diff options
Diffstat (limited to 'lib/libc/sys')
| -rw-r--r-- | lib/libc/sys/Makefile.inc | 6 | ||||
| -rw-r--r-- | lib/libc/sys/sysctl.2 | 2257 |
2 files changed, 2260 insertions, 3 deletions
diff --git a/lib/libc/sys/Makefile.inc b/lib/libc/sys/Makefile.inc index 40cbd9640fc..6823d7472a8 100644 --- a/lib/libc/sys/Makefile.inc +++ b/lib/libc/sys/Makefile.inc @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile.inc,v 1.153 2017/11/28 06:03:41 guenther Exp $ +# $OpenBSD: Makefile.inc,v 1.154 2018/01/12 04:36:12 deraadt Exp $ # $NetBSD: Makefile.inc,v 1.35 1995/10/16 23:49:07 jtc Exp $ # @(#)Makefile.inc 8.1 (Berkeley) 6/17/93 @@ -194,5 +194,5 @@ MAN+= __get_tcb.2 __thrsigdivert.2 __thrsleep.2 _exit.2 accept.2 \ shmctl.2 shmget.2 shutdown.2 sigaction.2 sigaltstack.2 sigpending.2 \ sigprocmask.2 sigreturn.2 sigsuspend.2 socket.2 \ socketpair.2 stat.2 statfs.2 swapctl.2 symlink.2 \ - sync.2 sysarch.2 syscall.2 thrkill.2 truncate.2 umask.2 unlink.2 \ - utimes.2 utrace.2 vfork.2 wait.2 write.2 + sync.2 sysarch.2 syscall.2 sysctl.2 thrkill.2 truncate.2 \ + umask.2 unlink.2 utimes.2 utrace.2 vfork.2 wait.2 write.2 diff --git a/lib/libc/sys/sysctl.2 b/lib/libc/sys/sysctl.2 new file mode 100644 index 00000000000..6aa84ea4599 --- /dev/null +++ b/lib/libc/sys/sysctl.2 @@ -0,0 +1,2257 @@ +.\" $OpenBSD: sysctl.2,v 1.1 2018/01/12 04:36:12 deraadt Exp $ +.\" +.\" Copyright (c) 1993 +.\" The Regents of the University of California. All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. Neither the name of the University nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.Dd $Mdocdate: January 12 2018 $ +.Dt SYSCTL 2 +.Os +.Sh NAME +.Nm sysctl +.Nd get or set system information +.Sh SYNOPSIS +.In sys/types.h +.In sys/sysctl.h +.Ft int +.Fn sysctl "const int *name" "u_int namelen" "void *oldp" "size_t *oldlenp" "void *newp" "size_t newlen" +.Sh DESCRIPTION +The +.Fn sysctl +function retrieves system information and allows processes with +appropriate privileges to set system information. +The information available from +.Fn sysctl +consists of integers, strings, and tables. +Information may be retrieved and set using the +.Xr sysctl 8 +utility; +the variable names used by this utility are given here in parentheses. +.Pp +Unless explicitly noted below, +.Fn sysctl +returns a consistent snapshot of the data requested. +Consistency is obtained by locking the destination +buffer into memory so that the data may be copied out without blocking. +Calls to +.Fn sysctl +are serialized to avoid deadlock. +.Pp +The state is described using a +.Dq Management Information Base (MIB) +style name, listed in +.Fa name , +which is a +.Fa namelen +length array of integers. +.Pp +The information is copied into the buffer specified by +.Fa oldp . +The size of the buffer is given by the location specified by +.Fa oldlenp +before the call, +and that location gives the amount of data copied after a successful call. +If the amount of data available is greater +than the size of the buffer supplied, +the call supplies as much data as fits in the buffer provided +and returns with the error code +.Er ENOMEM . +If the old value is not desired, +.Fa oldp +and +.Fa oldlenp +should be set to +.Dv NULL . +.Pp +The size of the available data can be determined by calling +.Fn sysctl +with a +.Dv NULL +parameter for +.Fa oldp . +The size of the available data will be returned in the location pointed to by +.Fa oldlenp . +For some operations, the amount of space may change often. +For these operations, +the system attempts to round up so that the returned size is +large enough for a call to return the data shortly thereafter. +.Pp +The terminating NUL character is included in the lengths of string values. +.Pp +To set a new value, +.Fa newp +is set to point to a buffer of length +.Fa newlen +from which the requested value is to be taken. +If a new value is not to be set, +.Fa newp +should be set to +.Dv NULL +and +.Fa newlen +set to 0. +.Pp +The top level names are defined with a +.Dv CTL_ +prefix in +.In sys/sysctl.h , +and are as follows. +The next and subsequent levels down are found in the include files +listed here, and described in separate sections below. +.Bl -column "CTL_MACHDEP" "ufs/ffs/ffs_extern.h" "Description" -offset indent +.It Sy "Name" Ta Sy "Next level names" Ta Sy "Description" +.It Dv CTL_DDB Ta "ddb/db_var.h" Ta "Kernel debugger" +.It Dv CTL_DEBUG Ta "sys/sysctl.h" Ta "Debugging" +.It Dv CTL_FS Ta "sys/sysctl.h" Ta "File system" +.It Dv CTL_HW Ta "sys/sysctl.h" Ta "Generic CPU, I/O" +.It Dv CTL_KERN Ta "sys/sysctl.h" Ta "High kernel limits" +.It Dv CTL_MACHDEP Ta "sys/sysctl.h" Ta "Machine dependent" +.It Dv CTL_NET Ta "sys/socket.h" Ta "Networking" +.It Dv CTL_VFS Ta "ufs/ffs/ffs_extern.h" Ta "Virtual file system" +.It Dv CTL_VM Ta "uvm/uvm_param.h" Ta "Virtual memory" +.El +.Pp +For example, the following retrieves the maximum number of processes allowed +in the system: +.Bd -literal -offset indent +int mib[2], maxproc; +size_t len; + +mib[0] = CTL_KERN; +mib[1] = KERN_MAXPROC; +len = sizeof(maxproc); +if (sysctl(mib, 2, &maxproc, &len, NULL, 0) == -1) + err(1, "sysctl"); +.Ed +.Ss CTL_DDB +Integer information and settable variables are available for the +.Dv CTL_DDB level , +as described below. +More information is also available in +.Xr ddb 4 . +.Bl -column "Second level name" "integer" "Changeable" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv DBCTL_CONSOLE Ta "integer" Ta "yes" +.It Dv DBCTL_LOG Ta "integer" Ta "yes" +.It Dv DBCTL_MAXLINE Ta "integer" Ta "yes" +.It Dv DBCTL_MAXWIDTH Ta "integer" Ta "yes" +.It Dv DBCTL_PANIC Ta "integer" Ta "yes" +.It Dv DBCTL_RADIX Ta "integer" Ta "yes" +.It Dv DBCTL_TABSTOP Ta "integer" Ta "yes" +.It Dv DBCTL_TRIGGER Ta "integer" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv DBCTL_CONSOLE Pq Va ddb.console +When this variable is set, an architecture dependent magic key sequence +on the console or a debugger button will permit entry into the kernel debugger. +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be raised. +.It Dv DBCTL_LOG Pq Va ddb.log +When set, ddb output is also logged in the kernel message buffer. +.It Dv DBCTL_MAXLINE Pq Va ddb.max_line +Determines the number of lines to page in +.Xr ddb 4 . +This variable is also available as the ddb +.Dv $lines +variable. +.It Dv DBCTL_MAXWIDTH Pq Va ddb.max_width +Determines the maximum width of a line in +.Xr ddb 4 . +This variable is also available as the ddb +.Dv $maxwidth +variable. +.It Dv DBCTL_PANIC Pq Va ddb.panic +When this variable is set, system panics may drop into the kernel debugger. +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be raised. +.It Dv DBCTL_RADIX Pq Va ddb.radix +Determines the default radix or base for non-prefixed numbers +entered into +.Xr ddb 4 . +This variable is also available as the ddb +.Dv $radix +variable. +.It Dv DBCTL_TABSTOP Pq Va ddb.tab_stop_width +Width of a tab stop in +.Xr ddb 4 . +This variable is also available as the ddb +.Dv $tabstops +variable. +.It Dv DBCTL_TRIGGER Pq Va ddb.trigger +When +.Dv DBCTL_CONSOLE +is set, +writing to +.Dv DBCTL_TRIGGER +causes the system to enter +.Xr ddb 4 . +When running with a +.Xr securelevel 7 +greater than 0, +the process writing to this variable must be running +on the console in order to enter +.Xr ddb 4 . +.El +.Ss CTL_DEBUG +The debugging variables vary from system to system. +A debugging variable may be added or deleted without need to recompile +.Fn sysctl +to know about it. +Each time it runs, +.Fn sysctl +gets the list of debugging variables from the kernel and +displays their current values. +The system defines twenty +.Li struct ctldebug +variables named +.Va debug0 +through +.Va debug19 . +They are declared as separate variables so that they can be +individually initialized at the location of their associated variable. +The loader prevents multiple use of the same variable by issuing errors +if a variable is initialized in more than one place. +For example, to export the variable +.Va dospecialcheck +as a debugging variable, the following declaration would be used: +.Bd -literal -offset indent +int dospecialcheck = 1; +struct ctldebug debug5 = { "dospecialcheck", &dospecialcheck }; +.Ed +.Ss CTL_FS +The string and integer information available for the +.Dv CTL_FS +level is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "Second level name" "integer" "Changeable" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv FS_POSIX_SETUID Ta "integer" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv FS_POSIX_SETUID Pq Va fx.posix.setuid +When this variable is set, ownership changes on a file will cause +the +.Va S_ISUID +and +.Va S_ISGID +bits to be cleared. +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be changed. +.El +.Ss CTL_HW +The string and integer information available for the +.Dv CTL_HW +level is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "Second level name" "integer" "Changeable" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv HW_ALLOWPOWERDOWN Ta "integer" Ta "yes" +.It Dv HW_BYTEORDER Ta "integer" Ta "no" +.It Dv HW_CPUSPEED Ta "integer" Ta "no" +.It Dv HW_DISKCOUNT Ta "integer" Ta "no" +.It Dv HW_DISKNAMES Ta "string" Ta "no" +.It Dv HW_DISKSTATS Ta "struct" Ta "no" +.It Dv HW_MACHINE Ta "string" Ta "no" +.It Dv HW_MODEL Ta "string" Ta "no" +.It Dv HW_NCPU Ta "integer" Ta "no" +.It Dv HW_NCPUFOUND Ta "integer" Ta "no" +.It Dv HW_PAGESIZE Ta "integer" Ta "no" +.It Dv HW_PERFPOLICY Ta "string" Ta "yes" +.It Dv HW_PHYSMEM Ta "integer" Ta "no" +.It Dv HW_PHYSMEM64 Ta "int64_t" Ta "no" +.It Dv HW_PRODUCT Ta "string" Ta "no" +.It Dv HW_SENSORS Ta "node" Ta "not applicable" +.It Dv HW_SETPERF Ta "integer" Ta "yes" +.It Dv HW_USERMEM Ta "integer" Ta "no" +.It Dv HW_USERMEM64 Ta "int64_t" Ta "no" +.It Dv HW_UUID Ta "string" Ta "no" +.It Dv HW_VENDOR Ta "string" Ta "no" +.It Dv HW_VERSION Ta "string" Ta "no" +.El +.Bl -tag -width "123456" +.It Dv HW_ALLOWPOWERDOWN Pq Va hw.allowpowerdown +Some machines generate an interrupt when the power button is pressed +and a driver can catch that interrupt. +When this variable is set, such an event will cause the system to +perform a regular shutdown and power off the machine. +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be changed. +.It Dv HW_BYTEORDER Pq Va hw.byteorder +The byteorder (4321 or 1234). +.It Dv HW_CPUSPEED Pq Va hw.cpuspeed +The current CPU frequency +.Pq in MHz . +.It Dv HW_DISKCOUNT Pq Va hw.diskcount +The number of disks currently attached to the