Re: amd64: update PTDpaddr with new PA of PML4 for libkvm

2019-02-14 Thread Naoki Fukaumi
Hi,

From: Mike Larkin 
Subject: Re: amd64: update PTDpaddr with new PA of PML4 for libkvm
Date: Wed, 13 Feb 2019 01:01:28 -0800

> On Wed, Feb 13, 2019 at 05:40:45PM +0900, Naoki Fukaumi wrote:
>> Hi Mike Larkin,
>> 
>> since pmap_kernel is randomized, savecore(libkvm) cannot save core
>> dump from dump device. (savecore: magic number mismatch)
>> 
>> updating PTDpaddr fixes this issue.
>> 
>> by the way, is there any problem to use proc0.p_addr->u_pcb.pcb_cr3
>> instead of PTDpaddr in cpu_dump()?
>> 
> 
> Thanks for noticing this!
> 
> Does using the proc0.p_addr->u_pcb.pcb_cr3 expansion also work?
> If so, we may be able to remove PTPpaddr entirely, if we remove the
> other usage in cpu_dump also.

here is "remove PTDpaddr" patch.

it works, but now I'm not sure which is better... using extra
"PTDpaddr" might be simpler... at least, I don't need to worry about
"is this chain really fine?" ;)



for "using PTDpaddr" case, I think it might be better to

- set PTDpaddr later in locore0.S (around setting pcb_cr3)
- use a term "PML4" than "PTD"/"PDP" in comments

to make thing more clear (for me).

Regards,

--
FUKAUMI Naoki

Index: sys/arch/amd64/amd64/locore.S
===
RCS file: /cvs/src/sys/arch/amd64/amd64/locore.S,v
retrieving revision 1.113
diff -u -p -u -p -r1.113 locore.S
--- sys/arch/amd64/amd64/locore.S   24 Jan 2019 00:00:50 -  1.113
+++ sys/arch/amd64/amd64/locore.S   15 Feb 2019 07:07:09 -
@@ -172,7 +172,7 @@ _C_LABEL(lapic_isr):
.globl  _C_LABEL(ssym),_C_LABEL(esym),_C_LABEL(boothowto)
.globl  _C_LABEL(bootdev)
.globl  _C_LABEL(bootinfo), _C_LABEL(bootinfo_size), _C_LABEL(atdevbase)
-   .globl  _C_LABEL(proc0paddr),_C_LABEL(PTDpaddr)
+   .globl  _C_LABEL(proc0paddr)
.globl  _C_LABEL(biosbasemem)
.globl  _C_LABEL(bootapiver)
.globl  _C_LABEL(pg_nx)
@@ -198,7 +198,6 @@ _C_LABEL(atdevbase):.quad   0   # location 
 _C_LABEL(bootapiver):  .long   0   # /boot API version
 _C_LABEL(bootdev): .long   0   # device we booted from
 _C_LABEL(proc0paddr):  .quad   0
-_C_LABEL(PTDpaddr):.quad   0   # paddr of PTD, for libkvm
 #ifndef REALBASEMEM
 _C_LABEL(biosbasemem): .long   0   # base memory reported by BIOS
 #else
Index: sys/arch/amd64/amd64/locore0.S
===
RCS file: /cvs/src/sys/arch/amd64/amd64/locore0.S,v
retrieving revision 1.16
diff -u -p -u -p -r1.16 locore0.S
--- sys/arch/amd64/amd64/locore0.S  24 Jan 2019 00:57:14 -  1.16
+++ sys/arch/amd64/amd64/locore0.S  15 Feb 2019 07:07:09 -
@@ -548,11 +548,6 @@ store_pte:
movl%ebp, 4(%ebx)
popl%ebp
 
-   /* Save phys. addr of PTD, for libkvm. */
-   movl$RELOC(PTDpaddr),%ebp
-   movl%esi,(%ebp)
-   movl$0,4(%ebp)
-
/*
 * Startup checklist:
 * 1. Enable PAE (and SSE while here).
Index: sys/arch/amd64/amd64/machdep.c
===
RCS file: /cvs/src/sys/arch/amd64/amd64/machdep.c,v
retrieving revision 1.254
diff -u -p -u -p -r1.254 machdep.c
--- sys/arch/amd64/amd64/machdep.c  21 Jan 2019 06:18:37 -  1.254
+++ sys/arch/amd64/amd64/machdep.c  15 Feb 2019 07:07:09 -
@@ -925,7 +925,7 @@ cpu_dump(void)
/*
 * Add the machine-dependent header info.
 */
-   cpuhdrp->ptdpaddr = PTDpaddr;
+   cpuhdrp->ptdpaddr = proc0.p_addr->u_pcb.pcb_cr3;
cpuhdrp->nmemsegs = mem_cluster_cnt;
 
/*
Index: sys/arch/amd64/include/pmap.h
===
RCS file: /cvs/src/sys/arch/amd64/include/pmap.h,v
retrieving revision 1.73
diff -u -p -u -p -r1.73 pmap.h
--- sys/arch/amd64/include/pmap.h   21 Jan 2019 06:18:37 -  1.73
+++ sys/arch/amd64/include/pmap.h   15 Feb 2019 07:07:09 -
@@ -344,9 +344,6 @@ struct pv_entry {   /* locked by its lis
  * global kernel variables
  */
 
-/* PTDpaddr: is the physical address of the kernel's PDP */
-extern u_long PTDpaddr;
-
 extern struct pmap kernel_pmap_store;  /* kernel pmap */
 
 extern long nkptp[];



Re: add getrun for rcctl(8)

2019-02-14 Thread YASUOKA Masahiko
On Fri, 15 Feb 2019 14:45:14 +0900 (JST)
YASUOKA Masahiko  wrote:
> The diff adds "getrun" command for rcctl(8) which shows the daemon
> variables from the running daemon.
> 
> ok? comment?

Sorry, previous diff is broken.  It could not get any value other than
daemon_pexp.  Let me update the diff.

