library-specs.7: Xr resolve-lib instead of resolve_lib

2015-09-27 Thread Theo Buehler
A typo:

Index: share/man/man7/library-specs.7
===
RCS file: /cvs/src/share/man/man7/library-specs.7,v
retrieving revision 1.10
diff -u -p -r1.10 library-specs.7
--- share/man/man7/library-specs.7  15 Nov 2010 07:41:21 -  1.10
+++ share/man/man7/library-specs.7  27 Sep 2015 12:32:36 -
@@ -136,7 +136,7 @@ one would use
 .Xr ld 1 ,
 .Xr ld.so 1 ,
 .Xr pkg_add 1 ,
-.Xr resolve_lib 1 ,
+.Xr resolve-lib 1 ,
 .Xr bsd.port.mk 5 ,
 .Xr packages 7 ,
 .Xr packages-specs 7 ,



Re: Xr radiusd with section number and remove outdated sentence

2015-09-27 Thread Stuart Henderson
On 2015/09/27 14:39, Theo Buehler wrote:
> Now that there is radiusd(8) in base, I suggest the following changes:
> 
> * add back the manual section number to 'Xr radiusd' in login_radius.8
>   and in login.conf.5

Unsure about these changes. login_radius isn't just for use with radiusd
in base, and radiusd(8) doesn't support CRYPTOCard/ActivCard so the paragraph
talking about those gets confusing.

Use of something like 'the RADIUS server' might be more appropriate than
specifically talking about radiusd.



xargs -0 -I

2015-09-27 Thread Matthew Martin
The following outputs only $ with a newline.

{ i=0; while [ $i -lt 89 ]; do printf $i\\0; : $(( i++ )); done; } | 
xargs -0 -I $ printf '%s\n' $

The problem is two fold. The first is that strnsubst gives up on
substituting since replstr is greater than maxsize. This should likely
cause an error, but I don't know the preferred way to do that.

The second problem is that count needs to be incremented so that the
utility will be run after a null byte. The patch below comes from
FreeBSD. https://svnweb.freebsd.org/base?view=revision=142604

That commit also moved a count++. While I don't believe that it is
necessary; but it also doesn't hurt. I believe it makes the code easier
to follow as now all paths immediately short circuit to addch except
null and EOL.


Index: xargs.c
===
RCS file: /cvs/src/usr.bin/xargs/xargs.c,v
retrieving revision 1.29
diff -u -p -r1.29 xargs.c
--- xargs.c 18 Apr 2015 18:28:38 -  1.29
+++ xargs.c 27 Sep 2015 06:20:01 -
@@ -255,11 +255,9 @@ parse_input(int argc, char *argv[])
ch = getchar();
if (isblank(ch)) {
/* Quotes escape tabs and spaces. */
-   if (insingle || indouble)
+   if (insingle || indouble || zflag)
goto addch;
hasblank = 1;
-   if (zflag)
-   goto addch;
goto arg2;
}
 
@@ -274,15 +272,22 @@ parse_input(int argc, char *argv[])
}
goto arg1;
case '\0':
-   if (zflag)
+   if (zflag) {
+   /*
+* Increment 'count', so that nulls will be treated
+* as end-of-line, as well as end-of-argument.  This
+* is needed so -0 works properly with -I and -L.
+*/
+   count++;
goto arg2;
+   }
goto addch;
case '\n':
+   if (zflag)
+   goto addch;
hasblank = 1;
if (hadblank == 0)
count++;
-   if (zflag)
-   goto addch;
 
/* Quotes do not escape newlines. */
 arg1:  if (insingle || indouble)



iwm(4) newstate task (again)

2015-09-27 Thread Stefan Sperling
This is yet another attempt at improving the iwm(4) newstate task.

The goal is to simplify things by only queuing one state transition
at a time. The newstate task now always transitions to the most
recently requested state, rather than hopping along with every request.

This allows us get rid of the silly newstate generation counter, and
allows us to simply cancel any outstanding transition when the interface
goes down.

The old code was queuing *additional* work from iwm_stop(). Which meant,
for example, that every time upon resume, a task ran only to discover that
it is no longer relevant.

This probably needs some testing to shake out bugs.
Test reports are very much appreciated!

This change might also fix semi-frequent firmware errors during association.
But not all -- I've found that running with IWM_DEBUG cranked up produces
sufficient printfs to make firmware commands time out more often.
It all seems very sensitive to timing which is hard to get completely
right with tasks involved.

