Retain the PF-accepted MAC and VLAN settings from the per-port t4iov
companion and expose them through the corresponding cxgbe ifnet.
Publish, snapshot, and destroy the cache under the existing adapter
synchronized-operation mechanism so status queries cannot race IOV
configuration or teardown.
Track successful t4iov attachment independently of the active VF count.
Restrict reporting to the port main VI, return an empty status for a
supported but unconfigured PF, and omit status from VF and auxiliary
VIs.
Reviewed by: jhb
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58741
Some firmware assigns only one bus number to each PCI-PCI bridge. This
prevents later SR-IOV VF enumeration when a VF routing ID falls on a bus
number already allocated to a sibling bridge.
Reserve only the additional bus numbers required by SR-IOV PFs.
Enumerate all directly attached functions before child drivers and
bridges attach, inspect their device_t objects for SR-IOV, and grow the
PCI bus resource through the highest possible VF routing ID.
First VF Offset and VF Stride may change when NumVFs changes. Probe
every valid NumVFs value and preserve the original setting. When the
upstream hierarchy uses ARI, temporarily enable the SR-IOV ARI Hierarchy
control in the lowest-numbered PF while sizing, then restore it. Scope
active-VF detection to each conventional PCI slot; an ARI bus remains
one slot-0 hierarchy. If firmware left VFs enabled on a device, do not
modify it and reserve only its active layout.
During runtime configuration, consult the PCI bus's owned resource
range rather than PCI-PCI bridge registers. This recognizes an existing
boot-time reservation beneath both PCI-PCI and host bridges and avoids a
second, overlapping bus-number allocation.
This avoids consuming bus numbers behind unrelated bridges. The runtime
allocation in pci_iov.c remains as a fallback when the boot-time range
cannot be enlarged. hw.pci.clear_buses remains useful when firmware
assigned a required number to another bridge before enumeration.
Validated the targeted implementation on an Intel E810-XXV behind a
non-ARI root port. With hw.pci.clear_buses=1 and no global reserve
tunable, the PF bridge received buses 1-2 while three unrelated bridges
each received one bus. A VF with First VF Offset 0x100 attached as
iavf0 at pci0:2:0:0, and detached cleanly.
Reviewed by: jhb, manpages (ziaee)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58624
Stop initialization when hardware setup, ring initialization/start, or
datapath start fails. Run the existing best-effort stop/cache/reset
cleanup and report the failure through iflib_init_failed(). Do not keep
configuring later rings or publish the interface as running.
Reviewed by: nprice
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59853
Atlantic controllers can retain receive descriptors and their data
addresses after their rings are disabled. Reusing or releasing those
mappings without invalidating the device cache has caused observed
IOMMU and SMMU faults in the referenced Linux reports (7a1bb49461b1,
ed4d81c4b3f2 and 7526183cfdbe).
Move global cache invalidation out of the per-ring stop routine. Disable
every ring first, toggle invalidation once, and wait for its completion
indication. Exclude Atlantic A0, as in the upstream workaround. Report
a completion timeout rather than silently discarding it.
Reviewed by: nprice
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59852
Use rss_getkey() for the initial VNIC key instead of generating a
per-attachment private key. Preserve the writable rss_key sysctl,
its override lifetime, the hardware DMA representation, and all hash
and indirection settings.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59795
Implement SIOCGIFRSSKEY and SIOCGIFRSSHASH for qlnxe and qlnxev using
the cached vport RSS configuration. This lets hn(4) synchronize its
synthetic RSS configuration with the VF without assuming that every
driver programs all of the common RSS hash selections.
Serialize the queries with the device lock and reject them while the
interface is not running. Convert the firmware request's key words back
into network byte order and translate the six representable IPv4/IPv6
TCP/UDP hash selections. Report no hashing when RSS is disabled, including
the driver's single-queue configuration.
For VFs, require a successful RSS extension response from every hardware
function. The overall vport-update reply can succeed while its RSS TLV
is missing or rejected; recording that result prevents reporting an
unconfirmed configuration. Invalidate the confirmation before each RSS
request. Leave existing vport-update return semantics, queue setup, and
the receive datapath unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59810
Replace the repeated hardware-reset key with rss_getkey(). Decode each
eight-byte chunk with be64dec() into the register-word array before
programming the five key registers.
This matches the key serialization in DPDK's nicvf_rss_set_key(), added
by commit 7694fab264ac666d62a4cae04f2979991ce64259
("net/thunderx/base: add RSS and RETA configuration"). A raw copy into
the word array on little-endian hosts would reverse bytes within each
register relative to that convention.
Preserve the CPI-algorithm gate, enabled hash fields, and round-robin
indirection table.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59806
Replace the random register words with rss_getkey() and decode each
four-byte chunk with le32dec() before writing the port's key registers.
Keep the RSS capability check and existing queue-count and indirection
table programming unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59805
Fetch the common Toeplitz key instead of filling it with random bytes
during receive-forwarding setup. Check the key size at compile time and
retain the existing host-to-network conversion for each hardware word.
Leave forwarding, hash selection, and queue mapping unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59804
Replace the embedded key with rss_getkey(). Retain the reversed 64-bit
word-pair order and low-word-first layout used by the existing firmware
request, matching the qlxgbe conversion.
The common default produces the same five firmware words as the old
constants. Leave hash selections, RSS enablement, and the indirection
mask unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59803
Replace the embedded default with rss_getkey(). Preserve the ICB's
little-endian representation of each big-endian key word, then copy
the initial 16 bytes of the serialized IPv6 key into the IPv4 key.
This retains the old default-key bytes and allows a configured common
key to take effect. Leave RSS flags and queue mapping unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59802
Replace the embedded key with rss_getkey(), retaining the firmware's
reversed 64-bit word-pair order and low-word-first layout within each
pair. The common default produces the same mailbox key as the existing
constants, while configured common keys no longer get ignored.
Leave the RSS enable flags, hash types, and indirection policy unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59801
Replace the embedded default key with rss_getkey(). Decode each group
of four key bytes as a big-endian word; the shared code then serializes
those host-order words as little-endian firmware fields. This preserves
the existing hardware representation for the common default and allows
a configured common key to take effect.
Keep the existing multi-queue gate, RSS hash selections, and indirection
policy unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59800
Use rss_getkey() for each port's initial key instead of a lazily generated
driver-global random key. Remove the obsolete helper and its unsynchronized
initialization flag. Make the common-key declaration available without
options RSS.
The port still retains the key used for hardware programming and the
existing SIOCGIFRSSKEY response. Leave hash types and queue placement
unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59799
Replace the private fixed key with rss_getkey(). Copy the common byte
stream directly into the RSS queue-pair context and use the same helper
for SIOCGIFRSSKEY, so hardware programming and hn's query agree.
Change the helper to fill caller-owned storage instead of returning a
pointer to a static key. Check the fixed hardware and ioctl buffer sizes
at compile time. Leave RSS masks and queue steering unchanged.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59798
Fill the RSS configuration request with the common 40-byte key instead
of fresh random bytes. Preserve the mailbox representation, hash
selection, and indirection table.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59797
Use the common RSS key instead of generating private random words.
Reverse the bytes before passing the key to the shared code, which copies
the supplied bytes directly into the firmware request. The searcher
consumes this array in reverse order; a raw copy of the common key would
not produce matching Toeplitz hashes.
The hardware ordering is documented by Linux commit
d682d2bdc30650a5c7ce9908ab83ab674b658744 ("bnx2x: byte swap rss_key to
comply to Toeplitz specs"). Keep the conversion in the FreeBSD caller
rather than changing the shared-code interface.
Preserve the config_hash gate, including the PMF-only key programming
on 57710/57711, and leave hash types and indirection policy unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59796
Fetch the common key in the PCI iflib frontend regardless of options RSS
and make the key API declaration available in both configurations.
Retain the existing hash-field selection and queue-placement branches.
The independent ARM frontend is unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59794
Fetch the common RSS key independently of options RSS instead of
generating a private key in non-RSS kernels. Keep the existing
software-RSS or round-robin indirection policy and hardware key
serialization unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59793
Use rss_getkey() in the older em multi-queue RSS path, which is reached
by 82574 with two receive queues. This replaces a private key generated
on each initialization and matches the common-key policy already used
by the igb path.
Decode each register word with le32dec() and remove the private assembly
macro, avoiding signed integer shifts while preserving the register byte
order. Leave the redirection table and hash fields unchanged. This does
not change single-queue em devices or PF-owned igb VF RSS settings.
