[PATCH v2] arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)

[Adhemerval Zanella Netto]

On 13/05/26 16:25, Aurelien Jarno wrote:
> Hi Adhemerval,
> 
> On 2026-05-13 08:32, Adhemerval Zanella wrote:
>> _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
>> argument registers (r0-r3) across the inner call to _dl_fixup /
>> _dl_profile_fixup.  Two related ABI requirements demand more:
>>
>>   * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
>>     function being resolved.  Recent GCC emits VFP instructions inside
>>     the fixup routines, clobbering them, so the resolved function sees
>>     corrupted arguments (BZ 34144).
>>
>>   * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
>>     reachable through the dynamic linker) must only corrupt integer
>>     core registers.  IFUNC resolvers, audit modules, and interposed
>>     malloc invoked during symbol resolution may also use VFP, even on
>>     softfp ABI builds (BZ 15792).
>>
>> Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
>> when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
>> call.  Whether VFP is usable is a property of the hardware, not of
>> the ABI glibc was built with, so the decision is gated on AT_HWCAP at
>> runtime in both hardfp and softfp builds; hardfp builds will always
>> find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
>> correctly skip the save.
>>
>> For _dl_runtime_profile the save area is slipped in just before the
>> bl to _dl_profile_fixup; the outgoing framesizep argument is
>> recomputed to account for the extra frame, and both the fast path
>> (no audit framesize) and the slow path (audit wraps with
>> pltenter/pltexit) traverse the restore before splitting.
>>
>> Checked on arm-linux-gnueabihf.
>> --
>> Changes from v1:
>> * The VFP save/restore should be done wrt kernel and hardware support,
>>   instead of the ABI.
> 
> Sorry about heading you in the wrong direction in my review of v1.

No worries, the ARM ABI permutation is not straightforward and there are
also the glibc implementation details (ifunc, audit, malloc interposition)
make it even more complex. 

> 
>> ---
>>  sysdeps/arm/Makefile               |  19 +++++
>>  sysdeps/arm/dl-trampoline.S        | 110 +++++++++++++++++++++++++++--
>>  sysdeps/arm/tst-bz34144-audit.c    |  32 +++++++++
>>  sysdeps/arm/tst-bz34144-auditmod.c |  50 +++++++++++++
>>  sysdeps/arm/tst-bz34144-mod.c      |  28 ++++++++
>>  sysdeps/arm/tst-bz34144.c          |  32 +++++++++
>>  6 files changed, 266 insertions(+), 5 deletions(-)
>>  create mode 100644 sysdeps/arm/tst-bz34144-audit.c
>>  create mode 100644 sysdeps/arm/tst-bz34144-auditmod.c
>>  create mode 100644 sysdeps/arm/tst-bz34144-mod.c
>>  create mode 100644 sysdeps/arm/tst-bz34144.c
> 
> I have tested this on both arm-linux-gnueabi and arm-linux-gnueabihf. I 
> haven't seen any testsuite regression. I confirm it fixes the regression 
> on arm-linux-gnueabihf.
> 
> Tested-by: Aurelien Jarno <aurelien@aurel32.net>

Thanks, I will wait Joseph take a look at this.