Index: if_iwm.c
===
RCS file: /cvs/src/sys/dev/pci/if_iwm.c,v
retrieving revision 1.51
diff -u -p -r1.51 if_iwm.c
--- if_iwm.c27 Sep 2015 16:53:38 -  1.51
+++ if_iwm.c27 Sep 2015 17:33:58 -
@@ -195,14 +195,6 @@ const struct iwm_rate {
 #define IWM_RIDX_IS_CCK(_i_) ((_i_) < IWM_RIDX_OFDM)
 #define IWM_RIDX_IS_OFDM(_i_) ((_i_) >= IWM_RIDX_OFDM)
 
-struct iwm_newstate_state {
-   struct task ns_wk;
-   struct ieee80211com *ns_ic;
-   enum ieee80211_state ns_nstate;
-   int ns_arg;
-   int ns_generation;
-};
-
 intiwm_store_cscheme(struct iwm_softc *, uint8_t *, size_t);
 intiwm_firmware_store_section(struct iwm_softc *, enum iwm_ucode_type,
uint8_t *, size_t);
@@ -406,7 +398,7 @@ struct ieee80211_node *iwm_node_alloc(st
 void   iwm_calib_timeout(void *);
 void   iwm_setrates(struct iwm_node *);
 intiwm_media_change(struct ifnet *);
-void   iwm_newstate_cb(void *);
+void   iwm_newstate_task(void *);
 intiwm_newstate(struct ieee80211com *, enum ieee80211_state, int);
 void   iwm_endscan_cb(void *);
 intiwm_init_hw(struct iwm_softc *);
@@ -5263,43 +5255,29 @@ iwm_media_change(struct ifnet *ifp)
 }
 
 void
-iwm_newstate_cb(void *wk)
+iwm_newstate_task(void *psc)
 {
-   struct iwm_newstate_state *iwmns = (void *)wk;
-   struct ieee80211com *ic = iwmns->ns_ic;
-   enum ieee80211_state nstate = iwmns->ns_nstate;
-   int generation = iwmns->ns_generation;
+   struct iwm_softc *sc = (struct iwm_softc *)psc;
+   struct ieee80211com *ic = >sc_ic;
+   enum ieee80211_state nstate = sc->ns_nstate;
+   enum ieee80211_state ostate = ic->ic_state;
struct iwm_node *in;
-   int arg = iwmns->ns_arg;
-   struct ifnet *ifp = IC2IFP(ic);
-   struct iwm_softc *sc = ifp->if_softc;
+   int arg = sc->ns_arg;
int error;
 
-   free(iwmns, M_DEVBUF, sizeof(*iwmns));
-
-   DPRINTF(("Prepare to switch state %s->%s\n",
-   ieee80211_state_name[ic->ic_state],
-   ieee80211_state_name[nstate]));
-   if (sc->sc_generation != generation) {
-   DPRINTF(("newstate_cb: someone pulled the plug meanwhile\n"));
-   if (nstate == IEEE80211_S_INIT) {
-   DPRINTF(("newstate_cb: nstate == IEEE80211_S_INIT: 
calling sc_newstate()\n"));
-   sc->sc_newstate(ic, nstate, arg);
-   }
-   return;
-   }
-
DPRINTF(("switching state %s->%s\n",
-   ieee80211_state_name[ic->ic_state],
+   ieee80211_state_name[ostate],
ieee80211_state_name[nstate]));
 
-   if (ic->ic_state == IEEE80211_S_SCAN && nstate != ic->ic_state)
+   if (ostate == IEEE80211_S_SCAN && nstate != ostate)
iwm_led_blink_stop(sc);
 
/* disable beacon filtering if we're hopping out of RUN */
-   if (ic->ic_state == IEEE80211_S_RUN && nstate != ic->ic_state) {
+   if (ostate == IEEE80211_S_RUN && nstate != ostate)
iwm_mvm_disable_beacon_filter(sc, (void *)ic->ic_bss);
 
