#!/bin/sh
# DF-4247 trigger documentation.
#
# VERIFIED PATH (this pack): the rig extracts the entire production parser
# (processpptables.c:37-1706) byte-identical and drives it with crafted
# PowerPlay tables -- see rig/ and run.log. This script documents the
# in-kernel trigger for hardware that has an AMD ASIC:
#
# 1. Craft a PowerPlay table binary (ATOM_PPLIB_POWERPLAYTABLE5):
#    - usVddcDependencyOnSCLKOffset = 0xFF00 (u16 offset far past a small table), or
#    - dependency table near image end with ucNumEntries = 0xFF and few records, or
#    - V2 StateArray state with nonClockInfoIndex/clockInfoIndex = 0xFF, or
#    - extended header -> VCE/UVD tables with index bytes = 0xFF, or
#    - a ROM image WITHOUT a FirmwareInfo data table (NULL fw_info deref).
# 2. On smu7/smu8 hardware (PP_TABLE_V0: Tonga/Polaris/Baffin/Carrizo/Stoney):
#        cat crafted.bin > /sys/class/drm/card0/device/pp_table
#    amd_powerplay_reset() -> pptable_init -> init_overdrive_limits /
#    init_clock_voltage_dependency / pp_tables_get_entry -> OOB reads past
#    soft_pp_table (info leak into dyn_state -> sysfs) or NULL-deref panic.
# 3. Unpatched: OOB read values become dyn_state clock/voltage entries
#    (kernel-heap info leak via pp_dpm_sclk etc.); patched (fix.diff):
#    sub-table skipped / count clamped / index rejected -- no OOB.
#
# On the audit guest this is hardware-gated (no 1002: PCI device) -- the rig
# provides the reproduction instead. See hw_probe.log / env.txt.
echo "in-kernel trigger requires an AMD ASIC (see header comment);"
echo "verified reproduction: cd rig && sh ./build.sh /usr/src && sh ./run.sh"