#!/bin/sh
# DF-5509 — END-TO-END attach-window storm (the boot-time defect, exercised
# through the real kldunload/attach path with 100% stock driver code).
#
# Precondition simulated (on real hardware this state is left by the BIOS
# during EHCI ownership handoff, or set by a malicious/compromised
# controller): USBINTR.PCD enabled + a pending port-change event with the
# ehci driver not yet attached -> INTx line asserted level-high.
#
# Then `kldload ehci` runs the REAL ehci_pci_attach:
#   ehci_pci.c:391  bus_setup_intr          <- handler goes LIVE here
#   ehci_pci.c:398  ehci_pci_take_controller
#   ehci_pci.c:451  ehci_init -> ehci.c:335 ehci_hcreset (first clearing)
# Between the first two lines the handler is armed with sc_offs=0 and
# sc_eintrs=0 (M_ZERO softc): ehci_interrupt reads "USBSTS" from MMIO+0x04
# (HCSPARAMS) and takes `goto done' WITHOUT acknowledging (ehci.c:1504-1513)
# -> the level INTx re-fires forever -> IRQ storm / machine live-lock.
set -e

echo "== [0] unload ehci (clean detach: ehci_detach writes USBINTR=0 + reset)"
kldunload ehci
sleep 1
pciconf -l | grep -i ehci || true

echo "== [1] arm the un-owned controller (root stand-in for BIOS residue)"
kenv ehciarm.mode=2
kldload /root/ehciarm/ehciarm.ko
kenv -u ehciarm.mode

echo "== [2] HOST: QEMU monitor -> device_add usb-kbd,id=k1,bus=ehci0.0,port=1"
echo "==     (sets USBSTS.PCD; INTx asserts now, handler not yet loaded)"

echo "== [3] guest resumes when the storm is bounded (or wedges if not):"
echo "kldload ehci"