[BACK]Return to sysctl.7 CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / src / share / man / man7

Annotation of src/share/man/man7/sysctl.7, Revision 1.43

1.43    ! jruoho      1: .\"    $NetBSD: sysctl.7,v 1.42 2010/04/20 06:22:52 jruoho Exp $
1.1       pavel       2: .\"
                      3: .\" Copyright (c) 1993
                      4: .\"    The Regents of the University of California.  All rights reserved.
                      5: .\"
                      6: .\" Redistribution and use in source and binary forms, with or without
                      7: .\" modification, are permitted provided that the following conditions
                      8: .\" are met:
                      9: .\" 1. Redistributions of source code must retain the above copyright
                     10: .\"    notice, this list of conditions and the following disclaimer.
                     11: .\" 2. Redistributions in binary form must reproduce the above copyright
                     12: .\"    notice, this list of conditions and the following disclaimer in the
                     13: .\"    documentation and/or other materials provided with the distribution.
                     14: .\" 3. Neither the name of the University nor the names of its contributors
                     15: .\"    may be used to endorse or promote products derived from this software
                     16: .\"    without specific prior written permission.
                     17: .\"
                     18: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
                     19: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
                     20: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
                     21: .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
                     22: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
                     23: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
                     24: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
                     25: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
                     26: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
                     27: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
                     28: .\" SUCH DAMAGE.
                     29: .\"
                     30: .\"    @(#)sysctl.3    8.4 (Berkeley) 5/9/95
                     31: .\"
1.41      jruoho     32: .Dd April 20, 2010
1.1       pavel      33: .Dt SYSCTL 7
                     34: .Os
                     35: .Sh NAME
                     36: .Nm sysctl
                     37: .Nd system information variables
                     38: .Sh DESCRIPTION
                     39: The
                     40: .Xr sysctl 3
                     41: library function and the
                     42: .Xr sysctl 8
                     43: utility are used to get and set values of system variables, maintained
                     44: by the kernel.
                     45: The variables are organized in a tree and identified by a sequence of
                     46: numbers, conventionally separated by dots with the topmost identifier
                     47: at the left side.
                     48: The numbers have corresponding text names.
                     49: The
                     50: .Xr sysctlnametomib 3
                     51: function or the
                     52: .Fl M
                     53: argument to the
                     54: .Xr sysctl 8
                     55: utility can be used to convert the text representation to the
                     56: numeric one.
                     57: .Pp
                     58: The individual sysctl variables are described below, both the textual
                     59: and numeric form where applicable.
                     60: The textual names can be used as argument to the
                     61: .Xr sysctl 8
                     62: utility and in the file
                     63: .Pa /etc/sysctl.conf .
                     64: The numeric names are usually defined as preprocessor constants and
                     65: are intended for use by programs.
                     66: Every such constant expands to one integer, which identifies the
                     67: sysctl variable relative to the upper level of the tree.
                     68: See the
                     69: .Xr sysctl 3
                     70: manual page for programming examples.
                     71: .Sh Top level names
                     72: The top level names are defined with a CTL_ prefix in
1.33      joerg      73: .In sys/sysctl.h ,
1.1       pavel      74: and are as follows.
                     75: The next and subsequent levels down are found in the include files
                     76: listed here, and described in separate sections below.
1.21      joerg      77: .Bl -column security CTL_SECURITY "Next level names" "High kernel limits"
1.1       pavel      78: .It Sy Name    Constant        Next level names        Description
1.21      joerg      79: .It kern       CTL_KERN        sys/sysctl.h    High kernel limits
                     80: .It vm CTL_VM  uvm/uvm_param.h Virtual memory
                     81: .It vfs        CTL_VFS sys/mount.h     Filesystem
                     82: .It net        CTL_NET sys/socket.h    Networking
                     83: .It debug      CTL_DEBUG       sys/sysctl.h    Debugging
                     84: .It hw CTL_HW  sys/sysctl.h    Generic CPU, I/O
                     85: .It machdep    CTL_MACHDEP     sys/sysctl.h    Machine dependent
                     86: .It user       CTL_USER        sys/sysctl.h    User-level
                     87: .It ddb        CTL_DDB sys/sysctl.h    In-kernel debugger
                     88: .It proc       CTL_PROC        sys/sysctl.h    Per-process
                     89: .It vendor     CTL_VENDOR      ?       Vendor specific
                     90: .It emul       CTL_EMUL        sys/sysctl.h    Emulation settings
                     91: .It security   CTL_SECURITY    sys/sysctl.h    Security settings
1.1       pavel      92: .El
                     93: .Sh The debug.* subtree
                     94: The debugging variables vary from system to system.
                     95: A debugging variable may be added or deleted without need to recompile
                     96: .Nm
                     97: to know about it.
                     98: Each time it runs,
                     99: .Nm
                    100: gets the list of debugging variables from the kernel and
                    101: displays their current values.
                    102: The system defines twenty
                    103: .Va ( struct ctldebug )
                    104: variables named
                    105: .Dv debug0
                    106: through
                    107: .Dv debug19 .
                    108: They are declared as separate variables so that they can be
                    109: individually initialized at the location of their associated variable.
                    110: The loader prevents multiple use of the same variable by issuing errors
                    111: if a variable is initialized in more than one place.
                    112: For example, to export the variable
                    113: .Dv dospecialcheck
                    114: as a debugging variable, the following declaration would be used:
1.43    ! jruoho    115: .Pp
1.1       pavel     116: .Bd -literal -offset indent -compact
                    117: int dospecialcheck = 1;
                    118: struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };
                    119: .Ed
                    120: .Pp
                    121: Note that the dynamic implementation of
                    122: .Nm
                    123: currently in use largely makes this particular
                    124: .Nm
                    125: interface obsolete.
                    126: See
                    127: .Xr sysctl 8
                    128: .\" and
                    129: .\" .Xr sysctl 9
                    130: for more information.
                    131: .Sh The vfs.* subtree
                    132: A distinguished second level name,
                    133: .Li vfs.generic ( VFS_GENERIC ) ,
                    134: is used to get general information about all filesystems.
1.26      elad      135: It has the following third level identifiers:
                    136: .Bl -tag -width compact
                    137: .It vfs.generic.maxtypenum ( VFS_MAXTYPENUM )
                    138: The highest valid filesystem type number.
                    139: .It vfs.generic.conf ( VFS_CONF )
                    140: Returns configuration information about the file-system type given as a fourth
                    141: level identifier.
                    142: .El
                    143: .Pp
                    144: The remaining second level identifiers are the file-system names, identified
                    145: by the type number returned by a
1.1       pavel     146: .Xr statvfs 2
                    147: call or from
1.27      wiz       148: .Li vfs.generic.conf .
1.1       pavel     149: The third level identifiers available for each filesystem
                    150: are given in the header file that defines the mount
                    151: argument structure for that filesystem.
                    152: .Sh The hw.* subtree
                    153: The string and integer information available for the
                    154: .Li hw
                    155: level is detailed below.
                    156: The changeable column shows whether a process with appropriate
                    157: privilege may change the value.
1.37      jruoho    158: .Bl -column "hw.machine_arch" "integer" "Changeable" -offset indent
1.1       pavel     159: .It Sy Second level name       Type    Changeable
                    160: .It hw.alignbytes      integer no
                    161: .It hw.byteorder       integer no
                    162: .It hw.cnmagic string  yes
                    163: .It hw.disknames       string  no
                    164: .It hw.diskstats       struct  no
                    165: .It hw.machine string  no
                    166: .It hw.machine_arch    string  no
                    167: .It hw.model   string  no
                    168: .It hw.ncpu    integer no
                    169: .It hw.pagesize        integer no
                    170: .It hw.physmem integer no
                    171: .It hw.physmem64       quad    no
                    172: .It hw.usermem integer no
                    173: .It hw.usermem64       quad    no
                    174: .El
                    175: .Pp
                    176: .Bl -tag -width "123456"
                    177: .It Li hw.alignbytes ( HW_ALIGNBYTES )
                    178: Alignment constraint for all possible data types.
                    179: This shows the value
                    180: .Dv ALIGNBYTES
                    181: in
                    182: .Pa /usr/include/machine/param.h ,
                    183: at the kernel compilation time.
                    184: .It Li hw.byteorder ( HW_BYTEORDER )
                    185: The byteorder (4,321, or 1,234).
                    186: .It Li hw.cnmagic ( HW_CNMAGIC )
                    187: The console magic key sequence.
                    188: .It Li hw.disknames ( HW_DISKNAMES )
                    189: The list of (space separated) disk device names on the system.
                    190: .It Li hw.iostatnames ( HW_IOSTATNAMES )
                    191: A space separated list of devices that will have I/O statistics
                    192: collected on them.
                    193: .It Li hw.iostats ( HW_IOSTATS )
                    194: Return statistical information on the NFS mounts, disk and tape
                    195: devices on the system.
                    196: An array of
                    197: .Va struct io_sysctl
                    198: structures is returned,
                    199: whose size depends on the current number of such objects in the system.
                    200: The third level name is the size of the
                    201: .Va struct io_sysctl .
                    202: The type of object can be determined by examining the
                    203: .Va type
                    204: element of
                    205: .Va struct io_sysctl .
                    206: Which can be
                    207: .Dv IOSTAT_DISK
                    208: (disk drive),
                    209: .Dv IOSTAT_TAPE
                    210: (tape drive), or
                    211: .Dv IOSTAT_NFS
                    212: (NFS mount).
                    213: .It Li hw.machine ( HW_MACHINE )
                    214: The machine class.
                    215: .It Li hw.machine_arch ( HW_MACHINE_ARCH )
                    216: The machine CPU class.
                    217: .It Li hw.model ( HW_MODEL )
                    218: The machine model.
                    219: .It Li hw.ncpu ( HW_NCPU )
                    220: The number of CPUs.
                    221: .It Li hw.pagesize ( HW_PAGESIZE )
                    222: The software page size.
                    223: .It Li hw.physmem ( HW_PHYSMEM )
                    224: The bytes of physical memory as a 32-bit integer.
                    225: .It Li hw.physmem64 ( HW_PHYSMEM64 )
                    226: The bytes of physical memory as a 64-bit integer.
                    227: .It Li hw.usermem ( HW_USERMEM )
                    228: The bytes of non-kernel memory as a 32-bit integer.
                    229: .It Li hw.usermem64 ( HW_USERMEM64 )
                    230: The bytes of non-kernel memory as a 64-bit integer.
                    231: .El
                    232: .Sh The kern.* subtree
1.43    ! jruoho    233: This subtree includes data generally related to the kernel.
1.1       pavel     234: The string and integer information available for the
                    235: .Li kern
                    236: level is detailed below.
                    237: The changeable column shows whether a process with appropriate
                    238: privilege may change the value.
1.43    ! jruoho    239: .Bl -column "kern.posix_reader_writer_locks" \
        !           240: "struct kinfo_drivers" "not applicable"
1.1       pavel     241: .It Sy Second level name       Type    Changeable
1.41      jruoho    242: .\".It kern.arandom    integer no
1.1       pavel     243: .It kern.argmax        integer no
                    244: .It kern.autonicetime  integer yes
                    245: .It kern.autoniceval   integer yes
1.39      jruoho    246: .It kern.boothowto     integer no
1.1       pavel     247: .It kern.boottime      struct timeval  no
1.39      jruoho    248: .\".It kern.bufq       node    not applicable
1.1       pavel     249: .It kern.ccpu  integer no
                    250: .It kern.clockrate     struct clockinfo        no
                    251: .It kern.consdev       integer no
1.39      jruoho    252: .It kern.coredump      node    not applicable
1.21      joerg     253: .It kern.cp_id struct  no
                    254: .It kern.cp_time       uint64_t[\|]    no
1.41      jruoho    255: .\".It kern.cryptodevallowsoft integer yes
1.1       pavel     256: .It kern.defcorename   string  yes
1.38      jruoho    257: .It kern.detachall     integer yes
1.1       pavel     258: .It kern.domainname    string  yes
                    259: .It kern.drivers       struct kinfo_drivers    no
1.39      jruoho    260: .It kern.dump_on_panic integer yes
1.1       pavel     261: .It kern.file  struct file     no
                    262: .It kern.forkfsleep    integer yes
                    263: .It kern.fscale        integer no
                    264: .It kern.fsync integer no
1.21      joerg     265: .It kern.hardclock_ticks       integer no
1.1       pavel     266: .It kern.hostid        integer yes
                    267: .It kern.hostname      string  yes
1.21      joerg     268: .It kern.iov_max       integer no
1.39      jruoho    269: .It kern.ipc   node    not applicable
1.21      joerg     270: .It kern.job_control   integer no
1.1       pavel     271: .It kern.labeloffset   integer no
                    272: .It kern.labelsector   integer no
1.21      joerg     273: .It kern.login_name_max        integer no
1.1       pavel     274: .It kern.logsigexit    integer yes
1.21      joerg     275: .It kern.mapped_files  integer no
1.1       pavel     276: .It kern.maxfiles      integer yes
                    277: .It kern.maxpartitions integer no
                    278: .It kern.maxphys       integer no
                    279: .It kern.maxproc       integer yes
                    280: .It kern.maxptys       integer yes
                    281: .It kern.maxvnodes     integer yes
                    282: .It kern.mbuf  node    not applicable
                    283: .It kern.memlock       integer no
1.21      joerg     284: .It kern.memlock_range integer no
                    285: .It kern.memory_protection     integer no
1.42      jruoho    286: .It kern.module        node    not applicable
1.21      joerg     287: .It kern.monotonic_clock       integer no
1.1       pavel     288: .It kern.msgbuf        integer no
                    289: .It kern.msgbufsize    integer no
                    290: .It kern.ngroups       integer no
1.41      jruoho    291: .\".It kern.no_sa_support      integer yes
1.1       pavel     292: .It kern.ntptime       struct ntptimeval       no
                    293: .It kern.osrelease     string  no
1.39      jruoho    294: .It kern.osrevision    integer no
1.1       pavel     295: .It kern.ostype        string  no
1.41      jruoho    296: .\".It kern.panic_now  integer yes
1.1       pavel     297: .It kern.pipe  node    not applicable
1.39      jruoho    298: .\" .It kern.posix     node    not applicable
                    299: .It kern.posix1version integer no
1.21      joerg     300: .It kern.posix_barriers        integer no
                    301: .It kern.posix_reader_writer_locks     integer no
1.39      jruoho    302: .\".It kern.posix_sched        integer yes
1.21      joerg     303: .It kern.posix_semaphores      integer no
                    304: .It kern.posix_spin_locks      integer no
                    305: .It kern.posix_threads integer no
                    306: .It kern.posix_timers  integer no
1.1       pavel     307: .It kern.proc  struct kinfo_proc       no
                    308: .It kern.proc2 struct kinfo_proc2      no
1.21      joerg     309: .It kern.proc_args     string  no
1.39      jruoho    310: .It kern.profiling     node    not applicable
1.41      jruoho    311: .\".It kern.pset       node    not applicable
1.1       pavel     312: .It kern.rawpartition  integer no
1.21      joerg     313: .It kern.root_device   string  no
                    314: .It kern.root_partition        integer no
                    315: .It kern.rtc_offset    integer yes
                    316: .It kern.saved_ids     integer no
1.39      jruoho    317: .It kern.sbmax integer yes
1.41      jruoho    318: .\".It kern.sched      node    not applicable
1.1       pavel     319: .It kern.securelevel   integer raise only
1.39      jruoho    320: .It kern.somaxkva      integer yes
1.21      joerg     321: .It kern.synchronized_io       integer no
1.19      christos  322: .It kern.timecounter   node    not applicable
1.1       pavel     323: .It kern.timex struct  no
                    324: .It kern.tkstat        node    not applicable
                    325: .It kern.urandom       integer no
1.41      jruoho    326: .\".It kern.usercrypto integer yes
                    327: .\" It kern.userasymcrypto     integer yes
1.39      jruoho    328: .It kern.veriexec      node    not applicable
1.1       pavel     329: .It kern.version       string  no
                    330: .It kern.vnode struct vnode    no
                    331: .El
                    332: .Bl -tag -width "123456"
1.41      jruoho    333: .\".It Li kern.arandom
                    334: .\" XXX: Undocumented.
