#!/bin/sh
# DF-4926 race driver — run as ROOT on the DragonFly guest.
# Prerequisites (see run.sh): /home/testnv/nvmm_race built, testnv in
# group nvmm, goracer.sh wrapper present, nvmm.ko available.
# Expected result: kernel panic while the driver runs (NULL nvmm_impl
# deref inside nvmm_ioctl during nvmm_fini(); the guest goes down).
set -x
kldload nvmm 2>/dev/null; true

# unprivileged side (group nvmm), backgrounded via its #!/bin/sh wrapper
# (su -m executes -c via the *current* shell, which may be csh and cannot
# parse ">/tmp/race.log 2>&1").
su -m testnv -c /home/testnv/goracer.sh &
sleep 2

# admin side: repeatedly unload/reload while the unpriv user storms ioctls
# (~1.1M NVMM_IOC_CAPABILITY/s + ~20k machine create/destroy cycles/s).
# Each kldunload that passes the (unsynchronized) nmachines==0 check at
# nvmm_dragonfly.c:369 runs nvmm_fini() with the device still live.
i=0
while [ $i -lt 40 ]; do
	i=$((i + 1))
	kldunload nvmm
	rc=$?
	sleep 0.3
	if [ $rc -ne 0 ]; then
		kldload nvmm 2>/dev/null
		sleep 0.3
	fi
done

# final unload WITHOUT reload
kldunload nvmm 2>/dev/null || true

sleep 8
pkill nvmm_race 2>/dev/null || true
echo "driver done (guest still alive?)"