Issue created by Sebastian Huber: https://gitlab.rtems.org/rtems/tools/rtems-source-builder/-/work_items/203
The GDB simulator which this tool builds carries four defects. Three of them make the MIPS simulator unusable for an operating system, and the fourth is in `sim/common` and reaches every target which slips simulator time. None of them is reachable from a bare metal test program, which is why the simulator has carried them. `sim_events_deschedule()` in `sim/common/sim-events.c` asserts that a non empty event queue implies a non negative time from event. That is not an invariant. `sim_events_slip()`, which the MIPS port calls for every branch delay slot, decrements the time from event unconditionally, so the time can pass an event which is still queued. A handler which deschedules another overdue event then aborts the simulation. Two timers are enough to reach it. `check_mf_hilo()` in `sim/mips/mips.igen` calls `sim_engine_abort()` when a `mfhi` or `mflo` reads a value the ISA leaves UNPREDICTABLE. RTEMS saves HI and LO unconditionally on interrupt entry, so it reads them at an arbitrary instruction boundary. Every clock tick which lands in multiply or divide heavy code aborts. The simulator resumes on the faulting instruction, which raises the same condition again. `signal_exception()` in `sim/mips/interp.c` computes `CAUSE`, `SR` and `EPC` for a reserved instruction, points `PC` at the exception handler and then assigns `PC = EPC` and discards all of it, so an operating system which would handle the exception never runs. The compiler emits `rdhwr $3, $29` to read the thread pointer for every access to a thread-local object on every MIPS target, and the R3900 lacks that instruction. The address error cases immediately above do not discard the exception and say so in a comment. The simulator also never recognises a software interrupt request, so a BSP cannot raise an interrupt in software. Measured on the RTEMS test suite for `mips/jmr3904`. The `mfhi` abort hung all thirteen FAT tests, at 78 minutes of timeouts and about 313 GB of standard error per suite run. One of them, `fatfs_fserror`, went from a 360 s timeout to 0.20 s and 86 bytes once the abort became a warning. The reserved instruction abort produced 620 million lines, about 23 GB, per suite run from four validation executables. The four patches are posted upstream: <https://inbox.sourceware.org/gdb-patches/[email protected]/T/#t> Until they land in binutils-gdb, carry them here. The GDB source is pinned in `rtems/config/tools/rtems-gdb-head.cfg`, which every architecture that builds GDB from head includes, so a `%patch add gdb -p1 <url>` for each patch after the `%source set` covers them all. The patches touch the simulator only. This description was created with Claude Code assistance. -- View it on GitLab: https://gitlab.rtems.org/rtems/tools/rtems-source-builder/-/work_items/203 You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/5-5wxvsyc1lhph4ypw0eyrnndfo-e/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help
_______________________________________________ bugs mailing list [email protected] http://lists.rtems.org/mailman/listinfo/bugs
