id = 939
title = "qemu-mipsn32el user mode emulator allocates pointers beyond upper memory limit"
state = "closed"
created_at = "2022-03-26T22:22:18.021Z"
closed_at = "2022-03-29T14:17:25.783Z"
labels = ["target: mips"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/939"
host-os = "n/a"
host-arch = "n/a"
qemu-version = "6.2.0 with the mipsn32 patches from issue 909 added"
guest-os = "n/a"
guest-arch = "n/a"
description = """In qemu-based N32 mips chroots (both BE and LE), I became aware of memory-intensive programs segfaulting, apparently at random. tar, gcc, but only in specific situations. Watching the strace output of gcc, I got the impression that it happens when memory beyond 2Gbyte is allocated. (mips n32 and o32 uses only 31 bit of a pointer, I've been told, so this is somewhat expected, but a segfault is nevertheless wrong.) 

So, I used the following test program, statically linked:
```
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main() {

  char *pointer;
  int i;

  for (i=1; i<301; i++) {

    printf("Allocation %i : ", i);
    pointer = malloc(20480000 * sizeof(char));

    printf(" pointer is %p, ", pointer);

    if (! pointer) {
      printf("malloc failed\\n");
      exit(0);
    };

    memset(pointer, 0xDB, 20480000);
    printf(" filled\\n");
  }
};
```

With mips3 n32 I get the following output:
```
pinacolada ~ # file /var/lib/machines/mips64el-n32/root/memtest
/var/lib/machines/mips64el-n32/root/memtest: ELF 32-bit LSB executable, MIPS, N32 MIPS-III version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
pinacolada ~ # /usr/bin/qemu-mipsn32el /var/lib/machines/mips64el-n32/root/memtest
Allocation 1 :  pointer is 0x40802010,  filled
Allocation 2 :  pointer is 0x41b8b010,  filled
Allocation 3 :  pointer is 0x42f14010,  filled
[...]
Allocation 51 :  pointer is 0x7d8c4010,  filled
Allocation 52 :  pointer is 0x7ec4d010,  filled
qemu: unhandled CPU exception 0x15 - aborting
pc=0x0000000010021944 HI=0x0000000000000004 LO=0x00000000100218f0 ds 02ea 00000000100218f0 0
GPR00: r0 0000000000000000 at 0000000000000001 v0 000000007ffd6010 v1 0000000026f77200
GPR04: a0 000000007ffd6010 a1 dbdbdbdbdbdbdbdb a2 0000000001388000 a3 0000000001388000
GPR08: t0 0000000025252525 t1 0000000025252525 t2 ffffffffffffffff t3 000000001006c369
GPR12: t4 000000001006c368 t5 0000000000000000 t6 0000000000000000 t7 0000000000000010
GPR16: s0 0000000000000001 s1 00000000407ffd54 s2 000000001009b270 s3 0000000000000000
GPR20: s4 0000000010000760 s5 00000000407ffd5c s6 0000000000000000 s7 0000000000000000
GPR24: t8 0000000000000000 t9 00000000100218f0 k0 0000000000000000 k1 0000000000000000
GPR28: gp 00000000100a7320 sp 00000000407ffbf0 s8 00000000407ffbf0 ra 0000000010000854
CP0 Status  0x24800010 Cause   0x00000000 EPC    0x0000000000000000
    Config0 0x80004482 Config1 0xbe61309b LLAddr 0x0000000000000000
    Config2 0x80000000 Config3 0x00000000
    Config4 0x00000000 Config5 0x00000000
**
ERROR:../accel/tcg/cpu-exec.c:928:cpu_exec: assertion failed: (cpu == current_cpu)
Bail out! ERROR:../accel/tcg/cpu-exec.c:928:cpu_exec: assertion failed: (cpu == current_cpu)
```

For mips2 o32 I get the more correct looking output
```
pinacolada ~ # file /var/lib/machines/mips-o32/root/memtest
/var/lib/machines/mips-o32/root/memtest: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
pinacolada ~ # /usr/bin/qemu-mips /var/lib/machines/mips-o32/root/memtest
Allocation 1 :  pointer is 0x3ec76008,  filled
Allocation 2 :  pointer is 0x3d8ed008,  filled
Allocation 3 :  pointer is 0x3c564008,  filled
[...]
Allocation 104 :  pointer is 0x4082c008,  filled
Allocation 105 :  pointer is (nil), malloc failed
```"""
reproduce = "n/a"
additional = "n/a"