#!/bin/sh
# B8A read-only WLAN/WCNSS audit. Runs on the board (busybox ash).
# Writes ONLY into $O (tmpfs /tmp). No sysfs/DT/eMMC writes, no module loads, no interface creation.
O=/tmp/b8a; rm -rf $O; mkdir -p $O
h() { echo; echo "### $*"; }
c() { echo; echo "\$ $*"; sh -c "$*" 2>&1; }
PAT='wcnss|wlan|wifi|pronto|iris|wcn36|80211|rfkill'

{ h DT; c 'cat /proc/device-tree/model; echo; cat /proc/device-tree/compatible | tr "\0" " "; echo'
  h "DT nodes matching $PAT|remoteproc"
  find /proc/device-tree/ -iname '*' 2>/dev/null | grep -iE "$PAT|remoteproc|smp2p|smd|smsm|reserved-memory/" | sed "s#/proc/device-tree/*#/#" | sort
  for n in $(find /proc/device-tree/ -type d 2>/dev/null | grep -iE 'wcnss|remoteproc|pronto|iris|wifi|bluetooth|smp2p-wcnss|reserved-memory/(wcnss|mpss|mba)'); do
    h "node ${n#/proc/device-tree}"
    for p in compatible status reg reg-names interrupt-names interrupts interrupts-extended power-domain-names clock-names clocks label memory-region size alignment alloc-ranges qcom,smd-channels qcom,smd-edge qcom,remote-pid local-mac-address pinctrl-names firmware-name qcom,smem-state-names; do
      [ -f $n/$p ] || continue
      case $p in compatible|status|reg-names|interrupt-names|power-domain-names|clock-names|label|qcom,smd-channels|pinctrl-names|firmware-name|qcom,smem-state-names)
        printf '  %s = "%s"\n' $p "$(tr '\0' ',' < $n/$p)";;
      *) printf '  %s = %s\n' $p "$(hexdump -v -e '4/1 "%02x" " "' $n/$p)";;
      esac
    done
  done
  h aliases; c 'ls /proc/device-tree/aliases; for a in /proc/device-tree/aliases/*; do printf "%s=%s\n" ${a##*/} "$(cat $a)"; done'
  h "pinctrl wcss"; c 'ls /proc/device-tree/soc@0/pinctrl@1000000 2>/dev/null | grep -i wcss'
  h "DT full grep of string props"; c 'grep -rlaiE "wcnss|pronto|wcn36|iris" /proc/device-tree 2>/dev/null | sed "s#/proc/device-tree/*#/#"'
} > $O/b8a-dt.txt

{ h kconfig; c 'ls -l /proc/config.gz'
  zcat /proc/config.gz > $O/config.full
  c "grep -E 'CONFIG_(WLAN|WCN|CFG80211|MAC80211|RFKILL|QCOM_WCNSS|WCNSS|BT|REMOTEPROC|QCOM_Q6V5|QCOM_SYSMON|QCOM_PIL|RPMSG|QRTR|QCOM_SMD|QCOM_SMEM|QCOM_SMP2P|QCOM_SMSM|FW_LOADER|EXTRA_FIRMWARE|CFG80211_|WIRELESS|ATH|WCN36XX|MODULES|POWER_SEQ|QCOM_RMTFS|QCOM_MDT|QCOM_SCM|QCOM_RPMPD|QCOM_SOCINFO)' $O/config.full | sort"
} > $O/b8a-kconfig.txt

{ h lsmod; c 'lsmod; cat /proc/modules'
  h /lib/modules; c 'uname -r; ls -la /lib/modules 2>&1; ls -R /lib/modules/$(uname -r) 2>&1 | head -50'
  h "/sys/module (all)"; c 'ls /sys/module | tr "\n" " "; echo'
  h "/sys/module matching"; c "ls /sys/module | grep -iE '$PAT|remoteproc|rpmsg|qrtr|wcnss|q6v5|mdt|smd|smem|cfg|mac'"
  h "drivers registered"; c "ls /sys/bus/platform/drivers | tr '\n' ' '; echo"
  c "ls /sys/bus/platform/drivers | grep -iE 'wcn|pronto|iris|q6v5|remoteproc|wcnss|rmtfs|smd|smp2p|smsm'"
  c "ls /sys/bus/rpmsg/drivers 2>&1"
  c 'for d in /sys/bus/platform/drivers/qcom-wcnss-pil /sys/bus/platform/drivers/qcom_wcnss_ctrl /sys/bus/rpmsg/drivers/qcom_wcnss_ctrl /sys/bus/platform/drivers/qcom-iris; do echo "$d: $(ls $d 2>&1 | tr "\n" " ")"; done'
  h kallsyms; c "grep -ciE 'wcn36xx|ieee80211_' /proc/kallsyms; grep -iE ' (wcnss_|qcom_iris|wcn36xx_probe|cfg80211_init|ieee80211_alloc_hw)' /proc/kallsyms | head -40"
  h which; c 'for t in iw rfkill ethtool hostapd wpa_supplicant modinfo modprobe insmod; do printf "%s: %s\n" $t "$(command -v $t || echo absent)"; done'
} > $O/b8a-modules.txt

