[PATCH v2] arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)

[Aurelien Jarno]

Hi Adhemerval,

On 2026-05-13 08:32, Adhemerval Zanella wrote:
> _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
> argument registers (r0-r3) across the inner call to _dl_fixup /
> _dl_profile_fixup.  Two related ABI requirements demand more:
> 
>   * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
>     function being resolved.  Recent GCC emits VFP instructions inside
>     the fixup routines, clobbering them, so the resolved function sees
>     corrupted arguments (BZ 34144).
> 
>   * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
>     reachable through the dynamic linker) must only corrupt integer
>     core registers.  IFUNC resolvers, audit modules, and interposed
>     malloc invoked during symbol resolution may also use VFP, even on
>     softfp ABI builds (BZ 15792).
> 
> Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
> when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
> call.  Whether VFP is usable is a property of the hardware, not of
> the ABI glibc was built with, so the decision is gated on AT_HWCAP at
> runtime in both hardfp and softfp builds; hardfp builds will always
> find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
> correctly skip the save.
> 
> For _dl_runtime_profile the save area is slipped in just before the
> bl to _dl_profile_fixup; the outgoing framesizep argument is
> recomputed to account for the extra frame, and both the fast path
> (no audit framesize) and the slow path (audit wraps with
> pltenter/pltexit) traverse the restore before splitting.
> 
> Checked on arm-linux-gnueabihf.
> --
> Changes from v1:
> * The VFP save/restore should be done wrt kernel and hardware support,
>   instead of the ABI.

Sorry about heading you in the wrong direction in my review of v1.

> ---
>  sysdeps/arm/Makefile               |  19 +++++
>  sysdeps/arm/dl-trampoline.S        | 110 +++++++++++++++++++++++++++--
>  sysdeps/arm/tst-bz34144-audit.c    |  32 +++++++++
>  sysdeps/arm/tst-bz34144-auditmod.c |  50 +++++++++++++
>  sysdeps/arm/tst-bz34144-mod.c      |  28 ++++++++
>  sysdeps/arm/tst-bz34144.c          |  32 +++++++++
>  6 files changed, 266 insertions(+), 5 deletions(-)
>  create mode 100644 sysdeps/arm/tst-bz34144-audit.c
>  create mode 100644 sysdeps/arm/tst-bz34144-auditmod.c
>  create mode 100644 sysdeps/arm/tst-bz34144-mod.c
>  create mode 100644 sysdeps/arm/tst-bz34144.c

I have tested this on both arm-linux-gnueabi and arm-linux-gnueabihf. I 
haven't seen any testsuite regression. I confirm it fixes the regression 
on arm-linux-gnueabihf.

Tested-by: Aurelien Jarno <aurelien@aurel32.net>

Thanks
Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                     http://aurel32.net