⬢ DragonFlyBSD Kernel Audit
DF-5005 / pll_harness.c
← back to finding ↓ download raw
/*
 * pll_harness.c — userland proof-of-arithmetic for the NEW (pass-2)
 * divide-by-zero sinks in amdgpu_pll_compute() beyond DF-2037.
 *
 * The functions amdgpu_pll_reduce_ratio(), amdgpu_pll_get_fb_ref_div() and
 * amdgpu_pll_compute() below are VERBATIM copies of
 *   sys/dev/drm/amd/amdgpu/amdgpu_pll.c lines 44..251
 * (as of this audit). Only the supporting macros (gcd, DIV_ROUND_UP,
 * DIV_ROUND_CLOSEST, min/max) are re-implemented with the exact semantics of
 *   sys/dev/drm/include/linux/gcd.h (gcd64) and
 *   sys/dev/drm/include/linux/kernel.h.
 *
 * The `struct amdgpu_pll' fields used are copied from
 *   sys/dev/drm/amd/amdgpu/amdgpu_mode.h.
 *
 * PLL limits are the ones the driver programs for every pixel PLL at
 * amdgpu_atombios.c:618-625 (min_post_div=2, max_post_div=0x7f,
 * min_ref_div=2, max_ref_div=0x3ff, min_feedback_div=4,
 * max_feedback_div=0xfff) with reference_freq=2700 (27 MHz, the value every
 * real VBIOS carries) and the pll_out fixup default 64800 (amdgpu_atombios.c:610).
 *
 * Cases:
 *   control : freq=148500 (148.5 MHz, a normal mode)      -> must NOT trap
 *   tc5     : freq=55      (tc=5: 0.55 MHz degenerate mode, non-FRAC)
 *             -> fb_div under-runs to 0 -> amdgpu_pll_reduce_ratio()
 *                DIV_ROUND_UP(nom_min, *nom=0)  -> SIGFPE   (amdgpu_pll.c:56)
 *   ref0    : reference_freq=0 (VBIOS usReferenceClock==0, unchecked at
 *             amdgpu_atombios.c:592), freq=60000
 *             -> den=0 -> DIV_ROUND_UP(den_min, *den=0) -> SIGFPE (amdgpu_pll.c:63)
 *   pd200   : flags|=AMDGPU_PLL_USE_POST_DIV, pll->post_div=200
 *             (AdjustDisplayPll ucPostDiv, u8, atombios_crtc.c:441-442)
 *             -> ref_div_max=min(128/200,1023)=0 -> ref_div=0
 *             -> diff loop divides by ref_div*post_div=0 -> SIGFPE (amdgpu_pll.c:203)
 *
 * usage: pll_harness <control|tc5|ref0|pd200>
 * exit:  0 ok (no trap),  42 = trapped SIGFPE (handler),  killed-by-SIGFPE otherwise
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
#include <stdint.h>

typedef uint32_t u32;

/* ---- sys/dev/drm/include/linux/kernel.h semantics ---- */
#define DIV_ROUND_UP(n, d)      (((n) + (d) - 1) / (d))
#define DIV_ROUND_CLOSEST(x, d) (((x) + ((d) / 2)) / (d))
#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))
#define DRM_DEBUG_KMS(fmt, ...) do { } while (0)

/* ---- sys/dev/drm/include/linux/gcd.h : gcd64, verbatim semantics ---- */
static uint64_t gcd64(uint64_t a, uint64_t b)
{
	uint64_t c;

	if (a < b) {
		uint64_t t = a; a = b; b = t;	/* swap(a, b) */
	}
	if (b == 0)
		return a;
	while ((c = a % b) != 0) {
		a = b;
		b = c;
	}
	return b;
}
static unsigned long gcd(unsigned long a, unsigned long b) { return gcd64(a, b); }

/* ---- sys/dev/drm/amd/amdgpu/amdgpu_mode.h ---- */
#define AMDGPU_PLL_USE_REF_DIV           (1 << 2)
#define AMDGPU_PLL_USE_FRAC_FB_DIV       (1 << 10)
#define AMDGPU_PLL_USE_POST_DIV          (1 << 12)
#define AMDGPU_PLL_IS_LCD                (1 << 13)
#define AMDGPU_PLL_PREFER_MINM_OVER_MAXP (1 << 14)

struct amdgpu_pll {
	uint32_t reference_freq;
	uint32_t reference_div;
	uint32_t post_div;
	uint32_t pll_in_min, pll_in_max;
	uint32_t pll_out_min, pll_out_max;
	uint32_t lcd_pll_out_min, lcd_pll_out_max;
	uint32_t min_post_div, max_post_div;
	uint32_t min_ref_div, max_ref_div;
	uint32_t min_feedback_div, max_feedback_div;
	uint32_t min_frac_feedback_div, max_frac_feedback_div;
	uint32_t best_vco;
	uint32_t flags;
};

