DF-4841 / trigger.c
/* * DF-4841 trigger โ NOT runnable on the audit guest (no LSI/3ware 9750 PCI * device exists; QEMU does not emulate one; tws is compiled into the kernel * with nothing attached). This file documents the exact hardware-gated * trigger for a maintainer with a 9700-series controller. * * Defect: after a controller soft reset, the recovery path re-runs * tws_init_obfl_q() (tws_hdm.c:118-148, called from tws_reinit(), * tws_cam.c:1266, and from tws_init_ctlr, tws_hdm.c:111) to refill the * firmware's outbound free list. But it only posts sense buffers whose * `posted` flag is false (tws_hdm.c:128), and nothing in the reset/recovery * path (tws_reset -> tws_reset_cb -> tws_reinit, tws_cam.c:1198-1266) * clears sc->sense_bufs[i].posted โ all 256 were `posted == true` from * before the reset (they were sitting in the pre-reset queue; the flags are * only ever cleared at attach, tws.c:620, and on an OBFL overrun repost * failure, tws_cam.c:543). The soft reset wipes the controller's copy of * the queue, so the "refill" is a no-op and the firmware is left with ZERO * response frames. * * Trigger (hardware present): * 1. Force the reset path: any controller error that reaches * tws_reset() (tws_cam.c:1198) โ e.g. a bus reset / controller * fault / the unguarded re-entry of DF-4401 โ or CAM freeze + * recovery during heavy I/O. * 2. Observe the recovery complete (tws_reinit releases simq, turns * interrupts back on, sends TWS_RESET_COMPLETE). * 3. Observe every subsequent command time out: the firmware cannot * post a single response (no free frames in the outbound free * list) โ adapter and all I/O to it are dead until reboot. * tws_init_connect()'s 60 s poll (TWS_POLL_TIMEOUT, tws.h:74) * inside tws_reinit likewise cannot succeed once the queue it * itself failed to refill is needed โ the recovery defeats itself. * * Root-cause receipts: * tws_hdm.c:127-144 while (i < tws_queue_depth) { if (!posted) post... } * tws_cam.c:1262-1266 obfl_q_overrun=false; init_connect(); init_obfl_q(); * posted cleared only at tws.c:620 (attach) and tws_cam.c:543 (overrun). */ int df4841_trigger_placeholder; /* see README.md */ |