[Bug dynamic-link/15792] [arm] ARM dynamic linker should save/restore coprocessor registers

https://sourceware.org/bugzilla/show_bug.cgi?id=15792

--- Comment #3 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.43/master branch has been updated by Aurelien Jarno
<[email protected]>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a6fa9a95949e3a24c09590a61e96f500e9c75c43

commit a6fa9a95949e3a24c09590a61e96f500e9c75c43
Author: Adhemerval Zanella <[email protected]>
Date:   Wed May 13 08:32:24 2026 -0300

    arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)

    _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
    argument registers (r0-r3) across the inner call to _dl_fixup /
    _dl_profile_fixup.  Two related ABI requirements demand more:

      * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
        function being resolved.  Recent GCC emits VFP instructions inside
        the fixup routines, clobbering them, so the resolved function sees
        corrupted arguments (BZ 34144).

      * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
        reachable through the dynamic linker) must only corrupt integer
        core registers.  IFUNC resolvers, audit modules, and interposed
        malloc invoked during symbol resolution may also use VFP, even on
        softfp ABI builds (BZ 15792).

    Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
    when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
    call.  Whether VFP is usable is a property of the hardware, not of
    the ABI glibc was built with, so the decision is gated on AT_HWCAP at
    runtime in both hardfp and softfp builds; hardfp builds will always
    find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
    correctly skip the save.

    For _dl_runtime_profile the save area is slipped in just before the
    bl to _dl_profile_fixup; the outgoing framesizep argument is
    recomputed to account for the extra frame, and both the fast path
    (no audit framesize) and the slow path (audit wraps with
    pltenter/pltexit) traverse the restore before splitting.

    Checked on arm-linux-gnueabihf.

    Tested-by: Aurelien Jarno <[email protected]>
    Reviewed-by: Wilco Dijkstra  <[email protected]>
    (cherry picked from commit 1111fbdd3e7ebed402800bc23e67055eaae0d972)

-- 
You are receiving this mail because:
You are on the CC list for the bug.