OPTIONS(4)                OpenBSD Programmer's Manual               OPTIONS(4)

NAME
     options - miscellaneous kernel configuration options

SYNOPSIS
     option ...

DESCRIPTION
     This manual page describes a number of miscellaneous kernel configuration
     options that may be specified in a kernel config file.  See config(8) for
     information on how to configure and build kernels.  Note: options are
     passed to the compile process as -D flags to the C compiler.

   Compatibility Options

     option COMPAT_23
     Enables compatibility with OpenBSD 2.3.  This makes it possible to run
     binaries that use old versions of the msgctl(2), shmctl(2) and __semctl
     system calls which changed semantics in OpenBSD 2.4.

     option COMPAT_25
     Enables compatibility with OpenBSD 2.5.  This makes it possible to run
     binaries that use old versions of the statfs(2), fstatfs(2) and getfs-
     stat(2) system calls which were replaced in OpenBSD 2.6 when struct stat
     was expanded.

     option COMPAT_SVR4
     On those architectures that support it, this enables binary compatibility
     with AT&T System V.4 UNIX binaries built for the same architecture.  This
     currently includes the sparc and i386.  Possibly the most widely known
     operating system based on this binary architecture is Sun's Solaris 2.x.
     See compat_svr4(8).

     option COMPAT_BSDOS
     On those architectures that support it, this enables binary compatibility
     with BSD/OS applications.  This option is supported on the i386 architec-
     ture.  See compat_bsdos(8). Requires option COMPAT_43 also be used for
     proper operation.

     option COMPAT_LINUX
     On those architectures that support it, this enables binary compatibility
     with Linux ELF and a.out applications built for the same architecture.
     This option is supported on the i386 architecture.  See compat_linux(8).

     option COMPAT_SUNOS
     On those architectures that support it, this enables binary compatibility
     with SunOS 4.x applications built for the same architecture.  This option
     is supported on the sparc and most m68k platforms.  See compat_sunos(8).

     option COMPAT_ULTRIX
     On those architectures that support it, this enables binary compatibility
     with Ultrix applications built for the same architecture.  This option is
     available on the little-endian MIPS platforms like the pmax and arc.  See
     compat_ultrix(8).

     option COMPAT_FREEBSD
     On those architectures that support it, this enables binary compatibility
     with FreeBSD applications built for the same architecture.  This option
     is available on the i386 architecture.  See compat_freebsd(8).

     option COMPAT_HPUX
     On those architectures that support it, this enables binary compatibility
     with HP/UX applications built for the same architecture.  This option is

     available on some m68k architectures.  See compat_hpux(8).

     option COMPAT_IBCS2
     On those architectures that support it, this enables binary compatibility
     with iBCS2 applications built for the same architecture.  This option is
     available on the i386 architecture.  See compat_ibcs2(8).

     option COMPAT_NETBSD
     On those architectures that support it, this enables binary compatibility
     with NetBSD applications built for the same architecture.  See
     compat_freebsd(8).

     option COMPAT_OSF1
     On those architectures that support it, this enables binary compatibility
     with Digital UNIX (formerly OSF/1) applications built for the same archi-
     tecture.  This option is available on the alpha architecture.  See
     compat_osf1(8).

     option COMPAT_NOMID
     Enables compatibility with a.out executables that lack a machine ID.  On
     the i386, this includes NetBSD 0.8's ZMAGIC format, 386BSD and BSDI's
     QMAGIC, NMAGIC, and OMAGIC a.out formats.  On the hp300 and other m68k
     architectures this permits certain old 4.3BSD binaries to work, though
     its use is discouraged now.

     option COMPAT_43
     Use of this option is discouraged.  It enables compatibility with 4.3BSD.
     It adds an old syscall for lseek() as well as ioctls for TIOCGETP and
     TIOCSETP. The return values for the getpid(2), getgid(2), and getuid(2)
     system calls are modified as well, to return the parent's PID and UID as
     well as the current process's.  It also enables the deprecated NTTYDISC
     terminal line discipline.  It provides backwards compatibility with the
     ``old'' SIOC[GS]IF{ADDR,DSTADDR,BRDADDR,NETMASK} interface ioctls, in-
     cluding binary compatibility for code written before the introduction of
     the sa_len field in sockaddrs.  It also enables support for some older
     pre BSD 4.4 socket calls.