Reviewed by: erj, gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59792
Zero the complete 52-byte RSS key buffer before fetching the common
40-byte key. Both the X722 AdminQ path and the register path consume all
52 bytes; the trailing extended-key bytes must not come from uninitialized
stack storage. This matches the zero padding already used by iavf and ice.
Remove the unused driver-default key helper and its declaration. Keep
the standard key, hash selections, and indirection policy unchanged.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59791
Use rss_getkey() when programming the RSS key through virtchnl regardless
of options RSS, matching the register-programming path. The common key
is available independently of RSS queue placement; the driver-specific
default otherwise makes the chosen key depend on the PF's configuration
interface.
Remove the unused default-key helper and its declarations. Preserve the
negotiated key length, zero padding, hash selections, and indirection-table
policy.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59790
Provide the iflib RSS query methods for X550 and newer VFs, whose RSS key
and hash types are programmed by the VF. Cache those values and answer
queries under the context lock, without register reads or mailbox
transactions. Invalidate the snapshot at init, stop, and when an admin
check requests recovery after losing the PF mailbox or detecting reset.
Reject queries while the snapshot or mailbox is unavailable.
Program the common RSS key and cache the values written to the registers.
The key remains stable across resets, including live MTU and capability
changes for which hn(4) can retain its copy without another VF handoff.
Serialize the key in register byte order and report the six supported
IPv4/IPv6 TCP/UDP hash selections from the programmed MRQC, rather than
claiming that every globally requested hash type is enabled. A single
receive queue still performs Toeplitz hashing. Older VFs retain
EOPNOTSUPP because their PF-owned RSS settings are not available here.
This allows hn(4) to synchronize synthetic RSS with the actual VF
settings instead of suppressing otherwise usable receive hash metadata.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59692
Use rss_getkey() for PF and VF RSS programming even when options RSS is
not configured. The common key is available independently of RSS queue
placement and is also used by software hashing. Generating a private key
on each initialization defeats that agreement and changes receive hashes
across resets.
Leave hash-field selection and indirection-table placement unchanged.
82599 and X540 VFs retain their PF-owned RSS configuration.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59789
Treat unsupported RSS queries and RSS_FUNC_NONE as normal reasons to
suppress synthetic receive hash metadata. Keep diagnostics for other
errors and invalid configurations. Also suppress hash metadata when
reconfiguring synthetic RSS fails, since the VF and synthetic settings
cannot then be assumed to agree. Correct the hash-query diagnostic name.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59691
Dispatch SIOCGIFRSSKEY and SIOCGIFRSSHASH through typed get_rss_key and
get_rss_hash methods under the context lock. Drivers can report their
programmed key and hash selections. The default methods return EOPNOTSUPP.
The common RSS key does not describe which hash selections a particular
device actually programs. hn(4) needs the effective VF configuration when
synchronizing RSS between its synthetic and VF receive paths.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59691
A VF can finish initialization or reset recovery after hn's handoff-time
RSS query returned ENXIO. In that case hn suppresses synthetic receive
hash metadata, but previously left it disabled even after the VF could
answer the queries again.
Queue an RSS refresh on a VF link-up notification, using the existing VF
worker in both transparent and non-transparent modes. Revalidate the
association, active VF path, administrative state, and carrier under
hn_lock before querying and reconfiguring synthetic RSS. Coalesce the
requests with an atomic flag and retain a request while capability
forwarding temporarily excludes the worker. Keep the existing query
validity checks and unsupported-query fallback unchanged.
This is a one-shot refresh, not a readiness poll. Recovery without a
link-up notification, or a query that still fails during the refresh,
does not trigger another retry by itself. A later link-up or normal
handoff can query again. Consuming the request while the VF path is
inactive is intentional: the next handoff queries RSS unconditionally.
Continue to reprogram RSS after a successful query even when the cached
key and types match. They are updated before host reconfiguration and
do not prove that the previous programming succeeded.
The event callback only records and schedules work; RSS queries and host
reconfiguration remain in sleepable context. No packet-path changes or
new timer are needed.
With an E835 iavf VF, reproduced an ENABLE_QUEUES timeout and an ENXIO
RSS query in both transparent and non-transparent modes. In each mode
hn restored mbuf_hash after VF recovery, without another interface
reconfiguration.
MFC after: 2 weeks
Sponsored by: BBOX.io
The VC worker ignores the pending count returned by iavf_process_adminq.
If a pass exhausts its message budget, replies can remain in the receive
ring without another interrupt to schedule the worker. During init,
the iflib admin task cannot provide a backstop because init holds the
context lock while waiting for ENABLE_QUEUES to complete.
Reschedule the VC worker after a successful pass with messages remaining.
Keep the per-pass budget and do not retry AdminQ errors. Stop
self-rescheduling once detach clears INITIALIZED; the existing polling
and reset-recovery gates continue to exclude asynchronous processing.
Validation: reproduced the timeout on a three queue E835 VF under
Hyper-V. Temporary tracing showed a successful ENABLE_QUEUES reply
already in the guest receive ring after a three-message pass left two
messages pending. With the fix and no tracing, a GENERIC kernel with
WITNESS and INVARIANTS passed three batches of 30 down/up and MTU
1500/9000 cycles without enable/disable timeouts.
MFC after: 2 weeks
Sponsored by: BBOX.io
Report the VF MAC, allocated transmit and receive queues, exact trunk
VLAN-filter count and capacity, negotiated virtchnl API, configured MAC,
VLAN, spoof-check, and promiscuous-mode policy, automatic link-state
policy, PF traffic permission, and fault containment through iflib.
Expose mirror configuration and active hardware rules, precise
malicious-driver isolation and counters, software mailbox-overflow
isolation and counters, VF-owned MAC-filter count and limit, and reset
diagnostics through a versioned driver.ice extension. Distinguish a
failed VF reset from a required VSI rebuild, which may still be pending
rather than failed. Keep the namespace schema local to the driver so
future extensions need no changes to common network headers or the
formatter.
Invalidate cached VF handshakes during preparation for an externally
initiated device reset, before releasing the context lock to wait for
hardware. Mark the VFs as requiring rebuild even if an early PF rebuild
failure prevents reaching their VSIs. Software-initiated resets retain
their advance notification before invalidating the handshake.
The iflib context lock protects VF state and VSI lifetime while
constructing the snapshot. The query uses only cached state and does
not issue AdminQ commands or read device registers.
Validation on E810 with host-attached iavf VFs used ifconfig -v and
direct Netlink queries to check handshake, queue, VLAN, policy, MDD,
and mailbox state across VF and PF resets.
Reviewed by: Pawel Sobczyk <[email protected]>, ziaee
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58739
Wire the shared code mailbox-overflow detector into the VF lifecycle and
virtchnl dispatcher. E830 controllers use their per-VF hardware
in-flight-message watermark. On older controllers, attribute a
congested mailbox snapshot to its sender, reset it with its queues
disabled, and discard its subsequent requests. Advance snapshot
accounting even for discarded requests. A physical VFLR, PF reset, or
IOV recreation releases the VF. A blocked VF can still submit mailbox
messages after reset, so discarding requests does not stop it from
replenishing the shared queue.
Process at most one initially full mailbox immediately. If producers
keep it nonempty, mask only the mailbox interrupt cause and let the
periodic admin timer schedule bounded drain work. Keep the shared admin
vector enabled so that OICR and other control-queue events can still be
serviced. Re-enable the mailbox cause after draining and recheck the
queue head for arrivals while the cause was masked. Retry failed reads
through the same deferred path instead of treating them as an empty queue.
Document both protection models and add failure-injection points for the
isolation and scheduling paths.
E810-XXV tests with two host-attached iavf VFs injected overflow on VF 0,
disabling only that VF while VF 1 completed 60 of 60 pings. A physical
VFLR and a PF reset each released VF 0; IOV recreation also reset its
cumulative count. Forced persistent mailbox-pending state produced 20
admin and control-queue passes in five seconds, remained timer-paced,
and did not interrupt sibling traffic.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59029
Consume the per-function MDD latches to attribute transmit and receive
events to the offending VF. Treat the global debug registers only as
the last-cause diagnostic, add the missing Tx data-protection cause, and
select the E830 TCLAN register addresses when required.
Block every virtchnl request from an offending VF, reset it, and leave
its queues and interrupt mappings unconfigured. Most MDD classes stop a
queue, but Tx data protection only drops the offending packet; the reset
makes the reported blocked state an actual DMA fence for every class.
Complete VFR without restoring resources so a later physical FLR can
create a new reset edge and recover the function.
Complete VFR before restoring queue and interrupt mappings. E810 does
not retain mapping writes while VFSWR remains asserted; retaining the
original hardware order prevents an immediate post-attach VFR from
leaving queue-map enable clear.
