Due to GCC bug:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58066
__tls_get_addr may be called with 8-byte stack alignment. Although
this bug has been fixed in GCC 4.9.4, 5.3 and 6, we can't assume
that stack will be always aligned at 16 bytes. Since SSE optimized
memory/string functions with aligned SSE register load and store are
used in the dynamic linker, we must set DL_RUNTIME_UNALIGNED_VEC_SIZE
to 8 so that _dl_runtime_resolve_sse will align the stack before
calling _dl_fixup:
Dump of assembler code for function _dl_runtime_resolve_sse:
0x00007ffff7deea90 <+0>: push %rbx
0x00007ffff7deea91 <+1>: mov %rsp,%rbx
0x00007ffff7deea94 <+4>: and $0xfffffffffffffff0,%rsp
^^^^^^^^^^^ Align stack to 16 bytes
0x00007ffff7deea98 <+8>: sub $0x100,%rsp
0x00007ffff7deea9f <+15>: mov %rax,0xc0(%rsp)
0x00007ffff7deeaa7 <+23>: mov %rcx,0xc8(%rsp)
0x00007ffff7deeaaf <+31>: mov %rdx,0xd0(%rsp)
0x00007ffff7deeab7 <+39>: mov %rsi,0xd8(%rsp)
0x00007ffff7deeabf <+47>: mov %rdi,0xe0(%rsp)
0x00007ffff7deeac7 <+55>: mov %r8,0xe8(%rsp)
0x00007ffff7deeacf <+63>: mov %r9,0xf0(%rsp)
0x00007ffff7deead7 <+71>: movaps %xmm0,(%rsp)
0x00007ffff7deeadb <+75>: movaps %xmm1,0x10(%rsp)
0x00007ffff7deeae0 <+80>: movaps %xmm2,0x20(%rsp)
0x00007ffff7deeae5 <+85>: movaps %xmm3,0x30(%rsp)
0x00007ffff7deeaea <+90>: movaps %xmm4,0x40(%rsp)
0x00007ffff7deeaef <+95>: movaps %xmm5,0x50(%rsp)
0x00007ffff7deeaf4 <+100>: movaps %xmm6,0x60(%rsp)
0x00007ffff7deeaf9 <+105>: movaps %xmm7,0x70(%rsp)
[BZ #19679]
* sysdeps/x86_64/dl-trampoline.S (DL_RUNIME_UNALIGNED_VEC_SIZE):
Renamed to ...
(DL_RUNTIME_UNALIGNED_VEC_SIZE): This. Set to 8.
(DL_RUNIME_RESOLVE_REALIGN_STACK): Renamed to ...
(DL_RUNTIME_RESOLVE_REALIGN_STACK): This. Updated.
(DL_RUNIME_RESOLVE_REALIGN_STACK): Renamed to ...
(DL_RUNTIME_RESOLVE_REALIGN_STACK): This.
* sysdeps/x86_64/dl-trampoline.h
(DL_RUNIME_RESOLVE_REALIGN_STACK): Renamed to ...
(DL_RUNTIME_RESOLVE_REALIGN_STACK): This.
The following new 386 and X86_64 were added to binutils. They are
non-dynamic relocations, so don't need direct handling in glibc.
But other programs, like elfutils, use the glibc elf.h definitions
for the names and numbers when inspecting ET_REL files.
R_386_GOT32X was proposed in
https://groups.google.com/forum/#!topic/ia32-abi/GbJJskkid4I
X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX were proposed in
https://groups.google.com/forum/#!topic/x86-64-abi/n9AWHogmVY0
There also used to be R_X86_64_PC32_BND and R_X86_64_PLT32_BND
but those already got deprecated in
https://groups.google.com/d/msg/x86-64-abi/-hdQyMixt8Y/XFDOvioG85cJ
* elf/elf.h (R_386_GOT32X): New.
(R_386_NUM): Update.
(R_X86_64_GOTPCRELX: New.
(R_X86_64_REX_GOTPCRELX): New.
(R_X86_64_NUM): Update.
