Stop building with and documenting FFS_SOFTUPDATES.
Code that used it was removed in February.

enable POOL_DEBUG after 7.5 release
OK deraadt@

disable POOL_DEBUG for release
ok deraadt@

Revert chunk that I have commited by accident.

Prevent simultaneous dt(4) open.

Syskaller has hit the assertion "dtlookup(unit) == NULL" by opening
dt(4) device in two parallel threads. Convert kassert into if
condition. Move check that device is not used after sleep points
in malloc. The list dtdev_list is protected by kernel lock which
is released during sleep.

Reported-by: syzbot+6d66c21f796c817948f0@syzkaller.appspotmail.com
OK miod@

re-enable POOL_DEBUG
OK deraadt@

disable POOL_DEBUG for release

enable sec(4) so people can try it out

re-enable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

re-enable POOL_DEBUG
ok deraadt@

disable POOL_DEBUG for release
ok deraadt@

enable kstat(4) and kstat(1).

kstat allows the kernel to expose arbitrary data for userland to
consume. currently this is used by some network card drivers to
expose hardware counters they provide, and a bit by the network
stack to show things like ifq counters.

ok bluhm@ deraadt@

re-enable POOL_DEBUG

disable pool debug for release

Template for option WITNESS is in the architecture GENERIC.MP file
if it is supported. Remove it from the global GENERIC config.
OK visa@ claudio@

Retire switch(4) it never really was production ready and the OpenFlow
API implemented is a deadend.
OK akoshibe@ yasuoka@ deraadt@ kn@ patrick@ sthen@

enable POOL_DEBUG again.

disable pool debug for release
ok deraadt@

Enable dt(4) on amd64, arm64, i386, and powerpc64 in GENERIC kernel.
Support to skip frames is missing on arm64 and i386, but the stack
traces are useful anyway. sparc64 should work, but I could not
test it. Other architectures do not have stacktrace_save_at() and
dynamic tracer does not link.
from patrick@; OK semarie@

reenable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

enable veb(4), it's time for wider testing.

apart from the semantic differences between bridge(4) and veb(4),
the only missing bits in veb(4) is the transparent ipsec interception
support, and spanning tree.

renable POOL_DEBUG
ok deraadt@

disable POOL_DEBUG in preparation for release
ok deraadt@

enable wg(4).

this will make testing easier for everyone.

from Jason A. Donenfeld and Matt Dunwoodie
ok deraadt@ tobhe@

add a commented out entry for wg(4).

i think ive tempted fate enough for one day.

reenable POOL_DEBUG

disable POOL_DEBUG in preparation for release
ok deraadt@

Import dt(4) a driver and framework for Dynamic Profiling.

The design is fairly simple: events, in the form of descriptors on a
ring, are being produced in any kernel context and being consumed by
a userland process reading /dev/dt.

Code and hooks are all guarded under '#if NDT > 0' so this commit
shouldn't introduce any change as long as dt(4) is disable in GENERIC.

ok kettenis@, visa@, jasper@, deraadt@

renable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

enable tpmr(4) so people can try it.

uncomment aggr(4) to make it easier for people to try

add aggr, but leave it commented out for now.

it needs to be a bit more robust before making it more available to try.

disable mobileip(4)

it's not great in several dimensions, so this is a first step to
removing it. if noone has a (reasonable) teary i'll start removing
the code in a few weeks.

"kill it with fire" deraadt@

renable POOL_DEBUG

it is POOL_DEBUG disable time

enable mpip(4)

ok deraadt@

add bpe(4) or Backbone Provider Edge interfaces

Backbone refers to 802.1ah or 802.1Q Provider Backbone Bridges
(PBB), or mac-in-mac, which is like vlans except it completely
encapsulates the inner packet rather than just add a shim to it.
This removes the need for Backbone Core Bridges (ie, switches between
bpe instances) to know all the addresses on all the networks.

Re-enable POOL_DEBUG for -current.

ok deraadt@

POOL_DEBUG is disabled for release

take us to 6.3-current

disable POOL_DEBUG for release
ok deraadt@

dcoppa@ and bluhm@ noted that i accidentally removed POOL_DEBUG

put it back.

split mobileip(4) out from the gre(4) driver.

having mobileip in gre makes it hard to cut gre up. the current mobileip
code is also broken, so this is def and improvement. it also makes it
easy to disable and remove mobileip in the future.

ok claudio@ henning@

Remove the TCP_FACK option and associated #if{,n}def code.

TCP_FACK was disabled by provos@ in June 1999.
TCP_FACK is an algorithm that decides that when something is lost, all
not SACKed packets until the most forward SACK are lost. It may be a
correct estimate, if network does not reorder packets.

OK visa@ mpi@ mikeb@

Unconditionally enable TCP selective acknowledgements (SACK)

OK deraadt, mpi, visa, job

re-enable POOL_DEBUG after the release

disable POOL_DEBUG for release
ok deraadt@

Merge DDBCTF into DDB.

Switch installer to Allotment Routing Table (ART).
Prompted by a bugreport by naddy that IPv6 autoconfiguration is broken
in the installer.
OK mpi, "go for it" deraadt

Kill option KEY, it is a useless knob, nobody uses pfkeyv2 without IPSEC or
tcp md5. OK mpi@

Add option to compile witness(4).

re-enable POOL_DEBUG after the release; ok deraadt@

POOL_DEBUG off for release

temporarily disable BFD, to not block work on unlocking the socket layer.

requested by deraadt@

enable BFD

OK deraadt@

Enable switch(4).

ok jca@, reyk@

Remove PIM support from the multicast stack.

ok mpi@

Build kernel with DEBUG=-g by default.

This will allow us to extract type informations from DWARF2 sections. It
also makes developer life easier as debug information are now included in
every object.

Resulting kernels will be stripped using strip(1) instead of ld(1).