Index: usr.sbin/rcctl/rcctl.8
===
RCS file: /cvs/src/usr.sbin/rcctl/rcctl.8,v
retrieving revision 1.35
diff -u -p -r1.35 rcctl.8
--- usr.sbin/rcctl/rcctl.8  20 Sep 2018 12:24:14 -  1.35
+++ usr.sbin/rcctl/rcctl.8  15 Feb 2019 05:48:16 -
@@ -22,7 +22,7 @@
 .Nd configure and control daemons and services
 .Sh SYNOPSIS
 .Nm rcctl
-.Cm get Ns | Ns Cm getdef Ns | Ns Cm set
+.Cm get Ns | Ns Cm getdef Ns | Ns Cm getrun Ns | Ns Cm set
 .Ar service | daemon Op Ar variable Op Ar arguments
 .Nm rcctl
 .Op Fl df
@@ -103,6 +103,10 @@ will display all services and daemons va
 Like
 .Cm get
 but returns the default values.
+.It Cm getrun Ar service | daemon Op Ar variable
+Like
+.Cm get
+but returns the values of the running daemon.
 .It Cm ls Ar lsarg
 Display a list of services and daemons matching
 .Ar lsarg ,
@@ -180,6 +184,9 @@ exits with 0 if the daemon or service is
 .Nm Cm getdef Ar daemon | service Op Cm status
 exits with 0 if the daemon or service is enabled by default
 and 1 if it is not.
+.Nm Cm getrun Ar daemon | service
+exits with 0 if the values of the running daemon exists
+and 1 if it doesn't.
 .Nm Cm ls failed
 exits with 1 if an enabled daemon is not running.
 Otherwise, the
Index: usr.sbin/rcctl/rcctl.sh
===
RCS file: /cvs/src/usr.sbin/rcctl/rcctl.sh,v
retrieving revision 1.107
diff -u -p -r1.107 rcctl.sh
--- usr.sbin/rcctl/rcctl.sh 21 Oct 2018 21:20:40 -  1.107
+++ usr.sbin/rcctl/rcctl.sh 15 Feb 2019 05:48:16 -
@@ -21,6 +21,7 @@ _special_svcs="accounting check_quotas i
spamd_black"
 readonly _special_svcs
 
+_RC_RUNDIR=/var/run/rc.d
 # get local functions from rc.subr(8)
 FUNCS_ONLY=1
 . /etc/rc.d/rc.subr
@@ -32,7 +33,7 @@ usage()
for _i in ${_rc_actions}; do _a="$(echo -n ${_i}${_a:+|${_a}})"; done
 
_rc_err \
-   "usage: rcctl get|getdef|set service | daemon [variable [arguments]]
+   "usage: rcctl get|getdef|getrun|set service | daemon [variable 
[arguments]]
rcctl [-df] ${_a} daemon ...
rcctl disable|enable|order [daemon ...]
rcctl ls all|failed|off|on|started|stopped"
@@ -374,6 +375,35 @@ svc_getdef()
fi
 }
 
+svc_getrun()
+{
+   local _svc=$1
+
+   ( svc_is_special ${_svc} || svc_is_meta ${_svc} ) && return 1
+
+   local _val _var=$2
+   local daemon_class daemon_flags daemon_rtable daemon_timeout daemon_user
+   local daemon_pexp
+
+   [ ! -f $_RC_RUNDIR/$_svc ] && return 1
+   _rc_parse_conf -readonly $_RC_RUNDIR/$_svc
+
+   [ -z "${daemon_pexp}" ] && eval daemon_pexp=\${pexp}
+
+   if [ -n "${_var}" ]; then
+   eval _val=\${daemon_${_var}}
+   [ -z "${_val}" ] || print -r -- "${_val}"
+   else
+   echo "${_svc}_class=${daemon_class}"
+   echo "${_svc}_flags=${daemon_flags}"
+   echo "${_svc}_rtable=${daemon_rtable}"
+   echo "${_svc}_timeout=${daemon_timeout}"
+   echo "${_svc}_user=${daemon_user}"
+   echo "${_svc}_pexp=${daemon_pexp}"
+   fi
+   return 0
+}
+
 svc_rm()
 {
local _svc=$1
@@ -509,7 +539,7 @@ case ${action} in
done
fi
;;
-   get|getdef)
+   get|getdef|getrun)
svc=$2
var=$3
[ -z "${svc}" ] && usage
@@ -571,7 +601,7 @@ case ${action} in
done
exit ${ret}
;;
-   get|getdef)
+   get|getdef|getrun)
if [ "${svc}" = "all" ]; then
for svc in $(svc_ls all); do
( svc_${action} ${svc} "${var}" )
Index: etc/rc.d/rc.subr
===
RCS file: /cvs/src/etc/rc.d/rc.subr,v
retrieving revision 1.130
diff -u -p -r1.130 rc.subr
--- etc/rc.d/rc.subr20 Jan 2019 04:52:07 -  1.130
+++ etc/rc.d/rc.subr15 Feb 2019 05:48:16 -
@@ -138,18 +138,24 @@ _rc_quirks() {
 
 _rc_parse_conf() {
typeset -l _key
-   local _l _rcfile _val
+   local _l _rcfile _val _readonly=
set -A _allowed_keys -- \
accounting amd_master check_quotas ipsec library_aslr \
multicast nfs_server pexp pf pkg_scripts shlib_dirs spamd_black
 
+   if [ "$1" = "-readonly" ]; then
+   _readonly=y
+   shift
+   fi
+
[ $# -gt 0 ] || set -- /etc/rc.conf /etc/rc.conf.local
for _rcfile; do
[[ -f $_rcfile ]] || continue

add getrun for rcctl(8)

2019-02-14 Thread YASUOKA Masahiko
Hi,

The diff adds "getrun" command for rcctl(8) which shows the daemon
variables from the running daemon.

ok? comment?

Index: usr.sbin/rcctl/rcctl.8
===
RCS file: /cvs/src/usr.sbin/rcctl/rcctl.8,v
retrieving revision 1.35
diff -u -p -r1.35 rcctl.8
--- usr.sbin/rcctl/rcctl.8  20 Sep 2018 12:24:14 -  1.35
+++ usr.sbin/rcctl/rcctl.8  15 Feb 2019 05:41:38 -
@@ -22,7 +22,7 @@
 .Nd configure and control daemons and services
 .Sh SYNOPSIS
 .Nm rcctl
-.Cm get Ns | Ns Cm getdef Ns | Ns Cm set
+.Cm get Ns | Ns Cm getdef Ns | Ns Cm getrun Ns | Ns Cm set
 .Ar service | daemon Op Ar variable Op Ar arguments
 .Nm rcctl
 .Op Fl df
@@ -103,6 +103,10 @@ will display all services and daemons va
 Like
 .Cm get
 but returns the default values.
+.It Cm getrun Ar service | daemon Op Ar variable
+Like
+.Cm get
+but returns the values of the running daemon.
 .It Cm ls Ar lsarg
 Display a list of services and daemons matching
 .Ar lsarg ,
@@ -180,6 +184,9 @@ exits with 0 if the daemon or service is
 .Nm Cm getdef Ar daemon | service Op Cm status
 exits with 0 if the daemon or service is enabled by default
 and 1 if it is not.
+.Nm Cm getrun Ar daemon | service
+exits with 0 if the values of the running daemon exists
+and 1 if it doesn't.
 .Nm Cm ls failed
 exits with 1 if an enabled daemon is not running.
 Otherwise, the
Index: usr.sbin/rcctl/rcctl.sh
===
RCS file: /cvs/src/usr.sbin/rcctl/rcctl.sh,v
retrieving revision 1.107
diff -u -p -r1.107 rcctl.sh
--- usr.sbin/rcctl/rcctl.sh 21 Oct 2018 21:20:40 -  1.107
+++ usr.sbin/rcctl/rcctl.sh 15 Feb 2019 05:41:38 -
@@ -21,6 +21,7 @@ _special_svcs="accounting check_quotas i
spamd_black"
 readonly _special_svcs
 