1.1       pavel     335: .It Li kern.argmax ( KERN_ARGMAX )
                    336: The maximum bytes of argument to
                    337: .Xr execve 2 .
1.39      jruoho    338: .\" XXX: Is kern.autonicetime still available?
1.1       pavel     339: .It Li kern.autonicetime ( KERN_AUTONICETIME )
                    340: The number of seconds of CPU-time a non-root process may accumulate before
                    341: having its priority lowered from the default to the value of KERN_AUTONICEVAL.
                    342: If set to 0, automatic lowering of priority is not performed, and if set to \-1
                    343: all non-root processes are immediately lowered.
1.39      jruoho    344: .\" XXX: Is kern.autoniceval still available?
1.1       pavel     345: .It Li kern.autoniceval ( KERN_AUTONICEVAL )
                    346: The priority assigned for automatically niced processes.
1.23      apb       347: .It Li kern.boothowto
                    348: Flags passed from the boot loader; see
                    349: .Xr reboot 2
                    350: for the meanings of the flags.
1.1       pavel     351: .It Li kern.boottime ( KERN_BOOTTIME )
                    352: A
                    353: .Va struct timeval
                    354: structure is returned.
                    355: This structure contains the time that the system was booted.
1.41      jruoho    356: .\" .It Li kern.bufq
                    357: .\" XXX: Undocumented.
1.1       pavel     358: .It Li kern.ccpu ( KERN_CCPU )
                    359: The scheduler exponential decay value.
                    360: .It Li kern.clockrate ( KERN_CLOCKRATE )
                    361: A
                    362: .Va struct clockinfo
                    363: structure is returned.
                    364: This structure contains the clock, statistics clock and profiling clock
                    365: frequencies, the number of micro-seconds per hz tick, and the clock
                    366: skew rate.
1.36      jruoho    367: Refer to
                    368: .Xr hz 9
                    369: for additional details.
1.1       pavel     370: .It Li kern.consdev ( KERN_CONSDEV )
                    371: Console device.
1.39      jruoho    372: .It Li kern.coredump
                    373: Settings related to set-id processes coredumps.
                    374: By default, set-id processes do not dump core in situations where
                    375: other processes would.
                    376: The settings in this node allows an administrator to change this
                    377: behavior.
                    378: .Pp
                    379: The third level name is
                    380: .Dv kern.coredump.setid
1.40      jruoho    381: and fourth level variables are described below.
                    382: .Bl -column "kern.coredump.setid.group" "integer" "Changeable" -offset indent
                    383: .It Sy Fourth level name       Type    Changeable
                    384: .It kern.coredump.setid.dump   integer yes
                    385: .It kern.coredump.setid.group  integer yes
                    386: .It kern.coredump.setid.mode   integer yes
                    387: .It kern.coredump.setid.owner  integer yes
                    388: .It kern.coredump.setid.path   string  yes
                    389: .El
1.39      jruoho    390: .Bl -tag -width "123456"
                    391: .It Li kern.coredump.setid.dump
                    392: If non-zero, set-id processes will dump core.
                    393: .It Li kern.coredump.setid.group
                    394: The group-id for the set-id processes' coredump.
                    395: .It Li kern.coredump.setid.mode
                    396: The mode for the set-id processes' coredump.
                    397: See
                    398: .Xr chmod 1 .
                    399: .It Li kern.coredump.setid.owner
                    400: The user-id that will be used as the owner of the set-id processes'
                    401: coredump.
                    402: .It Li kern.coredump.setid.path
                    403: The path to which set-id processes' coredumps will be saved to.
                    404: Same syntax as kern.defcorename.
                    405: .El
1.1       pavel     406: .It Li kern.cp_id ( KERN_CP_ID )
                    407: Mapping of CPU number to CPU id.
                    408: .It Li kern.cp_time ( KERN_CP_TIME )
                    409: Returns an array of CPUSTATES uint64_ts.
                    410: This array contains the
                    411: number of clock ticks spent in different CPU states.
                    412: On multi-processor systems, the sum across all CPUs is returned unless
                    413: appropriate space is given for one data set for each CPU.
                    414: Data for a specific CPU can also be obtained by adding the number of the
                    415: CPU at the end of the MIB, enlarging it by one.
1.41      jruoho    416: .\".It Li kern.cryptodevallowsoft
                    417: .\" XXX: Undocumented.
1.1       pavel     418: .It Li kern.defcorename ( KERN_DEFCORENAME )
                    419: Default template for the name of core dump files (see also
                    420: .Li proc.pid.corename
                    421: in the per-process variables
                    422: .Li proc.* ,
                    423: and
                    424: .Xr core 5
                    425: for format of this template).
                    426: The default value is
                    427: .Nm %n.core
                    428: and can be changed with the kernel configuration option
                    429: .Cd options DEFCORENAME
                    430: (see
                    431: .Xr options 4
                    432: ).
1.38      jruoho    433: .It Li kern.detachall
                    434: Detach all devices at shutdown.
1.1       pavel     435: .It Li kern.domainname ( KERN_DOMAINNAME )
                    436: Get or set the YP domain name.
                    437: .It Li kern.drivers ( KERN_DRIVERS )
                    438: Return an array of
                    439: .Va struct kinfo_drivers
                    440: that contains the name and major device numbers of all the device drivers
                    441: in the current kernel.
                    442: The
                    443: .Va d_name
                    444: field is always a NUL terminated string.
                    445: The
                    446: .Va d_bmajor
                    447: field will be set to \-1 if the driver doesn't have a block device.
1.39      jruoho    448: .It Li kern.dump_on_panic ( KERN_DUMP_ON_PANIC )
1.41      jruoho    449: Perform a crash dump on system
                    450: .Xr panic 9 .
1.1       pavel     451: .It Li kern.file ( KERN_FILE )
                    452: Return the entire file table.
                    453: The returned data consists of a single
                    454: .Va struct filelist
                    455: followed by an array of
                    456: .Va struct file ,
                    457: whose size depends on the current number of such objects in the system.
                    458: .It Li kern.forkfsleep ( KERN_FORKFSLEEP )
                    459: If
                    460: .Xr fork 2
                    461: system call fails due to limit on number of processes (either
                    462: the global maxproc limit or user's one), wait for this many
                    463: milliseconds before returning
                    464: .Er EAGAIN
                    465: error to process.
                    466: Useful to keep heavily forking runaway processes in bay.
                    467: Default zero (no sleep).
                    468: Maximum is 20 seconds.
                    469: .It Li kern.fscale ( KERN_FSCALE )
                    470: The kernel fixed-point scale factor.
                    471: .It Li kern.fsync ( KERN_FSYNC )
                    472: Return 1 if the POSIX 1003.1b File Synchronization Option is available
                    473: on this system,
                    474: otherwise 0.
                    475: .It Li kern.hardclock_ticks ( KERN_HARDCLOCK_TICKS )
                    476: Returns the number of
                    477: .Xr hardclock 9
                    478: ticks.
                    479: .It Li kern.hostid ( KERN_HOSTID )
1.39      jruoho    480: Get or set the host identifier.
                    481: This is aimed to replace the legacy
                    482: .Xr gethostid 3
                    483: and
                    484: .Xr sethostid 3
                    485: system calls.
1.1       pavel     486: .It Li kern.hostname ( KERN_HOSTNAME )
1.39      jruoho    487: Get or set the
                    488: .Xr hostname 1 .
1.1       pavel     489: .It Li kern.iov_max ( KERN_IOV_MAX )
                    490: Return the maximum number of
                    491: .Va iovec
                    492: structures that a process has available for use with
                    493: .Xr preadv 2 ,
                    494: .Xr pwritev 2 ,
                    495: .Xr readv 2 ,
                    496: .Xr recvmsg 2 ,
                    497: .Xr sendmsg 2
                    498: and
                    499: .Xr writev 2 .
1.39      jruoho    500: .It Li kern.ipc ( KERN_SYSVIPC )
                    501: Return information about the SysV IPC parameters.
                    502: The third level names for the ipc variables are detailed below.
                    503: .Bl -column "kern.ipc.shm_use_phys" "integer" "Changeable" -offset indent
                    504: .It Sy Third level name        Type    Changeable
                    505: .It kern.ipc.sysvmsg   integer no
                    506: .It kern.ipc.sysvsem   integer no
                    507: .It kern.ipc.sysvshm   integer no
                    508: .It kern.ipc.sysvipc_info      struct  no
                    509: .It kern.ipc.shmmax    integer yes
                    510: .It kern.ipc.shmmni    integer yes
                    511: .It kern.ipc.shmseg    integer yes
                    512: .It kern.ipc.shmmaxpgs integer yes
                    513: .It kern.ipc.shm_use_phys      integer yes
                    514: .It kern.ipc.msgmni    integer yes
                    515: .It kern.ipc.msgseg    integer yes
                    516: .It kern.ipc.semmni    integer yes
                    517: .It kern.ipc.semmns    integer yes
                    518: .It kern.ipc.semmnu    integer yes
                    519: .El
                    520: .Bl -tag -width "123456"
                    521: .It Li kern.ipc.sysvmsg ( KERN_SYSVIPC_MSG )
                    522: Returns 1 if System V style message queue functionality is available
                    523: on this system,
                    524: otherwise 0.
                    525: .It Li kern.ipc.sysvsem ( KERN_SYSVIPC_SEM )
                    526: Returns 1 if System V style semaphore functionality is available
                    527: on this system,
                    528: otherwise 0.
                    529: .It Li kern.ipc.sysvshm ( KERN_SYSVIPC_SHM )
                    530: Returns 1 if System V style share memory functionality is available
                    531: on this system,
                    532: otherwise 0.
                    533: .It Li kern.ipc.sysvipc_info ( KERN_SYSVIPC_INFO )
                    534: Return System V style IPC configuration and run-time information.
                    535: The fourth level name selects the System V style IPC facility.
                    536: .Bl -column "KERN_SYSVIPC_MSG_INFO" "struct shm_sysctl_info" -offset indent
                    537: .It Sy Fourth level name       Type
                    538: .It KERN_SYSVIPC_MSG_INFO      struct msg_sysctl_info
                    539: .It KERN_SYSVIPC_SEM_INFO      struct sem_sysctl_info
                    540: .It KERN_SYSVIPC_SHM_INFO      struct shm_sysctl_info
                    541: .El
                    542: .Pp
                    543: .Bl -tag -width "123456"
                    544: .It Li KERN_SYSVIPC_MSG_INFO
                    545: Return information on the System V style message facility.
                    546: The
                    547: .Sy msg_sysctl_info
                    548: structure is defined in
                    549: .In sys/msg.h .
                    550: .It Li KERN_SYSVIPC_SEM_INFO
                    551: Return information on the System V style semaphore facility.
                    552: The
                    553: .Sy sem_sysctl_info
                    554: structure is defined in
                    555: .In sys/sem.h .
                    556: .It Li KERN_SYSVIPC_SHM_INFO
                    557: Return information on the System V style shared memory facility.
                    558: The
                    559: .Sy shm_sysctl_info
                    560: structure is defined in
                    561: .In sys/shm.h .
                    562: .El
                    563: .It Li kern.ipc.shmmax ( KERN_SYSVIPC_SHMMAX )
                    564: Max shared memory segment size in bytes.
                    565: .It Li kern.ipc.shmmni ( KERN_SYSVIPC_SHMMNI )
                    566: Max number of shared memory identifiers.
                    567: .It Li kern.ipc.shmseg ( KERN_SYSVIPC_SHMSEG )
                    568: Max shared memory segments per process.
                    569: .It Li kern.ipc.shmmaxpgs ( KERN_SYSVIPC_SHMMAXPGS )
                    570: Max amount of shared memory in pages.
                    571: .It Li kern.ipc.shm_use_phys ( KERN_SYSVIPC_SHMUSEPHYS )
                    572: Locking of shared memory in physical memory.
                    573: If 0, memory can be swapped
                    574: out, otherwise it will be locked in physical memory.
                    575: .It Li kern.ipc.msgmni
                    576: Max number of message queue identifiers.
                    577: .It Li kern.ipc.msgseg
                    578: Max number of number of message segments.
                    579: .It Li kern.ipc.semmni
                    580: Max number of number of semaphore identifiers.
                    581: .It Li kern.ipc.semmns
                    582: Max number of number of semaphores in system.
                    583: .It Li kern.ipc.semmnu
                    584: Max number of undo structures in system.
                    585: .El
1.1       pavel     586: .It Li kern.job_control ( KERN_JOB_CONTROL )
                    587: Return 1 if job control is available on this system, otherwise 0.
