feat(M10): enable FF_FLOW_IPIP with software GIF tunnel fallback (Phase-2 P1d)

Phase-2 fifth milestone: enable FF_FLOW_IPIP=1 standalone (PA/ZC
temporarily reverted for isolation per spec). Adds end-to-end IPIP
tunnel verification across F-Stack server (GIF) and Linux client.

Code changes (3 files, +25/-7):

- lib/Makefile: enable FF_FLOW_IPIP=1; comment-back PA/ZC for
  this milestone (M9 already covered the combo case).

- lib/ff_dpdk_if.c (line 1439-1466): soften create_ipip_flow
  failure path. Was rte_exit(EXIT_FAILURE) on any error; now
  printf warning + continue. Rationale: rte_flow IPIP is a NIC
  hardware-offload optimization. virtio (and several other) DPDK
  drivers return ENOTSUP for it. The GIF tunnel itself runs
  in software via FreeBSD's if_gif/in_gif/in6_gif (already
  built into libfstack since M6). Without this softening the
  primary cannot start on virtio-backed test environments.

- example/Makefile: probe libfstack.a for the 'T ff_zc_send'
  symbol via nm; only build helloworld_zc target when ZC is
  present. Lets milestones that disable FF_ZC_SEND for
  isolation testing (like M10) still produce the other
  helloworld + helloworld_epoll binaries successfully.

Verification (G1-G7, 1 bounce internal):

- G1.1 lib make all: exit=0, 0 errors, 57 warnings (= baseline).
- G1.4 libfstack.a: 6.53 MB. example/ make produces helloworld
  (29.0 MB) + helloworld_epoll (29.0 MB); helloworld_zc skipped
  (clean log message).
- G2.1 helloworld primary: ALIVE, log shows
  'Flow rule validation failed: Function not implemented' as a
  warning (NOT rte_exit) followed by normal ipfw2 + dpdk if
  registration. 0 SIGSEGV.
- G3.1 tools/sbin/ifconfig gif0 create: exit=0.
- G3.2 ifconfig gif0: 'flags=8010<POINTOPOINT,MULTICAST> mtu 1280
  / groups: gif' shown.
- G3.3 ifconfig list: lo0 + f-stack-0 + gif0 visible.
- G3.4 server tunnel setup:
    ifconfig gif0 tunnel 9.134.214.176 9.134.211.87
    ifconfig gif0 inet 10.10.10.1 10.10.10.2 netmask 0xffffffff
  Result: 'tunnel inet 9.134.214.176 --> 9.134.211.87 / inet
  10.10.10.1 --> 10.10.10.2' with UP/POINTOPOINT/RUNNING/MULTICAST.
- G3.5 client (Linux f-stack-client) tunnel setup:
    ip tunnel add gif0 mode ipip remote 9.134.214.176 local 9.134.211.87
    ip addr add 10.10.10.2 peer 10.10.10.1 dev gif0
    ip link set gif0 up
- G3.6 ping -c 3 -W 2 10.10.10.1: 3/3 received, 0% packet loss,
  rtt min/avg/max 0.288/0.436/0.649 ms. Linux IPIP <-> F-Stack
  GIF cross-implementation tunnel works.
- G6 lint: 0 errors.

Bounce ledger: 1 formal bounce (G2 -> code, rte_exit softening),
no escalation.

Documentation:
- docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M10-spec.md (NEW).
- docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M10-execution-log.md
  (NEW, full evidence + bounce ledger + follow-ups F1-F3).
- docs/01-LAYER1-ARCHITECTURE.md + zh_cn mirror: M10 anchor.
- docs/F-Stack_Knowledge_Base_Summary.md + zh_cn: scope amended.

Compliance: 0 direct rm/kill/chmod calls. All cleanup routed
through workspace shell wrappers.

Local commit only; not pushed.