+_RC_RUNDIR=/var/run/rc.d
 # get local functions from rc.subr(8)
 FUNCS_ONLY=1
 . /etc/rc.d/rc.subr
@@ -32,7 +33,7 @@ usage()
for _i in ${_rc_actions}; do _a="$(echo -n ${_i}${_a:+|${_a}})"; done
 
_rc_err \
-   "usage: rcctl get|getdef|set service | daemon [variable [arguments]]
+   "usage: rcctl get|getdef|getrun|set service | daemon [variable 
[arguments]]
rcctl [-df] ${_a} daemon ...
rcctl disable|enable|order [daemon ...]
rcctl ls all|failed|off|on|started|stopped"
@@ -374,6 +375,34 @@ svc_getdef()
fi
 }
 
+svc_getrun()
+{
+   local _svc=$1
+
+   ( svc_is_special ${_svc} || svc_is_meta ${_svc} ) && return 1
+   [ ! -f $_RC_RUNDIR/$_svc ] && return 1
+   _rc_parse_conf -readonly $_RC_RUNDIR/$_svc
+
+   local _val _var=$2
+   local daemon_class daemon_flags daemon_rtable daemon_timeout daemon_user
+   local daemon_pexp
+
+   [ -z "${daemon_pexp}" ] && eval daemon_pexp=\${pexp}
+
+   if [ -n "${_var}" ]; then
+   eval _val=\${daemon_${_var}}
+   [ -z "${_val}" ] || print -r -- "${_val}"
+   else
+   echo "${_svc}_class=${daemon_class}"
+   echo "${_svc}_flags=${daemon_flags}"
+   echo "${_svc}_rtable=${daemon_rtable}"
+   echo "${_svc}_timeout=${daemon_timeout}"
+   echo "${_svc}_user=${daemon_user}"
+   echo "${_svc}_pexp=${daemon_pexp}"
+   fi
+   return 0
+}
+
 svc_rm()
 {
local _svc=$1
@@ -509,7 +538,7 @@ case ${action} in
done
fi
;;
-   get|getdef)
+   get|getdef|getrun)
svc=$2
var=$3
[ -z "${svc}" ] && usage
@@ -571,7 +600,7 @@ case ${action} in
done
exit ${ret}
;;
-   get|getdef)
+   get|getdef|getrun)
if [ "${svc}" = "all" ]; then
for svc in $(svc_ls all); do
( svc_${action} ${svc} "${var}" )
Index: etc/rc.d/rc.subr
===
RCS file: /cvs/src/etc/rc.d/rc.subr,v
retrieving revision 1.130
diff -u -p -r1.130 rc.subr
--- etc/rc.d/rc.subr20 Jan 2019 04:52:07 -  1.130
+++ etc/rc.d/rc.subr15 Feb 2019 05:41:38 -
@@ -138,18 +138,24 @@ _rc_quirks() {
 
 _rc_parse_conf() {
typeset -l _key
-   local _l _rcfile _val
+   local _l _rcfile _val _readonly=
set -A _allowed_keys -- \
accounting amd_master check_quotas ipsec library_aslr \
multicast nfs_server pexp pf pkg_scripts shlib_dirs spamd_black
 
+   if [ "$1" = "-readonly" ]; then
+   _readonly=y
+   shift
+   fi
+
[ $# -gt 0 ] || set -- /etc/rc.conf /etc/rc.conf.local
for _rcfile; do
[[ -f $_rcfile ]] || continue
while IFS=' ' read -r _l; do
[[ $_l == [!#=]*=* ]] || continue
_key=${_l%%*([[:blank:]])=*}
-   [[ $_key == 

Re: Why both media and -mediaopt doesn't specify at the same time?

2019-02-14 Thread Masato Asou
From: YASUOKA Masahiko 
Date: Thu, 14 Feb 2019 15:34:26 +0900 (JST)

> On Thu, 14 Feb 2019 08:30:45 +0900 (JST)
> Masato Asou  wrote:
>> From: Claudio Jeker 
>> Date: Wed, 13 Feb 2019 14:25:58 +0100
>> 
>>> On Wed, Feb 13, 2019 at 11:04:02AM +0900, Masato Asou wrote:
 Hi,
 
 When I execute `ifconfig media XX -mediaopt YY' command, it occured
 error as below.
 
 $ doas ifconfig em1 media 100baseTX -mediaopt full-duplex
 ifconfig: may not issue both `media' and `-mediaopt'
 $ echo $?
 1
 
 Does anyone knows this reason?
>>> 
>>> This was done to prevent changing mediaopt while changing media at the
>>> same time. Media and mediaopt are linked together and ifconfig fetches
>>> the initial settings early on. Changing media and mediaopt at the same
>>> time may end up with a results that puts the interface into an invalid
>>> state.
>> 
>> Thanks for your explanation.
>> 
>> However, media and mediaopt (not `-') can specfy same time. Does this
>> work valid?
> 
> The reason isn't because we can assume all "mediaopt" are cleared when
> changing "media"?  Then clearing individual "mediaopt" when changing
> "media" doesn't make sense.

Oh!
My thought was missing.

Thanks

> 
>>> Is there a particular reason why you need to use media and
>>> -mediaopt at the same time?
>> 
>> I have no particular reason. I just thiking that way.
>> If specified media and -media same time, I only execute one command.
>> 
 I think following patch is works fine.
 
 $ cvs diff ifconfig.c
 Index: ifconfig.c
 ===
 RCS file: /cvs/src/sbin/ifconfig/ifconfig.c,v
 retrieving revision 1.379
 diff -u -p -r1.379 ifconfig.c
 --- ifconfig.c  30 Sep 2018 18:19:24 -  1.379
 +++ ifconfig.c  13 Feb 2019 01:58:18 -
 @@ -2797,10 +2797,6 @@ unsetmediaopt(const char *val, int d)
 if (actions & A_MEDIAOPTCLR)
 errx(1, "only one `-mediaopt' command may be issued");
 
 -   /* May not issue `media' and `-mediaopt'. */
 -   if (actions & A_MEDIA)
 -   errx(1, "may not issue both `media' and `-mediaopt'");
 -
 /*
  * No need to check for A_MEDIAINST, since the test for A_MEDIA
  * implicitly checks for A_MEDIAINST.
 --
 ASOU Masato
 
>>> 
>>> -- 
>>> :wq Claudio
>> 
>> --
>> ASOU Masato
>> 
> 
--
ASOU Masato



Re: dd conv=fsync

2019-02-14 Thread Ted Unangst
Alexander Bluhm wrote:
> GNU dd has the conv=fsync feature which does an fsync(2) after final
> write to output.  I find this useful for write performance measurement
> through the file system without buffer cache optimization.  Others
> may like the reliable storage guarantee of fsync(2).
> 
> Do we want dd conv=fsync in OpenBSD?

