#!/bin/sh
# DF-2799 run — HOST-side driver (the guest kernel wedges by design, so
# every guest command is issued through vm.sh run_root/run_user with
# timeouts).  Binaries staged in /tmp/df2799 (executables by both root
# and the unprivileged user).
#
# Expect on stock kernel:  LISTONCE-RC:124 and JAILONCE-RC:124
#   (kern.jail.list read blocks forever in sysctl_jail_list on jail_lock;
#    a new jail(2) blocks forever on jail_lock in sys_jail)
#   while plain `echo`/`date` still work => targeted kernel-lock deadlock.
# Expect on patched kernel: both rc=0, storm survives, guest healthy.
set -x
V=dfbsd-qemu/vm.sh
D=/tmp/df2799

# sanity: markers are fast before the storm
$V run_root "cd $D && timeout 10 ./listonce; echo PRE-LISTONCE-RC:\$?; timeout 10 ./jailonce; echo PRE-JAILONCE-RC:\$?"

# 4 unprivileged readers across the 6 CPUs (world-readable sysctl, no privs)
$V run_user "cd $D; nohup ./jailistreader 0 > /tmp/reader1.log 2>&1 & nohup ./jailistreader 0 > /tmp/reader2.log 2>&1 & nohup ./jailistreader 0 > /tmp/reader3.log 2>&1 & nohup ./jailistreader 0 > /tmp/reader4.log 2>&1 & sleep 1; pgrep -c jailistreader"

# root churn: jail(2) create/destroy loop
$V run_root "cd $D && nohup ./jailchurn 200000 > /tmp/churn.log 2>&1 & sleep 2; echo CHURN-STARTED"

sleep 10

# markers with timeout — 124 == wedged
$V run_root "cd $D && timeout 15 ./listonce; echo LISTONCE-RC:\$?"
$V run_root "cd $D && timeout 15 ./jailonce; echo JAILONCE-RC:\$?"

# proof the host part is still alive (kernel-lock deadlock, not a crash):
# plain syscalls that need neither lock still return
$V run_root 'echo STILL-ALIVE; date; ps ax | grep -E "jailchurn|jailistreader" | grep -v grep | head -14'

$V log 40