> Err, this all sounds to me like the storm detection code should > *automatically* disable the CEC in such cases, I'd say.
Sounds good. But we should distinguish storms that have many different addresses from storms that just ping a few addresses. CEC will see counts hit the threshold in the latter case, but it might not be able to take the pages offline (because they are locked, or in-use by kernel). So I think the change might be to the return value from NOTIFY_STOP to NOTIFY_DONE ... but only if we are in the middle of a storm AND the CEC array is full. -Tony