/*
 * Proof-of-concept test case for Ceph CRUSH mapper GCC 101175 bug
 * 
 * This test demonstrates the potential undefined behavior in crush_ln()
 * when __builtin_clz() is called with zero argument.
 * 
 * Can be integrated into existing Ceph unit test framework or adapted
 * for KUnit testing as suggested by Slava.
 */

#include <stdio.h>
#include <stdint.h>
#include <assert.h>

/* Simplified version of the problematic crush_ln function */
static uint64_t crush_ln_original(unsigned int xin)
{
    unsigned int x = xin;
    int iexpon = 15;
    
    x++;
    
    /* This is where the bug can occur */
    if (!(x & 0x18000)) {
        /* PROBLEMATIC: no zero check before __builtin_clz */
        int bits = __builtin_clz(x & 0x1FFFF) - 16;
        x <<= bits;
        iexpon = 15 - bits;
    }
    
    return (uint64_t)x | ((uint64_t)iexpon << 32);
}

/* Fixed version with zero check */
static uint64_t crush_ln_fixed(unsigned int xin)
{
    unsigned int x = xin;
    int iexpon = 15;
    
    x++;
    
    if (!(x & 0x18000)) {
        uint32_t masked = x & 0x1FFFF;
        /* FIXED: add zero check */
        int bits = masked ? __builtin_clz(masked) - 16 : 16;
        x <<= bits;
        iexpon = 15 - bits;
    }
    
    return (uint64_t)x | ((uint64_t)iexpon << 32);
}

/* Test function to find problematic input values */
void test_crush_ln_edge_cases(void)
{
    printf("=== Ceph CRUSH Mapper GCC 101175 Bug Test ===\n\n");
    
    /* Test values that could trigger the bug */
    unsigned int problematic_inputs[] = {
        0x17FFF,    /* x+1 = 0x18000, (x+1 & 0x18000) = 0x18000 - not triggered */
        0x7FFF,     /* x+1 = 0x8000,  (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0x8000 - safe */
        0xFFFF,     /* x+1 = 0x10000, (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0x10000 - safe */
        0x7FFFF,    /* x+1 = 0x80000, (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0 - PROBLEMATIC! */
        0x9FFFF,    /* x+1 = 0xA0000, (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0 - PROBLEMATIC! */
        0xBFFFF,    /* x+1 = 0xC0000, (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0 - PROBLEMATIC! */
        0xDFFFF,    /* x+1 = 0xE0000, (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0 - PROBLEMATIC! */
        0xFFFFF,    /* x+1 = 0x100000, (x+1 & 0x18000) = 0 and (x+1 & 0x1FFFF) = 0 - PROBLEMATIC! */
    };
    
    int num_tests = sizeof(problematic_inputs) / sizeof(problematic_inputs[0]);
    int bugs_found = 0;
    
    printf("Testing %d potentially problematic input values:\n\n", num_tests);
    printf("Input    | x+1      | Condition Check | Masked Value | Status\n");
    printf("---------|----------|-----------------|--------------|--------\n");
    
    for (int i = 0; i < num_tests; i++) {
        unsigned int input = problematic_inputs[i];
        unsigned int x = input + 1;
        bool condition_met = !(x & 0x18000);
        unsigned int masked = x & 0x1FFFF;
        
        printf("0x%06X | 0x%06X | %-15s | 0x%05X    | ", 
               input, x, 
               condition_met ? "TRUE" : "FALSE", 
               masked);
        
        if (condition_met && masked == 0) {
            printf("BUG! Zero passed to __builtin_clz\n");
            bugs_found++;
        } else if (condition_met) {
            printf("Safe (non-zero argument)\n");
        } else {
            printf("Condition not met (safe)\n");
        }
    }
    
    printf("\n=== Summary ===\n");
    printf("Total tests: %d\n", num_tests);
    printf("Potential bugs found: %d\n", bugs_found);
    
    if (bugs_found > 0) {
        printf("\n⚠️  WARNING: Found inputs that could trigger undefined behavior!\n");
        printf("These inputs cause __builtin_clz(0) to be called, which has\n");
        printf("undefined behavior when compiled with GCC 11.1.0 -march=x86-64-v3 -O1\n");
    } else {
        printf("\n✅ No obvious problematic inputs found in this test set.\n");
    }
    
    /* Test that fixed version handles problematic cases */
    if (bugs_found > 0) {
        printf("\n=== Testing Fixed Version ===\n");
        for (int i = 0; i < num_tests; i++) {
            unsigned int input = problematic_inputs[i];
            unsigned int x = input + 1;
            if (!(x & 0x18000) && (x & 0x1FFFF) == 0) {
                uint64_t result = crush_ln_fixed(input);
                printf("Fixed version handles input 0x%06X -> result 0x%016lX\n", 
                       input, result);
            }
        }
    }
}

int main(void)
{
    printf("NOTE: This is a proof-of-concept test case to demonstrate\n");
    printf("      the potential GCC 101175 bug in Ceph's crush_ln().\n");
    printf("      Maintainers can compile and run this to verify the issue.\n\n");
    
    test_crush_ln_edge_cases();
    
    printf("\n=== Compilation Test ===\n");
    printf("To reproduce the GCC bug, compile with:\n");
    printf("gcc -march=x86-64-v3 -O1 -S -o test_crush.s ceph_poc_test.c\n");
    printf("Then examine the assembly for BSR instructions without zero checks.\n");
    
    return 0;
}

/*
 * Expected problematic assembly with GCC 11.1.0 -march=x86-64-v3 -O1:
 * 
 * In crush_ln_original, you might see:
 *     bsr eax, [masked_value]    # <-- UNDEFINED if masked_value is 0
 *     
 * While crush_ln_fixed should generate proper conditional logic or use LZCNT.
 * 
 * Integration suggestions for Ceph:
 * 1. Add this as a KUnit test in net/ceph/
 * 2. Include in existing Ceph test suite
 * 3. Add to crush unit tests
 */