gdb/1900: arm-elf sim segfaults on "load" under host x86_64

[jjhellst at gmail dot com]

>Number:         1900
>Category:       gdb
>Synopsis:       arm-elf sim segfaults on "load" under host x86_64
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 23 19:38:00 UTC 2005
>Closed-Date:
>Last-Modified:
>Originator:     jjhellst@gmail.com
>Release:        GNU gdb 6.3
>Organization:
>Environment:
Host:
Linux xyyz.foo.bar 2.6.10-1.770_FC3 #1 Thu Feb 24 18:09:38 EST 2005 x86_64 x86_64 x86_64 GNU/Linux

GCC:
Reading specs from /opt/gcc/arm-elf/lib/gcc/arm-elf/3.4.3/specs
Configured with: ../gcc-3.4.3/configure --prefix=/opt/gcc/arm-elf --target=arm-elf --disable-shared --enable-interwork --enable-multilib --with-headers=../newlib-1.13.0/newlib/libc/include --with-newlib --enable-languages=c,c++
Thread model: single
gcc version 3.4.3

GDB:
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-elf". (also tried default host which is x86_64)

Binutils (as):
[janne@buildotron gdb-6.3]$ /opt/gcc/arm-elf/bin/arm-elf-as -v
GNU assembler version 2.15 (arm-elf) using BFD version 2.15
>Description:
Hi,

I get a segfault when I try to load an ARM ELF executable into GDB ARM simulator.  This happens with two different executables (i.e., all I've tried have this problem).

IIRC the same configuration (same GCC, same GDB, same newlib) worked on another computer, with the difference that the host was x86 32-bit.  I tried to configure arm-elf-gdb to use 32-bit instructions, but apparently I failed since it still appears to be using 64-bit mode.

I can send you the executable as well.  It's 200KB so I'm not sure if you want me to add it as an attachment here.  Please ask if you need it.

Here is what happens when I debug arm-elf-gdb with GDB:

GNU gdb Red Hat Linux (6.1post-1.20040607.43rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...Using host libthread_db library "/lib64/tls/libthread_db.so.1".

(gdb) r
Starting program: /opt/gcc/arm-elf/bin/arm-elf-gdb
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-elf".
(gdb) file hglTest
Reading symbols from /home/build/p4/libs/libhg/test/build-arm-elf/hglTest...done.
(gdb) target sim
Connected to the simulator.
(gdb) load
Loading section .init, size 0x1c vma 0x8000
Loading section .text, size 0xb9a0 vma 0x801c