                    588: .It Li kern.labeloffset ( KERN_LABELOFFSET )
                    589: The offset within the sector specified by KERN_LABELSECTOR of the
                    590: .Xr disklabel 5 .
                    591: .It Li kern.labelsector ( KERN_LABELSECTOR )
                    592: The sector number containing the
                    593: .Xr disklabel 5 .
                    594: .It Li kern.login_name_max ( KERN_LOGIN_NAME_MAX )
                    595: The size of the storage required for a login name, in bytes,
                    596: including the terminating NUL.
                    597: .It Li kern.logsigexit ( KERN_LOGSIGEXIT )
                    598: If this flag is non-zero, the kernel will
                    599: .Xr log 9
                    600: all process exits due to signals which create a
                    601: .Xr core 5
                    602: file, and whether the coredump was created.
                    603: .It Li kern.mapped_files ( KERN_MAPPED_FILES )
                    604: Returns 1 if the POSIX 1003.1b Memory Mapped Files Option is available
                    605: on this system,
                    606: otherwise 0.
                    607: .It Li kern.maxfiles ( KERN_MAXFILES )
                    608: The maximum number of open files that may be open in the system.
                    609: .It Li kern.maxpartitions ( KERN_MAXPARTITIONS )
                    610: The maximum number of partitions allowed per disk.
                    611: .It Li kern.maxphys ( KERN_MAXPHYS )
                    612: Maximum raw I/O transfer size.
                    613: .It Li kern.maxproc ( KERN_MAXPROC )
                    614: The maximum number of simultaneous processes the system will allow.
                    615: .It Li kern.maxptys ( KERN_MAXPTYS )
                    616: The maximum number of pseudo terminals.
                    617: This value can be both raised and lowered, though it cannot
                    618: be set lower than number of currently used ptys.
                    619: See also
                    620: .Xr pty 4 .
                    621: .It Li kern.maxvnodes ( KERN_MAXVNODES )
                    622: The maximum number of vnodes available on the system.
                    623: This can only be raised.
                    624: .It Li kern.mbuf ( KERN_MBUF )
                    625: Return information about the mbuf control variables.
                    626: Mbufs are data structures which store network packets and other data
                    627: structures in the networking code, see
                    628: .Xr mbuf 9 .
                    629: The third level names for the mbuf variables are detailed below.
                    630: The changeable column shows whether a process with appropriate
                    631: privilege may change the value.
1.21      joerg     632: .Bl -column "kern.mbuf.nmbclusters" "integer" "Changeable" -offset indent
1.1       pavel     633: .It Sy Third level name        Type    Changeable
                    634: .\" XXX Changeable? really?
                    635: .It kern.mbuf.mblowat  integer yes
                    636: .It kern.mbuf.mclbytes integer yes
                    637: .It kern.mbuf.mcllowat integer yes
                    638: .It kern.mbuf.msize    integer yes
                    639: .It kern.mbuf.nmbclusters      integer yes
                    640: .El
                    641: .Pp
                    642: The variables are as follows:
                    643: .Bl -tag -width "123456"
                    644: .It Li kern.mbuf.mblowat ( MBUF_MBLOWAT )
                    645: The mbuf low water mark.
                    646: .It Li kern.mbuf.mclbytes ( MBUF_MCLBYTES )
                    647: The mbuf cluster size.
                    648: .It Li kern.mbuf.mcllowat ( MBUF_MCLLOWAT )
                    649: The mbuf cluster low water mark.
                    650: .It Li kern.mbuf.msize ( MBUF_MSIZE )
                    651: The mbuf base size.
                    652: .It Li kern.mbuf.nmbclusters ( MBUF_NMBCLUSTERS )
                    653: The limit on the number of mbuf clusters.
                    654: The variable can only be increased, and only increased on machines with
                    655: direct-mapped pool pages.
                    656: .El
                    657: .It Li kern.memlock ( KERN_MEMLOCK )
                    658: Returns 1 if the POSIX 1003.1b Process Memory Locking Option is available
                    659: on this system,
                    660: otherwise 0.
                    661: .It Li kern.memlock_range ( KERN_MEMLOCK_RANGE )
                    662: Returns 1 if the POSIX 1003.1b Range Memory Locking Option is available
                    663: on this system,
                    664: otherwise 0.
                    665: .It Li kern.memory_protection ( KERN_MEMORY_PROTECTION )
                    666: Returns 1 if the POSIX 1003.1b Memory Protection Option is available
                    667: on this system,
                    668: otherwise 0.
1.42      jruoho    669: .It Li kern.module
                    670: Settings related to kernel modules.
                    671: The third level names for the settings are described below.
                    672: .Bl -column "kern.module.autoload" "integer" "Changeable" -offset indent
                    673: .It Sy Third level name        Type    Changeable
                    674: .It kern.module.autoload       integer yes
                    675: .It kern.module.verbose        integer yes
                    676: .El
                    677: .Pp
                    678: The variables are as follows:
                    679: .Bl -tag -width "123456"
                    680: .It Li kern.module.autoload
                    681: A boolean that controls whether kernel modules are loaded automatically.
                    682: See for example
                    683: .Xr modstat 8
                    684: for additional details.
                    685: .It Li kern.module.verbose
                    686: A boolean that enables or disables verbose
                    687: debug messages related to kernel modules.
                    688: .El
1.1       pavel     689: .It Li kern.monotonic_clock ( KERN_MONOTONIC_CLOCK )
                    690: Returns the standard version the implementation of the POSIX 1003.1b
                    691: Monotonic Clock Option conforms to,
                    692: otherwise 0.
                    693: .It Li kern.msgbuf ( KERN_MSGBUF )
                    694: The kernel message buffer, rotated so that the head of the circular kernel
                    695: message buffer is at the start of the returned data.
                    696: The returned data may contain NUL bytes.
                    697: .It Li kern.msgbufsize ( KERN_MSGBUFSIZE )
                    698: The maximum number of characters that the kernel message buffer can hold.
                    699: .It Li kern.ngroups ( KERN_NGROUPS )
                    700: The maximum number of supplemental groups.
1.41      jruoho    701: .\" .It Li kern.no_sa_support
                    702: .\" XXX: Undocumented.
1.1       pavel     703: .It Li kern.ntptime ( KERN_NTPTIME )
                    704: A
                    705: .Va struct ntptimeval
                    706: structure is returned.
                    707: This structure contains data used by the
                    708: .Xr ntpd 8
                    709: program.
                    710: .It Li kern.osrelease ( KERN_OSRELEASE )
                    711: The system release string.
                    712: .It Li kern.osrevision ( KERN_OSREV )
                    713: The system revision string.
                    714: .It Li kern.ostype ( KERN_OSTYPE )
                    715: The system type string.
1.41      jruoho    716: .\".It Li kern.panic_now
                    717: .\" XXX: Undocumented.
1.1       pavel     718: .It Li kern.pipe ( KERN_PIPE )
                    719: Pipe settings.
                    720: The third level names for the  integer pipe settings is detailed below.
                    721: The changeable column shows whether a process with appropriate
                    722: privilege may change the value.
1.21      joerg     723: .Bl -column "kern.pipe.maxbigpipes" "integer" "Changeable" -offset indent
1.1       pavel     724: .It Sy Third level name        Type    Changeable
                    725: .It kern.pipe.kvasiz   integer yes
                    726: .It kern.pipe.maxbigpipes      integer yes
                    727: .It kern.pipe.maxkvasz integer yes
                    728: .It kern.pipe.limitkva integer yes
                    729: .It kern.pipe.nbigpipes        integer yes
                    730: .El
                    731: .Pp
                    732: The variables are as follows:
                    733: .Bl -tag -width "123456"
                    734: .It Li kern.pipe.kvasiz ( KERN_PIPE_KVASIZ )
                    735: Amount of kernel memory consumed by pipe buffers.
                    736: .It Li kern.pipe.maxbigpipes ( KERN_PIPE_MAXBIGPIPES )
                    737: Maximum number of "big" pipes.
                    738: .It Li kern.pipe.maxkvasz ( KERN_PIPE_MAXKVASZ )
                    739: Maximum amount of kernel memory to be used for pipes.
                    740: .It Li kern.pipe.limitkva ( KERN_PIPE_LIMITKVA )
                    741: Limit for direct transfers via page loan.
                    742: .It Li kern.pipe.nbigpipes ( KERN_PIPE_NBIGPIPES )
                    743: Number of "big" pipes.
                    744: .El
1.39      jruoho    745: .\" XXX: Undocumented .It Li kern.posix ( ? )
                    746: .\"     This is a node in which the only variable is semmax.
1.1       pavel     747: .It Li kern.posix1version ( KERN_POSIX1 )
                    748: The version of ISO/IEC 9945 (POSIX 1003.1) with which the system
                    749: attempts to comply.
                    750: .It Li kern.posix_barriers ( KERN_POSIX_BARRIERS )
                    751: The version of
                    752: .St -p1003.1
                    753: and its
                    754: Barriers
                    755: option to which the system attempts to conform,
                    756: otherwise 0.
                    757: .It Li kern.posix_reader_writer_locks ( KERN_POSIX_READER_WRITER_LOCKS )
                    758: The version of
                    759: .St -p1003.1
                    760: and its
                    761: Read-Write Locks
                    762: option to which the system attempts to conform,
                    763: otherwise 0.
1.41      jruoho    764: .\".It Li kern.posix_sched
                    765: .\" XXX: Undocumented.
1.1       pavel     766: .It Li kern.posix_semaphores ( KERN_POSIX_SEMAPHORES )
                    767: The version of
                    768: .St -p1003.1
                    769: and its
                    770: Semaphores
                    771: option to which the system attempts to conform,
                    772: otherwise 0.
                    773: .It Li kern.posix_spin_locks ( KERN_POSIX_SPIN_LOCKS )
                    774: The version of
                    775: .St -p1003.1
                    776: and its
                    777: Spin Locks
                    778: option to which the system attempts to conform,
                    779: otherwise 0.
                    780: .It Li kern.posix_threads ( KERN_POSIX_THREADS )
                    781: The version of
                    782: .St -p1003.1
                    783: and its
                    784: Threads
                    785: option to which the system attempts to conform,
                    786: otherwise 0.
                    787: .It Li kern.posix_timers ( KERN_POSIX_TIMERS )
                    788: The version of
                    789: .St -p1003.1
                    790: and its
                    791: Timers
                    792: option to which the system attempts to conform,
                    793: otherwise 0.
                    794: .It Li kern.proc ( KERN_PROC )
                    795: Return the entire process table, or a subset of it.
                    796: An array of
                    797: .Va struct kinfo_proc
                    798: structures is returned,
                    799: whose size depends on the current number of such objects in the system.
                    800: The third and fourth level numeric names are as follows:
1.21      joerg     801: .Bl -column "KERN_PROC_SESSION" "Fourth level is:" -offset indent
1.1       pavel     802: .It Sy Third level name        Fourth level is:
1.21      joerg     803: .It KERN_PROC_ALL      None
                    804: .It KERN_PROC_GID      A group ID
                    805: .It KERN_PROC_PID      A process ID
                    806: .It KERN_PROC_PGRP     A process group
                    807: .It KERN_PROC_RGID     A real group ID
                    808: .It KERN_PROC_RUID     A real user ID
                    809: .It KERN_PROC_SESSION  A session ID
                    810: .It KERN_PROC_TTY      A tty device
                    811: .It KERN_PROC_UID      A user ID
1.1       pavel     812: .El
                    813: .It Li kern.proc2 ( KERN_PROC2 )
                    814: As for KERN_PROC, but an array of
                    815: .Va struct kinfo_proc2
                    816: structures are returned.
                    817: The fifth level name is the size of the
                    818: .Va struct kinfo_proc2
                    819: and the sixth level name is the number of structures to return.
                    820: .It Li kern.proc_args ( KERN_PROC_ARGS )
                    821: Return the argv or environment strings (or the number thereof)
                    822: of a process.
                    823: Multiple strings are returned separated by NUL characters.
                    824: The third level name is the process ID.
                    825: The fourth level name is as follows:
1.21      joerg     826: .Bl -column "KERN_PROG_NARGV" "The number of environ strings" -offset indent
                    827: .It KERN_PROC_ARGV     The argv strings
                    828: .It KERN_PROC_ENV      The environ strings
                    829: .It KERN_PROC_NARGV    The number of argv strings
                    830: .It KERN_PROC_NENV     The number of environ strings
1.1       pavel     831: .El
                    832: .It Li kern.profiling ( KERN_PROF )
                    833: Return profiling information about the kernel.
                    834: If the kernel is not compiled for profiling,
                    835: attempts to retrieve any of the KERN_PROF values will
                    836: fail with
                    837: .Er EOPNOTSUPP .
                    838: The third level names for the string and integer profiling information
                    839: is detailed below.
                    840: The changeable column shows whether a process with appropriate
                    841: privilege may change the value.
1.21      joerg     842: .Bl -column "kern.profiling.gmonparam" "struct gmonparam" "Changeable" -offset indent
1.1       pavel     843: .It Sy Third level name        Type    Changeable
                    844: .It kern.profiling.count       u_short[\|]     yes
                    845: .It kern.profiling.froms       u_short[\|]     yes
                    846: .It kern.profiling.gmonparam   struct gmonparam        no
                    847: .It kern.profiling.state       integer yes
                    848: .It kern.profiling.tos struct tostruct yes
                    849: .El
                    850: .Pp
                    851: The variables are as follows:
                    852: .Bl -tag -width "123456"
                    853: .It Li kern.profiling.count ( GPROF_COUNT )
                    854: Array of statistical program counter counts.
                    855: .It Li kern.profiling.froms ( GPROF_FROMS )
                    856: Array indexed by program counter of call-from points.
                    857: .It Li kern.profiling.gmonparams ( GPROF_GMONPARAM )
                    858: Structure giving the sizes of the above arrays.
                    859: .It Li kern.profiling.state ( GPROF_STATE )
                    860: Profiling state.
                    861: If set to GMON_PROF_ON, starts profiling.
                    862: If set to GMON_PROF_OFF, stops profiling.
                    863: .It Li kern.profiling.tos ( GPROF_TOS )
                    864: Array of
                    865: .Va struct tostruct
                    866: describing destination of calls and their counts.
                    867: .El
1.41      jruoho    868: .\" .It Li kern.pset
                    869: .\" XXX: Undocumented.
1.1       pavel     870: .It Li kern.rawpartition ( KERN_RAWPARTITION )
                    871: The raw partition of a disk (a == 0).