system. +.It Dv HW_DISKNAMES Pq Va hw.disknames +A comma-separated list of disk names. +.It Dv HW_DISKSTATS Pq Va hw.diskstats +An array of +.Li struct diskstats +structures containing disk statistics. +.It Dv HW_MACHINE Pq Va hw.machine +The machine class. +.It Dv HW_MODEL Pq Va hw.model +The machine model. +.It Dv HW_NCPU Pq Va hw.ncpu +The number of CPUs being used. +.It Dv HW_NCPUFOUND Pq Va hw.ncpufound +The number of CPUs found. +.It Dv HW_PAGESIZE Pq Va hw.pagesize +The software page size. +.It Dv HW_PERFPOLICY Pq Va hw.perfpolicy +The performance policy for power management. +Can be one of +.Dq manual , +.Dq auto , +or +.Dq high . +.It Dv HW_PHYSMEM +The total physical memory, in bytes. +This variable is deprecated; use +.Dv HW_PHYSMEM64 +instead. +.It Dv HW_PHYSMEM64 Pq Va hw.physmem +The total physical memory, in bytes. +.It Dv HW_PRODUCT Pq Va hw.product +The product name of the machine. +.It Dv HW_SENSORS Pq Va hw.sensors +Third level comprises an array of +.Li struct sensordev +structures containing information about devices +that may attach hardware monitoring sensors. +.Pp +Third, fourth and fifth levels together comprise an array of +.Li struct sensor +structures containing snapshot readings of hardware monitoring sensors. +In such usage, third level indicates the numerical representation +of the sensor device name to which the sensor is attached +(a device's xname and number are matched with the help of +.Li struct sensordev +structure above), +fourth level indicates sensor type and +fifth level is an ordinal sensor number (unique to +the specified sensor type on the specified sensor device). +.Pp +The +.Sy sensordev +and +.Sy sensor +structures +and +.Sy sensor_type +enumeration +are defined in +.In sys/sensors.h . +.It Dv HW_SERIALNO Pq Va hw.serialno +The serial number of the machine. +.It Dv HW_SETPERF Pq Va hw.setperf +Current CPU performance +.Pq percentage . +It is only modifiable if +.Dv HW_PERFPOLICY +is set to +.Dq manual . +.It Dv HW_USERMEM +The amount of available non-kernel memory in bytes. +This variable is deprecated; use +.Dv HW_USERMEM64 +instead. +.It Dv HW_USERMEM64 Pq Va hw.usermem +The amount of available non-kernel memory in bytes. +.It Dv HW_UUID Pq Va hw.uuid +The universal unique identification number assigned to the machine. +.It Dv HW_VENDOR Pq Va hw.vendor +The vendor name for this machine. +.It Dv HW_VERSION Pq Va hw.version +The version or revision of this machine. +.El +.Ss CTL_KERN +The string and integer information available for the +.Dv CTL_KERN +level is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +The types of data currently available are process information, +system vnodes, the open file entries, routing table entries, +virtual memory statistics, load average history, and clock rate +information. +.Bl -column "KERN_PROC_NOBROADCASTKILL" "u_int64_t[CPUSTATES]" "no" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv KERN_ALLOWKMEM Ta "integer" Ta "yes" +.It Dv KERN_ARGMAX Ta "integer" Ta "no" +.It Dv KERN_BOOTTIME Ta "struct timeval" Ta "no" +.It Dv KERN_CACHEPCT Ta "integer" Ta "yes" +.It Dv KERN_CCPU Ta "integer" Ta "no" +.It Dv KERN_CLOCKRATE Ta "struct clockinfo" Ta "no" +.It Dv KERN_CONSDEV Ta "dev_t" Ta "no" +.It Dv KERN_CPTIME Ta "long[CPUSTATES]" Ta "no" +.It Dv KERN_CPTIME2 Ta "u_int64_t[CPUSTATES]" Ta "no" +.It Dv KERN_DNSJACKPORT Ta "integer" Ta "yes" +.It Dv KERN_DOMAINNAME Ta "string" Ta "yes" +.It Dv KERN_FILE Ta "struct kinfo_file" Ta "no" +.It Dv KERN_FORKSTAT Ta "struct forkstat" Ta "no" +.It Dv KERN_FSCALE Ta "integer" Ta "no" +.It Dv KERN_FSYNC Ta "integer" Ta "no" +.It Dv KERN_GLOBAL_PTRACE Ta "integer" Ta "yes" +.It Dv KERN_HOSTID Ta "integer" Ta "yes" +.It Dv KERN_HOSTNAME Ta "string" Ta "yes" +.It Dv KERN_INTRCNT Ta "node" Ta "not applicable" +.It Dv KERN_JOB_CONTROL Ta "integer" Ta "no" +.It Dv KERN_MALLOCSTATS Ta "node" Ta "no" +.It Dv KERN_MAXCLUSTERS Ta "integer" Ta "yes" +.It Dv KERN_MAXFILES Ta "integer" Ta "yes" +.It Dv KERN_MAXLOCKSPERUID Ta "integer" Ta "yes" +.It Dv KERN_MAXPARTITIONS Ta "integer" Ta "no" +.It Dv KERN_MAXPROC Ta "integer" Ta "yes" +.It Dv KERN_MAXTHREAD Ta "integer" Ta "yes" +.It Dv KERN_MAXVNODES Ta "integer" Ta "yes" +.It Dv KERN_MBSTAT Ta "struct mbstat" Ta "no" +.It Dv KERN_MSGBUF Ta "char[]" Ta "no" +.It Dv KERN_MSGBUFSIZE Ta "integer" Ta "no" +.It Dv KERN_NCHSTATS Ta "struct nchstats" Ta "no" +.It Dv KERN_NFILES Ta "integer" Ta "no" +.It Dv KERN_NGROUPS Ta "integer" Ta "no" +.It Dv KERN_NOSUIDCOREDUMP Ta "integer" Ta "yes" +.It Dv KERN_NPROCS Ta "integer" Ta "no" +.It Dv KERN_NSELCOLL Ta "integer" Ta "no" +.It Dv KERN_NTHREADS Ta "integer" Ta "no" +.It Dv KERN_NUMVNODES Ta "integer" Ta "no" +.It Dv KERN_OSRELEASE Ta "string" Ta "no" +.It Dv KERN_OSREV Ta "integer" Ta "no" +.It Dv KERN_OSTYPE Ta "string" Ta "no" +.It Dv KERN_OSVERSION Ta "string" Ta "no" +.It Dv KERN_POSIX1 Ta "integer" Ta "no" +.It Dv KERN_PROC Ta "struct kinfo_proc" Ta "no" +.It Dv KERN_PROC_ARGS Ta "node" Ta "not applicable" +.It Dv KERN_PROC_CWD Ta "string" Ta "not applicable" +.It Dv KERN_PROC_NOBROADCASTKILL Ta "node" Ta "not applicable" +.It Dv KERN_PROC_VMMAP Ta "struct kinfo_vmentry" Ta "no" +.It Dv KERN_PROF Ta "node" Ta "not applicable" +.It Dv KERN_RAWPARTITION Ta "integer" Ta "no" +.It Dv KERN_SAVED_IDS Ta "integer" Ta "no" +.It Dv KERN_SECURELVL Ta "integer" Ta "raise only" +.It Dv KERN_SEMINFO Ta "node" Ta "not applicable" +.It Dv KERN_SHMINFO Ta "node" Ta "not applicable" +.It Dv KERN_SOMAXCONN Ta "integer" Ta "yes" +.It Dv KERN_SOMINCONN Ta "integer" Ta "yes" +.It Dv KERN_SPLASSERT Ta "int" Ta "yes" +.It Dv KERN_STACKGAPRANDOM Ta "integer" Ta "yes" +.It Dv KERN_SYSVIPC_INFO Ta "node" Ta "not applicable" +.It Dv KERN_SYSVMSG Ta "integer" Ta "no" +.It Dv KERN_SYSVSEM Ta "integer" Ta "no" +.It Dv KERN_SYSVSHM Ta "integer" Ta "no" +.It Dv KERN_TIMECOUNTER Ta "node" Ta "not applicable" +.It Dv KERN_TTY Ta "node" Ta "not applicable" +.It Dv KERN_TTYCOUNT Ta "integer" Ta "no" +.It Dv KERN_VERSION Ta "string" Ta "no" +.It Dv KERN_WATCHDOG Ta "node" Ta "not applicable" +.It Dv KERN_WXABORT Ta "integer" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv KERN_ALLOWKMEM Pq Va kern.allowkmem +Allow userland processes access to +.Pa /dev/mem +and +.Pa /dev/kmem . +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be changed. +.It Dv KERN_ARGMAX Pq Va kern.argmax +The maximum number of bytes allowed among the arguments to +.Xr exec 3 . +.It Dv KERN_BOOTTIME Pq Va kern.boottime +A +.Li struct timeval +structure is returned. +This structure contains the time that the system was booted. +.It Dv KERN_CACHEPCT Pq Va kern.bufcachepercent +The maximum percentage of physical memory the buffer cache may use; +the default is 20%. +.It Dv KERN_CCPU Pq Va kern.ccpu +The scheduler exponential decay value. +.It Dv KERN_CLOCKRATE Pq Va kern.clockrate +A +.Li struct clockinfo +structure is returned. +This structure contains the clock, statistics clock and profiling clock +frequencies, the number of micro-seconds per hz tick, and the clock +skew rate. +.It Dv KERN_CONSDEV Pq Va kern.consdev +The console device. +.It Dv KERN_CPTIME Pq Va kern.cp_time +An array of longs of size +.Li CPUSTATES +is returned, containing statistics about the number of ticks spent by +the system in interrupt processing, user processes +.Po +.Xr nice 1 +or normal +.Pc , +system processing, or idling. +.It Dv KERN_CPTIME2 Pq Va kern.cp_time2 +Similar to +.Dv KERN_CPTIME , +but obtains information from only the single CPU specified by the +third level name given. +.It Dv KERN_DNSJACKPORT Pq Va kern.dnsjackport +When non-zero, the localhost port to which all DNS sockets should be +redirected. +.It Dv KERN_DOMAINNAME Pq Va kern.domainname +Get or set the YP domain name. +.It Dv KERN_FILE Pq Va kern.file +Return the entire file table, or a subset of it. +An array of +.Li struct kinfo_file +structures is returned, +whose size depends on the current number of selected files in the system. +The third and fourth level names are as follows: +.Bl -column "Third level name" "Fourth level is:" -offset indent +.It Sy "Third level name" Ta Sy "Fourth level is:" +.It Dv KERN_FILE_BYFILE Ta "A file type" +.It Dv KERN_FILE_BYPID Ta "A process ID" +.It Dv KERN_FILE_BYUID Ta "A user ID" +.El +.Pp +The fifth level name is the size of the +.Li struct kinfo_file +and the sixth level name is the number of structures to return. +.It Dv KERN_FORKSTAT Pq Va kern.forkstat +A +.Li struct forkstat +structure is returned. +This structure contains information about the number of +.Xr fork 2 , +.Xr vfork 2 , +and +.Xr __tfork 3 +system calls as well as kernel thread creations since system startup, +and the number of pages of virtual memory involved in each. +.It Dv KERN_FSCALE Pq Va kern.fscale +The kernel fixed-point scale factor. +.It Dv KERN_FSYNC Pq Va kern.fsync +Return 1 if the File Synchronisation Option is available on this system, +otherwise 0. +.It Dv KERN_GLOBAL_PTRACE Pq Va kern.global_ptrace +When set to 1, permit +.Xr ptrace 2 +to attach to any process with the appropriate privileges. +When set to 0, processes may only attach to their own descendants. +.It Dv KERN_HOSTID Pq Va kern.hostid +Get or set the host ID. +.It Dv KERN_HOSTNAME Pq Va kern.hostname +Get or set the hostname. +.It Dv KERN_JOB_CONTROL Pq Va kern.job_control +Return 1 if job control is available on this system, otherwise 0. +.It Dv KERN_MALLOCSTATS Pq Va kern.malloc +Return kernel memory bucket statistics. +The third level names are detailed below. +There are no changeable values in this branch. +.Bl -column "KERN_MALLOC_KMEMNAMES" "string" -offset indent +.It Sy "Third level name" Ta Sy "Type" +.It Dv KERN_MALLOC_BUCKET Ta "node" +.It Dv KERN_MALLOC_BUCKETS Ta "string" +.It Dv KERN_MALLOC_KMEMNAMES Ta "string" +.It Dv KERN_MALLOC_KMEMSTATS Ta "node" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv KERN_MALLOC_BUCKET.