#!/bin/sh
# DF-1042 run -- load the harness and observe whether the OOB write fires.
#
# Must run as root (kldload).  This is expected: the bug is a boot-time,
# firmware-data path, not a userspace syscall -- there is no unprivileged
# trigger.  The harness is the dynamic proof-of-primitive.
#
# Expected on the UNPATCHED kernel (#0):
#   DF1042: AFTER  lapic_set_cpuid(1,256): cpu_id_to_apic_id[0]=1 [1]=256
#   DF1042: OOB WRITE CONFIRMED -- apic_id_to_cpu_id[256] OOB write clobbered cpu_id_to_apic_id[0]
#
# Expected on the PATCHED kernel (#1, fix.diff applied):
#   lapic_set_cpuid: invalid cpu_id 1 apic_id 256, skipping
#   DF1042: AFTER  lapic_set_cpuid(1,256): cpu_id_to_apic_id[0]=0 [1]=1
#   DF1042: no corruption -- apic_id_to_cpu_id[256] OOB write did not reach
cd "$(dirname "$0")"
KO=$(ls /usr/obj$(pwd)/df1042.ko /usr/obj/*/$(pwd)/df1042.ko 2>/dev/null | head -1)
[ -z "$KO" ] && KO=$(find /usr/obj -name df1042.ko -newer df1042_harness.c 2>/dev/null | head -1)
cp "$KO" /root/df1042.ko
kldload /root/df1042.ko 2>&1
echo "--- dmesg (DF1042) ---"
dmesg | grep -E 'DF1042|lapic_set_cpuid: invalid' | tail -10
kldunload df1042 2>/dev/null || true