#!/bin/sh
# DF-5563 baseline reproduction, variant B (rig device; isolates the
# iiconf.c module text as the freed text the parked thread resumes into).
# EXPECTS: Fatal trap 12 (page fault, supervisor read instruction) with
# the RIP inside the unloaded iicbus.ko text range, shortly after the
# kill -9.  Panics land on the serial console (host: vm.sh log).
set -e
cd /root/df5563

echo "=== load chain ==="
kldload /usr/src/sys/bus/iicbus/iicbus/iicbus.ko
kldload /boot/kernel/iicbb.ko
kldload /usr/obj/root/df5563/build_reg/iicbb_reg.ko
kldload /usr/obj/root/df5563/build_rig/df5563_rig.ko
kldload /usr/src/sys/bus/iicbus/iic/iic.ko
sleep 1

echo "=== park a requester (IIC_WAIT|IIC_INTR) with the bridge busy ==="
sysctl hw.df5563.busy=1
./park intr &
PARK=$!
sleep 2
ps -o pid,stat,wchan,command -p $PARK || true

echo "=== module text addresses BEFORE unload ==="
kldstat | grep -E 'iicbus|iicbb|df5563|iic\.ko' || true

echo "=== unload the whole stack under the parked requester ==="
kldunload iic || true
kldunload df5563_rig || true
kldunload iicbb_reg || true
kldunload iicbb || true
kldunload iicbus || true
sleep 1
kldstat || true

echo "=== signal the parked thread: it must resume into FREED text ==="
kill -9 $PARK || true
sleep 10
echo "=== guest still alive? (if you read this, no panic) ==="
ps -o pid,stat,command -p $PARK || echo "park process gone"