[PATCH v2 0/2] riscv: signal: fix the FP state restore in rt_sigreturn()

[Nickolai Zeldovich <nickolai@csail.mit.edu>]

If rt_sigreturn() is preempted or sleeps on a page fault while it copies
the FP registers from the signal frame, the interrupted code resumes
with the signal handler's FP registers. Patch 1 fixes this, patch 2 adds
a selftest that reproduces it with userfaultfd.

Tested under QEMU with riscv64 defconfig plus CONFIG_USERFAULTFD: the
new test fails 10 of 10 runs on master, with preempt=lazy and
preempt=none, and passes 10 of 10 with patch 1, also on top of Guobin
Zhang's "riscv: signal: protect regs->status RMW from concurrent
preemption" v2 [1]; the two apply in either order.

This series was prepared with the help of an AI tool.

Changes in v2:
- Disable preemption around __fstate_clean() (Andy Chiu)
- Add a selftest (Andy Chiu)
- Shorten the commit message

v1: https://lore.kernel.org/all/20261016160708.790397-1-nickolai@csail.mit.edu/
[1] https://lore.kernel.org/all/20261020-vector_fpu_regs_status_rmw_fix-v2-1-474a59155e96@intel.com/

Nickolai Zeldovich (2):
  riscv: signal: mark the FP state clean before restoring it from the
    frame
  selftests: riscv: test FP state restore when rt_sigreturn() faults

 arch/riscv/kernel/signal.c                    |   7 +
 .../selftests/riscv/sigreturn/.gitignore      |   1 +
 .../selftests/riscv/sigreturn/Makefile        |   5 +-
 .../selftests/riscv/sigreturn/fp_restore.c    | 146 ++++++++++++++++++
 4 files changed, 158 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/riscv/sigreturn/fp_restore.c


base-commit: 36aad21d50d1af3f6954bb0c988257a908202477
-- 
2.53.0