#!/bin/sh
# DF-4744 — detach/in-flight-interrupt race exerciser.
#
# !!! NOT RUN by the reviewer: the audit QEMU guest has NO AHCI controller
# !!! (see env.txt — pciconf shows no class 0x0106 device, storage is virtio).
# !!! This script is the recipe for hardware that DOES have a secondary AHCI
# !!! controller, per VERDICT.md §3. Deterministic demonstration additionally
# !!! needs a debug kernel with a DELAY() inside ahci_intr() after the
# !!! AHCI_F_INT_GOOD check (widens the window; see VERDICT.md).
#
# Preconditions:
#   * root on the test box
#   * boot disk NOT on the ahci controller under test
#   * a spare disk on ahciN (here assumed da1)
#   * for a deterministic hit: instrumented kernel as described in VERDICT.md
#
# Success criterion (unpatched kernel): panic in ahci_intr/ahci_port_intr
# (UAF deref or fault on unmapped ABAR) during the detach loop.
# With fix.diff applied: detach returns cleanly, no panic, over many rounds.

CTRL=ahci0
DISK=/dev/da1
ROUNDS=200

for i in $(seq 1 $ROUNDS); do
    # streaming raw reads to keep the controller interrupting
    dd if=$DISK of=/dev/null bs=1m count=2000 >/dev/null 2>&1 &
    DDPID=$!
    sleep 0.3
    devctl detach $CTRL 2>/dev/null
    wait $DDPID 2>/dev/null
    devctl probe $CTRL 2>/dev/null || break   # re-probe to re-attach for next round
    sleep 1
done
echo "survived $i rounds"