sysctl.7: simplify statements about net.inet6 variables

options(4), sysctl(7): Document options HEARTBEAT.

sysctl(7): Note nodev,nosuid requirement for user-mounted fs.

While here, tidy up language and markup a smidge.

sysctl.7: be a little more descriptive about kern.osrevision

It's expressed as an integer, and is also returned as an integer type
should one retrieve it via sysctl(3) (as this man page already
correctly documents in the table above its description).

Add new "kern.mbuf.nmbclusters_limit" sysctl.

- Used to know the upper limit of nmbclusters.
- It's read only.

Fix PR kern/57037

Be able to change the behavior sending parameter changing routing messages.
When set net.inet6.ip6.param_rt_msg=0, don't send parameter changing
routing messages.
When set net.inet6.ip6.param_rt_msg=1(default), send parameter changing
routing messages by RTM_NEWADDR.

Add sysctl entry to control to send routing message for RTM_DYNAMIC.

Some routing daemons require such routing message to keep coherency.

If we want to let kernel send such message, set net.inet.icmp.dynamic_rt_msg=1
for IPv4, net.inet6.icmp6.dynamic_rt_msg=1 for IPv6.
Default(=0) is the same as before, that is, not send such routing message.

Add sysctl entry to enable/disable to use path MTU discovery for icmpv6 reflecting.

If we want to use path MTU discovery for icmp reflecting set
net.inet6.icmp6.reflect_pmtu=1. Default(=0) is the same as before, that is,
use IPV6_MINMTU.

module(9), sysctl(7): Document kern.module.autounload_unsafe.

Add sysctl entry to improve interconnectivity to some VPN appliances, pointed out by seil-team@IIJ.

If we want to allow different identifier types on IDii and IDir, set
net.key.allow_different_idtype=1. Default(=0) is the same as before.

kern.maxvnodes _can_ be lowered, but not below the number of currently
active vnodes.

s/runable/runnable/

fix various typos, mainly in comments, but also in man pages and log messages.

Fix typos.

Tie the maximum file lock per unprivilegied uid to kern.maxfiles

This makes the limit simple to raise at run time. While there, document
that fcntl(2) and flock(2) may return ENOMEM when this limit is reached.

Swap encryption no longer experimental or default-off.

Use Dv. Bump date for previous.

Setting a socket buffer size stops autoscaling. Add a sysctl to
prevent this behaviour. The default is not changed.

sysctl: Adjust man page for new ARP sysctl ND settings

Xref rfc6056(7).

g/c vm.idlezero

Mark experimental-default-off knobs clearly as such.

Document vm.swap_encrypt.

Tweak kern.arandom documentation.

Update documentation of kern.arandom. It uses cprng_strong(9).

Document usage of KERN_ARND

document vm.ubc_direct

Provide documentation for KERN_LWP.

PR lib/20108

branches: 1.139.2;
Document KERN_PROC_CWD in sysctl(7)

Document kern.uidinfo.semcnt.

Remove trailing whitespace. Remove comma for better readability.

As discussed in tech-kern:

- make sysctl kern.expose_address tri-state:
0: no access
1: access to processes with open /dev/kmem
2: access to everyone
defaults:
0: KASLR kernels
1: non-KASLR kernels

- improve efficiency by calling get_expose_address() per sysctl, not per
process.

- don't expose addresses for linux procfs

- welcome to 8.99.27, changes to fill_*proc ABI

- Introduce a new SO_RERROR socket option to explicitly turn on
receive overflow errors re-instating the default behavior to
silently ignore them as before 2018-03-19.
- Introduce a new kern.sooptions sysctl to control the default
behavior of socket options. Setting this to 0x4000 (SO_RERROR),
turns on receive overflow error reporting for all sockets.
- Change dhcpcd to turn on SO_RERROR on all its sockets.

As discussed in tech-net.

kern.boottime was changed from a struct timeval to a struct timespec
in January 2009 (the Christos' time merge, when time_t went to 64 bits).

sysctl needs to catch up. (So do other progs, which will happen, eventually,
but most of them are unaffected in any practical way.)

If you are running a system (NetBSD 6 or later) without this change, try
sysctl -nn kern.boottime
and marvel at the result (in theory, seconds.microseconds) most
probably being something like:
jinx$ sysctl -nn kern.boottime
1540801874.999995564
(There is a 1 in 1000 chance your system will have booted
in the interval [0 , 999999] nanoseconds after some second,
in which case this will not be observed. You should get
(almost) the same value after this change - just now it is as
it should be (there should now always be 9 digits after the '.').

On the other hand, if you're on a big-endian 64 bit host (running
64 bit sysctl) you would have always seen 0 for the microseconds field.
That should be fixed by this.

In sysctl(7) also document what we mean by "the time the system booted".

