Add sysconf(8) and libbsdconf(3)
Complete the native configuration trinity: sysctl(8) for live kernel
state, sysrc(8) for rc.conf(5), and sysconf(8) for the remaining base
configuration -- loader.conf(5), sysctl.conf(5), and the make.conf(5)
family -- atop libbsdconf(3).
libbsdconf resurrects figpar as a unified reader/writer. Callbacks own
semantics; statements may span multiple lines via backslash continuation;
non-seekable input is spooled; writes are atomic (mkstemp, fsync, rename)
with mode/owner preservation. Format descriptors name each target, its
files, and quoting rules without private parsers. Multi-file targets
follow boot sourcing order; loader chases loader_conf_files as the boot
loader does.
sysconf(8) is the operator-facing tool: name / name=value on a required
target, sysrc-style list edits, make append and list-strike where they
belong, jail/altroot, and a capsicum sandbox for read-only use.
[21 lines not shown]
igbv: Recover disabled Hyper-V transmit queues
The Windows PF can disable a VF transmit queue while continuing to
report carrier up. Link polling alone then leaves the VF operationally
up even though it cannot transmit. The reproduced VLAN failure shows
this state with PF driver 14.1.5.0 and an MDD indication in the host trace.
Check queue zero from the admin path only while the Hyper-V VF is
running with sanitized queues and a completed host handshake. Report
operational link down and invalidate the statistics baseline when the
queue is disabled. Request recovery through the normal iflib stop/init
path only when a fresh, accessible STATUS read reports carrier up.
Rate limit requests if the host continues to hold the queue disabled,
and leave recovery pending while carrier is down.
Document the recovery behavior and clarify why the Hyper-V reset retains
the VF-local software reset before its host reset/MAC exchange.
Sponsored by: BBOX.io
cxgbe: Use the correct GHASH offset for a GMAC from a full TLS record
If a TLS request transmits all but a part of the GMAC at the end of a
TLS record, the work request asks the crypto engine to return the
calculated GMAC to the driver so it can be sent in a simple TCP packet
when the rest of the TLS record is transmitted in the future.
However, the offset of the returned GHASH offset was calculated
incorrectly in this case causing the driver to not recognize the
cached GMAC and instead use a more wasteful work request in the future
that encrypted the entire TLS record discarding all but the needed
bytes of the trailer.
Note that this does not effect correctness, just efficiency.
Reviewed by: np
Fixes: 9e269eafebfc ("cxgbe: Use partial GCM mode for partial TLS records on T7")
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D59711
vlan: Notify the parent when replacing a VLAN ID
Changing the VID of an existing VLAN interface rehashes the interface and
announces the new VID, but does not unregister the old VID. Parent
drivers and VLAN event consumers can consequently retain stale filter
membership.
After successfully inserting the new VID, emit vlan_unconfig for the old
VID before the existing vlan_config notification. Do not unregister
anything if insertion fails and the old VID is restored.
MFC after: 2 weeks
Sponsored by: BBOX.io
igbv: Support Hyper-V virtual functions
Use the Hyper-V reset/MAC exchange for 82576 and I350 VFs instead of the
native posted mailbox protocol, which the Windows PF does not service.
Read the host assigned address through configuration bytes 0x201 through
0x206 only during reset, and use it to identify the matching synthetic
hn(4) interface. The operations are local to the VF frontend.
Poll hardware link status rather than retaining a native mailbox link
handshake. Leave MAC, multicast, promiscuous-mode, and VLAN membership
policy with the host. Disable guest VLAN registration and native receive
limit requests, and limit the VF to an MTU of 1500 bytes.
Preserve accumulated statistics across host resets without counting a
counter clear as a wrap. Reject inaccessible register samples and rebase
after a reset indication or a disabled transmit queue, including when the
PF blocks the queue for malicious driver detection.
