Re: [PATCH v2 2/2] selftests: riscv: test FP state restore when rt_sigreturn() faults

[Andy Chiu <tchiu@tenstorrent.com>]

Hi Nickolai,

On Sat, Oct 31, 2026 at 12:18:26PM -0400, Nickolai Zeldovich wrote:
> Add a test for the previous patch: the signal frame sits on a
> userfaultfd page that the handler drops after dirtying the FP
> registers, so rt_sigreturn() sleeps in the middle of copying the FP
> registers from the frame. The interrupted code must get its own
> registers back.
> 
> The test is skipped without the D extension or when userfaultfd is not
> available to the caller.
>

The test is failing on qemu, with or without the patch applied.

> Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
> ---
>  .../selftests/riscv/sigreturn/.gitignore      |   1 +
>  .../selftests/riscv/sigreturn/Makefile        |   5 +-
>  .../selftests/riscv/sigreturn/fp_restore.c    | 146 ++++++++++++++++++
>  3 files changed, 151 insertions(+), 1 deletion(-)
>  create mode 100644 tools/testing/selftests/riscv/sigreturn/fp_restore.c
> 
> diff --git a/tools/testing/selftests/riscv/sigreturn/.gitignore b/tools/testing/selftests/riscv/sigreturn/.gitignore
> index 35002b8ae780..8ed282ecb618 100644
> --- a/tools/testing/selftests/riscv/sigreturn/.gitignore
> +++ b/tools/testing/selftests/riscv/sigreturn/.gitignore
> @@ -1 +1,2 @@
> +fp_restore
>  sigreturn
> diff --git a/tools/testing/selftests/riscv/sigreturn/Makefile b/tools/testing/selftests/riscv/sigreturn/Makefile
> index 8c77508641f3..ac7ae7a7c2ae 100644
> --- a/tools/testing/selftests/riscv/sigreturn/Makefile
> +++ b/tools/testing/selftests/riscv/sigreturn/Makefile
> @@ -4,9 +4,12 @@
>  
>  CFLAGS += -I$(top_srcdir)/tools/include
>  
> -TEST_GEN_PROGS := sigreturn
> +TEST_GEN_PROGS := sigreturn fp_restore
>  
>  include ../../lib.mk
>  
>  $(OUTPUT)/sigreturn: sigreturn.c
>  	$(CC) -static -o $@ $(CFLAGS) $(LDFLAGS) $^
> +
> +$(OUTPUT)/fp_restore: fp_restore.c
> +	$(CC) -static -pthread -o $@ $(CFLAGS) $(LDFLAGS) $^
> diff --git a/tools/testing/selftests/riscv/sigreturn/fp_restore.c b/tools/testing/selftests/riscv/sigreturn/fp_restore.c
> new file mode 100644
> index 000000000000..1a56684c5f28
> --- /dev/null
> +++ b/tools/testing/selftests/riscv/sigreturn/fp_restore.c
> @@ -0,0 +1,146 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Check that rt_sigreturn() restores the FP registers from the signal
> + * frame when the copy of the frame sleeps on a page fault while the
> + * handler's FP state is dirty.  The frame is placed on a userfaultfd
> + * page that the handler drops, so the copy faults after f0-f15.
> + */
> +#include <fcntl.h>
> +#include <pthread.h>
> +#include <signal.h>
> +#include <stdint.h>
> +#include <string.h>
> +#include <sys/auxv.h>
> +#include <sys/ioctl.h>
> +#include <sys/mman.h>
> +#include <sys/syscall.h>
> +#include <ucontext.h>
> +#include <unistd.h>
> +#include <asm/hwcap.h>
> +#include <linux/userfaultfd.h>
> +#include "kselftest_harness.h"
> +
> +#define PAGE		4096UL
> +#define STACK_SIZE	65536UL
> +/* the page boundary falls this far into the FP image, after f0-f15 */
> +#define SPLIT		128
> +
> +#define F0_15	"0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15"
> +/* caller-saved only, so the handler's epilogue does not reload them */
> +#define HANDLER_REGS	"0, 1, 2, 3, 4, 5, 6, 7, 10, 11, 12, 13, 14, 15"
> +
> +static uint64_t pattern[16], handler_pattern[16];
> +static void *saved;
> +static int placed;
> +
> +static void handler(int sig, siginfo_t *si, void *context)
> +{
> +	ucontext_t *uc = context;
> +	unsigned long split = (unsigned long)&uc->uc_mcontext.__fpregs + SPLIT;
