R_ARM_REL32 processed incorrectly by ld

[Ben Harris]

  * The version of ld. ld announces it if you start it with the `--version'
    argument.

GNU ld 2.11.2, configured with --target=arm-unknown-elf.

  * Any patches you may have applied to the ld source, including any patches
    made to the BFD library.

None.

  * The type of machine you are using, and the operating system name and
    version number.

Power Macintosh 9600 running NetBSD/macppc 1.5.

  * What compiler (and its version) was used to compile ld---e.g. "gcc-2.7".

egcs-1.1.2, as shipped with NetBSD 1.5.

  * The command arguments you gave the linker to link your example and observe
    the bug.

bin/arm-unknown-elf-ld -o bug bug1.o bug2.o

  * A complete input file, or set of input files, that will reproduce the bug.

begin 664 bug1.o
M?T5,address@hidden
M`"@`"``%```````$`````"YS>6UT86(`+G-T<address@hidden<VAS=')T86(`+G1E
M>'0`+G)E;"YT97AT`"YD871A`"YB<W,`````````````````````````````
M````````````````````````````&P````$````&`````````#0````(````
M```````````!`````````"$````)address@hidden@``"`````8````!
address@hidden,`````````/`````````````````````$`
M````````,address@hidden
address@hidden
address@hidden&`````'````!0````0````0````"0````,`````
M`````````!0"```,```````````````!````````````````````````````
M```````````````````#``$``````````````````P`#````````````````
M``,address@hidden'1H
,:6YG``0````#!0``
`
end

begin 664 bug2.o
M?T5,address@hidden
M`"@`!P`$``$`````+G-Y;address@hidden<W1R=&%B`"YS:'-T<address@hidden&5X=``N
M9&%T80`N8G-S````````````````````````````````````````````````
M```````;`````0````8`````````-`````0```````````````$`````````
M(address@hidden"<````(
M`````P`````````X`````````````````````0`````````1`````P``````
M````````.````"P```````````````$``````````0````(`````````````
M`'address@hidden,`0``
M!P```````````````0``````````````````````````````````````````
M`````P`!``````````````````,address@hidden,``0``````
1````````$``!``!T:&EN9P``
`
end

These were created by assembling the following files with gas from the
same binutils build:

---- bug1.s ----
base:
        .word   0
        .word   thing - base
----------------
---- bug2.s ----
        .global thing
thing:
        .word   1
----------------

  * A description of what behavior you observe that you believe is incorrect.

In the linker output, the word four bytes after "base" should contain the
offset from "base" to "thing", but doesn't:

Disassembly of section .text:

00008000 <base>:
    8000:       00000000        andeq   r0, r0, r0
    8004:       0000000c        andeq   r0, r0, ip

00008008 <thing>:
    8008:       00000001        andeq   r0, r0, r1

I believe the "0000000c" there should have been "00000008".

The problem seems to lie in BFD's handling of R_ARM_REL32 relocations.
ARM ELF (revision B-01) states that the result of such a relocation is
"S - P + A", where S is the address of the symbol, P is the address of the
word being relocated and A is the addend recorded there.  In this case,
these are 0x8008, 0x8004 and 0x4.  BFD, though, is using the base address
of the output section as P, with the obvious consequences.  I believe the
following patch fixes the problem:

--- binutils-2.11.2/bfd/elf32-arm.h.orig        Thu Jun 14 12:16:59 2001
+++ binutils-2.11.2/bfd/elf32-arm.h     Fri Aug  3 00:09:36 2001
@@ -1295,7 +1295,7 @@ elf32_arm_final_link_relocate (howto, in

        case R_ARM_REL32:
          value -= (input_section->output_section->vma
-                   + input_section->output_offset);
+                   + input_section->output_offset + rel->r_offset);
          value += addend;
          break;
        }

-- 
Ben Harris                                                   <address@hidden>
Portmaster, NetBSD/arm26               <URL:http://www.netbsd.org/Ports/arm26/>