igc: stability improvements
Always disable PCIe ASPM for i226 type cards to improve stability and wire sysctl calls to iflib_request_reset instead of igc_if_init as this will stall the drivers RX path.
pci: Add L1 PM definitions
Add register/bit definitions for the L1 PM substates capability
(PCIZ_L1PM) to pcireg.h.
Signed-off-by: Michael Adler <madler at tapil.com>
pci: Add L1 PM definitions
Add register/bit definitions for the L1 PM substates capability
(PCIZ_L1PM) to pcireg.h.
Signed-off-by: Michael Adler <madler at tapil.com>
igc: stability improvements
Always disable PCIe ASPM for i226 type cards to improve stability and wire sysctl calls to iflib_request_reset instead of igc_if_init as this will stall the drivers RX path.
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
MFC after: 4 days
igc: Apply ASPM L1.2 workaround to all I226 devices
Classify I226_LMVP and I226_BLANK_NVM as I226 silicon so they
receive the I226-specific ASPM L1.2 workaround.
PR: 279245
MFC after: 1 week
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2318
igc: Disable ASPM L1.2 on I226 to prevent RX stalls
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
[8 lines not shown]
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
configd: further restrict configd actions to root and wwwonly for more sensitive actions (stopping services, reading certain data, ..) that won't be scheduled anyway and should have no other consumers.
addition to https://github.com/opnsense/core/commit/a313cbd5bdcfc3c9d4a55704fcdb8bbcf7182069
In the long run we might consider swapping the defaults, but since the chance of regressions is rather larger and most callouts aren't that problematic anyway, opt for explicit elevated rights for now.
Firewall: Rules and NAT: Group invalid rules to the end of the ruleset. These rules are skipped by PF processing because they do not have a valid interface. (#10550)
---------
Co-authored-by: Stephan de Wit <stephan.de.wit at deciso.com>