> +
> +	placed = !(split & (PAGE - 1));
> +	if (placed) {
> +		/* rt_sigreturn() will fault on this page and wait for serve() */
> +		memcpy(saved, (void *)split, PAGE);
> +		if (madvise((void *)split, PAGE, MADV_DONTNEED))
> +			_exit(1);
> +	}
> +	asm volatile(".irp i, " HANDLER_REGS "\n"
> +		     "fld f\\i, \\i * 8(%[h])\n"
> +		     ".endr\n"
> +		     : : [h] "r" (handler_pattern)
> +		     : "memory", "ft0", "ft1", "ft2", "ft3", "ft4", "ft5",
> +		       "ft6", "ft7", "fa0", "fa1", "fa2", "fa3", "fa4", "fa5");
> +}
> +
> +static void *serve(void *arg)
> +{
> +	struct uffdio_copy copy = { .src = (unsigned long)saved, .len = PAGE };
> +	struct uffd_msg msg;
> +	int fd = (long)arg;
> +
> +	while (read(fd, &msg, sizeof(msg)) == sizeof(msg)) {
> +		copy.dst = msg.arg.pagefault.address & ~(PAGE - 1);
> +		copy.copy = 0;
> +		ioctl(fd, UFFDIO_COPY, &copy);
> +	}
> +	return NULL;
> +}
> +
> +TEST(fp_restore_frame_fault)
> +{
> +	struct sigaction sa = {
> +		.sa_sigaction = handler,
> +		.sa_flags = SA_SIGINFO | SA_ONSTACK,
> +	};
> +	struct uffdio_api api = { .api = UFFD_API };
> +	struct uffdio_register reg = { .mode = UFFDIO_REGISTER_MODE_MISSING };
> +	stack_t ss = { .ss_size = STACK_SIZE };
> +	long pid = getpid(), tid = syscall(__NR_gettid);
> +	uint64_t out[16];
> +	unsigned long fcsr, shift;
> +	pthread_t thread;
> +	int fd, i;
> +
> +	if (!(getauxval(AT_HWCAP) & COMPAT_HWCAP_ISA_D))
> +		SKIP(return, "no D extension");
> +
> +	fd = syscall(__NR_userfaultfd, O_CLOEXEC);
> +	if (fd < 0)
> +		SKIP(return, "userfaultfd not available");
> +	ASSERT_EQ(0, ioctl(fd, UFFDIO_API, &api));
> +
> +	for (i = 0; i < 16; i++) {
> +		pattern[i] = 0x4010000000000000ULL + i;
> +		handler_pattern[i] = 0xbff0000000000000ULL + i;
> +	}
> +
> +	saved = mmap(NULL, PAGE, PROT_READ | PROT_WRITE,
> +		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> +	ASSERT_NE(MAP_FAILED, saved);
> +	ss.ss_sp = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE,
> +			MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> +	ASSERT_NE(MAP_FAILED, ss.ss_sp);
> +	/* populate it, so only the page the handler drops faults */
> +	memset(ss.ss_sp, 0, STACK_SIZE);
> +	reg.range.start = (unsigned long)ss.ss_sp;
> +	reg.range.len = STACK_SIZE;
> +	ASSERT_EQ(0, ioctl(fd, UFFDIO_REGISTER, &reg));
> +	ASSERT_EQ(0, pthread_create(&thread, NULL, serve, (void *)(long)fd));
> +	ASSERT_EQ(0, sigaction(SIGUSR1, &sa, NULL));
> +
> +	/* lower the frame until the FP image crosses a page at SPLIT */
> +	for (shift = 0; shift < PAGE && !placed; shift += 16) {
> +		register long a0 asm("a0") = pid;
> +		register long a1 asm("a1") = tid;
> +		register long a2 asm("a2") = SIGUSR1;
> +		register long a7 asm("a7") = __NR_tgkill;
> +
> +		ss.ss_size = STACK_SIZE - shift;
> +		ASSERT_EQ(0, sigaltstack(&ss, NULL));
> +		fcsr = 0x1f;
> +		asm volatile(".irp i, " F0_15 "\n"
> +			     "fld f\\i, \\i * 8(%[in])\n"
> +			     ".endr\n"
> +			     "csrw fcsr, %[fcsr]\n"
> +			     "ecall\n"
> +			     "csrr %[fcsr], fcsr\n"
> +			     ".irp i, " F0_15 "\n"
> +			     "fsd f\\i, \\i * 8(%[out])\n"
> +			     ".endr\n"
> +			     : "+r" (a0), [fcsr] "+r" (fcsr)
> +			     : "r" (a1), "r" (a2), "r" (a7),
> +			       [in] "r" (pattern), [out] "r" (out)
> +			     : "memory", "ft0", "ft1", "ft2", "ft3", "ft4", "ft5",
> +			       "ft6", "ft7", "fs0", "fs1", "fa0", "fa1", "fa2",
> +			       "fa3", "fa4", "fa5");
> +	}
> +	ASSERT_TRUE(placed);
> +
> +	for (i = 0; i < 16; i++) {
> +		EXPECT_EQ(pattern[i], out[i]) TH_LOG("f%d", i);
> +	}
> +	EXPECT_EQ(0x1fUL, fcsr);
> +}
> +
> +TEST_HARNESS_MAIN
> -- 
> 2.53.0
>