1.\" $NetBSD: options.4,v 1.17 1997/04/21 13:00:52 mrg Exp $ 2.\" 3.\" Copyright (c) 1996 4.\" Perry E. Metzger. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. All advertising materials mentioning features or use of this software 15.\" must display the following acknowledgement: 16.\" This product includes software developed for the NetBSD Project 17.\" by Perry E. Metzger. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.Dd October 20, 1996 34.Os NetBSD 1.3 35.Dt OPTIONS 4 36.Sh NAME 37.Nm options 38.Nd Miscellaneous kernel configuration options 39.Sh SYNOPSIS 40.Cd options ... 41.Sh DESCRIPTION 42This manual page describes a number of miscellaneous kernel 43configuration options that may be specified in a kernel config 44file. See 45.Xr config 8 46for information on how to configure and build kernels. 47.Em Note: 48Options are passed to the compile process as -D flags to the C 49compiler. 50.Ss Compatibility Options 51.Bl -ohang 52.It Cd options COMPAT_09 53Enable binary compatibility with 54.Nx 0.9 . 55This enables support for 5616-bit user, group, and process ids (following revisions support 5732-bit identifiers), 58It also allows the use of the deprecated getdomainname, setdomainname, 59and uname syscalls. 60This option also allows using numeric fileystem identifiers rather 61than strings. Post 0.9 versions use string identifiers. 62.It Cd options COMPAT_10 63Enable binary compatibility with 64.Nx 1.0 . 65This option allows the use of the filesystem name of 66.Dq ufs 67as an alias for 68.Dq ffs . 69The name 70.Dq ffs 71should be used post 1.0 in 72.Pa /etc/fstab 73and other files. It also adds old syscalls for the 74.At V 75shared memory interface. This was changed post 1.0 to work on 64-bit 76architectures. This option also enables 77.Dq sgtty 78compatibility, without which programs using the old interface produce 79an 80.Dq inapropriate ioctl 81error. 82.It Cd options COMPAT_11 83Enable binary compatibility with 84.Nx 1.1 . 85This allows binaries running on the i386 port to gain direct access to 86the io ports by opening 87.Pa /dev/io 88read/write. This functionality was 89replaced by 90.Xr i386_iopl 2 91post 1.1. 92On the 93.Tn Atari 94port, the location of the disk label was moved after 1.1. When the 95.Em COMPAT_11 96option is set, the kernel will read (pre) 1.1 style disk labels as a 97last resort. When a disklabel is re-written, the old style label will 98be replaced with a post 1.1 style label. 99.It Cd options COMPAT_12 100Enable binary compatibility with 101.Nx 1.2 . 102This allows the use of old syscalls for reboot. The syscall number 103was changed post 1.2 to add functionality to the reboot syscall. 104.It Cd options COMPAT_43 105Enables compatibility with 106.Bx 4.3 . 107This adds an old syscall for lseek. It also adds the ioctls for 108TIOCGETP and TIOCSETP. The return values for getpid, getgid, and 109getuid syscalls are modified as well, to return the parent's pid and 110uid as well as the current process's. It also enables the deprecated 111NTTYDISC terminal line disipline. 112It also provides backwards compatibility with 113.Dq old 114SIOC[GS]IF{ADDR,DSTADDR,BRDADDR,NETMASK} interface ioctls, including 115binary compatibility with code written before the introduction of the 116sa_len field in sockaddrs. 117It also enables 118support for some older pre BSD 4.4 socket calls. 119.It Cd options COMPAT_SVR4 120On those architectures that support it, this enables binary 121compatibility with 122.At V.4 123applications built for the same architecture. This currently includes 124the sparc, and i386. 125.It Cd options COMPAT_LINUX 126On those architectures that support it, this enables binary 127compatibility with Linux ELF and a.out 128applications built for the same architecture. This is currently limited 129to the i386. 130.It Cd options COMPAT_SUNOS 131On those architectures that support it, this enables binary 132compatibility with SunOS 4.1 133applications built for the same architecture. This currently includes 134the sparc and most or all m68k platforms. 135.It Cd options COMPAT_ULTRIX 136On those architectures that support it, this enables binary 137compatibility with Ultrix 138applications built for the same architecture. This currently is limited 139to the pmax. The functionality of this option is unknown. 