Author: jfb8856606

docs/01-LAYER1-ARCHITECTURE.md

@@ -143,6 +143,7 @@ F-Stack adopted a **complete porting** strategy:
 - **Phase-2 M7 (2026-06-08)**: enabled `FF_USE_PAGE_ARRAY=1` (P1a, single-pass / 0 bounces); brings `lib/ff_memory.c` (481 lines, mmap-based page-array + mbuf reference pool) into `FF_HOST_SRCS`; runtime allocates 256 MB one-shot mmap (65536 × 4 KB pages) at `ff_mmap_init` to amortize per-packet 4 KB alloc/free syscalls. See `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M7-execution-log.md`
 - **Phase-2 M8 (2026-06-08)**: enabled `FF_ZC_SEND=1` (P1b, 1 bounce); introduced `FSTACK_ZC_MAGIC` sentinel (uio.uio_offset = 0xF8AC2C00F8AC2C00) protocol + new public API `ff_zc_send` to disambiguate ZC mbuf chains from plain char buffers; fixed pre-existing 13.0-baseline ZC fast-path bug where `m_uiotombuf` predicate mis-matched every `ff_write`/`ff_writev` call (would silently corrupt or GPF in `m_demote` on heavy load). 8 files +85/-4 across `freebsd/sys/mbuf.h`, `freebsd/kern/uipc_mbuf.c`, `freebsd/kern/sys_generic.c`, `lib/Makefile`, `lib/ff_syscall_wrapper.c`, `lib/ff_api.h`, `lib/ff_api.symlist`, `example/Makefile` + `example/main_zc.c`. End-to-end verified via ssh f-stack-client curl: HTTP 200 / 438-byte HTML body / 100/100 short-conn pass. See `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M8-execution-log.md`
 - **Phase-2 M9 (2026-06-08)**: enabled both `FF_USE_PAGE_ARRAY=1` + `FF_ZC_SEND=1` combo (P1c, single-pass / 0 bounces, 1-line Makefile change leveraging M7+M8 work); validated co-existence end-to-end (ff_mmap_init 256MB + ipfw2/tcp_bbr init clean + HTTP 200 single curl + 100/100 short-conn). 1000-conn observation: ~3.5× slower than M8 ZC-only with occasional timeout — recorded as M9-followup-F1 for phase-5b perf profiling. See `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M9-execution-log.md`
+- **Phase-2 M10 (2026-06-08)**: enabled `FF_FLOW_IPIP=1` (P1d, 1 bounce); softened `create_ipip_flow` failure from `rte_exit` to printf warning so primary stays alive on NICs that lack rte_flow IPIP offload (e.g. virtio); GIF tunnel runs in software via FreeBSD `if_gif/in_gif`. End-to-end IPIP tunnel verified: `tools/sbin/ifconfig gif0 create + tunnel + inet` on server side + `ip tunnel add gif0 mode ipip` on Linux f-stack-client side + ping 3/3 received 0% loss RTT 0.29-0.65 ms. example/Makefile auto-skips helloworld_zc target when libfstack.a is built without FF_ZC_SEND. See `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M10-execution-log.md`
 
 ### 3.2 Ported FreeBSD Subsystems
 

docs/F-Stack_Knowledge_Base_Summary.md

@@ -2,7 +2,7 @@
 
 **Document Version**: 1.0  
 **Generation Date**: 2026-03-20  
-**Content Scope**: F-Stack v1.26 (FreeBSD 15.0 port; upgraded from 13.0 in 2025-2026 — M0~M5 + runtime-fix + rib-fix + Phase-5b NFR-1 PASS; **Phase-2 M6 enabled FF_NETGRAPH+FF_IPFW combo + M7 enabled FF_USE_PAGE_ARRAY + M8 enabled FF_ZC_SEND + M9 PA+ZC combo, 2026-06-08**) + DPDK 23.11.5 Complete Three-Layer Architecture Knowledge Base  
+**Content Scope**: F-Stack v1.26 (FreeBSD 15.0 port; upgraded from 13.0 in 2025-2026 — M0~M5 + runtime-fix + rib-fix + Phase-5b NFR-1 PASS; **Phase-2 M6 enabled FF_NETGRAPH+FF_IPFW combo + M7 enabled FF_USE_PAGE_ARRAY + M8 enabled FF_ZC_SEND + M9 PA+ZC combo + M10 enabled FF_FLOW_IPIP, 2026-06-08**) + DPDK 23.11.5 Complete Three-Layer Architecture Knowledge Base  
 **Document Location**: `/data/workspace/f-stack/docs/`  
 **Purpose**: Pre-requisite architecture documentation for Spec-Driven Development
 

docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M10-execution-log.md

@@ -0,0 +1,136 @@
+# Phase-2 M10 Execution Log — FF_FLOW_IPIP (P1d)
+
+> 状态：✅ PASS（IPIP 隧道双端互通；1 bounce 修软退化）
+> 日期：2026-06-08
+> 上游基础：M9 commit `2f4748638`
+
+---
+
+## 1. 摘要
+
+启用 `FF_FLOW_IPIP=1`（M7+M8 PA/ZC 暂回退到注释，独立验证 GIF/IPIP 路径）。涉及：
+
+1. lib/Makefile 启用 FF_FLOW_IPIP
+2. lib/ff_dpdk_if.c 把 `create_ipip_flow` 失败 `rte_exit` 改为软警告（virtio NIC 无 rte_flow IPIP 卸载，但 GIF 走 FreeBSD 内核软件路径不依赖硬件 flow）
+3. example/Makefile 自动跳过依赖 ZC 的 helloworld_zc target（因 M10 测试需 disable ZC 隔离）
+4. 服务端 `tools/sbin/ifconfig gif0 create / tunnel / inet` 三步配 GIF 隧道
+5. 客户端 Linux `ip tunnel add gif0 mode ipip` + `ip addr add` + `ip link set up`
+6. ping 验证：3/3 ICMP echo reply ✓
+
+**最终结果**：客户端 Linux IPIP ↔ 服务端 F-Stack GIF 跨实现互通，RTT < 1ms。
+
+---
+
+## 2. 改动清单
+
+| 文件 | 改动 | 行数 |
+|---|---|---|
+| `lib/Makefile` | 启用 `FF_FLOW_IPIP=1` + 把 PA/ZC 临时回退到注释 | +3 / -3 |
+| `lib/ff_dpdk_if.c` | `create_ipip_flow` fail 由 `rte_exit` 改为 `printf` 软警告 + 注释解释 | +13 / -3 |
+| `example/Makefile` | 用 `nm` 探测 libfstack.a 是否含 `ff_zc_send`，缺则跳过 helloworld_zc target | +9 / -1 |
+
+**总计 3 文件 +25/-7**
+
+---
+
+## 3. RCA — Bounce #1
+
+### 3.1 现象
+
+启用 FF_FLOW_IPIP=1 编译 PASS，但 helloworld primary 起栈到 `Port 0 Link Up` 后立即报：
+
+```
+Flow rule validation failed: Function not implemented
+EAL: Error - exiting with code: 1
+  Cause: create_ipip_flow failed
+```
+
+并 `rte_exit(EXIT_FAILURE)` 退出，G2 失败。
+
+### 3.2 根因
+
+`ff_dpdk_if.c:1442` 调用 `create_ipip_flow(0)` 通过 `rte_flow_create` API 在 NIC 上创建 IPIP 解封装 flow rule。**virtio_net 驱动**（实测网卡 `0000:00:09.0 1af4:1000 Virtio network device`）不实现 `rte_flow` API → ENOTSUP。
+
+但 GIF 隧道实际走 **FreeBSD 内核软件路径**（`if_gif.c` / `in_gif.c` 在 lib 内已编入），与 NIC 硬件 flow 卸载**正交**。13.0 baseline 该 rte_exit 是过激的失败处理。
+
+### 3.3 修复
+
+把 `rte_exit(EXIT_FAILURE, ...)` 改为 `printf("M10 [WARN] ...")` 软警告。注释清楚说明：rte_flow IPIP 是性能优化（硬件卸载封装/解封装），缺失时软件路径仍可工作。
+
+---
+
+## 4. Gate 实测结果
+
+### G1 — 编译
+
+| 子项 | 结果 |
+|---|---|
+| `lib/ make clean && make` | exit=0 / 0 errors / 57 warnings |
+| `libfstack.a` | 6.53 MB |
+| `example/ make` | helloworld + helloworld_epoll 产出，helloworld_zc 自动跳过（lib 无 ff_zc_send 符号） |
+
