Comment 3 for bug 1729850

On the broken build, the first thing to notice is that when entering sha256_block_data_order, we are running in Thumb mode, as bit 5 of the status register is set:

(gdb) info registers
r0 0x4b7558 4945240
r1 0x4b7580 4945280
r2 0x1 1
r3 0x0 0
r4 0x4b7558 4945240
r5 0xfffef44c 4294898764
r6 0x0 0
r7 0x4b7580 4945280
r8 0x3 3
r9 0xfffef44c 4294898764
r10 0x0 0
r11 0x0 0
r12 0x0 0
sp 0xfffef3b8 0xfffef3b8
lr 0x414387 4277127
pc 0x4160c0 0x4160c0 <sha256_block_data_order>
cpsr 0x40080030 1074266160

The good build was not running in Thumb mode. sha256-armv4.S enables Thumb instructions if __thumb2__ is defined by the compiler, see:

.text
#if __ARM_ARCH__<7
.code 32
#else
.syntax unified
# ifdef __thumb2__
.thumb
# else
.code 32
# endif
#endif

Sure enough, there's a difference between the 2 tested gcc builds.

Bad build:
$ gcc -dM -E - < /dev/null | grep __thumb2__
#define __thumb2__ 1
$

Good build:
$ gcc -dM -E - < /dev/null | grep __thumb2__
$

Looking in the changelog for gcc-7, I see the following comment for 7.2.0-2:
  * Restore configuring with --with-mode=thumb on armhf. Closes: #873584.