140.It Cd options COMPAT_FREEBSD 141On those architectures that support it, this enables binary 142compatibility with FreeBSD 143applications built for the same architecture. This is obviously limited 144to the i386. 145.It Cd options COMPAT_HPUX 146On those architectures that support it, this enables binary 147compatibility with HP/UX 148applications built for the same architecture. This is limited to the 149hp300 port, and has some known bugs. A limited set of programs do work. 150.It Cd options COMPAT_IBCS2 151On those architectures that support it, this enables binary 152compatibility with iBCS2 153applications built for the same architecture. This is currently 154limited to the i386. 155.It Cd options COMPAT_OSF1 156On those architectures that support it, this enables binary 157compatibility with Digital UNIX (formerly OSF/1) 158applications built for the same architecture. This is currently 159limited to the alpha, and may not even work. 160.El 161.Ss Debugging Options 162.Bl -ohang 163.It Cd options DDB 164Compiles in a kernel debugger for diagnosing kernel problems. See 165.Xr ddb 4 166for details. 167.Em NOTE: 168not available on all architectures. 169.It Cd options DDB_ONPANIC 170If set to non-zero, the DDB will be entered upon kernel panic. The 171default if not specified is "1". Note that this sets the value of 172the 173.Em ddb.onpanic 174sysctl variable which may be changed at run time -- see 175.Xr sysctl 8 176for details. 177.It Cd options KGDB 178Compiles in a remote kernel debugger stub for diagnosing kernel problems 179using the 180.Dq remote target 181feature of gdb. See 182.Xr gdb 1 183for details. 184.Em NOTE: 185not available on all architectures. 186.It Cd makeoptions DEBUG="-g" 187The -g flag causes 188.Pa netbsd.gdb 189to be built in addition to 190.Pa netbsd . 191.Pa netbsd.gdb 192is useful for debugging kernel crash dumps with gdb. 193The command 194.Dl gdb -k 195invokes gdb in kernel debugger mode. 196See 197.Xr gdb 1 198for details. This also turns on 199.Em options DEBUG 200(which see). 201.It Cd options DEBUG 202Turns on miscellaneous kernel debugging. Since options are turned into 203preprocessor defines (see above), 204.Em options DEBUG 205is equivalent to doing a 206.Em #define DEBUG 207throughout the kernel. Much of the kernel has 208.Em #ifdef DEBUG 209conditionalized debugging code. Note that many parts of the kernel 210(typically device drivers) include their own 211.Em #ifdef XXX_DEBUG 212conditionals instead. 213This option also turns on certain other options, notably the 214.Em KMEMSTATS 215option, which may decrease system performance. 216.It Cd options DIAGNOSTIC 217Adds code to the kernel that does internal consistency checks. This 218code will cause the kernel to panic if corruption of internal data 219structures is detected. 220.It Cd options KTRACE 221Add hooks for the system call tracing facility, which allows users to 222watch the system call invokation behavior of processes. See 223.Xr ktrace 1 224for details. 225.El 226.Ss File Systems 227.Bl -ohang 228.It Cd file-system FFS 229Includes code implementing the Berkeley Fast File System 230.Em ( FFS ) . 231Most machines need this if they are not running diskless. 232.It Cd file-system LFS 233Include the log structured file system 234.Em ( LFS ) . 235See 236.Xr mount_lfs 8 237and 238.Xr newlfs 8 239for details. 240.It Cd file-system MFS 241Include the memory file system 242.Em ( MFS ) . 243This file system stores files in swappable memory, and produces 244notable performance improvements when it is used as the file store 245for 246.Pa /tmp 247and similar file systems. See 248.Xr mount_mfs 8 249for details. 250.It Cd file-system NFS 251Include the client side of the 252.Em NFS 253(Network File System) remote file sharing protocol. 254Although the bulk of the code implementing 255.Em NFS 256is kernel based, several user level daemons are needed for it to 257work. See 258.Xr mount_nfs 8 259and 260.Xr nfsiod 8 261for details. 