E810 also sets a parent PF_MDET latch for an event attributed by a
VP_MDET latch to one of its VFs. Do not reinitialize the PF for those
event classes. This prevents a hostile VF from flapping PF and sibling
traffic while retaining recovery for an unattributed PF queue event.
Provide an opt-in auto-reset policy for operators who prefer
availability to persistent isolation. Clear reset induced anti-spoof
latches before releasing a rebuilt VF.
This follows the MDD attribution and reset semantics in section
9.2.2.2.1 of the Intel E810 Datasheet. The per-VF register coverage and
E830 TCLAN selection match the Intel ICE driver, while the default
fail-closed policy follows ixl(4).
Validated on E810 with four four-queue FreeBSD iavf VFs. An invalid
tail write blocked only the offender, incremented its Tx MDD counter,
caused no PF reinitialization, and left a sibling at 50/50 successful
pings. Physical FLR restored the offender and a PF reset rebuilt it
without a spurious anti-spoof block. With auto-reset enabled, the
offender resumed after the reset while its sibling completed 60/60
pings; all queue-map enable bits remained set after the second VFR.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59028
The documented VLAN and MAC filter limits are reversed. Match the
defaults in the driver schema: 64 VLAN filters and 16 non-primary MAC
filters per VF.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59027
VF drivers replay their address filters after reset and may retry a
request whose reply was lost. The PF tracked only a count and
incremented it after an idempotent hardware add, so duplicate replays
eventually exhausted the quota. It then rejected an entire address
batch, including the administrator-assigned address.
Track exact non-primary MAC filter membership within each VF quota.
Validate a complete batch before changing hardware, charge only unique
absent addresses, and update ownership after each successful operation.
Preserve an administrator-assigned address when the VF is not permitted
to change it.
Validated on an E810-XXV with a host-attached iavf VF. The configured
filter quota was filled, then the complete set was replayed across VFR
and PF reset without a duplicate warning or ADD_ETH_ADDR NACK. Deleting
an absent address was a no-op. With allow-set-mac disabled, the guest
could not remove its administrator-assigned filter, while multicast
filter additions continued to succeed.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59026
Extend the optional ICE failure-injection facility with points for the
MAC anti-spoof firmware update and each mandatory VF reset stage.
The reset points report a failed Tx drain command, VFR timeout, receive
queue disable, or final PCIe transaction drain after the corresponding
hardware operation. This permits fail-closed state and recovery tests
without deliberately leaving live DMA during teardown.
The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59025
Reset preparation notifies cooperative VFs, then immediately releases
queue maps and firmware topology. A VF which ignores the notification
can continue DMA while the PF tears down the resources which describe
it.
Assert VFSWR for each configured VF before teardown. Run the mandatory
firmware drain serially, disable active receive queues, verify that PCIe
transactions have drained, and leave the VF held until its VSI rebuild
succeeds. Block ordinary mailbox requests as soon as quiesce begins so
a hostile VF cannot re-enable queues in the warning interval.
Also clear VFLR status only after VFRD and perform the final Transaction
Pending check before publishing VFACTIVE. This follows the VF reset
flow in section 4.1.3.3.3 of the Intel E810 Datasheet. Serializing VFs
stays below the documented limit of four concurrent VM/VF reset flows.
Validated on an E810-XXV with active host VFs and a Linux passthrough
VF. Two active VFs recovered together after a PF reset and eight after
a CORE reset; every VF returned initialized and traffic resumed. A
128-VF configured passthrough topology also survived a PF reset.
With the bhyve process paused while ingress targeted an active Linux
VF, the PF completed quiesce, topology teardown, and VSI rebuild without
guest mailbox cooperation. The VF remained configured but uninitialized
until the guest resumed, then re-handshook and restored traffic.
The companion failure-injection commit forced each mandatory drain
stage to fail. Every affected VF remained inactive with bus mastering
disabled and recovered after SR-IOV recreation.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59024
ice_reset_vf() logs failures to drain PCIe transactions, issue the
mandatory zero-queue command, or observe VFR completion, but still
publishes VFACTIVE. A VF can resume against reset state which the PF
knows is incomplete.
Return an error from the reset operation and retain a reset-failed flag
when any mandatory stage fails. Reject ordinary virtchnl requests while
the failure persists. Publish VFACTIVE only after every stage succeeds.
A later VFLR or PF rebuild can recover the VF and clear the failure.
Remove tracked queue leaves before clearing their software state. The
reset-only AdminQ command drains hardware queues but does not update the
shared scheduler database; losing that bookkeeping can strand queue
resources across VF teardown and recreation.
After a successful VF reset, discard software switch filter state whose
hardware rules were reset and clear guest-owned MAC and VLAN tracking.
Restore PF-owned anti-spoof policy, the broadcast filter, and the
assigned MAC before publishing VFACTIVE. The guest can then replay its
own filter state without stale software entries suppressing the firmware
requests.
Tested on an E810-XXV with a host-attached iavf. Repeated VFLRs rebuilt
the base filters with new firmware rule IDs and restored traffic.
Forced reset-stage and policy-replay failures remained inactive until
recovery, and a PF reset rebuilt the VF and restored live traffic
automatically.
This follows the conservative reset policy used by ixl(4).
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59023
The SR-IOV schema enables MAC anti-spoofing by default, but the driver
never programs the VSI security section. A VF can therefore transmit
with an arbitrary source address despite the configured policy.
Program ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF when the VF VSI is
created, and replay the policy when the VSI is rebuilt after a PF or
device reset. Fail VF creation or rebuild when firmware cannot install
the security policy so an unprotected VF is never published as active.
Validated on E810 hardware with host-attached and Linux passthrough
VFs. Traffic using the assigned source MAC passed while otherwise
identical forged-source frames were dropped. After a PF reset, assigned
traffic resumed and zero of ten forged frames reached the peer.
An injected MAC anti-spoof update failure left the VF inactive.
Destroying and recreating the SR-IOV configuration restored the policy
and traffic.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59022
Extend the optional ice(4) failure injection facility with semantic
corruption points for queue configuration, RSS keys and tables, and
interrupt mappings.
Each point mutates an otherwise valid request after the common
virtchnl length check. This exercises the PF semantic validators with a
real VF while preserving the normal wire format and mailbox path.
The queue point selects unaligned Tx or Rx bases, an unaligned or
unrepresentable receive buffer, an invalid frame size, duplicate queue
IDs, or a bad VSI. The RSS points select short advertised data or an
out-of-range LUT entry. The interrupt point selects an invalid ITR,
traffic on vector zero, duplicate vectors, or a bad VSI.
The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59021
Virtchnl requests originate in guest-controlled VFs. The existing PF
implementation checked message shape but allowed several hardware-facing
values through without complete semantic validation.
Require the exact RSS key and LUT sizes advertised to the VF, validate
every LUT entry, and pass only the validated LUT length to firmware. A
short LUT previously caused the AdminQ command to read beyond the
received request.
Validate queue ring bases, descriptor counts, receive buffer units,
maximum frame sizes, and per-VSI consistency before disabling or
changing any queue. This also prevents the 32-bit receive ring length
from being truncated through a 16-bit validation helper.
Advertise the PF frame-size limit in VF resources. Leaving max_mtu
zero causes Linux iavf to request a 16382-byte frame, beyond the
9728-byte limit enforced by this driver.
Some Linux iavf releases use the advertised maximum as max_pkt_size
even when their receive buffers cover fewer bytes within the E810
five-buffer hardware limit. Accept this advisory mismatch for
compatibility. ice_setup_rx_ctx() retains the mandatory hardware
clamp of RXMAX to five data buffers, as Linux ice does. DPDK sizes
its request to the same limit.
Preflight the complete interrupt map before changing queue state.
Reject invalid ITR indices, traffic on vector zero, duplicate
vectors, and queues assigned to multiple vectors. This prevents
hostile input from reaching an MPASS or leaving a partially updated
mapping.
The limits follow the ICE queue context units and the validation policy
used by the Intel ICE and FreeBSD ixl PF drivers.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59020
Add compile-time optional, non-sleeping fail points around every VF
creation resource boundary, before VF VSI reconstruction, and in the
GET_STATS validation path.
Provide an ICE-wide wrapper and device selector so other driver
subsystems can add scoped points without duplicating the failpoint
plumbing. Keep the current SR-IOV points and VF selector in an iov
child namespace.
Compile the facility only with options DRIVER_FAILPOINTS. This shared
option avoids a separate kernel option for every driver that provides
test-only injection hooks. Ordinary kernels contain no ICE failpoint
objects or sysctl nodes. Require an exact PF device name and
optionally a VF index before any point can fire. This prevents a stale
test setting from affecting another PF.