Kernel build time increases by approximately 10%. However it is still
possible to disable this by defining DEBUG="".

ok kettenis@, bluhm@, natano@, jasper@, reyk@, deraadt@

option INSECURE is obsolete

teach ddb(4) about CTF. currently it only loads the CTF and uses it on amd64
to lookup the number of function parameters. however having this basic
facility allows us to expand it's usage.

currently hidden behind the (disabled) DDBCTF kernel option as some of the
required tools are not available in base yet. in addition to that one
also needs recent bootblocks that load the .SUNW_ctf kernel section.

discussed with mpi@ over many a cider and ale in cambridge
feedback and ok guenther@ mpi@

Introduce Dynamic Profiling, a ddb(4) based & gprof compatible kernel
profiling framework.

Code patching is used to enable probes when entering functions. The
probes will call a mcount()-like function to match the behavior of a
GPROF kernel.

Currently only available on amd64 and guarded under DDBPROF. Support
for other archs will follow soon.

A new sysctl knob, ddb.console, need to be set to 1 in securelevel 0
to be able to use this feature.

Inputs and ok guenther@

Add in the (disabled) kernel glue for BFD

OK claudio@, henning@

Import switch(4), an in-kernel OpenFlow switch which can work alone.
switch(4) currently supports OpenFlow 1.3.5.
Currently, it's disabled by the kernel config.

With help from yasuoka@ reyk@ jsg@.

ok deraadt@ yasuoka@ reyk@ henning@

pool debug dance, part deux

disable tmpfs because it receives zero maintainance.

do the pool debug release dance. ok deraadt

unlink systrace from the build. pledge is the glorious future that awaits.
the rest of systrace to be deleted in a serious of followup commits.
ok from larger openbsd developer community

Enable ART.

Leave the define for the moment, this will be changed as soon as we're
confident enough.

"it must be a 3-line diff" krw@

ok bluhm@, mikeb@, dlg@, reyk@, deraadt@

activate POOL_DEBUG during -current; miod

deactivate POOL_DEBUG for release
ok deraadt, jsg

Implement etherip(4) driver

This commit is not removing the existing EtherIP part of gif(4) and
it keeps EtherIP of gif(4) working.

ok jbg@ sthen@ mpi@ reyk@ yasuoka@

Add pair(4), a vether-based virtual Ethernet driver to interconnect
rdomains and bridges on the local system. This can be used to route
through local rdomains, to create L2 devices (like trunks) between
them, and many other things.

Discussed with many, with input from mpi@
OK sthen@ phessler@ yasuoka@ mikeb@

Allocate a new major for tap(4) also note that pseudo-device tun is for tap
as well. OK dlg@ mpi@

turn POOL_DEBUG back on

As usual, turn off POOL_DEBUG for the release.
ok deraadt@

Implemented MPLS pseudowire (mpw(4)) to be used with VPLS and VPWS.

ok mpi@, claudio@.

remove obsolete INET kernel option

we're tagged for release; turn POOL_DEBUG back on. ok deraadt@

disable POOL_DEBUG for release
ok deraadt@

Delete option COMPAT_43: support for pre-sa_len binaries has been obsolete
for a couple decades. Keep the OSIOCGIFCONF ioctl to support COMPAT_LINUX
but move the rest of the Linux-specific ioctl() handling into linux_socket.c
This lets struct osockaddr finally move from sys/socket.h to protocols/talkd.h

ok krw@ deraadt@ mpi@

remove LKM

sl(4) is no more, thanks for all the fish!

pool debug back on

disable POOL_DEBUG for release

-option ALTQ
ALTQ has served us well for years and was extremely important not just for
us, but for the entire bandwidth management arena. Back when we got altq,
the subject was not yet well researched and understood, which is why altq
is the framework with pluggable schedulers it is. Kenjiro Cho (kjc@) did an
amazing job there.
Now, more than 10 years later, we do have a good understanding and can use
a simpler framework with just one priority queueing and one bandwidth
shaping mechanism each - the new queueing subsystem. Last not least because
it is incredibly painful to maintain both in parallel, it is time for altq
to depart. Farewell, thanks for many years of good service. Everybody
using any form of "not just fifo" queueing owes Kenjiro a lot. At least
buy him a beer when you meet him.
And, allow me this personal note, thanks Kenjiro, working with you on the
topic has always been a great pleasure and I learned a lot from you. Thanks!

re-enable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

enable tmpfs so it gets tested some more.
okay kettenis@, martin@, beck@, krw@, tedu@, millert@

enable fuse.

ok deraadt@

enable vxlan(4). ok deraadt@

Import vxlan(4), the virtual extensible local area network tunnel
interface. VXLAN is a UDP-based tunnelling protocol for overlaying
virtualized layer 2 networks over layer 3 networks. The implementation
is based on draft-mahalingam-dutt-dcops-vxlan-04 and has been tested
with other implementations in the wild.

put it in deraadt@

as predicted, problems have been found with mpath. disabling it while they
get figured out.

enable mpath, rdac, and sym to see what will happen.

discussed with and ok deraadt. we expect a problem will appear which will
cause it to be disabled again, but unless we try this we wont see the
problems.

Fix comment, socket splice can also do UDP now. Fix white spaces.

The last user of the old __tfork() was updated to the current one,
so COMPAT_O51 can go. The complete ABI role means COMPAT_O53 can
be removed as well.

ok jsing@ tedu@

re-enable POOL_DEBUG after release; ok deraadt@

disable POOL_DEBUG for release
ok deraadt@

Add an f_mntfromspec member to struct statfs, which specifies the name of
the special provided when the mount was requested. This may be the same as
the special that was actually used for the mount (e.g. in the case of a
device node) or it may be different (e.g. in the case of a DUID).

Whilst here, change f_ctime to a 64 bit type and remove the pointless
f_spare members.

Compatibility goo courtesy of guenther@

ok krw@ millert@

tedu faith(4), suggested by todd@ some weeks ago after a submission by
dhill.

ok krw@, mikeb@, tedu@ (implicit)

Antici

pation: back to -current

welcome to 5.3-BETA

cleanup around the pipex. naming style, delete or update comments.
no functional changes.