262.It Cd file-system CD9660 263Includes code for the ISO 9660 + Rock Ridge file system, which is the 264standard file system on many CD-ROMs. Useful mostly if you have a CD 265drive. See 266.Xr mount_cd9660 8 267for details. 268.It Cd file-system MSDOSFS 269Includes the 270.Tn MS-DOS 271FAT file system, which is reportedly still used 272by unfortunate people who have not heard about 273.Nx . 274Also implements the 275.Tn Windows 95 276extensions to the same, which permit the use of longer, mixed case 277file names. see 278.Xr mount_msdos 8 279and 280.Xr fsck_msdos 8 281for details. 282.It Cd file-system FDESC 283Includes code for a file system, conventionally mounted on 284.Pa /dev/fd , 285which permits access to the per-process file descriptor space via 286special files in the file system. 287See 288.Xr mount_fdesc 8 289for details. 290Note that this facility is redundant, and thus unneeded on most 291.Nx 292systems, since the 293.Xr fd 4 294pseudodevice driver already provides identical functionality. On most 295.Nx 296systems, instances of 297.Xr fd 4 298are mknoded under 299.Pa /dev/fd/ 300and on 301.Pa /dev/stdin , 302.Pa /dev/stdout , 303and 304.Pa /dev/stderr . 305.It Cd file-system KERNFS 306Includes code which permits the mounting of a special file system 307(normally mounted on 308.Pa /kern ) 309in which files representing various kernel variables and parameters 310may be found. 311See 312.Xr mount_kernfs 8 313for details. 314.It Cd file-system NULLFS 315Includes code for a loopback file system. This permits portions of the file 316hierarchy to be re-mounted in other places. The code really exists to 317provide an example of a stackable file system layer. See 318.Xr mount_null 8 319for details. 320.It Cd file-system PORTAL 321Includes the (experimental) portal filesystem. This permits 322interesting tricks like opening TCP sockets by opening files in the 323file system. The portal file system is conventionally mounted on 324.Pa /p 325and is partially implemented by a special daemon. See 326.Xr mount_portal 8 327for details. 328.It Cd file-system PROCFS 329Includes code for a special file system (conventionally mounted on 330.Pa /proc ) 331in which the process space becomes visible in the file system. Among 332other things, the memory spaces of processes running on the system are 333visible as files, and signals may be sent to processes by writing to 334.Pa ctl 335files in the procfs namespace. See 336.Xr mount_procfs 8 337for details. 338.It Cd file-system UMAPFS 339Includes a loopback file system in which user and group ids may be 340remapped -- this can be useful when mounting alien file systems with 341different uids and gids than the local system. 342See 343.Xr mount_umap 8 344for details. 345.It Cd file-system UNION 346Includes code for the union file system, which permits directories to 347be mounted on top of each other in such a way that both file systems 348remain visible -- this permits tricks like allowing writing (and the 349deleting of files) on a read-only file system like a CD-ROM by 350mounting a local writable file system on top of the read-only file 351system. See 352.Xr mount_union 8 353for details. 354.El 355.Ss File System Options 356.Bl -ohang 357.It Cd options NFSSERVER 358Include the server side of the 359.Em NFS 360(Network File System) remote file sharing protocol. 361Although the bulk of the code implementing 362.Em NFS 363is kernel based, several user level daemons are needed for it to 364work. See 365.Xr mountd 8 366and 367.Xr nfsd 8 368for details. 369.It Cd options QUOTA 370Enables kernel support for file system quotas. See 371.Xr quotaon 8 , 372.Xr edquota 8 , 373and 374.Xr quota 1 375for details. Note that quotas only work on 376.Dq ffs 377file systems, although 378.Xr rpc.rquotad 8 379permits them to be accessed over 380.Em NFS . 381.It Cd options FIFO 382Augments the system to permit the use of 383.At V 384style FIFOs (i.e. 385.Dq named pipes 386). This option is recommended. 387.It Cd options NVNODE=integer 388This option sets the size of the cache used by the name-to-inode translation 389routines, (a.k.a. the 390.Fn namei 391cache, though called by many other names in the kernel source). By default, 392this cache has NPROC (set as 20 + 16 * MAXUSERS) * (80 + NPROC / 8) entries. 