+### G2 — 主程序冒烟
+
+| 子项 | v1（rte_exit）| v2（warning fallback） |
+|---|---|---|
+| primary 起栈 | ✗ (rte_exit) | ✓ ALIVE |
+| Flow rule warn | – | `Flow rule validation failed: Function not implemented`（warning） |
+| ipfw2 / dpdk if | – | ✓ ✓ |
+
+### G3 — IPIP 隧道功能验收
+
+| 子项 | 命令 | 结果 |
+|---|---|---|
+| G3.1 | `tools/sbin/ifconfig gif0 create` | exit=0 ✓ |
+| G3.2 | `tools/sbin/ifconfig gif0` | `gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280 / groups: gif` ✓ |
+| G3.3 | `tools/sbin/ifconfig` (list all) | `lo0` + `f-stack-0` + `gif0` 三接口可见 ✓ |
+| G3.4 | `ifconfig gif0 tunnel 9.134.214.176 9.134.211.87` + `ifconfig gif0 inet 10.10.10.1 10.10.10.2 netmask 0xffffffff` | `tunnel inet 9.134.214.176 --> 9.134.211.87 / inet 10.10.10.1 --> 10.10.10.2` flags=`UP,POINTOPOINT,RUNNING,MULTICAST` ✓ |
+| G3.5 | client: `ip tunnel add gif0 mode ipip remote 9.134.214.176 local 9.134.211.87` + addr + link up | `gif0@NONE: link/ipip 9.134.211.87 peer 9.134.214.176 inet 10.10.10.2 peer 10.10.10.1/32` ✓ |
+| **G3.6** | **`ping -c 3 -W 2 10.10.10.1`** | **3/3 received, 0% loss, RTT 0.288/0.436/0.649 ms ✓** |
+
+### G4 — 性能（observation only，OQ-2 默认许可降级）
+
+iperf 大流量未跑（client 端工具 + 时间预算限制）；功能 PASS 即认为 P1d 完结。
+
+### G5 — 文档
+
+`phase2-M10-spec.md` + `phase2-M10-execution-log.md`；docs anchor + Summary scope 同 M6/M7/M8/M9 模式。
+
+### G6 — Lint：0 errors。
+
+### G7 — Commit：本地英文 commit，不 push。
+
+---
+
+## 5. Bounce 计数
+
+| # | 阶段 | 触发 | 修复 |
+|---|---|---|---|
+| 1 | gate→code | rte_exit 因 virtio 无 rte_flow IPIP 卸载 | rte_exit → printf warning（软退化） |
+
+**1/3 bounces**，未 escalation。
+
+---
+
+## 6. 已知遗留 / Follow-up
+
+| ID | 描述 | 计划 |
+|---|---|---|
+| F1 | virtio NIC 无 rte_flow IPIP 硬件卸载 → CPU 软件 GIF 路径性能可能低于硬件支持的 NIC | 不修（硬件能力限制；非代码 bug） |
+| F2 | iperf 大流量隧道吞吐基线未做 | 推迟到 phase-5b 大并发性能阶段 |
+| F3 | M10 例 Makefile 探测 ZC 符号需要先编 lib —— 此 ordering 依赖未来可加 explicit dependency | 文档 + 测试通过即可 |
+
+---
+
+## 7. Phase 进度
+
+| Phase | 状态 |
+|---|---|
+| A. Spec | ✅ |
+| B. Research | ✅ |
+| C. Code v1（Makefile only） | ✅ → bounce |
+| C. Code v2（rte_exit fallback + ex Makefile guard） | ✅ |
+| D. Review | ✅ 0 lint |
+| E. Gate | ✅ G1-G3.6 + G6/G7 PASS；G4 observation only |
+
+**M10 整体：✅ PASS**

docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M10-spec.md

@@ -0,0 +1,76 @@
+# Phase-2 M10 Spec — FF_FLOW_IPIP (P1d)
+
+> 状态：DRAFT → ready
+> 上游基础：M9 commit `2f4748638`
+> 复杂度：M（涉及双端隧道配置 + 路由）
+
+---
+
+## 1. 目标 / 范围
+
+### in-scope
+
+- `lib/Makefile` 启用 `FF_FLOW_IPIP=1`（单独，不与其他 P1 同启）
+- 复用 lib/ff_dpdk_if.c 现有 4 处 ifdef 与已编入的 in_gif.c / if_gif.c / ng_gif.c
+- G1-G3：编译 + 起栈 + 通过 `tools/sbin/ifconfig gif0 create` 在服务端创建 GIF 隧道、客户端用 `ip tunnel` 配置对端隧道、配置路由后做基础 ping 验证
+- 文档同步
+
+### out-of-scope
+
+- ZC / PA combo（M10 单独 build；为避免变量交叉，暂 disable M7/M8）
+- IPv6 over IPv4 / IPv4 over IPv6 复杂矩阵
+- iperf 大流量性能（OQ-2 默认许可降级）
+
+---
+
+## 2. Acceptance Criteria
+
+| ID | 验收 |
+|---|---|
+| AC-M10-1 | `lib/Makefile`：`FF_FLOW_IPIP=1` + 暂时回退 PA/ZC 到注释（独立验证） |
+| AC-M10-2 | `lib/ make`：exit=0 / 0 errors / warnings ≤ 60 |
+| AC-M10-3 | helloworld primary 起栈 ≥ 12s ALIVE，无 panic |
+| AC-M10-4 | `tools/sbin/ifconfig gif0 create` 成功（exit=0） |
+| AC-M10-5 | `ifconfig gif0 inet ...` 配置 GIF 隧道 + 路由后，从 client 端 `ping` server 端 GIF 内 IP 至少 1 个 ICMP echo reply ✓（OQ-4 降级许可：若客户端 GIF 反向不通可作 G3.5 observation） |
+| AC-M10-6 | 文档 anchor + execution log |
+
+---
+
+## 3. 风险
+
+| ID | 风险 | 缓解 |
+|---|---|---|
+| R-M10-1 | f-stack-client（Linux）gif 隧道用 `ip tunnel mode ipip` vs FreeBSD GIF 兼容性 | RFC 2003 IPIP 标准协议，应可互通；如不通降级为 observation |
+| R-M10-2 | tools/sbin/ifconfig 缺少 GIF clone 支持 | 实测 `ifconfig gif0 create` 看是否报错；如缺 fallback 至 ngctl mkpeer |
+
+---
+
+## 4. 验收命令
+
+```sh
+# G1
+cd /data/workspace/f-stack/lib && make clean && make
+cd /data/workspace/f-stack/example && /data/workspace/rm_tmp_file.sh ./helloworld* && make
+
+# G2
+/data/workspace/rm_tmp_file.sh /var/run/dpdk/rte/{config,fbarray_*,hugepage_info}
+sudo ./helloworld -c ../config.ini --proc-type=primary --proc-id=0 &
+sleep 12 && [ -d /proc/$PID ] && echo ALIVE
+
+# G3 server side
+sudo /data/workspace/f-stack/tools/sbin/ifconfig gif0 create
+sudo /data/workspace/f-stack/tools/sbin/ifconfig gif0 tunnel <server_outer> <client_outer>
+sudo /data/workspace/f-stack/tools/sbin/ifconfig gif0 inet <server_inner>/30 <client_inner>
+
+# G3 client side (via ssh)
+ssh f-stack-client "sudo ip tunnel add gif0 mode ipip remote <server_outer> local <client_outer>"
+ssh f-stack-client "sudo ip addr add <client_inner>/30 dev gif0"
+ssh f-stack-client "sudo ip link set gif0 up"
+ssh f-stack-client "ping -c 3 -W 2 <server_inner>"
+
+/data/workspace/kill_process.sh $PID
+```
+
+---
+
+> 下一步：Phase C — 启用 Makefile + 编译 + 实测。