The hooks exposed two reset-lifetime defects while validating the
existing SR-IOV review series. A PF reset could discard a firmware VSI
before teardown, and a rebuilt sibling could leave stale switch-filter
state after IOV destroy.
Tested on an E810-XXV with INVARIANTS and WITNESS. All twelve creation
checkpoints rolled back and permitted immediate resource reuse. Forced
reconstruction and malformed GET_STATS failures also preserved sibling
operation and reply cardinality.
Reviewed by: gallatin, nprice, ziaee
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58940
VF drivers replay their VLAN filters after a reset and may retry a
request whose reply was lost. The PF tracked only a count and sent
every requested ID back to the switch. After PF reset replay had
already restored the filters, duplicate VID 0 failed with
ICE_ERR_ALREADY_EXISTS and NACKed the entire VF batch.
Track exact VLAN membership for each VF. Compact requests to unique
IDs whose membership changes, enforce the configured limit against
those IDs, and update membership after each hardware operation so
partial failures cannot undercount filters. Treat already-present
adds and already-absent deletes as successful reconciliation and
suppress their misleading low-level error dump.
Validated on an E810-XXV with a host-attached iavf VF. A three-filter
limit was filled with VIDs 0, 1, and 4094. PF and CORE resets replayed
all three without a duplicate warning or ADD_VLAN NACK, and DTrace
confirmed a three-VID replay reached the PF. A fourth unique VID was
rejected without changing the count; deleting an absent VID was a
no-op; deleting and replacing a present VID updated the count exactly.
A 128 four-queue VF create/destroy cycle also completed cleanly, and a
newly recreated VF started with an empty membership map.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58909
ice_iov_uninit() freed each VF interrupt-map array without returning the
reserved indices to the device interrupt resource manager. Repeated VF
create and destroy cycles therefore exhausted the PF interrupt map even
though no VFs remained.
Return the interrupt allocation before freeing its map. Also split
software-only VSI release from hardware teardown so failures before
ice_initialize_vsi() do not issue invalid RSS, scheduler, and Free VSI
commands for an object firmware has never seen.
Keep a VF disabled until all of its resources and hardware state have
been created successfully. Clear the enabled state before teardown and
after any failed add so asynchronous mailbox processing cannot use a
partial or freed VSI. Consume VFLR status for inactive VF slots without
trying to reset a nonexistent VSI.
Track whether firmware currently owns each VSI and clear that ownership
after resets. Teardown can then skip AdminQ commands for VSIs which
were not rebuilt. Remove every VSI switch filter before firmware
teardown, matching Linux and preventing filter-list leaks across
create and destroy cycles. This also applies to the PF VSI detach path.
Validated on an E810-XXV with two consecutive create and destroy cycles
of 128 four-queue VFs. A 16-queue VF could then be created. Two
oversized configurations each failed, cleaned back to zero VFs without
invalid firmware teardown commands, and were each followed by a
successful 16-queue VF creation.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58908
The ENABLE_QUEUES handler has already validated the queue selection
before attempting to enable Rx hardware. A timeout or unexpected queue
state is an operation failure, not an invalid virtchnl parameter.
Return VIRTCHNL_STATUS_ERR_ADMIN_QUEUE_ERROR for these failures, matching
the disable path. Keep ERR_PARAM for invalid requests and attempts to
enable unconfigured queues. Preserve the recorded state of queues which
were enabled before a later queue failed.
MFC after: 2 weeks
Sponsored by: BBOX.io
The VF mailbox handler unconditionally submitted queue-disable
commands, including when a VF repeated a request or negotiated after a
PF reset had already destroyed its queues. Firmware can reject stale
Tx queue metadata, causing a NACK and unnecessary VF recovery.
Track queue configuration and enable state across virtchnl operations,
and clear it at VF and PF reset. Apply only hardware transitions that
are not already complete while preserving progress after a partial
failure. Validate queue configurations before mutating hardware so the
state maps remain trustworthy.
FreeBSD configures Tx hardware in CONFIG_VSI_QUEUES rather than
ENABLE_QUEUES, so track Tx configuration separately from Rx
configuration and enable state. Linux ice similarly tracks per-VF Tx
and Rx queue state and skips redundant transitions.
On an E810-XXV, the prior code emitted AQ_RC_EINVAL while configuring a
fresh four-queue VF because it disabled never-configured Tx queues.
With this change, two VFs completed 20 stop/start cycles each, and
recovered across PF and CORE resets with no watchdog, MDD, or AQ errors.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58909
PF and device resets discard all hardware VSI state. ice_rebuild()
only recreated the main PF VSI before replaying configuration for every
VSI. As a result, replay used stale VF VSI handles. Firmware rejected
it with AQ_RC_EACCES and the failure aborted the entire PF rebuild.
Re-add each VF VSI before replaying its configuration, and do not
publish VFACTIVE until both operations succeed. Clear the initialized
state so that the VF must negotiate again. If a VF rebuild fails, leave
it inactive and continue so that one guest cannot prevent the PF or
sibling VFs from recovering.
Mark it initialized only after the resource response is submitted
successfully, so the state follows completion of the mailbox handshake.
Make that failed state authoritative in the mailbox path. While the
firmware VSI is invalid, permit only VERSION and RESET_VF and reject
operations which require VSI state. A VFR may complete the hardware
reset, but cannot make the PF-owned VSI valid or publish the VF active.
Preserve accumulated VF statistics while establishing a new raw
hardware sample after reconstruction. This keeps the cumulative totals
returned to iavf monotonic across PF resets. Return after rejecting a
GET_STATS request for the wrong VSI so that it cannot receive a second
success reply.
Before a locally initiated reset, notify initialized VFs with
RESET_IMPENDING while the mailbox control queue is still alive. Ignore
individual send failures so one VF cannot prevent notification of its
siblings or the reset itself. Send the event from the common reset
preparation path and before directly triggering CORE and GLOBAL resets.
Preserve the inactive state across later VF resets. The zero-queue
Disable LAN Tx AQ remains mandatory to complete every VFR, but do not
clear VFSWR or publish VFACTIVE while the PF-owned VSI remains invalid.
Linux ice uses the same separation: generic rebuild excludes VF VSIs,
the VF reset path rebuilds them separately, and reset preparation
notifies initialized VFs before tearing down the control queues.
Validated on an E810-XXV with one and eight host-attached iavf VFs.
Repeated PF and CORE resets recovered every VF under traffic without
watchdog, MDD, or persistent data-path errors. An additional one-VF
test kept traffic active across PF and CORE resets; carrier and traffic
recovered automatically and both PF and VF watchdog counters stayed at
zero.
Two four-queue VFs passed through to a Linux 7.0 iavf guest also
recovered carrier and traffic automatically after PF and CORE resets.
Simultaneous traffic on both VFs resumed without intervention and the PF
watchdog counter remained zero.
DPDK 25.11 testpmd, using vfio no-IOMMU and two queues per VF, sustained
about 4.55 Mpps per VF before reset. It received reset events for both
VFs after PF and CORE resets. The documented ethdev stop, reset,
reconfigure, and start sequence restored traffic after each reset.
Physical bus mastering remained enabled and the PF watchdog counter
remained zero.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58905
ice_if_init marks DRIVER_INITIALIZED only after all queue and filter
operations succeed, so ice_if_stop intentionally does nothing after an
initialization failure. Each failure path must therefore unwind any
hardware queues it may have configured before iflib releases their DMA
mappings.
Tx setup enables firmware scheduler queues one at a time, and Rx enable
similarly processes queues incrementally. Route failures from both
operations through cleanup paths for both the PF and mirror VSIs. The
cleanup helpers tolerate queues which were not configured, so they also
cover failures on the first queue.
This leaves failed initialization stopped as required by the
iflib_init_failed contract.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59331
Test the producer and consumer indices after waiting for transmit
completion. The post-decrement loop leaves timeout at -1 on exhaustion,
so testing timeout == 0 missed the actual timeout and could report one
when the final poll completed successfully.
Leave the hardware shutdown sequence unchanged. This only corrects the
diagnostic; runtime FLR recovery and command-buffer lifetime handling
remain separate work.
MFC after: 2 weeks
Sponsored by: BBOX.io
Check the receive DMA and frame transfer setup results that were
previously discarded. Return EINVAL for invalid ring/writeback addresses
rather than reporting success, and stop initialization through
iflib_init_failed() when a ring could not be configured.
Use the transmit queue count for transmit initialization and the supplied
channel index for DMA operations. The driver currently allocates one
queue in each direction, so those index/count corrections are latent.