+   /* Reset the device if moving out of AUTH, ASSOC, or RUN. */
+   if (ostate > IEEE80211_S_SCAN && nstate < ostate) {
if (((in = (void *)ic->ic_bss) != NULL))
in->in_assoc = 0;
iwm_release(sc, NULL);
@@ -5393,25 +5371,15 @@ iwm_newstate_cb(void *wk)
 int
 iwm_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 {
-   struct iwm_newstate_state *iwmns;
struct ifnet *ifp = IC2IFP(ic);
struct iwm_softc *sc = ifp->if_softc;
 
timeout_del(>sc_calib_to);
 
-   iwmns = malloc(sizeof(*iwmns), M_DEVBUF, M_NOWAIT);
-   if (!iwmns) {
-   DPRINTF(("%s: allocating state cb mem failed\n", DEVNAME(sc)));
-   return ENOMEM;
-   }
-
-   iwmns->ns_ic = ic;
-   iwmns->ns_nstate 

Re: Xr radiusd with section number and remove outdated sentence

2015-09-27 Thread Jason McIntyre
On Sun, Sep 27, 2015 at 02:39:39PM +0200, Theo Buehler wrote:
> Now that there is radiusd(8) in base, I suggest the following changes:
> 
> * add back the manual section number to 'Xr radiusd' in login_radius.8
>   and in login.conf.5
> 
> * remove a sentence from CAVEATS which is no longer true.  I don't
>   think that `.Xr packages 7' is necessary.
> 
> * the grammar of one sentence seems odd, I added a 'to' (second hunk).
>   

just a note on this last point:

> Index: libexec/login_radius/login_radius.8
> ===
> RCS file: /cvs/src/libexec/login_radius/login_radius.8,v
> retrieving revision 1.12
> diff -u -p -r1.12 login_radius.8
> --- libexec/login_radius/login_radius.8   14 Aug 2013 08:39:31 -  
> 1.12
> +++ libexec/login_radius/login_radius.8   27 Sep 2015 12:34:20 -
> @@ -49,7 +49,7 @@
>  The
>  .Nm
>  utility contacts the
> -.Xr radiusd
> +.Xr radiusd 8
>  daemon to authenticate a
>  .Ar user .
>  If no
> @@ -60,8 +60,8 @@ When executed as the name
>  .Pa login_ Ns Ar style ,
>  .Nm
>  will request
> -.Xr radiusd
> -use the authentication specified by
> +.Xr radiusd 8
> +to use the authentication specified by

there are various patterns:

ask someone to do something
request something of someone
request someone do something

so what's there is perfectly fine. i'm not sure if it's even correct to
"request someone to do something" - i certainly wouldn;t use it.

jmc

>  .Ar style .
>  .Pp
>  The options are as follows:
> @@ -95,7 +95,7 @@ server shared_secret
>  .Pp
>  It is expected that rather than requesting the radius style directly
>  (in which case the
> -.Xr radiusd
> +.Xr radiusd 8
>  server uses a default style)
>  that
>  .Nm
> @@ -111,7 +111,7 @@ to both of those names.
>  Now when the user requests one of those authentication styles,
>  .Nm
>  will automatically forward the request to the remote
> -.Xr radiusd
> +.Xr radiusd 8
>  and request it do the requested style of authentication.
>  .Sh LOGIN.CONF VARIABLES
>  The
> @@ -154,11 +154,6 @@ list of radius servers and their associa
>  .Xr login 1 ,
>  .Xr login.conf 5
>  .Sh CAVEATS
> -.Ox
> -does not ship with a radius server in the default install, however
> -several are available via
> -.Xr packages 7 .
> -.Pp
>  For
>  .Nm
>  to function, the
> Index: share/man/man5/login.conf.5
> ===
> RCS file: /cvs/src/share/man/man5/login.conf.5,v
> retrieving revision 1.60
> diff -u -p -r1.60 login.conf.5
> --- share/man/man5/login.conf.5   24 Sep 2015 13:24:59 -  1.60
> +++ share/man/man5/login.conf.5   27 Sep 2015 12:34:20 -
> @@ -542,7 +542,7 @@ and
>  are provided for use by programs like
>  .Xr ftpd 8
>  and
> -.Xr radiusd .
> +.Xr radiusd 8 .
>  If no service type is specified,
>  .Li login
>  is used.
> 



mk.conf.5: Use Ql where appropriate

2015-09-27 Thread Michael Reed
Hi all,

Instead of using a mix of single and double quotes
to denote command invocations and literal strings,
use Ql instead.  This was inspired by revision 1.425
of bsd.port.mk [1].