Document single queue support and host assigned access VLANs. Guest VLAN
[9 lines not shown]
man: Link mlx5en.4 also to if_mce.4
For consistency, create a symbolic link from mlx5en.4 to also if_mce.4
Reviewed by: ziaee, #manpages
Event: EuroBSDCon 2026
Differential Revision: https://reviews.freebsd.org/D59610
MFC after: 3 days
(cherry picked from commit e46a7d842a7572cc7ccef88a463a9af1a725fefc)
acpi: Don't compile CPU_VENDOR_{AMD,HYGON} cases on non-x86_64
Fixes build on aarch64.
Fixes: 5f68acc931a4 ("acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume")
Sponsored by: The FreeBSD Foundation
iflib: add a new global tunable "prefer_mpring"
net.iflib.prefer_mpring can be used to control whether or
not all iflib driver instances default to mp_ring or simple_tx.
This is intended to be temporary, to allow easy testing (now) of
simple_tx, and to allow an easy fallback to the legacy path
(later) once the default is switched to simple_tx
acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume
If amdsmu(4) is not loaded when entering suspend-to-idle and on an AMD
CPU, emit a warning.
FreeBSD currently only supports S0ix on AMD CPUs through the SMU. When
Intel support is completed, we should check the equivalent for Intel
(intelpmc).
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59672
iflib: implement driver-provided queue selection for simple tx
Until now, simple tx has used its own queue selector, and has
ignored isc_txq_select and isc_txq_select_v2 (not this only
seems to matter for ice(4) with dcb enabled). This change
makes simple-tx use isc_txq_select* when present.
The implementation is defined to be efficient, with a
transmit routine chosen up-front that hard-codes the
queue selection and calls an always-inlined body. This
avoids a useless test per packet in the hotpath, and
also may avoid speculation into header parsing.
Note that this was designed for readability and efficiency
in the common case (interface up, not ALTQ). That's why
we do queue selection without duplicating nic-running and
altq checks, leaving them to the common implmentation.
Sponsored by: Netflix
[2 lines not shown]
proc: free kstack buffers when debug permission changes
The kern.proc.kstack handler allocates its output and stack buffers
before deliberately checking p_candebug again under the process lock.
If trace-control state changes between authorization checks, the failure
path balances the process and exec state but leaks both buffers.
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <andrew at calif.io>
Fixes: 8b5abd9027b8 ("kern_proc.c: disallow execve around sysctl kern.proc.kstacks")
Reviewed by: markj
MFC after: 1 week
mac_bsdextended: reject negative rule indices in sysctl_rule()
The security.mac.bsdextended.rules.<N> node handler takes N as
`index = name[0]` (a signed int) and only checks
`index >= MAC_BSDEXTENDED_MAXRULES`. A negative index is caught on
the read branch, but the write-only add and delete
branches proceed to `rules[index]` unconditionally.
Reject `index < 0` alongside the existing upper-bound check.
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <andrew at calif.io>
Reviewed by: markj
MFC after: 2 weeks
truss(1): capsicumize
The new ptrace(2) features allow to change truss(1) to systematically
operate on the process descriptors instead of pids.
Allocate the global kqueue that tracks all noted children
by pdopenpid()-ing them and adding to the kqueue with
EVFILT_PROCDESC/NOTE_PDSIGCHLD. The activated knote triggers the
pdwait() call to return the child tracing info. This replaces the
waitid(P_ALL) call in the non-capsicumized truss(1) eventloop.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58094
verbs/mlx5: Add GRE and MPLS flow specification filter
[PATCH 30/31] FreeBSD OFED support for DPDK MLX5 PMD
a) Allow verbs applications packet steering of GRE tunneled traffic.
Adding GRE flow specification based on RFC 2890.
GRE consists of flags, protocol and key fields.
IPv4 protocol 47 (IPPROTO_GRE) can be used when GRE packets are
encapsulated in IPv4.
b) verbs: Add MPLS flow specification filter
Add MPLS flow specification based on RFC 3032.
MPLS spec defined with label field which includes the
label value and additional parameters such as: BoS, TC and TTL.