   Debugging Options

     option DDB
     Compiles in a kernel debugger for diagnosing kernel problems.  See ddb(4)
     for details.  Note: not available on all architectures.

     option DDB_SAFE_CONSOLE
     Allows a break into the kernel debugger during boot.  Useful when debug-
     ging problems that can cause init(8) to fail.

     option KGDB
     Compiles in a remote kernel debugger stub for diagnosing kernel problems
     using the ``remote target'' feature of gdb.  See gdb(1) for details.
     Note: not available on all architectures.

     makeoptions DEBUG="-g"
     The -g flag causes bsd.gdb to be built in addition to bsd. bsd.gdb is
     useful for debugging kernel crash dumps with gdb.  Note that gdb's -k
     flag is obsolete and should not be used.  Instead, the kernel can be de-
     bugged by starting gdb with the kernel name as an argument (no core file)
     and then use the gdb command ``target kcore COREFILE''.

     option DEBUG
     Turns on miscellaneous kernel debugging.  Since options are turned into
     preprocessor defines (see above), option DEBUG is equivalent to doing a
     #define DEBUG throughout the kernel.  Much of the kernel has #ifdef DEBUG
     conditional debugging code.  Note that many parts of the kernel (typical-
     ly device drivers) include their own #ifdef XXX_DEBUG conditionals in-
     stead.  This option also turns on certain other options, notably option

     KMEMSTATS, which may decrease system performance.

     option DIAGNOSTIC
     Adds code to the kernel that does internal consistency checks.  This code
     will cause the kernel to panic if corruption of internal data structures
     is detected.

     option SMALL_KERNEL
     Removes some optimizations from the kernel to reduce the size of the re-
     sulting kernel binary. This option can decrease system performance.

     option GPROF
     Adds code to the kernel for kernel profiling with kgmon(8).

     makeoptions PROF="-pg"
     The -pg flag causes the kernel to be compiled with support for profiling.
     The option GPROF is required for the kernel compile to succeed.

     option KTRACE
     Adds hooks for the system call tracing facility, which allows users to
     watch the system call invocation behavior of processes.  See ktrace(1)
     for details.

   File Systems

     option FFS
     Includes code implementing the Berkeley Fast File System (FFS). Most ma-
     chines need this if they are not running diskless.

     option EXT2FS
     Includes code implementing the Second Extended File System (EXT2FS). This
     is the most commonly used file system on the Linux operating system, and
     is provided here for compatibility.  Some specific features of EXT2FS
     like the "behavior on errors" are not implemented.  This file system
     can't be used with uid_t or gid_t values greater than 65535.  Also, the
     filesystem will not function correctly on architectures with differing
     byte-orders.  That is, a big-endian machine will not be able to read an
     ext2fs filesystem created on an i386 or other little-endian machine.  See
     mount_ext2fs(8) for details.

     option MFS
     Include the memory file system (MFS). This file system stores files in
     swappable memory, and produces notable performance improvements when it
     is used as the file store for /tmp or similar mount points.  See
     mount_mfs(8) for details.

     option NFSCLIENT
     Include the client side of the NFS (Network File System) remote file
     sharing protocol.  Although the bulk of the code implementing NFS is ker-
     nel based, several user level daemons are needed for it to work.  See
     mount_nfs(8) for details on NFS.

     option CD9660
     Includes code for the ISO 9660 + Rock Ridge file system, which is the
     standard file system used on many CD-ROMs.  It also supports Joliet ex-
     tensions.  See mount_cd9660(8) for details.

     option MSDOSFS
     Includes support for the MS-DOS FAT file system.  The kernel also imple-
     ments the Windows 95 extensions which permit the use of longer, mixed-
     case file names.  See mount_msdos(8) and fsck_msdos(8) for details.