What does gnu dd do if the output is stdout? Is it an error?

With this patch, I get dd: fsync stdout: Invalid argument
after the transfer is complete. Should there be an fstat check to make sure
it's a regular file?

> +.It Cm fsync
> +Write output to permanent storage device before finishing.

I know this wording is similar to fsync(2), but I think I'd prefer just a
reference. The output may not be permanent storage. What about

Call
.Xr fsync 2
on the output file before exiting.




ikectl ca's 1 year validity

2019-02-14 Thread Stuart Henderson
I usually setup iked with certificates generated by other tooling, but
have used "ikectl ca" once or twice when I've been in a hurry, and each
time have been bitten by the default validities. It uses 365 days for
everything.

For server certificates it's simple enough to rekey or at least re-sign
so 1 year default seems reasonable. In addition this is controlled by
an easily editable .cnf file.

Client certificates are a bit more hassle to update but like server
certificates you don't usually want hugely long validity for these.
Again they're controlled by the .cnf file, and the most common end-
user-facing setups using EAP username/password login don't need them
anyway.

For CRLs and CA certificates this is hardcoded in the ikectl binary.
A year is *way* too short for root CA validity. Can we bump it? The
proposal below feels reasonable to me for ikectl but I'm open to other
suggestions (I'm fairly happy with this being hardcoded for ikectl ca
use, as long as it's a sane value .. users with strong opinions or
policies diverging from ikectl's default are likely to know enough
to be able to manage their CA with other tools).


Index: ikeca.c
===
RCS file: /cvs/src/usr.sbin/ikectl/ikeca.c,v
retrieving revision 1.47
diff -u -p -r1.47 ikeca.c
--- ikeca.c 8 Nov 2017 09:33:37 -   1.47
+++ ikeca.c 14 Feb 2019 20:44:31 -
@@ -429,7 +429,7 @@ ca_create(struct ca *ca)
system(cmd);
chmod(path, 0600);
 
-   snprintf(cmd, sizeof(cmd), "%s x509 -req -days 365"
+   snprintf(cmd, sizeof(cmd), "%s x509 -req -days 4500"
" -in %s/private/ca.csr -signkey %s/private/ca.key"
" -sha256"
" -extfile %s -extensions x509v3_CA -out %s/ca.crt -passin file:%s",



dd conv=fsync

2019-02-14 Thread Alexander Bluhm
Hi,

GNU dd has the conv=fsync feature which does an fsync(2) after final
write to output.  I find this useful for write performance measurement
through the file system without buffer cache optimization.  Others
may like the reliable storage guarantee of fsync(2).

Do we want dd conv=fsync in OpenBSD?

bluhm

Index: bin/dd/args.c
===
RCS file: /data/mirror/openbsd/cvs/src/bin/dd/args.c,v
retrieving revision 1.30
diff -u -p -r1.30 args.c
--- bin/dd/args.c   25 Jul 2018 15:09:48 -  1.30
+++ bin/dd/args.c   14 Feb 2019 15:05:18 -
@@ -274,6 +274,7 @@ static const struct conv {
{ "ascii",  C_ASCII,C_EBCDIC,   e2a_POSIX },
{ "block",  C_BLOCK,C_UNBLOCK,  NULL },
{ "ebcdic", C_EBCDIC,   C_ASCII,a2e_POSIX },
+   { "fsync",  C_FSYNC,0,  NULL },
{ "ibm",C_EBCDIC,   C_ASCII,a2ibm_POSIX },
{ "lcase",  C_LCASE,C_UCASE,NULL },
{ "osync",  C_OSYNC,C_BS,   NULL },
Index: bin/dd/dd.1
===
RCS file: /data/mirror/openbsd/cvs/src/bin/dd/dd.1,v
retrieving revision 1.33
diff -u -p -r1.33 dd.1
--- bin/dd/dd.1 17 Aug 2016 21:23:01 -  1.33
+++ bin/dd/dd.1 14 Feb 2019 18:12:03 -
@@ -203,6 +203,8 @@ is a slightly different mapping, which i
 .At V
 .Cm ibm
 value.
+.It Cm fsync
+Write output to permanent storage device before finishing.
 .It Cm lcase
 Transform uppercase characters into lowercase characters.
 .It Cm noerror
Index: bin/dd/dd.c
===
RCS file: /data/mirror/openbsd/cvs/src/bin/dd/dd.c,v
retrieving revision 1.25
diff -u -p -r1.25 dd.c
--- bin/dd/dd.c 23 Jul 2018 23:09:37 -  1.25
+++ bin/dd/dd.c 14 Feb 2019 18:13:55 -
@@ -347,6 +347,10 @@ dd_close(void)
}
if (out.dbcnt)
dd_out(1);
+   if (ddflags & C_FSYNC) {
+   if (fsync(out.fd) == -1)
+   err(1, "fsync %s", out.name);
+   }
 }
 
 void
Index: bin/dd/dd.h
===
RCS file: /data/mirror/openbsd/cvs/src/bin/dd/dd.h,v
retrieving revision 1.8
diff -u -p -r1.8 dd.h
--- bin/dd/dd.h 13 Aug 2017 02:06:42 -  1.8
+++ bin/dd/dd.h 14 Feb 2019 15:05:18 -
@@ -96,3 +96,4 @@ typedef struct {
 #defineC_STATUS0x20
 #defineC_NOXFER0x40
 #defineC_NOINFO0x80
+#defineC_FSYNC 0x100



