qemu-mipsn32el user mode emulator allocates pointers beyond upper memory limit

Host environment

• Gentoo Linux
• Linux pinacolada 5.15.25-gentoo #1 SMP PREEMPT Tue Mar 1 09:40:06 CET 2022 x86_64 Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz GenuineIntel GNU/Linux
• QEMU flavor: qemu-mipsn32el
• QEMU version: 6.2.0 with the mipsn32 patches from issue 909 added

Emulated/Virtualized environment

• -march=mips3 -mabi=n32

Description of problem

In qemu-based N32 mips chroots (both BE and LE), I became aware of memory-intensive programs segfaulting, apparently at random. tar, gcc, but only in specific situations. Watching the strace output of gcc, I got the impression that it happens when memory beyond 2Gbyte is allocated. (mips n32 and o32 uses only 31 bit of a pointer, I've been told, so this is somewhat expected, but a segfault is nevertheless wrong.)

So, I used the following test program, statically linked:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main() {

  char *pointer;
  int i;

  for (i=1; i<301; i++) {

    printf("Allocation %i : ", i);
    pointer = malloc(20480000 * sizeof(char));

    printf(" pointer is %p, ", pointer);

    if (! pointer) {
      printf("malloc failed\n");
      exit(0);
    };

    memset(pointer, 0xDB, 20480000);
    printf(" filled\n");
  }
};

With mips3 n32 I get the following output:

pinacolada ~ # file /var/lib/machines/mips64el-n32/root/memtest
/var/lib/machines/mips64el-n32/root/memtest: ELF 32-bit LSB executable, MIPS, N32 MIPS-III version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
pinacolada ~ # /usr/bin/qemu-mipsn32el /var/lib/machines/mips64el-n32/root/memtest
Allocation 1 :  pointer is 0x40802010,  filled
Allocation 2 :  pointer is 0x41b8b010,  filled
Allocation 3 :  pointer is 0x42f14010,  filled
[...]
Allocation 51 :  pointer is 0x7d8c4010,  filled
Allocation 52 :  pointer is 0x7ec4d010,  filled
qemu: unhandled CPU exception 0x15 - aborting
pc=0x0000000010021944 HI=0x0000000000000004 LO=0x00000000100218f0 ds 02ea 00000000100218f0 0
GPR00: r0 0000000000000000 at 0000000000000001 v0 000000007ffd6010 v1 0000000026f77200
GPR04: a0 000000007ffd6010 a1 dbdbdbdbdbdbdbdb a2 0000000001388000 a3 0000000001388000
GPR08: t0 0000000025252525 t1 0000000025252525 t2 ffffffffffffffff t3 000000001006c369
GPR12: t4 000000001006c368 t5 0000000000000000 t6 0000000000000000 t7 0000000000000010
GPR16: s0 0000000000000001 s1 00000000407ffd54 s2 000000001009b270 s3 0000000000000000
GPR20: s4 0000000010000760 s5 00000000407ffd5c s6 0000000000000000 s7 0000000000000000
GPR24: t8 0000000000000000 t9 00000000100218f0 k0 0000000000000000 k1 0000000000000000
GPR28: gp 00000000100a7320 sp 00000000407ffbf0 s8 00000000407ffbf0 ra 0000000010000854
CP0 Status  0x24800010 Cause   0x00000000 EPC    0x0000000000000000
    Config0 0x80004482 Config1 0xbe61309b LLAddr 0x0000000000000000
    Config2 0x80000000 Config3 0x00000000
    Config4 0x00000000 Config5 0x00000000
**
ERROR:../accel/tcg/cpu-exec.c:928:cpu_exec: assertion failed: (cpu == current_cpu)
Bail out! ERROR:../accel/tcg/cpu-exec.c:928:cpu_exec: assertion failed: (cpu == current_cpu)

For mips2 o32 I get the more correct looking output

pinacolada ~ # file /var/lib/machines/mips-o32/root/memtest
/var/lib/machines/mips-o32/root/memtest: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
pinacolada ~ # /usr/bin/qemu-mips /var/lib/machines/mips-o32/root/memtest
Allocation 1 :  pointer is 0x3ec76008,  filled
Allocation 2 :  pointer is 0x3d8ed008,  filled
Allocation 3 :  pointer is 0x3c564008,  filled
[...]
Allocation 104 :  pointer is 0x4082c008,  filled
Allocation 105 :  pointer is (nil), malloc failed