     option FDESC
     Includes code for a file system which can be mounted on /dev/fd. This
     filesystem permits access to the per-process file descriptor space via
     special files in the file system.  See mount_fdesc(8) for details.  Note
     that this facility is redundant, and thus unneeded on most OpenBSD sys-
     tems, since the fd(4) pseudodevice driver already provides identical
     functionality.  On most systems, instances of fd(4) are mknoded under
     /dev/fd/ and on /dev/stdin, /dev/stdout, and /dev/stderr.

     option KERNFS
     Includes code which permits the mounting of a special file system (nor-
     mally mounted on /kern) in which files representing various kernel vari-
     ables and parameters may be found.  See mount_kernfs(8) for details.

     option NULLFS
     Includes code for a loopback file system.  This permits portions of the
     file hierarchy to be re-mounted in other places.  The code really exists
     to provide an example of a stackable file system layer.  See
     mount_null(8) for details.

     option PORTAL
     Includes the (experimental) portal filesystem.  This permits interesting
     tricks like opening TCP sockets by opening files in the file system.  The
     portal file system is conventionally mounted on /p and is partially im-
     plemented by a special daemon.  See mount_portal(8) for details.

     option PROCFS
     Includes code for a special file system (conventionally mounted on /proc)
     in which the process space becomes visible in the file system.  Among
     other things, the memory spaces of processes running on the system are
     visible as files, and signals may be sent to processes by writing to ctl
     files in the procfs namespace.  See mount_procfs(8) for details.

     option UMAPFS
     Includes a loopback file system in which user and group IDs may be
     remapped -- this can be useful when mounting alien file systems with dif-
     ferent uids and gids than the local system (eg, remote NFS).  See
     mount_umap(8) for details.

     option UNION
     Includes code for the union file system, which permits directories to be
     mounted on top of each other in such a way that both file systems remain
     visible -- this permits tricks like allowing writing (and the deleting of
     files) on a read-only file system like a CD-ROM by mounting a local
     writable file system on top of the read-only file system.  This filesys-
     tem is still experimental and is known to be somewhat unstable.  See
     mount_union(8) for details.

   File System Options

     option FFS_SOFTUPDATES
     Enables a scheme that uses partial ordering of buffer cache operations to
     allow metadata updates in FFS to happen asynchronously, increasing write
     performance significantly.  Normally, the FFS filesystem writes metadata
     updates synchronously which exacts a performance penalty in favor of
     filesystem integrity.  With soft updates, you gain the performance of
     asynchronous writes while retaining the safety of synchronous metadata
     updates.

     Soft updates must be enabled on a per-filesystem basis.  See mount(8) for
     details.

     Processors with a small kernel address space, such as the sun4 and sun4c,
     do not have enough kernel memory to support soft updates.  Attempts to
     use this option with these CPUs will cause a kernel hang or panic after a
     short period of use as the kernel will quickly run out of memory.  This
     is not related to the amount of physical memory present in the machine --


     it is a limitation of the CPU architecture itself.

     option BUFCACHEPERCENT=integer
     Percentage of RAM to use as a file system buffer.  It defaults to 5.

     option NFSSERVER
     Include the server side of the NFS (Network File System) remote file
     sharing protocol.  Although the bulk of the code implementing NFS is ker-
     nel based, several user level daemons are needed for it to work.  See
     mountd(8) and nfsd(8) for details.

     option QUOTA
     Enables kernel support for file system quotas.  See quotaon(8),
     edquota(8), repquota(8), and quota(1) for details.  Note that quotas only
     work on ``ffs'' file systems, although rpc.rquotad(8) permits them to be
     accessed over NFS.

     option FIFO
     Adds support for AT&T System V UNIX style FIFOs (i.e., ``named pipes'').
     This option is recommended in almost all cases as many programs use
     these.

     option NVNODE=integer
     This option sets the size of the cache used by the name-to-inode transla-
     tion routines, (a.k.a. the namei() cache, though called by many other
     names in the kernel source).  By default, this cache has NPROC (set as 20
     + 16 * MAXUSERS) * (80 + NPROC / 8) entries.  A reasonable way to derive
     a value of NVNODE, should a large number of namei cache misses be noticed
     with a tool such as systat(1), is to examine the system's current comput-
     ed value with sysctl(8), (which calls this parameter "kern.maxvnodes")
     and to increase this value until either the namei cache hit rate improves
     or it is determined that the system does not benefit substantially from
     an increase in the size of the namei cache.

     option EXT2FS_SYSTEM_FLAGS
     This option changes the behavior of the APPEND and IMMUTABLE flags for a
     file on an EXT2FS filesystem.  Without this option, the superuser or own-
     er of the file can set and clear them.  With this option, only the supe-
     ruser can set them, and they can't be cleared if the securelevel is
     greater than 0.  See also chflags(1).

