#!/bin/sh
# DF-0793 run: demonstrates the async-TRIM code path on FFS.
#
# This needs root to (a) kldload the asyncd disk module and (b) issue the
# mount(2)/unmount(2) syscalls.  vfs.usermount=0 on the default guest, so an
# unprivileged user cannot reach the FFS TRIM path at all (see VERDICT.md).
#
# What this shows on the UNPATCHED audit kernel:
#   - mount("ufs",MP,MNT_TRIM) succeeds (kernel sets MNT_TRIM w/o device check)
#   - 0 FREEBLKS bios reach the device  -> ffs_blkfree took the synchronous
#     branch; the async-TRIM store/defer code never ran (DF-0793 unreachable).
#
# Requires the asyncd KLD to be built (./build.sh) and the guest to have
# /usr/src for the KLD build.  Run from the host with vm.sh or directly on
# the guest as root.
set -e
DEV=/dev/asyncd0s0
MP=/mnt/df0793

# 1. load the async-TRIM disk (completes FREEBLKS after a 2s callout delay)
[ -f asyncd.ko ] || make KMOD=asyncd
kldload ./asyncd.ko 2>/dev/null || true
dmesg | grep asyncd0 | tail -1

# 2. fresh FFS image on the async disk
newfs $DEV >/dev/null 2>&1
mkdir -p $MP

# 3. the harness mounts ufs+trim via direct syscall, writes, unlinks, umounts
#    (trim_uaf uses /dev/vn0 by default; override with arg if needed)
./trim_uaf 5

echo "FREEBLKS count: $(dmesg | grep -c 'asyncd: FREEBLKS')"
echo "On the unpatched kernel this prints 0  -> DF-0793 TRIM path is dead code."