XXX Pullup -8
XXX Pullup -7
XXX Pullup -6 (oops, missed that one...)

Fix some xrefs.

document kern.expose_address

more netkey->netipsec

well well well it's September now

remove reference to ipnat

branches: 1.128.2;
sysctl.7: fix speeling mistake

Fix tab/macro order.

Document new PF_LOCAL sysctls.

New sentence, new line.

branches: 1.124.2;
Improve description of ddb.commandonenter.

Document ddb.dumpstack sysctl
Remove the mention of ddb.onpanic=2 as that functionality was removed with the
introduction of ddb.dumpstack.

Heads up by <pgoyette>

Sort ddb section in alphabetical order.
Bump date.

kern.module.verbose is a boolean, not an integer. We had it right in the
text following the table, but the table itself was wrong.

Thanks to martin@ for pointing this out.

Fix word.

Remove Tn.

document ddb.panicstackframes

Remove lurking reference to TCP_COMPAT_42.

Fix a macro. Fix two tables.

Document vm.guard_size and vm.thread_guard_size

Remove workaround for ancient HTML generation code.

branches: 1.113.4;
A couple more minor changes for readability.

Improve some grammar, let verbs agree in number with their subjects.

Document new proc.curproc.paxflags variable.

branches: 1.110.2;
Fix typo: s/currenly/currently

New sentence, new line.

Remove trailing whitespace.

Document kern.sched sysctl variables.

Fix display problem reported by kamil via abhinav.

Use Fl for flags.

Document kern.hist

Document the previously-undocument kern.bufq node.

Document net.inet.ip.dad_count.

branches: 1.102.2;
Add a new kern.messages sysctl to allow kernel message verbosity to be
altered after boot.

Fixes PR kern/46539 using patch submitted by Nat Sloss.

Punctuation nit.

Document security.pax.mprotect.ptrace

Document arp sysctl removals

Document net.inet6.ip6.neighborgcthresh change

Fix typo.

add addrctlpolicy

Minor rephrasing for English grammar police.

Reduce whitespace.

document new sysctls

Add more formatting.

Use more macros for symbolic constants

This change was suggested by <riastradh> in PR xsrc/49912
The change idea was approved by <wiz>

Correct mandoc warnings and errors

This change should be no visible to users.

Bump date for previous.

Clean-up resources (sys/sys/resource.h) usage

Add vmemoryuse to login_cap(3)
Document vmemoryuse in login.conf(5)
Document proc.pid.rlimit.vmemoryuse and proc.pid.rlimit.maxlwp in sysctl(7)
Document SBSIZE, AS, VMEM and NTHR in share/doc/psd/05.sysman/1.6.t

Reviewed by <riastradh>
Approved by <pgoyette>

Tested by Dominik Bialy

Closes PR xsrc/49912

Change draft-ietf-tcpm-initcwnd-08.txt to RFC6928,

add log_unknown_network

BUILDINFO part 2: expose sysctl kern.buildinfo

Add hw.ncpuonline documentation.

Remove trailing whitespace.

Add kern.pool for memory pool stats.

Explain ipsec.enabled better.

mention new ipsec sysctls.

branches: 1.79.2;
New sentence, new line.

Mention the new kern.module.autotime variable.

vfs.wapbl.flush_disk_cache is more about metadata than data, and
more about safety in the event of power loss than safety in the
event of a crash.

New sentence, new line.

update init_win{,_local} to match recent changes.

document new reserved ports

branches: 1.73.2;
4 new sysctls to avoid ipv6 DoS attacks from OpenBSD

PR/46602: Move the rfc6056 port randomization to the IP layer.

Drop trailing whitespace.

document kern.maxlwp and kern.uidinfo.*

Fix whitespace nits. Suggested by Bug Hunting.

branches: 1.68.2; 1.68.6; 1.68.8;
Minor typo fix.

branches: 1.67.2;
update for rfc6056 from vlad.

mention the new kern.tty.qsize

add new arp logging sysctls

Quote minus so it does not become a dash.

Attempt to improve the documentation of ddb.onpanic, from options(4).

Fix xref; security(8) -> security(7).

Remove trailing whitespace.

merge the two lists.

Document the remaining vfs.generic sysctls.

branches: 1.58.2;
Use St for POSIX references.

file system consistency.

Do some markup cleanup for the benefit of troff PostScript output.

- try to be more consistent with Va/Vt/Dv
- make the space in "... otherwise 0." non-paddable to prevent widow "0."
- consistently use -width "123456" for lists of nodes


TODO: There's still quite a bit of mess to clean up:

- tables of "n+1 level names" are indented (or not) inconsistently
- formatting of node names is inconsistent (normal vs literal)
- references to POSIX should use .St
- filesystem vs. file-system, our old time favorite!
- .Pq adds annoying extra space in troff output, do we really want to use it?
- etc.