393A reasonable way to derive a value of NVNODE, should you notice a large 394number of namei cache misses with a tool such as 395.Xr systat 1 , 396is to examine your system's current computed value with 397.Xr sysctl 1 , 398(which calls this parameter "kern.maxvnodes") and to increase this value 399until either the namei cache hit rate improves or it is determined that 400your system does not benefit substantially from an increase in the size of 401the namei cache. 402.El 403.Ss Miscellaneous Options 404.Bl -ohang 405.It Cd options LKM 406Enable loadable kernel modules. See 407.Xr lkm 4 408for details. 409.Em NOTE: 410not available on all architectures. 411.It Cd options INSECURE 412Hardwires the kernel security level at -1. This means that the system 413always runs in secure level 0 mode, even when running multiuser. See 414the manual page for 415.Xr init 8 416for details on the implications of this. The kernel secure level may 417manipulated by the superuser by altering the 418.Em kern.securelevel 419sysctl variable. (It should be noted that the secure level may only be 420lowered by a call from process id 1, i.e. 421.Em init . ) 422See also 423.Xr sysctl 8 424and 425.Xr sysctl 3 . 426.It Cd options UCONSOLE 427Normally, only the superuser can execute the TIOCCONS ioctl, which 428redirects console output to a non-console tty. (See 429.Xr tty 4 430for details). 431This option permits any user to execute the ioctl. This is useful on 432machines such as personal workstations which run X servers, where one 433would prefer to permit console output to be viewed in a window without 434requiring a suid root program to do it. 435.It Cd options MACHINE_NONCONTIG 436This option changes part of the VM/pmap interface, to allow for 437non-contiguous memory. On some ports it is not an option. These 438ports typically only use one of the interfaces. 439.It Cd options MEMORY_DISK_HOOKS 440This option allows for some machine dependent functions to be called when 441the ramdisk driver is configured. This can result in automatically loading 442a ramdisk from floppy on open (among other things). 443.It Cd options MEMORY_DISK_IS_ROOT 444Forces the ramdisk to be the root device. This can only be overridden when 445the kernel is booted in the 'ask-for-root' mode. 446.It Cd options NTP 447Turns on in-kernel precision timekeeping support used by software 448implementing 449.Em NTP 450(Network Time Protocol, RFC1305). 451The 452.Em NTP 453option adds an in-kernel phase-locked loop (PLL) for normal 454.Em NTP 455operation, and a frequency-locked loop (FLL) for intermittently-connected 456operation. 457.Xr xntpd 8 458will employ a user-level PLL when kernel support is unavailable, 459but the in-kernel version has lower latency and more precision, and 460so typically keeps much better time. 461The interface to the kernel 462.Em NTP 463support is provided by the 464.Xr ntp_adjtime 2 465and 466.Xr ntp_gettime 2 467system calls, which are intended for use by 468.Xr xntpd 8 469and are enabled by the option. 470On systems with sub-microsecond resolution timers, or where (HZ / 100000) 471is not an integer, the 472.Em NTP 473option also enables extended-precision arithmetic to keep track of 474fractional clock ticks at NTP time-format precision. 475.It Cd options PPS 476This option enables a kernel serial line discipline for receiving time 477phase signals from an external reference clock such as a radio clock. 478(The 479.Em NTP 480option (which see) must be on if the 481.Em PPS 482option is used.) 483Some reference clocks generate a pulse per second (PPS) signal in 484phase with their time source. The 485.Em PPS 486line discipline receives this signal on either the data leads 487or the DCD control lead of a serial port. 488.Em NTP 489uses the PPS signal to discipline the local clock oscillator to a high 490degree of precision (typically less than 50 microseconds in time and 4910.1 ppm in accuracy). 492.Em PPS 493can also generate a serial output pulse when the system receives a PPS 494interrupt. This can be used to measure the system interrupt latency 495and thus calibrate 496.Em NTP 497to account for it. 498Using 499.Em PPS 500usually requires a 501gadget box 502to convert from TTL to RS-232 signal levels. 