/* ==================== VERBATIM FROM amdgpu_pll.c:44-99 ==================== */
static void amdgpu_pll_reduce_ratio(unsigned *nom, unsigned *den,
				    unsigned nom_min, unsigned den_min)
{
	unsigned tmp;

	/* reduce the numbers to a simpler ratio */
	tmp = gcd(*nom, *den);
	*nom /= tmp;
	*den /= tmp;

	/* make sure nominator is large enough */
	if (*nom < nom_min) {
		tmp = DIV_ROUND_UP(nom_min, *nom);
		*nom *= tmp;
		*den *= tmp;
	}

	/* make sure the denominator is large enough */
	if (*den < den_min) {
		tmp = DIV_ROUND_UP(den_min, *den);
		*nom *= tmp;
		*den *= tmp;
	}
}

static void amdgpu_pll_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
				      unsigned fb_div_max, unsigned ref_div_max,
				      unsigned *fb_div, unsigned *ref_div)
{
	/* limit reference * post divider to a maximum */
	ref_div_max = min(128 / post_div, ref_div_max);

	/* get matching reference and feedback divider */
	*ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
	*fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den);

	/* limit fb divider to its maximum */
	if (*fb_div > fb_div_max) {
		*ref_div = DIV_ROUND_CLOSEST(*ref_div * fb_div_max, *fb_div);
		*fb_div = fb_div_max;
	}
}

/* ==================== VERBATIM FROM amdgpu_pll.c:114-251 ==================== */
void amdgpu_pll_compute(struct amdgpu_pll *pll,
			u32 freq,
			u32 *dot_clock_p,
			u32 *fb_div_p,
			u32 *frac_fb_div_p,
			u32 *ref_div_p,
			u32 *post_div_p)
{
	unsigned target_clock = pll->flags & AMDGPU_PLL_USE_FRAC_FB_DIV ?
		freq : freq / 10;

	unsigned fb_div_min, fb_div_max, fb_div;
	unsigned post_div_min, post_div_max, post_div;
	unsigned ref_div_min, ref_div_max, ref_div;
	unsigned post_div_best, diff_best;
	unsigned nom, den;

	/* determine allowed feedback divider range */
	fb_div_min = pll->min_feedback_div;
	fb_div_max = pll->max_feedback_div;

	if (pll->flags & AMDGPU_PLL_USE_FRAC_FB_DIV) {
		fb_div_min *= 10;
		fb_div_max *= 10;
	}

	/* determine allowed ref divider range */
	if (pll->flags & AMDGPU_PLL_USE_REF_DIV)
		ref_div_min = pll->reference_div;
	else
		ref_div_min = pll->min_ref_div;

	if (pll->flags & AMDGPU_PLL_USE_FRAC_FB_DIV &&
	    pll->flags & AMDGPU_PLL_USE_REF_DIV)
		ref_div_max = pll->reference_div;
	else
		ref_div_max = pll->max_ref_div;

	/* determine allowed post divider range */
	if (pll->flags & AMDGPU_PLL_USE_POST_DIV) {
		post_div_min = pll->post_div;
		post_div_max = pll->post_div;
	} else {
		unsigned vco_min, vco_max;

		if (pll->flags & AMDGPU_PLL_IS_LCD) {
			vco_min = pll->lcd_pll_out_min;
			vco_max = pll->lcd_pll_out_max;
		} else {
			vco_min = pll->pll_out_min;
			vco_max = pll->pll_out_max;
		}

		if (pll->flags & AMDGPU_PLL_USE_FRAC_FB_DIV) {
			vco_min *= 10;
			vco_max *= 10;
		}

		post_div_min = vco_min / target_clock;
		if ((target_clock * post_div_min) < vco_min)
			++post_div_min;
		if (post_div_min < pll->min_post_div)
			post_div_min = pll->min_post_div;

		post_div_max = vco_max / target_clock;
		if ((target_clock * post_div_max) > vco_max)
			--post_div_max;
		if (post_div_max > pll->max_post_div)
			post_div_max = pll->max_post_div;
	}

	/* represent the searched ratio as fractional number */
	nom = target_clock;
	den = pll->reference_freq;

	/* reduce the numbers to a simpler ratio */
	amdgpu_pll_reduce_ratio(&nom, &den, fb_div_min, post_div_min);

	/* now search for a post divider */
	if (pll->flags & AMDGPU_PLL_PREFER_MINM_OVER_MAXP)
		post_div_best = post_div_min;
	else
		post_div_best = post_div_max;
	diff_best = ~0;

	for (post_div = post_div_min; post_div <= post_div_max; ++post_div) {
		unsigned diff;
		amdgpu_pll_get_fb_ref_div(nom, den, post_div, fb_div_max,
					  ref_div_max, &fb_div, &ref_div);
		diff = abs(target_clock - (pll->reference_freq * fb_div) /
			(ref_div * post_div));

		if (diff < diff_best || (diff == diff_best &&
		    !(pll->flags & AMDGPU_PLL_PREFER_MINM_OVER_MAXP))) {

			post_div_best = post_div;
			diff_best = diff;
		}
	}
	post_div = post_div_best;

