[v2] arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)

Wilco Dijkstra Wilco.Dijkstra@arm.com
Mon Jun 15 12:52:34 GMT 2026


Hi Adhemerval,

> _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
> argument registers (r0-r3) across the inner call to _dl_fixup /
> _dl_profile_fixup.  Two related ABI requirements demand more:
>
>  * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
>    function being resolved.  Recent GCC emits VFP instructions inside
>    the fixup routines, clobbering them, so the resolved function sees
>    corrupted arguments (BZ 34144).
>
>  * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
>    reachable through the dynamic linker) must only corrupt integer
>    core registers.  IFUNC resolvers, audit modules, and interposed
>    malloc invoked during symbol resolution may also use VFP, even on
>    softfp ABI builds (BZ 15792).
>
> Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
> when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
> call.  Whether VFP is usable is a property of the hardware, not of
> the ABI glibc was built with, so the decision is gated on AT_HWCAP at
> runtime in both hardfp and softfp builds; hardfp builds will always
> find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
> correctly skip the save.
>
> For _dl_runtime_profile the save area is slipped in just before the
> bl to _dl_profile_fixup; the outgoing framesizep argument is
> recomputed to account for the extra frame, and both the fast path
> (no audit framesize) and the slow path (audit wraps with
> pltenter/pltexit) traverse the restore before splitting.

LGTM.

Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>

Cheers,
Wilco


More information about the Libc-alpha mailing list