<size> Pq Va kern.malloc.bucket +A node containing the statistics for the memory bucket of the +specified size (in decimal notation, the number of bytes per bucket +element, e.g., 16, 32, 128). +Each node returns a +.Li struct kmembuckets . +.Pp +If a value is specified that does not correspond directly to a +bucket size, the statistics for the closest larger bucket size will be +returned instead. +.Pp +Note that bucket sizes are typically powers of 2. +.It Dv KERN_MALLOC_BUCKETS Pq Va kern.malloc.buckets +Return a comma-separated list of the bucket sizes used by the kernel. +.It Dv KERN_MALLOC_KMEMNAMES Pq Va kern.malloc.kmemnames +Return a comma-separated list of the names of the kernel +.Xr malloc 9 +types. +.It Dv KERN_MALLOC_KMEMSTATS Pq Va kern.malloc.kmemstat +A node containing the statistics for the memory types of the specified +name. +Each node returns a +.Li struct kmemstats . +.El +.It Dv KERN_MAXCLUSTERS Pq Va kern.maxclusters +The maximum number of +.Xr mbuf 9 +clusters that may be allocated. +.It Dv KERN_MAXFILES Pq Va kern.maxfiles +The maximum number of open files that may be open in the system. +.It Dv KERN_MAXLOCKSPERUID Pq Va kerb.maxlocksperuid +The maximum number of file locks per user; +the default is 1024. +.It Dv KERN_MAXPARTITIONS Pq Va kern.maxpartitions +The maximum number of partitions allowed per disk. +.It Dv KERN_MAXPROC Pq Va kern.maxproc +The maximum number of simultaneous processes the system will allow. +.It Dv KERN_MAXTHREAD Pq Va kern.maxthread +The maximum number of simultaneous threads the system will allow. +.It Dv KERN_MAXVNODES Pq Va kern.maxvnodes +The maximum number of vnodes available on the system. +.It Dv KERN_MBSTAT Pq Va kern.mbstat +A +.Li struct mbstat +structure is returned, containing statistics on +.Xr mbuf 9 +usage. +.It Dv KERN_MSGBUF Pq Va kern.msgbuf +Returns a buffer containing kernel log messages; +see +.Xr dmesg 8 . +.It Dv KERN_MSGBUFSIZE Pq Va kern.msgbufsize +The size of the kernel message buffer. +.It Dv KERN_NCHSTATS Pq Va kern.nchstats +A +.Li struct nchstats +structure is returned. +This structure contains information about the +filename to +.Xr inode 5 +mapping cache. +.It Dv KERN_NFILES Pq Va kern.nfiles +Number of open files. +.It Dv KERN_NGROUPS Pq Va kern.ngroups +The maximum number of supplemental groups. +.It Dv KERN_NOSUIDCOREDUMP Pq Va kern.nosuidcoredump +Whether a process may dump core after changing user or group ID: +.Bl -column "value" "condition" "current directory" +.It Sy "value" Ta Sy "condition" Ta Sy "dump core to" +.It 0 Ta "euid == 0" Ta "current directory" +.It 1 Ta "never" Ta "" +.It 2 Ta "always" Ta Pa "/var/crash" +.It 3 Ta "depends" Ta Pa "/var/crash/$programname/" +.El +.It Dv KERN_NPROCS Pq Va kern.nprocs +The number of entries in the kernel process table. +.It Dv KERN_NSELCOLL Pq Va kern.nselcoll +Number of +.Xr select 2 +collisions. +.It Dv KERN_NTHREADS Pq Va kern.nthreads +The number of entries in the kernel thread table. +.It Dv KERN_NUMVNODES Pq Va kern.numvnodes +Number of vnodes in use. +.It Dv KERN_OSRELEASE Pq Va kern.osrelease +The system release string. +.It Dv KERN_OSREV Pq Va kern.osrevision +The system revision number. +.It Dv KERN_OSTYPE Pq Va kern.ostype +The system type string. +.It Dv KERN_OSVERSION Pq Va kern.osversion +The kernel build version. +.It Dv KERN_POSIX1 Pq Va kern.posix1version +The version of ISO/IEC 9945 (POSIX 1003.1) with which the system +attempts to comply. +.It Dv KERN_PROC Pq Va kern.proc +Return the entire process table, or a subset of it. +An array of +.Li struct kinfo_proc +structures is returned, +whose size depends on the current number of selected processes in the system. +The third and fourth level names are as follows: +.Bl -column "KERN_PROC_SESSION" "Fourth level is:" -offset indent +.It Sy "Third level name" Ta Sy "Fourth level is:" +.It Dv KERN_PROC_ALL Ta "None" +.It Dv KERN_PROC_KTHREAD Ta "A kernel thread" +.It Dv KERN_PROC_PID Ta "A process ID" +.It Dv KERN_PROC_PGRP Ta "A process group" +.It Dv KERN_PROC_RUID Ta "A real user ID" +.It Dv KERN_PROC_SESSION Ta "A session PID" +.It Dv KERN_PROC_TTY Ta "A tty device" +.It Dv KERN_PROC_UID Ta "A user ID" +.El +.Pp +The fifth level name is the size of the +.Li struct kinfo_proc +and the sixth level name is the number of structures to return. +.It Dv KERN_PROC_ARGS Pq Va kern.procargs +Returns the arguments or environment of a process. +The third level name is the PID of the process. +The fourth level name is one of: +.Bl -column KERN_PROC_NARGV -offset indent +.It Dv KERN_PROC_ARGV +.It Dv KERN_PROC_ENV +.It Dv KERN_PROC_NARGV +.It Dv KERN_PROC_NENV +.El +.Pp +.Dv KERN_PROC_NARGV +and +.Dv KERN_PROC_NENV +return the number of elements as an +.Vt int +in the argv or env array. +.Dv KERN_PROC_ARGV +returns the argv array and +.Dv KERN_PROC_ENV +returns the environ array. +The buffer pointed to by +.Fa oldp +is filled with an array of char pointers +followed by the strings themselves. +The last char pointer is a +.Dv NULL +pointer. +.It Dv KERN_PROC_CWD Pq Va kern.proc_cwd +Return the current working directory of a process. +The third level name is the target process ID. +A NUL-terminated string is returned. +.It Dv KERN_PROC_NOBROADCASTKILL Pq Va kern.proc_nobroadcastkill +When set, a process will no longer be signaled when sending broadcast signals. +The third level name is the target process ID. +.It Dv KERN_PROC_VMMAP Pq Va kern.proc_vmmap +Return the entire process VM map entries. +An array of +.Li struct kinfo_vmentry +structures is returned, +whose size depends on the current number of VM map entries of the selected process. +Iteration is possible by setting the base address in the first element of +.Li struct kinfo_vmentry . +.It Dv KERN_PROF Pq Va kern.profiling +Return profiling information about the kernel. +If the kernel is not compiled for profiling, +attempts to retrieve any of the +.Dv KERN_PROF +values will fail with +.Er EOPNOTSUPP . +The third level names for the string and integer profiling information +are detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "Third level name" "struct gmonparam" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv GPROF_COUNT Ta "u_short[]" Ta "yes" +.It Dv GPROF_FROMS Ta "u_short[]" Ta "yes" +.It Dv GPROF_GMONPARAM Ta "struct gmonparam" Ta "no" +.It Dv GPROF_STATE Ta "integer" Ta "yes" +.It Dv GPROF_TOS Ta "struct tostruct" Ta "yes" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv GPROF_COUNT +Array of statistical program counter counts. +.It Dv GPROF_FROMS +Array indexed by program counter of call-from points. +.It Dv GPROF_GMONPARAM +Structure giving the sizes of the above arrays. +.It Dv GPROF_STATE +Returns +.Dv GMON_PROF_ON +or +.Dv GMON_PROF_OFF +to show that profiling is running or stopped. +.It Dv GPROF_TOS +Array of +.Li struct tostruct +describing destination of calls and their counts. +.El +.It Dv KERN_RAWPARTITION Pq Va kern.rawpartition +The raw partition of a disk (a == 0). +.It Dv KERN_SAVED_IDS Pq Va kern.saved_ids +Returns 1 if saved set-group-ID and saved set-user-ID are available. +.It Dv KERN_SECURELVL Pq Va kern.securelevel +The system security level. +This level may be raised by processes with appropriate privileges. +It may only be lowered by process 1. +.It Dv KERN_SEMINFO Pq Va kern.seminfo +Return the elements of +.Li struct seminfo . +If the kernel is not compiled with System V style semaphore support, +attempts to retrieve any of the +.Dv KERN_SEMINFO +values will fail with +.Er EOPNOTSUPP . +The third level names for the elements of +.Li struct seminfo +are detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "KERN_SEMINFO_SEMMNI" "integer" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv KERN_SEMINFO_SEMAEM Ta "integer" Ta "no" +.It Dv KERN_SEMINFO_SEMMNI Ta "integer" Ta "yes" +.It Dv KERN_SEMINFO_SEMMNS Ta "integer" Ta "yes" +.It Dv KERN_SEMINFO_SEMMNU Ta "integer" Ta "yes" +.It Dv KERN_SEMINFO_SEMMSL Ta "integer" Ta "yes" +.It Dv KERN_SEMINFO_SEMOPM Ta "integer" Ta "yes" +.It Dv KERN_SEMINFO_SEMUME Ta "integer" Ta "no" +.It Dv KERN_SEMINFO_SEMUSZ Ta "integer" Ta "no" +.It Dv KERN_SEMINFO_SEMVMX Ta "integer" Ta "no" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv KERN_SEMINFO_SEMAEM Pq Va kern.seminfo.semaem +The adjust on exit maximum value. +.It Dv KERN_SEMINFO_SEMMNI Pq Va kern.seminfo.semni +The maximum number of semaphore identifiers allowed. +.It Dv KERN_SEMINFO_SEMMNS Pq Va kern.seminfo.semmns +The maximum number of semaphores allowed in the system. +.It Dv KERN_SEMINFO_SEMMNU Pq Va kern.seminfo.semnu +The maximum number of semaphore undo structures allowed in the system. +.It Dv KERN_SEMINFO_SEMMSL Pq Va kern.seminfo.semmsl +The maximum number of semaphores allowed per ID. +.It Dv KERN_SEMINFO_SEMOPM Pq Va kern.seminfo.semopm +The maximum number of operations per +.Xr semop 2 +call. +.It Dv KERN_SEMINFO_SEMUME Pq Va kern.seminfo.semume +The maximum number of undo entries per process. +.It Dv KERN_SEMINFO_SEMUSZ Pq Va kern.seminfo.semusz +The size (in bytes) of the undo structure. +.It Dv KERN_SEMINFO_SEMVMX Pq Va kern.seminfo.semvmx +The semaphore maximum value. +.El +.It Dv KERN_SHMINFO Pq Va kern.shminfo +Return the elements of +.Li struct shminfo . +If the kernel is not compiled with System V style shared memory support, +attempts to retrieve any of the +.Dv KERN_SHMINFO +values will fail with +.Er EOPNOTSUPP . +The third level names for the elements of +.Li struct shminfo +are detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "KERN_SHMINFO_SHMMAX" "integer" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv KERN_SHMINFO_SHMALL Ta "integer" Ta "yes" +.It Dv KERN_SHMINFO_SHMMAX Ta "integer" Ta "yes" +.It Dv KERN_SHMINFO_SHMMIN Ta "integer" Ta "yes" +.It Dv KERN_SHMINFO_SHMMNI Ta "integer" Ta "yes" +.It Dv KERN_SHMINFO_SHMSEG Ta "integer" Ta "yes" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv KERN_SHMINFO_SHMALL Pq Va kern.shminfo.shmall +The maximum amount of total shared memory allowed in the system (in pages). +.It Dv KERN_SHMINFO_SHMMAX Pq Va kern.shminfo.shmmax +The maximum shared memory segment size (in bytes). +.It Dv KERN_SHMINFO_SHMMIN Pq Va kern.shminfo.shmmin +The minimum shared memory segment size (in bytes). +.It Dv KERN_SHMINFO_SHMMNI Pq Va kern.shminfo.shmmni +The maximum number of shared memory identifiers in the system. +.It Dv KERN_SHMINFO_SHMSEG Pq Va kern.shminfo.shmseg +The maximum number of shared memory segments per process. +.El +.It Dv KERN_SOMAXCONN Pq Va kern.somaxconn +Upper bound on the number of half-open connections a process can allow +to be associated with a socket, using +.Xr listen 2 . +The default value is 128. +.It Dv KERN_SOMINCONN Pq Va kern.sominconn +Lower bound on the number of half-open connections a process can allow +to be associated with a socket, using +.Xr listen 2 . +The default value is 80. +.It Dv KERN_SPLASSERT Pq Va kern.splassert +Modify the system interrupt priority level. +Valid values are: +.Pp +.Bl -tag -width 3n -offset indent -compact +.It 0 +Disable error checking. +.It 1 +Print a message if an error is detected. +.It 2 +Print a message if an error is detected, +and