cc  -O2 -pipe   -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes  -Wmissing-prototypes -Wpointer-arith -Wcast-qual  -Wold-style-definition -Wmissing-include-dirs  -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc  -I. -Idragonfly -I/root/dfwb3/forwarder_x86_64/include -Idragonfly/../include -I/usr/include  -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline   -c dfwb3_rig.c
wb_rxeof=0xffffffff808daed0 wb_init=0xffffffff808da750 wb_stop=0xffffffff808d9850 wb_start=0xffffffff808d9e90 wb_txeof.part.4=0xffffffff808da510 wb_watchdog=0xffffffff808dae60 mbstat=0xffffffff8131dec0 mbtypes=0xffffffff81325ec0
kern.dfwb3.rxeof: 0x0000000000000000 -> 0xffffffff808daed0
kern.dfwb3.init: 0x0000000000000000 -> 0xffffffff808da750
kern.dfwb3.stop: 0x0000000000000000 -> 0xffffffff808d9850
kern.dfwb3.start: 0x0000000000000000 -> 0xffffffff808d9e90
kern.dfwb3.txeof: 0x0000000000000000 -> 0xffffffff808da510
kern.dfwb3.watchdog: 0x0000000000000000 -> 0xffffffff808dae60
kern.dfwb3.mbstat: 0x0000000000000000 -> 0xffffffff8131dec0
kern.dfwb3.mbtypes: 0x0000000000000000 -> 0xffffffff81325ec0
=== go4267: ring built by REAL wb_init (DF-4267) ===
kern.dfwb3.go4267: 0 -> 0
GO_RC=0
=== marker summary ===
dfwb3: cluster pool exhausted after 34655 clusters
dfwb3: saved-chain walk: 17 mbufs intact (m_len==128, marker ok: 0 damaged)
dfwb3: after REAL wb_txeof.part.4 with a chip-completed head descriptor: opackets +0, wb_tx_head=0xffffffff82650348 STILL SET, chain[0].wb_mbuf=0 M-bM^@M^T the :1062 walk 'while (head->wb_mbuf != NULL)' never entered: TX completion WEDGED (5s watchdog is the only exit)
dfwb3: *** DF-4270 WEDGE CONFIRMED ***
dfwb3: go4270 SURVIVED M-bM^@M^T guest stays up
dfwb3: cluster pool exhausted after 34355 clusters
dfwb3: saved-chain walk: 17 mbufs intact (m_len==128, marker ok: 0 damaged)
dfwb3: *** DF-4270 LEAK CONFIRMED: exactly the 17 mbufs of the dequeued packet chain are still allocated and referenced by NOTHING (queue empty, descriptor wb_mbuf NULL) ***
dfwb3: after REAL wb_txeof.part.4 with a chip-completed head descriptor: opackets +0, wb_tx_head=0xffffffff82650348 STILL SET, chain[0].wb_mbuf=0 M-bM^@M^T the :1062 walk 'while (head->wb_mbuf != NULL)' never entered: TX completion WEDGED (5s watchdog is the only exit)
dfwb3: *** DF-4270 WEDGE CONFIRMED ***
dfwb3: go4270 SURVIVED M-bM^@M^T guest stays up
dfwb3: A/B with ONE-TOKEN-FIXED links (simulated fix.diff): delivered=1 head==chain1:1 M-bM^@M^T the identical state now advances past slot 0
dfwb3: *** DF-4267 A/B: only the link words differ M-bM^@M^T the collapse is the ternary at if_wb.c:909 ***
dfwb3: go4267 SURVIVED M-bM^@M^T guest stays up
---DMESG---
dfwb3: === DF-4267: ring built by the REAL wb_init (inlined wb_list_rx_init, if_wb.c:894-917) ===
dfwb3: hardware links ld->wb_rx_list[i].wb_next (a closed ring would link i -> i+1, 63 -> 0):
dfwb3:   wb_rx_list[ 0].wb_next = 0x0541b110 
dfwb3:   wb_rx_list[ 8].wb_next = 0x0541b190 
dfwb3:   wb_rx_list[16].wb_next = 0x0541b210 
dfwb3:   wb_rx_list[24].wb_next = 0x0541b290 
dfwb3:   wb_rx_list[32].wb_next = 0x0541b310 
dfwb3:   wb_rx_list[40].wb_next = 0x0541b390 
dfwb3:   wb_rx_list[48].wb_next = 0x0541b410 
dfwb3:   wb_rx_list[56].wb_next = 0x0541b490 
dfwb3:   => -1/64 hardware wb_next words point at descriptor 0 (vtophys(&wb_rx_list[0])=0x541b100)
dfwb3: software walk from wb_rx_head: distinct descriptors reachable = 64 / 64 (returned to a visited descriptor after 64 hops)
dfwb3: TX contrast: distinct descriptors reachable from wb_tx_free = 128 / 128 (the :878 twin is correct)
dfwb3: [4267-crafted] head==chain0:1 slot0.status=0x40400300 OWN:0 RXLEN:64 mbuf=0xfffff80089795c00
dfwb3: if_input: m=0xfffff8008979dc00 m_len=60 pkthdr.len=60 dst=ff:ff:ff:ff:ff:ff type=df67 (further normal deliveries suppressed in log)
dfwb3: after processing the completed frame: delivered=1 head==chain0:0 head==chain1:1 M-bM^@M^T a correct ring advances head to chain[1]
dfwb3: if_input: m=0xfffff8008979dc00 m_len=60 pkthdr.len=60 dst=ff:ff:ff:ff:ff:ff type=df67 (further normal deliveries suppressed in log)
dfwb3: A/B with ONE-TOKEN-FIXED links (simulated fix.diff): delivered=1 head==chain1:1 M-bM^@M^T the identical state now advances past slot 0
dfwb3: *** DF-4267 A/B: only the link words differ M-bM^@M^T the collapse is the ternary at if_wb.c:909 ***
dfwb3: MMIO WB_RXADDR=0x0541b100 (== vtophys(&wb_rx_list[0]): YES) M-bM^@M^T every RX (re)start fetches descriptor 0; with all wb_next words pointing back to 0 the chip suspends after ONE frame (per-frame RX restart, wb_intr:1137/wb_rxeoc:1030)
dfwb3: go4267 SURVIVED M-bM^@M^T guest stays up