[BACK]Return to sysctl.7 CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / src / share / man / man7

Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.

Diff for /src/share/man/man7/sysctl.7 between version 1.32 and 1.59

version 1.32, 2010/02/21 14:26:33 version 1.59, 2011/02/01 20:43:48
Line 29 
Line 29 
 .\"  .\"
 .\"     @(#)sysctl.3    8.4 (Berkeley) 5/9/95  .\"     @(#)sysctl.3    8.4 (Berkeley) 5/9/95
 .\"  .\"
 .Dd February 21, 2010  .Dd February 1, 2011
 .Dt SYSCTL 7  .Dt SYSCTL 7
 .Os  .Os
 .Sh NAME  .Sh NAME
Line 68  sysctl variable relative to the upper le
Line 68  sysctl variable relative to the upper le
 See the  See the
 .Xr sysctl 3  .Xr sysctl 3
 manual page for programming examples.  manual page for programming examples.
 .Sh Top level names  .Ss Top level names
 The top level names are defined with a CTL_ prefix in  The top level names are defined with a
 .Aq Pa sys/sysctl.h ,  .Va CTL_
   prefix in
   .In sys/sysctl.h ,
 and are as follows.  and are as follows.
 The next and subsequent levels down are found in the include files  The next and subsequent levels down are found in the include files
 listed here, and described in separate sections below.  listed here, and described in separate sections below.
 .Bl -column security CTL_SECURITY "Next level names" "High kernel limits"  .Bl -column "security" ".Dv CTL_SECURITY" ".In uvm/uvm_param.h" "High kernel limits"
 .It Sy Name     Constant        Next level names        Description  .It Sy Name  Ta Sy Constant     Ta Sy Next level names Ta Sy Description
 .It kern        CTL_KERN        sys/sysctl.h    High kernel limits  .It kern     Ta Dv CTL_KERN     Ta In sys/sysctl.h     Ta High kernel limits
 .It vm  CTL_VM  uvm/uvm_param.h Virtual memory  .It vm       Ta Dv CTL_VM       Ta In uvm/uvm_param.h  Ta Virtual memory
 .It vfs CTL_VFS sys/mount.h     Filesystem  .It vfs      Ta Dv CTL_VFS      Ta In sys/mount.h      Ta Filesystem
 .It net CTL_NET sys/socket.h    Networking  .It net      Ta Dv CTL_NET      Ta In sys/socket.h     Ta Networking
 .It debug       CTL_DEBUG       sys/sysctl.h    Debugging  .It debug    Ta Dv CTL_DEBUG    Ta In sys/sysctl.h     Ta Debugging
 .It hw  CTL_HW  sys/sysctl.h    Generic CPU, I/O  .It hw       Ta Dv CTL_HW       Ta In sys/sysctl.h     Ta Generic CPU, I/O
 .It machdep     CTL_MACHDEP     sys/sysctl.h    Machine dependent  .It machdep  Ta Dv CTL_MACHDEP  Ta In sys/sysctl.h     Ta Machine dependent
 .It user        CTL_USER        sys/sysctl.h    User-level  .It user     Ta Dv CTL_USER     Ta In sys/sysctl.h     Ta User-level
 .It ddb CTL_DDB sys/sysctl.h    In-kernel debugger  .It ddb      Ta Dv CTL_DDB      Ta In sys/sysctl.h     Ta In-kernel debugger
 .It proc        CTL_PROC        sys/sysctl.h    Per-process  .It proc     Ta Dv CTL_PROC     Ta In sys/sysctl.h     Ta Per-process
 .It vendor      CTL_VENDOR      ?       Vendor specific  .It vendor   Ta Dv CTL_VENDOR   Ta ?                   Ta Vendor specific
 .It emul        CTL_EMUL        sys/sysctl.h    Emulation settings  .It emul     Ta Dv CTL_EMUL     Ta In sys/sysctl.h     Ta Emulation settings
 .It security    CTL_SECURITY    sys/sysctl.h    Security settings  .It security Ta Dv CTL_SECURITY Ta In sys/sysctl.h     Ta Security settings
 .El  .El
 .Sh The debug.* subtree  .Ss The debug.* subtree
 The debugging variables vary from system to system.  The debugging variables vary from system to system.
 A debugging variable may be added or deleted without need to recompile  A debugging variable may be added or deleted without need to recompile
 .Nm  .Nm
Line 100  Each time it runs,
Line 102  Each time it runs,
 gets the list of debugging variables from the kernel and  gets the list of debugging variables from the kernel and
 displays their current values.  displays their current values.
 The system defines twenty  The system defines twenty
 .Va ( struct ctldebug )  .Vt ( struct ctldebug )
 variables named  variables named
 .Dv debug0  .Dv debug0
 through  through
Line 110  individually initialized at the location
Line 112  individually initialized at the location
 The loader prevents multiple use of the same variable by issuing errors  The loader prevents multiple use of the same variable by issuing errors
 if a variable is initialized in more than one place.  if a variable is initialized in more than one place.
 For example, to export the variable  For example, to export the variable
 .Dv dospecialcheck  .Va dospecialcheck
 as a debugging variable, the following declaration would be used:  as a debugging variable, the following declaration would be used:
   .Pp
 .Bd -literal -offset indent -compact  .Bd -literal -offset indent -compact
 int dospecialcheck = 1;  int dospecialcheck = 1;
 struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };  struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };
Line 127  See
Line 130  See
 .\" and  .\" and
 .\" .Xr sysctl 9  .\" .Xr sysctl 9
 for more information.  for more information.
 .Sh The vfs.* subtree  .Ss The vfs.* subtree
 A distinguished second level name,  A distinguished second level name,
 .Li vfs.generic ( VFS_GENERIC ) ,  .Li vfs.generic ( VFS_GENERIC ) ,
 is used to get general information about all filesystems.  is used to get general information about all file systems.
 It has the following third level identifiers:  It has the following third level identifiers:
 .Bl -tag -width compact  .Bl -tag -width "123456"
 .It vfs.generic.maxtypenum ( VFS_MAXTYPENUM )  .It Li vfs.generic.maxtypenum ( VFS_MAXTYPENUM )
 The highest valid filesystem type number.  The highest valid file system type number.
 .It vfs.generic.conf ( VFS_CONF )  .It Li vfs.generic.conf ( VFS_CONF )
 Returns configuration information about the file-system type given as a fourth  Returns configuration information about the file system type given as a fourth
 level identifier.  level identifier.
   .It Li vfs.generic.usermount ( VFS_USERMOUNT )
   Determines if non superuser mounts are allowed, default to no
   .Dv 0 .
   .It Li vfs.generic.magiclinks ( VFS_MAGICLINKS )
   Controls if expansion of variables is going to be performed on pathnames
   or not.
   Defaults to no variable expansion,
   .Dv 0 .
   Variables are of the form
   .Li @name
   and the following names are supported:
   .Bl -tag -width "kernel_ident"
   .It domainname
   The domain name as determined by
   .Xr getdomainname 2
   .It emul
   The current process emulation name.
   Defaults to
   .Dv netbsd .
   Other valid emulations are:
   .Dv aout ,
   .Dv aoutm68k ,
   .Dv darwin ,
   .Dv freebsd ,
   .Dv ibcs2 ,
   .Dv irix ,
   .Dv linux ,
   .Dv linux32 ,
   .Dv m68k4k ,
   .Dv mach ,
   .Dv netbsd32 ,
   .Dv osf1 ,
   .Dv pecoff ,
   .Dv sunos ,
   .Dv sunos32 ,
   .Dv svr4 ,
   .Dv svr4_32 ,
   .Dv ultrix ,
   .Dv vax1k .
   .It gid
   The effective group id of the current process.
   .It hostname
   The host name as determined by
   .Xr gethostname 2
   .It kernel_ident
   The kernel identifier, as specified by config.
   For example
   .Dv GENERIC .
   .It machine
   The type of machine as determined by the
   .Xr sysctl 3
   .Dq hw.machine .
   .It machine_arch
   The architecture of the processor as determined by the
   .Xr sysctl 3
   .Dq hw.machine_arch .
   .It osrelease
   The kernel release number as determined by the
   .Xr sysctl 3
   .Dq kern.osrelease .
   .Xr sysctl 3
   .It ostype
   The kernel operating system type as determined by the
   .Xr sysctl 3
   .Dq kern.ostype .
   Defaults to
   .Dv NetBSD .
   .It rgid
   The real group id of the current process.
   .It ruid
   The real user id of the current process.
   .It uid
   The effective user id of the current process.
   .El
 .El  .El
 .Pp  .Pp
 The remaining second level identifiers are the file-system names, identified  A second level name for controlling the
   .Xr wapbl 4
   (Write Ahead Physical Block Logging file system journalling)
   capabilities with the following third level identifiers:
   .Bl -tag -width "123456"
   .It Li vfs.wapbl.flush_disk_cache
   Controls whether to attempt to flush the disk cache on each commit.
   It defaults to 1 and it should always be on to ensure data integrity in
   case of a crash.
   For slow disks, turning it off can improve performance.
   .It Li vfs.wapbl.verbose_commit
   For each transaction log commit, print the number of bytes written
   and the time it took to commit as seconds.nanoseconds.
   .El
   .Pp
   The remaining second level identifiers are the file system names, identified
 by the type number returned by a  by the type number returned by a
 .Xr statvfs 2  .Xr statvfs 2
 call or from  call or from
 .Li vfs.generic.conf .  .Li vfs.generic.conf .
 The third level identifiers available for each filesystem  .Pp
   The third level identifiers available for each file system
 are given in the header file that defines the mount  are given in the header file that defines the mount
 argument structure for that filesystem.  argument structure for that file system.
 .Sh The hw.* subtree  .Ss The hw.* subtree
 The string and integer information available for the  The string and integer information available for the
 .Li hw  .Li hw
 level is detailed below.  level is detailed below.