MFC after: 2 weeks
Sponsored by: BBOX.io
Check hardware initialization instead of discarding its result, and
preserve the original initialization error across cleanup. Report a failed
init to iflib rather than publishing a running datapath. Return normalized
FreeBSD errors from attach_post. Reuse the existing native reset cleanup
on failure.
MFC after: 2 weeks
Sponsored by: BBOX.io
Check the result of ixgbe_init_hw() before configuring queues. Report
failure through iflib_init_failed() instead of publishing a working
datapath after shared-code initialization failed.
MFC after: 2 weeks
Sponsored by: BBOX.io
Raw VSI statistics belong to the firmware-assigned counter index and are
reset when firmware recreates the VSI. Reusing a baseline across either
event makes a counter decrease look like a full width rollover.
Reset the PF and main VSI baselines when rebuilding hardware resources.
Start a new baseline when firmware assigns a different PF counter index
and whenever it allocates a VF VSI. Ordinary interface reinits which
retain the hardware resources continue to retain their statistics.
This follows the lifecycle used by ice without placing an unconditional
statistics reset in ixl_initialize_vsi(), which also runs during ordinary
iflib initialization.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59337
Cache a validated flow control setting without touching hardware when
iflib has closed admission. The queues may still be live pending a
watchdog stop, or the device may already be stopped or suspended. RX
initialization and link setup replay the cached flow control policy.
For live updates, decide once under the context lock whether to touch
hardware, then mask MDD around SRRCTL writes regardless of a concurrent
watchdog closing admission. The context lock excludes actual stop and
reinitialization while these writes are in progress.
MFC after: 2 weeks
Sponsored by: BBOX.io
Serialize cached DMA coalescing policy with initialization and schedule
its application through the admin task. The old running check
preceded if_init() acquiring the context lock, so an intervening down
operation could be followed by an unconditional initialization.
Use the deferred if-up request so restart permission is checked when the
task runs. Changes made while stopped or suspended remain cached for
the next initialization. Do not schedule a reset for an unchanged value.
MFC after: 2 weeks
Sponsored by: BBOX.io
Do not publish a running interface after vnic_dev_enable_wait() fails.
Run the existing stop cleanup for the queues configured before the enable
request, then report initialization failure to iflib.
Mark those queues as needing cleanup before submitting the enable request
so the stopped-state shortcut cannot skip the unwind.
MFC after: 2 weeks
Sponsored by: BBOX.io
The transmit stop loop cleaned the receive completion ring, and the
receive stop loop cleaned the transmit completion ring. Use enic_cq_wq()
for transmit queues and enic_cq_rq() for receive queues, matching the
queue indices used by the remaining ring bookkeeping.
MFC after: 2 weeks
Sponsored by: BBOX.io
ice marked every transmitted packet RS and recorded every last
descriptor in its report-status queue. Hardware therefore wrote
descriptor status for every packet, and the driver traversed every
packet while reclaiming completed descriptors.
iflib marks selected packets with IPI_TX_INTR as completion
checkpoints. It forces a checkpoint as deferred work or ring pressure
grows. Retain EOP on every packet, but set RS and record the descriptor
only at those checkpoints.
DPDK uses the same sparse-RS design and defaults tx_rs_thresh to 32.
Let iflib choose the adaptive interval for FreeBSD. This reduces PCIe
and memory traffic while preserving bounded descriptor reclamation.
Validated on an E810-XXV in an A-B-A test with five matched
four-stream, TSO-disabled transmit runs per phase. Median throughput
was 9.413, 9.413, and 9.414 Gbps. Median whole-system CPU was 21.54%,
17.75%, and 21.62%, respectively. The candidate used less system CPU
than both exact-baseline phases in every pair. Interrupt rate was
unchanged, no transmit watchdog fired, and normal TSO traffic remained
line-rate. DTrace confirmed that only iflib-selected packet-final
descriptors carried RS after the change. The effect should be more
profound at 200Gbps but my DUT is network limited.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58910
ice_msix_admin() runs as an interrupt filter inside a critical section.
ice_rdma_notify_pe_intr() acquires the global RDMA sx and invokes the
client event handler, both of which require sleepable thread context. A
PE or HMC critical error could therefore panic under WITNESS or sleep
from interrupt context.
Accumulate OICR causes atomically in the interrupt filter and mark them
pending in the driver state. Deliver the notification from the iflib
admin task before processing reset events. This preserves the existing
ordering, lets an iRDMA-requested reset run in the same admin pass, and
coalesces causes from multiple interrupts.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59340
Use the key and lookup table lengths returned by GET_VF_RESOURCES when
configuring RSS through virtchnl, as DPDK does. The Windows E835 PF
advertises a 40-byte key and rejects our fixed 52-byte CONFIG_RSS_KEY
request, leaving receive traffic on queue zero.
Validate the negotiated lengths before constructing AdminQ messages and
publish the lookup table size to iflib. Preserve register-mode RSS
selection and its fixed hardware sizes. Use aligned, zero initialized
key storage so an RSS kernel's 40-byte key does not leave an uninitialized
tail when the PF requests 52 bytes.
Validation: normal and RSS enabled iavf module builds passed. On an E835
VF under Hyper-V Server 2025, repeated IPv4 and IPv6 receive tests used all
three configured guest RX queues in both transparent hn and non-transparent
lagg modes. The RSS key rejection disappeared, IPv4 transmit tests passed,
and no TX watchdog fired. Each traffic case used three runs of 16 streams.
Obtained from: DPDK (negotiated RSS sizing)
MFC after: 2 weeks
Sponsored by: BBOX.io
The transparent VF capability handler ignored the requested change and
only copied the VF's enabled capabilities. Forward SIOCSIFCAP to the VF
and return its result. Preserve VF capabilities which hn does not expose.
Limit advertised capabilities to those supported by the transparent
packet path and VLAN relay. Do not inherit VF services such as send tags
or the extended capability ioctl when hn has no corresponding methods.
At handoff, adopt the VF's enabled offloads without reconfiguring it.
Mark the datapath as switching while the VF applies a capability change,
since its ioctl may reinitialize the device. If the association is still
ready and unchanged afterwards, synchronize hn with the actual VF state
even on error and restrict checksum assistance to the forwarded offloads.
Republish link state suppressed during the transition when the VF is
still ready. Refresh VLAN child capabilities after adoption and when
restoring the synthetic path.
Run the VF capability ioctl without hn_lock to avoid reversing the VLAN
configuration lock order. Hold an ifnet reference, serialize capability
changes and VF initialization, and make detach wait with hn_lock released.
Revalidate the VF association before publishing the result. Defer
VLAN-child capability notifications to the existing VF taskqueue so they
also run without hn_lock, and drain that work before ifnet teardown.
MFC after: 2 weeks
Sponsored by: BBOX.io
VLANs configured on the synthetic interface do not otherwise reach the
accelerating VF's VLAN callbacks. Those callbacks can be needed for
hardware filter membership or for interpreting stripped VLAN tags, even
though no vlan interface is attached directly to the VF.
Subscribe to VLAN events only in transparent mode and schedule the
existing VF task. Snapshot the synthetic interface's VLAN topology under
network epoch, then leave epoch before invoking the VF callbacks, which
may sleep. Do not acquire hn_lock or configure the VF from a VLAN event
handler; the worker applies membership outside the VLAN configuration
lock.
Keep an applied-VID bitmap under hn_lock and relay only changes. Replay
VLANs configured before VF arrival, reconcile changes while acceleration
is active, and preserve membership across temporary datapath switches.
This relays guest intent; it does not configure host access VLAN policy
or overcome PF restrictions on tagged traffic.
Block initialization while either interface is detaching. Deregister
VLAN handlers before draining work, remove registrations when hn leaves a
live VF, and discard the applied bitmap when the VF itself departs.
MFC after: 2 weeks
Sponsored by: BBOX.io
The Intel shared code can wait for firmware resources while holding its
OS abstraction locks. FreeBSD mapped these locks to mutexes, which
cannot be held across a voluntary sleep. Concurrent PF rebuilds
therefore trigger WITNESS when RSS profile updates contend for the
firmware change lock.
Map the shared-code lock abstraction to exclusive sx locks. This also
covers tunnel and flow-profile operations which can reach the same
firmware wait while serialized.
Validated with WITNESS on a dual port Intel E835. Sixteen CORE resets
rebuilt both PFs without lock warnings, reset failures, or watchdogs.
Ten interface down/up cycles and twenty promiscuous-filter cycles also
completed cleanly.
Reviewed by: erj
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59339
The Windows PF can disable a VF transmit queue while continuing to
report carrier up. Link polling alone then leaves the VF operationally
up even though it cannot transmit. The reproduced VLAN failure shows
this state with PF driver 14.1.5.0 and an MDD indication in the host trace.