                    872: .It Li kern.root_device ( KERN_ROOT_DEVICE )
                    873: The name of the root device (e.g.,
                    874: .Dq wd0 ) .
                    875: .It Li kern.root_partition ( KERN_ROOT_PARTITION )
                    876: The root partition on the root device (a == 0).
                    877: .It Li kern.rtc_offset ( KERN_RTC_OFFSET )
                    878: Return the offset of real time clock from UTC in minutes.
                    879: .It Li kern.saved_ids ( KERN_SAVED_IDS )
                    880: Returns 1 if saved set-group and saved set-user ID is available.
                    881: .It Li kern.sbmax ( KERN_SBMAX )
                    882: Maximum socket buffer size.
                    883: .\" XXX units?
                    884: .It Li kern.securelevel ( KERN_SECURELVL )
1.25      elad      885: See
                    886: .Xr secmodel_securelevel 9 .
1.41      jruoho    887: .\" .It Li kern.sched
                    888: .\" XXX: Undocumented.
1.1       pavel     889: .It Li kern.somaxkva ( KERN_SOMAXKVA )
                    890: Maximum amount of kernel memory to be used for socket buffers.
                    891: .\" XXX units?
                    892: .It Li kern.synchronized_io ( KERN_SYNCHRONIZED_IO )
                    893: Returns 1 if the POSIX 1003.1b Synchronized I/O Option is available
                    894: on this system,
                    895: otherwise 0.
1.19      christos  896: .It Li kern.timecounter ( dynamic )
                    897: Display and control the timecounter source of the system.
1.21      joerg     898: .Bl -column "kern.timecounter.timestepwarnings" "integer" "Changeable" -offset indent
1.19      christos  899: .It Sy Third level name        Type    Changeable
                    900: .It kern.timecounter.choice    string  no
                    901: .It kern.timecounter.hardware  string  yes
                    902: .It kern.timecounter.timestepwarnings  integer yes
                    903: .El
                    904: .Pp
                    905: The variables are as follows:
                    906: .Bl -tag -width "123456"
                    907: .It Li kern.timecounter.choice ( dynamic )
                    908: The list of available timecounters with their quality and frequency.
                    909: .It Li kern.timecounter.hardware ( dynamic )
                    910: The currently selected timecounter source.
                    911: .It Li kern.timecounter.timestepwarnings ( dynamic )
                    912: If non-zero display a message each time the time is stepped.
                    913: .El
1.1       pavel     914: .It Li kern.timex ( KERN_TIMEX )
                    915: Not available.
                    916: .It Li kern.tkstat ( KERN_TKSTAT )
                    917: Return information about the number of characters sent and received
                    918: on ttys.
                    919: The third level names for the tty statistic variables are detailed below.
                    920: The changeable column shows whether a process
                    921: with appropriate privilege may change the value.
1.21      joerg     922: .Bl -column "kern.tkstat.cancc" "quad" "Changeable" -offset indent
1.1       pavel     923: .It Sy Third level name        Type    Changeable
                    924: .It kern.tkstat.cancc  quad    no
                    925: .It kern.tkstat.nin    quad    no
                    926: .It kern.tkstat.nout   quad    no
                    927: .It kern.tkstat.rawcc  quad    no
                    928: .El
                    929: .Pp
                    930: The variables are as follows:
                    931: .Bl -tag -width "123456"
                    932: .It Li kern.tkstat.cancc ( KERN_TKSTAT_CANCC )
                    933: The number of canonical input characters.
                    934: .It Li kern.tkstat.nin ( KERN_TKSTAT_NIN )
                    935: The total number of input characters.
                    936: .It Li kern.tkstat.nout ( KERN_TKSTAT_NOUT )
                    937: The total number of output characters.
                    938: .It Li kern.tkstat.rawcc ( KERN_TKSTAT_RAWCC )
                    939: The number of raw input characters.
                    940: .El
                    941: .It Li kern.urandom ( KERN_URND )
                    942: Random integer value.
1.41      jruoho    943: .\".It Li kern.usercrypto
                    944: .\" XXX: Undocumented.
                    945: .\".It Li kern.userasymcrypto
                    946: .\" XXX: Undocumented.
1.1       pavel     947: .It Li kern.veriexec
1.40      jruoho    948: Runtime information for
                    949: .Xr veriexec 8 .
                    950: .Bl -column "kern.veriexec.algorithms" "integer" "Changeable" -offset indent
                    951: .It Sy Third level name        Type    Changeable
                    952: .It kern.veriexec.algorithms   string  no
                    953: .It kern.veriexec.count        node    not applicable
                    954: .It kern.veriexec.strict       integer yes
                    955: .It kern.veriexec.verbose      integer yes
                    956: .El
1.1       pavel     957: .Bl -tag -width "123456"
                    958: .It Li kern.veriexec.algorithms
                    959: Returns a string with the supported algorithms in Veriexec.
                    960: .It Li kern.veriexec.count
                    961: Sub-nodes are added to this node as new mounts are monitored by Veriexec.
                    962: Each mount will be under its own
                    963: .No tableN
                    964: node.
                    965: Under each node there will be three variables, indicating the mount
                    966: point, the file-system type, and the number of entries.
                    967: .It Li kern.veriexec.strict
                    968: Controls the strict level of Veriexec.
                    969: See
                    970: .Xr security 8
                    971: for more information on each level's implications.
                    972: .It Li kern.veriexec.verbose
                    973: Controls the verbosity level of Veriexec.
                    974: If 0, only the minimal
                    975: indication required will be given about what's happening - fingerprint
                    976: mismatches, removal of entries from the tables, modification of a
                    977: fingerprinted file.
                    978: If 1, more messages will be printed (ie., when a file with a valid
                    979: fingerprint is accessed).
                    980: Verbose level 2 is debug mode.
                    981: .El
                    982: .It Li kern.version ( KERN_VERSION )
                    983: The system version string.
                    984: .It Li kern.vnode ( KERN_VNODE )
                    985: Return the entire vnode table.
                    986: Note, the vnode table is not necessarily a consistent snapshot of
                    987: the system.
                    988: The returned data consists of an array whose size depends on the
                    989: current number of such objects in the system.
                    990: Each element of the array contains the kernel address of a vnode
                    991: .Va struct vnode *
                    992: followed by the vnode itself
                    993: .Va struct vnode .
1.43    ! jruoho    994: .\" XXX: Undocumented: kern.lwp: no children?
1.1       pavel     995: .El
                    996: .Sh The machdep.* subtree
                    997: The set of variables defined is architecture dependent.
                    998: Most architectures define at least the following variables.
1.43    ! jruoho    999: .Bl -column "machdep.booted_kernel" "Type" "Changeable" -offset indent
1.1       pavel    1000: .It Sy Second level name       Type    Changeable
1.43    ! jruoho   1001: .It Li machdep.booted_kernel   string  no
1.1       pavel    1002: .El
1.43    ! jruoho   1003: .\" XXX: Document the above.
1.1       pavel    1004: .Sh The net.* subtree
                   1005: The string and integer information available for the
                   1006: .Li net
                   1007: level is detailed below.
                   1008: The changeable column shows whether a process with appropriate
                   1009: privilege may change the value.
                   1010: The second and third levels are typically the protocol family and
                   1011: protocol number, though this is not always the case.
1.21      joerg    1012: .Bl -column "Second level name" "IPsec key management values" "Changeable" -offset indent
1.1       pavel    1013: .It Sy Second level name       Type    Changeable
                   1014: .It net.route  routing messages        no
                   1015: .It net.inet   IPv4 values     yes
                   1016: .It net.inet6  IPv6 values     yes
                   1017: .It net.key    IPsec key management values     yes
                   1018: .El
                   1019: .Pp
                   1020: .Bl -tag -width "123456"
                   1021: .It Li net.route ( PF_ROUTE )
                   1022: .\" XXX really?
                   1023: Return the entire routing table or a subset of it.
                   1024: The data is returned as a sequence of routing messages (see
                   1025: .Xr route 4
                   1026: for the header file, format and meaning).
                   1027: The length of each message is contained in the message header.
                   1028: .Pp
                   1029: The third level name is a protocol number, which is currently always 0.
                   1030: The fourth level name is an address family, which may be set to 0 to
                   1031: select all address families.
                   1032: The fifth and sixth level names are as follows:
1.21      joerg    1033: .Bl -column "Fifth level name" "Sixth level is:" -offset indent
1.1       pavel    1034: .It Sy Fifth level name        Sixth level is:
1.21      joerg    1035: .It NET_RT_FLAGS       rtflags
                   1036: .It NET_RT_DUMP        None
                   1037: .It NET_RT_IFLIST      None
1.1       pavel    1038: .El
                   1039: .It Li net.inet ( PF_INET )
                   1040: Get or set various global information about the IPv4
                   1041: .Pq Internet Protocol version 4 .
                   1042: The third level name is the protocol.
                   1043: The fourth level name is the variable name.
                   1044: The currently defined protocols and names are:
1.21      joerg    1045: .Bl -column "Protocol name" "sack.globalmaxholes" "integer" "Changeable" -offset 4n
1.1       pavel    1046: .It Sy Protocol name   Variable name   Type    Changeable
                   1047: .It arp        down    integer yes
                   1048: .It arp        keep    integer yes
                   1049: .It arp        prune   integer yes
                   1050: .It arp        refresh integer yes
                   1051: .It carp       allow   integer yes
                   1052: .It carp       preempt integer yes
                   1053: .It carp       log     integer yes
                   1054: .It carp       arpbalance      integer yes
                   1055: .It icmp       errppslimit     integer yes
                   1056: .It icmp       maskrepl        integer yes
                   1057: .It icmp       rediraccept     integer yes
                   1058: .It icmp       redirtimeout    integer yes
1.28      christos 1059: .It icmp       bmcastecho      integer yes
1.1       pavel    1060: .It ip allowsrcrt      integer yes
                   1061: .It ip anonportmax     integer yes
                   1062: .It ip anonportmin     integer yes
                   1063: .It ip checkinterface  integer yes
                   1064: .It ip directed-broadcast      integer yes
                   1065: .It ip do_loopback_cksum       integer yes
                   1066: .It ip forwarding      integer yes
                   1067: .It ip forwsrcrt       integer yes
                   1068: .It ip gifttl  integer yes
                   1069: .It ip grettl  integer yes
1.8       liamjfoy 1070: .It ip hashsize        integer yes
1.1       pavel    1071: .It ip hostzerobroadcast       integer yes
                   1072: .It ip lowportmin      integer yes
                   1073: .It ip lowportmax      integer yes
                   1074: .It ip maxflows        integer yes
                   1075: .It ip maxfragpackets  integer yes
                   1076: .It ip mtudisc integer yes
                   1077: .It ip mtudisctimeout  integer yes
                   1078: .It ip random_id       integer yes
                   1079: .It ip redirect        integer yes
                   1080: .It ip subnetsarelocal integer yes
                   1081: .It ip ttl     integer yes
                   1082: .It tcp        rfc1323 integer yes
                   1083: .It tcp        sendspace       integer yes
                   1084: .It tcp        recvspace       integer yes
                   1085: .It tcp        mssdflt integer yes
                   1086: .It tcp        syn_cache_limit integer yes
                   1087: .It tcp        syn_bucket_limit        integer yes
                   1088: .It tcp        syn_cache_interval      integer yes
                   1089: .It tcp        init_win        integer yes
                   1090: .It tcp        init_win_local  integer yes
                   1091: .It tcp        mss_ifmtu       integer yes
                   1092: .It tcp        win_scale       integer yes
                   1093: .It tcp        timestamps      integer yes
                   1094: .It tcp        compat_42       integer yes
                   1095: .It tcp        cwm     integer yes
                   1096: .It tcp        cwm_burstsize   integer yes
                   1097: .It tcp        ack_on_push     integer yes
                   1098: .It tcp        keepidle        integer yes
                   1099: .It tcp        keepintvl       integer yes
                   1100: .It tcp        keepcnt integer yes
                   1101: .It tcp        slowhz  integer no
1.12      christos 1102: .It tcp        keepinit        integer yes
1.1       pavel    1103: .It tcp        log_refused     integer yes
                   1104: .It tcp        rstppslimit     integer yes
                   1105: .It tcp        ident   struct  no
1.13      christos 1106: .It tcp        drop    struct  no
1.1       pavel    1107: .It tcp        sack.enable     integer yes
                   1108: .It tcp        sack.globalholes        integer no
                   1109: .It tcp        sack.globalmaxholes     integer yes
                   1110: .It tcp        sack.maxholes   integer yes
                   1111: .It tcp        ecn.enable      integer yes
                   1112: .It tcp        ecn.maxretries  integer yes
                   1113: .It tcp        congctl.selected        string  yes
                   1114: .It tcp        congctl.available       string  yes
                   1115: .It tcp        abc.enable      integer yes
                   1116: .It tcp        abc.aggressive  integer yes
                   1117: .It udp        checksum        integer yes
                   1118: .It udp        do_loopback_cksum       integer yes
                   1119: .It udp        recvspace       integer yes
                   1120: .It udp        sendspace       integer yes
                   1121: .El
                   1122: .Pp
                   1123: The variables are as follows:
                   1124: .Bl -tag -width "123456"
                   1125: .It Li arp.down
                   1126: Failed ARP entry lifetime.
                   1127: .It Li arp.keep
                   1128: Valid ARP entry lifetime.
                   1129: .It Li arp.prune
                   1130: ARP cache pruning interval.
                   1131: .It Li arp.refresh
                   1132: ARP entry refresh interval.
                   1133: .It Li carp.allow
                   1134: If set to 0, incoming
                   1135: .Xr carp 4
                   1136: packets will not be processed.
                   1137: If set to any other value, processing will occur.
                   1138: Enabled by default.
                   1139: .It Li carp.arpbalance
                   1140: If set to any value other than 0, the ARP balancing functionality of
                   1141: .Xr carp 4
                   1142: is enabled.
                   1143: When ARP requests are received for an IP address which is part of any virtual
                   1144: host, carp will hash the source IP in the ARP request to select one of the
                   1145: virtual hosts from the set of all the virtual hosts which have that IP address.
                   1146: The master of that host will respond with the correct virtual MAC address.
                   1147: Disabled by default.
                   1148: .It Li carp.log
                   1149: If set to any value other than 0,
                   1150: .Xr carp 4
                   1151: will log errors.
                   1152: Disabled by default.
