#!/bin/sh
# DF-5334 trigger: attach the stock QEMU "usb-net" CDC/RNDIS gadget to a
# DragonFly master guest.  No custom device needed - the *stock* QEMU
# usb-net (RNDIS+CDC dual configuration) drives cdce_attach() into its
# "No valid alternate setting found" failure branch, which calls
# cdce_detach() on a never-attached usb_ether -> kernel panic
# (write/read through NULL: fault VA = 0x0).
#
# Usage (from dfbsd-qemu/, guest powered off, disk reverted to a clean
# snapshot with STOCK /boot/kernel/if_cdce.ko + uether.ko):
#
#   QEMU_EXTRA="-device piix3-usb-uhci,id=uhci0 \
#               -netdev user,id=n1 \
#               -device usb-net,bus=uhci0.0,netdev=n1" ./vm.sh up
#
# Expected on an UNPATCHED guest: boot stops with
#   cdce0: <QEMU USB Net RNDIS Control Interface> on usbus0
#   cdce0: No valid alternate setting found
#   Fatal trap 12: page fault while in kernel mode
#   fault virtual address = 0x0
#   Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi
# and SSH never comes up (vm.sh up times out; guest sits in DDB).
#
# Hot-plug variant (guest already running, needs a USB controller):
#   python3 moncmd.py "device_add usb-net,id=net0,bus=uhci0.0,port=1,netdev=n1"
# (panicked the guest the same way when first tried via qemu-xhci.)
set -e
cd "$(dirname "$0")"
exec qemu-system-x86_64 \
    -enable-kvm -m 4096 -smp 6 \
    -drive file=disk.qcow2,if=virtio,format=qcow2 \
    -device piix3-usb-uhci,id=uhci0 \
    -netdev user,id=n1 \
    -device usb-net,bus=uhci0.0,netdev=n1 \
    -netdev user,id=n0,hostfwd=tcp:127.0.0.1:5522-:22 \
    -device virtio-net-pci,netdev=n0 \
    -display none \
    -monitor unix:boot-mon.sock,server,nowait \
    -serial unix:serial.sock,server,nowait \
    -daemonize -pidfile vm.pid