Fix It arguments. Also, let's assume it's 2011.

document the new wapbl sysctls.

Fix xref; module(4) -> module(7).

Point to module(9) instead of modctl(8).

Like with mqueue(3), create and remove the aio(3) sysctl nodes dynamically.

Use .Ss for subtitles.

Add kern.mqueue also to the big list of second-level nodes. Sort.

Get rid of SYSCTL_SETUP.

We want the sysctl variables also when mqueue(3) is loaded as a module.

Make HTML-ready.

Document also kern.cryptodevallowsoft.

Document kern.usercrypto and kern.userasymcrypto.

Document kern.arandom, and remove kern.autonicetime and kern.autoniceval.

XXX: Although no sysctl variables exist for the last two, these are still
defined in <sys/sysctl.h> and <sys/systm.h>.

Add sublists to the security-tree.

In addition, some small fixes to spelling errors, wording, and markup.

Document the kern.module node.

Mark nine undocumented kern.x nodes/variables with XXX. The total amount of
undocumented variables is well over twenty in the kern-subtree alone.

Add sublists for the kern.coredump and kern.veriexec trees.

Sort the kern-subtree. Try to correct the differences between the list and
the descriptions. Mark several undocumented or unclear items with XXX.

Note kern.detachall.

Move the description of 'hw.acpi.supported_states' from sysctl(7) to acpi(4).

Mention the updated hz(9) here.

Fix the CTL_DDB definitions (DDBCTL_XXX, not DBCTL_XXX).

Document the following: ddb.maxwidth, ddb.tee_msgbuf, and ddb.commandonenter.

Use .In instead of .Aq Pa for header files.

Bump date for vm.user_va0_disable.

rename the va0_disabled option and cpp conditional to "disable" as well,
for consistency, and document option and sysctl flag

It's "hw.acpi.supported_states", not "hw.acpi.support_states". From
rudolf on netbsd-docs@.

Bump date for new sysctl.

PR/42243: Yasuoka Masahiko: Add "net.inet.icmp.bmcastecho" sysctl support,
to disable icmp replies to the broadcast address.

Punctuation fix (separate punctuation from marked-up work to avoid it being
marked up as well).

Slightly restructure vfs level documentation.

Centralize documentation about exported sysctl variables in the relevant
secmodel's man-page.

Bump date for previous.

Expose the kernel's boothowto(9) variable through the sysctl
kern.boothowto variable.

Part of the /etc/rc silent changes requested in PR 41946
and proposed in tech-userlevel.

Document PROC_PID_LIMIT_SBSIZE. From Greg A. Woods in PR lib/36463.
Wording is taken from getrlimit(2).

groff is applying more than enough space between column, so don't
increase it even more. Do ensure that the columns are as large as the
largest value though. Do not indent the kern.* table as it can't fit
comfortable on the screen otherwise.

Add missing Bl argument. Remove superfluous roff command.

PR/40937: matthew sporleder: document kern.timecounter in sysctl(7)

branches: 1.18.2;
-If non-zero, DDB will be entered when the kernel panics.
+If non-zero, DDB will be entered if the kernel panics.

Remove LKMs and switch to the module framework, pass 1.

Proposed on tech-kern@.

branches: 1.16.2;
Mention few more changeable SysV IPC parameters, sync with reality.

Describe hw.acpi_supported_states. Info from joerg.

branches: 1.14.4;
Update for PaX ASLR.

branches: 1.13.4;
man bits from anon ymous

- per socket keepalive settings
- settable connection establishment timeout

net.inet.tcp.newreno is no more.

remove net.inet6.ip6.rht0.

Disable processing of routing header type 0 packets since they can be used
of DoS attacks. Provide a sysctl to re-enable them (net.inet6.ip6.rht0).

Information from:
http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf

Document net.inet.ip.hashsize to control the IPv4 Fast Forward hash table size

Document net.inet6.ip6.hashsize to control the IPv6 Fast Forward hash table

ip6.maxflows default value is 256 - document

Document net.inet6.ip6.maxflows for IPv6 Fast Forward

Some nits, paxctl(1) -> paxctl(8).

Fix typo.

New sentence, new line.
Reword: all .. will not .. -> no .. will ..

Move the description of sysctl MIBs from sysctl.3 to a new manual page
sysctl.7. Remove the list of MIBs from sysctl.8 so we don't have to
maintain duplicate information, as proposed by YAMAMOTO Takashi on
tech-userlevel. Also remove references to header files from sysctl.8.

The numeric constants remain documented, they are still needed in some
cases. See the discussion on tech-userlevel. ("mib list in sysctl.8")

OK by YAMAMOTO Takashi.