MPLS allows stacking multiple labels in sequence.
In addition, the MPLS header can be encapsulated on top of different
layers, e.g.: ETH, IP (rfc4023), UDP (rfc7510), GRE (rfc4023).
Therefore, when using the flow creation verb, the application should
[14 lines not shown]
IB/mlx5: Expose GRE flow spec to user-kernel ABI header
[PATCH 29/31] FreeBSD OFED support for DPDK MLX5 PMD
a) Add ib_uverbs_flow_spec_gre to define the rule to match GRE
encapsulation protocol.
The spec includes the generic specs header, type, size and reserved
fields while the filter itself is defined as ib_uverbs_flow_gre_filter
and includes:
- Checksum present bit, key present bit and version bits in a single
16bit field.
- Protocol type field - Indicates the ether protocol type of the
encapsulated payload.
- Key field - present if key bit is set and contains an application
specific key value.
b) IB/uverbs: Expose MPLS flow spec to user-kernel ABI header
[24 lines not shown]
fixup! verbs/mlxs: mlx5: Add tunnel offloads support in direct verbs
Fix is based on upstream rdma-core commit ee54f9d5348f ("mlx5: Add
loopback flags to QP creation").
Validate create_flags against a supported-flags mask instead of rejecting
anything that is not MLX5DV_QP_CREATE_TUNNEL_OFFLOADS. A create_flags of
0 is now accepted, unknown bits are rejected, and the vendor flag is OR-ed
in rather than assigned. The loopback flags that commit also adds do not
exist in this tree, so only the validation is taken.
Sponsored by: NVidia networking
MFC after: 1 month
fixup! IB/mlx5: Expose GRE flow spec to user-kernel ABI header
Import Linux upstream commit a93b632c4531 ("IB/mlx5: Fix GRE flow
specification").
Honour the user-supplied GRE protocol mask instead of hard-coding 0xffff,
so wildcard and partial masks work.
Also give flow_spec_data[] 8-byte alignment, so this userspace copy of
struct ib_uverbs_flow_spec_hdr matches the kernel UAPI on 32-bit builds.
The kernel header has always used __aligned_u64 here and only our copy
diverged, so there is no upstream commit for that half. The attribute is
spelled out instead of introducing an __aligned_u64 macro, which
<infiniband/types.h> does not provide and which libbnxtre already defines
for itself.
Sponsored by: NVidia networking
MFC after: 1 month
fixup! verbs/mlx5: Add GRE and MPLS flow specification filter
Import rdma-core upstream commit ff01da2c5ac2 ("verbs: Fix typo in copying
IBV_FLOW_SPEC_UDP/TCP 'val'").
The TCP/UDP filter value was copied using the size of the IPv4 filter,
overrunning the destination subobject.
Also accept inner MPLS flow specs, matching 6d6f29721eea ("verbs: Allow
creation of inner MPLS flow spec"). Upstream deliberately has no inner
case for GRE - it is a tunnel header, matched only in the outer stack - so
that part of the review comment is not applied.
Sponsored by: NVidia networking
MFC after: 1 month
fixup! verbs/mlx5: Expose tag matching capabilities
Reject TM-SRQ creation when tm_cap.max_ops is 0, so the internal command
QP's send queue is not sized to zero work-queue entries.
Sponsored by: NVidia networking
MFC after: 1 month
fixup! IB/mlx5: Add tunneling offloads support
Import Linux upstream commit 4e2b53a5cb5a ("IB/mlx5: Report inner RSS
capability").
Define MLX5_RX_HASH_INNER as (1UL << 31). Shifting 1 into the sign bit of
a plain int is undefined behaviour, and user space compiles this header
too. The main.c half of that commit is already carried by the preceding
fixup.
Sponsored by: NVidia networking
MFC after: 1 month
fixup! IB/mlx5: Expose multi-packet RQ capabilities
Import Linux upstream commit ccc870879027 ("IB/mlx5: Allow creation of a
multi-packet RQ").