Re: video(1) and modesetting driver

2019-02-14 Thread Martin Pieuchot
On 14/02/19(Thu) 11:24, Raphael Graf wrote:
> On Wed, Feb 13, 2019 at 04:09:10PM -0200, Martin Pieuchot wrote:
> > On 07/02/19(Thu) 13:52, Raphael Graf wrote:
> > > [...] 
> > > The new diff below solves this yuy2/yuyv problem by defining them both 
> > > under
> > > the same name 'yuy2'.
> > 
> > That's great.  I would just change the comment to explain that it's due
> > to an incoherency between the names reported by XvListImageFormats(3) and
> > V4L2 :) 
> 
> I'll do this when the general idea of the diff gets accepted..
> 
> > 
> > > The only change to the manpage is now the addition of yv12 to the list of
> > > valid encodings.
> > 
> > Fine, I just missed the point: why do we need to support yv12?
> 
> The support for yv12 as an input encoding is actually a side effect of the
> implementation. Webcams (video(4)) do not provide yv12, but is now possible to
> read and display yv12 encoded files.
> 
> > 
> > > The trickiest part is the 'choose_enc' function where encodings are chosen
> > > based on device capabilities.
> > > The following conversions are now possible:
> > > yuy2 -> uyvy
> > > yuy2 -> yv12
> > > uyvy -> yuy2
> > > uyvy -> yv12
> > > 
> > > As my webcam only provides yuy2, I have used input-files for testing:
> > > $ video -i test.yuy2
> > > $ video -i test.uyvy -e uyvy
> > > $ video -i test.yv12 -e yv12
> > > 
> > > These examples work for me with both drivers (modesetting and intel).
> > > The conversion to yv12 has a small performance impact, of course. Do you 
> > > think
> > > the performance is acceptable?
> > 
> > Do you think it is?  When is the conversion needed?
> >
> 
> Conversion to yv12 is needed when Xv does neither support yuy2 nor uyvy.
> This is the case when the modesetting driver is in use (see output of xvinfo).
> I think the performance is acceptable, it is hardly noticable on my laptops.

Good, then please update the comment and I'll commit your diff :)

Thanks for solving this issue.



Re: [PATCH] mg: {beginning,end}-of-buffer don't set marks in Emacs

2019-02-14 Thread Leonid Bobrov
Ping.

On Wed, Feb 06, 2019 at 11:29:47PM +0200, Leonid Bobrov wrote:
> Hi!
> 
> Going to end and begging of buffer doesn't set marks in Emacs.
> 
> Index: basic.c
> ===
> RCS file: /cvs/src/usr.bin/mg/basic.c,v
> retrieving revision 1.47
> diff -u -p -u -p -r1.47 basic.c
> --- basic.c   10 Oct 2015 09:13:14 -  1.47
> +++ basic.c   6 Feb 2019 21:18:34 -
> @@ -122,7 +122,6 @@ forwchar(int f, int n)
>  int
>  gotobob(int f, int n)
>  {
> - (void) setmark(f, n);
>   curwp->w_dotp = bfirstlp(curbp);
>   curwp->w_doto = 0;
>   curwp->w_rflag |= WFFULL;
> @@ -140,7 +139,6 @@ gotoeob(int f, int n)
>  {
>   struct line *lp;
>  
> - (void) setmark(f, n);
>   curwp->w_dotp = blastlp(curbp);
>   curwp->w_doto = llength(curwp->w_dotp);
>   curwp->w_dotline = curwp->w_bufp->b_lines;
> Index: region.c
> ===
> RCS file: /cvs/src/usr.bin/mg/region.c,v
> retrieving revision 1.37
> diff -u -p -u -p -r1.37 region.c
> --- region.c  9 Sep 2016 06:05:51 -   1.37
> +++ region.c  6 Feb 2019 21:18:34 -
> @@ -405,6 +405,7 @@ markbuffer(int f, int n)
>  {
>   if (gotoeob(f,n) == FALSE)
>   return (FALSE);
> + (void) setmark(f, n);
>   if (gotobob(f,n) == FALSE)
>   return (FALSE);
>   return (TRUE);
> 



Fix mmap_hints regression test for arm64

2019-02-14 Thread mbuhl


Hi,

the folowing patch fixes the uvm_mmap_hints regression test on arm64:

ot10# make
./mmap_hint
1: Checking hint 0x0 mmap
-> 0x1d978c9000
2: Checking hint page below VM_MAXUSER_ADDRESS 0x7f7000 mmap
-> 0x7f7000
3: Checking hint VM_MIN_ADDRESS 0x1000 mmap
-> 0x1000
4: Checking hint 0x1000 mmap, which is in use
-> 0x2000

Previously it was not possible to compile the test, see
http://bluhm.genua.de/regress/results/2019-02-07T16%3A49%3A48Z/logs/sys/uvm/mmap_hint/make.log

I added the ifdefs because they are also there on amd64.

Thanks,
Moritz Buhl

Index: sys//arch/arm64/include/pmap.h
===
RCS file: /mount/openbsd/cvs/src/sys/arch/arm64/include/pmap.h,v
retrieving revision 1.11
diff -u -p -r1.11 pmap.h
--- sys//arch/arm64/include/pmap.h  16 May 2018 09:07:45 -  1.11
+++ sys//arch/arm64/include/pmap.h  12 Feb 2019 16:44:03 -
@@ -17,15 +17,12 @@
 #ifndef_ARM64_PMAP_H_
 #define_ARM64_PMAP_H_
 
+#ifndef _LOCORE
 #include 
-
+#include 
 #include 
+#endif
 
-#define PMAP_PA_MASK   ~((paddr_t)PAGE_MASK) /* to remove the flags */
-#define PMAP_NOCACHE   0x1 /* non-cacheable memory */
-#define PMAP_DEVICE0x2 /* device memory */
-
-typedef struct pmap *pmap_t;
 
 /* V->P mapping data */
 #define VP_IDX0_CNT512
@@ -41,7 +38,6 @@ typedef struct pmap *pmap_t;
 #define VP_IDX3_MASK   (VP_IDX3_CNT-1)
 #define VP_IDX3_POS12
 
-void pmap_kenter_cache(vaddr_t va, paddr_t pa, vm_prot_t prot, int cacheable);
 /* cache flags */
 #define PMAP_CACHE_CI  (PMAP_MD0)  /* cache inhibit */
 #define PMAP_CACHE_WT  (PMAP_MD1)  /* writethru */
@@ -53,20 +49,16 @@ void pmap_kenter_cache(vaddr_t va, paddr
 #define PTED_VA_WIRED_M(PMAP_MD3 << 1)
 #define PTED_VA_EXEC_M (PMAP_MD3 << 2)
 
-#define PG_PMAP_MODPG_PMAP0
-#define PG_PMAP_REFPG_PMAP1
-#define PG_PMAP_EXEPG_PMAP2
-
-// [NCPUS]
-extern paddr_t zero_page;
-extern paddr_t copy_src_page;
-extern paddr_t copy_dst_page;
-
-void pagezero_cache(vaddr_t);
 
 /*
  * Pmap stuff
  */
+#if defined(_KERNEL) && !defined(_LOCORE)
+
+void pmap_kenter_cache(vaddr_t va, paddr_t pa, vm_prot_t prot, int cacheable);
+
+typedef struct pmap *pmap_t;
+
 struct pmap {
struct mutex pm_mtx;
union {
@@ -81,6 +73,20 @@ struct pmap {
struct pmap_statistics  pm_stats;   /* pmap statistics */
 };
 