Program received signal SIGSEGV, Segmentation fault.
0x0000003d3c968a62 in free () from /lib64/tls/libc.so.6
(gdb) bt
#0  0x0000003d3c968a62 in free () from /lib64/tls/libc.so.6
#1  0x00000000005133c5 in sim_load_file (sd=0x1, myname=0x807e90 "gdbsim", callback=0x780500, prog=0x807ed0 "/home/build/p4/libs/libhg/test/build-arm-elf/hglTest",
    prog_bfd=0x0, verbose_p=1, lma_p=0, do_write=0x5125f0 <sim_write>) at ../../../gdb-6.3/sim/arm/../common/sim-load.c:149
#2  0x0000000000513051 in sim_load (sd=0x800000, prog=0x1 <Address 0x1 out of bounds>, abfd=0x0, from_tty=0) at ../../../gdb-6.3/sim/arm/wrapper.c:886
#3  0x000000000042fc72 in gdbsim_load (prog=0x807ed0 "/home/build/p4/libs/libhg/test/build-arm-elf/hglTest", fromtty=1) at ../../gdb-6.3/gdb/remote-sim.c:409
#4  0x000000000047393f in load_command (arg=0x800000 "", from_tty=1) at ../../gdb-6.3/gdb/symfile.c:1355
#5  0x000000000040e8bd in execute_command (p=0x7a4004 "", from_tty=1) at ../../gdb-6.3/gdb/top.c:733
#6  0x000000000048c316 in command_handler (command=0x7a4000 "load") at ../../gdb-6.3/gdb/event-top.c:500
#7  0x000000000048c8a0 in command_line_handler (rl=0x7bada0 "à­{") at ../../gdb-6.3/gdb/event-top.c:799
#8  0x0000000000583801 in rl_callback_read_char () at ../../gdb-6.3/readline/callback.c:123
#9  0x000000000048bc39 in rl_callback_read_char_wrapper (client_data=0x800000) at ../../gdb-6.3/gdb/event-top.c:166
#10 0x000000000048ac4d in process_event () at ../../gdb-6.3/gdb/event-loop.c:334
#11 0x000000000048b778 in gdb_do_one_event (data=0x800000) at ../../gdb-6.3/gdb/event-loop.c:371
#12 0x000000000040e3ce in catcher (func=0x40e4e0 <do_catch_errors>, func_uiout=0x7f5ac0, func_args=0x7fbffff290, func_val=0x7fbffff288, func_caught=0x7fbffff28c,
    errstring=0x10011 <Address 0x10011 out of bounds>, gdberrmsg=0x0, mask=6) at ../../gdb-6.3/gdb/top.c:431
#13 0x000000000040e530 in catch_errors (func=0x800000, func_args=0x1, errstring=0x0, mask=0) at ../../gdb-6.3/gdb/top.c:536
#14 0x000000000043f566 in tui_command_loop (data=0x800000) at ../../gdb-6.3/gdb/tui/tui-interp.c:150
#15 0x0000000000405359 in captured_command_loop (data=0x800000) at ../../gdb-6.3/gdb/main.c:91
#16 0x000000000040e3ce in catcher (func=0x40e4e0 <do_catch_errors>, func_uiout=0x7f5ac0, func_args=0x7fbffff440, func_val=0x7fbffff438, func_caught=0x7fbffff43c,
    errstring=0x10011 <Address 0x10011 out of bounds>, gdberrmsg=0x0, mask=6) at ../../gdb-6.3/gdb/top.c:431
#17 0x000000000040e530 in catch_errors (func=0x800000, func_args=0x1, errstring=0x0, mask=0) at ../../gdb-6.3/gdb/top.c:536
#18 0x0000000000405a06 in captured_main (data=0x7fbffff590) at ../../gdb-6.3/gdb/main.c:801
#19 0x000000000040e3ce in catcher (func=0x40e4e0 <do_catch_errors>, func_uiout=0x764420, func_args=0x7fbffff7c0, func_val=0x7fbffff7b8, func_caught=0x7fbffff7bc,
    errstring=0x10011 <Address 0x10011 out of bounds>, gdberrmsg=0x0, mask=6) at ../../gdb-6.3/gdb/top.c:431
#20 0x000000000040e530 in catch_errors (func=0x800000, func_args=0x1, errstring=0x0, mask=0) at ../../gdb-6.3/gdb/top.c:536
#21 0x0000000000406134 in gdb_main (args=0x800000) at ../../gdb-6.3/gdb/main.c:810
#22 0x0000000000405347 in main (argc=8007680, argv=0x1) at ../../gdb-6.3/gdb/gdb.c:35
(gdb)

Depending on what I do, I can crash it elsewhere as well.  Here is an example (it still appears to be heap related):

(gdb) target sim
Connected to the simulator.
(gdb) r
Starting program: /home/build/p4/libs/hg/hgFloatSmokeTest/build-arm-elf/hgfloat_smoketest
warning: No program loaded.