docs/zh_cn/01-LAYER1-ARCHITECTURE.md

@@ -143,6 +143,7 @@ F-Stack 采用了**完整移植**策略：
 - **Phase-2 M7（2026-06-08）**：默认启用 `FF_USE_PAGE_ARRAY=1`（P1a，单次过 / 0 打回）；将 `lib/ff_memory.c`（481 行，mmap-based page-array + mbuf reference pool）纳入 `FF_HOST_SRCS`；运行时 `ff_mmap_init` 一次性预留 256 MB（65536 × 4 KB 页）以摊销每包 4 KB alloc/free 系统调用开销。详见 `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M7-execution-log.md`
 - **Phase-2 M8（2026-06-08）**：默认启用 `FF_ZC_SEND=1`（P1b，1 次打回）；引入 `FSTACK_ZC_MAGIC` sentinel（uio.uio_offset = 0xF8AC2C00F8AC2C00）协议 + 新公开 API `ff_zc_send`，用于区分 ZC mbuf chain 与普通 char buffer；修复 13.0 baseline 遗留 ZC fast-path bug —— 原 `m_uiotombuf` 谓词命中所有 `ff_write`/`ff_writev` 调用，在高压下会静默破坏数据或 `m_demote` GPF。共 8 文件 +85/-4，覆盖 `freebsd/sys/mbuf.h`、`freebsd/kern/uipc_mbuf.c`、`freebsd/kern/sys_generic.c`、`lib/Makefile`、`lib/ff_syscall_wrapper.c`、`lib/ff_api.h`、`lib/ff_api.symlist`、`example/Makefile` + `example/main_zc.c`。通过 ssh f-stack-client curl 端到端验证：HTTP 200 / 438 字节真实 HTML body / 100x 短连 100/100 通过。详见 `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M8-execution-log.md`
 - **Phase-2 M9（2026-06-08）**：同时启用 `FF_USE_PAGE_ARRAY=1` + `FF_ZC_SEND=1` combo（P1c，单次过 / 0 打回，1 行 Makefile diff 复用 M7+M8 已有代码）；端到端验证共存能力（ff_mmap_init 256MB + ipfw2/tcp_bbr init 干净 + HTTP 200 单次 curl + 100/100 短连）。1000 短连 observation：约 M8 ZC-only 的 3.5 倍耗时且偶发 timeout —— 记为 M9-followup-F1，推迟到 phase-5b 阶段做性能 profiling。详见 `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M9-execution-log.md`
+- **Phase-2 M10（2026-06-08）**：启用 `FF_FLOW_IPIP=1`（P1d，1 次打回）；将 `create_ipip_flow` 失败从 `rte_exit` 软化为 printf warning，使 primary 在不支持 rte_flow IPIP 卸载的 NIC（如 virtio）上仍可起栈；GIF 隧道走 FreeBSD `if_gif/in_gif` 软件路径。端到端 IPIP 隧道实测：服务端 `tools/sbin/ifconfig gif0 create + tunnel + inet` + 客户端 Linux `ip tunnel add gif0 mode ipip` + ping 3/3 received 0% loss RTT 0.29-0.65 ms。example/Makefile 在 libfstack.a 未启 FF_ZC_SEND 时自动跳过 helloworld_zc target。详见 `docs/freebsd_13_to_15_upgrade_spec/zh_cn/phase2-M10-execution-log.md`
 
