lib/57638: thread local storage broken on evbarm (armv5)

[martin%NetBSD.org@localhost]

>Number:         57638
>Category:       lib
>Synopsis:       thread local storage broken on evbarm (armv5)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 30 17:55:00 +0000 2023
>Originator:     Martin Husemann
>Release:        NetBSD 10.99.9
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD unpluged.duskware.de 10.99.9 NetBSD 10.99.9 (UNPLUGED) #521: Sat Sep 30 13:40:22 CEST 2023 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/evbarm/compile/UNPLUGED evbarm
Architecture: earmv5
Machine: evbarm
>Description:

Many (all?) TLS related tests crash on evbarm, like:

tp-start: 1696095219.51665, t_tls_extern, 21
tc-start: 1696095219.52148, dynamic_abusedef
tc-se:Test program crashed; attempting to get stack trace

Unfortunately gdb is not helpfull (11.0.50 hangs, 13.2 crashes).
Extracting the core and examining with gdb 11.0.50 shows:

Core was generated by `t_tls_extern'.
Program terminated with signal SIGBUS, Bus error.
#0  0xbbed8c78 in _rtld_symlook_list (
    name=name@entry=0xbbbc0233 "__aeabi_read_tp", hash=hash@entry=0xbfffe624, 
    objlist=0xbbef1258 <_rtld_list_main>, 
    defobj_out=defobj_out@entry=0xbfffe5d8, flags=flags@entry=1, 
    ventry=ventry@entry=0x0, dlp=dlp@entry=0xbfffe5dc)
    at /work/src/libexec/ld.elf_so/symbol.c:88
88      /work/src/libexec/ld.elf_so/symbol.c: No such file or directory.
(gdb) info thread
  Id   Target Id         Frame 
* 1    process 9670      0xbbed8c78 in _rtld_symlook_list (
    name=name@entry=0xbbbc0233 "__aeabi_read_tp", hash=hash@entry=0xbfffe624, 
    objlist=0xbbef1258 <_rtld_list_main>, 
    defobj_out=defobj_out@entry=0xbfffe5d8, flags=flags@entry=1, 
    ventry=ventry@entry=0x0, dlp=dlp@entry=0xbfffe5dc)
    at /work/src/libexec/ld.elf_so/symbol.c:88
(gdb) info locals
symp = <optimized out>
def = 0x0
defobj = 0x0
elm = 0xbbef80e0
(gdb) p *elm
$1 = {link = {sqe_next = 0xbbef8140}, obj = 0xbbefc000}
(gdb) info dll
From        To          Syms Read   Shared Object Library
0xbbea4270  0xbbead1c8  Yes         /usr/lib/libatf-c.so.0
0xbbd3df60  0xbbe3f104  Yes         /usr/lib/libc.so.12
0xbbbe0320  0xbbbe040c  Yes         /usr/tests/libexec/ld.elf_so/libh_use_static.so
0xbbbc0328  0xbbbc0414  Yes         /usr/tests/libexec/ld.elf_so/libh_def_static.so.1
0xbbed0608  0xbbedd154  Yes         /usr/libexec/ld.elf_so
(gdb) info reg
r0             0xbbbc0233          3149660723
r1             0xbfffe624          3221218852
r2             0xbbef1258          3153007192
r3             0xbfffe5d8          3221218776
r4             0xbbef80e0          3153035488
r5             0xbfffe5dc          3221218780
r6             0xbbbc0233          3149660723
r7             0x0                 0
r8             0x1                 1
r9             0xbfffe5d8          3221218776
r10            0xbfffe624          3221218852
r11            0xbfffe610          3221218832
r12            0x40                64
sp             0xbfffe55c          0xbfffe55c
lr             0xbbed91b8          3152908728
pc             0xbbed8c78          0xbbed8c78 <_rtld_symlook_list+24>
cpsr           0xa0000010          2684354576
(gdb) x/16i _rtld_symlook_list   
   0xbbed8c60 <_rtld_symlook_list>:     
    push        {r4, r5, r6, r7, r8, r9, r10, r11, lr}
   0xbbed8c64 <_rtld_symlook_list+4>:   ldr     r4, [r2]
   0xbbed8c68 <_rtld_symlook_list+8>:   sub     sp, sp, #20
   0xbbed8c6c <_rtld_symlook_list+12>:  cmp     r4, #0
   0xbbed8c70 <_rtld_symlook_list+16>:  ldr     r5, [sp, #64]   ; 0x40
   0xbbed8c74 <_rtld_symlook_list+20>:  str     r3, [sp, #12]
=> 0xbbed8c78 <_rtld_symlook_list+24>:  ldrd    r8, [sp, #56]   ; 0x38
   0xbbed8c7c <_rtld_symlook_list+28>:  
    beq 0xbbed8d70 <_rtld_symlook_list+272>
   0xbbed8c80 <_rtld_symlook_list+32>:  mov     r10, #0
   0xbbed8c84 <_rtld_symlook_list+36>:  mov     r7, r0
   0xbbed8c88 <_rtld_symlook_list+40>:  mov     r11, r1
   0xbbed8c8c <_rtld_symlook_list+44>:  mov     r6, r10
   0xbbed8c90 <_rtld_symlook_list+48>:  ldr     r12, [r5, #8]
   0xbbed8c94 <_rtld_symlook_list+52>:  ldr     r2, [r4, #4]
   0xbbed8c98 <_rtld_symlook_list+56>:  cmp     r12, #0
   0xbbed8c9c <_rtld_symlook_list+60>:  
    beq 0xbbed8cf0 <_rtld_symlook_list+144>


... which looks exactly like the crash gdb 13.2 dies with.

>How-To-Repeat:
s/a

>Fix:
n/a