qemu-mipsn32el user mode emulator allocates pointers beyond upper memory limit
Host environment
- Gentoo Linux
Linux pinacolada 5.15.25-gentoo #1 SMP PREEMPT Tue Mar 1 09:40:06 CET 2022 x86_64 Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz GenuineIntel GNU/Linux
- QEMU flavor: qemu-mipsn32el
- QEMU version: 6.2.0 with the mipsn32 patches from issue 909 added
Emulated/Virtualized environment
-march=mips3 -mabi=n32
Description of problem
In qemu-based N32 mips chroots (both BE and LE), I became aware of memory-intensive programs segfaulting, apparently at random. tar, gcc, but only in specific situations. Watching the strace output of gcc, I got the impression that it happens when memory beyond 2Gbyte is allocated. (mips n32 and o32 uses only 31 bit of a pointer, I've been told, so this is somewhat expected, but a segfault is nevertheless wrong.)
So, I used the following test program, statically linked:
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main() {
char *pointer;
int i;
for (i=1; i<301; i++) {
printf("Allocation %i : ", i);
pointer = malloc(20480000 * sizeof(char));
printf(" pointer is %p, ", pointer);
if (! pointer) {
printf("malloc failed\n");
exit(0);
};
memset(pointer, 0xDB, 20480000);
printf(" filled\n");
}
};
With mips3 n32 I get the following output:
pinacolada ~ # file /var/lib/machines/mips64el-n32/root/memtest
/var/lib/machines/mips64el-n32/root/memtest: ELF 32-bit LSB executable, MIPS, N32 MIPS-III version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
pinacolada ~ # /usr/bin/qemu-mipsn32el /var/lib/machines/mips64el-n32/root/memtest
Allocation 1 : pointer is 0x40802010, filled
Allocation 2 : pointer is 0x41b8b010, filled
Allocation 3 : pointer is 0x42f14010, filled
[...]
Allocation 51 : pointer is 0x7d8c4010, filled
Allocation 52 : pointer is 0x7ec4d010, filled
qemu: unhandled CPU exception 0x15 - aborting
pc=0x0000000010021944 HI=0x0000000000000004 LO=0x00000000100218f0 ds 02ea 00000000100218f0 0
GPR00: r0 0000000000000000 at 0000000000000001 v0 000000007ffd6010 v1 0000000026f77200
GPR04: a0 000000007ffd6010 a1 dbdbdbdbdbdbdbdb a2 0000000001388000 a3 0000000001388000
GPR08: t0 0000000025252525 t1 0000000025252525 t2 ffffffffffffffff t3 000000001006c369
GPR12: t4 000000001006c368 t5 0000000000000000 t6 0000000000000000 t7 0000000000000010
GPR16: s0 0000000000000001 s1 00000000407ffd54 s2 000000001009b270 s3 0000000000000000
GPR20: s4 0000000010000760 s5 00000000407ffd5c s6 0000000000000000 s7 0000000000000000
GPR24: t8 0000000000000000 t9 00000000100218f0 k0 0000000000000000 k1 0000000000000000
GPR28: gp 00000000100a7320 sp 00000000407ffbf0 s8 00000000407ffbf0 ra 0000000010000854
CP0 Status 0x24800010 Cause 0x00000000 EPC 0x0000000000000000
Config0 0x80004482 Config1 0xbe61309b LLAddr 0x0000000000000000
Config2 0x80000000 Config3 0x00000000
Config4 0x00000000 Config5 0x00000000
**
ERROR:../accel/tcg/cpu-exec.c:928:cpu_exec: assertion failed: (cpu == current_cpu)
Bail out! ERROR:../accel/tcg/cpu-exec.c:928:cpu_exec: assertion failed: (cpu == current_cpu)
For mips2 o32 I get the more correct looking output
pinacolada ~ # file /var/lib/machines/mips-o32/root/memtest
/var/lib/machines/mips-o32/root/memtest: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
pinacolada ~ # /usr/bin/qemu-mips /var/lib/machines/mips-o32/root/memtest
Allocation 1 : pointer is 0x3ec76008, filled
Allocation 2 : pointer is 0x3d8ed008, filled
Allocation 3 : pointer is 0x3c564008, filled
[...]
Allocation 104 : pointer is 0x4082c008, filled
Allocation 105 : pointer is (nil), malloc failed