#!/bin/sh
# DF-5149 runtime trigger: demonstrate that the pps driver (which has no
# device_detach, sys/dev/misc/pps/pps.c:190-197) cannot be torn down, and
# that on this guest the pps attack surface is not instantiated at all:
# the driver is compiled into neither the builtin kernel nor any module,
# and QEMU exposes no ISA parallel port, so even with ppbus.ko loaded no
# ppbus bus instance (and hence no pps child / /dev/ppsN) can ever appear.
#
# Run as root on the DragonFly guest. Safe: read-only probes + a load/
# unload round-trip of ppbus.ko (which attaches nothing and unloads
# cleanly because it owns zero devices). Expected outcome (see run.log):
#   - no pps/ppbus drivers registered (kldstat -v)
#   - no pps.ko in /boot/kernel (only ppbus.ko, the bus half)
#   - no ppbus/lpt/ppi/pps devices in X86_64_GENERIC
#   - kldload ppbus -> no new dmesg attach lines, no /dev/pps*|/dev/lpt*|/dev/ppi*
#   - kldunload ppbus -> rc=0 (nothing was instantiated)
#   - guest stays up, no fault

echo "== uname =="
uname -a
echo
echo "== pps driver registered anywhere? =="
kldstat -v 2>/dev/null | grep -iE "pps|ppbus"
echo "grep-rc=$? (1 = pps/ppbus drivers not registered)"
echo
echo "== pps.ko module present? =="
ls /boot/kernel | grep -E "^pp"
echo
echo "== pps in kernel config? =="
grep -nE "ppbus|lpt|ppi|pps" /usr/src/sys/config/X86_64_GENERIC
echo "cfg-rc=$?"
echo
echo "== /dev/pps* =="
ls -l /dev/pps* 2>&1
echo
echo "== kldload ppbus and look for a parallel-port bus instance =="
kldload ppbus && echo ppbus-loaded
dmesg | tail -4
ls -l /dev/pps* /dev/lpt* /dev/ppi* 2>&1
kldunload ppbus
echo "ppbus-unload-rc=$? (0 = no device ever attached, bus left no residue)"
echo
echo "== guest alive =="
uptime