 The changeable column shows whether a process with appropriate  The changeable column shows whether a process with appropriate
 privilege may change the value.  privilege may change the value.
 .Bl -column "hw.acpi.supported_states" "integer" "Changeable" -offset indent  .Bl -column "hw.machine_arch" "integer" "Changeable" -offset indent
 .It Sy Second level name        Type    Changeable  .It Sy Second level name        Type    Changeable
 .It hw.acpi.supported_states    string  no  
 .It hw.alignbytes       integer no  .It hw.alignbytes       integer no
 .It hw.byteorder        integer no  .It hw.byteorder        integer no
 .It hw.cnmagic  string  yes  .It hw.cnmagic  string  yes
Line 174  privilege may change the value.
Line 266  privilege may change the value.
 .El  .El
 .Pp  .Pp
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li hw.acpi.supported_states  
 List of possible  
 .Tn ACPI  
 sleep states.  
 The list can contain the following values:  
 .Bl -tag -width XS1X  
 .It S0  
 fully running  
 .It S1  
 power on suspend (CPU and hard disks are off)  
 .It S2  
 similar to S3, usually not implemented  
 .It S3  
 suspend-to-RAM  
 .It S4  
 suspend-to-disk (needs BIOS support)  
 .It S5  
 power off  
 .El  
 .It Li hw.alignbytes ( HW_ALIGNBYTES )  .It Li hw.alignbytes ( HW_ALIGNBYTES )
 Alignment constraint for all possible data types.  Alignment constraint for all possible data types.
 This shows the value  This shows the value
 .Dv ALIGNBYTES  .Dv ALIGNBYTES
 in  in
 .Pa /usr/include/machine/param.h ,  .In machine/param.h ,
 at the kernel compilation time.  at the kernel compilation time.
 .It Li hw.byteorder ( HW_BYTEORDER )  .It Li hw.byteorder ( HW_BYTEORDER )
 The byteorder (4,321, or 1,234).  The byteorder (4321, or 1234).
 .It Li hw.cnmagic ( HW_CNMAGIC )  .It Li hw.cnmagic ( HW_CNMAGIC )
 The console magic key sequence.  The console magic key sequence.
 .It Li hw.disknames ( HW_DISKNAMES )  .It Li hw.disknames ( HW_DISKNAMES )
Line 213  collected on them.
Line 286  collected on them.
 Return statistical information on the NFS mounts, disk and tape  Return statistical information on the NFS mounts, disk and tape
 devices on the system.  devices on the system.
 An array of  An array of
 .Va struct io_sysctl  .Vt struct io_sysctl
 structures is returned,  structures is returned,
 whose size depends on the current number of such objects in the system.  whose size depends on the current number of such objects in the system.
 The third level name is the size of the  The third level name is the size of the
 .Va struct io_sysctl .  .Vt struct io_sysctl .
 The type of object can be determined by examining the  The type of object can be determined by examining the
 .Va type  .Va type
 element of  element of
 .Va struct io_sysctl .  .Vt struct io_sysctl .
 Which can be  Which can be
 .Dv IOSTAT_DISK  .Dv IOSTAT_DISK
 (disk drive),  (disk drive),
Line 248  The bytes of non-kernel memory as a 32-b
Line 321  The bytes of non-kernel memory as a 32-b
 .It Li hw.usermem64 ( HW_USERMEM64 )  .It Li hw.usermem64 ( HW_USERMEM64 )
 The bytes of non-kernel memory as a 64-bit integer.  The bytes of non-kernel memory as a 64-bit integer.
 .El  .El
 .Sh The kern.* subtree  .Ss The kern.* subtree
   This subtree includes data generally related to the kernel.
 The string and integer information available for the  The string and integer information available for the
 .Li kern  .Li kern
 level is detailed below.  level is detailed below.
 The changeable column shows whether a process with appropriate  The changeable column shows whether a process with appropriate
 privilege may change the value.  privilege may change the value.
 The types of data currently available are process information,  .Bl -column "kern.posix_reader_writer_locks" \
 system vnodes, the open file entries, routing table entries,  "struct kinfo_drivers" "not applicable"
 virtual memory statistics, load average history, and clock rate  
 information.  
 .Bl -column "kern.posix_reader_writer_locks" "struct kinfo_drivers" "not applicable"  
 .It Sy Second level name        Type    Changeable  .It Sy Second level name        Type    Changeable
   .It kern.aio_listio_max integer yes
   .It kern.aio_max        integer yes
   .It kern.arandom        integer no
 .It kern.argmax integer no  .It kern.argmax integer no
 .It kern.autonicetime   integer yes  .It kern.boothowto      integer no
 .It kern.autoniceval    integer yes  
 .It kern.boottime       struct timeval  no  .It kern.boottime       struct timeval  no
 .It kern.bufq   node    not applicable  .\".It kern.bufq        node    not applicable
 .It kern.ccpu   integer no  .It kern.ccpu   integer no
 .It kern.clockrate      struct clockinfo        no  .It kern.clockrate      struct clockinfo        no
 .It kern.consdev        integer no  .It kern.consdev        integer no
   .It kern.coredump       node    not applicable
 .It kern.cp_id  struct  no  .It kern.cp_id  struct  no
 .It kern.cp_time        uint64_t[\|]    no  .It kern.cp_time        uint64_t[\|]    no
   .It kern.cryptodevallowsoft     integer yes
 .It kern.defcorename    string  yes  .It kern.defcorename    string  yes
   .It kern.detachall      integer yes
 .It kern.domainname     string  yes  .It kern.domainname     string  yes
 .It kern.drivers        struct kinfo_drivers    no  .It kern.drivers        struct kinfo_drivers    no
   .It kern.dump_on_panic  integer yes
 .It kern.file   struct file     no  .It kern.file   struct file     no
 .It kern.forkfsleep     integer yes  .It kern.forkfsleep     integer yes
 .It kern.fscale integer no  .It kern.fscale integer no
Line 281  information.
Line 358  information.
 .It kern.hostid integer yes  .It kern.hostid integer yes
 .It kern.hostname       string  yes  .It kern.hostname       string  yes
 .It kern.iov_max        integer no  .It kern.iov_max        integer no
   .It kern.ipc    node    not applicable
 .It kern.job_control    integer no  .It kern.job_control    integer no
 .It kern.labeloffset    integer no  .It kern.labeloffset    integer no
 .It kern.labelsector    integer no  .It kern.labelsector    integer no
Line 297  information.
Line 375  information.
 .It kern.memlock        integer no  .It kern.memlock        integer no
 .It kern.memlock_range  integer no  .It kern.memlock_range  integer no
 .It kern.memory_protection      integer no  .It kern.memory_protection      integer no
   .It kern.module node    not applicable
 .It kern.monotonic_clock        integer no  .It kern.monotonic_clock        integer no
   .It kern.mqueue node    not applicable
 .It kern.msgbuf integer no  .It kern.msgbuf integer no
 .It kern.msgbufsize     integer no  .It kern.msgbufsize     integer no
 .It kern.ngroups        integer no  .It kern.ngroups        integer no
   .\".It kern.no_sa_support       integer yes
 .It kern.ntptime        struct ntptimeval       no  .It kern.ntptime        struct ntptimeval       no
 .It kern.osrelease      string  no  .It kern.osrelease      string  no
 .It kern.osrev  integer no  .It kern.osrevision     integer no
 .It kern.ostype string  no  .It kern.ostype string  no
   .\".It kern.panic_now   integer yes
 .It kern.pipe   node    not applicable  .It kern.pipe   node    not applicable
 .It kern.posix1 integer no  .\" .It kern.posix      node    not applicable
   .It kern.posix1version  integer no
   .It kern.posix_aio      integer no
 .It kern.posix_barriers integer no  .It kern.posix_barriers integer no
 .It kern.posix_reader_writer_locks      integer no  .It kern.posix_reader_writer_locks      integer no
   .\".It kern.posix_sched integer yes
 .It kern.posix_semaphores       integer no  .It kern.posix_semaphores       integer no
 .It kern.posix_spin_locks       integer no  .It kern.posix_spin_locks       integer no
 .It kern.posix_threads  integer no  .It kern.posix_threads  integer no
Line 316  information.
Line 401  information.
 .It kern.proc   struct kinfo_proc       no  .It kern.proc   struct kinfo_proc       no
 .It kern.proc2  struct kinfo_proc2      no  .It kern.proc2  struct kinfo_proc2      no
 .It kern.proc_args      string  no  .It kern.proc_args      string  no
 .It kern.prof   node    not applicable  .It kern.profiling      node    not applicable
   .\".It kern.pset        node    not applicable
 .It kern.rawpartition   integer no  .It kern.rawpartition   integer no
 .It kern.root_device    string  no  .It kern.root_device    string  no
 .It kern.root_partition integer no  .It kern.root_partition integer no
 .It kern.rtc_offset     integer yes  .It kern.rtc_offset     integer yes
 .It kern.saved_ids      integer no  .It kern.saved_ids      integer no
   .It kern.sbmax  integer yes
   .\".It kern.sched       node    not applicable
 .It kern.securelevel    integer raise only  .It kern.securelevel    integer raise only
   .It kern.somaxkva       integer yes
 .It kern.synchronized_io        integer no  .It kern.synchronized_io        integer no
 .It kern.ipc    node    not applicable  
 .It kern.timecounter    node    not applicable  .It kern.timecounter    node    not applicable
 .It kern.timex  struct  no  .It kern.timex  struct  no
 .It kern.tkstat node    not applicable  .It kern.tkstat node    not applicable
 .It kern.urandom        integer no  .It kern.urandom        integer no
   .It kern.usercrypto     integer yes
   .It kern.userasymcrypto integer yes
   .It kern.veriexec       node    not applicable
 .It kern.version        string  no  .It kern.version        string  no
 .It kern.vnode  struct vnode    no  .It kern.vnode  struct vnode    no
 .El  .El
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
   .It Li kern.aio_listio_max
   The maximum number of asynchronous
   .Tn I/O
   operations in a single list I/O call.