	/* get the feedback and reference divider for the optimal value */
	amdgpu_pll_get_fb_ref_div(nom, den, post_div, fb_div_max, ref_div_max,
				  &fb_div, &ref_div);

	/* reduce the numbers to a simpler ratio once more */
	/* this also makes sure that the reference divider is large enough */
	amdgpu_pll_reduce_ratio(&fb_div, &ref_div, fb_div_min, ref_div_min);

	/* avoid high jitter with small fractional dividers */
	if (pll->flags & AMDGPU_PLL_USE_FRAC_FB_DIV && (fb_div % 10)) {
		fb_div_min = max(fb_div_min, (9 - (fb_div % 10)) * 20 + 60);
		if (fb_div < fb_div_min) {
			unsigned tmp = DIV_ROUND_UP(fb_div_min, fb_div);
			fb_div *= tmp;
			ref_div *= tmp;
		}
	}

	/* and finally save the result */
	if (pll->flags & AMDGPU_PLL_USE_FRAC_FB_DIV) {
		*fb_div_p = fb_div / 10;
		*frac_fb_div_p = fb_div % 10;
	} else {
		*fb_div_p = fb_div;
		*frac_fb_div_p = 0;
	}

	*dot_clock_p = ((pll->reference_freq * *fb_div_p * 10) +
			(pll->reference_freq * *frac_fb_div_p)) /
		       (ref_div * post_div * 10);
	*ref_div_p = ref_div;
	*post_div_p = post_div;

	DRM_DEBUG_KMS("%d - %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
		      freq, *dot_clock_p * 10, *fb_div_p, *frac_fb_div_p,
		      ref_div, post_div);
}
/* ==================== end verbatim ==================== */

static const char *g_case = "?";

static void sigfpe_handler(int sig)
{
	printf("case %-8s : TRAPPED signal %d (SIGFPE = integer divide by zero)\n",
	    g_case, sig);
	fflush(stdout);
	_exit(42);
}

/* firmware defaults exactly as amdgpu_atombios.c:592-626 programs them */
static void pll_fw_defaults(struct amdgpu_pll *p)
{
	memset(p, 0, sizeof(*p));
	p->reference_freq = 2700;	/* usReferenceClock, 27 MHz in 10 kHz units */
	p->pll_out_min = 64800;		/* driver fixup floor, :610-611 */
	p->pll_out_max = 1200000;	/* ulMaxPixelClockPLL_Output (12 GHz..any) */
	p->lcd_pll_out_min = 64800;
	p->lcd_pll_out_max = 1200000;
	p->min_post_div = 2;		/* :618 */
	p->max_post_div = 0x7f;		/* :619 */
	p->min_frac_feedback_div = 0;	/* :620 */
	p->max_frac_feedback_div = 9;	/* :621 */
	p->min_ref_div = 2;		/* :622 */
	p->max_ref_div = 0x3ff;		/* :623 */
	p->min_feedback_div = 4;	/* :624 */
	p->max_feedback_div = 0xfff;	/* :625 */
}

int main(int argc, char **argv)
{
	struct amdgpu_pll pll;
	u32 freq, dot = 0, fb = 0, frac = 0, refd = 0, postd = 0;

	if (argc != 2) {
		fprintf(stderr, "usage: %s <control|tc5|ref0|pd200>\n", argv[0]);
		return 2;
	}
	g_case = argv[1];
	signal(SIGFPE, sigfpe_handler);

	pll_fw_defaults(&pll);

	if (!strcmp(g_case, "control")) {
		freq = 148500;			/* plain 148.5 MHz DVI mode */
	} else if (!strcmp(g_case, "tc5")) {
		freq = 55;			/* tc = 55/10 = 5 (0.55 MHz) */
	} else if (!strcmp(g_case, "ref0")) {
		pll.reference_freq = 0;		/* VBIOS usReferenceClock == 0 */
		freq = 60000;
	} else if (!strcmp(g_case, "pd200")) {
		pll.flags |= AMDGPU_PLL_USE_POST_DIV;
		pll.post_div = 200;		/* AdjustDisplayPll ucPostDiv */
		freq = 60000;
	} else {
		fprintf(stderr, "unknown case %s\n", g_case);
		return 2;
	}

	printf("case %-8s : freq=%u ref=%u flags=0x%x post_div=%u -> computing...\n",
	    g_case, freq, pll.reference_freq, pll.flags, pll.post_div);
	fflush(stdout);

	amdgpu_pll_compute(&pll, freq, &dot, &fb, &frac, &refd, &postd);

	printf("case %-8s : COMPLETED dot=%u fb=%u.%u ref=%u post=%u (no trap)\n",
	    g_case, dot, fb, frac, refd, postd);
	return 0;
}