COMPAT_O48 can be turned off; ok guenther

kill nnpfs dead

now that we are current again, enable POOL_DEBUG

As usual, turn off POOL_DEBUG for the release. Note that POOL_DEBUG is
not the same as it was in 4.9 or earlier. In either case you can turn
it on again using sysctl kern.pool_debug=1 -- but if POOL_DEBUG is not
enabled you only get a subset of the strict checks.

ok deraadt@

Actually enabling the __tfork compat code would be a Good Thing

re-enable POOL_DEBUG for -current

As usual, turn off POOL_DEBUG for the release. Note that POOL_DEBUG is
not the same as it was in 4.9 or earlier. In either case you can turn
it on again using sysctl kern.pool_debug=1 -- but if POOL_DEBUG is not
enabled you only get a subset of the strict checks.
prodded by david

ccd goes to the attic
discussed with jsing and millert

Re-enable POOL_DEBUG. requested by deraadt@.

As usual, turn off POOL_DEBUG for the release. Note that POOL_DEBUG is
not the same as it was in 4.9 or earlier. In either case you can turn
it on again using sysctl kern.pool_debug=1 -- but if POOL_DEBUG is not
enabled you only get a subset of the strict checks.
ok kettenis miod beck

Fix up previous diff: use COMPAT_O48 instead of COMPAT_48, add option
to GENERIC, wrap compat_o48_sys_getdirentries() with an appropriate
#ifdef, and use struct compat_o48_sys_getdirentries_args instead of
struct sys_getdirentries_args.

begone, fucking rotten appletalk shit. ok room

this also must be included my previous commit. sorry.

Include PIPEX in kernel by default. And add new sysctl variable
`net.pipex.enable' to enable PIPEX. By default, pipex is disabled
and it will not process packets from wire. Update man pages and
update HOWTO_PIPEX_NPPPD.txt for testers.

discussed with dlg@, ok deraadt@ mcbride@ claudio@

do 1.174 correctly and remove (commented out) option PORTAL

Disable NNPFS;

A purdy OpenAFS port is being worked on and everybody hates
having to touch files inside nnpfs/ so it is going to go away
real soon.

ok deraadt@, beck@

rename VFSDEBUG to VFLCKDEBUG;

prompted by tedu@

POOL_DEBUG has nothing to do with portalfs

Remove portalfs.

While it is a terribly cool idea, it's just awful and since noone has stepped
up to the plate to keep it up with the current vop state, retire it to the
attic.

ok krw@, deraadt@, guenther@, miod@.
comments from jmc@

COMPAT_O47 (kernel getpeereid, which was replaced by libc getpeereid)
can go away
ok guenther

enable POOL_DEBUG again since we are not in release

move us to real 4.9

group filesystems together

ok miod@

Add socket option SO_SPLICE to splice together two TCP sockets.
The data received on the source socket will automatically be sent
on the drain socket. This allows to write relay daemons with zero
data copy.
ok markus@

There is no reason to not include MPLS and mpe(4) in GENERIC. Makes my
life a lot easier. Sure deraadt@

use a better description for the vnd(4) entry on this file.

ok millert@

vscsi lives once more!

Add a new interface pppx(4) -- the ppp multiplexer to be used with npppd
and pipex. pppx(4) creates an interface whenever a session is created
so that altq and pf can work on these.
Started by dlg@ debugged and made usable by myself
OK dlg@ yasuoka@ deraadt@

Move getpeereid(2) into COMPAT_O47. In 4.8 and onwards it is library
code using socket options.
ok matthew

now that we are at -current again, re-enable POOL_DEBUG

"go ahead" kettenis@

we ship releases with POOL_DEBUG off. post-release, turn it back on.
POOL_DEBUG is for development safety (catches our bugs early), but this
particular safety comes off for release.
reminded by miod

disable vscsi until we actually have something that uses it (like iscsid),
and until matthew@ is happy with it.

suggested by deraadt@

garbage collect the now unused PAGEFASTRECYCLE option.

ok deraadt@, david@

turn off COMPAT_O43

Replace enc(4) with a new implementation as a cloner device. We still
create enc0 by default, but it is possible to add additional enc
interfaces. This will be used later to allow alternative encs per
policy or to have an enc per rdomain when IPsec becomes rdomain-aware.

manpage bits ok jmc@
input from henning@ deraadt@ toby@ naddy@
ok henning@ claudio@

PAGEFASTRECYCLE does not exist as an option after uvm_pmemrange; it is
implied.

order the network pseudo-devices by name. Move pppoe and sppp into that list.
OK kettenis, krw, dlg

Add commented MPLS and mpe(4) entries.
OK sthen, jsg

Enable PAGEFASTRECYCLE.

ok deraadt@, ariane@

enable POOL_DEBUG

we disable POOL_DEBUG for releases. Reminded by mpf
After release, someone please remind us to turn it on again. It helps
find bugs. We just don't want people to get hosed too much during
release.

Add PIPEX option, disabled by default for now.

ok deraadt yasuoka

vether(4) is a virtual ethernet device driver which can be used
so that a bridge-etherip-tunnel host can join into the bridge itself.
It is ridiculous that this capability was missing from our network
stack portfolio, considering we have bgp and ospf daemons...
discussed at length with claudio

add commented out options for PAGEFASTRECYCLE, KVA_GUARDPAGES, shuffle VFSDEBUG
around and add POOL_DEBUG as an enabled option, removing the define from subr_pool.c.

comments & ok deraadt@.

Remove support for packet mode of Metricom Ricochet radios.
It currently doesn't compile and this is unlikely to change
as there are many alternatives now since we no longer live
in the early 1990s and Metricom went bankrupt some time ago.

ok many @

wire vscsi up to a cdev

for claudio@ ok deraadt@

add mpath(4), a driver that steals paths to scsi devices if it
thinks they could be available via multiple paths. those stolen
devices are then made available via mpath(4).

this is the minimum amount of code to implement the stealing. it
is generally broken and very brittle, so it is currently disabled.

it is going in so i can work on it in the tree.