   Like with all variables related to
   .Xr aio 3 ,
   the variable may be created and removed dynamically
   upon loading or unloading the corresponding kernel module.
   .It Li kern.aio_max
   The maximum number of asynchronous I/O operations.
   .It Li kern.arandom
   This variable picks a random number each time it is queried.
   The used random number generator
   .Pf ( Tn RNG )
   is based on
   .Xr arc4random 3 .
 .It Li kern.argmax ( KERN_ARGMAX )  .It Li kern.argmax ( KERN_ARGMAX )
 The maximum bytes of argument to  The maximum bytes of argument to
 .Xr execve 2 .  .Xr execve 2 .
 .It Li kern.autonicetime ( KERN_AUTONICETIME )  
 The number of seconds of CPU-time a non-root process may accumulate before  
 having its priority lowered from the default to the value of KERN_AUTONICEVAL.  
 If set to 0, automatic lowering of priority is not performed, and if set to \-1  
 all non-root processes are immediately lowered.  
 .It Li kern.autoniceval ( KERN_AUTONICEVAL )  
 The priority assigned for automatically niced processes.  
 .It Li kern.boothowto  .It Li kern.boothowto
 Flags passed from the boot loader; see  Flags passed from the boot loader; see
 .Xr reboot 2  .Xr reboot 2
 for the meanings of the flags.  for the meanings of the flags.
 .It Li kern.boottime ( KERN_BOOTTIME )  .It Li kern.boottime ( KERN_BOOTTIME )
 A  A
 .Va struct timeval  .Vt struct timeval
 structure is returned.  structure is returned.
 This structure contains the time that the system was booted.  This structure contains the time that the system was booted.
   .\" .It Li kern.bufq
   .\" XXX: Undocumented.
 .It Li kern.ccpu ( KERN_CCPU )  .It Li kern.ccpu ( KERN_CCPU )
 The scheduler exponential decay value.  The scheduler exponential decay value.
 .It Li kern.clockrate ( KERN_CLOCKRATE )  .It Li kern.clockrate ( KERN_CLOCKRATE )
 A  A
 .Va struct clockinfo  .Vt struct clockinfo
 structure is returned.  structure is returned.
 This structure contains the clock, statistics clock and profiling clock  This structure contains the clock, statistics clock and profiling clock
 frequencies, the number of micro-seconds per hz tick, and the clock  frequencies, the number of micro-seconds per hz tick, and the clock
 skew rate.  skew rate.
   Refer to
   .Xr hz 9
   for additional details.
 .It Li kern.consdev ( KERN_CONSDEV )  .It Li kern.consdev ( KERN_CONSDEV )
 Console device.  Console device.
   .It Li kern.coredump
   Settings related to set-id processes coredumps.
   By default, set-id processes do not dump core in situations where
   other processes would.
   The settings in this node allows an administrator to change this
   behavior.
   .Pp
   The third level name is
   .Dv kern.coredump.setid
   and fourth level variables are described below.
   .Bl -column "kern.coredump.setid.group" "integer" "Changeable" -offset indent
   .It Sy Fourth level name        Type    Changeable
   .It kern.coredump.setid.dump    integer yes
   .It kern.coredump.setid.group   integer yes
   .It kern.coredump.setid.mode    integer yes
   .It kern.coredump.setid.owner   integer yes
   .It kern.coredump.setid.path    string  yes
   .El
   .Bl -tag -width "123456"
   .It Li kern.coredump.setid.dump
   If non-zero, set-id processes will dump core.
   .It Li kern.coredump.setid.group
   The group-id for the set-id processes' coredump.
   .It Li kern.coredump.setid.mode
   The mode for the set-id processes' coredump.
   See
   .Xr chmod 1 .
   .It Li kern.coredump.setid.owner
   The user-id that will be used as the owner of the set-id processes'
   coredump.
   .It Li kern.coredump.setid.path
   The path to which set-id processes' coredumps will be saved to.
   Same syntax as kern.defcorename.
   .El
 .It Li kern.cp_id ( KERN_CP_ID )  .It Li kern.cp_id ( KERN_CP_ID )
 Mapping of CPU number to CPU id.  Mapping of CPU number to CPU id.
 .It Li kern.cp_time ( KERN_CP_TIME )  .It Li kern.cp_time ( KERN_CP_TIME )
 Returns an array of CPUSTATES uint64_ts.  Returns an array of
   .Dv CPUSTATES
   .Vt uint64_t Ns s.
 This array contains the  This array contains the
 number of clock ticks spent in different CPU states.  number of clock ticks spent in different CPU states.
 On multi-processor systems, the sum across all CPUs is returned unless  On multi-processor systems, the sum across all CPUs is returned unless
 appropriate space is given for one data set for each CPU.  appropriate space is given for one data set for each CPU.
 Data for a specific CPU can also be obtained by adding the number of the  Data for a specific CPU can also be obtained by adding the number of the
 CPU at the end of the MIB, enlarging it by one.  CPU at the end of the MIB, enlarging it by one.
   .It Li kern.cryptodevallowsoft
   This variable controls userland access to hardware versus software transforms
   in the
   .Xr crypto 4
   system.
   The available values are as follows:
   .Bl -tag -width XX0 -offset indent
   .It Dv \*[Lt] 0
   Always force userlevel requests to use software transforms.
   .It Dv = 0
   If present, use hardware and grant userlevel requests for
   non-accelerated transforms (handling the latter in software).
   .It Dv \*[Gt] 0
   Allow user requests only for transforms which are hardware-accelerated.
   .El
 .It Li kern.defcorename ( KERN_DEFCORENAME )  .It Li kern.defcorename ( KERN_DEFCORENAME )
 Default template for the name of core dump files (see also  Default template for the name of core dump files (see also
 .Li proc.pid.corename  .Li proc.pid.corename
Line 382  and
Line 538  and
 .Xr core 5  .Xr core 5
 for format of this template).  for format of this template).
 The default value is  The default value is
 .Nm %n.core  .Pa %n.core
 and can be changed with the kernel configuration option  and can be changed with the kernel configuration option
 .Cd options DEFCORENAME  .Cd options DEFCORENAME
 (see  (see
 .Xr options 4  .Xr options 4
 ).  ).
   .It Li kern.detachall
   Detach all devices at shutdown.
 .It Li kern.domainname ( KERN_DOMAINNAME )  .It Li kern.domainname ( KERN_DOMAINNAME )
 Get or set the YP domain name.  Get or set the YP domain name.
 .It Li kern.dump_on_panic ( KERN_DUMP_ON_PANIC )  
 Perform a crash dump on system panic.  
 .It Li kern.drivers ( KERN_DRIVERS )  .It Li kern.drivers ( KERN_DRIVERS )
 Return an array of  Return an array of
 .Va struct kinfo_drivers  .Vt struct kinfo_drivers
 that contains the name and major device numbers of all the device drivers  that contains the name and major device numbers of all the device drivers
 in the current kernel.  in the current kernel.
 The  The
Line 403  field is always a NUL terminated string.
Line 559  field is always a NUL terminated string.
 The  The
 .Va d_bmajor  .Va d_bmajor
 field will be set to \-1 if the driver doesn't have a block device.  field will be set to \-1 if the driver doesn't have a block device.
   .It Li kern.dump_on_panic ( KERN_DUMP_ON_PANIC )
   Perform a crash dump on system
   .Xr panic 9 .
 .It Li kern.file ( KERN_FILE )  .It Li kern.file ( KERN_FILE )
 Return the entire file table.  Return the entire file table.
 The returned data consists of a single  The returned data consists of a single
 .Va struct filelist  .Vt struct filelist
 followed by an array of  followed by an array of
 .Va struct file ,  .Vt struct file ,
 whose size depends on the current number of such objects in the system.  whose size depends on the current number of such objects in the system.
 .It Li kern.forkfsleep ( KERN_FORKFSLEEP )  .It Li kern.forkfsleep ( KERN_FORKFSLEEP )
 If  If
Line 424  Maximum is 20 seconds.
Line 583  Maximum is 20 seconds.
 .It Li kern.fscale ( KERN_FSCALE )  .It Li kern.fscale ( KERN_FSCALE )
 The kernel fixed-point scale factor.  The kernel fixed-point scale factor.
 .It Li kern.fsync ( KERN_FSYNC )  .It Li kern.fsync ( KERN_FSYNC )
 Return 1 if the POSIX 1003.1b File Synchronization Option is available  Return 1 if the
   .St -p1003.1b-93
   File Synchronization Option is available
 on this system,  on this system,
 otherwise 0.  otherwise\ 0.
 .It Li kern.hardclock_ticks ( KERN_HARDCLOCK_TICKS )  .It Li kern.hardclock_ticks ( KERN_HARDCLOCK_TICKS )
 Returns the number of  Returns the number of
 .Xr hardclock 9  .Xr hardclock 9
 ticks.  ticks.
 .It Li kern.hostid ( KERN_HOSTID )  .It Li kern.hostid ( KERN_HOSTID )
 Get or set the host id.  Get or set the host identifier.
   This is aimed to replace the legacy
   .Xr gethostid 3
   and
   .Xr sethostid 3
   system calls.
 .It Li kern.hostname ( KERN_HOSTNAME )  .It Li kern.hostname ( KERN_HOSTNAME )
 Get or set the hostname.  Get or set the
   .Xr hostname 1 .
 .It Li kern.iov_max ( KERN_IOV_MAX )  .It Li kern.iov_max ( KERN_IOV_MAX )
 Return the maximum number of  Return the maximum number of
 .Va iovec  .Vt iovec
 structures that a process has available for use with  structures that a process has available for use with
 .Xr preadv 2 ,  .Xr preadv 2 ,
 .Xr pwritev 2 ,  .Xr pwritev 2 ,
Line 446  structures that a process has available 
Line 613  structures that a process has available 
 .Xr sendmsg 2  .Xr sendmsg 2
 and  and
 .Xr writev 2 .  .Xr writev 2 .