Program received signal SIGSEGV, Segmentation fault.
GetWord (state=0x2a97b3a010, address=229432, check=0) at ../../../gdb-6.3/sim/arm/armvirt.c:88
88      ../../../gdb-6.3/sim/arm/armvirt.c: No such file or directory.
        in ../../../gdb-6.3/sim/arm/armvirt.c
(gdb) bt
#0  GetWord (state=0x2a97b3a010, address=229432, check=0) at ../../../gdb-6.3/sim/arm/armvirt.c:88
#1  0x000000000052f12c in ARMul_Emulate32 (state=0x807ea0) at ../../../gdb-6.3/sim/arm/armemu.c:316
#2  0x000000000051b0f7 in ARMul_DoProg (state=0x807ea0) at ../../../gdb-6.3/sim/arm/arminit.c:237
#3  0x0000000000512742 in sim_resume (sd=0xe, step=0, siggnal=0) at ../../../gdb-6.3/sim/arm/wrapper.c:229
#4  0x0000000000430354 in gdbsim_wait (ptid={pid = -1, lwp = 0, tid = 0}, status=0x7fbfffed80) at ../../gdb-6.3/gdb/remote-sim.c:682
#5  0x00000000004827ca in wait_for_inferior () at ../../gdb-6.3/gdb/infrun.c:988
#6  0x0000000000482925 in proceed (addr=0, siggnal=TARGET_SIGNAL_DEFAULT, step=0) at ../../gdb-6.3/gdb/infrun.c:814
#7  0x000000000042fde0 in gdbsim_create_inferior (exec_file=0x81d420 "/home/build/p4/libs/hg/hgFloatSmokeTest/build-arm-elf/hgfloat_smoketest", args=0x8b5710 "",
    env=0x7cc680, from_tty=0) at ../../gdb-6.3/gdb/remote-sim.c:468
#8  0x000000000047c6af in run_command (args=0x0, from_tty=1) at ../../gdb-6.3/gdb/infcmd.c:481
#9  0x000000000040e8bd in execute_command (p=0x7a4001 "", from_tty=1) at ../../gdb-6.3/gdb/top.c:733
#10 0x000000000048c316 in command_handler (command=0x7a4000 "") at ../../gdb-6.3/gdb/event-top.c:500
#11 0x000000000048c8a0 in command_line_handler (rl=0x848ee0 " Ï\204") at ../../gdb-6.3/gdb/event-top.c:799
#12 0x0000000000583801 in rl_callback_read_char () at ../../gdb-6.3/readline/callback.c:123
#13 0x000000000048bc39 in rl_callback_read_char_wrapper (client_data=0xe) at ../../gdb-6.3/gdb/event-top.c:166
#14 0x000000000048ac4d in process_event () at ../../gdb-6.3/gdb/event-loop.c:334
#15 0x000000000048b778 in gdb_do_one_event (data=0xe) at ../../gdb-6.3/gdb/event-loop.c:371
#16 0x000000000040e3ce in catcher (func=0x40e4e0 <do_catch_errors>, func_uiout=0x7f5ad0, func_args=0x7fbffff280, func_val=0x7fbffff278, func_caught=0x7fbffff27c,
    errstring=0x4000000 <Address 0x4000000 out of bounds>, gdberrmsg=0x0, mask=6) at ../../gdb-6.3/gdb/top.c:431
#17 0x000000000040e530 in catch_errors (func=0xe, func_args=0x0, errstring=0x8dff90 "", mask=0) at ../../gdb-6.3/gdb/top.c:536
#18 0x000000000043f566 in tui_command_loop (data=0xe) at ../../gdb-6.3/gdb/tui/tui-interp.c:150
#19 0x0000000000405359 in captured_command_loop (data=0xe) at ../../gdb-6.3/gdb/main.c:91
#20 0x000000000040e3ce in catcher (func=0x40e4e0 <do_catch_errors>, func_uiout=0x7f5ad0, func_args=0x7fbffff430, func_val=0x7fbffff428, func_caught=0x7fbffff42c,
    errstring=0x4000000 <Address 0x4000000 out of bounds>, gdberrmsg=0x0, mask=6) at ../../gdb-6.3/gdb/top.c:431
#21 0x000000000040e530 in catch_errors (func=0xe, func_args=0x0, errstring=0x8dff90 "", mask=0) at ../../gdb-6.3/gdb/top.c:536
#22 0x0000000000405a06 in captured_main (data=0x7fbffff580) at ../../gdb-6.3/gdb/main.c:801
#23 0x000000000040e3ce in catcher (func=0x40e4e0 <do_catch_errors>, func_uiout=0x764420, func_args=0x7fbffff7b0, func_val=0x7fbffff7a8, func_caught=0x7fbffff7ac,
    errstring=0x4000000 <Address 0x4000000 out of bounds>, gdberrmsg=0x0, mask=6) at ../../gdb-6.3/gdb/top.c:431
#24 0x000000000040e530 in catch_errors (func=0xe, func_args=0x0, errstring=0x8dff90 "", mask=0) at ../../gdb-6.3/gdb/top.c:536
#25 0x0000000000406134 in gdb_main (args=0xe) at ../../gdb-6.3/gdb/main.c:810
#26 0x0000000000405347 in main (argc=3, argv=0x0) at ../../gdb-6.3/gdb/gdb.c:35

Hope this helps.

Best regards,
Janne Hellsten
>How-To-Repeat:
Compile an arm-elf binary with GCC 3.4.3 (other versions might work too), use x86_64 host to run the binary with simulator target (gdb compiled with target==arm-elf).
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: