⬢ DragonFlyBSD Kernel Audit
DF-4737 / guest_hw_evidence.txt
← back to finding ↓ download raw
DF-4737 hardware gate evidence (audit QEMU guest, DragonFly 6.5-DEVELOPMENT)

$ pciconf -l
hostb0@pci0:0:0:0:   class=0x060000 card=0x11001af4 chip=0x12378086 rev=0x02 hdr=0x00
isab1@pci0:0:1:0:    class=0x060100 card=0x11001af4 chip=0x70008086 rev=0x00 hdr=0x00
atapci0@pci0:0:1:1:  class=0x010180 card=0x11001af4 chip=0x70108086 rev=0x00 hdr=0x00
none0@pci0:0:1:3:    class=0x068000 card=0x11001af4 chip=0x71138086 rev=0x03 hdr=0x00
vgapci0@pci0:0:2:0:  class=0x030000 card=0x11001af4 chip=0x11111234 rev=0x02 hdr=0x00
virtio_pci0@pci0:0:3:0: class=0x020000 card=0x00011af4 chip=0x10001af4 rev=0x00 hdr=0x00
virtio_pci1@pci0:0:4:0: class=0x010000 card=0x00021af4 chip=0x10011af4 rev=0x00 hdr=0x00

-> No vendor=0x1022 (AMD) device, no vendor=0x10de (nVIDIA) device.
   (amdpm attaches only to 1022:740b/7413/7443/746b or 10de:01b4 — none present.
   The 8086:7113 PIIX4 PMU belongs to intpm(4), not amdpm(4).)

$ pciconf -l | grep -Eic "vendor=0x1022|vendor=0x10de|0x0607"
0

$ kldload amdpm ; echo $?
0
$ kldstat -v | grep amdpm
 5    1 0xffffffff82600000    19000 amdpm.ko (/boot/kernel/amdpm.ko)
		326 amdpm/smbus
$ devinfo | grep -ci "amdpm|cbb"
0                       <- module loaded but attaches to nothing

$ ls -l /dev/smb*
ls: /dev/smb*: No such file or directory      <- no smbus children, no userspace entry

=> The in-kernel amdpm_wait() path cannot execute on this guest; logic proven
   by the guest-run replica (run.log). kldunload amdpm performed afterwards;
   guest returned clean.