                   1153: .It Li carp.preempt
                   1154: If set to 0,
                   1155: .Xr carp 4
                   1156: will not attempt to become master if it is receiving advertisements from
                   1157: another active master.
                   1158: If set to any other value, carp will become master of the virtual host if it
                   1159: believes it can send advertisements more frequently than the current master.
                   1160: Disabled by default.
                   1161: .It Li ip.allowsrcrt
                   1162: If set to 1, the host accepts source routed packets.
                   1163: .It Li ip.anonportmax
                   1164: The highest port number to use for TCP and UDP ephemeral port allocation.
                   1165: This cannot be set to less than 1024 or greater than 65535, and must
                   1166: be greater than
                   1167: .Li ip.anonportmin .
                   1168: .It Li ip.anonportmin
                   1169: The lowest port number to use for TCP and UDP ephemeral port allocation.
                   1170: This cannot be set to less than 1024 or greater than 65535.
                   1171: .It Li ip.checkinterface
                   1172: If set to non-zero, the host will reject packets addressed to it
                   1173: that arrive on an interface not bound to that address.
                   1174: Currently, this must be disabled if ipnat is used to translate the
                   1175: destination address to another local interface, or if addresses
                   1176: are added to the loopback interface instead of the interface where
                   1177: the packets for those packets are received.
                   1178: .It Li ip.directed-broadcast
                   1179: If set to 1, enables directed broadcast behavior for the host.
                   1180: .It Li ip.do_loopback_cksum
                   1181: Perform IP checksum on loopback.
                   1182: .It Li ip.forwarding
                   1183: If set to 1, enables IP forwarding for the host,
                   1184: meaning that the host is acting as a router.
                   1185: .It Li ip.forwsrcrt
                   1186: If set to 1, enables forwarding of source-routed packets for the host.
                   1187: This value may only be changed if the kernel security level is less than 1.
                   1188: .It Li ip.gifttl
                   1189: The maximum time-to-live (hop count) value for an IPv4 packet generated by
                   1190: .Xr gif 4
                   1191: tunnel interface.
                   1192: .It Li ip.grettl
                   1193: The maximum time-to-live (hop count) value for an IPv4 packet generated by
                   1194: .Xr gre 4
                   1195: tunnel interface.
1.8       liamjfoy 1196: .It Li ip.hashsize
                   1197: The size of IPv4 Fast Forward hash table.
                   1198: This value must be a power of 2 (64, 256...).
                   1199: A larger hash table size results in fewer collisions.
                   1200: Also see
                   1201: .Li ip.maxflows .
1.1       pavel    1202: .It Li ip.hostzerobroadcast
                   1203: All zeroes address is broadcast address.
                   1204: .It Li ip.lowportmax
                   1205: The highest port number to use for TCP and UDP reserved port allocation.
                   1206: This cannot be set to less than 0 or greater than 1024, and must
                   1207: be greater than
                   1208: .Li ip.lowportmin .
                   1209: .It Li ip.lowportmin
                   1210: The lowest port number to use for TCP and UDP reserved port allocation.
                   1211: This cannot be set to less than 0 or greater than 1024, and must
                   1212: be smaller than
                   1213: .Li ip.lowportmax .
                   1214: .It Li ip.maxflows
1.5       liamjfoy 1215: IPv4 Fast Forwarding is enabled by default.
                   1216: If set to 0, IPv4 Fast Forwarding is disabled.
1.1       pavel    1217: .Li ip.maxflows
                   1218: controls the maximum amount of flows which can be created.
                   1219: The default value is 256.
                   1220: .It Li ip.maxfragpackets
                   1221: The maximum number of fragmented packets the node will accept.
                   1222: 0 means that the node will not accept any fragmented packets.
                   1223: \-1 means that the node will accept as many fragmented packets as it receives.
                   1224: The flag is provided basically for avoiding possible DoS attacks.
                   1225: .It Li ip.mtudisc
                   1226: If set to 1, enables Path MTU Discovery (RFC 1191).
                   1227: When Path MTU Discovery is enabled, the transmitted TCP segment
                   1228: size will be determined by the advertised maximum segment size
                   1229: (MSS) from the remote end, as constrained by the path MTU.
                   1230: If MTU Discovery is disabled, the transmitted segment size will
                   1231: never be greater than
                   1232: .Li tcp.mssdflt
                   1233: (the local maximum segment size).
                   1234: .It Li ip.mtudisctimeout
                   1235: The number of seconds in which a route added by the Path MTU
                   1236: Discovery engine will time out.
                   1237: When the route times out, the Path
                   1238: MTU Discovery engine will attempt to probe a larger path MTU.
                   1239: .It Li ip.random_id
                   1240: Assign random ip_id values.
                   1241: .It Li ip.redirect
                   1242: If set to 1, ICMP redirects may be sent by the host.
                   1243: This option is ignored unless the host is routing IP packets,
                   1244: and should normally be enabled on all systems.
                   1245: .It Li ip.subnetsarelocal
                   1246: If set to 1, subnets are to be considered local addresses.
                   1247: .It Li ip.ttl
                   1248: The maximum time-to-live (hop count) value for an IP packet sourced by
                   1249: the system.
                   1250: This value applies to normal transport protocols, not to ICMP.
                   1251: .It Li icmp.errppslimit
                   1252: The variable specifies the maximum number of outgoing ICMP error messages,
                   1253: per second.
                   1254: ICMP error messages that exceeded the value are subject to rate limitation
                   1255: and will not go out from the node.
                   1256: Negative value disables rate limitation.
                   1257: .It Li icmp.maskrepl
                   1258: If set to 1, ICMP network mask requests are to be answered.
                   1259: .It Li icmp.rediraccept
                   1260: If set to non-zero, the host will accept ICMP redirect packets.
                   1261: Note that routers will never accept ICMP redirect packets,
                   1262: and the variable is meaningful on IP hosts only.
                   1263: .It Li icmp.redirtimeout
                   1264: The variable specifies lifetime of routing entries generated by incoming
                   1265: ICMP redirect.
                   1266: This defaults to 600 seconds.
                   1267: .It Li icmp.returndatabytes
                   1268: Number of bytes to return in an ICMP error message.
1.28      christos 1269: .It Li icmp.bmcastecho
                   1270: If set to 1, enables responding to ICMP echo or timestamp request to the
                   1271: broadcast address.
1.1       pavel    1272: .It Li tcp.ack_on_push
                   1273: If set to 1, TCP is to immediately transmit an ACK upon reception of
                   1274: a packet with PUSH set.
                   1275: This can avoid losing a round trip time in some rare situations,
                   1276: but has the caveat of potentially defeating TCP's delayed ACK algorithm.
                   1277: Use of this option is generally not recommended, but
                   1278: the variable exists in case your configuration really needs it.
                   1279: .It Li tcp.compat_42
                   1280: If set to 1, enables work-arounds for bugs in the 4.2BSD TCP implementation.
                   1281: Use of this option is not recommended, although it may be
                   1282: required in order to communicate with extremely old TCP implementations.
                   1283: .It Li tcp.cwm
                   1284: If set to 1, enables use of the Hughes/Touch/Heidemann Congestion Window
                   1285: Monitoring algorithm.
                   1286: This algorithm prevents line-rate bursts of packets that could
                   1287: otherwise occur when data begins flowing on an idle TCP connection.
                   1288: These line-rate bursts can contribute to network and router congestion.
                   1289: This can be particularly useful on World Wide Web servers
                   1290: which support HTTP/1.1, which has lingering connections.
                   1291: .It Li tcp.cwm_burstsize
                   1292: The Congestion Window Monitoring allowed burst size, in terms
                   1293: of packet count.
                   1294: .It Li tcp.delack_ticks
                   1295: Number of ticks to delay sending an ACK.
                   1296: .It Li tcp.do_loopback_cksum
                   1297: Perform TCP checksum on loopback.
                   1298: .It Li tcp.init_win
                   1299: A value indicating the TCP initial congestion window.
                   1300: If this value is 0, an auto-tuning algorithm designed to use an initial
                   1301: window of approximately 4K bytes is in use.
                   1302: Otherwise, this value indicates a fixed number of packets.
                   1303: .It Li tcp.init_win_local
                   1304: Like
                   1305: .Li tcp.init_win ,
                   1306: but used when communicating with hosts on a local network.
                   1307: .It Li tcp.keepcnt
                   1308: Number of keepalive probes sent before declaring a connection dead.
                   1309: If set to zero, there is no limit;
                   1310: keepalives will be sent until some kind of
                   1311: response is received from the peer.
                   1312: .It Li tcp.keepidle
                   1313: Time a connection must be idle before keepalives are sent (if keepalives
                   1314: are enabled for the connection).
                   1315: See also tcp.slowhz.
                   1316: .It Li tcp.keepintvl
                   1317: Time after a keepalive probe is sent until, in the absence of any response,
                   1318: another probe is sent.
                   1319: See also tcp.slowhz.
                   1320: .It Li tcp.log_refused
                   1321: If set to 1, refused TCP connections to the host will be logged.
1.12      christos 1322: .It Li tcp.keepinit
                   1323: Timeout in seconds during connection establishment.
1.1       pavel    1324: .It Li tcp.mss_ifmtu
                   1325: If set to 1, TCP calculates the outgoing maximum segment size based on
                   1326: the MTU of the appropriate interface.
                   1327: If set to 0, it is calculated based on the greater of the MTU of the
                   1328: interface, and the largest (non-loopback) interface MTU on the system.
                   1329: .It Li tcp.mssdflt
                   1330: The default maximum segment size both advertised to the peer
                   1331: and to use when either the peer does not advertise a maximum segment size to
                   1332: us during connection setup or Path MTU Discovery
                   1333: .Li ( ip.mtudisc )
                   1334: is disabled.
                   1335: Do not change this value unless you really know what you are doing.
                   1336: .It Li tcp.recvspace
                   1337: The default TCP receive buffer size.
                   1338: .It Li tcp.rfc1323
                   1339: If set to 1, enables RFC 1323 extensions to TCP.
                   1340: .It Li tcp.rstppslimit
                   1341: The variable specifies the maximum number of outgoing TCP RST packets,
                   1342: per second.
                   1343: TCP RST packet that exceeded the value are subject to rate limitation
                   1344: and will not go out from the node.
                   1345: Negative value disables rate limitation.
1.13      christos 1346: .It Li tcp.ident
                   1347: Return the user ID of a connected socket pair.
                   1348: (RFC1413 Identification Protocol lookups.)
                   1349: .It Li tcp.drop
                   1350: Drop a TCP socket pair connection.
1.1       pavel    1351: .It Li tcp.sack.enable
                   1352: If set to 1, enables RFC 2018 Selective ACKnowledgement.
                   1353: .It Li tcp.sack.globalholes
                   1354: Global number of TCP SACK holes.
                   1355: .It Li tcp.sack.globalmaxholes
                   1356: Global maximum number of TCP SACK holes.
                   1357: .It Li tcp.sack.maxholes
                   1358: Maximum number of TCP SACK holes allowed per connection.
                   1359: .It Li tcp.ecn.enable
                   1360: If set to 1, enables RFC 3168 Explicit Congestion Notification.
                   1361: .It Li tcp.ecn.maxretries
                   1362: Number of times to retry sending the ECN-setup packet.
                   1363: .It Li tcp.sendspace
                   1364: The default TCP send buffer size.
                   1365: .It Li tcp.slowhz
                   1366: The units for tcp.keepidle and tcp.keepintvl; those variables are in ticks
                   1367: of a clock that ticks tcp.slowhz times per second.
                   1368: (That is, their values
                   1369: must be divided by the tcp.slowhz value to get times in seconds.)
                   1370: .It Li tcp.syn_bucket_limit
                   1371: The maximum number of entries allowed per hash bucket in the TCP
                   1372: compressed state engine.
                   1373: .It Li tcp.syn_cache_limit
                   1374: The maximum number of entries allowed in the TCP compressed state
                   1375: engine.
                   1376: .It Li tcp.timestamps
                   1377: If rfc1323 is enabled, a value of 1 indicates RFC 1323 time stamp options,
                   1378: used for measuring TCP round trip times, are enabled.
                   1379: .It Li tcp.win_scale
                   1380: If rfc1323 is enabled, a value of 1 indicates RFC 1323 window scale options,
                   1381: for increasing the TCP window size, are enabled.
                   1382: .It Li tcp.congctl.available
                   1383: The available TCP congestion control algorithms.
                   1384: .It Li tcp.congctl.selected
                   1385: The currently selected TCP congestion control algorithm.
                   1386: .It Li tcp.abc.enable
                   1387: If set to 1, use RFC 3465 Appropriate Byte Counting (ABC).
                   1388: If set to 0, use traditional Packet Counting.
                   1389: .It Li tcp.abc.aggressive
                   1390: Choose the L parameter found in RFC 3465.
                   1391: L is the maximum cwnd increase for an ack during slow start.
                   1392: If set to 1, use L=2*SMSS.
                   1393: If set to 0, use L=1*SMSS.
                   1394: It has no effect unless tcp.abc.enable is set to 1.
                   1395: .It Li udp.checksum
                   1396: If set to 1, UDP checksums are being computed.
                   1397: Received non-zero UDP checksums are always checked.
                   1398: Disabling UDP checksums is strongly discouraged.
                   1399: .It Li udp.sendspace
                   1400: The default UDP send buffer size.
                   1401: .It Li udp.recvspace
                   1402: The default UDP receive buffer size.
                   1403: .El
                   1404: .Pp
                   1405: For variables net.*.ipsec, please refer to
                   1406: .Xr ipsec 4 .
                   1407: .It Li net.inet6 ( PF_INET6 )
                   1408: Get or set various global information about the IPv6
                   1409: .Pq Internet Protocol version 6 .
                   1410: The third level name is the protocol.
                   1411: The fourth level name is the variable name.