a stack trace if possible. +.It 3 +The same as 2, but also drop into the kernel debugger. +.El +.Pp +Any other value causes a system panic on errors. +See +.Xr splassert 9 +for more information. +.It Dv KERN_STACKGAPRANDOM Pq Va kern.stackgap_random +Sets the range of the random value added to the stack pointer on each +program execution. +The random value is added to make buffer overflow exploitation slightly +harder. +The bigger the number, the harder it is to brute force this added protection, +but it also means bigger waste of memory. +.It Li KERN_SYSVIPC_INFO Pq Va kern.sysvipc_info +Return System V style IPC configuration and run-time information. +The third level name selects the System V style IPC facility. +.Bl -column "KERN_SYSVIPC_MSG_INFO" "struct shm_sysctl_info" -offset indent +.It Sy "Third level name" Ta Sy "Type" +.It Dv KERN_SYSVIPC_MSG_INFO Ta "struct msg_sysctl_info" +.It Dv KERN_SYSVIPC_SEM_INFO Ta "struct sem_sysctl_info" +.It Dv KERN_SYSVIPC_SHM_INFO Ta "struct shm_sysctl_info" +.El +.Bl -tag -width "123456" +.It Dv KERN_SYSVIPC_MSG_INFO +Return information on the System V style message facility. +The +.Sy msg_sysctl_info +structure is defined in +.In sys/msg.h . +.It Dv KERN_SYSVIPC_SEM_INFO +Return information on the System V style semaphore facility. +The +.Sy sem_sysctl_info +structure is defined in +.In sys/sem.h . +.It Dv KERN_SYSVIPC_SHM_INFO +Return information on the System V style shared memory facility. +The +.Sy shm_sysctl_info +structure is defined in +.In sys/shm.h . +.El +.It Dv KERN_SYSVMSG Pq Va kern.sysvmsg +Returns 1 if System V style message queue functionality is available on this +system, otherwise 0. +.It Dv KERN_SYSVSEM Pq Va kern.sysvem +Returns 1 if System V style semaphore functionality is available on this +system, otherwise 0. +.It Dv KERN_SYSVSHM Pq Va kern.sysvshm +Returns 1 if System V style shared memory functionality is available on this +system, otherwise 0. +.It Dv KERN_TIMECOUNTER Pq Va kern.timecounter +Return statistics information about the kernel time counter. +The third level names information is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "KERN_TIMECOUNTER_TIMESTEPWARNINGS" "integer" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv KERN_TIMECOUNTER_CHOICE Ta "string" Ta "no" +.It Dv KERN_TIMECOUNTER_HARDWARE Ta "string" Ta "yes" +.It Dv KERN_TIMECOUNTER_TICK Ta "integer" Ta "no" +.It Dv KERN_TIMECOUNTER_TIMESTEPWARNINGS Ta "integer" Ta "yes" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv KERN_TIMECOUNTER_CHOICE Pq Va kern.timecounter.choice +Get the list of kernel time counter sources and their claimed +quality (higher is better). +.It Dv KERN_TIMECOUNTER_HARDWARE Pq Va kern.timecounter.hardware +Get or set the kernel time counter source by name. +.It Dv KERN_TIMECOUNTER_TICK Pq Va kern.timecounter.tick +Get the number of times we have reset the kernel time counter +information. +.It Dv KERN_TIMECOUNTER_TIMESTEPWARNINGS Pq Va kern.timecounter.timestepwarnings +Get or set a flag to log a message when the kernel time is +stepped. +.El +.It Dv KERN_TTY Pq Va kern.tty +Return statistics information about tty input/output. +The third level names information is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "KERN_TTY_TKRAWCC" "struct itty" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv KERN_TTY_INFO Ta "struct itty" Ta "no" +.It Dv KERN_TTY_TKCANCC Ta "int64_t" Ta "no" +.It Dv KERN_TTY_TKNIN Ta "int64_t" Ta "no" +.It Dv KERN_TTY_TKNOUT Ta "int64_t" Ta "no" +.It Dv KERN_TTY_TKRAWCC Ta "int64_t" Ta "no" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv KERN_TTY_INFO Pq Va kern.tty.ttyinfo +Returns an array of +.Li struct itty +structures containing tty statistics. +.It Dv KERN_TTY_TKCANCC Pq Va kern.tty.tk_cancc +Returns the number of input characters in canonical mode. +.It Dv KERN_TTY_TKNIN Pq Va kern.tty.tk_nin +Returns the number of input characters from a +.Xr tty 4 . +.It Dv KERN_TTY_TKNOUT Pq Va kern.tty.tk_nout +Returns the number of output characters on a +.Xr tty 4 . +.It Dv KERN_TTY_TKRAWCC Pq Va kern.tty.tk_rawcc +Returns the number of input characters in raw mode. +.El +.It Dv KERN_TTYCOUNT Pq Va kern.ttycount +Number of available +.Xr tty 4 +devices. +.It Dv KERN_VERSION Pq Va kern.version +The system version string. +.It Dv KERN_WATCHDOG Pq Va kern.watchdog +Return information on hardware watchdog timers. +If the kernel does not support a hardware watchdog timer, +attempts to retrieve or set any of the +.Dv KERN_WATCHDOG +values will fail with +.Er EOPNOTSUPP . +.Bl -column "KERN_WATCHDOG_PERIOD" "integer" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv KERN_WATCHDOG_AUTO Ta "integer" Ta "yes" +.It Dv KERN_WATCHDOG_PERIOD Ta "integer" Ta "yes" +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Dv KERN_WATCHDOG_AUTO Pq Va kern.watchdog.auto +If set to 1, the kernel refreshes the watchdog timer periodically. +If set to 0, a userland process must ensure that the watchdog timer +gets refreshed by setting the +.Dv KERN_WATCHDOG_PERIOD +variable. +.It Dv KERN_WATCHDOG_PERIOD Pq Va kern.watchdog.period +The period of the watchdog timer in seconds. +Set to 0 to disable the watchdog timer. +.El +.It Dv KERN_WXABORT Pq Va kern.wxabort +Generate an abort, +rather than returning an error, +on W^X violation. +.El +.Ss CTL_MACHDEP +The set of variables defined is architecture dependent. +Most architectures define at least the following variables. +.Bl -column "Second level name" "dev_t" "Changeable" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv CPU_CONSDEV Ta "dev_t" Ta "no" +.El +.Pp +Consult the example file +.Pa /etc/examples/sysctl.conf +for a non-exhaustive list of +.Li machdep +variables. +.Ss CTL_NET +The string and integer information available for the +.Dv CTL_NET +level is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "Second level name" "routing messages" "Changeable" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv PF_ROUTE Ta "routing messages" Ta "no" +.It Dv PF_INET Ta "IPv4 values" Ta "yes" +.It Dv PF_INET6 Ta "IPv6 values" Ta "yes" +.It Dv PF_KEY Ta "key management" Ta "no" +.It Dv PF_MPLS Ta "MPLS values" Ta "yes" +.It Dv PF_PIPEX Ta "PIPEX values" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv PF_ROUTE +Return the entire routing table or a subset of it. +The data is returned as a sequence of routing messages (see +.Xr route 4 +for the header file, format, and meaning). +The length of each message is contained in the message header. +.Pp +The third level name is a protocol number, which is currently always 0. +The fourth level name is an address family, which may be set to 0 to +select all address families. +The fifth and sixth level names are as follows: +.Bl -column "Fifth level name" "Sixth level is:" -offset indent +.It Sy "Fifth level name" Ta Sy "Sixth level is:" +.It Dv NET_RT_DUMP Ta "priority" +.It Dv NET_RT_FLAGS Ta "rtflags" +.It Dv NET_RT_IFLIST Ta "None" +.It Dv NET_RT_IFNAMES Ta "None" +.It Dv NET_RT_STATS Ta "None" +.El +.Bl -tag -width "123456" +.It Li NET_RT_DUMP +If set to 0, show all routes. +If set to any number, show all routes with that number priority. +If set to a negative number, show routes that do not have the positive +priority value. +.El +.Pp +An optional seventh level name can be provided to select the routing table +on which to run the operation. +If not provided, the table with ID 0 is used. +.It Dv PF_INET +Get or set various global information about IPv4 +.Pq Internet Protocol version 4 . +The third level name is the protocol. +The fourth level name is the variable name. +The currently defined protocols and names are: +.Bl -column "Protocol name" "ipsec-expire-acquire" "structure" "Changeable" -offset 2n +.It Sy "Protocol name" Ta Sy "Variable name" Ta Sy "Type" Ta Sy "Changeable" +.It ah Ta enable Ta integer Ta yes +.It bpf Ta bufsize Ta integer Ta yes +.It bpf Ta maxbufsize Ta integer Ta yes +.It carp Ta allow Ta integer Ta yes +.It carp Ta log Ta integer Ta yes +.It carp Ta preempt Ta integer Ta yes +.It divert Ta recvspace Ta integer Ta yes +.It divert Ta sendspace Ta integer Ta yes +.It esp Ta enable Ta integer Ta yes +.It esp Ta udpencap Ta integer Ta yes +.It esp Ta udpencap_port Ta integer Ta yes +.It etherip Ta allow Ta integer Ta yes +.It gre Ta allow Ta integer Ta yes +.It gre Ta wccp Ta integer Ta yes +.It icmp Ta bmcastecho Ta integer Ta yes +.It icmp Ta errppslimit Ta integer Ta yes +.It icmp Ta maskrepl Ta integer Ta yes +.It icmp Ta rediraccept Ta integer Ta yes +.It icmp Ta redirtimeout Ta integer Ta yes +.It icmp Ta stats Ta structure Ta no +.It icmp Ta tstamprepl Ta integer Ta yes +.It ip Ta arpdown Ta integer Ta yes +.It ip Ta arptimeout Ta integer Ta yes +.It ip Ta directed-broadcast Ta integer Ta yes +.It ip Ta encdebug Ta integer Ta yes +.It ip Ta forwarding Ta integer Ta yes +.It ip Ta ifq Ta node Ta "N/A" +.It ip Ta ipsec-allocs Ta integer Ta yes +.It ip Ta ipsec-auth-alg Ta string Ta yes +.It ip Ta ipsec-bytes Ta integer Ta yes +.It ip Ta ipsec-comp-alg Ta string Ta yes +.It ip Ta ipsec-enc-alg Ta string Ta yes +.It ip Ta ipsec-expire-acquire Ta integer Ta yes +.It ip Ta ipsec-firstuse Ta integer Ta yes +.It ip Ta ipsec-invalid-life Ta integer Ta yes +.It ip Ta ipsec-pfs Ta integer Ta yes +.It ip Ta ipsec-soft-allocs Ta integer Ta yes +.It ip Ta ipsec-soft-bytes Ta integer Ta yes +.It ip Ta ipsec-soft-firstuse Ta integer Ta yes +.It ip Ta ipsec-soft-timeout Ta integer Ta yes +.It ip Ta ipsec-timeout Ta integer Ta yes +.It ip Ta maxqueue Ta integer Ta yes +.It ip Ta mforwarding Ta integer Ta yes +.It ip Ta mtudisc Ta integer Ta yes +.It ip Ta mtudisctimeout Ta integer Ta yes +.It ip Ta multipath Ta integer Ta yes +.It ip Ta portfirst Ta integer Ta yes +.It ip Ta porthifirst Ta integer Ta yes +.It ip Ta porthilast Ta integer Ta yes +.It ip Ta portlast Ta integer Ta yes +.It ip Ta redirect Ta integer Ta yes +.It ip Ta sourceroute Ta integer Ta yes +.It ip Ta stats Ta structure Ta no +.It ip Ta ttl Ta integer Ta yes +.It ipcomp Ta enable Ta integer Ta yes +.It ipip Ta allow Ta integer Ta yes +.It mobileip Ta allow Ta integer Ta yes +.It tcp Ta ackonpush Ta integer Ta yes +.It tcp Ta always_keepalive Ta integer Ta yes +.It tcp Ta baddynamic Ta array Ta yes +.It tcp Ta ecn Ta integer Ta yes +.It tcp Ta ident Ta structure Ta no +.It tcp Ta keepidle Ta integer Ta yes +.It tcp Ta keepinittime Ta integer Ta yes +.It tcp Ta keepintvl Ta integer Ta yes +.It tcp Ta mssdflt Ta integer Ta yes +.It tcp Ta reasslimit Ta integer Ta yes +.It tcp