# DF-4450 — PSR2 EDP_PSR2_CTL 4-bit field overflow via sink-reported resync latency

## What this pack contains

A deterministic, hardware-free reproduction of the *register-encoding defect*
in `hsw_activate_psr2()` (`sys/dev/drm/i915/intel_psr.c:410-443`): the demo
mirrors the kernel arithmetic exactly and shows that a sink reporting
`DP_SYNCHRONIZATION_LATENCY_IN_SINK = 0x0F` (the maximum value allowed by
`DP_MAX_RESYNC_FRAME_COUNT_MASK`, include/drm/drm_dp_helper.h:800) makes the
driver write an `EDP_PSR2_CTL` value in which three independent 4-bit timing
fields are corrupted by adjacent-field spill.

## Build / run

```
./build.sh    # cc -O2 -o /tmp/psr2_reg_demo /tmp/psr2_reg_demo.c
./run.sh      # /tmp/psr2_reg_demo
```

(On the audit host the source is `psr2_reg_demo.c`; it was transferred to the
DF guest, compiled with the guest's cc 8.3, and executed there — see
`build.log` / `run.log` / `env.txt`.)

## Expected output (decisive lines)

```
latency=14 (max legal)  EDP_PSR2_CTL=0xc00002ff -> IDLE_FRAME=15  FRAME_BEFORE_SU=15  TP2_TIME=2500us
latency=15 (SPILLS!)    EDP_PSR2_CTL=0xc0000310 -> IDLE_FRAME=0   FRAME_BEFORE_SU=1   TP2_TIME=50us
```

At latency=15 the kernel computes `idle_frames = max(6, 15+1) = 16` and
`EDP_PSR2_FRAME_BEFORE_SU(16)`:

* `16 << 0` (intel_psr.c:421) spills bit 4 into FRAME_BEFORE_SU — the
  IDLE_FRAME field reads back **0**, silently dropping below the HW minimum
  of 6 frames the code explicitly tries to enforce (intel_psr.c:415-418).
* `16 << 4 = 0x100` (intel_psr.c:430) spills bit 8 into TP2_TIME; OR'ed with
  the requested 2500us encoding (`2<<8`), the 2-bit TP2_TIME field becomes
  `3` = **50us** — the opposite of the requested value.

## Why no kernel-side run

The kernel manifestation requires an Intel display engine (HSW+) driving a
PSR2-capable eDP sink that reports resync latency 0xF. The audit guest has
**virtio-gpu only** (`pciconf -l`: `vgapci0 ... chip=0x11111234`), so `i915`
cannot bind; the write to `EDP_PSR2_CTL` (a device MMIO at 0x6f900) cannot be
exercised there. The arithmetic is reproduced exactly; the MMIO effect is
hardware-bound.