+#define PMAP_PA_MASK   ~((paddr_t)PAGE_MASK) /* to remove the flags */
+#define PMAP_NOCACHE   0x1 /* non-cacheable memory */
+#define PMAP_DEVICE0x2 /* device memory */
+
+#define PG_PMAP_MODPG_PMAP0
+#define PG_PMAP_REFPG_PMAP1
+#define PG_PMAP_EXEPG_PMAP2
+
+// [NCPUS]
+extern paddr_t zero_page;
+extern paddr_t copy_src_page;
+extern paddr_t copy_dst_page;
+
+void pagezero_cache(vaddr_t);
 
 extern struct pmap kernel_pmap_;
 #define pmap_kernel()  (_pmap_)
@@ -105,8 +111,9 @@ int pmap_fault_fixup(pmap_t, vaddr_t, vm
 void pmap_postinit(void);
 void   pmap_map_early(paddr_t, psize_t);
 
-#ifndef _LOCORE
+#endif /* _KERNEL && !_LOCORE */
 
+#ifndef _LOCORE
 #define __HAVE_VM_PAGE_MD
 struct vm_page_md {
struct mutex pv_mtx;



rework bgpd timeout handling a bit

2019-02-14 Thread Claudio Jeker
mrt_timeout should just return -1 when there is no timeout set.
The poll loop in bgpd.c already limits the maximum wait time.
While there switch to using time_t for the calculation.

OK?
-- 
:wq Claudio

? obj
Index: bgpd.c
===
RCS file: /cvs/src/usr.sbin/bgpd/bgpd.c,v
retrieving revision 1.210
diff -u -p -r1.210 bgpd.c
--- bgpd.c  14 Feb 2019 10:38:04 -  1.210
+++ bgpd.c  14 Feb 2019 10:44:14 -
@@ -102,13 +102,14 @@ main(int argc, char *argv[])
struct bgpd_config  *conf;
struct peer *peer_l, *p;
struct pollfdpfd[POLL_MAX];
+   time_t   timeout;
pid_tse_pid = 0, rde_pid = 0, pid;
char*conffile;
char*saved_argv0;
int  debug = 0;
int  rflag = 0, sflag = 0;
int  rfd = -1;
-   int  ch, timeout, status;
+   int  ch, status;
int  pipe_m2s[2];
int  pipe_m2r[2];
 
@@ -262,9 +263,9 @@ BROKEN  if (pledge("stdio rpath wpath cpa
pfd[PFD_SOCK_ROUTE].events = POLLIN;
 
timeout = mrt_timeout(conf->mrt);
-   if (timeout > MAX_TIMEOUT)
-   timeout = MAX_TIMEOUT;
 
+   if (timeout < 0 || timeout > MAX_TIMEOUT)
+   timeout = MAX_TIMEOUT;
if (poll(pfd, POLL_MAX, timeout * 1000) == -1)
if (errno != EINTR) {
log_warn("poll error");
Index: bgpd.h
===
RCS file: /cvs/src/usr.sbin/bgpd/bgpd.h,v
retrieving revision 1.367
diff -u -p -r1.367 bgpd.h
--- bgpd.h  14 Feb 2019 10:38:04 -  1.367
+++ bgpd.h  14 Feb 2019 10:44:14 -
@@ -1093,7 +1093,6 @@ struct rde_hashstats {
 
 #defineMRT_FILE_LEN512
 #defineMRT2MC(x)   ((struct mrt_config *)(x))
-#defineMRT_MAX_TIMEOUT 7200
 
 enum mrt_type {
MRT_NONE,
@@ -1195,7 +1194,7 @@ void   mrt_clear_seq(void);
 voidmrt_write(struct mrt *);
 voidmrt_clean(struct mrt *);
 voidmrt_init(struct imsgbuf *, struct imsgbuf *);
-int mrt_timeout(struct mrt_head *);
+time_t  mrt_timeout(struct mrt_head *);
 voidmrt_reconfigure(struct mrt_head *);
 voidmrt_handler(struct mrt_head *);
 struct mrt *mrt_get(struct mrt_head *, struct mrt *);
Index: mrt.c
===
RCS file: /cvs/src/usr.sbin/bgpd/mrt.c,v
retrieving revision 1.91
diff -u -p -r1.91 mrt.c
--- mrt.c   14 Feb 2019 10:38:04 -  1.91
+++ mrt.c   14 Feb 2019 10:44:14 -
@@ -909,12 +909,12 @@ mrt_open(struct mrt *mrt, time_t now)
return (1);
 }
 
-int
+time_t
 mrt_timeout(struct mrt_head *mrt)
 {
struct mrt  *m;
time_t   now;
-   int  timeout = MRT_MAX_TIMEOUT;
+   time_t   timeout = -1;
 
now = time(NULL);
LIST_FOREACH(m, mrt, entry) {
@@ -925,11 +925,12 @@ mrt_timeout(struct mrt_head *mrt)
MRT2MC(m)->ReopenTimer =
now + MRT2MC(m)->ReopenTimerInterval;
}
-   if (MRT2MC(m)->ReopenTimer - now < timeout)
+   if (timeout == -1 ||
+   MRT2MC(m)->ReopenTimer - now < timeout)
timeout = MRT2MC(m)->ReopenTimer - now;
}
}
-   return (timeout > 0 ? timeout : 0);
+   return (timeout);
 }
 
 void



Re: video(1) and modesetting driver

2019-02-14 Thread Raphael Graf
On Wed, Feb 13, 2019 at 04:09:10PM -0200, Martin Pieuchot wrote:
> On 07/02/19(Thu) 13:52, Raphael Graf wrote:
> > [...] 
> > The new diff below solves this yuy2/yuyv problem by defining them both under
> > the same name 'yuy2'.
> 
> That's great.  I would just change the comment to explain that it's due
> to an incoherency between the names reported by XvListImageFormats(3) and
> V4L2 :) 

I'll do this when the general idea of the diff gets accepted..

> 
> > The only change to the manpage is now the addition of yv12 to the list of
> > valid encodings.
> 
> Fine, I just missed the point: why do we need to support yv12?

The support for yv12 as an input encoding is actually a side effect of the
implementation. Webcams (video(4)) do not provide yv12, but is now possible to
read and display yv12 encoded files.

