Re: i386: Lazy binding trampoline and vector register usage

[Szabolcs Nagy <Szabolcs.Nagy@arm.com>]

On 18/12/2019 10:22, Florian Weimer wrote:
> We have this in sysdeps/i386/Makefile:
> 
> # Make sure no code in ld.so uses mm/xmm/ymm/zmm registers on i386 since
> # the first 3 mm/xmm/ymm/zmm registers are used to pass vector parameters
> # which must be preserved.
> # With SSE disabled, ensure -fpmath is not set to use sse either.
> rtld-CFLAGS += -mno-sse -mno-mmx -mfpmath=387
> ifeq ($(subdir),elf)
> CFLAGS-.os += $(if $(filter $(@F),$(patsubst %,%.os,$(all-rtld-routines))),\
> 		   $(rtld-CFLAGS))
> 
> tests-special += $(objpfx)tst-ld-sse-use.out
> $(objpfx)tst-ld-sse-use.out: ../sysdeps/i386/tst-ld-sse-use.sh $(objpfx)ld.so
> 	@echo "Checking ld.so for SSE register use.  This will take a few seconds..."
> 	$(BASH) $< $(objpfx) '$(NM)' '$(OBJDUMP)' '$(READELF)' > $@; \
> 	$(evaluate-test)
> else
> CFLAGS-.os += $(if $(filter rtld-%.os,$(@F)), $(rtld-CFLAGS))
> endif
> 
> The idea is that we do not need to save and restore vector registers in
> the trampoline (or align the stack) if we compile ld.so in such a way
> that only general registers are used.  But that does not actually work
> in all cases because lazy binding can call malloc, which lives in
> libc.so or might even be interposed, and is thus free to use vector
> registers.
> 
> What should we do about this?  Calling malloc from _dl_fixup is unsafe
> for other reasons because lazy binding can happen in signal handlers, so
> maybe this would be fixed if we switched to a non-interposable
> async-signal-safe allocator?

note that ifunc resolvers can also run during lazy binding
and those can execute arbitrary user code (even if the
allocator issue is fixed).