   Miscellaneous Options

     option PCIVERBOSE
     Makes the boot process more verbose for PCI peripherals (vendor names and
     other information is printed, etc.).

     option EISAVERBOSE
     Makes the boot process more verbose for EISA peripherals.

     option PCMCIAVERBOSE
     Makes the boot process more verbose for PCMCIA peripherals.

     option APERTURE
     Provide in-kernel support for VGA framebuffer mapping by user-processes
     (such as an X windows server).  This option is supported in the i386 ar-
     chitecture.

     option XSERVER
     Support for X windows in the console driver.

     option LKM
     Enables support for loadable kernel modules.  See lkm(4) for details.
     Note: This option is not yet available on all architectures.

     option CRYPTO
     Enables support for the kernel cryptographic framework.  See crypto(9)
     for details.  While not IP specific, this option is usually used in con-
     junction with option IPSEC.

     option INSECURE
     Hardwires the kernel security level at -1.  This means that the system
     always runs in securelevel 0 mode, even when running multiuser.  See
     init(8) for details on the implications of this.  The kernel secure level
     may be manipulated by the superuser by altering the kern.securelevel
     sysctl variable.  (It should be noted that the securelevel may only be
     lowered by a call from process ID 1, i.e., init(8).) See also sysctl(8)
     and sysctl(3).

     option MACHINE_NONCONTIG
     This option changes part of the VM/pmap interface, to allow for non-con-
     tiguous memory.  On some ports it is not an option.  These ports typical-
     ly only use one of the interfaces.

     option RAM_DISK_HOOKS
     This option allows for some machine dependent functions to be called when
     the ramdisk driver is configured.  This can result in automatically load-
     ing a ramdisk from floppy on open (among other things).

     option RAM_DISK_IS_ROOT
     Forces the ramdisk to be the root device.  This can only be overridden
     when the kernel is booted in the ``ask-for-root'' mode.

     option CCDNBUF=integer
     The ccd(4) device driver uses ``component buffers'' to distribute I/O re-
     quests to the components of a concatenated disk.  It keeps a freelist of
     buffer headers in order to reduce use of the kernel memory allocator.
     CCDNBUF is the number of buffer headers allocated on the freelist for
     each component buffer.  It defaults to 8.

     option KMEMSTATS
     The kernel memory allocator, malloc(9), will keep statistics on its per-
     formance if this option is enabled.  Unfortunately, this option therefore
     essentially disables MALLOC() and FREE() forms of the memory allocator,
     which are used to enhance the performance of certain critical sections of
     code in the kernel.  This option therefore can lead to a significant de-
     crease in the performance of certain code in the kernel if enabled.  Ex-
     amples of such code include the namei() routine, the ccd(4) driver, the
     ncr(4) driver, and much of the networking code.  Note that this option is
     silently turned on by the DEBUG option.

     option BOOT_CONFIG
     Adds support for the -c boot option (User Kernel Config).  Allows modifi-
     cation of kernel settings (i.e., device parameters) before booting the
     system.

     option UVM_SWAP_ENCRYPT
     Enables kernel support for encrypting pages that are written out to swap
     storage.  Swap encryption prevents sensitive data from remaining on the
     disk even after the operating system has been shut down.  This option
     should be turned on if cryptographic filesystems are used.  The sysctl
     variable vm.swapencrypt.enable controls its behaviour.  See sysctl(8) and
     sysctl(3) for details.

