#!/usr/bin/env bash
# Diagnose VBIOS-backup failures (nvflash --save / sysfs ROM fallback).
# Read-only, except for briefly toggling the sysfs ROM enable flag
# (reverted right after). Run as root on the test host.
#
# Usage: ./diag_rom.sh [BDF]
# Example: ./diag_rom.sh 0000:28:00.0
set -u

BDF="${1:-}"
if [ -z "$BDF" ]; then
    BDF="$(lspci -D -d 10de:20c2 2>/dev/null | awk '{print $1}' | head -1)"
fi
if [ -z "$BDF" ]; then
    BDF="$(lspci -D -d 10de:2082 2>/dev/null | awk '{print $1}' | head -1)"
fi

echo "=== host ==="
uname -r
echo "BDF: ${BDF:-none found}"
echo

if [ -z "$BDF" ]; then
    echo "no CMP 170HX on the bus - nothing to diagnose"
    exit 2
fi

ROM="/sys/bus/pci/devices/${BDF}/rom"
echo "=== sysfs rom node ==="
ls -l "$ROM" 2>&1 || echo "rom node missing (rc=$?)"
echo
echo "=== rom enable attempt ==="
if echo 1 > "$ROM" 2>/tmp/rom_err.txt; then
    echo "enable rc=0 (OK)"
    echo 0 > "$ROM" 2>/dev/null || echo "WARNING: could not disable rom again"
else
    echo "enable FAILED rc=$?"
    cat /tmp/rom_err.txt
fi
rm -f /tmp/rom_err.txt
echo
echo "=== kernel lockdown ==="
cat /sys/kernel/security/lockdown 2>&1 || echo "lockdown file unreadable"
echo
echo "=== secure boot ==="
if command -v mokutil >/dev/null 2>&1; then
    mokutil --sb-state 2>&1
else
    echo "mokutil not installed"
fi
echo
echo "=== recent rom/nvrm kernel lines ==="
dmesg 2>/dev/null | grep -iE "rom|nvrm|lockdown" | tail -15 || echo "dmesg unreadable"
echo
echo "=== nvidia-smi present? ==="
command -v nvidia-smi >/dev/null 2>&1 && echo yes || echo no