Ta rfc1323 Ta integer Ta yes +.It tcp Ta rfc3390 Ta integer Ta yes +.It tcp Ta rootonly Ta array Ta yes +.It tcp Ta rstppslimit Ta integer Ta yes +.It tcp Ta sack Ta integer Ta yes +.It tcp Ta slowhz Ta integer Ta no +.It tcp Ta stats Ta structure Ta no +.It tcp Ta synbucketlimit Ta integer Ta yes +.It tcp Ta syncachelimit Ta integer Ta yes +.It tcp Ta synhashsize Ta integer Ta yes +.It tcp Ta synuselimit Ta integer Ta yes +.It udp Ta baddynamic Ta array Ta yes +.It udp Ta checksum Ta integer Ta yes +.It udp Ta recvspace Ta integer Ta yes +.It udp Ta rootonly Ta array Ta yes +.It udp Ta sendspace Ta integer Ta yes +.It udp Ta stats Ta structure Ta no +.El +.Pp +The variables are as follows: +.Bl -tag -width "123456" +.It Li ah.enable Pq Va net.inet.ah.enable +If set to 1, enable the Authentication Header +.Pq AH +IPsec protocol. +Enabled by default. +See +.Xr ipsec 4 +for more information. +.It Li bpf.bufsize Pq Va net.bpf.bufsize +The initial size of +.Xr bpf 4 +buffers. +.It Li bpf.maxbufsize Pq Va net.bpf.maxbufsize +The maximum size a user may request a +.Xr bpf 4 +buffer to be. +.It Li carp.allow Pq Va net.inet.carp.allow +If set to 0, incoming +.Xr carp 4 +packets will not be processed. +If set to any other value, processing will occur. +Enabled by default. +.It Li carp.log Pq Va net.inet.carp.log +Controls the verbosity of +.Xr carp 4 +logging. +May be a value between 0 and 7 corresponding with +.Xr syslog 3 +priorities. +The default value is 2. +.It Li carp.preempt Pq Va net.inet.carp.preempt +If set to 0, +.Xr carp 4 +will not attempt to become master if it is receiving advertisements from +another active master. +If set to any other value, carp will become master of the virtual host if it +believes it can send advertisements more frequently than the current master. +Disabled by default. +.It Li divert.recvspace Pq Va net.inet.divert.recvspace +Returns the default divert receive buffer size. +.It Li divert.sendspace Pq Va net.inet.divert.sendspace +Returns the default divert send buffer size. +.It Li esp.enable Pq Va net.inet.esp.enable +If set to 1, enable the Encapsulating Security Payload +.Pq ESP +IPsec protocol. +Enabled by default. +See +.Xr ipsec 4 +for more information. +.It Li esp.udpencap Pq Va net.inet.esp.udpencap +If set to 1, enable processing of UDP encapsulated ESP packets. +Enabled by default. +.It Li esp.udpencap_port Pq Va net.inet.udpencap_port +Contains the value of the UDP port that triggers +decapsulation for incoming UDP encapsulated ESP packets. +The default port is 4500. +.It Li etherip.allow Pq Va net.inet.etherip.allow +If set to 0, incoming Ethernet-in-IPv4 packets will not be processed. +If set to any other value, processing will occur. +.It Li gre.allow Pq Va net.inet.gre.allow +If set to 0, incoming GRE packets will not be processed. +If set to any other value, processing will occur. +.It Li gre.wccp Pq Va net.inet.gre.wccp +If set to 0, incoming WCCPv1-style GRE packets will not be processed. +If set to any other value, and gre.allow allows GRE packet processing, +WCCPv1-style GRE packets will be processed. +.It Li icmp.bmcastecho Pq Va net.inet.icmp.bmcastecho +If set to 1, respond to ICMP echo requests destined for +broadcast and multicast addresses. +Note, enabling this could open a system to a type of denial of service attack +called +.Qq smurfing , +and is thus not advised. +.It Li icmp.errppslimit Pq Va net.inet.icmp.errppslimit +This variable specifies the maximum number of outgoing ICMP error messages +per second. +ICMP error messages exceeding this value are subject to rate limitation +and will not go out from the node. +A negative value disables rate limitation. +.It Li icmp.maskrepl Pq Va kern.inet.icmp.maskrepl +Returns 1 if ICMP network mask requests are to be answered. +.It Li icmp.rediraccept Pq Va kern.inet.icmp.rediraccept +If set to non-zero, the host will accept ICMP redirect packets. +Note that routers will never accept ICMP redirect packets, +and the variable is meaningful on IP hosts only. +.It Li icmp.redirtimeout Pq Va net.inet.icmp.redrttimeout +This variable specifies the lifetime of routing entries generated by incoming +ICMP redirects. +The default timeout is 10 minutes. +.It Li icmp.stats Pq Va kern.inet.icmp.stats +Returns the ICMP statistics in a struct icmpstat. +.It Li icmp.tstamprepl Pq Va net.inet.icmp.tstamprepl +If set to 1, reply to ICMP timestamp requests. +If set to 0, ignore timestamp requests. +.It Li ip.arpdown Pq Va net.inet.ip.arpdown +Lifetime of unresolved ARP entries, in seconds. +.It Li ip.arptimeout Pq Va net.inet.ip.arptimeout +Lifetime of resolved ARP entries, in seconds. +.It Li ip.directed-broadcast Pq Va net.inet.ip.directed-broadcast +Returns 1 if directed broadcast behavior is enabled for the host. +.It Li ip.encdebug Pq Va net.inet.ip.encdebug +Returns 1 when error message reporting is enabled for the host. +If the kernel has been compiled with the +.Dv ENCDEBUG +option, +then debugging information will also be reported when this variable is set. +.It Li ip.forwarding Pq Va net.inet.ip.forwarding +If set to 1, then IP forwarding is enabled for the host, +indicating the host is acting as a router. +If set to 2, then IP forwarding is restricted to traffic that has been +IPsec encapsulated or decapsulated by the host. +The default value is 0. +.It Li ip.ifq +Fifth level comprises an array of +.Li struct ifqueue +structures containing information about IP packet input queue. +The fifth level names for the elements of +.Li struct ifqueue +are detailed below. +.Bl -column "Fifth level name" "integer" "Changeable" -offset indent +.It Sy "Fifth level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv IFQCTL_DROPS Ta "integer" Ta "no" +.It Dv IFQCTL_LEN Ta "integer" Ta "no" +.It Dv IFQCTL_MAXLEN Ta "integer" Ta "yes" +.El +.Pp +The variables are as follows: +.Pp +.Bl -tag -width Ds -compact +.It Dv IFQCTL_DROPS Pq Va net.inet.ip.ifq.drops +Returns number of packet dropped. +.It Dv IFQCTL_LEN Pq Va net.inet.ip.ifq.len +Returns the current queue length. +.It Dv IFQCTL_MAXLEN Pq Va net.inet.ip.ifq.maxlen +Get or set the maximum number of queue length. +.El +.It Li ip.ipsec-allocs Pq Va net.inet.ip.ipsec-allocs +The number of IPsec flows that can use a security association before +it expires. +If set to less than or equal to zero, the security association will not +expire because of this counter. +The default value is 0. +.It Li ip.ipsec-auth-alg Pq Va net.inet.ip.ipsec-auth-alg +This is the default authentication algorithm the kernel will instruct +key management daemons to negotiate when establishing security +associations on behalf of the kernel. +Such security associations can occur as a result of a process having +requested some security level through +.Xr setsockopt 2 , +or as a result of dynamic VPN entries. +Supported values are hmac-md5, hmac-sha1, and hmac-ripemd160. +If set to any other value, it is left to the key management daemons to +select an authentication algorithm for the security association. +The default value is hmac-sha1. +.It Li ip.ipsec-bytes Pq Va net.inet.ip.ipsec-bytes +The number of bytes that will be processed by a security association +before it expires. +If set to less than or equal to zero, the security association will not +expire because of this counter. +The default value is 0. +.It Li ip.ipsec-comp-alg Pq Va net.inet.ip.ipsec-comp-alg +The compression algorithm to use with an IP Compression Association +.Pq IPCA . +Possible values are +.Dq deflate +and +.Dq lzs . +Note that lzs is only available with +.Xr hifn 4 . +See +.Xr ipsecctl 8 +for more information. +.It Li ip.ipsec-enc-alg Pq Va net.inet.ip.ipsec-enc-alg +This is the default encryption algorithm the kernel will instruct key +management daemons to negotiate when establishing security +associations on behalf of the kernel. +Such security associations can occur as a result of a process having +requested some security level through +.Xr setsockopt 2 , +or as a result of dynamic VPN entries. +Supported values are aes, des, 3des, blowfish and cast128. +If set to any other value, it is left to the key management daemons to +select an encryption algorithm for the security association. +The default value is aes. +.It Li ip.ipsec-expire-acquire Pq Va net.inet.ip.ipsec-expire-acquire +How long the kernel should allow key management to dynamically acquire +security associations before re-sending a request. +The default value is 30 seconds. +.It Li ip.ipsec-firstuse Pq Va net.inet.ip.ipsec-firstuse +The number of seconds after a security association is first used before +it expires. +If set to less than or equal to zero, the security association will +not expire because of this timer. +The default value is 7200 seconds. +.It Li ip.ipsec-invalid-life Pq Va net.inet.ip.ipsec-invalid-life +The lifetime of embryonic Security Associations (SAs that key management +daemons have reserved but not fully established yet) in seconds. +If set to less than or equal to zero, embryonic SAs will not expire. +The default value is 60. +.It Li ip.ipsec-pfs Pq Va net.inet.ip.ipsec-pfs +If set to any non-zero value, the kernel will ask the key management +daemons to use Perfect Forward Secrecy when establishing IPsec +Security Associations. +Perfect Forward Secrecy makes IPsec Security Associations +cryptographically distinct from each other, such that breaking the key +for one such SA does not compromise any others. +Requiring PFS for every security association significantly increases the +computational load of +.Xr isakmpd 8 +exchanges. +The default value is 1. +.It Li ip.ipsec-soft-allocs Pq Va net.inet.ip.ipsec-soft-allocs +The number of IPsec flows that can use a security association before a +message is sent by the kernel to key management for renegotiation +of the security association. +If set to less than or equal to zero, no message is sent to key +management. +The default value is 0. +.It Li ip.ipsec-soft-bytes Pq Va net.inet.ip.ipsec-soft-bytes +The number of bytes that will be processed by a security association +before a message is sent by the kernel to key management for +renegotiation of the security association. +If set to less than or equal to zero, no message is sent to key +management. +The default value is 0. +.It Li ip.ipsec-soft-firstuse Pq Va net.inet.ip.ipsec-soft-firstuse +The number of seconds after a security association is first used +before a message is sent by the kernel to key management for +renegotiation of the security association. +If set to less than