Bug 2263739 - glibc: -mtls-dialect=gnu2 TLS descriptor resolvers not ABI compliant
Summary: glibc: -mtls-dialect=gnu2 TLS descriptor resolvers not ABI compliant
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: glibc
Version: rawhide
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Carlos O'Donell
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2263180
TreeView+ depends on / blocked
 
Reported: 2024-02-11 14:14 UTC by Florian Weimer
Modified: 2024-04-05 14:03 UTC (History)
23 users (show)

Fixed In Version: glibc-2.39.9000-5.fc41 glibc-2.39-7.fc40
Clone Of:
Environment:
Last Closed: 2024-04-05 14:03:44 UTC
Type: ---
Embargoed:
fweimer: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
GNU Compiler Collection 113874 0 P3 RESOLVED GNU2 TLS descriptor calls do not follow psABI on x86_64-linux-gnu 2024-03-01 14:45:58 UTC
Red Hat Issue Tracker FC-1113 0 None None None 2024-02-11 14:25:59 UTC
Sourceware 31372 0 P2 NEW _dl_tlsdesc_dynamic doesn't preserve all caller-saved registers 2024-03-01 14:46:04 UTC

Description Florian Weimer 2024-02-11 14:14:28 UTC
GCC assumes that the call to the descriptor function does not clobber vector registers.

I think this means we can't enable -mtls-dialect=gnu2 for Fedora 40.

Reproducible: Always

Comment 1 Florian Weimer 2024-02-12 14:45:00 UTC
Upstream consensus appears to be that this is a glibc bug.

Comment 2 Carlos O'Donell 2024-03-01 14:48:16 UTC
Upstream glibc bug is not marked done, but upstream has made forward progress.

commit 0aac205a814a8511e98d02b91a8dc908f1c53cde
Author: H.J. Lu <hjl.tools>
Date:   Mon Feb 26 06:37:03 2024 -0800

    x86: Update _dl_tlsdesc_dynamic to preserve caller-saved registers
    
    Compiler generates the following instruction sequence for GNU2 dynamic
    TLS access:
    
            leaq    tls_var@TLSDESC(%rip), %rax
            call    *tls_var@TLSCALL(%rax)
    
    or
    
            leal    tls_var@TLSDESC(%ebx), %eax
            call    *tls_var@TLSCALL(%eax)
    
    CALL instruction is transparent to compiler which assumes all registers,
    except for EFLAGS and RAX/EAX, are unchanged after CALL.  When
    _dl_tlsdesc_dynamic is called, it calls __tls_get_addr on the slow
    path.  __tls_get_addr is a normal function which doesn't preserve any
    caller-saved registers.  _dl_tlsdesc_dynamic saved and restored integer
    caller-saved registers, but didn't preserve any other caller-saved
    registers.  Add _dl_tlsdesc_dynamic IFUNC functions for FNSAVE, FXSAVE,
    XSAVE and XSAVEC to save and restore all caller-saved registers.  This
    fixes BZ #31372.
    
    Add GLRO(dl_x86_64_runtime_resolve) with GLRO(dl_x86_tlsdesc_dynamic)
    to optimize elf_machine_runtime_setup.
    Reviewed-by: Noah Goldstein <goldstein.w.n>

commit 9b7091415af47082664717210ac49d51551456ab
Author: H.J. Lu <hjl.tools>
Date:   Wed Feb 28 12:08:03 2024 -0800

    x86-64: Update _dl_tlsdesc_dynamic to preserve AMX registers
    
    _dl_tlsdesc_dynamic should also preserve AMX registers which are
    caller-saved.  Add X86_XSTATE_TILECFG_ID and X86_XSTATE_TILEDATA_ID
    to x86-64 TLSDESC_CALL_STATE_SAVE_MASK.  Compute the AMX state size
    and save it in xsave_state_full_size which is only used by
    _dl_tlsdesc_dynamic_xsave and _dl_tlsdesc_dynamic_xsavec.  This fixes
    the AMX part of BZ #31372.  Tested on AMX processor.
    
    AMX test is enabled only for compilers with the fix for
    
    https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114098
    
    GCC 14 and GCC 11/12/13 branches have the bug fix.
    Reviewed-by: Sunil K Pandey <skpgkp2>

Comment 3 Florian Weimer 2024-03-22 13:09:19 UTC
Additional fixes:

commit fd7ee2e6c5eb49e4a630a9978b4d668bff6354ee
Author: Andreas Schwab <schwab>
Date:   Tue Mar 19 13:49:50 2024 +0100

    Add tst-gnu2-tls2mod1 to test-internal-extras
    
    That allows sysdeps/x86_64/tst-gnu2-tls2mod1.S to use internal headers.
    
    Fixes: 717ebfa85c ("x86-64: Allocate state buffer space for RDI, RSI and RBX")

commit 717ebfa85c8240d32d0d19d86a484c31c55c9617
Author: H.J. Lu <hjl.tools>
Date:   Mon Mar 18 06:40:16 2024 -0700

    x86-64: Allocate state buffer space for RDI, RSI and RBX
    
    _dl_tlsdesc_dynamic preserves RDI, RSI and RBX before realigning stack.
    After realigning stack, it saves RCX, RDX, R8, R9, R10 and R11.  Define
    TLSDESC_CALL_REGISTER_SAVE_AREA to allocate space for RDI, RSI and RBX
    to avoid clobbering saved RDI, RSI and RBX values on stack by xsave to
    STATE_SAVE_OFFSET(%rsp).
    
       +==================+<- stack frame start aligned at 8 or 16 bytes
       |                  |<- RDI saved in the red zone
       |                  |<- RSI saved in the red zone
       |                  |<- RBX saved in the red zone
       |                  |<- paddings for stack realignment of 64 bytes
       |------------------|<- xsave buffer end aligned at 64 bytes
       |                  |<-
       |                  |<-
       |                  |<-
       |------------------|<- xsave buffer start at STATE_SAVE_OFFSET(%rsp)
       |                  |<- 8-byte padding for 64-byte alignment
       |                  |<- 8-byte padding for 64-byte alignment
       |                  |<- R11
       |                  |<- R10
       |                  |<- R9
       |                  |<- R8
       |                  |<- RDX
       |                  |<- RCX
       +==================+<- RSP aligned at 64 bytes
    
    Define TLSDESC_CALL_REGISTER_SAVE_AREA, the total register save area size
    for all integer registers by adding 24 to STATE_SAVE_OFFSET since RDI, RSI
    and RBX are saved onto stack without adjusting stack pointer first, using
    the red-zone.  This fixes BZ #31501.
    Reviewed-by: Sunil K Pandey <skpgkp2>

Comment 4 Arjun Shankar 2024-04-05 14:03:44 UTC
This is fixed in Fedora 40 via the bodhi update: https://bodhi.fedoraproject.org/updates/FEDORA-2024-eafbf519ec


Note You need to log in before you can comment on or make changes to this bug.