[v2] arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)

[Richard Earnshaw (foss)]

On 15/06/2026 13:52, Wilco Dijkstra wrote:
> Hi Adhemerval,
> 
>> _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
>> argument registers (r0-r3) across the inner call to _dl_fixup /
>> _dl_profile_fixup.  Two related ABI requirements demand more:
>>
>>  * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
>>    function being resolved.  Recent GCC emits VFP instructions inside
>>    the fixup routines, clobbering them, so the resolved function sees
>>    corrupted arguments (BZ 34144).
>>
>>  * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
>>    reachable through the dynamic linker) must only corrupt integer
>>    core registers.  IFUNC resolvers, audit modules, and interposed
>>    malloc invoked during symbol resolution may also use VFP, even on
>>    softfp ABI builds (BZ 15792).
>>
>> Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31

d8-d15 are callee saved, not call-clobbered.

R.

>> when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
>> call.  Whether VFP is usable is a property of the hardware, not of
>> the ABI glibc was built with, so the decision is gated on AT_HWCAP at
>> runtime in both hardfp and softfp builds; hardfp builds will always
>> find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
>> correctly skip the save.
>>
>> For _dl_runtime_profile the save area is slipped in just before the
>> bl to _dl_profile_fixup; the outgoing framesizep argument is
>> recomputed to account for the extra frame, and both the fast path
>> (no audit framesize) and the slow path (audit wraps with
>> pltenter/pltexit) traverse the restore before splitting.
> 
> LGTM.
> 
> Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>
> 
> Cheers,
> Wilco