   .It Li kern.ipc ( KERN_SYSVIPC )
   Return information about the SysV IPC parameters.
   The third level names for the ipc variables are detailed below.
   .Bl -column "kern.ipc.shm_use_phys" "integer" "Changeable" -offset indent
   .It Sy Third level name Type    Changeable
   .It kern.ipc.sysvmsg    integer no
   .It kern.ipc.sysvsem    integer no
   .It kern.ipc.sysvshm    integer no
   .It kern.ipc.sysvipc_info       struct  no
   .It kern.ipc.shmmax     integer yes
   .It kern.ipc.shmmni     integer yes
   .It kern.ipc.shmseg     integer yes
   .It kern.ipc.shmmaxpgs  integer yes
   .It kern.ipc.shm_use_phys       integer yes
   .It kern.ipc.msgmni     integer yes
   .It kern.ipc.msgseg     integer yes
   .It kern.ipc.semmni     integer yes
   .It kern.ipc.semmns     integer yes
   .It kern.ipc.semmnu     integer yes
   .El
   .Bl -tag -width "123456"
   .It Li kern.ipc.sysvmsg ( KERN_SYSVIPC_MSG )
   Returns 1 if System V style message queue functionality is available
   on this system,
   otherwise\ 0.
   .It Li kern.ipc.sysvsem ( KERN_SYSVIPC_SEM )
   Returns 1 if System V style semaphore functionality is available
   on this system,
   otherwise\ 0.
   .It Li kern.ipc.sysvshm ( KERN_SYSVIPC_SHM )
   Returns 1 if System V style share memory functionality is available
   on this system,
   otherwise\ 0.
   .It Li kern.ipc.sysvipc_info ( KERN_SYSVIPC_INFO )
   Return System V style IPC configuration and run-time information.
   The fourth level name selects the System V style IPC facility.
   .Bl -column "KERN_SYSVIPC_MSG_INFO" "struct shm_sysctl_info" -offset indent
   .It Sy Fourth level name        Type
   .It KERN_SYSVIPC_MSG_INFO       struct msg_sysctl_info
   .It KERN_SYSVIPC_SEM_INFO       struct sem_sysctl_info
   .It KERN_SYSVIPC_SHM_INFO       struct shm_sysctl_info
   .El
   .Pp
   .Bl -tag -width "123456"
   .It Li KERN_SYSVIPC_MSG_INFO
   Return information on the System V style message facility.
   The
   .Sy msg_sysctl_info
   structure is defined in
   .In sys/msg.h .
   .It Li KERN_SYSVIPC_SEM_INFO
   Return information on the System V style semaphore facility.
   The
   .Sy sem_sysctl_info
   structure is defined in
   .In sys/sem.h .
   .It Li KERN_SYSVIPC_SHM_INFO
   Return information on the System V style shared memory facility.
   The
   .Sy shm_sysctl_info
   structure is defined in
   .In sys/shm.h .
   .El
   .It Li kern.ipc.shmmax ( KERN_SYSVIPC_SHMMAX )
   Max shared memory segment size in bytes.
   .It Li kern.ipc.shmmni ( KERN_SYSVIPC_SHMMNI )
   Max number of shared memory identifiers.
   .It Li kern.ipc.shmseg ( KERN_SYSVIPC_SHMSEG )
   Max shared memory segments per process.
   .It Li kern.ipc.shmmaxpgs ( KERN_SYSVIPC_SHMMAXPGS )
   Max amount of shared memory in pages.
   .It Li kern.ipc.shm_use_phys ( KERN_SYSVIPC_SHMUSEPHYS )
   Locking of shared memory in physical memory.
   If 0, memory can be swapped
   out, otherwise it will be locked in physical memory.
   .It Li kern.ipc.msgmni
   Max number of message queue identifiers.
   .It Li kern.ipc.msgseg
   Max number of number of message segments.
   .It Li kern.ipc.semmni
   Max number of number of semaphore identifiers.
   .It Li kern.ipc.semmns
   Max number of number of semaphores in system.
   .It Li kern.ipc.semmnu
   Max number of undo structures in system.
   .El
 .It Li kern.job_control ( KERN_JOB_CONTROL )  .It Li kern.job_control ( KERN_JOB_CONTROL )
 Return 1 if job control is available on this system, otherwise 0.  Return 1 if job control is available on this system, otherwise\ 0.
 .It Li kern.labeloffset ( KERN_LABELOFFSET )  .It Li kern.labeloffset ( KERN_LABELOFFSET )
 The offset within the sector specified by KERN_LABELSECTOR of the  The offset within the sector specified by
   .Dv KERN_LABELSECTOR
   of the
 .Xr disklabel 5 .  .Xr disklabel 5 .
 .It Li kern.labelsector ( KERN_LABELSECTOR )  .It Li kern.labelsector ( KERN_LABELSECTOR )
 The sector number containing the  The sector number containing the
Line 464  all process exits due to signals which c
Line 719  all process exits due to signals which c
 .Xr core 5  .Xr core 5
 file, and whether the coredump was created.  file, and whether the coredump was created.
 .It Li kern.mapped_files ( KERN_MAPPED_FILES )  .It Li kern.mapped_files ( KERN_MAPPED_FILES )
 Returns 1 if the POSIX 1003.1b Memory Mapped Files Option is available  Returns 1 if the
 on this system,  .St -p1003.1b-93
 otherwise 0.  Memory Mapped Files Option is available on this system,
   otherwise\ 0.
 .It Li kern.maxfiles ( KERN_MAXFILES )  .It Li kern.maxfiles ( KERN_MAXFILES )
 The maximum number of open files that may be open in the system.  The maximum number of open files that may be open in the system.
 .It Li kern.maxpartitions ( KERN_MAXPARTITIONS )  .It Li kern.maxpartitions ( KERN_MAXPARTITIONS )
Line 518  The variable can only be increased, and 
Line 774  The variable can only be increased, and 
 direct-mapped pool pages.  direct-mapped pool pages.
 .El  .El
 .It Li kern.memlock ( KERN_MEMLOCK )  .It Li kern.memlock ( KERN_MEMLOCK )
 Returns 1 if the POSIX 1003.1b Process Memory Locking Option is available  Returns 1 if the
 on this system,  .St -p1003.1b-93
 otherwise 0.  Process Memory Locking Option is available on this system,
   otherwise\ 0.
 .It Li kern.memlock_range ( KERN_MEMLOCK_RANGE )  .It Li kern.memlock_range ( KERN_MEMLOCK_RANGE )
 Returns 1 if the POSIX 1003.1b Range Memory Locking Option is available  Returns 1 if the
 on this system,  .St -p1003.1b-93
 otherwise 0.  Range Memory Locking Option is available on this system,
   otherwise\ 0.
 .It Li kern.memory_protection ( KERN_MEMORY_PROTECTION )  .It Li kern.memory_protection ( KERN_MEMORY_PROTECTION )
 Returns 1 if the POSIX 1003.1b Memory Protection Option is available  Returns 1 if the
 on this system,  .St -p1003.1b-93
 otherwise 0.  Memory Protection Option is available on this system,
   otherwise\ 0.
   .It Li kern.module
   Settings related to kernel modules.
   The third level names for the settings are described below.
   .Bl -column "kern.module.autoload" "integer" "Changeable" -offset indent
   .It Sy Third level name Type    Changeable
   .It kern.module.autoload        integer yes
   .It kern.module.verbose integer yes
   .El
   .Pp
   The variables are as follows:
   .Bl -tag -width "123456"
   .It Li kern.module.autoload
   A boolean that controls whether kernel modules are loaded automatically.
   See
   .Xr module 7
   for additional details.
   .It Li kern.module.verbose
   A boolean that enables or disables verbose
   debug messages related to kernel modules.
   .El
 .It Li kern.monotonic_clock ( KERN_MONOTONIC_CLOCK )  .It Li kern.monotonic_clock ( KERN_MONOTONIC_CLOCK )
 Returns the standard version the implementation of the POSIX 1003.1b  Returns the standard version the implementation of the
   .St -p1003.1b-93
 Monotonic Clock Option conforms to,  Monotonic Clock Option conforms to,
 otherwise 0.  otherwise\ 0.
   .It Li kern.mqueue
   Settings related to
   .Tn POSIX
   message queues; see
   .Xr mqueue 3 .
   This node is created dynamically when
   the corresponding kernel module is loaded.
   The third level names for the settings are described below.
   .Bl -column "kern.mqueue.mq_max_msgsize" "integer" "Changeable" -offset indent
   .It Sy Third level name Type    Changeable
   .It kern.mqueue.mq_open_max     integer yes
   .It kern.mqueue.mq_prio_max     integer yes
   .It kern.mqueue.mq_max_msgsize  integer yes
   .It kern.mqueue.mq_def_maxmsg   integer yes
   .It kern.mqueue.mq_max_maxmsg   integer yes
   .El
   .Pp
   The variables are:
   .Bl -tag -width "123456"
   .It Li kern.mqueue.mq_open_max
   The maximum number of message queue descriptors any single process can open.
   .It Li kern.mqueue.mq_prio_max
   The maximum priority of a message.
   .It Li kern.mqueue.mq_max_msgsize
   The maximum size of a message in a message queue.
   .It Li kern.mqueue.mq_def_maxmsg
   The default maximum message count.
   .It Li kern.mqueue.mq_max_maxmsg
   The maximum number of messages in a message queue.
   .El
 .It Li kern.msgbuf ( KERN_MSGBUF )  .It Li kern.msgbuf ( KERN_MSGBUF )
 The kernel message buffer, rotated so that the head of the circular kernel  The kernel message buffer, rotated so that the head of the circular kernel
 message buffer is at the start of the returned data.  message buffer is at the start of the returned data.