                   1412: The currently defined protocols and names are:
1.21      joerg    1413: .Bl -column "Protocol name" "do_loopback_cksum" "integer" "Changeable" -offset indent
1.1       pavel    1414: .It Sy Protocol name   Variable name   Type    Changeable
                   1415: .It icmp6      errppslimit     integer yes
                   1416: .It icmp6      mtudisc_hiwat   integer yes
                   1417: .It icmp6      mtudisc_lowat   integer yes
                   1418: .It icmp6      nd6_debug       integer yes
                   1419: .It icmp6      nd6_delay       integer yes
                   1420: .It icmp6      nd6_maxnudhint  integer yes
                   1421: .It icmp6      nd6_mmaxtries   integer yes
                   1422: .It icmp6      nd6_prune       integer yes
                   1423: .It icmp6      nd6_umaxtries   integer yes
                   1424: .It icmp6      nd6_useloopback integer yes
                   1425: .It icmp6      nodeinfo        integer yes
                   1426: .It icmp6      rediraccept     integer yes
                   1427: .It icmp6      redirtimeout    integer yes
                   1428: .It ip6        accept_rtadv    integer yes
                   1429: .It ip6        anonportmax     integer yes
                   1430: .It ip6        anonportmin     integer yes
                   1431: .It ip6        auto_flowlabel  integer yes
                   1432: .It ip6        dad_count       integer yes
                   1433: .It ip6        defmcasthlim    integer yes
                   1434: .It ip6        forwarding      integer yes
                   1435: .It ip6        gifhlim integer yes
1.7       liamjfoy 1436: .It ip6        hashsize        integer yes
1.1       pavel    1437: .It ip6        hlim    integer yes
                   1438: .It ip6        hdrnestlimit    integer yes
                   1439: .It ip6        kame_version    string  no
                   1440: .It ip6        keepfaith       integer yes
                   1441: .It ip6        log_interval    integer yes
                   1442: .It ip6        lowportmax      integer yes
                   1443: .It ip6        lowportmin      integer yes
1.5       liamjfoy 1444: .It ip6        maxflows        integer yes
1.1       pavel    1445: .It ip6        maxfragpackets  integer yes
                   1446: .It ip6        maxfrags        integer yes
                   1447: .It ip6        redirect        integer yes
                   1448: .It ip6        rr_prune        integer yes
                   1449: .It ip6        use_deprecated  integer yes
                   1450: .It ip6        v6only  integer yes
                   1451: .It udp6       do_loopback_cksum       integer yes
                   1452: .It udp6       recvspace       integer yes
                   1453: .It udp6       sendspace       integer yes
                   1454: .El
                   1455: .Pp
                   1456: The variables are as follows:
                   1457: .Bl -tag -width "123456"
                   1458: .It Li ip6.accept_rtadv
                   1459: If set to non-zero, the node will accept ICMPv6 router advertisement packets
                   1460: and autoconfigures address prefixes and default routers.
                   1461: The node must be a host
                   1462: .Pq not a router
                   1463: for the option to be meaningful.
                   1464: .It Li ip6.anonportmax
                   1465: The highest port number to use for TCP and UDP ephemeral port allocation.
                   1466: This cannot be set to less than 1024 or greater than 65535, and must
                   1467: be greater than
                   1468: .Li ip6.anonportmin .
                   1469: .It Li ip6.anonportmin
                   1470: The lowest port number to use for TCP and UDP ephemeral port allocation.
                   1471: This cannot be set to less than 1024 or greater than 65535.
                   1472: .It Li ip6.auto_flowlabel
                   1473: On connected transport protocol packets,
                   1474: fill IPv6 flowlabel field to help intermediate routers to identify packet flows.
                   1475: .It Li ip6.dad_count
                   1476: The variable configures number of IPv6 DAD
                   1477: .Pq duplicated address detection
                   1478: probe packets.
                   1479: The packets will be generated when IPv6 interface addresses are configured.
                   1480: .It Li ip6.defmcasthlim
                   1481: The default hop limit value for an IPv6 multicast packet sourced by the node.
                   1482: This value applies to all the transport protocols on top of IPv6.
                   1483: There are APIs to override the value, as documented in
                   1484: .Xr ip6 4 .
                   1485: .It Li ip6.forwarding
                   1486: If set to 1, enables IPv6 forwarding for the node,
                   1487: meaning that the node is acting as a router.
                   1488: If set to 0, disables IPv6 forwarding for the node,
                   1489: meaning that the node is acting as a host.
                   1490: IPv6 specification defines node behavior for
                   1491: .Dq router
                   1492: case and
                   1493: .Dq host
                   1494: case quite differently, and changing this variable during operation
                   1495: may cause serious trouble.
                   1496: It is recommended to configure the variable at bootstrap time,
                   1497: and bootstrap time only.
                   1498: .It Li ip6.gifhlim
                   1499: The maximum hop limit value for an IPv6 packet generated by
                   1500: .Xr gif 4
                   1501: tunnel interface.
                   1502: .It Li ip6.hdrnestlimit
                   1503: The number of IPv6 extension headers permitted on incoming IPv6 packets.
                   1504: If set to 0, the node will accept as many extension headers as possible.
1.7       liamjfoy 1505: .It Li ip6.hashsize
                   1506: The size of IPv6 Fast Forward hash table.
                   1507: This value must be a power of 2 (64, 256...).
                   1508: A larger hash table size results in fewer collisions.
                   1509: Also see
                   1510: .Li ip6.maxflows .
1.1       pavel    1511: .It Li ip6.hlim
                   1512: The default hop limit value for an IPv6 unicast packet sourced by the node.
                   1513: This value applies to all the transport protocols on top of IPv6.
                   1514: There are APIs to override the value, as documented in
                   1515: .Xr ip6 4 .
                   1516: .It Li ip6.kame_version
                   1517: The string identifies the version of KAME IPv6 stack implemented in the kernel.
                   1518: .It Li ip6.keepfaith
                   1519: If set to non-zero, it enables
                   1520: .Dq FAITH
                   1521: TCP relay IPv6-to-IPv4 translator code in the kernel.
                   1522: Refer
                   1523: .Xr faith 4
                   1524: and
                   1525: .Xr faithd 8
                   1526: for detail.
                   1527: .It Li ip6.log_interval
                   1528: The variable controls amount of logs generated by IPv6 packet
                   1529: forwarding engine, by setting interval between log output
                   1530: .Pq in seconds .
                   1531: .It Li ip6.lowportmax
                   1532: The highest port number to use for TCP and UDP reserved port allocation.
                   1533: This cannot be set to less than 0 or greater than 1024, and must
                   1534: be greater than
                   1535: .Li ip6.lowportmin .
                   1536: .It Li ip6.lowportmin
                   1537: The lowest port number to use for TCP and UDP reserved port allocation.
                   1538: This cannot be set to less than 0 or greater than 1024, and must
                   1539: be smaller than
                   1540: .Li ip6.lowportmax .
1.5       liamjfoy 1541: .It Li ip6.maxflows
                   1542: IPv6 Fast Forwarding is enabled by default.
                   1543: If set to 0, IPv6 Fast Forwarding is disabled.
                   1544: .Li ip6.maxflows
                   1545: controls the maximum amount of flows which can be created.
1.6       liamjfoy 1546: The default value is 256.
1.1       pavel    1547: .It Li ip6.maxfragpackets
                   1548: The maximum number of fragmented packets the node will accept.
                   1549: 0 means that the node will not accept any fragmented packets.
                   1550: \-1 means that the node will accept as many fragmented packets as it receives.
                   1551: The flag is provided basically for avoiding possible DoS attacks.
                   1552: .It Li ip6.maxfrags
                   1553: The maximum number of fragments the node will accept.
                   1554: 0 means that the node will not accept any fragments.
                   1555: \-1 means that the node will accept as many fragments as it receives.
                   1556: The flag is provided basically for avoiding possible DoS attacks.
                   1557: .It Li ip6.redirect
                   1558: If set to 1, ICMPv6 redirects may be sent by the node.
                   1559: This option is ignored unless the node is routing IP packets,
                   1560: and should normally be enabled on all systems.
                   1561: .It Li ip6.rr_prune
                   1562: The variable specifies interval between IPv6 router renumbering prefix
                   1563: babysitting, in seconds.
                   1564: .It Li ip6.use_deprecated
                   1565: The variable controls use of deprecated address, specified in RFC 2462 5.5.4.
                   1566: .It Li ip6.v6only
                   1567: The variable specifies initial value for
                   1568: .Dv IPV6_V6ONLY
                   1569: socket option for
                   1570: .Dv AF_INET6
                   1571: socket.
                   1572: Please refer to
                   1573: .Xr ip6 4
                   1574: for detail.
                   1575: .It Li icmp6.errppslimit
                   1576: The variable specifies the maximum number of outgoing ICMPv6 error messages,
                   1577: per second.
                   1578: ICMPv6 error messages that exceeded the value are subject to rate limitation
                   1579: and will not go out from the node.
                   1580: Negative value disables rate limitation.
                   1581: .It Li icmp6.mtudisc_hiwat
                   1582: .It Li icmp6.mtudisc_lowat
                   1583: The variables define the maximum number of routing table entries,
                   1584: created due to path MTU discovery
                   1585: .Pq prevents denial-of-service attacks with ICMPv6 too big messages .
                   1586: When IPv6 path MTU discovery happens, we keep path MTU information into
                   1587: the routing table.
                   1588: If the number of routing table entries exceed the value,
                   1589: the kernel will not attempt to keep the path MTU information.
                   1590: .Li icmp6.mtudisc_hiwat
                   1591: is used when we have verified ICMPv6 too big messages.
                   1592: .Li icmp6.mtudisc_lowat
                   1593: is used when we have unverified ICMPv6 too big messages.
                   1594: Verification is performed by using address/port pairs kept in connected pcbs.
                   1595: Negative value disables the upper limit.
                   1596: .It Li icmp6.nd6_debug
                   1597: If set to non-zero, kernel IPv6 neighbor discovery code will generate
                   1598: debugging messages.
                   1599: The debug outputs are useful to diagnose IPv6 interoperability issues.
                   1600: The flag must be set to 0 for normal operation.
                   1601: .It Li icmp6.nd6_delay
                   1602: The variable specifies
                   1603: .Dv DELAY_FIRST_PROBE_TIME
                   1604: timing constant in IPv6 neighbor discovery specification
                   1605: .Pq RFC 2461 ,
                   1606: in seconds.
                   1607: .It Li icmp6.nd6_maxnudhint
                   1608: IPv6 neighbor discovery permits upper layer protocols to supply reachability
                   1609: hints, to avoid unnecessary neighbor discovery exchanges.
                   1610: The variable defines the number of consecutive hints the neighbor discovery
                   1611: layer will take.
                   1612: For example, by setting the variable to 3, neighbor discovery layer
                   1613: will take 3 consecutive hints in maximum.
                   1614: After receiving 3 hints, neighbor discovery layer will perform
                   1615: normal neighbor discovery process.
                   1616: .It Li icmp6.nd6_mmaxtries
                   1617: The variable specifies
                   1618: .Dv MAX_MULTICAST_SOLICIT
                   1619: constant in IPv6 neighbor discovery specification
                   1620: .Pq RFC 2461 .
                   1621: .It Li icmp6.nd6_prune
                   1622: The variable specifies interval between IPv6 neighbor cache babysitting,
                   1623: in seconds.
                   1624: .It Li icmp6.nd6_umaxtries
                   1625: The variable specifies
                   1626: .Dv MAX_UNICAST_SOLICIT
                   1627: constant in IPv6 neighbor discovery specification
                   1628: .Pq RFC 2461 .
                   1629: .It Li icmp6.nd6_useloopback
                   1630: If set to non-zero, kernel IPv6 stack will use loopback interface for
                   1631: local traffic.
                   1632: .It Li icmp6.nodeinfo
                   1633: The variable enables responses to ICMPv6 node information queries.
                   1634: If you set the variable to 0, responses will not be generated for
                   1635: ICMPv6 node information queries.
                   1636: Since node information queries can have a security impact, it is
                   1637: possible to fine tune which responses should be answered.
                   1638: Two separate bits can be set.
                   1639: .Bl -tag -width "12345"
                   1640: .It 1
                   1641: Respond to ICMPv6 FQDN queries, e.g.
                   1642: .Li ping6 -w .
                   1643: .It 2
                   1644: Respond to ICMPv6 node addresses queries, e.g.
                   1645: .Li ping6 -a .
                   1646: .El
                   1647: .It Li icmp6.rediraccept
                   1648: If set to non-zero, the host will accept ICMPv6 redirect packets.
                   1649: Note that IPv6 routers will never accept ICMPv6 redirect packets,
                   1650: and the variable is meaningful on IPv6 hosts
                   1651: .Pq non-router
                   1652: only.
                   1653: .It Li icmp6.redirtimeout
                   1654: The variable specifies lifetime of routing entries generated by incoming
                   1655: ICMPv6 redirect.
                   1656: .It Li udp6.do_loopback_cksum
                   1657: Perform UDP checksum on loopback.
                   1658: .It Li udp6.recvspace
                   1659: Default UDP receive buffer size.
                   1660: .It Li udp6.sendspace
                   1661: Default UDP send buffer size.
                   1662: .El
                   1663: .Pp
                   1664: We reuse net.*.tcp for
                   1665: .Tn TCP
                   1666: over
                   1667: .Tn IPv6 ,
                   1668: and therefore we do not have variables net.*.tcp6.
                   1669: Variables net.inet6.udp6 have identical meaning to net.inet.udp.
                   1670: Please refer to
                   1671: .Li PF_INET
                   1672: section above.
                   1673: For variables net.*.ipsec6, please refer to
                   1674: .Xr ipsec 4 .
                   1675: .It Li net.key ( PF_KEY )
                   1676: Get or set various global information about the IPsec key management.
                   1677: The third level name is the variable name.
                   1678: The currently defined variable and names are:
1.21      joerg    1679: .Bl -column "blockacq_lifetime" "integer" "Changeable" -offset indent
1.1       pavel    1680: .It Sy Variable name   Type    Changeable
                   1681: .It debug      integer yes
                   1682: .It spi_try    integer yes
                   1683: .It spi_min_value      integer yes
                   1684: .It spi_max_value      integer yes
                   1685: .It larval_lifetime    integer yes
                   1686: .It blockacq_count     integer yes
                   1687: .It blockacq_lifetime  integer yes
                   1688: .It esp_keymin integer yes
                   1689: .It esp_auth   integer yes
                   1690: .It ah_keymin  integer yes
                   1691: .El
1.21      joerg    1692: .Pp
1.1       pavel    1693: The variables are as follows:
                   1694: .Bl -tag -width "123456"
                   1695: .It Li debug
                   1696: Turn on debugging message from within the kernel.
                   1697: The value is a bitmap, as defined in
                   1698: .Pa /usr/include/netkey/key_debug.h .
                   1699: .It Li spi_try
                   1700: The number of times the kernel will try to obtain an unique SPI
                   1701: when it generates it from random number generator.
                   1702: .It Li spi_min_value
                   1703: Minimum SPI value when generating it within the kernel.
