/*
 * DF-3878 PoC — arithmetic-level reproduction of the divide-by-zero in
 * dce_v8_0_latency_watermark() (sys/dev/drm/amd/amdgpu/dce_v8_0.c:812-860)
 * — the DCE8 (Bonaire/Kaveri/Kabini/Mullins) twin of DF-3828 (DCE11) and
 * DF-3857 (DCE10).
 *
 * Chain replicated exactly as in the kernel source (all in dce_v8_0.c):
 *
 *   dce_v8_0_program_watermarks()        :948
 *       gate: enabled && num_heads && mode   (:959)
 *       !adev->pm.dpm_enabled  ->
 *           wm_high.yclk = adev->pm.current_mclk * 10;   (:973, = 0 on affected systems)
 *           wm_high.sclk = adev->pm.current_sclk * 10;   (:974, = 0 on affected systems)
 *       wm_high.disp_clk = mode->clock;                  (:977, validated non-zero)
 *       latency_watermark_a = dce_v8_0_latency_watermark(&wm_high);  (:994)
 *   dce_v8_0_available_bandwidth()       :760-768
 *       = min(dram_bandwidth, data_return, dmif_req) == 0 when yclk/sclk == 0
 *   dce_v8_0_latency_watermark()         :812
 *       worst_chunk_return_time      = (512 * 8 * 1000) / available_bandwidth;  <-- :817 #DE
 *       cursor_line_pair_return_time = (128 * 4 * 1000) / available_bandwidth;  <-- :818 #DE
 *       dc_latency                   = 40000000 / wm->disp_clk;                 <-- :819
 *
 * All three divides execute BEFORE the function's only guard
 * (`if (wm->num_heads == 0) return 0;`, dce_v8_0.c:827). That guard is dead
 * anyway: the sole caller path gates on
 * `amdgpu_crtc->base.enabled && num_heads && mode` (dce_v8_0.c:959).
 *
 * pm.current_sclk/current_mclk become 0 when the VBIOS firmware-info table
 * reports ulDefaultEngineClock/ulDefaultMemoryClock == 0 — copied with no
 * zero-guard (amdgpu_atombios.c:677-680, unlike neighboring fields at
 * :667/:694/:708 which get clamped) and assigned even on parse failure
 * (amdgpu_atombios.c:718-719). Identical seeding to DF-3828/DF-3857.
 *
 * The disp_clk==0 vector (mode->clock == 0) is killed in this tree by
 * drm_mode_validate_basic (sys/dev/drm/drm_modes.c:1114 MODE_CLOCK_LOW) via
 * drm_mode_convert_umode -> drm_mode_validate_driver (:1745).
 *
 * In userspace the same u32 division raises SIGFPE (integer divide by zero);
 * in the kernel the identical instruction raises #DE and panics the machine
 * during a mode set (dce_v8_0_crtc_do_set_base :1973 ->
 * dce_v8_0_bandwidth_update :1082 -> program_watermarks :948, and the DPM
 * clock-change path amdgpu_pm.c:2141 -> amdgpu_display_bandwidth_update).
 *
 * Which watermark code actually runs on DCE8 parts: CONFIG_DRM_AMD_DC is set
 * (sys/dev/drm/kconfig.h) but CIK asics take DC only when forced:
 * BONAIRE/KAVERI/KABINI/MULLINS -> `return amdgpu_dc > 0` and amdgpu_dc
 * defaults to -1 (amdgpu_drv.c:107), so the DEFAULT display path on those
 * parts is this legacy file (dce_v8_1/8_2/8_3/8_5 ip blocks, cik.c:2022-2081)
 * — dce_v8_0_latency_watermark is live, NOT dce_calcs. (CHIP_HAWAII defaults
 * to DC (`!= 0`), so Hawaii runs the DF-3869 dce_calcs family instead.)
 */
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

