I tracked this down to the code in linux-user/syscall.c. The mmap code seems broken, it assumes arg1 is a pointer to an array where the real arguments are. Given arg1 = 0 the memory access check fails.
I'm running qemu-arm and see the following output from mmap with 'strace qemu-arm -strace' (for both host and traget strace output):mmap(NULL, 32800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ad329b460004023 mmap(0,131072,7,34,-1,0) = 0xfffffff2When my program later tries to read memory at 0xfffffffe it fails with a SIGSEGV:Program received signal SIGSEGV, Segmentation fault.1: x/i $pc 0xce30: ldr r1, [r5](gdb) i rr5 0xfffffffe -2Why does qemu-arm return such high addresses on a 32 bit platform and why is the memory inaccessible? If this doesn't seem like an obvious bug in my code, where in the qemu code should I start looking for how mmap works?Kai