                   1704: .It Li spi_max_value
                   1705: Maximum SPI value when generating it within the kernel.
                   1706: .It Li larval_lifetime
                   1707: Lifetime for LARVAL SAD entries, in seconds.
                   1708: .It Li blockacq_count
                   1709: Number of ACQUIRE PF_KEY messages to be blocked after an ACQUIRE message.
                   1710: It avoids flood of ACQUIRE PF_KEY from being sent from the kernel to the
                   1711: key management daemon.
                   1712: .It Li blockacq_lifetime
                   1713: Lifetime of ACQUIRE PF_KEY message.
                   1714: .It Li esp_keymin
                   1715: Minimum ESP key length, in bits.
                   1716: The value is used when the kernel creates proposal payload
                   1717: on ACQUIRE PF_KEY message.
                   1718: .It Li esp_auth
                   1719: Whether ESP authentication should be used or not.
                   1720: Non-zero value indicates that ESP authentication should be used.
                   1721: The value is used when the kernel creates proposal payload
                   1722: on ACQUIRE PF_KEY message.
                   1723: .It Li ah_keymin
                   1724: Minimum AH key length, in bits,
                   1725: The value is used when the kernel creates proposal payload
                   1726: on ACQUIRE PF_KEY message.
                   1727: .El
                   1728: .El
                   1729: .Sh The proc.* subtree
                   1730: The string and integer information available for the
                   1731: .Li proc
                   1732: level is detailed below.
                   1733: The changeable column shows whether a process with appropriate
                   1734: privilege may change the value.
                   1735: These values are per-process,
                   1736: and as such may change from one process to another.
                   1737: When a process is created,
                   1738: the default values are inherited from its parent.
                   1739: When a set-user-ID or set-group-ID binary is executed, the
                   1740: value of PROC_PID_CORENAME is reset to the system default value.
                   1741: The second level name is either the magic value PROC_CURPROC, which
                   1742: points to the current process, or the PID of the target process.
1.21      joerg    1743: .Bl -column "proc.pid.corename" "string" "not applicable" -offset indent
1.1       pavel    1744: .It Sy Third level name        Type    Changeable
                   1745: .It proc.pid.corename  string  yes
                   1746: .It proc.pid.rlimit    node    not applicable
                   1747: .It proc.pid.stopfork  int     yes
                   1748: .It proc.pid.stopexec  int     yes
                   1749: .It proc.pid.stopexit  int     yes
                   1750: .El
                   1751: .Bl -tag -width "123456"
                   1752: .It Li proc.pid.corename ( PROC_PID_CORENAME )
                   1753: The template used for the core dump file name (see
                   1754: .Xr core 5
                   1755: for details).
                   1756: The base name must either be
                   1757: .Nm core
                   1758: or end with the suffix ``.core'' (the super-user may set arbitrary names).
                   1759: By default it points to KERN_DEFCORENAME.
                   1760: .It Li proc.pid.rlimit ( PROC_PID_LIMIT )
                   1761: Return resources limits, as defined for the
                   1762: .Xr getrlimit 2
                   1763: and
                   1764: .Xr setrlimit 2
                   1765: system calls.
                   1766: The fourth level name is one of:
                   1767: .Bl -tag -width PROC_PID_LIMIT_MEMLOCKAA
                   1768: .It Li proc.pid.rlimit.cputime ( PROC_PID_LIMIT_CPU )
                   1769: The maximum amount of CPU time (in seconds) to be used by each process.
                   1770: .It Li proc.pid.rlimit.filesize ( PROC_PID_LIMIT_FSIZE )
                   1771: The largest size (in bytes) file that may be created.
                   1772: .It Li proc.pid.rlimit.datasize ( PROC_PID_LIMIT_DATA )
                   1773: The maximum size (in bytes) of the data segment for a process;
                   1774: this defines how far a program may extend its break with the
                   1775: .Xr sbrk 2
                   1776: system call.
                   1777: .It Li proc.pid.rlimit.stacksize ( PROC_PID_LIMIT_STACK )
                   1778: The maximum size (in bytes) of the stack segment for a process;
                   1779: this defines how far a program's stack segment may be extended.
                   1780: Stack extension is performed automatically by the system.
                   1781: .It Li proc.pid.rlimit.coredumpsize ( PROC_PID_LIMIT_CORE )
                   1782: The largest size (in bytes)
                   1783: .Pa core
                   1784: file that may be created.
                   1785: .It Li proc.pid.rlimit.memoryuse ( PROC_PID_LIMIT_RSS )
                   1786: The maximum size (in bytes) to which a process's resident set size may
                   1787: grow.
                   1788: This imposes a limit on the amount of physical memory to be given to
                   1789: a process; if memory is tight, the system will prefer to take memory
                   1790: from processes that are exceeding their declared resident set size.
                   1791: .It Li proc.pid.rlimit.memorylocked ( PROC_PID_LIMIT_MEMLOCK )
                   1792: The maximum size (in bytes) which a process may lock into memory
                   1793: using the
                   1794: .Xr mlock 2
                   1795: function.
                   1796: .It Li proc.pid.rlimit.maxproc ( PROC_PID_LIMIT_NPROC )
                   1797: The maximum number of simultaneous processes for this user id.
                   1798: .It Li proc.pid.rlimit.descriptors ( PROC_PID_LIMIT_NOFILE )
                   1799: The maximum number of open files for this process.
1.22      snj      1800: .It Li proc.pid.rlimit.sbsize ( PROC_PID_LIMIT_SBSIZE )
                   1801: The maximum size (in bytes) of the socket buffers
                   1802: set by the
                   1803: .Xr setsockopt 2
                   1804: .Dv SO_RCVBUF
                   1805: and
                   1806: .Dv SO_SNDBUF
                   1807: options.
1.1       pavel    1808: .El
                   1809: .Pp
                   1810: The fifth level name is one of
                   1811: .Li soft ( PROC_PID_LIMIT_TYPE_SOFT ) or
                   1812: .Li hard ( PROC_PID_LIMIT_TYPE_HARD ) ,
                   1813: to select respectively the soft or hard limit.
                   1814: Both are of type integer.
                   1815: .It Li proc.pid.stopfork ( PROC_PID_STOPFORK )
                   1816: If non zero, the process' children will be stopped after
                   1817: .Xr fork 2
                   1818: calls.
                   1819: The children is created in the SSTOP state and is never scheduled
                   1820: for running before being stopped.
                   1821: This feature helps attaching a process with a debugger such as
                   1822: .Xr gdb 1
                   1823: before it had the opportunity to actually do anything.
                   1824: .Pp
                   1825: This value is inherited by the process's children, and it also
                   1826: apply to emulation specific system calls that fork a new process, such as
                   1827: .Fn sproc
                   1828: or
                   1829: .Fn clone .
                   1830: .It Li proc.pid.stopexec ( PROC_PID_STOPEXEC )
                   1831: If non zero, the process will be stopped on next
                   1832: .Xr exec 3
                   1833: call.
                   1834: The process created by
                   1835: .Xr exec 3
                   1836: is created in the SSTOP state and is never scheduled for running
                   1837: before being stopped.
                   1838: This feature helps attaching a process with a debugger such as
                   1839: .Xr gdb 1
                   1840: before it had the opportunity to actually do anything.
                   1841: .Pp
                   1842: This value is inherited by the process's children.
                   1843: .It Li proc.pid.stopexit ( PROC_PID_STOPEXIT )
                   1844: If non zero, the process will be stopped on when it has cause to exit,
                   1845: either by way of calling
                   1846: .Xr exit 3 ,
                   1847: .Xr _exit 2 ,
                   1848: or by the receipt of a specific signal.
                   1849: The process is stopped before any of its resources or vm space is
                   1850: released allowing examination of the termination state of a process
                   1851: before it disappears.
                   1852: This feature can be used to examine the final conditions of the
                   1853: process's vmspace via
                   1854: .Xr pmap 1
                   1855: or its resource settings with
                   1856: .Xr sysctl 8
                   1857: before it disappears.
                   1858: .Pp
                   1859: This value is also inherited by the process's children.
                   1860: .El
                   1861: .Sh The user.* subtree ( CTL_USER )
                   1862: The string and integer information available for the
                   1863: .Li user
                   1864: level is detailed below.
                   1865: The changeable column shows whether a process with appropriate
                   1866: privilege may change the value.
1.21      joerg    1867: .Bl -column "user.coll_weights_max" "integer" "Changeable" -offset indent
1.1       pavel    1868: .It Sy Second level name       Type    Changeable
                   1869: .It user.atexit_max    integer no
                   1870: .It user.bc_base_max   integer no
                   1871: .It user.bc_dim_max    integer no
                   1872: .It user.bc_scale_max  integer no
                   1873: .It user.bc_string_max integer no
                   1874: .It user.coll_weights_max      integer no
                   1875: .It user.cs_path       string  no
                   1876: .It user.expr_nest_max integer no
                   1877: .It user.line_max      integer no
                   1878: .It user.posix2_c_bind integer no
                   1879: .It user.posix2_c_dev  integer no
                   1880: .It user.posix2_char_term      integer no
                   1881: .It user.posix2_fort_dev       integer no
                   1882: .It user.posix2_fort_run       integer no
                   1883: .It user.posix2_localedef      integer no
                   1884: .It user.posix2_sw_dev integer no
                   1885: .It user.posix2_upe    integer no
                   1886: .It user.posix2_version        integer no
                   1887: .It user.re_dup_max    integer no
                   1888: .It user.stream_max    integer no
                   1889: .It user.stream_max    integer no
                   1890: .It user.tzname_max    integer no
                   1891: .El
                   1892: .Bl -tag -width "123456"
                   1893: .It Li user.atexit_max ( USER_ATEXIT_MAX )
                   1894: The maximum number of functions that may be registered with
                   1895: .Xr atexit 3 .
                   1896: .It Li user.bc_base_max ( USER_BC_BASE_MAX )
                   1897: The maximum ibase/obase values in the
                   1898: .Xr bc 1
                   1899: utility.
                   1900: .It Li user.bc_dim_max ( USER_BC_DIM_MAX )
                   1901: The maximum array size in the
                   1902: .Xr bc 1
                   1903: utility.
                   1904: .It Li user.bc_scale_max ( USER_BC_SCALE_MAX )
                   1905: The maximum scale value in the
                   1906: .Xr bc 1
                   1907: utility.
                   1908: .It Li user.bc_string_max ( USER_BC_STRING_MAX )
                   1909: The maximum string length in the
                   1910: .Xr bc 1
                   1911: utility.
                   1912: .It Li user.coll_weights_max ( USER_COLL_WEIGHTS_MAX )
                   1913: The maximum number of weights that can be assigned to any entry of
                   1914: the LC_COLLATE order keyword in the locale definition file.
                   1915: .It Li user.cs_path ( USER_CS_PATH )
                   1916: Return a value for the
                   1917: .Ev PATH
                   1918: environment variable that finds all the standard utilities.
                   1919: .It Li user.expr_nest_max ( USER_EXPR_NEST_MAX )
                   1920: The maximum number of expressions that can be nested within
                   1921: parenthesis by the
                   1922: .Xr expr 1
                   1923: utility.
                   1924: .It Li user.line_max ( USER_LINE_MAX )
                   1925: The maximum length in bytes of a text-processing utility's input
                   1926: line.
                   1927: .It Li user.posix2_char_term ( USER_POSIX2_CHAR_TERM )
                   1928: Return 1 if the system supports at least one terminal type capable of
                   1929: all operations described in POSIX 1003.2, otherwise 0.
                   1930: .It Li user.posix2_c_bind ( USER_POSIX2_C_BIND )
                   1931: Return 1 if the system's C-language development facilities support the
                   1932: C-Language Bindings Option, otherwise 0.
                   1933: .It Li user.posix2_c_dev ( USER_POSIX2_C_DEV )
                   1934: Return 1 if the system supports the C-Language Development Utilities Option,
                   1935: otherwise 0.
                   1936: .It Li user.posix2_fort_dev ( USER_POSIX2_FORT_DEV )
                   1937: Return 1 if the system supports the FORTRAN Development Utilities Option,
                   1938: otherwise 0.
                   1939: .It Li user.posix2_fort_run ( USER_POSIX2_FORT_RUN )
                   1940: Return 1 if the system supports the FORTRAN Runtime Utilities Option,
                   1941: otherwise 0.
                   1942: .It Li user.posix2_localedef ( USER_POSIX2_LOCALEDEF )
                   1943: Return 1 if the system supports the creation of locales, otherwise 0.
                   1944: .It Li user.posix2_sw_dev ( USER_POSIX2_SW_DEV )
                   1945: Return 1 if the system supports the Software Development Utilities Option,
                   1946: otherwise 0.
                   1947: .It Li user.posix2_upe ( USER_POSIX2_UPE )
                   1948: Return 1 if the system supports the User Portability Utilities Option,
                   1949: otherwise 0.
                   1950: .It Li user.posix2_version ( USER_POSIX2_VERSION )
                   1951: The version of POSIX 1003.2 with which the system attempts to comply.
                   1952: .It Li user.re_dup_max ( USER_RE_DUP_MAX )
                   1953: The maximum number of repeated occurrences of a regular expression
                   1954: permitted when using interval notation.
                   1955: .It Li user.stream_max ( USER_STREAM_MAX )
                   1956: The minimum maximum number of streams that a process may have open
                   1957: at any one time.
                   1958: .It Li user.tzname_max ( USER_TZNAME_MAX )
                   1959: The minimum maximum number of types supported for the name of a
                   1960: timezone.
                   1961: .El
                   1962: .Sh The vm.* subtree ( CTL_VM )
                   1963: The string and integer information available for the
                   1964: .Li vm
                   1965: level is detailed below.
                   1966: The changeable column shows whether a process with appropriate
                   1967: privilege may change the value.