Line 541  The returned data may contain NUL bytes.
Line 851  The returned data may contain NUL bytes.
 The maximum number of characters that the kernel message buffer can hold.  The maximum number of characters that the kernel message buffer can hold.
 .It Li kern.ngroups ( KERN_NGROUPS )  .It Li kern.ngroups ( KERN_NGROUPS )
 The maximum number of supplemental groups.  The maximum number of supplemental groups.
   .\" .It Li kern.no_sa_support
   .\" XXX: Undocumented.
 .It Li kern.ntptime ( KERN_NTPTIME )  .It Li kern.ntptime ( KERN_NTPTIME )
 A  A
 .Va struct ntptimeval  .Vt struct ntptimeval
 structure is returned.  structure is returned.
 This structure contains data used by the  This structure contains data used by the
 .Xr ntpd 8  .Xr ntpd 8
Line 554  The system release string.
Line 866  The system release string.
 The system revision string.  The system revision string.
 .It Li kern.ostype ( KERN_OSTYPE )  .It Li kern.ostype ( KERN_OSTYPE )
 The system type string.  The system type string.
   .\".It Li kern.panic_now
   .\" XXX: Undocumented.
 .It Li kern.pipe ( KERN_PIPE )  .It Li kern.pipe ( KERN_PIPE )
 Pipe settings.  Pipe settings.
 The third level names for the  integer pipe settings is detailed below.  The third level names for the  integer pipe settings is detailed below.
Line 573  The variables are as follows:
Line 887  The variables are as follows:
 .It Li kern.pipe.kvasiz ( KERN_PIPE_KVASIZ )  .It Li kern.pipe.kvasiz ( KERN_PIPE_KVASIZ )
 Amount of kernel memory consumed by pipe buffers.  Amount of kernel memory consumed by pipe buffers.
 .It Li kern.pipe.maxbigpipes ( KERN_PIPE_MAXBIGPIPES )  .It Li kern.pipe.maxbigpipes ( KERN_PIPE_MAXBIGPIPES )
 Maximum number of "big" pipes.  Maximum number of
   .Dq big
   pipes.
 .It Li kern.pipe.maxkvasz ( KERN_PIPE_MAXKVASZ )  .It Li kern.pipe.maxkvasz ( KERN_PIPE_MAXKVASZ )
 Maximum amount of kernel memory to be used for pipes.  Maximum amount of kernel memory to be used for pipes.
 .It Li kern.pipe.limitkva ( KERN_PIPE_LIMITKVA )  .It Li kern.pipe.limitkva ( KERN_PIPE_LIMITKVA )
 Limit for direct transfers via page loan.  Limit for direct transfers via page loan.
 .It Li kern.pipe.nbigpipes ( KERN_PIPE_NBIGPIPES )  .It Li kern.pipe.nbigpipes ( KERN_PIPE_NBIGPIPES )
 Number of "big" pipes.  Number of
   .Dq big
   pipes.
 .El  .El
   .\" XXX: Undocumented .It Li kern.posix ( ? )
   .\"      This is a node in which the only variable is semmax.
 .It Li kern.posix1version ( KERN_POSIX1 )  .It Li kern.posix1version ( KERN_POSIX1 )
 The version of ISO/IEC 9945 (POSIX 1003.1) with which the system  The version of ISO/IEC 9945
 attempts to comply.  .Pq St -p1003.1
   with which the system attempts to comply.
   .It Li kern.posix_aio
   The version of
   .St -p1003.1
   and its Asynchronous I/O option to which the system attempts to conform.
 .It Li kern.posix_barriers ( KERN_POSIX_BARRIERS )  .It Li kern.posix_barriers ( KERN_POSIX_BARRIERS )
 The version of  The version of
 .St -p1003.1  .St -p1003.1
 and its  and its
 Barriers  Barriers
 option to which the system attempts to conform,  option to which the system attempts to conform,
 otherwise 0.  otherwise\ 0.
 .It Li kern.posix_reader_writer_locks ( KERN_POSIX_READER_WRITER_LOCKS )  .It Li kern.posix_reader_writer_locks ( KERN_POSIX_READER_WRITER_LOCKS )
 The version of  The version of
 .St -p1003.1  .St -p1003.1
 and its  and its
 Read-Write Locks  Read-Write Locks
 option to which the system attempts to conform,  option to which the system attempts to conform,
 otherwise 0.  otherwise\ 0.
   .\".It Li kern.posix_sched
   .\" XXX: Undocumented.
 .It Li kern.posix_semaphores ( KERN_POSIX_SEMAPHORES )  .It Li kern.posix_semaphores ( KERN_POSIX_SEMAPHORES )
 The version of  The version of
 .St -p1003.1  .St -p1003.1
 and its  and its
 Semaphores  Semaphores
 option to which the system attempts to conform,  option to which the system attempts to conform,
 otherwise 0.  otherwise\ 0.
 .It Li kern.posix_spin_locks ( KERN_POSIX_SPIN_LOCKS )  .It Li kern.posix_spin_locks ( KERN_POSIX_SPIN_LOCKS )
 The version of  The version of
 .St -p1003.1  .St -p1003.1
 and its  and its
 Spin Locks  Spin Locks
 option to which the system attempts to conform,  option to which the system attempts to conform,
 otherwise 0.  otherwise\ 0.
 .It Li kern.posix_threads ( KERN_POSIX_THREADS )  .It Li kern.posix_threads ( KERN_POSIX_THREADS )
 The version of  The version of
 .St -p1003.1  .St -p1003.1
 and its  and its
 Threads  Threads
 option to which the system attempts to conform,  option to which the system attempts to conform,
 otherwise 0.  otherwise\ 0.
 .It Li kern.posix_timers ( KERN_POSIX_TIMERS )  .It Li kern.posix_timers ( KERN_POSIX_TIMERS )
 The version of  The version of
 .St -p1003.1  .St -p1003.1
 and its  and its
 Timers  Timers
 option to which the system attempts to conform,  option to which the system attempts to conform,
 otherwise 0.  otherwise\ 0.
 .It Li kern.proc ( KERN_PROC )  .It Li kern.proc ( KERN_PROC )
 Return the entire process table, or a subset of it.  Return the entire process table, or a subset of it.
 An array of  An array of
 .Va struct kinfo_proc  .Vt struct kinfo_proc
 structures is returned,  structures is returned,
 whose size depends on the current number of such objects in the system.  whose size depends on the current number of such objects in the system.
 The third and fourth level numeric names are as follows:  The third and fourth level numeric names are as follows:
Line 646  The third and fourth level numeric names
Line 973  The third and fourth level numeric names
 .It KERN_PROC_UID       A user ID  .It KERN_PROC_UID       A user ID
 .El  .El
 .It Li kern.proc2 ( KERN_PROC2 )  .It Li kern.proc2 ( KERN_PROC2 )
 As for KERN_PROC, but an array of  As for
 .Va struct kinfo_proc2  .Dv KERN_PROC ,
   but an array of
   .Vt struct kinfo_proc2
 structures are returned.  structures are returned.
 The fifth level name is the size of the  The fifth level name is the size of the
 .Va struct kinfo_proc2  .Vt struct kinfo_proc2
 and the sixth level name is the number of structures to return.  and the sixth level name is the number of structures to return.
 .It Li kern.proc_args ( KERN_PROC_ARGS )  .It Li kern.proc_args ( KERN_PROC_ARGS )
 Return the argv or environment strings (or the number thereof)  Return the argv or environment strings (or the number thereof)
Line 667  The fourth level name is as follows:
Line 996  The fourth level name is as follows:
 .It Li kern.profiling ( KERN_PROF )  .It Li kern.profiling ( KERN_PROF )
 Return profiling information about the kernel.  Return profiling information about the kernel.
 If the kernel is not compiled for profiling,  If the kernel is not compiled for profiling,
 attempts to retrieve any of the KERN_PROF values will  attempts to retrieve any of the
 fail with  .Dv KERN_PROF
   values will fail with
 .Er EOPNOTSUPP .  .Er EOPNOTSUPP .
 The third level names for the string and integer profiling information  The third level names for the string and integer profiling information
 is detailed below.  is detailed below.
Line 693  Array indexed by program counter of call
Line 1023  Array indexed by program counter of call
 Structure giving the sizes of the above arrays.  Structure giving the sizes of the above arrays.
 .It Li kern.profiling.state ( GPROF_STATE )  .It Li kern.profiling.state ( GPROF_STATE )
 Profiling state.  Profiling state.
 If set to GMON_PROF_ON, starts profiling.  If set to
 If set to GMON_PROF_OFF, stops profiling.  .Dv GMON_PROF_ON ,
   starts profiling.
   If set to
   .Dv GMON_PROF_OFF ,
   stops profiling.
 .It Li kern.profiling.tos ( GPROF_TOS )  .It Li kern.profiling.tos ( GPROF_TOS )
 Array of  Array of
 .Va struct tostruct  .Vt struct tostruct
 describing destination of calls and their counts.  describing destination of calls and their counts.
 .El  .El
   .\" .It Li kern.pset
   .\" XXX: Undocumented.
 .It Li kern.rawpartition ( KERN_RAWPARTITION )  .It Li kern.rawpartition ( KERN_RAWPARTITION )
 The raw partition of a disk (a == 0).  The raw partition of a disk (a == 0).
 .It Li kern.root_device ( KERN_ROOT_DEVICE )  .It Li kern.root_device ( KERN_ROOT_DEVICE )
Line 717  Maximum socket buffer size.
Line 1053  Maximum socket buffer size.
 .It Li kern.securelevel ( KERN_SECURELVL )  .It Li kern.securelevel ( KERN_SECURELVL )
 See  See
 .Xr secmodel_securelevel 9 .  .Xr secmodel_securelevel 9 .