> 
> > The trickiest part is the 'choose_enc' function where encodings are chosen
> > based on device capabilities.
> > The following conversions are now possible:
> > yuy2 -> uyvy
> > yuy2 -> yv12
> > uyvy -> yuy2
> > uyvy -> yv12
> > 
> > As my webcam only provides yuy2, I have used input-files for testing:
> > $ video -i test.yuy2
> > $ video -i test.uyvy -e uyvy
> > $ video -i test.yv12 -e yv12
> > 
> > These examples work for me with both drivers (modesetting and intel).
> > The conversion to yv12 has a small performance impact, of course. Do you 
> > think
> > the performance is acceptable?
> 
> Do you think it is?  When is the conversion needed?
>

Conversion to yv12 is needed when Xv does neither support yuy2 nor uyvy.
This is the case when the modesetting driver is in use (see output of xvinfo).
I think the performance is acceptable, it is hardly noticable on my laptops.
 



Re: ldap(1) Add delete support [0/1]

2019-02-14 Thread Claudio Jeker
On Thu, Feb 14, 2019 at 08:32:11AM +0100, Martijn van Duren wrote:
> I would like to see some more functionality in ldap(1), so I started of 
> with delete, because that's seems to be the easiest/shortest to
> implement and the diffs are big enough as is.
> 
> I split it up in 2 diffs. This is the first one, which restructures
> ldap(1) to make use of a per command environment.
> 
> Thoughts? OK?

I'm not thrilled by the way you do the getopt handling.
Having dynamic getopt strings is intransparent. It will also fail the
moment a flag is reused with a different meaning.
I would prefer a more straight forward solution with one single getopt
option string and conflict resolution during or after option parsing.
 
Also I would use some kind of enum or define for the mode instead of using
strcmp to know the mode.

> martijn@
> 
> diff --git a/ldapclient.c b/ldapclient.c
> index 9763b8e..9f29997 100644
> --- a/ldapclient.c
> +++ b/ldapclient.c
> @@ -52,6 +52,8 @@
>  #define F_NEEDAUTH   0x04
>  #define F_LDIF   0x08
>  
> +#define GETOPT_COMMON"c:D:H:vWw:xy:Z"
> +
>  #define LDAPHOST "localhost"
>  #define LDAPFILTER   "(objectClass=*)"
>  #define LDIF_LINELENGTH  79
> @@ -79,9 +81,21 @@ struct ldapc_search {
>   char**ls_attr;
>  };
>  
> +struct ldapc_app {
> + const char  *name;
> + const char  *optstring;
> + const char  *usage;
> + const char  *pledge;
> + int (*exec)(int, char *[]);
> + struct ldapc ldap;
> + union {
> + struct ldapc_search ls;
> + };
> +};
> +
>  __dead void   usage(void);
>  int   ldapc_connect(struct ldapc *);
> -int   ldapc_search(struct ldapc *, struct ldapc_search *);
> +int   ldapc_search(int, char *[]);
>  int   ldapc_printattr(struct ldapc *, const char *,
>   const struct ber_octetstring *);
>  void  ldapc_disconnect(struct ldapc *);
> @@ -90,115 +104,132 @@ int ldapc_parseurl(struct ldapc *, struct 
> ldapc_search *,
>  const char   *ldapc_resultcode(enum result_code);
>  const char   *url_decode(char *);
>  
> -__dead void
> -usage(void)
> -{
> - extern char *__progname;
> -
> - fprintf(stderr,
> -"usage: %s search [-LvWxZ] [-b basedn] [-c CAfile] [-D binddn] [-H host]\n"
> -"[-l timelimit] [-s scope] [-w secret] [-y secretfile] [-z 
> sizelimit]\n"
> -"[filter] [attributes ...]\n",
> - __progname);
> -
> - exit(1);
> -}
> +struct ldapc_app ldapc_apps[] = {
> + {"search", "Lb:s:l:z:", "[-L] [-b basedn] [-s scope] [-l timelimit] "
> + "[-z sizelimit] [filter] [attributes ...]", "stdio", ldapc_search,
> + {0}, {0}}
> +};
> +struct ldapc_app *ldapc_app = NULL;
>  
>  int
>  main(int argc, char *argv[])
>  {
> + char optstr[BUFSIZ];
>   char passbuf[LDAPPASSMAX];
>   const char  *errstr, *url = NULL, *secretfile = NULL;
>   struct stat  st;
> - struct ldapc ldap;
> - struct ldapc_search  ls;
>   int  ch;
>   int  verbose = 1;
> + size_t   i;
>   FILE*fp;
>  
>   if (pledge("stdio inet unix tty rpath dns", NULL) == -1)
>   err(1, "pledge");
>  
> - log_init(verbose, 0);
> + if (strlcpy(optstr, GETOPT_COMMON, sizeof(optstr)) >= sizeof(optstr))
> + errx(1, "strlcpy");
>  
> - memset(, 0, sizeof(ldap));
> - memset(, 0, sizeof(ls));
> - ls.ls_scope = -1;
> - ldap.ldap_port = -1;
> + log_init(verbose, 0);
>  
> - /*
> -  * Check the command.  Currently only "search" is supported but
> -  * it could be extended with others such as add, modify, or delete.
> -  */
>   if (argc < 2)
>   usage();
> - else if (strcmp("search", argv[1]) == 0)
> - ldap.ldap_req = LDAP_REQ_SEARCH;
> - else
> + for (i = 0; i < sizeof(ldapc_apps)/sizeof(*ldapc_apps); i++) {
> + if (strcmp(ldapc_apps[i].name, argv[1]) == 0) {
> + ldapc_app = _apps[i];
> + break;
> + }
> + }
> + if (ldapc_app == NULL)
>   usage();
>   argc--;
>   argv++;
>  
> - while ((ch = getopt(argc, argv, "b:c:D:H:Ll:s:vWw:xy:Zz:")) != -1) {
> + if (strcmp(ldapc_app->name, "search") == 0)
> + ldapc_app->ls.ls_scope = -1;
> + ldapc_app->ldap.ldap_port = -1;
> +
> +
> + if (strlcat(optstr, ldapc_app->optstring, sizeof(optstr)) >=
> + sizeof(optstr))
> + errx(1, "strlcat optstr");
> + while ((ch = getopt(argc, argv, optstr)) != -1) {
>   switch (ch) {
>   case 'b':
> - ls.ls_basedn = optarg;
> - break;
> + if 

Re: switch Xorg protos to xorgproto 2018.4

2019-02-14 Thread Matthieu Herrb
On Mon, Feb 11, 2019 at 07:34:46AM +0100, Matthieu Herrb wrote:
> Hi,
> 
> I've recently imported xorgproto 2018.4 in xenocara. This is a package
> the unifies all the previous *proto packages from X.Org (except
> xcb-proto which is special), and enabled it yesterday.
> 
> I had to revert that last commit since it is suspected to be the cause
> for this regression mentionned on misc:
> https://marc.info/?l=openbsd-misc=154983711329128=2
> 
> So please test the following diff for other possible regressions,
> while we're looking at the compton issue.

The compton issue has been found and a patch got committed to ports.

So any ok for this ?