503The gadget box and PPS are described in more detail in the HTML documentation 504shipped with the xntpd distribution. 505.It Cd option SETUIDSCRIPTS 506Allows scripts with the setuid bit set to execute as the effective 507user rather than the real user, just like binary executables. 508NOTE: Using this option will also enable 509.Em option FDSCRIPTS 510.It Cd option FDSCRIPTS 511Allows execution of scripts with the execute bit set, but not the 512read bit, by opening the file and passing the file descriptor to 513the shell, rather than the filename. NOTE: Execute only (non-readable) 514scripts will have 515.Va argv[0] 516set to 517.Pa /dev/fd/* . 518What this option allows as far as security is 519concerned, is the ability to safely ensure that the correct script 520it run by the interpreter, as it is passed as an already open file. 521.It Cd options RTC_OFFSET=integer 522The kernel (and typically the hardware battery backed-up clock on 523those machines that have one) keeps time in 524.Em UTC 525(Universal Coordinated Time, once known as 526.Em GMT , 527or Greenwich Mean Time) 528and not in the time of the local time zone. 529The 530.Em RTC_OFFSET 531option is used on some ports (such as the i386) to tell the kernel 532that the hardware clock is offset from 533.Em UTC 534by the specified number of minutes. This is typically used when a 535machine boots several operating systems and one of them wants the 536hardware clock to run in the local time zone and not in 537.Em UTC , 538e.g. 539.Em RTC_OFFSET=300 540means 541the hardware clock is set to US Eastern Time (300 minutes behind 542.Em UTC ) , 543and not 544.Em UTC . 545(Note: 546.Em RTC_OFFSET 547is used to initialize a kernel variable named 548.Va rtc_offset 549which is the source actually used to determine the clock offset, and 550which may be accessed via the kern.rtc_offset sysctl variable. 551See 552.Xr sysctl 8 553and 554.Xr sysctl 3 555for details. Since the kernel clock is initialized from the hardware 556clock very early in the boot process, it is not possible to meaningfully change 557.Va rtc_offset 558in system initialization scripts. Changing this value currently may 559only be done at kernel compile time or by patching the kernel and 560rebooting.) 561.It Cd options CCDNBUF=integer 562The 563.Xr ccd 4 564device driver uses "component buffers" to distribute I/O requests to the 565components of a concatenated disk. It keeps a freelist of buffer headers 566in order to reduce use of the kernel memory allocator. 567.Em CCDNBUF 568is the number of buffer headers allocated on the freelist for 569each component buffer. It defaults to 8. 570.It Cd options KMEMSTATS 571The kernel memory allocator, 572.Xr malloc 9 , 573will keep statistics on its performance if this option is enabled. 574Unfortunately, this option therefore essentially disables 575.Fn MALLOC 576and 577.Fn FREE 578forms of the memory allocator, which are used to enhance the performance 579of certain critical sections of code in the kernel. 580This option therefore can 581lead to a significant decrease in the performance of certain code in the kernel 582if enabled. Examples of such code include the 583.Fn namei 584routine, the 585.Xr ccd 4 586driver, 587the 588.Xr ncr 4 589driver, 590and much of the networking code. 591.Em N.B. This option is silently 592.Em turned on by the DEBUG option. 593.El 594.Ss Networking Options 595.Bl -ohang 596.It Cd options GATEWAY 597Enables 598.Em IPFORWARDING 599(which see) 600and (on most ports) increases the size of 601.Em NMBCLUSTERS 602(which see). In general, 603.Em GATEWAY 604is used to indicate that a system should act as a router, and 605.Em IPFORWARDING 606is not invoked directly. 607(Note that 608.Em GATEWAY 609has no impact on protocols other than IP, such as CLNP or XNS.) 610.It Cd options IPFORWARDING 611Enables IP routing behavior. With this option enabled, the machine 612will forward IP datagrams between its interfaces that are destined for 613other machines. Note that even without this option, the kernel will 614still forward some packets (such as source routed packets) -- removing 615.Em GATEWAY 616and 617.Em IPFORWARDING 618is insufficient to stop all routing through a bastion host on a 619firewall -- source routing is controlled independently. 