objcopy/ld ELF->a.out incorrect instruction address call

[Leon Dang]

System: FreeBSD-4.3 i386
Binutil version: 2.11.2 and older

BFD compiled with --enable-targets=all

Problem Report:
===============

Test conducted:
---------------

1. Compiled simple.c as aout (gcc -aout -c simple.c),
   and compiled simple_main.c as ELF.
2. Converted simple.o into ELF format with objcopy:
    objcopy -I a.out-i386 -O elf32-i386 --remove-leading-char simple.o

   (Note: tried input/output formats for freebsd also).
3. Linked ELF simple.o with simple_main.o to produce simple program:
    gcc simple.o simple_main.o -o simple

Sources:
--------

>>>>>>>>>> simple.c: <<<<<<<<<<<<

extern int return_func();

int simple()
{
        int i;

        i = return_func();
        return i;
}

>>>>>>>>>> simple_main.c: <<<<<<<<<<<<

int return_func()
{
        return 100;
}

extern int simple();

int main()
{
        int i;

        i = simple();
        printf("i: %d\n", i);
        return 0;
}


Stack Trace in GDB:
-------------------

1. $ gdb simple
2. break main
3. run
4. x/10i simple

0x8048528 <simple>:     push   %ebp
0x8048529 <simple+1>:   mov    %esp,%ebp
0x804852b <simple+3>:   sub    $0x18,%esp

0x8048533 <simple+11>:  mov    %eax,%eax
0x8048535 <simple+13>:  mov    %eax,0xfffffffc(%ebp)
0x8048538 <simple+16>:  mov    0xfffffffc(%ebp),%edx
0x804853b <simple+19>:  mov    %edx,%eax
0x804853d <simple+21>:  jmp    0x8048540 <simple+24>
0x804853f <simple+23>:  nop    

>>> instruction 0x804852e <simple+6> should have been "call return_func"

Possible causes:
----------------

objcopy dumps wrong values in the "call" instruction, or ld does not
resolve
correctly.

A Hack that works:
------------------

For some reason, global variables are addressed correctly. And for some
reason using a function pointer that is initialised with the called
function makes a proper call work, ie, if simple.c was changed to the
following:

extern int return_func();

int simple()
{
        int i;
        int (*rf)();

        rf = return_func;
        i = rf();       /* call the func pointer */
        return i;
}

The problem with this is that I don't have the a.out object file's
source code, so there is no way to hack the source code to use function
pointers.

Another resolution might be to create wrappers as an a.out object which
is linked to the original object file. The wrappers use function
pointers instead of direct function calls. Then convert the combined
library into ELF with objcopy.

However, I'd like to know why direct calling of the elf functions from
the original a.out object fails. (ELF calling the a.out function works
flawlessly).

Thank you,
Leon