or equal to zero, no message is sent to key +management. +The default value is 3600 seconds. +.It Li ip.ipsec-soft-timeout Pq Va net.inet.ip.ipsec-soft-timeout +The number of seconds after a security association is established +before a message is sent by the kernel to key management for +renegotiation of the security association. +If set to less than or equal to zero, no message is sent to key +management. +The default value is 80000 seconds. +.It Li ip.ipsec-timeout Pq Va net.inet.ip.ipsec-timeout +The number of seconds after a security association is established +before it will expire. +If set to less than or equal to zero, the security association will +not expire because of this timer. +The default value is 86400 seconds. +.It Li ip.maxqueue Pq Va net.inet.ip.maxqueue +Fragment flood protection. +Sets the maximum number of unassembled IP fragments in the fragment queue. +.It Li ip.mforwarding Pq Va net.inet.ip.mforwarding +If set to 1, then multicast forwarding is enabled for the host. +The default is 0. +.It Li ip.mtudisc Pq Va net.inet.ip.mtudisc +Returns 1 if Path MTU Discovery is enabled. +.It Li ip.mtudisctimeout Pq Va net.inet.ip.mtudisctimeout +Number of seconds in which a route added by the Path MTU +Discovery engine will time out. +When the route times out, the Path MTU Discovery engine will attempt +to probe a larger path MTU. +.It Li ip.multipath Pq Va net.inet.ip.multipath +This variable enables multipath routing for IPv4 addresses. +If set to 0, only the first route selected will be used for a given +destination regardless of how many routes exist in the routing table. +.It Li ip.portfirst Pq Va net.inet.ip.portfirst +Minimum registered port number for TCP/UDP port allocation. +Registered ports can be used by ordinary user processes +or programs executed by ordinary users. +Cannot be less than 1024 or greater than 49151. +Must be less than ip.portlast. +.It Li ip.porthifirst Pq Va net.inet.ip.porthifirst +Minimum dynamic/private port number for TCP/UDP port allocation. +Dynamic/private ports can be used by ordinary user processes +or programs executed by ordinary users. +Cannot be less than 49152 or greater than 65535. +Must be less than ip.porthilast. +.It Li ip.porthilast Pq Va net.inet.ip.porthilast +Maximum dynamic/private port number for TCP/UDP port allocation. +Dynamic/private ports can be used by ordinary user processes +or programs executed by ordinary users. +Cannot be less than 49152 or greater than 65535. +Must be greater than ip.porthifirst. +.It Li ip.portlast Pq Va net.inet.ip.portlast +Maximum registered port number for TCP/UDP port allocation. +Registered ports can be used by ordinary user processes +or programs executed by ordinary users. +Cannot be less than 1024 or greater than 49151. +Must be greater than ip.portfirst. +.It Li ip.redirect Pq Va net.inet.ip.redirect +Returns 1 when ICMP redirects may be sent by the host. +This option is ignored unless the host is routing IP packets, +and should normally be enabled on all systems. +.It Li ip.sourceroute Pq Va net.inet.ip.sourceroute +Returns 1 when forwarding of source-routed packets is enabled for +the host. +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be changed. +.It Li ip.stats Pq Va net.inet.ip.stats +Returns the IP statistics in a struct ipstat. +.It Li ip.ttl Pq Va net.inet.ip.ttl +The maximum time-to-live (hop count) value for an IP packet +sourced by the system. +This value applies to normal transport protocols, not to ICMP. +.It Li ipcomp.enable Pq Va net.inet.ipcomp.enable +Enable the IPComp protocol. +See +.Xr ipsecctl 8 +for more information. +.It Li ipip.allow Pq Va net.inet.ipip.allow +If set to 0, incoming IP-in-IP packets will not be processed. +If set to any other value, processing will occur; furthermore, if set +to 2, no checks for spoofing of loopback addresses will be done. +This is useful only for debugging purposes, and should never be used +in production systems. +.It Li mobileip.allow Pq Va net.inet.mobileip.allow +If set to 0, incoming Mobile IP encapsulated packets (RFC 2004) will not be +processed. +If set to any other value, processing will occur. +.It Li tcp.ackonpush Pq Va net.inet.tcp.ackonpush +Returns 1 if TCP segments with the +.Dv TH_PUSH +flag set are being acknowledged immediately, otherwise 0. +.It Li tcp.baddynamic Pq Va net.inet.tcp.baddynamic +An array of +.Li in_port_t +is returned specifying the bitmask of TCP ports between 512 +and 1023 inclusive that should not be allocated dynamically +by the kernel (i.e., they must be bound specifically by port number). +.It Li tcp.ecn Pq Va net.inet.tcp.ecn +Returns 1 if Explicit Congestion Notifications for TCP are enabled. +.It Li tcp.ident Pq Va net.inet.tcp.ident +A +.Li struct tcp_ident_mapping +specifying a local and foreign endpoint of a TCP +socket is filled in with the effective and real UIDs of the process that +owns the socket. +If no such socket exists, then the effective and real UID values are +both set to \-1. +.It Li tcp.keepidle Pq Va net.inet.tcp.keepidle +If the socket option +.Dv SO_KEEPALIVE +has been set on a socket, then this value specifies how much time a +connection needs to be idle before keepalives are sent. +See also tcp.slowhz. +.It Li tcp.keepinittime Pq Va net.inet.tcp.keepinittime +Time to keep alive the initial SYN packet of a TCP handshake. +.It Li tcp.keepintvl Pq Va net.inet.tcp.keepintvl +Time after a keepalive probe is sent until, in the absence of any response, +another probe is sent. +See also tcp.slowhz. +.It Li tcp.always_keepalive Pq Va net.inet.tcp.always_keepalive +Act as if the option +.Dv SO_KEEPALIVE +was set on all TCP sockets. +.It Li tcp.mssdflt Pq Va net.inet.tcp.mssdflt +The maximum segment size that is used as default for non-local connections. +The default value is 512. +.It Li tcp.reasslimit Pq Va net.inet.tcp.reasslimit +The maximum number of out-of-order TCP +segments the system will store for reassembly. +.It Li tcp.rfc1323 Pq Va net.inet.tcp.rfc1323 +Returns 1 if RFC 1323 extensions to TCP are enabled. +.It Li tcp.rfc3390 Pq Va net.inet.tcp.rfc3390 +Returns 1 if the TCP Initial Window +is increased to 4 * MSS or 4380 bytes, as specified in RFC 3390. +Returns 2 if the TCP Initial Window +is increased to 10 * MSS or 14600 bytes, as specified in +RFC 6928. +.It Li tcp.rootonly Pq Va net.inet.tcp.rootonly +An array of +.Li in_port_t +is returned specifying the bitmask of TCP ports +that can only be bound by processes with root euid. +When running with a +.Xr securelevel 7 +greater than 0, +this variable may not be changed. +.It Li tcp.rstppslimit Pq Va net.inet.tcp.rstppslimit +This variable specifies the maximum number of outgoing TCP RST packets +per second. +TCP RST packets exceeding this value are subject to rate limitation +and will not go out from the node. +A negative value disables rate limitation. +.It Li tcp.sack Pq Va net.inet.tcp.sack +Returns 1 if RFC 2018 Selective Acknowledgements are enabled. +.It Li tcp.slowhz Pq Va net.inet.tcp.slowhz +The units for tcp.keepidle and tcp.keepintvl; those variables are in ticks +of a clock that ticks tcp.slowhz times per second. +(That is, their values must be divided by the tcp.slowhz value to get times +in seconds.) +.It Li tcp.stats Pq Va net.inet.tcp.stats +Returns the TCP statistics in a struct tcpstat. +.It Li tcp.synbucketlimit Pq Va net.inet.tcp.synbucketlimit +The maximum number of entries allowed per hash bucket in the TCP SYN cache. +.It Li tcp.syncachelimit Pq Va net.inet.tcp.syncachelimit +The maximum number of entries allowed in the TCP SYN cache. +.It Li tcp.synhashsize Pq Va net.inet.tcp.synhashsize +The number of buckets in the TCP SYN cache hash array. +After the value is set, the actual size changes when the alternative +SYN cache becomes empty and both SYN caches are swapped. +.It Li tcp.synuselimit Pq Va net.inet.tcp.synuselimit +The minimum number of times the hash function for the TCP SYN cache is used +before it is reseeded. +.It Li udp.baddynamic Pq Va net.inet.udp.baddynamic +Analogous to +.Li tcp.baddynamic +but for UDP sockets. +.It Li udp.checksum Pq Va net.inet.udp.checksum +Returns 1 when UDP checksums are being computed and checked. +Disabling UDP checksums is strongly discouraged. +.It Li udp.recvspace Pq Va net.inet.udp.recvspace +Returns the default UDP receive buffer size. +.It Li udp.rootonly Pq Va net.inet.udp.rootonly +Analogous to +.Li tcp.rootonly +but for UDP sockets. +.It Li udp.sendspace Pq Va net.inet.udp.sendspace +Returns the default UDP send buffer size. +.It Li udp.stats Pq Va net.inet.udp.stats +Returns the UDP statistics in a struct udpstat. +.El +.It Dv PF_INET6 +Get or set various global information about IPv6 +.Pq Internet Protocol version 6 . +The third level name is the protocol. +The fourth level name is the variable name. +The currently defined protocols and names are: +.Bl -column "Protocol name" "multicast_mtudisc" "integer" "yes" -offset indent +.It Sy "Protocol name" Ta Sy "Variable name" Ta Sy "Type" Ta Sy "Changeable" +.It icmp6 Ta errppslimit Ta integer Ta yes +.It icmp6 Ta mtudisc_hiwat Ta integer Ta yes +.It icmp6 Ta mtudisc_lowat Ta integer Ta yes +.It icmp6 Ta nd6_debug Ta integer Ta yes +.It icmp6 Ta nd6_delay Ta integer Ta yes +.It icmp6 Ta nd6_maxnudhint Ta integer Ta yes +.It icmp6 Ta nd6_mmaxtries Ta integer Ta yes +.It icmp6 Ta nd6_umaxtries Ta integer Ta yes +.It icmp6 Ta redirtimeout Ta integer Ta yes +.It ip6 Ta auto_flowlabel Ta integer Ta yes +.It ip6 Ta dad_count Ta integer Ta yes +.It ip6 Ta dad_pending Ta integer Ta yes +.It ip6 Ta defmcasthlim Ta integer Ta yes +.It ip6 Ta forwarding Ta integer Ta yes +.It ip6 Ta hdrnestlimit Ta integer Ta yes +.It ip6 Ta hlim Ta integer Ta yes +.It ip6 Ta ifq Ta node Ta "N/A" +.It ip6 Ta log_interval Ta integer Ta yes +.It ip6 Ta maxdynroutes Ta integer Ta yes +.It ip6 Ta maxfragpackets Ta integer Ta yes +.It ip6 Ta maxfrags Ta integer Ta yes +.It ip6 Ta mforwarding Ta integer Ta yes +.It ip6 Ta mtudisctimeout Ta integer Ta yes +.It ip6 Ta multicast_mtudisc Ta integer Ta yes +.It ip6 Ta multipath Ta integer Ta yes +.It ip6 Ta neighborgcthresh Ta integer Ta yes +.It ip6 Ta redirect Ta integer Ta yes +.It ip6 Ta use_deprecated Ta integer Ta yes +.El +.Pp +The variables are as follows: +.Pp +.Bl -tag -width "123456" -compact +.It Li icmp6.errppslimit Pq Va net.inet6.icmp6.errppslimit +This variable specifies the maximum number of outgoing ICMPv6 error messages +per second. +ICMPv6 error messages exceeding this value are subject to rate