> 
> Index: Makefile
> ===
> RCS file: /cvs/xenocara/proto/Makefile,v
> retrieving revision 1.17
> diff -u -r1.17 Makefile
> --- Makefile  10 Feb 2019 23:07:47 -  1.17
> +++ Makefile  11 Feb 2019 00:05:49 -
> @@ -2,17 +2,7 @@
>  
>  .include 
>  
> -SUBDIR= bigreqsproto compositeproto dmxproto damageproto \
> - fixesproto fontsproto glproto inputproto \
> - kbproto pmproto xineramaproto presentproto randrproto \
> - recordproto renderproto resourceproto scrnsaverproto \
> - videoproto x11proto xcb-proto xcmiscproto xextproto \
> - xf86bigfontproto xf86dgaproto \
> - xf86vidmodeproto
> -
> -.if ${XENOCARA_BUILD_DRI:L} == "yes"
> -SUBDIR+= xf86driproto dri2proto dri3proto
> -.endif
> +SUBDIR= xcb-proto xorgproto
>  
>  .include 
>  
> -- 
> Matthieu Herrb

-- 
Matthieu Herrb



Re: ldap(1) Add delete support [1/1]

2019-02-14 Thread Martijn van Duren
And the man support for delete, applies on top of the restructure diff.

diff --git a/ldap.1 b/ldap.1
index 0225f78..296d282 100644
--- a/ldap.1
+++ b/ldap.1
@@ -35,6 +35,17 @@
 .Op Fl z Ar sizelimit
 .Op Ar filter
 .Op Ar attributes ...
+.Nm
+.Cm delete
+.Op Fl rvWxZ
+.Op Fl c Ar CAfile
+.Op Fl D Ar binddn
+.Op Fl f Ar file
+.Op Fl H Ar host
+.Op Fl w Ar secret
+.Op Fl y Ar secretfile
+.Op Fl z Ar sizelimit
+.Op Ar DN ...
 .Sh DESCRIPTION
 The
 .Nm
@@ -186,6 +197,37 @@ entries.
 The default value is 0.
 for no limit.
 .El
+.Ss DELETE
+The
+.Cm delete
+command performs a directory delete request.
+The
+.Ar DN
+arguments are used as a list of DNs to remove from the server.
+If a delete request fails all following delete requests are canceled.
+The
+.Cm delete
+specific options are as follows:
+.Bl -tag -width Ds
+.It Fl f Ar file
+Get a list of DNs from
+.Ar file .
+.Ar File
+is parsed before the
+.Ar DN
+list.
+.It Fl r
+Do a recursive delete.
+.It Fl z Ar sizelimit
+Request the server to limit the search result to a maximum number of
+.Ar sizelimit
+entries.
+The default value is 0.
+for no limit.
+This option is only used in combination with the
+.Fl r
+flag.
+.El
 .Sh FILES
 .Bl -tag -width "/etc/ssl/cert.pemXXX" -compact
 .It Pa /etc/ssl/cert.pem



Re: ldap(1) Add delete support [0/1]

2019-02-14 Thread Martijn van Duren
Here's the accompanying documentation diff for the restructure.

diff --git a/ldap.1 b/ldap.1
index bb65ea4..0225f78 100644
--- a/ldap.1
+++ b/ldap.1
@@ -40,30 +40,10 @@ The
 .Nm
 utility is a simple LDAP client.
 It queries an LDAP server to perform a command and outputs the results
-in the LDAP Data Interchange Format (LDIF).
-.Bl -tag -width Ds
-.It Cm search Ar options Oo Ar filter Oc Op Ar attributes ...
-Perform a directory search request.
-The optional
-.Ar filter
-argument specifies the LDAP filter for the directory search.
-The default is
-.Ar (objectClass=*)
-and the format must comply to the
-.Dq String Representation of Search Filters
-as described in RFC 4515.
-If one or more
-.Ar attribute
-options are specified,
-.Nm
-restricts the output to the specified attributes.
-.El
+if applicable.
 .Pp
-The options are as follows:
+All commands support the following options:
 .Bl -tag -width Ds
-.It Fl b Ar basedn
-Use the specified distinguished name (dn) as the starting point for
-directory search requests.
 .It Fl c Ar CAfile
 When TLS is enabled, load the CA bundle for certificate verification
 from the specified file.
@@ -95,7 +75,8 @@ Each of
 .Ar basedn , attribute , scope
 and
 .Ar filter
-may be omitted,
+may be omitted and are ignored for any other command besides
+.Cm search,
 but the preceding
 .Sq /
 or
@@ -123,6 +104,52 @@ The host argument is required to be a URL-encoded path, 
for example
 for
 .Pa /var/run/ldapi .
 .El
+.It Fl v
+Product more verbose output.
+.It Fl W
+Prompt for the bind secret with echo turned off.
+.It Fl w Ar secret
+Specify the bind secret on the command line.
+.It Fl x
+Use simple authentication.
+This is the default as
+.Nm
+does not support SASL authentication.
+.It Fl y Ar secretfile
+Read the bind secret from the first line of the specified file or from
+standard input if the
+.Ar secretfile
+argument is
+.Sq - .
+The file must not be world-readable if it is a regular file.
+.It Fl Z
+Enable TLS using the StartTLS operation.
+.El
+.Ss SEARCH
+The
+.Cm search
+command performs a directory search request.
+The optional
+.Ar filter
+argument specifies the LDAP filter for the directory search.
+The default is
+.Ar (objectClass=*)
+and the format must comply to the
+.Dq String Representation of Search Filters
+as described in RFC 4515.
+If one or more
+.Ar attribute
+options are specified,
+.Nm
+restricts the output to the specified attributes.
+.Pp
+The
+.Cm search
+specific options are as follows:
+.Bl -tag -width Ds
+.It Fl b Ar basedn
+Use the specified distinguished name (dn) as the starting point for
+directory search requests.
 .It Fl L
 Output the directory search result in a standards-compliant version of
 the LDAP Data Interchange Format (LDIF).
@@ -152,26 +179,6 @@ or
 The default is
 .Ic sub
 for subtree searches.
-.It Fl v
-Product more verbose output.
-.It Fl W
-Prompt for the bind secret with echo turned off.
-.It Fl w Ar secret
-Specify the bind secret on the command line.
-.It Fl x
-Use simple authentication.
-This is the default as
-.Nm
-does not support SASL authentication.
-.It Fl y Ar secretfile
-Read the bind secret from the first line of the specified file or from
-standard input if the
-.Ar secretfile
-argument is
-.Sq - .
-The file must not be world-readable if it is a regular file.
-.It Fl Z
-Enable TLS using the StartTLS operation.
 .It Fl z Ar sizelimit
 Request the server to limit the search result to a maximum number of
 .Ar sizelimit