#!/bin/sh
# DF-4884 trigger / precondition check.
#
# The bug fires during amdgpu driver attach when ALL six VBIOS read methods
# fail. The failing method has already done:
#     kfree(adev->bios);   /* adev->bios NOT set to NULL */
# and the unconditional kfree(adev->bios) in amdgpu_device_fini() then
# double-frees it on the probe-failure teardown path.
#
# Concrete trigger configuration (any ONE suffices to make the last-touching
# read method allocate + free while every other method also fails):
#   * ACPI VFCT table with a PCI-matching image whose content fails
#     check_atom_bios()  -> amdgpu_acpi_vfct_bios() dangles (amdgpu_bios.c:428)
#   * ATRM present, returns short/garbage -> atrm path dangles (amdgpu_bios.c:354)
#   * ROM BAR mappable but content invalid -> amdgpu_read_bios() dangles
#     (amdgpu_bios.c:145); this is the LAST toucher for CIK/VI ASICs because
#     cik/vi_read_disabled_bios() call amdgpu_read_bios() again (cik.c:922,
#     vi.c:406) and from_rom/platform methods early-out without clearing
#   * IGP VRAM copy invalid -> igp_read_bios_from_vram() dangles (amdgpu_bios.c:116)
#
# Then: boot with the card installed / kldload amdgpu. The probe fails with
# "Unable to locate a BIOS ROM" and the teardown double-frees.

AMD_VGA=$(pciconf -l 2>/dev/null | grep -c '0x1002')
AMD_CLASS=$(pciconf -lv 2>/dev/null | grep -c -i 'class.*0x03.*0x1002')

echo "PRECONDITION: AMD display device present ............. $([ "$AMD_VGA" -gt 0 ] && echo PRESENT || echo 'ABSENT (cannot test)')"
echo "PRECONDITION: amdgpu attach path reachable .......... $([ "$AMD_VGA" -gt 0 ] && echo YES || echo UNREACHABLE)"

if [ "$AMD_VGA" -eq 0 ]; then
    echo "=> not_reproduced on this guest: no AMD PCI device; amdgpu never probes."
    echo "   (see VERDICT.md for the code trace proving the double-free)"
    exit 1
fi

echo "Trigger: force all BIOS read methods to fail, then watch the probe:"
echo "  - corrupt VFCT image / disable ROM shadow / garbage ROM BAR content"
echo "  - kldload amdgpu  (or boot)"
echo "  - expect: 'Unable to locate a BIOS ROM' + slab double-free panic /"
echo "    heap corruption in amdgpu_device_fini teardown"