Check queue zero from the admin path only while the Hyper-V VF is
running with sanitized queues and a completed host handshake. Report
operational link down and invalidate the statistics baseline when the
queue is disabled. Request recovery through the normal iflib stop/init
path only when a fresh, accessible STATUS read reports carrier up.
Rate limit requests if the host continues to hold the queue disabled,
and leave recovery pending while carrier is down.
Document the recovery behavior and clarify why the Hyper-V reset retains
the VF-local software reset before its host reset/MAC exchange.
Sponsored by: BBOX.io
Changing the VID of an existing VLAN interface rehashes the interface and
announces the new VID, but does not unregister the old VID. Parent
drivers and VLAN event consumers can consequently retain stale filter
membership.
After successfully inserting the new VID, emit vlan_unconfig for the old
VID before the existing vlan_config notification. Do not unregister
anything if insertion fails and the old VID is restored.
MFC after: 2 weeks
Sponsored by: BBOX.io
Use the Hyper-V reset/MAC exchange for 82576 and I350 VFs instead of the
native posted mailbox protocol, which the Windows PF does not service.
Read the host assigned address through configuration bytes 0x201 through
0x206 only during reset, and use it to identify the matching synthetic
hn(4) interface. The operations are local to the VF frontend.
Poll hardware link status rather than retaining a native mailbox link
handshake. Leave MAC, multicast, promiscuous-mode, and VLAN membership
policy with the host. Disable guest VLAN registration and native receive
limit requests, and limit the VF to an MTU of 1500 bytes.
Preserve accumulated statistics across host resets without counting a
counter clear as a wrap. Reject inaccessible register samples and rebase
after a reset indication or a disabled transmit queue, including when the
PF blocks the queue for malicious driver detection.
Document single queue support and host assigned access VLANs. Guest VLAN
trunks are not supported: tagged transmissions with the Windows I350 PF
driver 14.1.5.0 can disable VF queues even on a trunk-configured port, and
the limitation was also reproduced with Windows VF drivers. Such trunks
must use the synthetic path with SR-IOV disabled for that virtual adapter.
Tested on Windows Server 2025 Hyper-V with both 82576 and I350 PFs.
Relnotes: yes
Sponsored by: BBOX.io
Initialization publishes RUNNING and enables interrupts before clearing
the simple-TX producer barrier. A transmitter admitted in that window
still sees IFLIB_TXQ_QUIESCING and drops its packet with ENETDOWN. A TX
completion task can likewise return without draining deferred packets.
Clear the barrier on every TX queue after driver initialization and RX
buffer setup succeed, before publishing admission. Keep failed init
paths closed and retain the existing stop, interrupt and timer ordering.
This changes only initialization; no work is added to the packet path.
Reviewed by: iflib (gallatin)
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59690
After a link speed change updates TSO capabilities, request a restart
when iflib is running or the interface is administratively up. Leave
an administratively down, stopped interface to apply the change at its
next initialization.
Do not infer initialization from IFF_DRV_OACTIVE, which also remains
set after stop and failed initialization. Use iflib_is_running() for
software admission and IFF_UP for intent; iflib retains responsibility
for quiescing any partially initialized queues before restarting.
This also permits a restart request for an administratively up
interface before its first initialization attempt.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59599
Replace direct IFF_DRV_RUNNING reads in igbv, ixgbe, ixv, iavf, ixl,
ice, bnxt Ethernet, aq, enic and the axgbe PCI frontend with
iflib_is_running(). Keep each existing mailbox-ready, fault-state,
link-state and administrative-up condition: framework admission is not
a substitute for device specific readiness.
This covers interrupt admission, operational link publication, VF
mailbox and VLAN replay, and live-configuration decisions. Remove
ifnet temporaries used only to read the driver flags.
Replace the em and igc debug dumps' RUNNING/OACTIVE text with one
framework admission snapshot. OACTIVE does not mean that the interface
or hardware is inactive. Label the result as software admission rather
than link state or proof that DMA has stopped, and retain the queue
head/tail dumps and separate RS diagnostics. Keep the filter register
and requested interface flags in the axgbe PCI promiscuous-mode trace,
but remove its unrelated legacy driver flags.
Use the parent Ethernet PF context for the bnxt RDMA running check,
retaining the link-state check and the existing IB_PORT_ACTIVE policy.
Both current RDMA construction paths use the PF netdev, and Ethernet
detach synchronously removes the RDMA auxiliary child before iflib frees
that context. Declare the direct iflib module dependency. This does
not transfer ownership of RDMA queues to iflib.
Leave the independent, non-iflib axgbe ARM frontend unchanged.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59601
Publish an atomic software run state snapshot through iflib_is_running().
Use it for iflib traffic admission, queue tasks, timers, debugnet and
live-configuration checks instead of reading the unsynchronized
ifnet driver flags. Keep admission closed after failed initialization
and close it when a watchdog requests deferred recovery.
Retain the context-locked datapath state for DMA ownership: a closed
admission gate does not establish that the hardware is stopped. Open
the gate after receive buffer setup and before interrupt enable, at the
existing RUNNING publication point. Serialize the writers with the
state mutex and continue publishing RUNNING/OACTIVE for network stack
consumers. The accessor takes no lock and is usable from filters, but
is only a snapshot, not a context reference or a queue-user drain.
Recheck multicast and VFLR admission under the context lock. Replace
the OACTIVE drain check with the same private admission gate, retaining
the separate per-queue descriptor backpressure policy. Rename its
debug counter to txq_drain_stopped.
Document the accessor and its synchronization limits. This does not
remove legacy flag reads elsewhere in the network stack or change the
existing queue-drain and device-stop contracts. External drivers will
still see the IFF_DRV_ publications but should migrate to this API.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59598
Use the context-locked datapath state for netmap initialization results,
resume completion and administrative work eligibility. Keep stopped
and failed interfaces eligible for link and mailbox recovery without
using IFF_DRV_OACTIVE as an implicit indication that initialization has
been attempted. Evaluate media and deferred admin eligibility under
the context lock rather than from an earlier IFF_DRV_ flag snapshot.
Always pass through iflib_stop() before an IOV-init callback which
changes the PF queue layout, as the IOV-uninit counterpart already does.
Neither administrative down nor a cleared IFF_DRV_RUNNING proves that
queue DMA is stopped. The private lifecycle state decides whether the
hardware stop is necessary; IFF_UP only decides whether to initialize
again afterward.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59597
Discover the Hyper-V queue grant through PCI configuration space for
X550, X552, X553, and E610 VFs. The X550 family exposes a byte at 0x207;
0x208 is a separate DCB flag. E610 exposes a little-endian queue count
word at those offsets. Accept grants of one, two, or four and use at most
two symmetric queue sets, subject to the existing MSI-X resource limit.
Keep one queue for invalid grants and for 82599/X540 Hyper-V VFs.
The family gates and queue limits are snooped from Windows Intel VF bus
traffic.
Update the shared code queue max so stop disables every usable queue.
Also program the receive length limit on every usable RX queue instead
of only queue zero and retain the 82599 exception for that register field.
MFC after: 2 weeks
Sponsored by: BBOX.io
Current Windows PF drivers do not emulate the E610 link-status query at
PCI configuration offset 0x209. The installed Intel ixw 1.8.54.0 driver
returns zero even with the physical port connected, leaving the VF at
no carrier after an otherwise successful hn handoff.
When the query returns zero, use VFLINKS for carrier only. Its speed
field is not the negotiated E610 line rate: the tested 1 Gb/s port
reports the default 10 Gb/s encoding. Publish an unknown speed instead,
including in the verbose link-up diagnostic, and document this fallback.
Keep nonzero PCI results authoritative and reject all-ones reads. Other
Hyper-V families and the native E610 mailbox path are unchanged.
A zero result cannot distinguish an unsupported query from a down link;
in either case this fallback relies on the legacy carrier indication.
The connected and disconnected ports reported VFLINKS.UP set and clear,
respectively, while both returned zero from the PCI query.
MFC after: 2 weeks
Sponsored by: BBOX.io
Hyper-V does not expose the normal Intel PF/VF mailbox.
Import the Hyper-V operation overrides from DPDK and complete its reset
callback with the configuration-space mechanism submitted by Microsoft.
Route ixv operations through the operation table, use mailbox API 1.0,
and limit this environment to one queue pair.
Claim the 82599, X540, X550, X550EM-X, and X550EM-A Hyper-V device IDs
listed by DPDK. Select the same path for the E610 Hyper-V subdevice
identity defined there.
