#!/bin/sh
# DF-2630 trigger: VFS_ROOT quorum wedge (pfs_nmasters=2 on single-device mount)
# Run as root on the guest.  All evidence to /root/poc/df2630/.
set -x
D=/root/poc/df2630
mkdir -p $D
vnconfig -u vn0 2>/dev/null
vnconfig -c vn0 /root/poc/wedge.img
mkdir -p /mnt/h2

echo '=== 1. mount (expect: returns 0 — VFS_ROOT is NOT called by mount(2)) ==='
date
mount -t hammer2 -o ro /dev/vn0@testvol /mnt/h2
echo "MOUNT_RC=$?"
date
# NOTE: bare `mount` (prmount->mountctl->nlookup) WEDGES on the mountpoint
# (accidentally proven in the first run: mount(8) pid 940 stuck, wchan h2root).
# Use fstab-style output which skips mountctl.
mount -p | grep h2

echo '=== 2. census right after mount ==='
ps axlw | grep -c h2xop-testvol
ps axlw | grep h2nod

echo '=== 3. first lookup: ls /mnt/h2 (expect: D-state, wchan h2root) ==='
( ls /mnt/h2 > $D/ls1.out 2>&1 ; echo "LS1_RC=$?" > $D/ls1.rc ) &
LS1=$!
sleep 4
ps -o pid,stat,wchan,command -p $LS1
ps axlw | grep -E "h2root|ncplk" | grep -v grep

echo '=== 4. second lookup: namecache contention (expect: wchan ncplk or h2root) ==='
( ls /mnt/h2 > $D/ls2.out 2>&1 ; echo "LS2_RC=$?" > $D/ls2.rc ) &
LS2=$!
sleep 4
ps -o pid,stat,wchan,command -p $LS1 -p $LS2
echo "LS1=$LS1 LS2=$LS2" > $D/ls_pids

echo '=== 5. stat the mountpoint directly ==='
( stat /mnt/h2 > $D/stat1.out 2>&1 ; echo "STAT_RC=$?" > $D/stat1.rc ) &
ST1=$!
sleep 3
ps -o pid,stat,wchan,command -p $ST1
echo "ST1=$ST1" >> $D/ls_pids

echo '=== 6. kill -9 the D-state lookups — unkillable? ==='
kill -9 $LS1 $LS2 $ST1 2>&1
sleep 3
ps -o pid,stat,wchan,command -p $LS1 -p $LS2 -p $ST1 2>&1
echo KILL9_DONE

echo '=== 7. plain umount by path (expect: wedges — sys_unmount nlookups the path) ==='
( umount /mnt/h2 > $D/umount.out 2>&1 ; echo "UM_RC=$?" > $D/umount.rc ) &
UM=$!
sleep 4
ps -o pid,stat,wchan,command -p $UM
echo "UM=$UM" >> $D/ls_pids
kill -9 $UM 2>&1
sleep 2
ps -o pid,stat,wchan,command -p $UM 2>&1

echo '=== 8. umount -f by path (does FORCE help?) ==='
( umount -f /mnt/h2 > $D/umountf.out 2>&1 ; echo "UMF_RC=$?" > $D/umountf.rc ) &
UMF=$!
sleep 4
ps -o pid,stat,wchan,command -p $UMF
echo "UMF=$UMF" >> $D/ls_pids
kill -9 $UMF 2>&1
sleep 2
ps -o pid,stat,wchan,command -p $UMF 2>&1

echo '=== 9. mount is still listed? third hammer2 mount elsewhere still possible? ==='
vnconfig -c vn1 /root/poc/control.img 2>/dev/null
mkdir -p /mnt/h2c
( timeout 15 mount -t hammer2 -o ro /dev/vn1@testvol /mnt/h2c > $D/mount3.out 2>&1 ; echo "MOUNT3_RC=$?" > $D/mount3.rc ) &
M3=$!
sleep 6
ps -o pid,stat,wchan,command -p $M3
cat $D/mount3.rc 2>/dev/null

echo '=== 10. thread/wchan census final ==='
ps axlw | grep -E "h2root|ncplk|h2xop|h2nod" | grep -v grep > $D/census_final.txt
cat $D/census_final.txt
echo '=== TRIGGER COMPLETE (guest left wedged; serial + files captured) ==='