 ### 3.2 FreeBSD 移植的子系统
 

docs/zh_cn/F-Stack_Knowledge_Base_Summary.md

@@ -2,7 +2,7 @@
 
 **文档版本**: 1.0  
 **生成日期**: 2026-03-20  
-**内容范围**: F-Stack v1.26（FreeBSD 15.0 移植；2025-2026 自 13.0 升级 —— M0~M5 + runtime-fix + rib-fix + Phase-5b NFR-1 PASS；**Phase-2 M6 启用 FF_NETGRAPH+FF_IPFW combo + M7 启用 FF_USE_PAGE_ARRAY + M8 启用 FF_ZC_SEND + M9 PA+ZC combo，2026-06-08**）+ DPDK 23.11.5 完整三层架构知识库  
+**内容范围**: F-Stack v1.26（FreeBSD 15.0 移植；2025-2026 自 13.0 升级 —— M0~M5 + runtime-fix + rib-fix + Phase-5b NFR-1 PASS；**Phase-2 M6 启用 FF_NETGRAPH+FF_IPFW combo + M7 启用 FF_USE_PAGE_ARRAY + M8 启用 FF_ZC_SEND + M9 PA+ZC combo + M10 启用 FF_FLOW_IPIP，2026-06-08**）+ DPDK 23.11.5 完整三层架构知识库  
 **文档位置**: `/data/workspace/f-stack/docs/`  
 **用途**: 规格驱动开发 (Spec-Driven Development) 的前置架构文档
 

example/Makefile

@@ -17,10 +17,22 @@ LIBS+= -L${FF_PATH}/lib -Wl,--whole-archive,-lfstack,--no-whole-archive
 LIBS+= -Wl,--no-whole-archive -lrt -lm -ldl -lcrypto -pthread -lnuma
 
 TARGET="helloworld"
+
+# M10: helloworld_zc requires libfstack.a built with FF_ZC_SEND=1
+# (it depends on ff_zc_send / ff_zc_mbuf_*). Probe the archive and
+# only build the ZC binary when the symbol is exported, so that
+# milestones which disable ZC for isolation (e.g. M10 FF_FLOW_IPIP)
+# still produce the other binaries successfully.
+ZC_SUPPORTED := $(shell nm ${FF_PATH}/lib/libfstack.a 2>/dev/null | grep -q "T ff_zc_send" && echo 1)
+
 all:
 	cc ${CFLAGS} -DINET6 -o ${TARGET} main.c ${LIBS}
 	cc ${CFLAGS} -o ${TARGET}_epoll main_epoll.c ${LIBS}
+ifeq ($(ZC_SUPPORTED),1)
 	cc ${CFLAGS} -DINET6 -DFSTACK_ZC_SEND -o ${TARGET}_zc main_zc.c ${LIBS}
+else
+	@echo "[M10 skip] libfstack.a built without FF_ZC_SEND — skipping ${TARGET}_zc"
+endif
 
 .PHONY: clean
 clean:

lib/Makefile

@@ -38,13 +38,13 @@ endif
 
 #FF_FLOW_ISOLATE=1
 #FF_FDIR=1
-#FF_FLOW_IPIP=1
+FF_FLOW_IPIP=1
 # NETGRAPH drivers ipfw
 FF_NETGRAPH=1
 FF_IPFW=1
 
-FF_USE_PAGE_ARRAY=1
-FF_ZC_SEND=1
+#FF_USE_PAGE_ARRAY=1
+#FF_ZC_SEND=1
 FF_INET6=1
 
 # TCPHPTS drivers rack and bbr

lib/ff_dpdk_if.c

@@ -1438,10 +1438,21 @@ ff_dpdk_init(int argc, char **argv)
 
 #ifdef FF_FLOW_IPIP
     // create ipip flow for port 0
+    /*
+     * M10: rte_flow IPIP rule is a hardware-offload optimization;
+     * virtio NICs (and other drivers without rte_flow IPIP support)
+     * return ENOTSUP here. The GIF tunnel itself works in software
+     * via FreeBSD's if_gif/in_gif path regardless, so we degrade
+     * to a warning instead of rte_exit() to keep the helloworld
+     * primary alive on hardware that lacks flow offload.
+     */
     if (rte_eal_process_type() == RTE_PROC_PRIMARY){
         ret = create_ipip_flow(0);
         if (ret != 0) {
-            rte_exit(EXIT_FAILURE, "create_ipip_flow failed\n");
+            printf("M10 [WARN] create_ipip_flow failed (ret=%d) — "
+                   "NIC lacks rte_flow IPIP offload; falling back "
+                   "to software GIF tunnel path. This is expected "
+                   "on virtio and similar drivers.\n", ret);
         }
     }
 #endif