limitation +and will not go out from the node. +A negative value will disable the rate limitation. +.Pp +.It Li icmp6.mtudisc_hiwat Pq Va net.inet6.icmp6.mtudisc_hiwat +.It Li icmp6.mtudisc_lowat Pq Va net.inet6.icmp6.mtudisc_lowat +These variables define the maximum number of routing table entries +created due to path MTU discovery +.Pq preventing denial-of-service attacks with ICMPv6 too big messages . +After IPv6 path MTU discovery happens, path MTU information is kept in +the routing table. +If the number of routing table entries exceeds this value, +the kernel will not attempt to keep the path MTU information. +.Li icmp6.mtudisc_hiwat +is used when we have verified ICMPv6 too big messages. +.Li icmp6.mtudisc_lowat +is used when we have unverified ICMPv6 too big messages. +Verification is performed by using address/port pairs kept in connected PCBs. +A negative value disables the upper limit. +.Pp +.It Li icmp6.nd6_debug Pq Va net.inet6.icmp6.nd6_debug +If set to non-zero, IPv6 neighbor discovery will generate debugging +messages. +The debug output is useful for diagnosing IPv6 interoperability issues. +The flag must be set to 0 for normal operation. +.Pp +.It Li icmp6.nd6_delay Pq Va net.inet6.icmp6.nd6_delay +This variable specifies the +.Dv DELAY_FIRST_PROBE_TIME +timing constant in IPv6 neighbor discovery specification +.Pq RFC 4861 , +in seconds. +.Pp +.It Li icmp6.nd6_maxnudhint Pq Va net.inet6.icmp6.nd6_maxnudhint +IPv6 neighbor discovery permits upper layer protocols to supply reachability +hints, to avoid unnecessary neighbor discovery exchanges. +This variable defines the number of consecutive hints the neighbor discovery +layer will take. +For example, by setting the variable to 3, neighbor discovery will take +a maximum of 3 consecutive hints. +After receiving 3 hints, the neighbor discovery layer will instead perform +the normal neighbor discovery process. +.Pp +.It Li icmp6.nd6_mmaxtries Pq Va net.inet6.icmp6.nd6_mmaxtries +This variable specifies the +.Dv MAX_MULTICAST_SOLICIT +constant in IPv6 neighbor discovery specification +.Pq RFC 4861 . +.Pp +.It Li icmp6.nd6_umaxtries Pq Va net.inet6.icmp6.nd6_umaxtries +This variable specifies the +.Dv MAX_UNICAST_SOLICIT +constant in IPv6 neighbor discovery specification +.Pq RFC 4861 . +.Pp +.It Li icmp6.redirtimeout Pq Va net.inet6.icmp6.redirtimeout +The variable specifies the lifetime of routing entries generated by +incoming ICMPv6 redirects. +.Pp +.It Li ip6.auto_flowlabel Pq Va net.inet6.ip6.auto_flowlabel +On connected transport protocol packets, +fill the IPv6 flowlabel field to help intermediate routers identify +packet flows. +.Pp +.It Li ip6.dad_count Pq Va net.inet6.ip6.dad_count +This variable configures the number of IPv6 DAD +.Pq duplicated address detection +probe packets. +These packets are generated when IPv6 interfaces are first brought up. +.Pp +.It Li ip6.dad_pending Pq Va net.inet6.ip6.dad_pending +This variable displays the number of pending IPv6 DAD +.Pq duplicated address detection +before completion. +It is used to make sure that DAD is completed before +.Xr netstart 8 +is executed. +.Pp +.It Li ip6.defmcasthlim Pq Va net.inet6.ip6.defmcasthlim +The default hop limit value for an IPv6 multicast packet sourced by the node. +This value applies to all the transport protocols on top of IPv6. +Methods for overriding this value are documented in +.Xr ip6 4 . +.Pp +.It Li ip6.forwarding Pq Va net.inet6.ip6.forwarding +Returns 1 when IPv6 forwarding is enabled for the node, +meaning that the node is acting as a router. +Returns 0 when IPv6 forwarding is disabled for the node, +meaning that the node is acting as a host. +Note that IPv6 defines node behavior for the +.Dq router +and +.Dq host +cases quite differently, and changing this variable during operation +may cause serious trouble. +Hence, this variable should only be set at bootstrap time. +.Pp +.It Li ip6.hdrnestlimit Pq Va net.inet6.ip6.hdrnestlimit +The number of IPv6 extension headers permitted on incoming IPv6 packets. +If set to 0, the node will accept as many extension headers as possible. +.Pp +.It Li ip6.hlim Pq Va net.inet6.ip6.hlim +The default hop limit value for an IPv6 unicast packet sourced by the node. +This value applies to all the transport protocols on top of IPv6. +Methods for overriding this value are documented in +.Xr ip6 4 . +.Pp +.It Li ip6.ifq Pq Va net.inet6.ip6.ifq +Fifth level comprises an array of +.Li struct ifqueue +structures containing information about IPv6 packet input queue. +The fifth level names for the elements of +.Li struct ifqueue +are detailed above in +.Li ip.ifq . +.Pp +.It Li ip6.log_interval Pq Va net.inet6.ip6.log_interval +This variable permits adjusting the amount of logs generated by the +IPv6 packet forwarding engine. +The value indicates the number of +seconds of interval which must elapse between log output. +.Pp +.It Li ip6.maxdynroutes Pq Va net.inet6.ip6.maxdynroutes +Maximum number of routes created by redirect. +Set to negative to disable. +The default value is 4096. +.Pp +.It Li ip6.maxfragpackets Pq Va net.inet6.ip6.maxfragpackets +The maximum number of fragmented packets the node will accept. +0 means that the node will not accept any fragmented packets. +\-1 means that the node will accept as many fragmented packets as it receives. +The flag is provided basically for avoiding possible DoS attacks. +.Pp +.It Li ip6.maxfrags Pq Va net.inet6.ip6.maxfrags +The maximum number of fragments the node will accept. +0 means that the node will not accept any fragments. +\-1 means that the node will accept as many fragments as it receives. +The flag is provided basically for avoiding possible DoS attacks. +.Pp +.It Li ip6.mforwarding Pq Va net.inet6.ip6.mforwarding +If set to 1, then multicast forwarding is enabled for the host. +The default is 0. +.Pp +.It Li ip6.multicast_mtudisc Pq Va net.inet6.ip6.multicast_mtudisc +This variable controls generation of ICMPv6 Too Big messages +when the machine is performing as an IPv6 multicast router. +If set to 1, an ICMPv6 Too Big message will be generated for multicast packets +which were too big to be forwarded. +If set to 0, the ICMPv6 Too Big message will be suppressed. +.Pp +.It Li ip6.multipath Pq Va net.inet6.ip6.multipath +This variable enables multipath routing for IPv6 addresses. +If set to 0, only the first route selected will be used for a given +destination regardless of how many routes exist in the routing table. +.Pp +.It Li ip6.mtudisctimeout Pq Va net.inet6.ip6.mtudisctimeout +Number of seconds in which a route added by the Path MTU +Discovery engine will time out. +When the route times out, the Path MTU Discovery engine will attempt +to probe a larger path MTU. +.Pp +.It Li ip6.neighborgcthresh Pq Va net.inet6.ip6.neighborgcthresh +Maximum number of entries in neighbor cache. +Set to negative to disable. +The default value is 2048. +.Pp +.It Li ip6.redirect Pq Va net.inet6.ip6.redirect +Returns 1 when ICMPv6 redirects may be sent by the node. +This option is ignored unless the node is routing IP packets, +and should normally be enabled on all systems. +.Pp +.It Li ip6.use_deprecated Pq Va net.inet6.ip6.use_deprecated +This variable controls the use of deprecated addresses, specified in +RFC 4862 5.5.4. +.El +.Pp +We reuse +.Li net.inet.tcp +and +.Li net.inet.udp +for TCP/UDP over IPv6. +.It Dv PF_KEY +Return +.Xr ipsec 4 +database dumps. +The second level name is +.Dv PF_KEY_V2 . +The third level name selects the database as follows: +.Pp +.Bl -tag -width "NET_KEY_SADB_DUMP" -offset indent -compact +.It Dv NET_KEY_SADB_DUMP +Security Association database (SADB). +.It Dv NET_KEY_SPD_DUMP +IPsec flow database (SPD). +.El +.It Dv PF_MPLS +Get or set global information about MPLS (Multiprotocol Label Switching). +.Bl -column "MPLSCTL_MAXINKLOOP " "integer" "not applicable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv MPLSCTL_DEFTTL Ta integer Ta yes +.It Dv MPLSCTL_IFQUEUE Ta node Ta "not applicable" +.It Dv MPLSCTL_MAPTTL_IP Ta integer Ta yes +.It Dv MPLSCTL_MAPTTL_IP6 Ta integer Ta yes +.It Dv MPLSCTL_MAXINKLOOP Ta integer Ta yes +.El +.Bl -tag -width "123456" +.It Dv MPLSCTL_DEFTTL Pq Va net.mpls.ttl +Set or get the default TTL value which is used for MPLS (Shim) Header. +The default is 255. +.It Dv MPLSCTL_IFQUEUE Pq Va net.mpls.ifq +Fourth level comprises an array of +.Li struct ifqueue +structures containing information about MPLS packet input queue. +The forth level names for the elements of +.Li struct ifqueue are same as described in +.Li ip.ifq +in the +.Dv PF_INET +section. +.It Dv MPLSCTL_MAPTTL_IP Pq Va net.mpls.mapttl_ip +If set to 1 the TTL field is synchronized between the IP header and the +MPLS label stack. +If set to 0 the IP header TTL is not modified while passing through MPLS +and the MPLS label stack is initialized with the +.Dv MPLSCTL_DEFTTL . +The default is 1. +.It Dv MPLSCTL_MAPTTL_IP6 Pq Va net.mpls.mapttl_ip6 +If set to 1 the TTL field is synchronized between the IPv6 header and the +MPLS label stack. +If set to 0 the IPv6 header TTL is not modified while passing through MPLS +and the MPLS label stack is initialized with the +.Dv MPLSCTL_DEFTTL . +The default is 0. +.It Dv MPLSCTL_MAXINKLOOP Pq Va net.mpls.maxloop_inkernel +Set or get the maxinum number of label stack operations (push, swap, pop) +that can be made on a packet. +The default is 16. +.El +.It Dv PF_PIPEX Pq Va net.pipex +Get or set global information about PIPEX. +.Pp +The currently defined variable names are: +.Bl -column "Third level name" "integer" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv PIPEXCTL_ENABLE Ta integer Ta yes +.It Dv PIPEXCTL_INQ Ta node Ta not applicable +.It Dv PIPEXCTL_OUTQ Ta node Ta not applicable +.El +.Bl -tag -width "123456" +.It Dv PIPEXCTL_ENABLE +If set to 1, enable PIPEX processing. +The default is 0. +.It Dv PIPEXCTL_INQ Pq Va net.pipex.inq +Fourth level comprises an array of +.Li struct ifqueue +structures containing information about the PIPEX packet input queue. +The forth level names for the elements of +.Li struct ifqueue +are the same as described in +.Li ip.ifq +in the +.Dv PF_INET +section. +.It Dv PIPEXCTL_OUTQ Pq Va net.pipex.outq +Fourth level comprises an array of +.Li struct ifqueue +structures containing information about PIPEX packet output queue. +The forth level names for the elements of +.Li struct ifqueue are same as described in +.Li ip.ifq +in the +.Dv PF_INET +section. +.El +.El +.Ss CTL_VFS +The string and integer information available