While doing the above, I also removed a seemingly bogus
use of `Ev' prepending `-pipe'.

Regards,
Michael

[1]: 
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/bsd.port.mk.5?sortby=date



Index: mk.conf.5
===
RCS file: /cvs/src/share/man/man5/mk.conf.5,v
retrieving revision 1.28
diff -u -p -r1.28 mk.conf.5
--- mk.conf.5   30 Jul 2015 08:03:50 -  1.28
+++ mk.conf.5   27 Sep 2015 19:34:24 -
@@ -75,10 +75,14 @@ Binary mode.
 Binary owner.
 .Bq root
 .It Ev BSDOBJDIR
-The real path to the system 'obj' tree, so that 'make obj' will work correctly.
+The real path to the system object tree, so that
+.Ql make obj
+will work correctly.
 .Bq Pa /usr/obj
 .It Ev BSDSRCDIR
-The real path to the system sources, so that 'make obj' will work correctly.
+The real path to the system sources, so that
+.Ql make obj
+will work correctly.
 .Bq Pa /usr/src
 .It Ev DIRMODE
 Mode for new directories.
@@ -160,7 +164,7 @@ National Language Support files owner.
 Mode for non-executable files.
 .Bq 444
 .It Ev XOBJDIR
-The real path to the 'obj' tree for building the X Window System.
+The real path to the object tree for building the X Window System.
 .Bq Pa /usr/xobj
 .It Ev XSRCDIR
 The real path to the X Window System sources.
@@ -203,7 +207,7 @@ Do not build PIE objects or executables.
 Do not build profiled versions of system libraries.
 .It Ev PIPE
 If set to
-.Qq Ev -pipe ,
+.Ql -pipe ,
 .Xr gcc 1
 will be given the
 .Fl pipe
@@ -218,20 +222,29 @@ Compile in support for S/key authenticat
 A space separated list of directories,
 relative to
 .Ev BSDSRCDIR ,
-to be skipped during "make build".
+to be skipped during
+.Ql make build .
 .It Ev SUDO
 Command run by
 .Xr make 1
 when doing certain operations requiring root privileges
-(e.g. the "make install" portion of "make build").
+(e.g. the
+.Ql make install
+portion of
+.Ql make build ) .
 If set to
 .Ev /usr/bin/doas ,
-this allows one to run "make build" as a user other than root
+this allows one to run
+.Ql make build
+as a user other than root
 (assuming doas is set up for that user).
 .It Ev SYS_INCLUDE
 Copy or symlink kernel include files into
 .Pa /usr/include .
-Possible values are "symlinks" or "copies"
+Possible values are
+.Ql symlinks
+or
+.Ql copies
 (which is the same as the variable being unset).
 .It Ev WARNINGS
 Adds appropriate warning flags (defined in



locking the page queues

2015-09-27 Thread Mark Kettenis
The diff below (re)introduces the active/inactive page queue lock.
This will be necessary to make progress with remove the need for
grabbing the kernel lock in more parts of uvm, such as the pagedaemon
and the uvm_fault().

This was tried once before.  And subsequently backed out because:

  Revert pageqlock back from a mutex to a simple_lock, as it needs to be
  recursive in some cases (mostly involving swapping). A proper fix is in
  the works, but this will unbreak kernels for now.

Remember, simple_lock was really simple; it didn't do any locking at all!

I'm not sure the proper fix ever happened.  I've verified to my
satisfaction that there are no lock ordering problems with the free
page queue lock.  And some initial testing on sparc64 did not hit any
lock recursion in the swap code.  But I could use some help testing
that this is indeed safe.


