#!/bin/sh
# DF-5213 trigger/proof script.
#
# There is no userspace trigger for this latent NULL-deref: the vtable
# slot is consumed on the display-off / init path of a VEGA20 ASIC, and
# the sole call site is currently asic-gated to VEGA10. The proof is:
#  (a) source facts: df_v3_6_funcs omits .enable_ecc_force_par_wr_rmw
#      (NULL by designated-initializer rules) while the struct declares
#      it, and the single caller is CHIP_VEGA10-gated;
#  (b) runtime probe: this host has no AMD GPU at all (a VEGA20 board
#      plus a widened asic gate would be needed to observe the panic).
#
# Run on a DragonFly host with the kernel source in /usr/src:
echo "== struct member (declared for ALL df_funcs implementations) =="
grep -n "enable_ecc_force_par_wr_rmw" \
    /usr/src/sys/dev/drm/amd/amdgpu/amdgpu.h
echo
echo "== sole call site (gated on CHIP_VEGA10) =="
sed -n '753,764p' /usr/src/sys/dev/drm/amd/amdgpu/gmc_v9_0.c
echo
echo "== CHIP_VEGA20 gets df_v3_6_funcs =="
grep -n "df_v3_6_funcs" /usr/src/sys/dev/drm/amd/amdgpu/soc15.c
echo
echo "== df_v3_6_funcs: 6 of 7 members initialized (ecc op missing => NULL) =="
sed -n '108,116p' /usr/src/sys/dev/drm/amd/amdgpu/df_v3_6.c
echo
echo "== hardware probe =="
pciconf -l | grep -i "0x1002"
echo "AMD_GREP_RC=$?"
pciconf -l | grep -iE "0x66a"
echo "VEGA20_GREP_RC=$?"