In D39440#900802, @emaste wrote:

I think this seems fine, dropping the 3rd and 4th clauses certainly. Is there something that motivated the macro addition, or just diff reduction against NetBSD?

Make all virtualised variables static and only expose ip6_log_ratelimit() function.

In D38644#881703, @mjg wrote:

This review is a response for a comment made by mjg in D38644 in which I added a sysctl to completely disable such logging on per vnet basis.
The whole logging section appeared in 1999 in one of the KAME commits and since then wasn’t particularly maintained apart of adding vnet support some time ago.
ppsratecheck is used like this is other parts of the kernel, for example in linuxkpi, and apparently is a preferred way to limit certain actions on time basis.

as requested mention RFC4443 in man page

Address comments:

• by popular demand don't mention firewall
• update man page wording

Rename to match log statement, stats variable and counter description presented by netstat -s.

I agree with @se on this. There was no direct user case before introducing sysctlbyname(2), it worked as an by-effect of implementation of how sysctl(3) handled that.
IMO the issue is in how the user.* is implemented and maybe that should be fixed in the long term, but as a band-aid that version LGTM.

In D34171#773087, @alfix86_gmail.com wrote:

However, it is strange but real, sysctlbyname() returns 0 but does not set the "value", while sysctlbyname-improved sets "value" correctly:

.Good catch, tanks.

__assert_unreachable in correct place

Use __assert_unreachable().
Shorten the code by two LOC.

Use atomic_load

Use correct diff this time…

Address /some/ comments.

Address comments.

Not really, no. This one was found with a power of grep while searching for NEEDGIANT nodes.

As mentioned on irc, I believe we're bound by the already defined exit codes, as describes in section EXIT STATUS of bhyve(8).

Update man page.

I was thinking about that too as there is no in-tree driver that support that call anyway, but bsnmpd have an option to query it if the driver supports it, so it'd have to be removed too. Anyway, it's probably task for another patch.

ACK. Wasn't sure about the JAIL_ATTACH namespace anyway.

In D25041#551522, @mjg wrote:

Disabling ptrace should not be an option, it should be mandatory no matter what.

Guys, thanks for the constructive comments.

I was told 2.5 years ago that jail_attach(2) is insecure and I shouldn't use it. Apparently it's no longer the case - see for example rS360356. Can I please have it accepted now?