According to standard, the presence of the flags only means that the
object path must be resolved at the time object loading, instead of my
reading that the flag is required to enable token substitution at all.
The consequence is that -z origin linker flag is no longer required
for the token substitution in the run/rpath or the needed library
soname. It is only recommended if token substition is needed at
dlopen(3) time, since namecache might drop the required entries at the
time of resolution.
Found, reviewed and tested by: emaste
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
The conditional came from NetBSD, where only select architectures have this
header/support
All architectures on FreeBSD have the necessary support though, so the
conditional's completely unnecessary
make tinderbox done on all architectures (including arm64, where the issue
occurred before) this time
X-MFC with: r282057, r282092
MFC after: 6 days
As jhb noted, the actual mmap(2) implementation is under sys/vm, not
sys/kern/, so the correct logical place is tests/sys/vm/, not
tests/sys/kern/
X-MFC with: r282076
MFC after: 6 days
Obtained from: https://github.com/Juniper/libxo/tree/0.3.2
Requested by: Phil Shafer <phil@juniper.net>
This import incorporates local change 279966.
Local change 276260 has been merged-in.
Run configure for drill (I forgot to do it when I imported 1.6.17, but the
omission was harmless). Note that running configure --with-drill at the
top level doesn't quite work for us since it is geared toward the slightly
weird upstream Makefiles, which we don't use.
ctld(8) child processes to indicate initiator address and name in
their titles, similar to what iscsid(8) child processes do.
PR: 181352
Differential Revision: https://reviews.freebsd.org/D2363
Reviewed by: rwatson@, mjg@
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
bufdaemon in getnewbuf(), do use buf_flush(). The difference is that
bufdaemon uses TRYLOCK to get buffer locks, which allows calls to
getnewbuf() while another buffer is locked.
Reported and tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
-- Fix whitespace
-- Use err/errx
-- Remove superfluous braces
- Be a bit more defensive with input from the end-user
- Don't throw a floating point exception by dividing by 0 when processing a
zero-byte file
MFC after: 1 week
Currently we have tables identified by their names in userland
with internal kernel-assigned indices. This works the following way:
When userland wishes to communicate with kernel to add or change rule(s),
it makes indexed sorted array of table names
(internally ipfw_obj_ntlv entries), and refer to indices in that
array in rule manipulation.
Prior to committing new rule to the ruleset kernel
a) finds all referenced tables, bump their refcounts and change
values inside the opcodes to be real kernel indices
b) auto-creates all referenced but not existing tables and then
do a) for them.
Kernel does almost the same when exporting rules to userland:
prepares array of used tables in all rules in range, and
prepends it before the actual ruleset retaining actual in-kernel
indexes for that.
There is also special translation layer for legacy clients which is
able to provide 'real' indices for table names (basically doing atoi()).
While it is arguable that every subsystem really needs names instead of
numbers, there are several things that should be noted:
1) every non-singleton subsystem needs to store its runtime state
somewhere inside ipfw chain (and be able to get it fast)
2) we can't assume object numbers provided by humans will be dense.
Existing nat implementation (O(n) access and LIST inside chain) is a
good example.
Hence the following:
* Convert table-centric rewrite code to be more generic, callback-based
* Move most of the code from ip_fw_table.c to ip_fw_sockopt.c
* Provide abstract API to permit subsystems convert their objects
between userland string identifier and in-kernel index.
(See struct opcode_obj_rewrite) for more details
* Create another per-chain index (in next commit) shared among all subsystems
* Convert current NAT44 implementation to use new API, O(1) lookups,
shared index and names instead of numbers (in next commit).
Sponsored by: Yandex LLC
When we are passing mbuf to IPSec processing via ipsec[46]_process_packet(),
we hold one reference to security policy and release it just after return
from this function. But IPSec processing can be deffered and when we release
reference to security policy after ipsec[46]_process_packet(), user can
delete this security policy from SPDB. And when IPSec processing will be
done, xform's callback function will do access to already freed memory.
To fix this move KEY_FREESP() into callback function. Now IPSec code will
release reference to SP after processing will be finished.
Differential Revision: https://reviews.freebsd.org/D2324
No objections from: #network
Sponsored by: Yandex LLC
