I tracked this down to the code in linux-user/syscall.c. The mmap code seems broken, it assumes arg1 is a pointer to an array where the real arguments are. Given arg1 = 0 the memory access check fails. The code I'm working on will happily take mmap2 instead so I have a workaround. Does someone have an opinion on the state of the mmap code? Kai On Wed, Jun 17, 2009 at 8:54 PM, Kai Backman wrote: > I'm running qemu-arm and see the following output from mmap with 'strace > qemu-arm -strace' (for both host and traget strace output): > mmap(NULL, 32800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > 0x2ad329b46000 > 4023 mmap(0,131072,7,34,-1,0) = 0xfffffff2 > > When my program later tries to read memory at 0xfffffffe it fails with a > SIGSEGV: > Program received signal SIGSEGV, Segmentation fault. > 1: x/i $pc 0xce30: ldr r1, [r5] > (gdb) i r > r5 0xfffffffe -2 > > Why does qemu-arm return such high addresses on a 32 bit platform and why > is the memory inaccessible? If this doesn't seem like an obvious bug in my > code, where in the qemu code should I start looking for how mmap works? > > Kai > > -- > Kai Backman, Software Engineer, kaib@google.com > -- Kai Backman, Software Engineer, kaib@google.com