DF-3904 / sk_rxeof_walk_shape.c
/* * DF-3904 analysis aid: sk_rxeof walk-bound probe. * * NOT runnable without SysKonnect hardware - kept as the source-level * demonstration of the missing work bound. This stub documents the loop * shape that the finding is about: * * sk_rxeof (if_sk.c:1820-1888) * for (;;) { <-- NO iteration bound * sk_ctl = cur_desc->sk_ctl; * if (sk_ctl & SK_RXCTL_OWN) { <-- only exit: NIC owns next desc * cd->sk_rx_prod = cur; * break; * } * ... * sk_newbuf(sc_if, cur, 0); <-- reposts OWN to the NIC * ifp->if_input(ifp, m, NULL, -1); * } * * A line-rate remote flood keeps freshly-reposted descriptors completing * ahead of the walker: after a full lap of the 256-deep ring the loop * revisits descriptor 0 which the NIC has by then re-completed, so the * loop never observes OWN and never exits - all under the card-global * sc->sk_serializer held by sk_intr (bus_setup_intr ..., &sc->sk_serializer * if_sk.c:1514), starving the softclock/netisr/other-port work on that * CPU (RX livelock; DF-3761 family). * * The sibling driver msk(4) bounds the identical walk via * sc->msk_process_limit (if_msk.c:3225, tunable mskc.process_limit); * FreeBSD's sk(4) bounded it in r~251845 era via RX polling budget. */ int df3904_source_probe_unused; |