The vast majority of timeouts I've seen w/glibc tests are due to:
- slow system (e.g. <1 GHz cpu)
- loaded system (e.g. lots of parallelism)
Even then, I've seen timeouts on system I don't generally consider
slow, or even loaded, and considering TIMEOUT is set to <=10 in ~60
tests (and <=20 in ~75 tests), it seems I'm not alone. I've just
gotten in the habit of doing `export TIMEOUTFACTOR=10` on all my
setups.
In the edge case where there is a bug in the test and the timeout is
hit, I think we all agree that's either a problem with the test or a
real bug in the library somewhere. In either case, the incident rate
should be low, so catering to that seems like the wrong trade-off.
Other developers too usually set large timeout factors. Increase the
default to 20 seconds to match reality.
The ldbl-128ibm implementation of nextafterl / nexttowardl returns -0
in FE_DOWNWARD mode when taking the next value below the least
positive subnormal, when it should return +0. This patch fixes it to
check explicitly for this case.
Tested for powerpc.
[BZ #19678]
* sysdeps/ieee754/ldbl-128ibm/s_nextafterl.c (__nextafterl):
Ensure +0.0 is returned when taking the next value below the least
positive value.
The ldbl-128ibm implementation of powl has some problems in the case
of overflow or underflow, which are mainly visible in non-default
rounding modes.
* When overflow or underflow is detected early, the correct sign of an
overflowing or underflowing result is not allowed for. This is
mostly hidden in the default rounding mode by the errno-setting
wrappers recomputing the result (except in non-default
error-handling modes such as -lieee), but visible in other rounding
modes where a result that is not zero or infinity causes the
wrappers not to do the recomputation.
* The final scaling is done before the sign is incorporated in the
result, but should be done afterwards for correct overflowing and
underflowing results in directed rounding modes.
This patch fixes those problems. Tested for powerpc.
[BZ #19674]
* sysdeps/ieee754/ldbl-128ibm/e_powl.c (__ieee754_powl): Include
sign in overflowing and underflowing results when overflow or
underflow is detected early. Include sign in result before rather
than after scaling.
The ldbl-128ibm implementations of remainderl and remquol have logic
resulting in incorrect tests for equality of the absolute values of
the arguments. Equality is tested based on the integer
representations of the high and low parts, with the sign bit masked
off the high part - but when this changes the sign of the high part,
the sign of the low part needs to be changed as well, and failure to
do this means arguments are wrongly treated as equal when they are
not.
This patch fixes the logic to adjust signs of low parts as needed.
Tested for powerpc.
[BZ #19603]
* sysdeps/ieee754/ldbl-128ibm/e_remainderl.c
(__ieee754_remainderl): Adjust sign of integer version of low part
when taking absolute value of high part.
* sysdeps/ieee754/ldbl-128ibm/s_remquol.c (__remquol): Likewise.
* math/libm-test.inc (remainder_test_data): Add another test.
(remquo_test_data): Likewise.
The ldbl-128ibm implementation of fmodl has logic to detect when the
first argument has absolute value less than or equal to the second.
This logic is only correct for nonzero low parts; if the high parts
are equal and the low parts are zero, then the signs of the low parts
(which have no semantic effect on the value of the long double number)
can result in equal values being wrongly treated as unequal, and an
incorrect result being returned from fmodl. This patch fixes this by
checking for the case of zero low parts.
Although this does show up in tests from libm-test.inc (both tests of
fmodl, and, indirectly, of remainderl / dreml), the dependence on
non-semantic zero low parts means that test shouldn't be expected to
reproduce it reliably; thus, this patch adds a standalone test that
sets up affected values using unions.
Tested for powerpc.
[BZ #19602]
* sysdeps/ieee754/ldbl-128ibm/e_fmodl.c (__ieee754_fmodl): Handle
equal high parts and both low parts zero specially.
* sysdeps/ieee754/ldbl-128ibm/test-fmodl-ldbl-128ibm.c: New test.
* sysdeps/ieee754/ldbl-128ibm/Makefile [$(subdir) = math] (tests):
Add test-fmodl-ldbl-128ibm.