Index: uvm.h
===
RCS file: /cvs/src/sys/uvm/uvm.h,v
retrieving revision 1.59
diff -u -p -r1.59 uvm.h
--- uvm.h   4 May 2015 10:21:15 -   1.59
+++ uvm.h   27 Sep 2015 18:47:00 -
@@ -54,6 +54,7 @@ struct uvm {
struct pglist page_inactive_swp;/* pages inactive (reclaim or free) */
struct pglist page_inactive_obj;/* pages inactive (reclaim or free) */
/* Lock order: pageqlock, then fpageqlock. */
+   struct mutex pageqlock; /* lock for active/inactive page q */
struct mutex fpageqlock;/* lock for free page q  + pdaemon */
boolean_t page_init_done;   /* TRUE if uvm_page_init() finished */
struct uvm_pmr_control pmr_control; /* pmemrange data */
Index: uvm_page.c
===
RCS file: /cvs/src/sys/uvm/uvm_page.c,v
retrieving revision 1.142
diff -u -p -r1.142 uvm_page.c
--- uvm_page.c  21 Sep 2015 12:59:01 -  1.142
+++ uvm_page.c  27 Sep 2015 18:47:00 -
@@ -179,6 +179,7 @@ uvm_page_init(vaddr_t *kvm_startp, vaddr
TAILQ_INIT(_active);
TAILQ_INIT(_inactive_swp);
TAILQ_INIT(_inactive_obj);
+   mtx_init(, IPL_NONE);
mtx_init(, IPL_VM);
uvm_pmr_init();
 
Index: uvm_page.h
===
RCS file: /cvs/src/sys/uvm/uvm_page.h,v
retrieving revision 1.59
diff -u -p -r1.59 uvm_page.h
--- uvm_page.h  21 Aug 2015 16:04:35 -  1.59
+++ uvm_page.h  27 Sep 2015 18:47:00 -
@@ -285,8 +285,8 @@ int vm_physseg_find(paddr_t, int *);
  * macros
  */
 
-#define uvm_lock_pageq()   /* lock */
-#define uvm_unlock_pageq() /* unlock */
+#define uvm_lock_pageq()   mtx_enter()
+#define uvm_unlock_pageq() mtx_leave()
 #define uvm_lock_fpageq()  mtx_enter()
 #define uvm_unlock_fpageq()mtx_leave()
 
Index: uvm_pdaemon.c
===
RCS file: /cvs/src/sys/uvm/uvm_pdaemon.c,v
retrieving revision 1.76
diff -u -p -r1.76 uvm_pdaemon.c
--- uvm_pdaemon.c   21 Aug 2015 16:04:35 -  1.76
+++ uvm_pdaemon.c   27 Sep 2015 18:47:00 -
@@ -237,7 +237,9 @@ uvm_pageout(void *arg)
if (uvmexp.free - BUFPAGES_DEFICIT < uvmexp.freetarg)
size += uvmexp.freetarg - (uvmexp.free -
BUFPAGES_DEFICIT);
+   uvm_unlock_pageq();
(void) bufbackoff(, size * 2);
+   uvm_lock_pageq();
 
/* Scan if needed to meet our targets. */
if (pma != NULL ||



Re: sleep in interface detach until all refs are released

2015-09-27 Thread Hrvoje Popovski
On 27.9.2015. 7:51, David Gwynne wrote:
> this uses the refcnt api to do the heavy lifting.
> 
> i think we have all the if_get/if_put calls we need, so this should
> be safe at this point.
> 
> if anyone wants to test, can you try detaching or destroying
> interfaces and check that the ifconfig call that does it doesnt end
> up blocking forever?
> 
> ok?
> 


Hi,

i am doing

ifconfig ix0 down; ifconfig ix1 down; sleep 5; ifconfig ix0 up; ifconfig
ix1 up; sleep 5; ifconfig carp1 destroy; ifconfig carp2 destroy; sleep
5; sh /etc/netstart carp1; sh /etc/netstart carp2; sleep 10;

for more than 12 hours and everything is working normal...




Xr radiusd with section number and remove outdated sentence

2015-09-27 Thread Theo Buehler
Now that there is radiusd(8) in base, I suggest the following changes:

* add back the manual section number to 'Xr radiusd' in login_radius.8
  and in login.conf.5

* remove a sentence from CAVEATS which is no longer true.  I don't
  think that `.Xr packages 7' is necessary.

* the grammar of one sentence seems odd, I added a 'to' (second hunk).
  