   Networking Options

     option GATEWAY
     Enables IPFORWARDING and (on most ports) increases the size of
     NMBCLUSTERS. In general, GATEWAY is used to indicate that a system should
     act as a router, and IPFORWARDING is not invoked directly.  (Note that


     GATEWAY has no impact on protocols other than IP, such as CLNP or XNS.)

     option IPFORWARDING
     Enables IP routing behavior.  With this option enabled, the machine will
     forward IP datagrams between its interfaces that are destined for other
     machines.  Note that even without this option, the kernel will still for-
     ward some packets (such as source routed packets) -- removing GATEWAY and
     IPFORWARDING is insufficient to stop all routing through a bastion host
     on a firewall -- source routing is controlled independently.  Note that
     IP forwarding may be turned on and off independently of the setting of
     the IPFORWARDING option through the use of the net.inet.ip.forwarding
     sysctl variable.  If net.inet.ip.forwarding is 1, IP forwarding is on.
     See sysctl(8) and sysctl(3) for details.

     option MROUTING
     Includes support for IP multicast routers.  INET should be set along with
     this.  Multicast routing is controlled by the mrouted(8) daemon.

     option INET
     Includes support for the TCP/IP protocol stack.  This option is currently
     required.  See inet(4) for details.

     options INET6
     Includes support for the IPv6 protocol stack.  See inet6(4) for details.
     Unlike INET, INET6 enables multicast routing code as well.  This option
     requires INET at this moment, but it should not.

     options ND6_DEBUG
     The option sets the default value of net.inet6.icmp6.nd6_debug to 1, for
     debugging IPv6 neighbor discovery protocol handling.  See sysctl(3) for
     details.

     option NS
     Include support for the Xerox XNS protocol stack.  See ns(4) for details.

     option ISO,TPIP
     Include support for the ubiquitous OSI protocol stack.  See iso(4) for
     details.

     option EON
     Include support for OSI tunneling over IP.

     option CCITT,LLC,HDLC
     Include support for the X.25 protocol stack.  The state of this code is
     currently unknown.  It probably contains bugs.

     option IPX, IPXIP
     Include support for Internetwork Packet Exchange protocol commonly in use
     by Novell NetWare.

     option NETATALK
     Include kernel support for the AppleTalk family of protocols.  This suite
     of supporting code is sometimes called netatalk support.

     option TCP_COMPAT_42
     Use of this option is extremely discouraged, so it should not be enabled.
     If any other machines on the network require enabling this, it's recom-
     mended that they be disconnected from the network.

     TCP bug compatibility with 4.2BSD. In 4.2BSD, TCP sequence numbers were
     32-bit signed values.  Modern implementations of TCP use unsigned values.
     This option clamps the initial sequence number to start in the range 2^31
     rather than the full unsigned range of 2^32.  Also, under 4.2BSD,
     keepalive packets must contain at least one byte or else the remote end


     will not respond.

     option TCP_SACK
     Turns on selective acknowledgements.  Additional information about seg-
     ments already received can be transmitted back to the sender, thus indi-
     cating segments that have been lost and allowing for a swifter recovery.
     Both communication endpoints need to support SACK. The fallback behaviour
     is NewReno fast recovery phase, which allows one lost segment to be re-
     covered per round trip time.  When more then one segment has been dropped
     per window, the transmission can continue without waiting for a retrans-
     mission timeout.

     option TCP_FACK
     Turns on forward acknowledgements allowing a more precise estimate of
     outstanding data during the fast recovery phase by using SACK informa-
     tion.  This option can only be used together with TCP_SACK.

     option TCP_SIGNATURE
     Turns on support for the TCP MD5 Signature option (RFC 2385).  This is
     used by Internet backbone routers to provide per-packet authentication
     for the TCP packets used to communicate BGP routing information.  You
     will also need a routing daemon that supports this option in order to ac-
     tually use it.

     option PPP_FILTER
     This option turns on pcap(3) based filtering for ppp connections.  This
     option is used by pppd(8) which needs to be compiled with PPP_FILTER de-
     fined (the current default).

     option PPP_BSDCOMP
     Enables BSD compressor for PPP connections.

     option PPP_DEFLATE
     For use in conjunction with PPP_BSDCOMP; provides an interface to zlib
     for PPP for deflate compression/decompression.

     option IPSEC
     This option enables IP security protocol support.  See ipsec(4) for more
     details.

     option ENCDEBUG
     This option enables debugging information to be conditionally logged in
     case IPSEC encounters errors.  The option IPSEC is required along with
     this option.  Debug logging can be turned on/off through the use of the
     net.inet.ip.encdebug sysctl variable.  If net.ipsec.encap.encdebug is 1,
     debug logging is on.  See sysctl(8) and sysctl(3) for details.

     option KEY
     Enables PFKEYv2 (RFC 2367) support.  While not IP specific, this option
     is usually used in conjunction with option IPSEC.