/* integer-truncating replica of the fixed20_12 math in dce_v8_0.c:642-768;
 * with yclk == 0 / sclk == 0 every product truncates to 0 exactly as the
 * kernel's dfixed_const(0)/dfixed_mul/dfixed_trunc sequences do. */
static uint32_t dram_bandwidth(uint32_t yclk_khz, uint32_t dram_channels)
{
	uint32_t yclk = yclk_khz / 1000;				/* :649-651 */
	uint32_t channels = dram_channels * 4;				/* :652 */
	return (uint32_t)((uint64_t)channels * yclk * 7 / 10);		/* :653-657 */
}

static uint32_t data_return_bandwidth(uint32_t sclk_khz)
{
	uint32_t sclk = sclk_khz / 1000;				/* :707-709 */
	return (uint32_t)((uint64_t)32 * sclk * 8 / 10);		/* :710-715 */
}

static uint32_t dmif_request_bandwidth(uint32_t disp_clk_khz)
{
	uint32_t disp_clk = disp_clk_khz / 1000;			/* :736-738 */
	return (uint32_t)((uint64_t)32 * disp_clk * 8 / 10);		/* :739-746 */
}

static uint32_t available_bandwidth(uint32_t yclk, uint32_t sclk, uint32_t disp_clk,
				    uint32_t dram_channels)
{
	uint32_t a = dram_bandwidth(yclk, dram_channels);
	uint32_t b = data_return_bandwidth(sclk);
	uint32_t c = dmif_request_bandwidth(disp_clk);
	return a < b ? (a < c ? a : c) : (b < c ? b : c);		/* :767 */
}

/* the three divides of dce_v8_0_latency_watermark(), dce_v8_0.c:815-821 */
static uint32_t latency_watermark(uint32_t yclk, uint32_t sclk, uint32_t disp_clk,
				  uint32_t dram_channels, uint32_t num_heads)
{
	uint32_t mc_latency = 2000;					/* :815 */
	uint32_t avail = available_bandwidth(yclk, sclk, disp_clk, dram_channels);
	uint32_t worst_chunk_return_time = (512 * 8 * 1000) / avail;	/* :817 */
	uint32_t cursor_line_pair_return_time = (128 * 4 * 1000) / avail; /* :818 */
	uint32_t dc_latency = 40000000 / disp_clk;			/* :819 */
	uint32_t other = ((num_heads + 1) * worst_chunk_return_time) +
			 (num_heads * cursor_line_pair_return_time);	/* :820-821 */
	(void)mc_latency; (void)dc_latency;
	return other;	/* value irrelevant; the divide traps before it */
}

int main(int argc, char **argv)
{
	/* inputs from argv so the compiler cannot fold the divides; defaults
	 * replicate the affected system: VBIOS zero default clocks
	 * (amdgpu_atombios.c:678/680) with DPM disabled. */
	uint32_t yclk_khz = argc > 1 ? (uint32_t)strtoul(argv[1], NULL, 0) : 0;
	uint32_t sclk_khz = argc > 2 ? (uint32_t)strtoul(argv[2], NULL, 0) : 0;
	uint32_t dispclk  = argc > 3 ? (uint32_t)strtoul(argv[3], NULL, 0) : 148500;

	/* healthy system: real CIK clocks (e.g. Bonaire 5GHz/1.2GHz eff.) -> no trap */
	uint32_t ok = latency_watermark(12000000, 5000000, 148500, 8, 1);
	printf("healthy clocks: watermark math returns %u (no trap)\n", ok);
	fflush(stdout);

	/* affected system: VBIOS reported 0 default clocks, DPM disabled */
	printf("affected clocks (current_mclk=%u, current_sclk=%u): "
	       "entering dce_v8_0_latency_watermark()...\n", yclk_khz, sclk_khz);
	fflush(stdout);
	uint32_t bad = latency_watermark(yclk_khz, sclk_khz, dispclk, 8, 1);
	printf("UNEXPECTED: returned %u without trapping\n", bad);
	return 1;
}