620To turn off source routing, use 621.Em options IPFORWSRCRT=0 622(which see). 623Note that IP forwarding may be turned on and off independently of the 624setting of the 625.Em IPFORWARDING 626option through the use of the 627.Em net.inet.ip.forwarding 628sysctl variable. If 629.Em net.inet.ip.forwarding 630is 1, IP forwarding is on. See 631.Xr sysctl 8 632and 633.Xr sysctl 3 634for details. 635.It Cd options IPFORWSRCRT=value 636If 637.Em value 638is set to zero, source routing of IP datagrams is turned off. If 639.Em value 640is set to one (the default) or the option is absent, source routed IP 641datagrams are forwarded by the machine. Note that source routing of 642IP packets may be turned on and off independently of the setting of 643the 644.Em IPFORWSRCRT 645option through the use of the 646.Em net.inet.ip.forwsrcrt 647sysctl variable. If 648.Em net.inet.ip.forwsrcrt 649is 1, forwarding of source routed IP datagrams is on. See 650.Xr sysctl 8 651and 652.Xr sysctl 3 653for details. 654.It Cd options MROUTING 655Includes support for IP multicast routers. You certainly want 656.Em INET 657with this. Multicast routing is controlled by the 658.Xr mrouted 8 659daemon. 660.It Cd options INET 661Includes support for the TCP/IP protocol stack. You almost certainly 662want this. See 663.Xr inet 4 664for details. 665This option is currently required. 666.It Cd options MCLSHIFT=value 667This option is the base-2 logarithm of the size of mbuf clusters. 668The BSD networking stack keeps network packets in a linked 669list, or chain, of kernel buffer objects called mbufs. The system 670provides larger mbuf clusters as an optimization for large packets, 671instead of using long chains for large packets. 672The mbuf cluster size, 673or 674.Em MCLBYTES, 675must be a power of two, and is computed as two raised to the power 676.Em MCLSHIFT. 677On systems with Ethernet network adaptors, 678.Em MCLSHIFT 679is often set to 11, giving 2048-byte mbuf clusters, large enough to 680hold a 1500-byte Ethernet frame in a single cluster. Systems with 681networks supporting larger frame sizes like ATM, FDDI, or HIPPI may 682perform better with MCLSHIFT set to 12 or 13, giving mbuf cluster 683sizes of 4096 and 8192 bytes, respectively. 684.It Cd options NS 685Include support for the Xerox XNS protocol stack. See 686.Xr ns 4 687for details. 688.It Cd options ISO,TPIP 689Include support for the ubiquitous OSI protocol stack. See 690.Xr iso 4 691for details. 692.It Cd options EON 693Include support for OSI tunneling over IP. 694.It Cd options CCITT,LLC,HDLC 695Include support for the X.25 protocol stack. 696The state of this code is currently unknown, and probably contains 697bugs. 698.It Cd options IPNOPRIVPORTS 699Normally, only root can bind a socket descriptor to a so-called 700.Dq privileged 701TCP 702port, that is, a port number in the range 0-1023. This option 703eliminates those checks from the kernel. This can be useful if there 704is a desire to allow daemons without privileges to bind those ports, 705e.g. on firewalls. The security tradeoffs in doing this are subtle. 706This option should only be used by experts. 707.It Cd options TCP_COMPAT_42 708TCP bug compatibility with 4.2BSD. In 4.2BSD, TCP sequence numbers 709were 32-bit signed values. Modern implementations of TCP use unsigned 710values. This option clamps the initial sequence number to start in 711the range 2^31 rather than the full unsigned range of 2^32. Also, 712under 4.2BSD, keepalive packets must contain at least one byte or else 713the remote end would not respond. 714.It Cd options PFIL_HOOKS 715This option turns on the packet filter interface hooks. See 716.Xr pfil 9 717for details. 718.It Cd options IPFILTER 719This option enables the IP filtering on the packet level using the 720ip-filter package. This option requies that the 721.Em PFIL_HOOK 722option also be included. 723.It Cd options IPFILTER_LOG 724This option, in conjuction with 725.Em IPFILTER , 726enables logging of IP packets using ip-filter. 