   SCSI Subsystem Options

     option SCSITERSE
     Terser SCSI error messages.  This omits the table for decoding ASC/ASCQ
     info, saving about 8 bytes or so.

     option SCSIDEBUG
     Prints extra debugging info for the SCSI subsystem to the console.

   System V IPC Options

     option SYSVMSG
     Includes support for AT&T System V UNIX style message queues.  See


     msgctl(2), msgget(2), msgrcv(2), msgsnd(2).

     option SYSVSEM
     Includes support for AT&T System V UNIX style semaphores.  See semctl(2),
     semget(2), semop(2).

     option SYSVSHM
     Includes support for AT&T System V UNIX style shared memory.  See
     shmat(2), shmctl(2), shmdt(2), shmget(2).

     option SHMMAXPGS=value
     Sets the maximum number of AT&T System V UNIX style shared memory pages
     that are available through the shmget(2) system call.  Default value is
     1024 on most ports.  See /usr/include/machine/vmparam.h for the default.

   Operation Related Options

     option SWAPPAGER
     Turns on paging.  (To be specific, this enables the virtual memory module
     responsible for handling page faults for ``anonymous'' objects (i.e., BSS
     pages)).  MANDATORY -- the system cannot actually run without this
     ``option''.

     option DEVPAGER
     Support for mmap()ing of devices.  (Specifically, this enables the virtu-
     al memory module responsible for handling page faults on mapped devices
     (``cdev'' vnodes)).  MANDATORY -- the system cannot actually run without
     this ``option''.

     option NMBCLUSTERS=value
     Size of kernel mbuf cluster map, mb_map, in CLBYTES-sized logical pages.
     Default on most ports is 256 (512 with ``option GATEWAY''). See
     /usr/include/machine/param.h for exact default information.  Increase
     this value if ``mb_map full'' messages appear.

     option NKMEMCLUSTERS=value
     Size of kernel malloc area in CLBYTES-sized logical pages.  This area is
     covered by the kernel submap kmem_map. See /usr/include/machine/param.h
     for the default value, which is port specific.  Increase this value if
     ``out of space in kmem_map'' panics happen.

     option NBUF=value

     option BUFPAGES=value
     These options set the number of pages available for the buffer cache.
     Their default value is a machine dependent value, often calculated as be-
     tween 5% and 10% of total available RAM.

     option NTP
     Modify the scheduler code to add hooks necessary for running an NTP dae-
     mon.  xntpd(8) is available as part of the port collection.

     option APM_NOPRINT
     This option is supported on the i386 architecture.  When enabled kernel
     messages regarding the status of the automatic power management system
     (APM) are suppressed.  APM status can still be obtained using apm(8)
     and/or apmd(8).

SEE ALSO
     X(1), gdb(1), ktrace(1), quota(1), gettimeofday(2), i386_iopl(2),
     msgctl(2), msgget(2), msgrcv(2), msgsnd(2), semctl(2), semget(2),
     semop(2), shmat(2), shmctl(2), shmdt(2), shmget(2), sysctl(3), ddb(4),
     inet(4), ipsec(4), iso(4), lkm(4), ns(4), xf86(4), apm(8), apmd(8),
     config(8), edquota(8), init(8), mount_cd9660(8), mount_fdesc(8),
     mount_kernfs(8), mount_mfs(8), mount_msdos(8), mount_nfs(8),
     mount_null(8), mount_portal(8), mount_procfs(8), mount_umap(8),
     mount_union(8), mrouted(8), quotaon(8), rpc.rquotad(8), sysctl(8), xnt-
     pd(8)

HISTORY
     The options man page first appeared in OpenBSD 2.3.

BUGS
     The INET option should not be required.

OpenBSD 2.9                     August 17, 1997                             10