   .\" .It Li kern.sched
   .\" XXX: Undocumented.
 .It Li kern.somaxkva ( KERN_SOMAXKVA )  .It Li kern.somaxkva ( KERN_SOMAXKVA )
 Maximum amount of kernel memory to be used for socket buffers.  Maximum amount of kernel memory to be used for socket buffers.
 .\" XXX units?  .\" XXX units?
 .It Li kern.synchronized_io ( KERN_SYNCHRONIZED_IO )  .It Li kern.synchronized_io ( KERN_SYNCHRONIZED_IO )
 Returns 1 if the POSIX 1003.1b Synchronized I/O Option is available  Returns 1 if the
 on this system,  .St -p1003.1b-93
 otherwise 0.  Synchronized I/O Option is available on this system,
 .It Li kern.ipc ( KERN_SYSVIPC )  otherwise\ 0.
 Return information about the SysV IPC parameters.  
 The third level names for the ipc variables are detailed below.  
 .Bl -column "kern.ipc.shm_use_phys" "integer" "Changeable" -offset indent  
 .It Sy Third level name Type    Changeable  
 .It kern.ipc.sysvmsg    integer no  
 .It kern.ipc.sysvsem    integer no  
 .It kern.ipc.sysvshm    integer no  
 .It kern.ipc.sysvipc_info       struct  no  
 .It kern.ipc.shmmax     integer yes  
 .It kern.ipc.shmmni     integer yes  
 .It kern.ipc.shmseg     integer yes  
 .It kern.ipc.shmmaxpgs  integer yes  
 .It kern.ipc.shm_use_phys       integer yes  
 .It kern.ipc.msgmni     integer yes  
 .It kern.ipc.msgseg     integer yes  
 .It kern.ipc.semmni     integer yes  
 .It kern.ipc.semmns     integer yes  
 .It kern.ipc.semmnu     integer yes  
 .El  
 .Bl -tag -width "123456"  
 .It Li kern.ipc.sysvmsg ( KERN_SYSVIPC_MSG )  
 Returns 1 if System V style message queue functionality is available  
 on this system,  
 otherwise 0.  
 .It Li kern.ipc.sysvsem ( KERN_SYSVIPC_SEM )  
 Returns 1 if System V style semaphore functionality is available  
 on this system,  
 otherwise 0.  
 .It Li kern.ipc.sysvshm ( KERN_SYSVIPC_SHM )  
 Returns 1 if System V style share memory functionality is available  
 on this system,  
 otherwise 0.  
 .It Li kern.ipc.sysvipc_info ( KERN_SYSVIPC_INFO )  
 Return System V style IPC configuration and run-time information.  
 The fourth level name selects the System V style IPC facility.  
 .Bl -column "KERN_SYSVIPC_MSG_INFO" "struct shm_sysctl_info" -offset indent  
 .It Sy Fourth level name        Type  
 .It KERN_SYSVIPC_MSG_INFO       struct msg_sysctl_info  
 .It KERN_SYSVIPC_SEM_INFO       struct sem_sysctl_info  
 .It KERN_SYSVIPC_SHM_INFO       struct shm_sysctl_info  
 .El  
 .Pp  
 .Bl -tag -width "123456"  
 .It Li KERN_SYSVIPC_MSG_INFO  
 Return information on the System V style message facility.  
 The  
 .Sy msg_sysctl_info  
 structure is defined in  
 .Aq Pa sys/msg.h .  
 .It Li KERN_SYSVIPC_SEM_INFO  
 Return information on the System V style semaphore facility.  
 The  
 .Sy sem_sysctl_info  
 structure is defined in  
 .Aq Pa sys/sem.h .  
 .It Li KERN_SYSVIPC_SHM_INFO  
 Return information on the System V style shared memory facility.  
 The  
 .Sy shm_sysctl_info  
 structure is defined in  
 .Aq Pa sys/shm.h .  
 .El  
 .It Li kern.ipc.shmmax ( KERN_SYSVIPC_SHMMAX )  
 Max shared memory segment size in bytes.  
 .It Li kern.ipc.shmmni ( KERN_SYSVIPC_SHMMNI )  
 Max number of shared memory identifiers.  
 .It Li kern.ipc.shmseg ( KERN_SYSVIPC_SHMSEG )  
 Max shared memory segments per process.  
 .It Li kern.ipc.shmmaxpgs ( KERN_SYSVIPC_SHMMAXPGS )  
 Max amount of shared memory in pages.  
 .It Li kern.ipc.shm_use_phys ( KERN_SYSVIPC_SHMUSEPHYS )  
 Locking of shared memory in physical memory.  
 If 0, memory can be swapped  
 out, otherwise it will be locked in physical memory.  
 .It Li kern.ipc.msgmni  
 Max number of message queue identifiers.  
 .It Li kern.ipc.msgseg  
 Max number of number of message segments.  
 .It Li kern.ipc.semmni  
 Max number of number of semaphore identifiers.  
 .It Li kern.ipc.semmns  
 Max number of number of semaphores in system.  
 .It Li kern.ipc.semmnu  
 Max number of undo structures in system.  
 .El  
 .It Li kern.timecounter ( dynamic )  .It Li kern.timecounter ( dynamic )
 Display and control the timecounter source of the system.  Display and control the timecounter source of the system.
 .Bl -column "kern.timecounter.timestepwarnings" "integer" "Changeable" -offset indent  .Bl -column "kern.timecounter.timestepwarnings" "integer" "Changeable" -offset indent
Line 857  The number of raw input characters.
Line 1110  The number of raw input characters.
 .El  .El
 .It Li kern.urandom ( KERN_URND )  .It Li kern.urandom ( KERN_URND )
 Random integer value.  Random integer value.
   .It Li kern.usercrypto
   When enabled, allows userland to
   .Xr open 2
   the
   .Pa /dev/crypto
   special device, used by the
   .Xr crypto 4
   system.
   .It Li kern.userasymcrypto
   Enables or disables the use of software asymmetric crypto support in the
   .Xr crypto 4
   system.
 .It Li kern.veriexec  .It Li kern.veriexec
 Tunings for Verixec.  Runtime information for
   .Xr veriexec 8 .
   .Bl -column "kern.veriexec.algorithms" "integer" "Changeable" -offset indent
   .It Sy Third level name Type    Changeable
   .It kern.veriexec.algorithms    string  no
   .It kern.veriexec.count node    not applicable
   .It kern.veriexec.strict        integer yes
   .It kern.veriexec.verbose       integer yes
   .El
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li kern.veriexec.algorithms  .It Li kern.veriexec.algorithms
 Returns a string with the supported algorithms in Veriexec.  Returns a string with the supported algorithms in Veriexec.
Line 868  Each mount will be under its own
Line 1141  Each mount will be under its own
 .No tableN  .No tableN
 node.  node.
 Under each node there will be three variables, indicating the mount  Under each node there will be three variables, indicating the mount
 point, the file-system type, and the number of entries.  point, the file system type, and the number of entries.
 .It Li kern.veriexec.strict  .It Li kern.veriexec.strict
 Controls the strict level of Veriexec.  Controls the strict level of Veriexec.
 See  See
Line 893  the system.
Line 1166  the system.
 The returned data consists of an array whose size depends on the  The returned data consists of an array whose size depends on the
 current number of such objects in the system.  current number of such objects in the system.
 Each element of the array contains the kernel address of a vnode  Each element of the array contains the kernel address of a vnode
 .Va struct vnode *  .Vt struct vnode *
 followed by the vnode itself  followed by the vnode itself
 .Va struct vnode .  .Vt struct vnode .
 .It Li kern.coredump.setid  .\" XXX: Undocumented: kern.lwp: no children?
 Settings related to set-id processes coredumps.  
 By default, set-id processes do not dump core in situations where  
 other processes would.  
 The settings in this node allows an administrator to change this  
 behavior.  
 .Pp  
 .Bl -tag -width "123456"  
 .It Li kern.coredump.setid.dump  
 If non-zero, set-id processes will dump core.  
 .It Li kern.coredump.setid.group  
 The group-id for the set-id processes' coredump.  
 .It Li kern.coredump.setid.mode  
 The mode for the set-id processes' coredump.  
 See  
 .Xr chmod 1 .  
 .It Li kern.coredump.setid.owner  
 The user-id that will be used as the owner of the set-id processes'  
 coredump.  
 .It Li kern.coredump.setid.path  
 The path to which set-id processes' coredumps will be saved to.  
 Same syntax as kern.defcorename.  
 .El  .El
 .\" XXX kern.lwp  .Ss The machdep.* subtree
 .El  
 .Sh The machdep.* subtree  
 The set of variables defined is architecture dependent.  The set of variables defined is architecture dependent.
 Most architectures define at least the following variables.  Most architectures define at least the following variables.
 .Bl -column "Second level name" "Type" "Changeable" -offset indent  .Bl -column "machdep.booted_kernel" "Type" "Changeable" -offset indent
 .It Sy Second level name        Type    Changeable  .It Sy Second level name        Type    Changeable
 .It Li CPU_CONSDEV      dev_t   no  .It Li machdep.booted_kernel    string  no
 .El  .El
 .Sh The net.* subtree  .\" XXX: Document the above.
   .Ss The net.* subtree
 The string and integer information available for the  The string and integer information available for the
 .Li net  .Li net
 level is detailed below.  level is detailed below.
Line 953  The data is returned as a sequence of ro
Line 1204  The data is returned as a sequence of ro
 for the header file, format and meaning).  for the header file, format and meaning).
 The length of each message is contained in the message header.  The length of each message is contained in the message header.
 .Pp  .Pp
 The third level name is a protocol number, which is currently always 0.  The third level name is a protocol number, which is currently always\ 0.
 The fourth level name is an address family, which may be set to 0 to  The fourth level name is an address family, which may be set to 0 to
 select all address families.  select all address families.