For E610/Linkville, read the emulated VFLINKS-format status from PCI
configuration space at offset 0x209. Older families retain the MMIO
VFLINKS path.
Treat receive-mode changes as host-owned no-ops and do not retry VLAN
operations that Hyper-V permanently rejects. Limit the Hyper-V 82599
MTU to 1504 because its VF does not implement the X540 RLPML field.
Use mailbox reset indications only to refresh cached Hyper-V link state.
Hyper-V does not provide the mailbox handshake required to treat that
indication as a request for an iflib reinitialization.
Tested on 82599 and E610 (with a followup commit) with Windows Server
2025 Hyper-V.
PR: 232472, 239849
Obtained from: DPDK (shared code)
Sponsored by: BBOX.io
Co-authored-by: Wei Hu <[email protected]>
The default VF-up script moves IPv4 configuration from the synthetic
interface to a failover lagg, but leaves IPv6 unconfigured on the lagg.
Adding the synthetic interface as a member can remove its IPv6 addresses,
so deleting the remaining member addresses is not sufficient.
Stop accepting router advertisements on the synthetic interface before
adding it to the lagg. Leave its link-local address and IPv6 enable state
in place for lagg's address, prefix and default-router cleanup, then disable
IPv6 and explicitly remove any remaining addresses. This also covers
members without a link-local address or with IPv6 already disabled.
Replay the synthetic interface's IPv6 rc.conf configuration on the lagg,
including aliases, prefix-derived addresses and legacy configuration names.
Remap the variables in a subshell and reuse network.subr's IPv6 helpers.
For SLAAC, solicit fresh router advertisements rather than copying learned
addresses as permanent ones. Configure IPv6 independently of the IPv4
DHCP/static choice, and leave existing laggs alone on repeated invocation.
Custom DHCPv6 clients and interface-scoped static routes still require the
per-interface setup hook.
Fixes: c685956956 ("hyperv: Add VF bringup scripts and devd rules.")
MFC after: 2 weeks
Sponsored by: BBOX.io
The VF-up script repeatedly deletes the first IPv4 address from hn until
ifconfig fails. Netlink-based ifconfig returns success when no address
remains, so the script can loop forever and block subsequent devd work.
Use ipv4_down() from the already-sourced network.subr to enumerate the
addresses and delete each explicitly. This also handles multiple
addresses without relying on the exit status of an empty deletion. The
behavior depends on ifconfig, not the VF hardware, so no device-specific
fallback is needed.
Fixes: c685956956 ("hyperv: Add VF bringup scripts and devd rules.")
MFC after: 2 weeks
Sponsored by: BBOX.io
The generic if_qflush() only clears if_snd. Calling it directly for a
transparent VF bypasses the driver's callback and its private software
transmit queues. Add if_getqflushfn(), matching the existing callback
accessors, and invoke the registered callback while hn_vf_lock protects
the VF pointer.
Flush an attached VF whenever transparent mode owns it, not only while
the VF datapath is enabled. Disabling transmit during handoff does not
discard packets already queued to the VF. This also covers the inactive
interval after fallback. Non-transparent VFs remain independently owned
and are not flushed by hn. Synthetic queue flushing is unchanged.
MFC after: 2 weeks
Sponsored by: BBOX.io
Hold hn_vf_lock across the VF identity/state check and link publication.
Otherwise an event can observe an enabled VF, pause during fallback, then
overwrite the freshly reported synthetic carrier with stale VF state.
Ignore events while switching or after the association generation changes.
The link notification only queues further work, so the callback does not
need the sleepable hn lock.
Document that association serial numbers are currently diagnostic:
hn_ismyvf() matches the VF by MAC, while notifications gate availability.
MFC after: 2 weeks
Sponsored by: BBOX.io
Handle the host's VF association notifications instead of ignoring them.
Require an allocated association before switching to the MAC-matched VF,
and track notification generations so a withdrawal during initialization
cannot enable an obsolete handoff. Defer association and address-event
work to the VF taskqueue; the receive channel must remain available to
deliver switch completions.
Request and wait for the empty VMBus completion for SET_DATAPATH, checking
submission and channel-revocation failures. Enable transparent VF
transmit and select its link status only after the switch completes.
Use the existing transaction lifetime and revocation handling, without a
timeout that could leave a late completion referencing a freed request.
Restore synthetic capabilities, TSO limits and hardware-assist flags on
fallback, targeting hn rather than the departing VF. Block transparent
transmit during handoff and after association withdrawal. Separate the
attach delay from saved-setting readiness, permit delayed association to
trigger initialization, and require a fresh handoff after NVS reattach.
Stop and detach still close local VF access if returning to the synthetic
path fails; such failures are logged, not reported as a successful switch.
MFC after: 2 weeks
Sponsored by: BBOX.io
The PCI_BUS_RELATIONS2 case lacks a break after queuing the reported
devices. It consequently processes the same packet as PCI_EJECT,
interpreting device_count as the slot number. If that value matches an
existing child, the callback schedules an unintended device eject.
End the relations case after processing the device list, matching the
original PCI_BUS_RELATIONS handling.
Fixes: ea11861e43 ("arm64: Hyper-V: vPCI: Enabling v-PCI in FreeBSD in ARM64 Hyper-V")
MFC after: 2 weeks
Sponsored by: BBOX.io
VF readiness can precede its first initialization. In particular,
iflib populates if_hwassist during init, so copying it while the VF is
still down can leave hn advertising checksum and TSO capabilities with
no hardware-assist flags. The stack then uses software segmentation
until a capability ioctl happens to refresh the copied state.
Synchronize enabled capabilities and hardware-assist flags after the VF
up ioctl succeeds, before switching the datapath and enabling transparent
VF transmit. Use the existing helper in the common initialization path,
covering both normal bring-up and delayed VF initialization.
MFC after: 2 weeks
Sponsored by: BBOX.io
The current interrupt path uses the IRQ resource value directly as the
LPC SIRQ selector in TPM_INT_VECTOR and already restricts it to 1 through
15. This is a driver limitation: a parent interrupt number need not equal
an LPC SIRQ channel, and SPI TPMs can use a separate parallel interrupt.
On the reported system with ACPI IRQ 45, the existing range check runs
after handler registration and returns before disabling firmware interrupt
delivery. This can leave a polling device with a handler on an asserted
source.
Disable and verify interrupt delivery before registering a handler or
starting common TPM services. Preserve the existing range policy, using
polling without registering a handler for routes rejected by that check,
and release their IRQ resources. Keep a failed setup's potentially stale
output cookie out of the device state; the interrupt framework may
already have removed that handler.
Cancel timed-out locality requests in the shared request helper, covering
both interrupt programming and commands. Permit attach after a locality
timeout if the enable register proves delivery is already off, allowing
later command recovery. If delivery remains enabled and cannot be
quiesced, fail attach instead of exposing a device node for possible later
recovery. Report this as a quiesce failure since locality acquisition as
well as register programming can fail.
On detach, publish dying and serialize with commands before quiescing TPM
interrupt delivery. Do this for polling devices too, since firmware may
have re-enabled delivery and resume-time quiescing may have failed. Quiesce
before common release destroys the command lock and before removing any
handler. Report hardware quiesce failure while completing software cleanup.
Reported by: adrian
Reviewed by: adrian, imp
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59645
tpm(4) was removed from amd64 GENERIC because it broke suspend and
resume. The preceding lifecycle, state-save, interrupt, locality, and
teardown fixes address those failures for both TPM 1.2 and TPM 2.0.
Restore the driver to amd64 GENERIC and MINIMAL, where TPM entropy
harvesting remained enabled. Enable the driver and entropy harvesting
in the MPC85XX and QORIQ64 configurations, which already provide FDT,
spibus, and the platform SPI controller required by FDT-attached TPMs.
Leave the generic AIM and POWER configurations unchanged because they
have no TPM attachment bus.
The TPM 1.2 path completed repeated S3 cycles and command tests on
ThinkPad T430 and T440p systems. The TPM 2.0 path completed repeated
device and full-system suspend/resume cycles on a ThinkPad P51. The
PowerPC configuration matrix was checked to retain tpm(4) only where its
FDT SPI attachment path is present.
PR: 291067
Reviewed by: kevans
Tested by: Marek Zarychta <zarychtam_plan-b.pwste.edu.pl> (tpm1.2)
Fixes: 16f8ea6a81 ("amd64: Remove tpm(4) from GENERIC for now")
MFC after: 1 month
Relnotes: yes
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59247
Rebuilding the Flow Director tables does not initialize the interface
or restore its queues. Do not set IFF_DRV_RUNNING from that operation:
iflib owns the flag, and may have cleared it while a watchdog reset is
pending. Restoring it here could admit traffic before the deferred
stop and initialization have run.