{ h "firmware search path"; c 'cat /sys/module/firmware_class/parameters/path 2>&1'
  for d in /lib/firmware /vendor/firmware /firmware /usr/lib/firmware /etc/firmware /persist /lib/firmware/qcom; do h "dir $d"; c "ls -laR $d 2>&1 | head -80"; done
  h "find all firmware-like files"
  c "find / -xdev \( -path /proc -o -path /sys \) -prune -o -type f \( -iname '*wcnss*' -o -iname '*wlan*' -o -iname '*pronto*' -o -iname '*.mdt' -o -iname '*.mbn' -o -iname '*nv*.bin' -o -iname 'regulatory.db*' -o -iname '*bdwlan*' -o -iname '*cal*.bin' -o -iname 'WCNSS*' \) -print 2>/dev/null"
  h "sha256 of firmware files"
  c "find /lib/firmware -type f -exec sha256sum {} + 2>/dev/null"
  h "mounts / block (read-only info)"; c 'cat /proc/mounts'; c 'ls -l /dev/disk/by-partlabel 2>&1 | grep -iE "modem|persist|fsg|modemst|system|cache"'
} > $O/b8a-firmware.txt

{ h remoteproc; for r in /sys/class/remoteproc/*; do echo "== $r -> $(readlink -f $r)"; for f in name state firmware recovery coredump; do printf '  %s: %s\n' $f "$(cat $r/$f 2>&1)"; done; done
  h "platform devices"; c "ls /sys/bus/platform/devices | grep -iE 'a204000|a21b000|a000000|remoteproc|wcnss|pronto|4080000|smd|smp2p|smsm|iris|wifi|bt'"
  for d in /sys/bus/platform/devices/*a204000* /sys/bus/platform/devices/*remoteproc*; do [ -e $d ] || continue; h "dev $d"; c "cat $d/modalias; echo; cat $d/uevent; echo driver: \$(readlink $d/driver); ls $d"; done
  h "rpmsg devices"; c 'ls -l /sys/bus/rpmsg/devices 2>&1'
  for d in /sys/bus/rpmsg/devices/*; do [ -e $d ] || continue; printf '  %s name=%s drv=%s\n' ${d##*/} "$(cat $d/name 2>/dev/null)" "$(readlink $d/driver 2>/dev/null | sed 's#.*/##')"; done
  h "smd/glink edges"; c "find /sys/devices -maxdepth 6 -iname '*smd*' -o -maxdepth 6 -iname '*edge*' 2>/dev/null | head -30"
  h "qrtr"; c 'cat /proc/net/protocols 2>/dev/null | head -3; grep -i qrtr /proc/net/protocols; ls /proc/net | tr "\n" " "'
  h "reserved memory (iomem)"; c 'cat /proc/iomem'
  h "processes"; c 'ps w | grep -vE "\[k|\]$" | head -60'
  h "deferred probe"; c 'cat /sys/kernel/debug/devices_deferred 2>&1'
} > $O/b8a-remoteproc.txt

{ h "ip link"; c 'ip link'; h "ip addr"; c 'ip addr'
  h /sys/class/net; c 'ls -l /sys/class/net'
  for n in /sys/class/net/*; do printf '  %s type=%s driver=%s uevent=%s\n' ${n##*/} "$(cat $n/type)" "$(readlink $n/device/driver 2>/dev/null | sed 's#.*/##')" "$(cat $n/uevent | tr '\n' ' ')"; done
  h ieee80211; c 'ls -l /sys/class/ieee80211 2>&1'
  h rfkill; c 'ls -l /sys/class/rfkill 2>&1; for r in /sys/class/rfkill/*; do [ -e $r ] && echo "$r $(cat $r/name) $(cat $r/type) soft=$(cat $r/soft) hard=$(cat $r/hard)"; done'
  h tools; c 'iw dev'; c 'iw phy'; c 'rfkill list'; c 'ethtool -i wwan0'; c 'ethtool -i usb0'
  h "proc net wireless"; c 'cat /proc/net/wireless'
  h "bluetooth"; c 'ls /sys/class/bluetooth 2>&1'
} > $O/b8a-net.txt

{ h "dmesg full"; dmesg > $O/dmesg.full; c 'wc -l /tmp/b8a/dmesg.full; head -3 /tmp/b8a/dmesg.full'
  h "relevant"; grep -inE 'wlan|wifi|wcnss|pronto|iris|wcn36|cfg80211|mac80211|firmware|remoteproc|rpmsg|rfkill|regulatory|calibrat|nv\.bin| nv |failed|error|timeout|defer|smd|smp2p|smsm|qrtr|reserved mem' $O/dmesg.full
} > $O/b8a-dmesg.txt

cd /tmp && tar cf /tmp/b8a.tar b8a && echo "B8A-AUDIT DONE $(sha256sum /tmp/b8a.tar | cut -c1-16)"