DF-2343 / panic.txt
DF-2343 panic signatures -- DragonFly 6.5-DEVELOPMENT, UMCSH harness kernel
(verbatim umcs.c TU-compiled with -O0 semantics for the verbatim unit;
ucom/usb framework + tty layer 100% stock, compiled in).
All three trigger routes reach the SAME faulting instruction:
umcs7840_calc_baudrate+0x90 = 0xffffffff80a856c6 = `divl -0x14(%rbp)`
(the division by rate at umcs.c:1066; the 1-element OOB load of
umcs7840_baudrate_divisors[9] is the instruction right before it at
+0x84 -- see VERDICT.md / adjacency evidence)
IMPORTANT: with the STOCK shipping codegen (CCVER=gcc80 -O2, which
built the guest's X86_64_GENERIC and the harness kernel by default)
gcc folds the division-by-zero UB: rate==0 returns via
"*divisor=0, *clk=0x80, ret 0" and pre_param then rejects with EINVAL
-- NO panic on the stock binary (verified live, run1.log, and in the
disassembly in adjacency.txt). The panics below are the literal
C-source semantics under -O0 codegen of the identical source bytes.
=====================================================================
PANIC 1 -- direct dispatch through the real umcs7840_pre_param
(the exact call usb_serial.c:1680 makes), rate=0
=====================================================================
UMCSH preparam: dispatching real umcs7840_pre_param(ucom, t.c_ospeed=0) -- the exact call usb_serial.c:1680 makes
UMCSH preparam: ABOUT TO ENTER (stock kernel: expect Fatal trap 0 divide error)
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer = 0x8:0xffffffff80a856c6
stack pointer = 0x10:0xfffff80117d175b0
frame pointer = 0x10:0xfffff80117d175d8
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 807
current thread = pri 6
trap number = 18
panic: integer divide fault
cpuid = 1
Trace beginning at frame 0xfffff80117d17418
trap_fatal() at trap_fatal+0x301
trap() at trap+0x457
calltrap() at calltrap+0x9
--- trap 0000000000000012, rip = ffffffff80a856c6, rsp = fffff80117d175a0, rbp = fffff80117d175d8 ---
umcs7840_calc_baudrate() at umcs7840_calc_baudrate+0x90 0xffffffff80a856c6
umcs7840_pre_param() at umcs7840_pre_param+0x29 0xffffffff80a8488d
umcsh_scenario() at umcsh_scenario+0x48a
boot() called on cpu#1
Dumping 550 MB ... Dump complete
=====================================================================
PANIC 2 -- UNPRIVILEGED first open of /dev/cuaU0.0 (user maxx,
dialer group) through the STOCK tty->ucom open path:
ucom_dev_open -> ucom_open -> usb_serial.c:839-842
(t = sc_it_in, never initialized, c_ospeed==0)
-> ucom_param -> pre_param -> calc_baudrate
=====================================================================
tioc0: opening /dev/cuaU0.0 (uid=1001) -- sc_it_* untouched, c_ospeed==0 flows to ucom_pre_param on first open
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 2; lapic id = 2
instruction pointer = 0x8:0xffffffff80a856c6
current process = 867 <- maxx's tioc0
panic: integer divide fault
Trace beginning at frame 0xfffff801186d92b8
trap_fatal() at trap_fatal+0x301
trap() at trap+0x457
calltrap() at calltrap+0x9
--- trap 0000000000000012, rip = ffffffff80a856c6, rsp = fffff801186d9440, rbp = fffff801186d9478 ---
umcs7840_calc_baudrate() at umcs7840_calc_baudrate+0x90 0xffffffff80a856c6
umcs7840_pre_param() at umcs7840_pre_param+0x29 0xffffffff80a8488d
ucom_param() at ucom_param+0xa8 0xffffffff80a66178 <- usb_serial.c:1680 dispatch
boot() called on cpu#2
Dumping 680 MB ... Dump complete
=====================================================================
PANIC 3 -- USB serial console route (the finding's primary claimed
trigger): loader tunables hw.usb.ucom.cons_unit=0 and
hw.usb.ucom.cons_baud=0; panic DURING ucom_attach ->
ucom_attach_tty console block (usb_serial.c:511-533),
after the GPIO/MODE reads and transfer setup succeeded
=====================================================================
UMCSH attach: ABOUT TO enter real umcs7840_attach()
UMCSH SIM: RD reg 0x07 port 0 -> 0x01
umcs7840: Chip mcs7840, found 4 active ports
UMCSH SIM: RD reg 0x2b port 0 -> 0x40
umcs7840: On-die confguration: RST: active high, HRD: no, PLL: avail, POR: avail, Ports: 4, EEPROM write enabled, IrDA is not available
UMCSH SIM: transfer_setup ep 0x01 n=2 -> OK (NULL)
[...]
UMCSH SIM: transfer_setup ep 0x09 n=1 -> OK (NULL)
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer = 0x8:0xffffffff80a856c6
current process = 792
panic: integer divide fault
Trace beginning at frame 0xfffff8011780b238
trap_fatal() at trap_fatal+0x301
trap() at trap+0x457
calltrap() at calltrap+0x9
--- trap 0000000000000012, rip = ffffffff80a856c6, rsp = fffff8011780b3c0, rbp = fffff8011780b3f8 ---
umcs7840_calc_baudrate() at umcs7840_calc_baudrate+0x90 0xffffffff80a856c6
umcs7840_pre_param() at umcs7840_pre_param+0x29 0xffffffff80a8488d
ucom_param() at ucom_param+0xa8 0xffffffff80a66178 <- usb_serial.c:523-533 console block
boot() called on cpu#1
Dumping 546 MB ... Dump complete
(Serial-console captures: panic_*_o0_serial.log; note the guest's
post-dump reboot path livelocked in send_ipiq drain after panics 2/3 --
a DragonFly shutdown-time issue with a panicked CPU, unrelated to the
finding; the dump itself completed.)