Arla client rename from xfs to nnpfs for later upgrades. Tested on various arches. ok todd@ beck@

endrun(4) - EndRun Technologies native time-of-day message timedelta
sensor. Based on msts(4). Tested with Praecis Ct
(http://www.endruntechnologies.com/network-time-source.htm).

help and feedback mbalmer
'no problem with this sensor going in' deraadt

Disable portalfs until it is fixed, okay deraadt@.

actually enable pflow

reinstate a comment whacked in -r1.138; ok deraadt

Widen some struct statfs fields to support large filesystem stata
and add some to be able to support statvfs(2). Do the compat dance
to provide backward compatibility. ok thib@ miod@

Add support for the Meinberg Standard Time String format that all Meinberg
radio clocks can transmit over serial ports. This is implemented as a
line discipline similar to nmea(4) and provides a timedelta sensor.

See http://www.meinberg.de/english/specs/timestr.htm for details on the
MSTS format.

ldattach(8) is extended to support the "msts" line discipline and two stopbits
(which some radio clocks, e.g. the C51 use). Do a "make includes" before your
next system build.

Initially from Maurice Janssen based on nmea(4). "go for it" deraadt

COMPAT_{23,25,35} should not be used directly

TCP_COMPAT_42 was last used in 1997. Kill it.
ok millert

Re-enable softraid. Tested on virtually all platforms by many people.
Thanks!

ok deraadt

turn off COMPAT_35; ok miod

disable softraid (because sr_boot_assembly->readdisklabel->readdoslabel->biowait)
is what happens on late-cold architectures. something else has to be fixed
first before that is permitted, i guess.

IPX is about to go away, remove commented out IPX options in GENERIC and
ipx related files (doesn't compile anyway)

Enable softraid so that people can start testing it.

Note: this is a work in progress! this is under active development and
things will change.

prompted and ok deraadt

bio for all archs, ok krw@ kettenis@ sounds good marco@ go for it deraadt@

back out bio, breaks dlg's sparc64 v215
prompted by/ok dlg@ deraadt@

prodded by marco, enable bio everywhere
grudgingly ok deraadt@

Enable FFS2, okay deraadt@

Add commented out entry for FFS2

attach softraid to the root of the device tree in a machine independant
way, rather than requiring some glue in each machines mainbus probe.

it is still commented out.

based on a discussion with miod@ ok marco@ deraadt@

Remove the tb(4) line discipline and manual page. I found no man pages
referencing tb(4).

ok deraadt

enable the NMEA 0183 line discipline in GENERIC. see nmea(4) for details.

ok deraadt

Only include PROCFS on kernels which have either COMPAT_LINUX or COMPAT_SVR4,
otherwise it's just a waste of bytes.
ok deraadt@ mickey@

Remove fdescfs

Remove kernfs, okay deraadt@.

Add multicast routing to GENERIC.

It is now possible to enable multicast routing in the kernel with
the sysctl option net.inet.ip.mforwarding=1

Based on intial work by msf@

help claudio@
ok claudio@ deraadt@

-#option NS # XNS
-#option NSIP # XNS tunneling over IP

remove commented-out CCITT option

RIP stackable filesystems, ok marius@ tedu@, discussed with deraadt@

initial import of a trunking (link aggregation and link failover)
implementation. it currently supports round robin mode with link state
checking, additional modes will be added later.

ok brad@, deraadt@

add option VFSDEBUG, disabled by default

enable UDF in GENERIC

Add kernel support for Protocol Independant Multicast (PIM)
Information: http://netweb.usc.edu/pim/

From Pavlin Radoslavov <pavlin@icir.org>

ok deraadt@ brad@

In kernel pppoe client, a simple IPv4 only implementation.
Initial porting from NetBSD by David Berghoff.
Modified/simplified to match our sppp implementation.
ok deraadt@

nothing really uses kernfs anymore, and in general it is unsafe since the
way that it interacts with the buffer cache can result in non-atomic data
ok most people

disable the layer filesystems by default; ok lots of people

remove GATEWAY and IPFORWARDING option knobs, use the sysctl.

ok mcbride@ miod@ deraadt@

remove commented-out netiso stuff

bpf device cloning.
Now to have more bpf devices just add device nodes in /dev,
no need to recompile kernel anymore.

Code from form@pdp-11.org.ru, some help from markus@.
ok markus@ canacar@ deraadt@

make acct(2) optional with ACCOUNTING
ok art@ deraadt@

Add COMPAT_35

Make it more obvious that you don't have to modify the counts on clonable
devices anymore.

ok deraadt@ henning@ krw@ millert@

disable COMPAT_25; ok miod millert

Decrease the initial number of ptys from 64 to 16. If the systems
needs more it will allocate them on demand. OK deraadt@ beck@

Adjust comment now that number of ptys is dynamic.

TCP_SIGNATURE enabled by default

clean out #ifdef horror show in xfs_dev-bsd.c and enable XFS in GENERIC.
ok deraadt@, todd@

dirhash is good to go. ok deraadt@

2 carp not 4

Common Address Redundancy Protocol

Allows multiple hosts to share an IP address, providing high availability
and load balancing.

Based on code by mickey@, with additional help from markus@
and Marco_Pfatschbacher@genua.de

ok deraadt@

make PULLDOWN_TEST codepath the default (has been default for a long time).
markus ok

turn layer fs back on. nullfs at least is very solid, and union isn't too
bad. suggested by deraadt and naddy

do not entice people into playing with broken fs

ok deraadt@

expose state table changes

renable sppp and lmc, now free

turn off sppp, lmc, and cz until various licenses on those components are
resolved. sorry -- i've been warning people for some time that i would
start to take this stance.

Remove kernel support for NTP. ok deraadt@ and tholo@

systrace pseudo-device okay deraadt@

put TCP_ECN into the kernel

Turn the ptrace(2) syscall into a kernel compile option, option PTRACE in
your kernel configuration file.
By default, GENERIC will enable this.

When PTRACE is not enabled, several ptrace-like features of the procfs
filesystem will be disabled as well (namely, the ability to read and write
any process' registers, as well as attching, single stepping and detaching
to/from processes).

This should help paranoid people build better sandboxens, and us to build
smaller ramdisks.

branches: 1.85.4;
No need to define TIMEZONE and DST to 0 here, param.c does that automagically.

change a maze of altq options into just "altq" for the base+red+cbq, and
then altq_* for each of the other * experimental options. and.. enable
it by default in GENERIC.

IPCOMP removal. deraadt@ ok.

