⬢ DragonFlyBSD Kernel Audit
DF-4203 / race.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-4203 live arming attempt: race the UNLOCKED re-entrant probe
# (ahci_cam.c:989-990 XPT_SCSI_IO -> ahci_cam_probe with only ap_sim_lock)
# against concurrent port activity, with at->at_probe force-set to
# ATA_PROBE_NEED_IDENT (normally only produced by ahci_pm.c:876, which
# needs port-multiplier hardware this guest lacks).
LOG=/root/df4203.log
: > $LOG
echo "=== df4203 race start $(date +%T)" >> $LOG
kldload /root/rig/df2420rig.ko >> $LOG 2>&1

# concurrent disk IO on the same port (drives ahci_port_intr on intr cpu)
for i in 1 2 3 4; do
	( end=$(( $(date +%s) + 75 ))
	  while [ $(date +%s) -lt $end ]; do
		dd if=/dev/da0 of=/dev/null bs=1m count=64 2>>$LOG
	  done ) &
done

# locked-probe side: XPT_RESET_DEV -> ahci_port_reset + state machine probes
( end=$(( $(date +%s) + 70 ))
  while [ $(date +%s) -lt $end ]; do
	camcontrol reset da0 >> $LOG 2>&1
	sleep 1
  done ) &

# unlocked-probe side: XPT_SCSI_IOs (every one sees NEED_IDENT while armed)
( end=$(( $(date +%s) + 70 )); n=0; e=0
  while [ $(date +%s) -lt $end ]; do
	out=$(/root/ahcipoc read10 2>&1)
	case "$out" in *CAM_REQ_CMP*|*status=0x11*) n=$((n+1));; *) e=$((e+1));; esac
  done
  echo "pass ccb ok=$n odd=$e" >> $LOG ) &

sleep 2
# the arm storm itself (45s of NEED_IDENT re-arming)
sysctl dev.df2420rig="arm 0 45" >> $LOG 2>&1
echo "=== arm storm done $(date +%T)" >> $LOG
wait
echo "=== df4203 race done $(date +%T)" >> $LOG
uptime >> $LOG