The ldbl-128ibm implementation of fmodl has completely bogus logic for
subnormal results (in this context, that means results for which the
result is in the subnormal range for double, not results with absolute
value below LDBL_MIN), based on code used for ldbl-128 that is correct
in that case but incorrect in the ldbl-128ibm use. This patch fixes
it to convert the mantissa into the correct form expected by
ldbl_insert_mantissa, removing the other cases of the code that were
incorrect and in one case unreachable for ldbl-128ibm. A correct
exponent value is then passed to ldbl_insert_mantissa to reflect the
shifted result.
Tested for powerpc.
[BZ #19595]
* sysdeps/ieee754/ldbl-128ibm/e_fmodl.c (__ieee754_fmodl): Use
common logic for all cases of shifting subnormal results. Do not
insert sign bit in shifted mantissa. Always pass -1023 as biased
exponent to ldbl_insert_mantissa in subnormal case.
The ldbl-128ibm implementation of roundl is only correct in
round-to-nearest mode (in other modes, there are incorrect results and
overflow exceptions in some cases). This patch reimplements it along
the lines used for floorl, ceill and truncl, using __round on the high
part, and on the low part if the high part is an integer, and then
adjusting in the cases where this is incorrect.
Tested for powerpc.
[BZ #19594]
* sysdeps/ieee754/ldbl-128ibm/s_roundl.c (__roundl): Use __round
on high and low parts then adjust result and use
ldbl_canonicalize_int if needed.
The ldbl-128ibm implementation of truncl is only correct in
round-to-nearest mode (in other modes, there are incorrect results and
overflow exceptions in some cases). It is also unnecessarily
complicated, rounding both high and low parts to the nearest integer
and then adjusting for the semantics of trunc, when it seems more
natural to take the truncation of the high part (__trunc optimized
inline versions can be used), and the floor or ceiling of the low part
(depending on the sign of the high part) if the high part is an
integer, as was done for floorl and ceill. This patch makes it use
that simpler approach.
Tested for powerpc.
[BZ #19593]
* sysdeps/ieee754/ldbl-128ibm/s_truncl.c (__truncl): Use __trunc
on high part and __floor or __ceil on low part then use
ldbl_canonicalize_int if needed.
The ldbl-128ibm implementation of ceill is only correct in
round-to-nearest mode (in other modes, there are incorrect results and
overflow exceptions in some cases). It is also unnecessarily
complicated, rounding both high and low parts to the nearest integer
and then adjusting for the semantics of ceil, when it seems more
natural to take the ceiling of the high part (__ceil optimized inline
versions can be used), and that of the low part if the high part is an
integer, as was done for floorl. This patch makes it use that simpler
approach.
Tested for powerpc.
[BZ #19592]
* sysdeps/ieee754/ldbl-128ibm/s_ceill.c (__ceill): Use __ceil on
high and low parts then use ldbl_canonicalize_int if needed.
The ldbl-128ibm implementation of floorl is only correct in
round-to-nearest mode (in other modes, there are incorrect results and
overflow exceptions in some cases going beyond the incorrect signs of
zero results noted in bug 17899). It is also unnecessarily
complicated, rounding both high and low parts to the nearest integer
and then adjusting for the semantics of floor, when it seems more
natural to take the floor of the high part (__floor optimized inline
versions can be used), and that of the low part if the high part is an
integer. This patch makes it use that simpler approach, with a
canonicalization that works in all rounding modes (given that the only
way the result can be noncanonical is if taking the floor of a
negative noninteger low part increased its exponent).
Tested for powerpc, where over a thousand failures are removed from
test-ldouble.out (floorl problems affect many powl tests).
[BZ #17899]
* sysdeps/ieee754/ldbl-128ibm/math_ldbl.h (ldbl_canonicalize_int):
New function.
* sysdeps/ieee754/ldbl-128ibm/s_floorl.c (__floorl): Use __floor
on high and low parts then use ldbl_canonicalize_int if needed.
As discussed in
https://sourceware.org/ml/libc-alpha/2015-10/msg00403.html
the setting of _STRING_ARCH_unaligned currently controls the external
GLIBC ABI as well as selecting the use of unaligned accesses withing
GLIBC.