"option IPSEC needs the enc interface"

IPComp. Turned off by default in GENERIC.

SWAPPAGER and DEVPAGER are distant memories from the past.

we need only one pflog now

first stab at packet logging for pf. inspired by late night dreams of art.
we just pass drop and passed packets to different pseudo interface that
can be listened to with bpf.

move pf hooks to sys/conf/GENERIC

Remove ipf. Darren Reed has interpreted his (old, new, whichever)
licence in a way that makes ipf not free according to the rules we
established over 5 years ago, at www.openbsd.org/goals.html (and those
same basic rules govern the other *BSD projects too). Specifically,
Darren says that modified versions are not permitted. But software
which OpenBSD uses and redistributes must be free to all (be they
people or companies), for any purpose they wish to use it, including
modification, use, peeing on, or even integration into baby mulching
machines or atomic bombs to be dropped on Australia. Furthermore, we
know of a number of companies using ipf with modification like us, who
are now in the same situation, and we hope that some of them will work
with us to fill this gap that now exists in OpenBSD (temporarily, we
hope).

It's Daylight Saving Time, not Savings. Fix comments.
Discussed with pjanzen@

Create COMPAT_25 and move ogetfsstat, ostatfs and ostatfs into it.
Create COMPAT_23 and move __osemctl, omsgctl, oshmctl there.

kill COMPAT_{09,10,11} kernel options. We still need kern_info_09.c and kern_ipc_10.c for other compat modules.

vlan in GENERIC (ti(4) now has an issue, jason will deal)

FFS_SOFTUPDATES in sys/conf/GENERIC

LFS is not an option right now.

move gif* and faith* into sys/conf/GENERIC. deraadt and angelos ok

Add commented-out MROUTING option (for completeness) -- (james@oaktree.co.uk)

Up the number of gif interfaces, we just need one enc interface.

enable PULLDOWN_TEST, and use m_pulldown for IPv6 packet parsing.
this will make it easier for IPv6 code to cope with uncontinuous packet
header on the mbuf (without this, ep interface on i386 chokes during IPv6
ND process).

should affect IPv6 only.

pseudo-device vlan (commented out for now)

make UVM_SWAP_ENCRYPT default, still need to enable via sysctl

Cryptographic services framework, and software "device driver". The
idea is to support various cryptographic hardware accelerators (which
may be (detachable) cards, secondary/tertiary/etc processors,
software crypto, etc). Supports session migration between crypto
devices. What it doesn't (yet) support:
- multiple instances of the same algorithm used in the same session
- use of multiple crypto drivers in the same session
- asymmetric crypto

No support for a userland device yet.

IPsec code path modified to allow for asynchronous cryptography
(callbacks used in both input and output processing). Some unrelated
code simplification done in the process (especially for AH).

Development of this code kindly supported by Network Security
Technologies (NSTI). The code was writen mostly in Greece, and is
being committed from Montreal.

Add an option DDB_SAFE_CONSOLE that defaults db_console to 1.
In many cases, setting db_console in /etc/rc is too late.

branches: 1.61.2;
add INET6 into conf/GENERIC.
add pseudo-devices for IPv6 into arch/*/conf/GENERIC.
nuke arch/*/conf/GENERIC.v6.

gre(4) interface in GENERIC

insert commented UVM_SWAP_ENCRYPTION

Up the number of enc interfaces.

Put TCP_SACK back in as it is not turned on by default anyway.
That way, users who want it can turn it on via sysctl.

Remove commented out sample of SHMMAXPGS setting with machine-specific
comment. People should read options.4 for such info anyhow, not this file.

SACK is not bug-free yet; off for 2.6

commented out profiling options

Add option NETATALK (commented out).

Added TCP_SIGNATURE option.

lmc driver; ported by chris@dqc.org

disable TCP_FACK for now

remove the NO_KMEMSTATS hack from sys/malloc.h
add KMEMSTATS to GENERIC to keep old behavior

renable TCP_SACK and TCP_FACK again. if you have problems direct flaims
to me.

Reenable IPSEC now that it is off by default, but can be enabled via sysctl

and enc is not default either

disable IPSEC by default

make option IPSEC imply option KEY

support bridging by default

Add option KEY in GENERIC, and update files.

Disable TCP_SACK and TCP_FACK until such time as they don't cause connection
problems between different revisions of OpenBSD.

Re-enable TCP_SACK/TCP_FACK now that it works on alpha

disable FACK/SACK again; they still panic alphas. Sorry Niels, but you have to do better...

reenable SACK and FACK

disable SACK/FACK until provos learns how to write code which does not do unaligned accesses

enable TCP_SACK and TCP_FACK by default

kill COMPAT_09 and COMPAT_10

add a commented out XFS option

add ksyms to GENERIC. Since DDB is already there this is safe.

makeoptions

Enable NTP again now that mickey has solved the pentium timer problem.

Comment out NTP for now as it seems to expose a bug in the use of performance
timers on the Pentium.

typo

Add option NTP to the standard set of things built into the kernel.
Adds minimal bloat vs. functionallity.

provide an lo1 for the netmask hack

noone cares about the strip driver

correct PORTAL comment; kstailey@

Remove COMPAT_NOMID, it should never have been here in the first place.

only need one encap device now

..and EXT2FS for all.

activate IPFILTER_LOG

IPFILTER_LOG should be a kernel option

Add option PPP_BSDCOMP and PPP_DEFLATE

4 strips? there is no need for that

add strip

add ipsec by default

not all ports use rd, duh

rd pdev

add IPXIP option commented out, explanation.

Add a commented out option NSIP with explanation

do not fool people into thinking VNODEPAGER is an option; netbsd pr#2757, erik@aarhus1.uni-c.dk

disable TCP_COMPAT_42 by default

random

note ipx

default to INSECURE

disable LFS

Comment out all obscure networking support; XNS, in particular, is very
busted and crashes people's machines when using ppp.

BOOT_CONFIG for all arch, not just i386

add rnd device.

option not options

GENERIC to be included by arch/XXX/conf/GENERIC; this includes all MI options & pseudo-devices

enable POOL_DEBUG after 7.5 release
OK deraadt@

disable POOL_DEBUG for release
ok deraadt@

Revert chunk that I have commited by accident.