727.It Cd options IPF_DEFAULT_PASS 728This option sets the default policy of ip-filter. It should be set 729to either 730.Em FR_PASS 731or 732.Em FR_BLOCK , 733depending on whether the filter is to pass or block packets by 734default, respectively. 735.It Cd options PPP_FILTER 736This option turns on 737.Xr pcap 3 738based filtering for ppp connections. This option is used by 739.Xr pppd 8 740which needs to be compiled with 741.Em PPP_FILTER 742defined (the current default). 743.El 744.Ss System V IPC Options 745.Bl -ohang 746.It Cd options SYSVMSG 747Includes support for 748.At V 749style message queues. See 750.Xr msgctl 2 , 751.Xr msgget 2 , 752.Xr msgrcv 2 , 753.Xr msgsnd 2 . 754.It Cd options SYSVSEM 755Includes support for 756.At V 757style semaphores. See 758.Xr semctl 2 , 759.Xr semget 2 , 760.Xr semop 2 . 761.It Cd options SYSVSHM 762Includes support for 763.At V 764style shared memory. See 765.Xr shmat 2 , 766.Xr shmctl 2 , 767.Xr shmdt 2 , 768.Xr shmget 2 . 769.It Cd options SHMPAXPGS=value 770Sets the maximum number of 771.At V 772style shared memory pages that are available through the 773.Xr shmget 2 774system call. Default value is 1024 on most ports. See 775.Pa /usr/include/machine/vmparam.h 776for the default. 777.El 778.Ss VM Related Options 779.Bl -ohang 780.It Cd options SWAPPAGER 781Turns on paging. (To be specific, this enables the virtual memory 782module responsible for handling page faults for 783.Dq anonymous 784objects (i.e. BSS pages)). 785.Em MANDATORY 786-- you cannot actually run without 787this 788.Dq option . 789.It Cd options VNODEPAGER 790Support for mmap()ing of files. (Specifically, this enables the 791virtual memory module responsible for handling page faults on mapped 792files ( 793.Dq plain file 794vnodes)). 795.Em MANDATORY 796-- you cannot actually run without 797this 798.Dq option . 799.It Cd options DEVPAGER 800Support for mmap()ing of devices. (Specifically, this enables the 801virtual memory module responsible for handling page faults on mapped 802devices ( 803.Dq cdev 804vnodes)). 805.Em MANDATORY 806-- you cannot actually run without 807this 808.Dq option . 809.It Cd options NMBCLUSTERS=value 810Size of kernel mbuf cluster map, 811.Em mb_map , 812in CLBYTES-sized logical 813pages. Default on most ports is 256 (512 with 814.Dq options GATEWAY ). 815See 816.Pa /usr/include/machine/param.h 817for exact default information. Increase this value if you get 818.Dq mb_map full 819messages. 820.It Cd options NKMEMCLUSTERS=value 821Size of kernel malloc arena in CLBYTES-sized logical pages. This area 822is covered by the kernel submap 823.Em kmem_map . 824See 825.Pa /usr/include/machine/param.h 826for the default value, which is port specific. Increase this value if 827you get 828.Dq out of space in kmem_map 829panics. 830.\" , which mean you have run out of mallocable kernel memory. 831.It Cd options NBUF=value 832.It Cd options BUFPAGES=value 833These option set the number of pages available for the buffer cache. 834Their default value is a machine depedant value, often calculated as 835between 5% and 10% of total available RAM. 836.El 837.\" The following requests should be uncommented and used where appropriate. 838.\" .Sh FILES 839.\" .Sh EXAMPLES 840.Sh SEE ALSO 841.Xr config 8 , 842.Xr init 8 , 843.Xr gettimeofday 2 , 844.Xr sysctl 8 , 845.Xr sysctl 3 , 846.Xr xntpd 8 , 847.Xr ntp_adjtime 2 , 848.Xr ntp_gettime 2 , 849.Xr i386_iopl 2 , 850.Xr msgctl 2 , 851.Xr msgget 2 , 852.Xr msgrcv 2 , 853.Xr msgsnd 2 , 854.Xr semctl 2 , 855.Xr semget 2 , 856.Xr semop 2 , 857.Xr shmat 2 , 858.Xr shmctl 2 , 859.Xr shmdt 2 , 860.Xr shmget 2 , 861.Xr ddb 4 , 862.Xr lkm 4 , 863.Xr inet 4 , 864.Xr ns 4 , 865.Xr iso 4 , 866.Xr mrouted 8 , 867.Xr mount_lfs 8 , 868.Xr newlfs 8 , 869.Xr mount_mfs 8 , 870.Xr mount_nfs 8 , 871.Xr mount_cd9660 8 , 872.Xr mount_msdos 8 , 873.Xr mount_fdesc 8 , 874.Xr mount_kernfs 8 , 875.Xr mount_null 8 , 876.Xr mount_portal 8 , 877.Xr mount_procfs 8 , 878.Xr mount_umap 8 , 879.Xr mount_union 8 , 880.Xr edquota 8 , 881.Xr quotaon 8 , 882.Xr quota 1 , 883.Xr rpc.rquotad 8 , 884.Xr ktrace 1 , 885.Xr gdb 1 886.Sh HISTORY 887The 888.Nm 889man page first appeared in 890.Nx 1.3 . 891.Sh BUGS 892The 893.Em INET 894and the 895.Em VNODEPAGER 896options should not be required. 897