Since _STRING_ARCH_unaligned was recently changed for AArch64, this
would potentially break the ABI in GLIBC 2.23, so split the uses and add
_STRING_INLINE_unaligned to select the string ABI. This setting must be
fixed for each target, while _STRING_ARCH_unaligned may be changed from
release to release. _STRING_ARCH_unaligned is used unconditionally in
glibc. But <bits/string.h>, which defines _STRING_ARCH_unaligned, isn't
included with -Os. Since _STRING_ARCH_unaligned is internal to glibc and
may change between glibc releases, it should be made private to glibc.
_STRING_ARCH_unaligned should defined in the new string_private.h heade
file which is included unconditionally from internal <string.h> for glibc
build.
[BZ #19462]
* bits/string.h (_STRING_ARCH_unaligned): Renamed to ...
(_STRING_INLINE_unaligned): This.
* include/string.h: Include <string_private.h>.
* string/bits/string2.h: Replace _STRING_ARCH_unaligned with
_STRING_INLINE_unaligned.
* sysdeps/aarch64/bits/string.h (_STRING_ARCH_unaligned): Removed.
(_STRING_INLINE_unaligned): New.
* sysdeps/aarch64/string_private.h: New file.
* sysdeps/generic/string_private.h: Likewise.
* sysdeps/m68k/m680x0/m68020/string_private.h: Likewise.
* sysdeps/s390/string_private.h: Likewise.
* sysdeps/x86/string_private.h: Likewise.
* sysdeps/m68k/m680x0/m68020/bits/string.h
(_STRING_ARCH_unaligned): Renamed to ...
(_STRING_INLINE_unaligned): This.
* sysdeps/s390/bits/string.h (_STRING_ARCH_unaligned): Renamed
to ...
(_STRING_INLINE_unaligned): This.
* sysdeps/sparc/bits/string.h (_STRING_ARCH_unaligned): Renamed
to ...
(_STRING_INLINE_unaligned): This.
* sysdeps/x86/bits/string.h (_STRING_ARCH_unaligned): Renamed
to ...
(_STRING_INLINE_unaligned): This.
Since libmvec_nonshared.a may be linked into shared objects, ALIAS_IMPL
should use PIC relocation.
[BZ #19590]
* sysdeps/x86_64/fpu/svml_finite_alias.S (ALIAS_IMPL): Use PIC
relocation.
* A stack-based buffer overflow was found in libresolv when invoked from
libnss_dns, allowing specially crafted DNS responses to seize control
of execution flow in the DNS client. The buffer overflow occurs in
the functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family. The use of AF_UNSPEC triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of the
buffers used for those queries could result in the response of a query
writing beyond the alloca allocated buffer created by
_nss_dns_gethostbyname4_r. Buffer management is simplified to remove
the overflow. Thanks to the Google Security Team and Red Hat for
reporting the security impact of this issue, and Robert Holiday of
Ciena for reporting the related bug 18665. (CVE-2015-7547)
See also:
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.htmlhttps://sourceware.org/ml/libc-alpha/2016-02/msg00418.html
In ICO C++11 mode ensure that isinff, isinfl, isnanf, and isnanl
are defined. These functions were accidentally removed from the
header as part of commit d9b965fa56,
but being GNU extensions, they should have been left in place.
The handling of negative offsets in MIPS mmap is inconsistent with
other architectures, as shown by failure of the test
posix/tst-mmap-offset for o32 and n32. The MIPS mmap syscall uses a
signed argument and does a signed arithmetic shift on it, whereas the
glibc semantics expected by that test are for the offset to be
considered as a large positive offset. This patch makes MIPS
consistent with other architectures as far as possible by using the
mmap2 syscall on o32 (#including the generic implementation), and
making mmap not an alias for mmap64 for n32, with a custom
implementation for n32 that zero-extends the offset argument to 64-bit
before calling the mmap syscall.
Tested for MIPS64 (o32, n32, n64).
[BZ #19550]
* sysdeps/unix/sysv/linux/mips/mips32/mmap.c: New file.
* sysdeps/unix/sysv/linux/mips/mips64/mmap64.c: Move to ....
* sysdeps/unix/sysv/linux/mips/mips64/n64/mmap64.c: ... here.
* sysdeps/unix/sysv/linux/mips/mips64/n32/mmap.c: New file.