for the +.Dv CTL_VFS +level is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "Second level name" "VFS generic info" "Changeable" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv VFS_GENERIC Ta "VFS generic info" Ta "no" +.It Dv "filesystem #" Ta "filesystem info" Ta "no" +.El +.Bl -tag -width "123456" +.It Dv VFS_GENERIC +This second level identifier requests generic information about the +VFS layer. +Within it, the following third level identifiers exist: +.Bl -column "Third level name" "struct vfsconf" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv VFS_CONF Ta "struct vfsconf" Ta "no" +.It Dv VFS_MAXTYPENUM Ta "int" Ta "no" +.El +.It filesystem # +After finding the filesystem dependent +.Va vfc_typenum +using +.Dv VFS_GENERIC +with +.Dv VFS_CONF , +it is possible to access filesystem dependent information. +.Pp +Some filesystems may contain settings. +.Bl -tag -width "123" +.It FFS +.Bl -column "FFS_SD_DIRECT_BLK_PTRS" "integer" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv FFS_DIRHASH_DIRSIZE Ta "integer" Ta "yes" +.It Dv FFS_DIRHASH_MAXMEM Ta "integer" Ta "yes" +.It Dv FFS_DIRHASH_MEM Ta "integer" Ta "no" +.It Dv FFS_MAX_SOFTDEPS Ta "integer" Ta "yes" +.It Dv FFS_SD_BLK_LIMIT_HIT Ta "integer" Ta "yes" +.It Dv FFS_SD_BLK_LIMIT_PUSH Ta "integer" Ta "yes" +.It Dv FFS_SD_DIR_ENTRY Ta "integer" Ta "yes" +.It Dv FFS_SD_DIRECT_BLK_PTRS Ta "integer" Ta "yes" +.It Dv FFS_SD_INDIR_BLK_PTRS Ta "integer" Ta "yes" +.It Dv FFS_SD_INO_LIMIT_HIT Ta "integer" Ta "yes" +.It Dv FFS_SD_INO_LIMIT_PUSH Ta "integer" Ta "yes" +.It Dv FFS_SD_INODE_BITMAP Ta "integer" Ta "yes" +.It Dv FFS_SD_SYNC_LIMIT_HIT Ta "integer" Ta "yes" +.It Dv FFS_SD_TICKDELAY Ta "integer" Ta "yes" +.It Dv FFS_SD_WORKLIST_PUSH Ta "integer" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv FFS_DIRHASH_DIRSIZE Pq Va vfs.ffs.dirhash_dirsize +The minimum size of a directory, in bytes, before it is considered for hashing. +.It Dv FFS_DIRHASH_MAXMEM Pq Va vfs.ffs.dirhash_maxmem +The maximum amount of memory, in bytes, to be used for storing directory +hashes. +.It Dv FFS_DIRHASH_MEM Pq Va vfs.ffs.dirhash_mem +The amount of memory currently used by all directory hashes. +.It Dv FFS_MAX_SOFTDEPS Pq Va vfs.ffs.max_softdeps +Maximum strcuctures before slowdowns. +.It Dv FFS_SD_BLK_LIMIT_HIT Pq Va vfs.ffs.sd_blk_limit_hit +Number of times block slowdown imposed. +.It Dv FFS_SD_BLK_LIMIT_PUSH Pq Va vfs.ffs.sd_blk_limit_push +Number of times block limit neared. +.It Dv FFS_SD_DIR_ENTRY Pq Va vfs.ffs.sd_dir_entry +Bufs redirtied as dir entry cannot write. +.It Dv FFS_SD_DIRECT_BLK_PTRS Pq Va vfs.ffs.sd_direct_blk_ptrs +Bufs redirtied as direct ptrs not written. +.It Dv FFS_SD_INDIR_BLK_PTRS Pq Va vfs.ffs.sd_indir_blk_ptrs +Bufs redirtied as indirect ptrs not written. +.It Dv FFS_SD_INO_LIMIT_HIT Pq Va vfs.ffs.sd_ino_limit_hit +Number of times inode limit imposed. +.It Dv FFS_SD_INO_LIMIT_PUSH Pq Va vfs.ffs.sd_ino_limit_push +Number of times inode limit neared. +.It Dv FFS_SD_INODE_BITMAP Pq Va vfs.ffs.sd_inode_bitmap +Bufs redirtied as inode bitmap not written. +.It Dv FFS_SD_SYNC_LIMIT_HIT Pq Va vfs.ffs.sd_sync_limit_hit +Number of synchronous slowdowns imposed. +.It Dv FFS_SD_TICKDELAY Pq Va vfs.ffs.sd_tickdelay +Ticks to pause during slowdown. +.It Dv FFS_SD_WORKLIST_PUSH Pq Va vfs.ffs.sd_worklist_push +Number of worklist cleanups. +.El +.It NFS +.Bl -column "Third level name" "struct nfsstats" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv NFS_NFSSTATS Ta "struct nfsstats" Ta "yes" +.It Dv NFS_NIOTHREADS Ta "int" Ta "yes" +.El +.Bl -tag -width Ds +.It Dv NFS_NIOTHREADS Pq Va vfs.nfs.iothreads +The number of I/O kernel threads for NFS clients. +The default is 4; +the maximum is 20. +.El +.It FUSE +.Bl -column "FUSEFS_POOL_NBPAGES" "Type" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv FUSEFS_INFBUFS Ta "int" Ta "no" +.It Dv FUSEFS_OPENDEVS Ta "int" Ta "no" +.It Dv FUSEFS_POOL_NBPAGES Ta "int" Ta "no" +.It Dv FUSEFS_WAITFBUFS Ta "int" Ta "no" +.El +.Bl -tag -width Ds +.It Dv FUSEFS_INFBUFS Pq Va vfs.fuse.fusefs_fbufs_in +The number of inbound fusebufs. +.It Dv FUSEFS_OPENDEVS Pq Va vfs.fuse.fusefs_open_devices +The number of FUSE devices opened. +.It Dv FUSEFS_POOL_NBPAGES Pq Va vfs.fuse.fusefs_pool_pages +The number of pages used for fusebuf memory. +.It Dv FUSEFS_WAITFBUFS Pq Va vfs.fuse.fusefs_fbufs_wait +The number of fusebufs waiting for a response. +.El +.El +.El +.Ss CTL_VM +The string and integer information available for the +.Dv CTL_VM +level is detailed below. +The changeable column shows whether a process with appropriate +privileges may change the value. +.Bl -column "Second level name" "swap encrypt values" "yes" -offset indent +.It Sy "Second level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv VM_ANONMIN Ta "integer" Ta "yes" +.It Dv VM_LOADAVG Ta "struct loadavg" Ta "no" +.It Dv VM_MAXSLP Ta "integer" Ta "no" +.It Dv VM_METER Ta "struct vmtotal" Ta "no" +.It Dv VM_NKMEMPAGES Ta "integer" Ta "no" +.It Dv VM_PSSTRINGS Ta "struct psstrings" Ta "no" +.It Dv VM_SWAPENCRYPT Ta "swap encrypt values" Ta "yes" +.It Dv VM_USPACE Ta "integer" Ta "no" +.It Dv VM_UVMEXP Ta "struct uvmexp" Ta "no" +.It Dv VM_VNODEMIN Ta "integer" Ta "yes" +.It Dv VM_VTEXTMIN Ta "integer" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv VM_ANONMIN Pq Va vm.anonmin +Percentage of physical memory available for +pages which contain anonymous mapping. +.It Dv VM_LOADAVG Pq Va vm.loadavg +Return the load average history. +The returned data consists of a +.Li struct loadavg . +.It Dv VM_MAXSLP Pq Va vm.maxslp +The time for a process to be blocked before being swappable, +in seconds. +.It Dv VM_METER Pq Va vm.vmmeter +Return the system wide virtual memory statistics. +The returned data consists of a +.Li struct vmtotal . +.It Dv VM_NKMEMPAGES Pq Va vm.nkmempages +Number of pages in kmem_map. +.It Dv VM_PSSTRINGS Pq Va vm.psstrings +Returns the address of the process +.Li struct ps_strings . +The +.Xr ps 1 +program uses it to locate the argument and environment strings. +.It Dv VM_SWAPENCRYPT +Contains statistics about swap encryption. +The string and integer information available for the third level is +detailed below. +.Bl -column "Third level name" "integer" "Changeable" -offset indent +.It Sy "Third level name" Ta Sy "Type" Ta Sy "Changeable" +.It Dv SWPENC_CREATED Ta "integer" Ta "no" +.It Dv SWPENC_DELETED Ta "integer" Ta "no" +.It Dv SWPENC_ENABLE Ta "integer" Ta "yes" +.El +.Bl -tag -width "123456" +.It Dv SWPENC_CREATED Pq Va vm.swapencrypt.keyscreated +The number of encryption keys that have been randomly created. +The swap partition is divided into sections of normally 512KB. +Each section has its own encryption key. +.It Dv SWPENC_DELETED Pq Va vm.swapencrypt.keysdeleted +The number of encryption keys that have been deleted, thus effectively +erasing the data that has been encrypted with them. +Encryption keys are deleted when their reference counter reaches zero. +.It Dv SWPENC_ENABLE Pq Va vm.swapencrypt.enable +Set to 1 to enable swap encryption for all processes. +A 0 disables swap encryption. +Pages still on swap receive a grandfather clause. +Turning this option on does not affect legacy swap data already on the disk, +but all newly written data will be encrypted. +When swap encryption is turned on, automatic +.Xr crash 8 +dumps are disabled. +.El +.It Dv VM_USPACE Pq Va vm.uspace +The number of bytes allocated for each kernel stack. +.It Dv VM_UVMEXP Pq Va vm.uvmexp +Contains statistics about the UVM memory management system. +.It Dv VM_VNODEMIN Pq Va vm.vnodemin +Percentage of physical memory available for +pages which contain cached file data. +.It Dv VM_VTEXTMIN Pq Va vm.vtextmin +Percentage of physical memory available for +pages which contain cached executable data. +.El +.Sh RETURN VALUES +If the call to +.Fn sysctl +is unsuccessful, \-1 is returned and +.Va errno +is set appropriately. +.Sh FILES +.Bl -tag -width "uvm/uvmXswapXencrypt.h " -compact +.It In sys/sysctl.h +top level identifiers and second level kernel and hardware +identifiers +.It In sys/socket.h +second level network identifiers +.It In sys/gmon.h +third level profiling identifiers +.It In uvm/uvm_param.h +second level virtual memory identifiers +.It In uvm/uvm_swap_encrypt.h +third level virtual memory identifiers +.It In net/if.h +packet input/output queue identifiers +.It In net/pipex.h +third level PIPEX identifiers +.It In netinet/in.h +third and fourth level IPv4/v6 identifiers +.It In netinet/ip_divert.h +fourth level divert identifiers +.It In netinet/icmp_var.h +fourth level ICMP identifiers +.It In netinet/icmp6.h +fourth level ICMPv6 identifiers +.It In netinet/tcp_var.h +fourth level TCP identifiers +.It In netinet/udp_var.h +fourth level UDP identifiers +.It In ddb/db_var.h +second level ddb identifiers +.It In sys/mount.h +second level vfs identifiers +.It In miscfs/fuse/fusefs.h +third level fusefs identifiers +.It In nfs/nfs.h +third level NFS identifiers +.It In ufs/ffs/ffs_extern.h +third level FFS identifiers +.It In machine/cpu.h +second level CPU identifiers +.El +.Sh ERRORS +The following errors may be reported: +.Bl -tag -width Er +.It Bq Er EFAULT +The buffer +.Fa name , +.Fa oldp , +.Fa newp , +or length pointer +.Fa oldlenp +contains an invalid address. +.It Bq Er EINVAL +The +.Fa name +array is less than two or greater than +.Dv CTL_MAXNAME . +.It Bq Er EINVAL +A non-null +.Fa newp +pointer is given and its specified length in +.Fa newlen +is too large or too small. +.It Bq Er ENOMEM +The length pointed to by +.Fa oldlenp +is too short to hold the requested value. +.It Bq Er ENOENT +The mib specified does not exist, or exceeds the range that is possible. +.It Bq Er ENXIO +If the mib is a sparsely populated array, this error may be returned +instead. +.It Bq Er ENOTDIR +The +.Fa name +array specifies an intermediate rather than terminal name. +.It Bq Er EOPNOTSUPP +The +.Fa name +array specifies a value that is unknown. +.It Bq Er EPERM +An attempt is made to set a read-only value. +.It Bq Er EPERM +A process without appropriate privileges attempts to set a value. +.It Bq Er EPERM +An attempt to change a value protected by the current kernel security +level is made. +.It Bq Er ESRCH +No process could be found which corresponds to the given process ID. +.El +.Sh SEE ALSO +.Xr pathconf 2 , +.Xr sysconf 3 , +.Xr ddb 4 , +.Xr sysctl.conf 5 , +.Xr securelevel 7 , +.Xr sysctl 8 +.Sh HISTORY +The +.Fn sysctl +function first appeared in +.Bx 4.4 . |