/*
 * DF-3857 PoC — arithmetic-level reproduction of the divide-by-zero in
 * dce_v10_0_latency_watermark() (sys/dev/drm/amd/amdgpu/dce_v10_0.c:877-925)
 * — the DCE10 (Tonga/Fiji) twin of DF-3828 (DCE11) / DF-3665 (evergreen).
 *
 * Chain replicated exactly as in the kernel source:
 *
 *   dce_v10_0_program_watermarks()        dce_v10_0.c:1024-1040
 *       !adev->pm.dpm_enabled  ->
 *           wm_high.yclk = adev->pm.current_mclk * 10;  (= 0 on affected systems)
 *           wm_high.sclk = adev->pm.current_sclk * 10;  (= 0 on affected systems)
 *       wm_high.disp_clk = mode->clock;                 (normal, e.g. 148500)
 *   dce_v10_0_available_bandwidth()       dce_v10_0.c:825-833
 *       = min(dram_bandwidth, data_return, dmif_req) == 0
 *   dce_v10_0_latency_watermark()         dce_v10_0.c:882-884
 *       worst_chunk_return_time       = (512 * 8 * 1000) / available_bandwidth; <-- #DE
 *       cursor_line_pair_return_time  = (128 * 4 * 1000) / available_bandwidth; <-- #DE
 *       dc_latency                    = 40000000 / wm->disp_clk;
 *
 * All three divides execute BEFORE the function's only guard
 * (`if (wm->num_heads == 0) return 0;`, dce_v10_0.c:892). The guard is
 * additionally dead in practice: the sole caller gates on
 * `amdgpu_crtc->base.enabled && num_heads && mode` (dce_v10_0.c:1024).
 *
 * pm.current_sclk/current_mclk become 0 when the VBIOS firmware-info table
 * reports ulDefaultEngineClock/ulDefaultMemoryClock == 0
 * (sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:677-680 copied with no zero-guard
 * and assigned even on parse failure at :718-719) — the exact seeding DF-3828
 * proved for DCE11; the parser is asic-agnostic and applies to Tonga/Fiji.
 * The secondary disp_clk==0 vector (mode->clock) is separately blocked by
 * drm_mode_validate_basic() (sys/dev/drm/drm_modes.c:1114, MODE_CLOCK_LOW).
 *
 * In userspace the same u32 division raises SIGFPE (integer divide by zero);
 * in the kernel the identical instruction raises #DE and panics the machine
 * during a mode set (dce_v10_0_crtc_do_set_base -> dce_v10_0_bandwidth_update,
 * dce_v10_0.c:2064).
 */
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

/* fixed20_12 truncation of the kernel helpers, integer part only:
 * with yclk == 0 and sclk == 0 the products truncate to 0 exactly as in
 * the kernel's dfixed_const/dfixed_mul/dfixed_trunc sequences. */
static uint32_t dram_bandwidth(uint32_t yclk_khz, uint32_t dram_channels)
{
	uint32_t yclk = yclk_khz / 1000;			/* dce_v10_0.c:715-716 */
	uint32_t channels = dram_channels * 4;			/* :717 */
	return (uint32_t)((uint64_t)channels * yclk * 7 / 10);	/* :719-724 */
}

static uint32_t data_return_bandwidth(uint32_t sclk_khz)
{
	uint32_t sclk = sclk_khz / 1000;			/* dce_v10_0.c:773-774 */
	return (uint32_t)((uint64_t)32 * sclk * 8 / 10);	/* :776-782 */
}

static uint32_t dmif_request_bandwidth(uint32_t disp_clk_khz)
{
	uint32_t disp_clk = disp_clk_khz / 1000;		/* dce_v10_0.c:802-803 */
	return (uint32_t)((uint64_t)32 * disp_clk * 8 / 10);	/* :805-813 */
}

static uint32_t available_bandwidth(uint32_t yclk, uint32_t sclk, uint32_t disp_clk,
				    uint32_t dram_channels)
{
	uint32_t a = dram_bandwidth(yclk, dram_channels);
	uint32_t b = data_return_bandwidth(sclk);
	uint32_t c = dmif_request_bandwidth(disp_clk);
	return a < b ? (a < c ? a : c) : (b < c ? b : c);	/* dce_v10_0.c:832 */
}

/* the three divides of dce_v10_0_latency_watermark(), dce_v10_0.c:880-887 */
static uint32_t latency_watermark(uint32_t yclk, uint32_t sclk, uint32_t disp_clk,
				  uint32_t dram_channels, uint32_t num_heads)
{
	uint32_t mc_latency = 2000;					/* :880 */
	uint32_t avail = available_bandwidth(yclk, sclk, disp_clk, dram_channels);
	uint32_t worst_chunk_return_time = (512 * 8 * 1000) / avail;	/* :882 */
	uint32_t cursor_line_pair_return_time = (128 * 4 * 1000) / avail;/* :883 */
	uint32_t dc_latency = 40000000 / disp_clk;			/* :884 */
	uint32_t other = ((num_heads + 1) * worst_chunk_return_time) +
			 (num_heads * cursor_line_pair_return_time);	/* :885-886 */
	(void)mc_latency; (void)dc_latency;
	return other;	/* value irrelevant; the divide traps before it */
}

int main(int argc, char **argv)
{
	/* inputs are read from argv so the compiler cannot fold the divide;
	 * defaults replicate the affected system: VBIOS reported zero default
	 * clocks (amdgpu_atombios.c:677-680) and DPM is disabled. */
	uint32_t yclk_khz = argc > 1 ? (uint32_t)strtoul(argv[1], NULL, 0) : 0;
	uint32_t sclk_khz = argc > 2 ? (uint32_t)strtoul(argv[2], NULL, 0) : 0;
	uint32_t dispclk  = argc > 3 ? (uint32_t)strtoul(argv[3], NULL, 0) : 148500;

	/* healthy system: real Tonga/Fiji clocks -> no trap */
	uint32_t ok = latency_watermark(6000000, 3000000, 148500, 8, 1);
	printf("healthy clocks: watermark math returns %u (no trap)\n", ok);
	fflush(stdout);

	/* affected system: VBIOS reported 0 default clocks, DPM disabled */
	printf("affected clocks (current_mclk=%u, current_sclk=%u): "
	       "entering latency_watermark()...\n", yclk_khz, sclk_khz);
	fflush(stdout);
	uint32_t bad = latency_watermark(yclk_khz, sclk_khz, dispclk, 8, 1);
	printf("UNEXPECTED: returned %u without trapping\n", bad);
	return 1;
}