* sysdeps/unix/sysv/linux/mips/mips64/n32/syscalls.list (mmap64):
New syscall entry.
* sysdeps/unix/sysv/linux/mips/mips64/n64/syscalls.list (mmap):
New syscall entry.
* sysdeps/unix/sysv/linux/mips/mips64/syscalls.list (mmap): Remove
syscall entry.
The following new 386 and X86_64 were added to binutils. They are
non-dynamic relocations, so don't need direct handling in glibc.
But other programs, like elfutils, use the glibc elf.h definitions
for the names and numbers when inspecting ET_REL files.
R_386_GOT32X was proposed in
https://groups.google.com/forum/#!topic/ia32-abi/GbJJskkid4I
X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX were proposed in
https://groups.google.com/forum/#!topic/x86-64-abi/n9AWHogmVY0
There also used to be R_X86_64_PC32_BND and R_X86_64_PLT32_BND
but those already got deprecated in
https://groups.google.com/d/msg/x86-64-abi/-hdQyMixt8Y/XFDOvioG85cJ
* elf/elf.h (R_386_GOT32X): New.
(R_386_NUM): Update.
(R_X86_64_GOTPCRELX: New.
(R_X86_64_REX_GOTPCRELX): New.
(R_X86_64_NUM): Update.
The MIPS memcpy optimizations at
<https://sourceware.org/ml/libc-alpha/2015-10/msg00597.html>
introduced a bug causing many string function tests to fail with
segfaults for n32 and n64:
FAIL: string/stratcliff
FAIL: string/test-bcopy
FAIL: string/test-memccpy
FAIL: string/test-memcmp
FAIL: string/test-memcpy
FAIL: string/test-memmove
FAIL: string/test-mempcpy
FAIL: string/test-stpncpy
FAIL: string/test-strncmp
FAIL: string/test-strncpy
(Some failures in other directories could also be caused by this bug.)
The problem is that after the check for whether a word of input is
left that can be copied as a word before moving to byte copies, a load
can occur in the branch delay slot, resulting in a segfault if we are
at the end of a page and the following page is unmapped. I don't see
how this would have passed the tests as reported in the original patch
posting (different kernel configurations affecting the code setting up
unmapped pages, maybe?), since the tests in question don't appear to
have changed recently.
This patch moves a later instruction into the delay slot, as suggested
at <https://sourceware.org/ml/libc-alpha/2016-01/msg00584.html>.
Tested for n32 and n64.
2016-01-28 Steve Ellcey <sellcey@imgtec.com>
Joseph Myers <joseph@codesourcery.com>
* sysdeps/mips/memcpy.S (MEMCPY_NAME) [USE_DOUBLE]: Avoid word
load in branch delay slot when less than a word of input left.
Error checking mutexes are not supposed to be subject to lock elision.
That would defeat the error checking nature of the mutex because lock
elision doesn't record ownership.
Building string/tst-endian.c with gcc 6 produces an build warning/error on s390 (big endian machine):
gcc tst-endian.c -c -std=gnu11 -fgnu89-inline -O2 or -O3 ...
tst-endian.c: In function ‘do_test’:
tst-endian.c:16:30: error: self-comparison always evaluates to false [-Werror=tautological-compare]
if (htobe16 (be16toh (i)) != i)
^~
...
See definitions of htobexx, bexxtoh in string/endian.h:
...
This patch silences these warnings with DIAG_* macros if build with gcc 6
and newer.
The same warnings occur on little endian machines with the
"htoleXX (leXXtoh (i)) != i" if-statements.
ChangeLog:
* string/tst-endian.c: Include <libc-internal.h>.
(do_test): Ignore tautological-compare warnings around
"htobeXX (beXXtoh (i)) != i" and
"htoleXX (leXXtoh (i)) != i" if-statements.
Florian Weimer
H.J. Lu
Mark Wielaard
Mike Frysinger
Carlos O'Donell
Adhemerval Zanella
Joseph Myers
Adhemerval Zanella
H.J. Lu
Andrew Senkevich
Szabolcs Nagy
Rajalakshmi Srinivasaraghavan
Steve Ellcey
Andreas Schwab
David S. Miller
Richard Henderson
Paul E. Murphy
Stefan Liebler