 The fifth and sixth level names are as follows:  The fifth and sixth level names are as follows:
Line 1431  The number of IPv6 extension headers per
Line 1682  The number of IPv6 extension headers per
 If set to 0, the node will accept as many extension headers as possible.  If set to 0, the node will accept as many extension headers as possible.
 .It Li ip6.hashsize  .It Li ip6.hashsize
 The size of IPv6 Fast Forward hash table.  The size of IPv6 Fast Forward hash table.
 This value must be a power of 2 (64, 256...).  This value must be a power of 2 (64, 256, ...).
 A larger hash table size results in fewer collisions.  A larger hash table size results in fewer collisions.
 Also see  Also see
 .Li ip6.maxflows .  .Li ip6.maxflows .
Line 1622  The variables are as follows:
Line 1873  The variables are as follows:
 .It Li debug  .It Li debug
 Turn on debugging message from within the kernel.  Turn on debugging message from within the kernel.
 The value is a bitmap, as defined in  The value is a bitmap, as defined in
 .Pa /usr/include/netkey/key_debug.h .  .In netkey/key_debug.h .
 .It Li spi_try  .It Li spi_try
 The number of times the kernel will try to obtain an unique SPI  The number of times the kernel will try to obtain an unique SPI
 when it generates it from random number generator.  when it generates it from random number generator.
Line 1653  The value is used when the kernel create
Line 1904  The value is used when the kernel create
 on ACQUIRE PF_KEY message.  on ACQUIRE PF_KEY message.
 .El  .El
 .El  .El
 .Sh The proc.* subtree  .Ss The proc.* subtree
 The string and integer information available for the  The string and integer information available for the
 .Li proc  .Li proc
 level is detailed below.  level is detailed below.
Line 1681  The template used for the core dump file
Line 1932  The template used for the core dump file
 .Xr core 5  .Xr core 5
 for details).  for details).
 The base name must either be  The base name must either be
 .Nm core  .Pa core
 or end with the suffix ``.core'' (the super-user may set arbitrary names).  or end with the suffix
 By default it points to KERN_DEFCORENAME.  .Pa .core
   (the super-user may set arbitrary names).
   By default it points to
   .Dv KERN_DEFCORENAME .
 .It Li proc.pid.rlimit ( PROC_PID_LIMIT )  .It Li proc.pid.rlimit ( PROC_PID_LIMIT )
 Return resources limits, as defined for the  Return resources limits, as defined for the
 .Xr getrlimit 2  .Xr getrlimit 2
Line 1691  and
Line 1945  and
 .Xr setrlimit 2  .Xr setrlimit 2
 system calls.  system calls.
 The fourth level name is one of:  The fourth level name is one of:
 .Bl -tag -width PROC_PID_LIMIT_MEMLOCKAA  .Bl -tag -width "123456"
 .It Li proc.pid.rlimit.cputime ( PROC_PID_LIMIT_CPU )  .It Li proc.pid.rlimit.cputime ( PROC_PID_LIMIT_CPU )
 The maximum amount of CPU time (in seconds) to be used by each process.  The maximum amount of CPU time (in seconds) to be used by each process.
 .It Li proc.pid.rlimit.filesize ( PROC_PID_LIMIT_FSIZE )  .It Li proc.pid.rlimit.filesize ( PROC_PID_LIMIT_FSIZE )
Line 1735  options.
Line 1989  options.
 .El  .El
 .Pp  .Pp
 The fifth level name is one of  The fifth level name is one of
 .Li soft ( PROC_PID_LIMIT_TYPE_SOFT ) or  .Li soft ( PROC_PID_LIMIT_TYPE_SOFT )
   or
 .Li hard ( PROC_PID_LIMIT_TYPE_HARD ) ,  .Li hard ( PROC_PID_LIMIT_TYPE_HARD ) ,
 to select respectively the soft or hard limit.  to select respectively the soft or hard limit.
 Both are of type integer.  Both are of type integer.
Line 1785  before it disappears.
Line 2040  before it disappears.
 .Pp  .Pp
 This value is also inherited by the process's children.  This value is also inherited by the process's children.
 .El  .El
 .Sh The user.* subtree ( CTL_USER )  .Ss The user.* subtree ( CTL_USER )
 The string and integer information available for the  The string and integer information available for the
 .Li user  .Li user
 level is detailed below.  level is detailed below.
Line 1853  The maximum length in bytes of a text-pr
Line 2108  The maximum length in bytes of a text-pr
 line.  line.
 .It Li user.posix2_char_term ( USER_POSIX2_CHAR_TERM )  .It Li user.posix2_char_term ( USER_POSIX2_CHAR_TERM )
 Return 1 if the system supports at least one terminal type capable of  Return 1 if the system supports at least one terminal type capable of
 all operations described in POSIX 1003.2, otherwise 0.  all operations described in
   .St -p1003.2 ,
   otherwise\ 0.
 .It Li user.posix2_c_bind ( USER_POSIX2_C_BIND )  .It Li user.posix2_c_bind ( USER_POSIX2_C_BIND )
 Return 1 if the system's C-language development facilities support the  Return 1 if the system's C-language development facilities support the
 C-Language Bindings Option, otherwise 0.  C-Language Bindings Option, otherwise\ 0.
 .It Li user.posix2_c_dev ( USER_POSIX2_C_DEV )  .It Li user.posix2_c_dev ( USER_POSIX2_C_DEV )
 Return 1 if the system supports the C-Language Development Utilities Option,  Return 1 if the system supports the C-Language Development Utilities Option,
 otherwise 0.  otherwise\ 0.
 .It Li user.posix2_fort_dev ( USER_POSIX2_FORT_DEV )  .It Li user.posix2_fort_dev ( USER_POSIX2_FORT_DEV )
 Return 1 if the system supports the FORTRAN Development Utilities Option,  Return 1 if the system supports the FORTRAN Development Utilities Option,
 otherwise 0.  otherwise\ 0.
 .It Li user.posix2_fort_run ( USER_POSIX2_FORT_RUN )  .It Li user.posix2_fort_run ( USER_POSIX2_FORT_RUN )
 Return 1 if the system supports the FORTRAN Runtime Utilities Option,  Return 1 if the system supports the FORTRAN Runtime Utilities Option,
 otherwise 0.  otherwise\ 0.
 .It Li user.posix2_localedef ( USER_POSIX2_LOCALEDEF )  .It Li user.posix2_localedef ( USER_POSIX2_LOCALEDEF )
 Return 1 if the system supports the creation of locales, otherwise 0.  Return 1 if the system supports the creation of locales, otherwise\ 0.
 .It Li user.posix2_sw_dev ( USER_POSIX2_SW_DEV )  .It Li user.posix2_sw_dev ( USER_POSIX2_SW_DEV )
 Return 1 if the system supports the Software Development Utilities Option,  Return 1 if the system supports the Software Development Utilities Option,
 otherwise 0.  otherwise\ 0.
 .It Li user.posix2_upe ( USER_POSIX2_UPE )  .It Li user.posix2_upe ( USER_POSIX2_UPE )
 Return 1 if the system supports the User Portability Utilities Option,  Return 1 if the system supports the User Portability Utilities Option,
 otherwise 0.  otherwise\ 0.
 .It Li user.posix2_version ( USER_POSIX2_VERSION )  .It Li user.posix2_version ( USER_POSIX2_VERSION )
 The version of POSIX 1003.2 with which the system attempts to comply.  The version of
   .St -p1003.2
   with which the system attempts to comply.
 .It Li user.re_dup_max ( USER_RE_DUP_MAX )  .It Li user.re_dup_max ( USER_RE_DUP_MAX )
 The maximum number of repeated occurrences of a regular expression  The maximum number of repeated occurrences of a regular expression
 permitted when using interval notation.  permitted when using interval notation.
Line 1886  at any one time.
Line 2145  at any one time.
 The minimum maximum number of types supported for the name of a  The minimum maximum number of types supported for the name of a
 timezone.  timezone.
 .El  .El
 .Sh The vm.* subtree ( CTL_VM )  .Ss The vm.* subtree ( CTL_VM )
 The string and integer information available for the  The string and integer information available for the
 .Li vm  .Li vm
 level is detailed below.  level is detailed below.
Line 1946  cached file data.
Line 2205  cached file data.
 .It Li vm.loadavg ( VM_LOADAVG )  .It Li vm.loadavg ( VM_LOADAVG )
 Return the load average history.  Return the load average history.
 The returned data consists of a  The returned data consists of a
 .Va struct loadavg .  .Vt struct loadavg .
 .It Li vm.maxslp ( VM_MAXSLP )  .It Li vm.maxslp ( VM_MAXSLP )
 The value of the maxslp kernel global variable.  The value of the maxslp kernel global variable.
 .It Li vm.vmmeter ( VM_METER )  .It Li vm.vmmeter ( VM_METER )
 Return system wide virtual memory statistics.  Return system wide virtual memory statistics.
 The returned data consists of a  The returned data consists of a
 .Va struct vmtotal .  .Vt struct vmtotal .
 .It vm.user_va0_disable  .It vm.user_va0_disable
 A flag which controls whether user processes can map virtual address 0.  A flag which controls whether user processes can map virtual address\ 0.
 .It Li vm.uspace ( VM_USPACE )  .It Li vm.uspace ( VM_USPACE )
 The number of bytes allocated for each kernel stack.  The number of bytes allocated for each kernel stack.
 .It Li vm.uvmexp ( VM_UVMEXP )  .It Li vm.uvmexp ( VM_UVMEXP )
 Return system wide virtual memory statistics.  Return system wide virtual memory statistics.
 The returned data consists of a  The returned data consists of a
 .Va struct uvmexp .  .Vt struct uvmexp .
 .It Li vm.uvmexp2 ( VM_UVMEXP2 )  .It Li vm.uvmexp2 ( VM_UVMEXP2 )
 Return system wide virtual memory statistics.  Return system wide virtual memory statistics.