Prevent simultaneous dt(4) open.

Syskaller has hit the assertion "dtlookup(unit) == NULL" by opening
dt(4) device in two parallel threads. Convert kassert into if
condition. Move check that device is not used after sleep points
in malloc. The list dtdev_list is protected by kernel lock which
is released during sleep.

Reported-by: syzbot+6d66c21f796c817948f0@syzkaller.appspotmail.com
OK miod@

re-enable POOL_DEBUG
OK deraadt@

disable POOL_DEBUG for release

enable sec(4) so people can try it out

re-enable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

re-enable POOL_DEBUG
ok deraadt@

disable POOL_DEBUG for release
ok deraadt@

enable kstat(4) and kstat(1).

kstat allows the kernel to expose arbitrary data for userland to
consume. currently this is used by some network card drivers to
expose hardware counters they provide, and a bit by the network
stack to show things like ifq counters.

ok bluhm@ deraadt@

re-enable POOL_DEBUG

disable pool debug for release

Template for option WITNESS is in the architecture GENERIC.MP file
if it is supported. Remove it from the global GENERIC config.
OK visa@ claudio@

Retire switch(4) it never really was production ready and the OpenFlow
API implemented is a deadend.
OK akoshibe@ yasuoka@ deraadt@ kn@ patrick@ sthen@

enable POOL_DEBUG again.

disable pool debug for release
ok deraadt@

Enable dt(4) on amd64, arm64, i386, and powerpc64 in GENERIC kernel.
Support to skip frames is missing on arm64 and i386, but the stack
traces are useful anyway. sparc64 should work, but I could not
test it. Other architectures do not have stacktrace_save_at() and
dynamic tracer does not link.
from patrick@; OK semarie@

reenable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

enable veb(4), it's time for wider testing.

apart from the semantic differences between bridge(4) and veb(4),
the only missing bits in veb(4) is the transparent ipsec interception
support, and spanning tree.

renable POOL_DEBUG
ok deraadt@

disable POOL_DEBUG in preparation for release
ok deraadt@

enable wg(4).

this will make testing easier for everyone.

from Jason A. Donenfeld and Matt Dunwoodie
ok deraadt@ tobhe@

add a commented out entry for wg(4).

i think ive tempted fate enough for one day.

reenable POOL_DEBUG

disable POOL_DEBUG in preparation for release
ok deraadt@

Import dt(4) a driver and framework for Dynamic Profiling.

The design is fairly simple: events, in the form of descriptors on a
ring, are being produced in any kernel context and being consumed by
a userland process reading /dev/dt.

Code and hooks are all guarded under '#if NDT > 0' so this commit
shouldn't introduce any change as long as dt(4) is disable in GENERIC.

ok kettenis@, visa@, jasper@, deraadt@

renable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

enable tpmr(4) so people can try it.

uncomment aggr(4) to make it easier for people to try

add aggr, but leave it commented out for now.

it needs to be a bit more robust before making it more available to try.

disable mobileip(4)

it's not great in several dimensions, so this is a first step to
removing it. if noone has a (reasonable) teary i'll start removing
the code in a few weeks.

"kill it with fire" deraadt@

renable POOL_DEBUG

it is POOL_DEBUG disable time

enable mpip(4)

ok deraadt@

add bpe(4) or Backbone Provider Edge interfaces

Backbone refers to 802.1ah or 802.1Q Provider Backbone Bridges
(PBB), or mac-in-mac, which is like vlans except it completely
encapsulates the inner packet rather than just add a shim to it.
This removes the need for Backbone Core Bridges (ie, switches between
bpe instances) to know all the addresses on all the networks.

Re-enable POOL_DEBUG for -current.

ok deraadt@

POOL_DEBUG is disabled for release

take us to 6.3-current

disable POOL_DEBUG for release
ok deraadt@

dcoppa@ and bluhm@ noted that i accidentally removed POOL_DEBUG

put it back.

split mobileip(4) out from the gre(4) driver.

having mobileip in gre makes it hard to cut gre up. the current mobileip
code is also broken, so this is def and improvement. it also makes it
easy to disable and remove mobileip in the future.

ok claudio@ henning@

Remove the TCP_FACK option and associated #if{,n}def code.

TCP_FACK was disabled by provos@ in June 1999.
TCP_FACK is an algorithm that decides that when something is lost, all
not SACKed packets until the most forward SACK are lost. It may be a
correct estimate, if network does not reorder packets.

OK visa@ mpi@ mikeb@

Unconditionally enable TCP selective acknowledgements (SACK)

OK deraadt, mpi, visa, job

re-enable POOL_DEBUG after the release

disable POOL_DEBUG for release
ok deraadt@

Merge DDBCTF into DDB.

Switch installer to Allotment Routing Table (ART).
Prompted by a bugreport by naddy that IPv6 autoconfiguration is broken
in the installer.
OK mpi, "go for it" deraadt

Kill option KEY, it is a useless knob, nobody uses pfkeyv2 without IPSEC or
tcp md5. OK mpi@

Add option to compile witness(4).

re-enable POOL_DEBUG after the release; ok deraadt@

POOL_DEBUG off for release

temporarily disable BFD, to not block work on unlocking the socket layer.

requested by deraadt@

enable BFD

OK deraadt@

Enable switch(4).

ok jca@, reyk@

Remove PIM support from the multicast stack.

ok mpi@

Build kernel with DEBUG=-g by default.

This will allow us to extract type informations from DWARF2 sections. It
also makes developer life easier as debug information are now included in
every object.

Resulting kernels will be stripped using strip(1) instead of ld(1).

Kernel build time increases by approximately 10%. However it is still
possible to disable this by defining DEBUG="".

ok kettenis@, bluhm@, natano@, jasper@, reyk@, deraadt@

option INSECURE is obsolete

teach ddb(4) about CTF. currently it only loads the CTF and uses it on amd64
to lookup the number of function parameters. however having this basic
facility allows us to expand it's usage.

currently hidden behind the (disabled) DDBCTF kernel option as some of the
required tools are not available in base yet. in addition to that one
also needs recent bootblocks that load the .SUNW_ctf kernel section.

discussed with mpi@ over many a cider and ale in cambridge
feedback and ok guenther@ mpi@

Introduce Dynamic Profiling, a ddb(4) based & gprof compatible kernel
profiling framework.

