#!/bin/sh
# DF-5666 guest-live introspection for sys/platform/pc64/x86_64/bios.c
#
# Questions answered, with the expected decisive output:
#  (1) What does pc64 bios.c provide?        -> bios_sigsearch is a live kernel text symbol
#  (2) Who reaches it, and when?             -> ipmi(4) only; NOT in X86_64_GENERIC; module-only,
#                                              not loaded on this guest => function never executes
#                                              in the default configuration
#  (3) Buffer math / scan window reality     -> the scanned physical window 0xe0000-0xfffff is
#                                              mapped, firmware-controlled, and (on SeaBIOS)
#                                              contains a valid 16-byte-aligned "_SM_" anchor at
#                                              0xf59c0 — exactly what the sole in-tree caller
#                                              (constant args 0xf0000,"_SM_",4,0x10,0) would match
#  (4) Attacker model                        -> data in the window is firmware-written ROM/reserved
#                                              area; no user-controlled input reaches any argument
#
# Host-side usage:
#   dfbsd-qemu/vm.sh run_root "$(cat introspect.sh)"
# (this exact invocation produced introspection.log)

echo '== (0) guest =='
uname -a

echo '== (1) bios_sigsearch is a live symbol in /boot/kernel/kernel =='
nm /boot/kernel/kernel | grep bios_sigsearch
echo '(no bios16/bios32 symbols expected:)'
nm /boot/kernel/kernel | grep -E 'bios16|bios32' || echo '  none - pc64 bios.c provides only bios_sigsearch (stub comment at bios.c:30-34)'

echo '== (2) reachability: ipmi(4) is module-only and not loaded =='
kldstat -v 2>/dev/null | grep -i ipmi && echo '  ipmi LOADED' || echo '  ipmi not loaded (kldstat -v)'
ls -la /boot/kernel/ipmi.ko 2>/dev/null || echo '  no ipmi.ko'
grep -c ipmi /usr/src/sys/config/X86_64_GENERIC 2>/dev/null && echo '  ipmi IS in GENERIC config' || echo '  ipmi NOT compiled into X86_64_GENERIC => bios_sigsearch does not run at boot'
ls /dev/ipmi* 2>/dev/null || echo '  no /dev/ipmi* node'

echo '== (3) the scanned window 0xe0000-0xfffff (firmware data, mapped) =='
echo '-- first 16 bytes at 0xf0000 (dd bs=16 skip=61440 = 0xf0000/16) --'
dd if=/dev/mem bs=16 skip=61440 count=1 2>/dev/null | hexdump -C
echo '-- "_SM_" / "_DMI_" / SeaBIOS anchors inside 0xf0000-0x100000 --'
dd if=/dev/mem bs=64k skip=14 count=2 2>/dev/null | hexdump -C | grep -E '_SM_|_DMI_|SeaBIOS' | head -8

echo '== (4) no SMBIOS/ipmi consumers active in this boot =='
dmesg | grep -iE 'smbios|ipmi' | head -5 || true
sysctl -a 2>/dev/null | grep -i smbios || echo '  no smbios sysctl on pc64 (sole consumer is ipmi_smbios.c)'
echo '== done =='