0;"

Why not use cr7 instead of using cr0 and doing cr >> 28 below ?

quoted

+     "mfcr %0;"
+     : "=r"(cr)
+     :
+     : "cr0");
+ return (cr >> 28) & 0xf;
}

static inline bool tcheck_doomed(void)
-- 
2.55.0

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

From: Thibault Ferrante <hidden>
Date: 2026-09-09 10:05:16

On 09/09/2026 10:56, Christophe Leroy (CS GROUP) wrote:

quoted

diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
index c03c6e778876..6024ce4ba6ff 100644
--- a/tools/testing/selftests/powerpc/tm/tm.h
+++ b/tools/testing/selftests/powerpc/tm/tm.h

@@ -105,8 +105,12 @@ static inline bool failure_is_nesting(void)

static inline int tcheck(void)
{
long cr;
- asm volatile ("tcheck 0" : "=r"(cr) : : "cr0");
- return (cr >> 28) & 4;
+ asm volatile("tcheck 0;"

Why not use cr7 instead of using cr0 and doing cr >> 28 below ?

That would work, but that's not consistent with other asm in selftest/powerpc: tbegin./tend./tabort. and vas_paste() all target cr0 and shift as needed.

Re: [PATCH] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value

From: Madhavan Srinivasan <maddy@linux.ibm.com>
Date: 2026-09-14 07:21:33

On Mon, 07 Sep 2026 23:54:20 +0200, Thibault Ferrante wrote:

tcheck() is used to check the current transaction state (active,
suspended, doomed) via the "tcheck" instruction, which writes its
result into CR field 0. The inline asm declared a GPR output operand
for this result but never actually moved the CR into it.

Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(),
tcheck_transactional()) has effectively been testing bits of an unrelated,
arbitrary register value since this helper was introduced.
The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before
they ever reach the callers, so tcheck_doomed() and tcheck_suspended()
can never return true, and tcheck_transactional() degrades to being
equivalent to tcheck_active().

[...]

Applied to powerpc/fixes.

[1/1] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
      https://git.kernel.org/powerpc/c/ed28b16eab705071d28edaace47189c2eb3aa108

cheers

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help