Keep the table rebuild and Flow Director interrupt re-enable unchanged.
This path is conditional on IXGBE_FDIR.
MFC after: 2 weeks
Sponsored by: BBOX.io
PF iflib callbacks receive struct ice_softc, not struct ice_mirr_if.
Resolve the mirror interface through sc->mirr_if before checking or
resetting subinterface state.
Use the same mirror softc when rebuilding its VSI. This records the
required subinterface reset in the state consumed by the PF callback,
rather than overlaying the PF softc and leaving rebuilt queues stopped.
MFC after: 2 weeks
Sponsored by: BBOX.io
ixl_set_state() takes a bit index, not a bit mask. ORing the
reset request and critical error indices produced the global reset
index, so a critical interrupt could mask its cause without scheduling
the intended PF reset.
Set both state bits explicitly.
MFC after: 2 weeks
Sponsored by: BBOX.io
Do not let iflib publish a running interface when the virtual device
rejected its enable command. Mark initialization failed and leave the
interface stopped.
MFC after: 2 weeks
Sponsored by: BBOX.io
The resume callback also runs when suspend fails, without an intervening
PCI power-state transition or configuration-space restore. Document
that drivers must not assume either has occurred.
MFC after: 2 weeks
Sponsored by: BBOX.io
The firmware recovery callout continues polling controller registers
after a power transition. An inaccessible E610 GL_MNG_FWSM register
reads as all ones in D3, which looks like firmware recovery mode and
queues an iflib reset while the device is suspended. A later D0 poll
then reports recovery complete and queues another reset.
Pause and drain the callout before terminal stop policy is applied,
prevent an in-flight callback from rearming it, and restart polling
only after resume has cleared the wake state. Track callout
initialization so partial attach cleanup does not drain an uninitialized
callout.
The false transition was reproduced on a dual-port E610 with direct D3
and system S3. Validate the guard with wake-disabled and wake-armed D3,
three repeated D3 cycles per port, and an S3 magic-packet wake. Both
ports returned to D0 without a false recovery transition.
MFC after: 2 weeks
Sponsored by: BBOX.io
iflib gates its built-in administrative and media-status callbacks once
a power transition starts, but iflib_media_change() could still invoke a
driver while the device was suspending or suspended. Several drivers
perform PHY or firmware I/O directly from this callback.
Return EBUSY before invoking IFDI_MEDIA_CHANGE() unless the device is
active. ifmedia then restores the prior selection, avoiding both
suspended hardware access and an unvalidated configuration that would
need to be replayed during resume.
Validated with device suspend on 82579LM, I210, and I225-IT
controllers. Media-selection requests returned EBUSY on every
suspended device. Resume restored the linked management interfaces at
1 Gbps with working traffic and no watchdogs; unconfigured interfaces
retained their prior admin and link state.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59330
Perform a terminal datapath stop before suspend and shutdown
callbacks, then drain the private configuration taskqueue before
entering low power. Track power state independently of queue
ownership and prevent built-in admin, IOV, LED, and media-status
callbacks from accessing a suspended device.
Restore driver-specific state while the datapath remains stopped.
Initialize it exactly once on resume when the interface is
administratively up, and keep an administratively-down interface
stopped. Roll back the driver when suspend or child suspension fails.
Add ifdi_power_prepare() for policy which must be established before
the terminal stop. Use it to snapshot ixgbe(4) wake policy and preserve
X550EM PHY ordering, and remove the duplicate stop from aq(4).
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59329
Track whether iflib queue mappings may still be accessed by the
device. Keep the state private to iflib and conservative: an unknown
or failed device must pass through IFDI_STOP() before mappings are
reused or released, while a device known to be stopped need not
receive another hardware stop.
Enter the starting state before IFDI_INIT(), publish running only
after receive buffers and framework state are ready, and stop hardware
if receive-buffer setup fails after driver initialization.
Do not initialize an administratively-down interface merely because
its MTU, capabilities, VLAN configuration, or media changed. Preserve
successful retries for an administratively-up interface whose previous
initialization failed.
This state describes ownership of iflib datapath mappings only. It
deliberately makes no claim about firmware queues, administrative DMA,
PCI power state, or whether a driver can safely elide a hardware reset.
Reviewed by: iflib (gallatin)
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59328
PF-administered priority need not impose an access VLAN. Permit the
existing VLAN PCP attribute in either access or trunk mode, while
keeping VLAN identifier and protocol access only.
Display trunk PCP in ifconfig and document the broader meaning in the
kernel snapshot, libifconfig, and rtnetlink contracts. This changes no
attribute numbers, wire encoding, or structure layout.
Reported by: kib
Sponsored by: BBOX.io
Driver-specific extension namespaces are optional. Describe their
role without implying that every provider supplies one.
Clarify that the VLAN count excludes membership installed implicitly by
the PF without implying that an explicit VID 0 request cannot consume a
reported filter.
Sponsored by: BBOX.io
iflib releases queue mappings after IFDI_STOP() returns. If a
Physical Function reset fails, returning with PCI bus mastering
enabled can therefore leave the device able to access mappings which
the framework is about to recycle.
Disable bus mastering and drain pending PCIe transactions when reset
fails during initialization or stop. Re-enable and verify bus
mastering only after a later reset succeeds and before queue
programming begins. Treat inability to establish the DMA fence as a
fail-stop invariant violation.
MFC after: 2 weeks
Sponsored by: BBOX.io
Expose cached per-VF configuration through the iflib VF status method.
Report mailbox initialization and the negotiated virtual-channel API, MAC
address, access or trunk VLAN mode, queue resources, administrator policy,
PF traffic permission, and fault containment.
Expose per-VF malicious-driver isolation and cumulative transmit and
receive event counts through a versioned driver.ixl extension.
Track successful PCI IOV attachment separately from hardware capability.
This lets a successfully attached but unconfigured PF return an empty
snapshot without claiming support when PCI IOV registration was
unavailable.
The query uses driver-cached state and does not issue AdminQ requests or
read device registers.
Sponsored by: BBOX.io
Expose cached VF configuration, policy, and runtime state through the
iflib VF status method. Include access or trunk VLAN mode, transmit and
receive queue counts selected by the current virtualization mode,
negotiated mailbox API, PF traffic permission, fault containment, and
quarantine state.
Initialize every cached API version before VF enumeration so an
unconfigured slot cannot be mistaken for API 1.0.
The query does not issue mailbox requests or read hardware registers.
Sponsored by: BBOX.io
Expose cached per-VF configuration through the iflib VF status method.
Report mailbox handshake state, MAC address, access or trunk VLAN mode,
hardware transmit and receive queue counts, administrator policy, and
fault-containment state.
The query does not issue mailbox requests or read hardware registers.
Sponsored by: BBOX.io
Add NIC-specific VF status to the existing ifconfig -v output. Fetch
the data through libifconfig using a separate native route Netlink
query.
Group optional identity, initialization, resources, VLAN policy,
administrator policy, protocol, traffic-permission, and
fault containment fields. Omitted fields remain distinct from false or
zero.
Refer users to iovctl -L for device-neutral PCI attachment and
passthrough state.
This is a Netlink-native evolution of the original interface by Eric
Joyner.
Relnotes: yes
Sponsored by: Intel Corporation (initial version)
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58778
Co-authored-by: Eric Joyner <[email protected]>
Request RTEXT_FILTER_VF through route Netlink and parse the common VF
status schema into typed public structures. Preserve per-field
presence using IFLAF_VF_* attribute numbers as mask bit indices so
callers can distinguish omitted values from false or zero.
Validate required VF indices, repeated driver namespaces, and their
versioned typed fields while allowing unknown optional attributes.
Return VF records through a pointer vector so append-only growth of the
public VF structure does not change the array stride seen by existing
consumers.
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58777
Add a transport neutral kernel snapshot for NIC-specific SR-IOV VF
status and an optional iflib provider method. Providers gather state
under driver defined synchronization.
Honor RTEXT_FILTER_VF on RTM_GETLINK requests and encode the status as
native typed route Netlink attributes. Represent VFs, driver
namespaces, and namespace fields as directly repeated nested attributes.
Presence masks in consumers can distinguish omission from false or zero.
Drivers may add custom status under stable, versioned namespaces. The
named, typed representation lets generic transports and consumers carry
or display fields without knowing their driver-specific schemas, while
the driver retains ownership of their names and meanings.
Document the ABI and add parser and RTM_GETLINK coverage.
Reviewed by: melifaro, iflib (gallatin), kgalazka (previous version)
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58776
Kevin Bowling