 The returned data consists of a  The returned data consists of a
 .Va struct uvmexp_sysctl .  .Vt struct uvmexp_sysctl .
 .\" XXX vm.idlezero  .\" XXX vm.idlezero
 .El  .El
 .Sh The ddb.* subtree ( CTL_DDB )  .Ss The ddb.* subtree ( CTL_DDB )
 The integer information available for the  The information available for the
 .Li ddb  .Li ddb
 level is detailed below.  level is detailed below.
 The changeable column shows whether a process with appropriate  The changeable column shows whether a process with appropriate
Line 1978  privilege may change the value.
Line 2237  privilege may change the value.
 .It Sy Second level name        Type    Changeable  .It Sy Second level name        Type    Changeable
 .It ddb.radix   integer yes  .It ddb.radix   integer yes
 .It ddb.maxoff  integer yes  .It ddb.maxoff  integer yes
   .It ddb.maxwidth        integer yes
 .It ddb.lines   integer yes  .It ddb.lines   integer yes
 .It ddb.tabstops        integer yes  .It ddb.tabstops        integer yes
 .It ddb.onpanic integer yes  .It ddb.onpanic integer yes
 .It ddb.fromconsole     integer yes  .It ddb.fromconsole     integer yes
   .It ddb.tee_msgbuf      integer yes
   .It ddb.commandonenter  string  yes
 .El  .El
 .Pp  .Pp
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li ddb.radix ( DBCTL_RADIX )  .It Li ddb.radix ( DDBCTL_RADIX )
 The input and output radix.  The input and output radix.
 .It Li ddb.maxoff ( DBCTL_MAXOFF )  .It Li ddb.maxoff ( DDBCTL_MAXOFF )
 The maximum symbol offset.  The maximum symbol offset.
 .It Li ddb.lines ( DBCTL_LINES )  .It Li ddb.maxwidth ( DDBCTL_MAXWIDTH )
   The maximum output line width.
   .It Li ddb.lines ( DDBCTL_LINES )
 Number of display lines.  Number of display lines.
 .It Li ddb.tabstops ( DBCTL_TABSTOPS )  .It Li ddb.tabstops ( DDBCTL_TABSTOPS )
 Tab width.  Tab width.
 .It Li ddb.onpanic ( DBCTL_ONPANIC )  .It Li ddb.onpanic ( DDBCTL_ONPANIC )
 If non-zero, DDB will be entered if the kernel panics.  If non-zero, DDB will be entered if the kernel panics.
 .It Li ddb.fromconsole ( DBCTL_FROMCONSOLE )  .It Li ddb.fromconsole ( DDBCTL_FROMCONSOLE )
 If not zero, DDB may be entered by sending a break on a serial  If not zero, DDB may be entered by sending a break on a serial
 console or by a special key sequence on a graphics console.  console or by a special key sequence on a graphics console.
 .\" XXX tee_msgbuf maxwidth commandonenter  .It Li ddb.tee_msgbuf
   If not zero, DDB will output also to the kernel message buffer.
   .It Li ddb.commandonenter
   If not empty, a command to be executed on each enter to the
   .Tn DDB .
   .\"
   .\" XXX: (a) ddb.commandonenter is missing in ddb(4);
   .\"      (b) No DDBCTL definitions for tee_msgbuf and commandonenter.
 .El  .El
 .Pp  .Pp
 These MIB nodes are also available as variables from within the DDB.  Some of these
   .Tn MIB
   nodes are also available as variables from within the debugger.
 See  See
 .Xr ddb 4  .Xr ddb 4
 for more details.  for more details.
 .Sh The security.* subtree ( CTL_SECURITY )  .Ss The security.* subtree ( CTL_SECURITY )
 The  The
 .Li security  .Li security
 level contains various security-related settings for  level contains various security-related settings for
 the system.  the system.
   The available second level names are:
   .Bl -column "Second level name" "integer" "Changeable" -offset indent
   .It Sy Second level name        Type    Changeable
   .It Li security.curtain integer yes
   .It Li security.models  node    not applicable
   .It Li security.pax     node    not applicable
   .El
   .Pp
 Available settings are detailed below.  Available settings are detailed below.
 .Pp  .Pp
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li security.curtain  .It Li security.curtain
 If non-zero, will filter return objects according to the user-id  If non-zero, will filter return objects according to the user
   .Tn ID
 requesting information about them, preventing from users any  requesting information about them, preventing from users any
 access to objects they don't own.  access to objects they do not own.
 .Pp  .Pp
 At the moment, it affects  At the moment, it affects
 .Xr ps 1 ,  .Xr ps 1 ,
Line 2047  For more information on any of the PaX f
Line 2329  For more information on any of the PaX f
 .Xr paxctl 8  .Xr paxctl 8
 and  and
 .Xr security 8 .  .Xr security 8 .
   The available third and fourth level names are:
   .Bl -column "security.pax.segvguard.suspend_timeout" "integer" "Changeable" \
   -offset 2n
   .It Sy Third and fourth level names Ta Sy Type Ta Sy Changeable
   .It Li security.pax.aslr.enabled        integer yes
   .\".It Li security.pax.aslr.exec_len    integer yes
   .It Li security.pax.aslr.global integer yes
   .\".It Li security.pax.aslr.mmap_len    integer yes
   .\".It Li security.pax.aslr.stack_len   integer yes
   .It Li security.pax.mprotect.enabled    integer yes
   .It Li security.pax.mprotect.global     integer yes
   .It Li security.pax.segvguard.enabled   integer yes
   .It Li security.pax.segvguard.expiry_timeout    integer yes
   .It Li security.pax.segvguard.global    integer yes
   .It Li security.pax.segvguard.max_crashes       integer yes
   .It Li security.pax.segvguard.suspend_timeout   integer yes
   .El
 .Pp  .Pp
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li security.pax.aslr.enable  .It Li security.pax.aslr.enabled
 Enable PaX ASLR (Address Space Layout Randomization).  Enable PaX ASLR (Address Space Layout Randomization).
 .Pp  .Pp
 The value of this  The value of this
 knob must be non-zero for PaX ASLR to be enabled, even if a program is set to  knob must be non-zero for PaX ASLR to be enabled, even if a program is set to
 explicit enable.  explicit enable.
   .\".It Li security.pax.aslr.exec_len
   .\" XXX: Undocumented.
 .It Li security.pax.aslr.global  .It Li security.pax.aslr.global
 Specifies the default global policy for programs without an  Specifies the default global policy for programs without an
 explicit enable/disable flag.  explicit enable/disable flag.
Line 2064  When non-zero, all programs will get PaX
Line 2365  When non-zero, all programs will get PaX
 Otherwise, all programs will not get PaX ASLR, except those specifically  Otherwise, all programs will not get PaX ASLR, except those specifically
 marked as such with  marked as such with
 .Xr paxctl 8 .  .Xr paxctl 8 .
 .It Li security.pax.mprotect.enable  .\".It Li security.pax.aslr.mmap_len
   .\" XXX: Undocumented.
   .\" .It Li security.pax.aslr.stack_len
   .\" XXX: Undocumented.
   .It Li security.pax.mprotect.enabled
 Enable PaX MPROTECT restrictions.  Enable PaX MPROTECT restrictions.
 .Pp  .Pp
 These are  These are
Line 2083  except those exempted with
Line 2388  except those exempted with
 Otherwise, all programs will not get the PaX MPROTECT restrictions,  Otherwise, all programs will not get the PaX MPROTECT restrictions,
 except those specifically marked as such with  except those specifically marked as such with
 .Xr paxctl 8 .  .Xr paxctl 8 .
 .It Li security.pax.segvguard.enable  .It Li security.pax.segvguard.enabled
 Enable PaX Segvguard.  Enable PaX Segvguard.
 .Pp  .Pp
 PaX Segvguard can detect and prevent certain exploitation attempts, where  PaX Segvguard can detect and prevent certain exploitation attempts, where
Line 2095  The
Line 2400  The
 .Nx  .Nx
 interface and implementation of the Segvguard is still experimental, and may  interface and implementation of the Segvguard is still experimental, and may
 change in future releases.  change in future releases.
   .It Li security.pax.segvguard.expiry_timeout
   If the max number was not reached within this timeout (in seconds), the entry
   will expire.
 .It Li security.pax.segvguard.global  .It Li security.pax.segvguard.global
 Specifies the default global policy for programs without an  Specifies the default global policy for programs without an
 explicit enable/disable flag.  explicit enable/disable flag.
Line 2105  except those exempted with
Line 2413  except those exempted with
 Otherwise, no program will get the PaX Segvguard restrictions,  Otherwise, no program will get the PaX Segvguard restrictions,
 except those specifically marked as such with  except those specifically marked as such with
 .Xr paxctl 8 .  .Xr paxctl 8 .
 .It Li security.pax.segvguard.expiry_timeout  .It Li security.pax.segvguard.max_crashes
 If the max number was not reached within this timeout (in seconds), the entry  The maximum number of segfaults a program can receive before suspension.
 will expire.  
 .It Li security.pax.segvguard.suspend_timeout  .It Li security.pax.segvguard.suspend_timeout
 Number of seconds to suspend a user from running a faulting program when the  Number of seconds to suspend a user from running a faulting program when the
 limit was exceeded.  limit was exceeded.
 .It Li security.pax.segvguard.max_crashes  
 Max number of segfaults a program can receive before suspension.  
 .El  .El
 .El  .El
 .Sh The vendor.* subtree ( CTL_VENDOR )  .Ss The vendor.* subtree ( CTL_VENDOR )
 The  The
 .Li vendor  .Li vendor
 toplevel name is reserved to be used by vendors who wish to  toplevel name is reserved to be used by vendors who wish to

Legend:
Removed from v.1.32  
changed lines
  Added in v.1.59

CVSweb <webmaster@jp.NetBSD.org>