Only the create_rq() part was missing: the striding RQ parameters we
validate and store on the WQ never reached the firmware. Program
two_byte_shift_en, single_stride_log_num_of_bytes and
single_wqe_log_num_of_strides, with the two log values encoded relative to
their MLX5_MIN_* bases so the 3-bit firmware fields do not truncate them.
Upstream renamed these WQ context fields later on, so the names used here
are the ones this tree's mlx5_ifc.h still carries.
Sponsored by: NVidia networking
MFC after: 1 month
verbs/mlxs: mlx5: Add tunnel offloads support in direct verbs
[PATCH 28/31] FreeBSD OFED support for DPDK MLX5 PMD
a) In order to enable offloading such as checksum and LRO for incoming
tunneling traffic, the QP should be created with tunnel offloads flag -
MLX5DV_QP_CREATE_TUNNEL_OFFLOAD.
b) Reports capability of which tunneling type supports
the tunneling offloads.
c) verbs: Add support in RSS of the inner packet
Some user space application would like to do RSS on the inner packet
fields instead of the outer. When user will set the IBV_RX_HASH_INNER
bit with one of the other hash fields, then the RSS will be on the inner
packet.
Differential revision: https://reviews.freebsd.org/D32203
MFC after: 1 month
verbs/mlx5: Allow creation of a Multi-Packet RQ using direct verbs
[PATCH 27/31] FreeBSD OFED support for DPDK MLX5 PMD
a) Add needed definitions to allow creation of a Multi-Packet RQ
using the mlx5 direct verbs interface.
In order to create a Multi-Packet RQ, one needs to provide a
mlx5dv_wq_init_attr containing the following information in its
striding_rq_attrs struct:
- single_stride_log_num_of_bytes: log of size of each stride
- single_wqe_log_num_of_strides: log of number of strides per WQE
- two_byte_shift_en: When enabled, hardware pads 2 bytes of zeros
before writing the message to memory (e.g. for IP alignment).
b) Add a helper function to verify 64 bit comp mask
The common check for a mask is as follows:
if (comp_mask & ~COMP_MASK_SUPPORTED_VALUES)
return EINVAL;
[11 lines not shown]
libmlx5: Report Multi-Packet RQ capabilities through mlx5 direct verbs
[PATCH 26/31] FreeBSD OFED support for DPDK MLX5 PMD
A Multi-Packet RQ is a receive queue where multiple packets are
written to the same WQE. Each message starts in the beginning of a
stride. The total size of the scatter elements of each WQE is
determined upon RQ creation and all the posted WQEs should meet the
determined size.
A Multi-Packet RQ reduces the number of needed post-recv operations
thus increasing performance.
It reduces memory footprint by allowing each packet to consume a
different number of strides instead of the whole WR.
Differential revision: https://reviews.freebsd.org/D32201
MFC after: 1 month
IB/mlx5: Fix ABI alignment to 64 bit
[PATCH 25/31] FreeBSD OFED support for DPDK MLX5 PMD
Struct mlx5_ib_striding_rq_caps was not aligned to 64 bit as
it should have been. Add a 32 bit reserved field.
Differential revision: https://reviews.freebsd.org/D32200
MFC after: 1 month
verbs/mlx5: Expose tag matching capabilities
[PATCH 23/31] FreeBSD OFED support for DPDK MLX5 PMD
a) Expose tag matching capabilities and show them in ibv_devinfo.
b) verbs: Introduce tag matching SRQ
Introducing tag matching SRQ (TM-SRQ), which retains basic semantic of
regular SRQ, reports completions to own CQ, and has additional tag
based message receiving mechanism.
Detailed description for the TM-SRQ usage was added into
Documentation/tag_matching.md
c) mlx5: Add support to tag matching SRQ type
Create command QP for a tag-matching SRQ. Command QP used for
inserting/removing entries from the tag matching list. This command QP
is hidden from the users in the mlx5_srq structure.
New verb ibv_post_srq_ops() will be added in next patch to use it.
[2 lines not shown]
