⬢ DragonFlyBSD Kernel Audit
DF-4582 / run.2.log
← back to finding ↓ download raw
DF-4582/DF-4583 userland runs, verbatim math, guest gcc 8.3.

$ cc -O0 -o rs690_div0_o0 rs690_div0.c
$ ./rs690_div0_o0

== scenario 0: entering rs690_crtc_bandwidth_compute()      [clock=1048576]
== scenario 0: child killed by signal 8 (Floating point exception)

== scenario 1: entering rs690_crtc_bandwidth_compute()      [sideport mclk=0]
== scenario 1: child killed by signal 8 (Floating point exception)

== scenario 2: entering rs690_crtc_bandwidth_compute()      [pm.sclk=0]
== scenario 2: child killed by signal 8 (Floating point exception)

kernel-side echo of the userland faults (serial console):
Sep 21 21:49:42 dfbsd kernel: pid 1901 (rs690_div0_o0), uid 0: exited on signal 8 (core dumped)
Sep 21 21:49:42 dfbsd kernel: pid 1904 (rs690_div0_o0), uid 0: exited on signal 8 (core dumped)
Sep 21 21:49:42 dfbsd kernel: pid 1907 (rs690_div0_o0), uid 0: exited on signal 8 (core dumped)

--------------------------------------------------------------------------------
Codegen note (documented in VERDICT.md): a micro-test of dfixed_div alone
(userland -O2) also dies (SIGILL: gcc replaces the provable %0 by ud2):

$ /tmp/t2
clk=1048576 a.full=0 (expect 0)
after /1000: a.full=0 (expect 0)
about to dfixed_div(b, a) with a.full==0 ...
Illegal instruction (core dumped)                                   rc=132
$ /tmp/t0   (-O0)
... Floating point exception (core dumped)                          rc=136

The full harness at -O2 survives because gcc UB-fuses the constant/inner
division chain in that particular build context; the SHIPPED radeon.ko
(see objdump_radeon_ko.txt) keeps a genuine runtime div with the
truncating shl, and the kernel-flag KLD (run.log) traps with #DE.  The
-O0 runs above establish the source-level semantics.