Index: libexec/login_radius/login_radius.8
===
RCS file: /cvs/src/libexec/login_radius/login_radius.8,v
retrieving revision 1.12
diff -u -p -r1.12 login_radius.8
--- libexec/login_radius/login_radius.8 14 Aug 2013 08:39:31 -  1.12
+++ libexec/login_radius/login_radius.8 27 Sep 2015 12:34:20 -
@@ -49,7 +49,7 @@
 The
 .Nm
 utility contacts the
-.Xr radiusd
+.Xr radiusd 8
 daemon to authenticate a
 .Ar user .
 If no
@@ -60,8 +60,8 @@ When executed as the name
 .Pa login_ Ns Ar style ,
 .Nm
 will request
-.Xr radiusd
-use the authentication specified by
+.Xr radiusd 8
+to use the authentication specified by
 .Ar style .
 .Pp
 The options are as follows:
@@ -95,7 +95,7 @@ server shared_secret
 .Pp
 It is expected that rather than requesting the radius style directly
 (in which case the
-.Xr radiusd
+.Xr radiusd 8
 server uses a default style)
 that
 .Nm
@@ -111,7 +111,7 @@ to both of those names.
 Now when the user requests one of those authentication styles,
 .Nm
 will automatically forward the request to the remote
-.Xr radiusd
+.Xr radiusd 8
 and request it do the requested style of authentication.
 .Sh LOGIN.CONF VARIABLES
 The
@@ -154,11 +154,6 @@ list of radius servers and their associa
 .Xr login 1 ,
 .Xr login.conf 5
 .Sh CAVEATS
-.Ox
-does not ship with a radius server in the default install, however
-several are available via
-.Xr packages 7 .
-.Pp
 For
 .Nm
 to function, the
Index: share/man/man5/login.conf.5
===
RCS file: /cvs/src/share/man/man5/login.conf.5,v
retrieving revision 1.60
diff -u -p -r1.60 login.conf.5
--- share/man/man5/login.conf.5 24 Sep 2015 13:24:59 -  1.60
+++ share/man/man5/login.conf.5 27 Sep 2015 12:34:20 -
@@ -542,7 +542,7 @@ and
 are provided for use by programs like
 .Xr ftpd 8
 and
-.Xr radiusd .
+.Xr radiusd 8 .
 If no service type is specified,
 .Li login
 is used.



packages.7: refer to check-problems instead of check-conflicts

2015-09-27 Thread Theo Buehler
check-conflicts(1) was replaced by check-problems(1), update
packages.7 accordinginly.

Index: share/man/man7/packages.7
===
RCS file: /cvs/src/share/man/man7/packages.7,v
retrieving revision 1.37
diff -u -p -r1.37 packages.7
--- share/man/man7/packages.7   23 Feb 2015 20:52:49 -  1.37
+++ share/man/man7/packages.7   27 Sep 2015 12:30:03 -
@@ -226,7 +226,7 @@ Members of the
 .Ox
 project routinely scan built packages for conflicting files,
 using
-.Xr check-conflicts 1 .
+.Xr check-problems 1 .
 Most packages should contain correct annotations, and not allow themselves
 to be installed on top of a conflicting package.
 .Sh PACKAGE DEPENDENCIES



Re: [patch] cleaner checksum modification for pf

2015-09-27 Thread Richard Procter

On 25/09/2015, at 9:33 PM, Stuart Henderson wrote:
> 
> [snip comment; I completely agree]
> 
>> Another (home) router I administer was seeing IIRC five [bad TCP checksums] a
>> day on average over 42 days, something we expect of a globe-spanning 
>> internetwork.
>> Passing one of these damaged segments to the user sufficies to break MACs 
>> and drop
>> secure connections.
> 
> While I do generally support this diff as long as it doesn't have
> a big negative impact on performance, the implication of mentioning
> this is that these are packets which PF would pass on to other
> hosts with a re-calculated checksum if the packets were modified
> (nat, scrub etc). But that's not the case because they would be
> checked on input to PF so wouldn't make it that far.

If I implied PF would mask these damaged packets I didn't mean to.  As you
say, PF would drop them when it tried to alter them (nat, scrub, etc).

Rather, the stats show that router faults can't be dismissed as irrelevant in
practice. And just one passed to the user in a secure stream will have a
significant impact, independently of its payload, by breaking the connection.

As to the patch, I have edited it for length and coherence but will hold off 
posting it for a week or two, as I hear there's much work going on elsewhere 
in the network stack. If anyone would like a copy in the meantime please 
contact me privately.

I don't expect a big performance hit, if any, as it works the same way as 5.3 
did
plus or minus a few function calls. Nor could I measure a difference netcatting
a largish file over 100BaseT via my Alix 2d2 running PF doing nat, scrub, etc. 
I'd appreciate more data or reports, positive or negative, though.

best, 
Richard. 
 
P.S. I earlier recommended EWD1023 from memory, that should have been EWD1036.