cortex-m-rt: consider enabling divide by zero trap by default

[jamesmunns]

In Cortex-M processors, (integer) divide by zero is not elevated to an exception/trap unless CCB->DIV_0_TRP is enabled, which is not the default setting. See https://developer.arm.com/documentation/100235/0004/the-cortex-m33-peripherals/system-control-block/configuration-and-control-register.

Instead, the result is undefined behavior/implementation defined. This is definitely surprising, if not unsound, under some expected behavior by Rust.

I'm not totally sure what happens on Cortex-M0/M0+ devices, or other devices without a hardware division unit.

We should probably set this bit in the cortex-m-rt init process (maybe toggled-off with an unsafe feature).

We might want to enable this to handle FFI or asm, but this is explicitly caught by Rust itself, rather than relying on the host to trap.

[jamesmunns]

https://doc.rust-lang.org/stable/reference/expressions/operator-expr.html#r-expr.arith-logic.behavior says that "division by zero panics" , which it sounds like not what we are doing.

edit: this is the reason that things are fine, actually!

[jamesmunns]

Ah. I'm probably wrong here. It seems that Rust actually DOES insert an explicit "divisor is not zero" check, and panics if that is true. It does not rely on the host to trap.

https://rust.godbolt.org/z/s9Pz4MeEY

We might want to still set the SCB setting, but this is MUCH less impactful than I initially thought as Rust is explicitly checking this.

[jonathanpallant]

Does turning this on break anyone who was assuming it was off?

[jamesmunns]

It would break anyone who:

• In FFI or ASM code (not rust)
• Did an integer divide by zero
• Expected this not to cause an exception

There's no valid reason I could think of where you would intentionally want to do this (especially if your "main" entrypoint is Rust), especially as the resulting output of the integer divide by zero is undefined/implementation defined, so there is no "goodput" to be had.

In favor, it could potentially cause traps earlier in FFI/ASM code, or in an odd/extremely unlikely case where something else undefined has happened, and we are executing garbage (if we happen to do a divide by zero).