#!/bin/sh
# DF-4701 trigger procedure — REQUIRES A PHYSICAL 3ware 9000-series CONTROLLER
# (0x13C1:0x1002..0x1005). Cannot run on the audit QEMU guest (no such PCI
# device; see env.txt). Run as indicated; steps 2 needs root, step 3 must be
# run as an UNPRIVILEGED user to demonstrate the sustained-DoS half of the bug.
set -u

echo "== DF-4701: tw_cl_shutdown_ctlr half-shutdown on handshake failure =="

# 0. Preconditions: twa attached, volume exported via CAM (e.g. /dev/da0 on twa0),
#    and firmware wedged enough that the shutdown handshake times out.
pciconf -l | grep -E 'chip=0x100[2-5]13c1' || { echo "no 3ware 9k controller present"; exit 1; }
ls /dev/twa0 >/dev/null 2>&1 || { echo "twa not attached"; exit 1; }

# 1. (root) Wedge the controller firmware — e.g. a hanging tw_cli maintenance op,
#    or pull it into the state where requests time out. A functional controller
#    will complete the handshake and the bug does not trigger.

# 2. (root) Attempt the unload; detach aborts AFTER tw_cl_shutdown_ctlr already
#    tore the CL down (active=FALSE, interrupts gone, watchdog cancelled,
#    CL locks destroyed). Expected dmesg markers:
#      "...init_connection failed"            (tw_cl_init.c:700-704 event 0x1016)
#      "...Can't close connection with controller" (tw_cl_init.c:577-581, 0x1015)
#      "Failed to shutdown Common Layer/controller" (tw_osl_freebsd.c:854-859, 0x2015)
#    Expected: kldunload returns failure (e.g. exit 5) and twa0 REMAINS in
#    devstat/kldstat — half-dead but attached.
kldunload twa; echo "kldunload rc=$?"

# 3. (unprivileged) Sustained trigger: issue I/O against a filesystem sitting on
#    the twa volume. There is no ctlr->active gate on twa_action/tw_cl_start_io
#    (tw_osl_cam.c:357, tw_cl_io.c:70), so every CCB is submitted to the dead
#    controller and burns CAM timeout periods; volume unusable until reboot.
su -m nobody -c 'ls -lR /twa-volume >/dev/null; echo ls_rc=$?'

# Success criterion: step 2 fails with the markers above while twa stays
# attached, and step 3 stalls >30s per command / errors out (EIO/timeout)
# instead of returning quickly with a clean driver refusal.