Code patching is used to enable probes when entering functions. The
probes will call a mcount()-like function to match the behavior of a
GPROF kernel.

Currently only available on amd64 and guarded under DDBPROF. Support
for other archs will follow soon.

A new sysctl knob, ddb.console, need to be set to 1 in securelevel 0
to be able to use this feature.

Inputs and ok guenther@

Add in the (disabled) kernel glue for BFD

OK claudio@, henning@

Import switch(4), an in-kernel OpenFlow switch which can work alone.
switch(4) currently supports OpenFlow 1.3.5.
Currently, it's disabled by the kernel config.

With help from yasuoka@ reyk@ jsg@.

ok deraadt@ yasuoka@ reyk@ henning@

pool debug dance, part deux

disable tmpfs because it receives zero maintainance.

do the pool debug release dance. ok deraadt

unlink systrace from the build. pledge is the glorious future that awaits.
the rest of systrace to be deleted in a serious of followup commits.
ok from larger openbsd developer community

Enable ART.

Leave the define for the moment, this will be changed as soon as we're
confident enough.

"it must be a 3-line diff" krw@

ok bluhm@, mikeb@, dlg@, reyk@, deraadt@

activate POOL_DEBUG during -current; miod

deactivate POOL_DEBUG for release
ok deraadt, jsg

Implement etherip(4) driver

This commit is not removing the existing EtherIP part of gif(4) and
it keeps EtherIP of gif(4) working.

ok jbg@ sthen@ mpi@ reyk@ yasuoka@

Add pair(4), a vether-based virtual Ethernet driver to interconnect
rdomains and bridges on the local system. This can be used to route
through local rdomains, to create L2 devices (like trunks) between
them, and many other things.

Discussed with many, with input from mpi@
OK sthen@ phessler@ yasuoka@ mikeb@

Allocate a new major for tap(4) also note that pseudo-device tun is for tap
as well. OK dlg@ mpi@

turn POOL_DEBUG back on

As usual, turn off POOL_DEBUG for the release.
ok deraadt@

Implemented MPLS pseudowire (mpw(4)) to be used with VPLS and VPWS.

ok mpi@, claudio@.

remove obsolete INET kernel option

we're tagged for release; turn POOL_DEBUG back on. ok deraadt@

disable POOL_DEBUG for release
ok deraadt@

Delete option COMPAT_43: support for pre-sa_len binaries has been obsolete
for a couple decades. Keep the OSIOCGIFCONF ioctl to support COMPAT_LINUX
but move the rest of the Linux-specific ioctl() handling into linux_socket.c
This lets struct osockaddr finally move from sys/socket.h to protocols/talkd.h

ok krw@ deraadt@ mpi@

remove LKM

sl(4) is no more, thanks for all the fish!

pool debug back on

disable POOL_DEBUG for release

-option ALTQ
ALTQ has served us well for years and was extremely important not just for
us, but for the entire bandwidth management arena. Back when we got altq,
the subject was not yet well researched and understood, which is why altq
is the framework with pluggable schedulers it is. Kenjiro Cho (kjc@) did an
amazing job there.
Now, more than 10 years later, we do have a good understanding and can use
a simpler framework with just one priority queueing and one bandwidth
shaping mechanism each - the new queueing subsystem. Last not least because
it is incredibly painful to maintain both in parallel, it is time for altq
to depart. Farewell, thanks for many years of good service. Everybody
using any form of "not just fifo" queueing owes Kenjiro a lot. At least
buy him a beer when you meet him.
And, allow me this personal note, thanks Kenjiro, working with you on the
topic has always been a great pleasure and I learned a lot from you. Thanks!

re-enable POOL_DEBUG

disable POOL_DEBUG for release
ok deraadt@

enable tmpfs so it gets tested some more.
okay kettenis@, martin@, beck@, krw@, tedu@, millert@

enable fuse.

ok deraadt@

enable vxlan(4). ok deraadt@

Import vxlan(4), the virtual extensible local area network tunnel
interface. VXLAN is a UDP-based tunnelling protocol for overlaying
virtualized layer 2 networks over layer 3 networks. The implementation
is based on draft-mahalingam-dutt-dcops-vxlan-04 and has been tested
with other implementations in the wild.

put it in deraadt@

as predicted, problems have been found with mpath. disabling it while they
get figured out.

enable mpath, rdac, and sym to see what will happen.

discussed with and ok deraadt. we expect a problem will appear which will
cause it to be disabled again, but unless we try this we wont see the
problems.

Fix comment, socket splice can also do UDP now. Fix white spaces.

The last user of the old __tfork() was updated to the current one,
so COMPAT_O51 can go. The complete ABI role means COMPAT_O53 can
be removed as well.

ok jsing@ tedu@

re-enable POOL_DEBUG after release; ok deraadt@

disable POOL_DEBUG for release
ok deraadt@

Add an f_mntfromspec member to struct statfs, which specifies the name of
the special provided when the mount was requested. This may be the same as
the special that was actually used for the mount (e.g. in the case of a
device node) or it may be different (e.g. in the case of a DUID).

Whilst here, change f_ctime to a 64 bit type and remove the pointless
f_spare members.

Compatibility goo courtesy of guenther@

ok krw@ millert@

tedu faith(4), suggested by todd@ some weeks ago after a submission by
dhill.

ok krw@, mikeb@, tedu@ (implicit)

Antici

pation: back to -current

welcome to 5.3-BETA

cleanup around the pipex. naming style, delete or update comments.
no functional changes.