1.21      joerg    1968: .Bl -column "Second level name" "struct uvmexp_sysctl" "Changeable" -offset indent
1.1       pavel    1969: .It Sy Second level name       Type    Changeable
                   1970: .It vm.anonmax int     yes
                   1971: .It vm.anonmin int     yes
                   1972: .It vm.bufcache        int     yes
                   1973: .It vm.bufmem  int     no
                   1974: .It vm.bufmem_hiwater  int     yes
                   1975: .It vm.bufmem_lowater  int     yes
                   1976: .It vm.execmax int     yes
                   1977: .It vm.execmin int     yes
                   1978: .It vm.filemax int     yes
                   1979: .It vm.filemin int     yes
                   1980: .It vm.loadavg struct loadavg  no
                   1981: .It vm.maxslp  int     no
                   1982: .It vm.nkmempages      int     no
                   1983: .It vm.uspace  int     no
                   1984: .It vm.uvmexp  struct uvmexp   no
                   1985: .It vm.uvmexp2 struct uvmexp_sysctl    no
                   1986: .It vm.vmmeter struct vmtotal  no
                   1987: .El
                   1988: .Pp
                   1989: .Bl -tag -width "123456"
                   1990: .It Li vm.anonmax ( VM_ANONMAX )
                   1991: The percentage of physical memory which will be reclaimed
                   1992: from other types of memory usage to store anonymous application data.
                   1993: .It Li vm.anonmin ( VM_ANONMIN )
                   1994: The percentage of physical memory which will be always be available for
                   1995: anonymous application data.
                   1996: .It Li vm.bufcache ( VM_BUFCACHE )
                   1997: The percentage of physical memory which will be available
                   1998: for the buffer cache.
                   1999: .It Li vm.bufmem ( VM_BUFMEM )
                   2000: The amount of kernel memory that is being used by the buffer cache.
                   2001: .It Li vm.bufmem_lowater ( VM_BUFMEM_LOWATER )
                   2002: The minimum amount of kernel memory to reserve for the
                   2003: buffer cache.
                   2004: .It Li vm.bufmem_hiwater ( VM_BUFMEM_HIWATER )
                   2005: The maximum amount of kernel memory to be used for the
                   2006: buffer cache.
                   2007: .It Li vm.execmax ( VM_EXECMAX )
                   2008: The percentage of physical memory which will be reclaimed
                   2009: from other types of memory usage to store cached executable data.
                   2010: .It Li vm.execmin ( VM_EXECMIN )
                   2011: The percentage of physical memory which will be always be available for
                   2012: cached executable data.
                   2013: .It Li vm.filemax ( VM_FILEMAX )
                   2014: The percentage of physical memory which will be reclaimed
                   2015: from other types of memory usage to store cached file data.
                   2016: .It Li vm.filemin ( VM_FILEMIN )
                   2017: The percentage of physical memory which will be always be available for
                   2018: cached file data.
                   2019: .It Li vm.loadavg ( VM_LOADAVG )
                   2020: Return the load average history.
                   2021: The returned data consists of a
                   2022: .Va struct loadavg .
                   2023: .It Li vm.maxslp ( VM_MAXSLP )
                   2024: The value of the maxslp kernel global variable.
                   2025: .It Li vm.vmmeter ( VM_METER )
                   2026: Return system wide virtual memory statistics.
                   2027: The returned data consists of a
                   2028: .Va struct vmtotal .
1.31      drochner 2029: .It vm.user_va0_disable
                   2030: A flag which controls whether user processes can map virtual address 0.
1.1       pavel    2031: .It Li vm.uspace ( VM_USPACE )
                   2032: The number of bytes allocated for each kernel stack.
                   2033: .It Li vm.uvmexp ( VM_UVMEXP )
                   2034: Return system wide virtual memory statistics.
                   2035: The returned data consists of a
                   2036: .Va struct uvmexp .
                   2037: .It Li vm.uvmexp2 ( VM_UVMEXP2 )
                   2038: Return system wide virtual memory statistics.
                   2039: The returned data consists of a
                   2040: .Va struct uvmexp_sysctl .
                   2041: .\" XXX vm.idlezero
                   2042: .El
                   2043: .Sh The ddb.* subtree ( CTL_DDB )
1.34      jruoho   2044: The information available for the
1.1       pavel    2045: .Li ddb
                   2046: level is detailed below.
                   2047: The changeable column shows whether a process with appropriate
                   2048: privilege may change the value.
                   2049: .\" XXX sort
1.21      joerg    2050: .Bl -column "Second level name" "integer" "Changeable" -offset indent
1.1       pavel    2051: .It Sy Second level name       Type    Changeable
                   2052: .It ddb.radix  integer yes
                   2053: .It ddb.maxoff integer yes
1.34      jruoho   2054: .It ddb.maxwidth       integer yes
1.1       pavel    2055: .It ddb.lines  integer yes
                   2056: .It ddb.tabstops       integer yes
                   2057: .It ddb.onpanic        integer yes
                   2058: .It ddb.fromconsole    integer yes
1.34      jruoho   2059: .It ddb.tee_msgbuf     integer yes
                   2060: .It ddb.commandonenter string  yes
1.1       pavel    2061: .El
                   2062: .Pp
                   2063: .Bl -tag -width "123456"
1.35      jruoho   2064: .It Li ddb.radix ( DDBCTL_RADIX )
1.1       pavel    2065: The input and output radix.
1.35      jruoho   2066: .It Li ddb.maxoff ( DDBCTL_MAXOFF )
1.1       pavel    2067: The maximum symbol offset.
1.34      jruoho   2068: .It Li ddb.maxwidth ( DDBCTL_MAXWIDTH )
                   2069: The maximum output line width.
1.35      jruoho   2070: .It Li ddb.lines ( DDBCTL_LINES )
1.1       pavel    2071: Number of display lines.
1.35      jruoho   2072: .It Li ddb.tabstops ( DDBCTL_TABSTOPS )
1.1       pavel    2073: Tab width.
1.35      jruoho   2074: .It Li ddb.onpanic ( DDBCTL_ONPANIC )
1.18      ad       2075: If non-zero, DDB will be entered if the kernel panics.
1.35      jruoho   2076: .It Li ddb.fromconsole ( DDBCTL_FROMCONSOLE )
1.1       pavel    2077: If not zero, DDB may be entered by sending a break on a serial
                   2078: console or by a special key sequence on a graphics console.
1.34      jruoho   2079: .It Li ddb.tee_msgbuf
                   2080: If not zero, DDB will output also to the kernel message buffer.
                   2081: .It Li ddb.commandonenter
                   2082: If not empty, a command to be executed on each enter to the
                   2083: .Tn DDB .
                   2084: .\"
                   2085: .\" XXX: (a) ddb.commandonenter is missing in ddb(4);
                   2086: .\"     (b) No DDBCTL definitions for tee_msgbuf and commandonenter.
1.1       pavel    2087: .El
                   2088: .Pp
1.34      jruoho   2089: Some of these
                   2090: .Tn MIB
                   2091: nodes are also available as variables from within the debugger.
1.1       pavel    2092: See
                   2093: .Xr ddb 4
                   2094: for more details.
                   2095: .Sh The security.* subtree ( CTL_SECURITY )
                   2096: The
                   2097: .Li security
                   2098: level contains various security-related settings for
1.2       wiz      2099: the system.
1.43    ! jruoho   2100: The available second level names are:
        !          2101: .Bl -column "Second level name" "integer" "Changeable" -offset indent
        !          2102: .It Sy Second level name       Type    Changeable
        !          2103: .It Li security.curtain        integer yes
        !          2104: .It Li security.models node    not applicable
        !          2105: .It Li security.pax    node    not applicable
        !          2106: .El
        !          2107: .Pp
1.2       wiz      2108: Available settings are detailed below.
1.1       pavel    2109: .Pp
                   2110: .Bl -tag -width "123456"
                   2111: .It Li security.curtain
1.43    ! jruoho   2112: If non-zero, will filter return objects according to the user
        !          2113: .Tn ID
1.1       pavel    2114: requesting information about them, preventing from users any
1.43    ! jruoho   2115: access to objects they do not own.
1.1       pavel    2116: .Pp
                   2117: At the moment, it affects
                   2118: .Xr ps 1 ,
                   2119: .Xr netstat 1
                   2120: (for
                   2121: .Dv PF_INET ,
                   2122: .Dv PF_INET6 ,
                   2123: and
                   2124: .Dv PF_UNIX
                   2125: PCBs), and
                   2126: .Xr w 1 .
1.4       elad     2127: .It Li security.models
                   2128: .Nx
                   2129: supports pluggable security models.
1.17      ad       2130: Every security model used, whether if loaded as a module or built with the system,
1.4       elad     2131: is required to add an entry to this node with at least one element,
                   2132: .Dq name ,
                   2133: indicating the name of the security model.
                   2134: .Pp
                   2135: In addition to the name, any settings and other information private to the
                   2136: security model will be available under this node.
                   2137: See
                   2138: .Xr secmodel 9
                   2139: for more information.
1.1       pavel    2140: .It Li security.pax
                   2141: Settings for PaX -- exploit mitigation features.
1.4       elad     2142: For more information on any of the PaX features, please see
                   2143: .Xr paxctl 8
                   2144: and
                   2145: .Xr security 8 .
1.43    ! jruoho   2146: The available third and fourth level names are:
        !          2147: .Bl -column "security.pax.segvguard.suspend_timeout" "integer" "Changeable" \
        !          2148: -offset 2n
        !          2149: .It Sy Third and fourth level names Ta Sy Type Ta Sy Changeable
        !          2150: .It Li security.pax.aslr.enabled       integer yes
        !          2151: .\".It Li security.pax.aslr.exec_len   integer yes
        !          2152: .It Li security.pax.aslr.global        integer yes
        !          2153: .\".It Li security.pax.aslr.mmap_len   integer yes
        !          2154: .\".It Li security.pax.aslr.stack_len  integer yes
        !          2155: .It Li security.pax.mprotect.enabled   integer yes
        !          2156: .It Li security.pax.mprotect.global    integer yes
        !          2157: .It Li security.pax.segvguard.enabled  integer yes
        !          2158: .It Li security.pax.segvguard.expiry_timeout   integer yes
        !          2159: .It Li security.pax.segvguard.global   integer yes
        !          2160: .It Li security.pax.segvguard.max_crashes      integer yes
        !          2161: .It Li security.pax.segvguard.suspend_timeout  integer yes
        !          2162: .El
1.1       pavel    2163: .Pp
                   2164: .Bl -tag -width "123456"
1.43    ! jruoho   2165: .It Li security.pax.aslr.enabled
1.14      elad     2166: Enable PaX ASLR (Address Space Layout Randomization).
                   2167: .Pp
                   2168: The value of this
                   2169: knob must be non-zero for PaX ASLR to be enabled, even if a program is set to
                   2170: explicit enable.
1.43    ! jruoho   2171: .\".It Li security.pax.aslr.exec_len
        !          2172: .\" XXX: Undocumented.
1.14      elad     2173: .It Li security.pax.aslr.global
                   2174: Specifies the default global policy for programs without an
                   2175: explicit enable/disable flag.
                   2176: .Pp
                   2177: When non-zero, all programs will get PaX ASLR, except those exempted with
                   2178: .Xr paxctl 8  .
                   2179: Otherwise, all programs will not get PaX ASLR, except those specifically
                   2180: marked as such with
                   2181: .Xr paxctl 8 .
1.43    ! jruoho   2182: .\".It Li security.pax.aslr.mmap_len
        !          2183: .\" XXX: Undocumented.
        !          2184: .\" .It Li security.pax.aslr.stack_len
        !          2185: .\" XXX: Undocumented.
        !          2186: .It Li security.pax.mprotect.enabled
1.1       pavel    2187: Enable PaX MPROTECT restrictions.
                   2188: .Pp
                   2189: These are
                   2190: .Xr mprotect 2
1.2       wiz      2191: restrictions to better enforce a W^X policy.
                   2192: The value of this
1.1       pavel    2193: knob must be non-zero for PaX MPROTECT to be enabled, even if a
                   2194: program is set to explicit enable.
                   2195: .It Li security.pax.mprotect.global
                   2196: Specifies the default global policy for programs without an
                   2197: explicit enable/disable flag.
                   2198: .Pp
                   2199: When non-zero, all programs will get the PaX MPROTECT restrictions,
                   2200: except those exempted with
1.4       elad     2201: .Xr paxctl 8  .
1.1       pavel    2202: Otherwise, all programs will not get the PaX MPROTECT restrictions,
                   2203: except those specifically marked as such with
1.4       elad     2204: .Xr paxctl 8 .
1.43    ! jruoho   2205: .It Li security.pax.segvguard.enabled
1.1       pavel    2206: Enable PaX Segvguard.
                   2207: .Pp
                   2208: PaX Segvguard can detect and prevent certain exploitation attempts, where
                   2209: an attacker may try for example to brute-force function return addresses
                   2210: of respawning daemons.
                   2211: .Pp
                   2212: .Em Note :
                   2213: The
                   2214: .Nx
                   2215: interface and implementation of the Segvguard is still experimental, and may
                   2216: change in future releases.
1.43    ! jruoho   2217: .It Li security.pax.segvguard.expiry_timeout
        !          2218: If the max number was not reached within this timeout (in seconds), the entry
        !          2219: will expire.
1.1       pavel    2220: .It Li security.pax.segvguard.global
                   2221: Specifies the default global policy for programs without an
                   2222: explicit enable/disable flag.
                   2223: .Pp
                   2224: When non-zero, all programs will get the PaX Segvguard,
                   2225: except those exempted with
1.4       elad     2226: .Xr paxctl 8  .
1.2       wiz      2227: Otherwise, no program will get the PaX Segvguard restrictions,
1.1       pavel    2228: except those specifically marked as such with
1.4       elad     2229: .Xr paxctl 8 .
1.43    ! jruoho   2230: .It Li security.pax.segvguard.max_crashes
        !          2231: The maximum number of segfaults a program can receive before suspension.
1.1       pavel    2232: .It Li security.pax.segvguard.suspend_timeout
                   2233: Number of seconds to suspend a user from running a faulting program when the
                   2234: limit was exceeded.
                   2235: .El
                   2236: .El
                   2237: .Sh The vendor.* subtree ( CTL_VENDOR )
                   2238: The
                   2239: .Li vendor
                   2240: toplevel name is reserved to be used by vendors who wish to
                   2241: have their own private MIB tree.
                   2242: Intended use is to store values under
                   2243: .Dq vendor.\*[Lt]yourname\*[Gt].* .
                   2244: .Sh SEE ALSO
                   2245: .Xr sysctl 3 ,
                   2246: .Xr ipsec 4 ,
                   2247: .Xr tcp 4 ,
                   2248: .Xr security 8 ,
                   2249: .Xr sysctl 8
                   2250: .Sh HISTORY
                   2251: The
                   2252: .Nm
                   2253: variables first appeared in
                   2254: .Bx 4.4 .

CVSweb <webmaster@jp.NetBSD.org>