sysutils/docker-compose: update to 5.0.1
Upstream rationalize 2.40.x -> 5.0.0 jump in version as:
> We decided to skip 3.0.0 for next major release after docker Compose v2 to
> prevent (more) confusion with the obsolete docker-compose file versions
> 2.x and 3.x inherited from Docker Compose v1. We also skipped 4.0.0 to
> have a clear separation with this legacy.
Introduce pmap_start_tlb_shoot() from amd64 to make the tlb shootdown
code more similar because a fix is coming and we'd rather place it in
that inline function than replicate it numerous times.
ok kettenis
On Intel CPUs writes to the x2APIC MSRs are non-serializing. This means
that writes done before sending an IPI may not be visible to other CPUs
because of out-of-order execution of the MSR write that triggers the IPI.
Add a "mfence; lfence" barrier like Linux has to prevent this unexpected
trap.
ok deraadt@, mlarkin@, mpi@
import bgp-perf, the OpenBGPD performance test suite
ok claudio rsadowski sthen
The OpenBGPD performance test suite contains two applications for
performance measurements.
The bgp-blaster tool can load mrtdump files into a table and emulate
many peers using that table.
The bgp-canary tool sends special UPDATE messages to the system under
test and measures the latency through the system. The statistics for
these measurements are available as an openmetric file.
Remove bug compatibility for implementations that don't support
rekeying. AFAIK this is only an ancient Sun SSH version.
If such an implementation tries to interoperate with OpenSSH, it
will eventually fail when the transport needs rekeying.
This is probably long enough to use it to download a modern SSH
implementation that lacks this problem :)
ok markus@ deraadt@
Enforce maximum packet/block limit during pre-authentication phase
OpenSSH doesn't support rekeying before authentication completes to
minimise pre-auth attack surface.
Given LoginGraceTime, MaxAuthTries and strict KEX, it would be
difficult to send enough data or packets before authentication
completes to reach a point where rekeying is required, but we'd
prefer it to be completely impossible.
So this applies the default volume/packet rekeying limits to the
pre-auth phase. If these limits are exceeded the connection will
simply be closed.
ok dtucker markus
Serialize concurrent access to command queues with a mutex. Fixes
corruption visible on the Orion O6 with multiple devices and after
the secondary cores spun up. Command queue handling/synchronization
can probably the improved further.
