[v2] arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
Wilco Dijkstra
Wilco.Dijkstra@arm.com
Mon Jun 15 12:52:34 GMT 2026
Hi Adhemerval,
> _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
> argument registers (r0-r3) across the inner call to _dl_fixup /
> _dl_profile_fixup. Two related ABI requirements demand more:
>
> * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
> function being resolved. Recent GCC emits VFP instructions inside
> the fixup routines, clobbering them, so the resolved function sees
> corrupted arguments (BZ 34144).
>
> * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
> reachable through the dynamic linker) must only corrupt integer
> core registers. IFUNC resolvers, audit modules, and interposed
> malloc invoked during symbol resolution may also use VFP, even on
> softfp ABI builds (BZ 15792).
>
> Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
> when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
> call. Whether VFP is usable is a property of the hardware, not of
> the ABI glibc was built with, so the decision is gated on AT_HWCAP at
> runtime in both hardfp and softfp builds; hardfp builds will always
> find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
> correctly skip the save.
>
> For _dl_runtime_profile the save area is slipped in just before the
> bl to _dl_profile_fixup; the outgoing framesizep argument is
> recomputed to account for the extra frame, and both the fast path
> (no audit framesize) and the slow path (audit wraps with
> pltenter/pltexit) traverse the restore before splitting.
LGTM.
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
Cheers,
Wilco
More information about the Libc-alpha
mailing list