support matching a list of addr/mask pairs so one can write
more efficient rulesets which were not possible before e.g.
add 100 skipto 1000 not src-ip 10.0.0.0/8,127.0.0.1/8,192.168.0.0/16
The change is fully backward compatible.
ipfw2 and manpage commit to follow.
MFC after: 3 days
- Limit the total number of pipes so that we do not
exhaust all vm objects in the kernel map. When
this limit is reached, a ratelimited message will
be printed to the console.
- Put a soft limit on the amount of memory consumable
by pipes. Once the limit has been reached, all new
pipes will be limited to 4K in size, rather than the
default of 16K.
- Put a limit on the number of pages that may be used
for high speed page flipping in order to reduce the
amount of wired memory. Pipe writes that occur
while this limit is exceeded will fall back to
non-page flipping mode.
The above values are auto-tuned in subr_param.c and
are scaled to take into account both the size of
physical memory and the size of the kernel map.
These limits help to reduce the "kernel resources exhausted"
panics that could be caused by opening a large
number of pipes. (Pipes alone are no longer able
to exhaust all resources, but other kernel memory hogs
in league with pipes may still be able to do so.)
PR: 53627
Ideas / comments from: hsu, tjr, dillon@apollo.backplane.com
MFC after: 1 week
the bulk out buffer size to 16 bytes. The bulk out endpoint descriptor
reports 32 bytes, but if you use this value, data will get dropped.
Reviewed/approved by: scottl
- Change vm_pageout_object_deactivate_pages()'s first parameter from a
vm_map_t to a pmap_t.
- Change vm_pageout_object_deactivate_pages()'s and
vm_pageout_map_deactivate_pages()'s last parameter from a vm_pindex_t
to a long. Since the number of pages in an address space doesn't
require 64 bits on an i386, vm_pindex_t is overkill.
to have this driver working on sparc64. It still needs to be made
endian-clean before it can work there.
Special thanks to dragonk@evilcode.net for sending me a dc(4) card so
that I was able to do this work.
Many cheers to all the people that tested this change, thanks to them,
this change shouldn't break anything :-).
Tested by: marcel (i386 and ia64), ru (i386), wilko (alpha),
mbr (i386), wpaul (i386) and
Will Saxon <WillS@housing.ufl.edu> (i386)
reset them only if they were previously in use. Unconditionally
resetting the registers wipes them out frequently, which interferes
with their use for kernel debugging.
While I'm here, be less verbose in the associated comment of a
neighboring function.
Noticed by: bde
insertion and extraction) has revealed two bugs:
- In vlan_start(), we're supposed to check the underlying interface to
see if it has the IFCAP_VLAN_HWTAGGING cabability set and, if so, set
things up for the VLAN_OUTPUT_TAG() routine. However the code checks
ifp->if_capabilities, which is the vlan pseudo-interface's capabilities
when it should be checking p->if_capabilities, which relates to the
underlying physical interface. Change ifp->if_capabilities to
p->if_capabilities so this works.
- In vlan_input(), we have to extract the 16-bit tag value from the
received frame and use it to figure out which vlan interface gets
the frame. The code that we use to track down the desired vlan
pseudo-interface is:
for (ifv = LIST_FIRST(&ifv_list); ifv != NULL;
ifv = LIST_NEXT(ifv, ifv_list))
if (ifp == ifv->ifv_p && tag == ifv->ifv_tag)
break;
The problem is that 'tag' is not computed consistently. In the case
where the interface supports hardware VLAN tag extraction and calls
VLAN_INPUT_TAG(), we do this:
tag = *(u_int*)(mtag+1);
But in the software emulation case, we do this
tag = EVL_VLANOFTAG(ntohs(evl->evl_tag));
The problem here is the EVL_VLANOFTAG() macro is only ever applied
in this one case. It's never applied to ifv->ifv_tag or anwhere else.
We must be consistent: either it's applied everywhere or nowhere.
To see how this can be a problem, do something like
ifconfig vlan0 vlan 12345 vlandev foo0 and observe the results.
I'm not quite sure what the right thing is to do here. Neither the
vlan(4) nor ifconfig(8) man pages suggest which way to go. For now,
I've removed this use of EVL_VLANOFTAG() so that the tag will match
correctly in all cases. I will not get upset if somebody makes a
compelling argument for using EVL_VLANOFTAG() everywhere instead,
as long as the use is consistent.
tested for playback.
* modify device name strings for ich chips to better conform with their
common names.
* remove superflous 'AC97 controller' from nforce device names.
MFC after: 1 week
to get a stacktrace. This does not work even with M_NOWAIT when we
have WITNESS and is generally a bad idea (pointed out by bde@). We
allocate an 8K heap for use by the unwinder when ddb is active. A
stack trace roughly takes up half of that in any case, so we have
some room for complex unwind situations. We don't want to waste too
much space though. Due to the nature of unwinding, we don't worry
too much about fragmentation or performance of unwinding while in
the debugger. For now we have our own heap management, but we may
be able to leverage from existing code at some later time.
While here:
o Make sure we actually free the unwind environment after unwinding.
This fixes a memory leak.
o Replace Doug's license with mine in unwind.c and unwind.h. Both
files don't have much, if any, of Doug's code left since the EPC
syscall overhaul and the import of the unwinder.
o Remove dead code.
o Replace M_NOWAIT with M_WAITOK for all remaining malloc() calls.
notice another typo in the same line. This typo makes libthr unuseable,
but it's effects where counter-balanced by the extra semicolon, which
made libthr remarkably useable for the past several months.
Should work with both regular and fast ipsec (mutually exclusive).
See manpage for more details.
Submitted by: Ari Suutari (ari.suutari@syncrontech.com)
Revised by: sam
MFC after: 1 week
- Associate logical CPUs on the same physical core with the same kseq.
- Adjust code that assumed there would only be one running thread in any
kseq.
- Wrap the HTT code with a ULE_HTT_EXPERIMENTAL ifdef. This is a start
towards HyperThreading support but it isn't quite there yet.
BUS_DMA_NOWAIT flag, since the code can't handle this.
- Use NULL, NULL for the lockfunc and lockfuncarg parameters of
bus_dma_tag_create() since deferred loads can't happen now.
as the target process' pid, it may exist if the process forked before leaving
the pgrp.
Thix fixes a panic that happens when calling setpgid to make a process
re-enter the pgrp with the same pgid as its pid if the pgrp still exists.
forced to do slightly bogus power state manipulation. However, this
is one of those features that is preventing further progress, so mark
them as BURN_BIRDGES like I did for the drivers in sys/dev/...
This, like the other change, are a no-op unless you have BURN_BRIDGES
in your kernel.
order to avoid the overhead of later page faults. In general, it
implements two cases: one for vnode-backed objects and one for
device-backed objects. Only the device-backed case is really
machine-dependent, belonging in the pmap.
This commit moves the vnode-backed case into the (relatively) new
function vm_map_pmap_enter(). On amd64 and i386, this commit only
amounts to code rearrangement. On alpha and ia64, the new machine
independent (MI) implementation of the vnode case is smaller and more
efficient than their pmap-based implementations. (The MI
implementation takes advantage of the fact that objects in -CURRENT
are ordered collections of pages.) On sparc64, pmap_object_init_pt()
hadn't (yet) been implemented.