COMPAT_O48 can be turned off; ok guenther

kill nnpfs dead

now that we are current again, enable POOL_DEBUG

As usual, turn off POOL_DEBUG for the release. Note that POOL_DEBUG is
not the same as it was in 4.9 or earlier. In either case you can turn
it on again using sysctl kern.pool_debug=1 -- but if POOL_DEBUG is not
enabled you only get a subset of the strict checks.

ok deraadt@

Actually enabling the __tfork compat code would be a Good Thing

re-enable POOL_DEBUG for -current

As usual, turn off POOL_DEBUG for the release. Note that POOL_DEBUG is
not the same as it was in 4.9 or earlier. In either case you can turn
it on again using sysctl kern.pool_debug=1 -- but if POOL_DEBUG is not
enabled you only get a subset of the strict checks.
prodded by david

ccd goes to the attic
discussed with jsing and millert

Re-enable POOL_DEBUG. requested by deraadt@.

As usual, turn off POOL_DEBUG for the release. Note that POOL_DEBUG is
not the same as it was in 4.9 or earlier. In either case you can turn
it on again using sysctl kern.pool_debug=1 -- but if POOL_DEBUG is not
enabled you only get a subset of the strict checks.
ok kettenis miod beck

Fix up previous diff: use COMPAT_O48 instead of COMPAT_48, add option
to GENERIC, wrap compat_o48_sys_getdirentries() with an appropriate
#ifdef, and use struct compat_o48_sys_getdirentries_args instead of
struct sys_getdirentries_args.

begone, fucking rotten appletalk shit. ok room

this also must be included my previous commit. sorry.

Include PIPEX in kernel by default. And add new sysctl variable
`net.pipex.enable' to enable PIPEX. By default, pipex is disabled
and it will not process packets from wire. Update man pages and
update HOWTO_PIPEX_NPPPD.txt for testers.

discussed with dlg@, ok deraadt@ mcbride@ claudio@

do 1.174 correctly and remove (commented out) option PORTAL

Disable NNPFS;

A purdy OpenAFS port is being worked on and everybody hates
having to touch files inside nnpfs/ so it is going to go away
real soon.

ok deraadt@, beck@

rename VFSDEBUG to VFLCKDEBUG;

prompted by tedu@

POOL_DEBUG has nothing to do with portalfs

Remove portalfs.

While it is a terribly cool idea, it's just awful and since noone has stepped
up to the plate to keep it up with the current vop state, retire it to the
attic.

ok krw@, deraadt@, guenther@, miod@.
comments from jmc@

COMPAT_O47 (kernel getpeereid, which was replaced by libc getpeereid)
can go away
ok guenther

enable POOL_DEBUG again since we are not in release

move us to real 4.9

group filesystems together

ok miod@

Add socket option SO_SPLICE to splice together two TCP sockets.
The data received on the source socket will automatically be sent
on the drain socket. This allows to write relay daemons with zero
data copy.
ok markus@

There is no reason to not include MPLS and mpe(4) in GENERIC. Makes my
life a lot easier. Sure deraadt@

use a better description for the vnd(4) entry on this file.

ok millert@

vscsi lives once more!

Add a new interface pppx(4) -- the ppp multiplexer to be used with npppd
and pipex. pppx(4) creates an interface whenever a session is created
so that altq and pf can work on these.
Started by dlg@ debugged and made usable by myself
OK dlg@ yasuoka@ deraadt@

Move getpeereid(2) into COMPAT_O47. In 4.8 and onwards it is library
code using socket options.
ok matthew

now that we are at -current again, re-enable POOL_DEBUG

"go ahead" kettenis@

we ship releases with POOL_DEBUG off. post-release, turn it back on.
POOL_DEBUG is for development safety (catches our bugs early), but this
particular safety comes off for release.
reminded by miod

disable vscsi until we actually have something that uses it (like iscsid),
and until matthew@ is happy with it.

suggested by deraadt@

garbage collect the now unused PAGEFASTRECYCLE option.

ok deraadt@, david@

turn off COMPAT_O43

Replace enc(4) with a new implementation as a cloner device. We still
create enc0 by default, but it is possible to add additional enc
interfaces. This will be used later to allow alternative encs per
policy or to have an enc per rdomain when IPsec becomes rdomain-aware.

manpage bits ok jmc@
input from henning@ deraadt@ toby@ naddy@
ok henning@ claudio@

PAGEFASTRECYCLE does not exist as an option after uvm_pmemrange; it is
implied.

order the network pseudo-devices by name. Move pppoe and sppp into that list.
OK kettenis, krw, dlg

Add commented MPLS and mpe(4) entries.
OK sthen, jsg

Enable PAGEFASTRECYCLE.

ok deraadt@, ariane@

enable POOL_DEBUG

we disable POOL_DEBUG for releases. Reminded by mpf
After release, someone please remind us to turn it on again. It helps
find bugs. We just don't want people to get hosed too much during
release.

Add PIPEX option, disabled by default for now.

ok deraadt yasuoka

vether(4) is a virtual ethernet device driver which can be used
so that a bridge-etherip-tunnel host can join into the bridge itself.
It is ridiculous that this capability was missing from our network
stack portfolio, considering we have bgp and ospf daemons...
discussed at length with claudio

add commented out options for PAGEFASTRECYCLE, KVA_GUARDPAGES, shuffle VFSDEBUG
around and add POOL_DEBUG as an enabled option, removing the define from subr_pool.c.

comments & ok deraadt@.

Remove support for packet mode of Metricom Ricochet radios.
It currently doesn't compile and this is unlikely to change
as there are many alternatives now since we no longer live
in the early 1990s and Metricom went bankrupt some time ago.

ok many @

wire vscsi up to a cdev

for claudio@ ok deraadt@

add mpath(4), a driver that steals paths to scsi devices if it
thinks they could be available via multiple paths. those stolen
devices are then made available via mpath(4).

this is the minimum amount of code to implement the stealing. it
is generally broken and very brittle, so it is currently disabled.

it is going in so i can work on it in the tree.

Arla client rename from xfs to nnpfs for later upgrades. Tested on various arches. ok todd@ beck@

endrun(4) - EndRun Technologies native time-of-day message timedelta
sensor. Based on msts(4). Tested with Praecis Ct
(http://www.endruntechnologies.com/network-time-source.htm).

help and feedback mbalmer
'no problem with this sensor going in' deraadt

Disable portalfs until it is fixed, okay deraadt@.

actually enable pflow