NetBSD

NetBSD is a free and open-source Unix-like operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was forked. It continues to be actively developed and is available for many platforms, including servers, desktops, handheld devices, and embedded systems. pp. 291–292.

The NetBSD project focuses on code clarity, careful design, and portability across many computer architectures. Its source code is publicly available and permissively licensed.

NetBSD supports over 59 hardware platforms across 16 instruction set architectures, ranging from VAX minicomputers and vintage home computers to modern ARM-based systems, Raspberry Pis, and RISC-V hardware. Portability is assisted by a hardware abstraction layer that separates machine-independent and machine-dependent driver components, allowing a single driver to operate on multiple platforms. The pkgsrc package collection, introduced with NetBSD 1.3 in 1998, provides more than 29,000 third-party software packages and has been adopted by other operating systems including SmartOS and Minix 3.

The operating system is developed by the NetBSD Foundation, a 501(c)(3) non-profit organization that holds the project's intellectual property and trademarks. The latest stable release is NetBSD 11.0 (30 July 2026).

History NetBSD was originally derived from the 4.3BSD-Reno release of the Berkeley Software Distribution from the Computer Systems Research Group of the University of California, Berkeley, via its History of the Net/2 source code release and the 386BSD project. The NetBSD project began as a result of frustration within the 386BSD developer community with the pace and direction of the operating system's development. The four founders of the NetBSD project, Chris Demetriou, Theo de Raadt, Adam Glass, and Charles Hannum, felt that a more open development model would benefit the project: one centered on portable, clean, correct code. They aimed to produce a unified, multi-platform, production-quality, BSD-based operating system. The name "NetBSD" was chosen based on the importance and growth of networks such as the Internet at that time, and the distributed, collaborative nature of its development.

The NetBSD source code repository was established on 21 March 1993 and the first official release, NetBSD 0.8, was made on 19 April 1993. This was derived from 386BSD 0.1 plus the version 0.2.2 unofficial patchkit, with several programs from the Net/2 release missing from 386BSD re-integrated, and various other improvements. The first multi-platform release, NetBSD 1.0, was made in October 1994, and being updated with 4.4BSD-Lite sources, it was free of all legally encumbered 4.3BSD Net/2 code. Also in 1994, for disputed reasons, one of the founders, Theo de Raadt, was removed from the project. He later founded a new project, OpenBSD, from a forked version of NetBSD 1.0 near the end of 1995. In 1998, NetBSD 1.3 introduced the pkgsrc packages collection.

Until 2004, NetBSD 1.x releases were made at roughly annual intervals, with minor "patch" releases in between. From release 2.0 onwards, NetBSD uses semantic versioning, and each major NetBSD release corresponds to an incremented major version number, i.e. the major releases following 2.0 are 3.0, 4.0 and so on. The previous minor releases are now divided into two categories: x.y "stable" maintenance releases and x.y.z releases containing only security and critical fixes.

NetBSD used to ship with twm as a preconfigured graphical interface (window manager); in 2020 (version 9.1) this was changed to the more modern and versatile CTWM.

Features

Portability

As the project's motto ("") suggests, NetBSD has been ported to a numerous 32- and 64-bit architectures. These range from VAX minicomputers to Pocket PC PDAs. NetBSD has also been ported to several video game consoles such as the Sega Dreamcast and the Nintendo Wii. As of 2019, NetBSD supports 59 hardware platforms (across 16 different instruction sets). The kernel and userland for these platforms are all built from a central unified source-code tree managed by CVS. Unlike other kernels such as μClinux, the NetBSD kernel requires the presence of an MMU in any given target architecture.

NetBSD's portability is aided by the use of hardware abstraction layer interfaces for low-level hardware access such as bus input/output or DMA. Using this portability layer, device drivers can be split into "machine-independent" (MI) and "machine-dependent" (MD) components. This makes a single driver easily usable on several platforms by hiding hardware access details, and reduces the work to port it to a new system.

This permits a particular device driver for a PCI card to work without modifications, whether it is in a PCI slot on an IA-32, Alpha, PowerPC, SPARC, or other architecture with a PCI bus. Moreover, a single driver for a specific device can operate via several different buses, such as ISA, PCI, or PC Card.

This platform independence aids the development of embedded systems, particularly since NetBSD 1.6, when the entire toolchain of compilers, assemblers, linkers, and other tools fully support cross-compiling.

In 2005, as a demonstration of NetBSD's portability and suitability for embedded applications, Technologic Systems, a vendor of embedded systems hardware, designed and demonstrated a NetBSD-powered kitchen toaster.

Commercial ports to embedded platforms were available from and supported by Wasabi Systems, including platforms such as the AMD Geode LX800, Freescale PowerQUICC processors, Marvell Orion, AMCC 405 family of PowerPC processors, and the Intel XScale IOP and IXP series.

Portable build framework The NetBSD cross-compiling framework (also known as "build.sh") lets a developer build a complete NetBSD system for an architecture from a more powerful system of different architecture (cross-compiling), including on a different operating system (the framework supports most POSIX-compliant systems). Several embedded systems using NetBSD have required no additional software development other than toolchain and target rehost.

As of 2017, NetBSD had reached fully reproducible builds on amd64 and SPARC64. The build.sh -P flag handles reproducible builds automatically.

The pkgsrc packages collection

NetBSD features pkgsrc (short for "package source"), a framework for building and managing third-party application software packages. The pkgsrc collection consists of more than 29,000 packages as of . Building and installing packages such as Lumina, KDE, GNOME, the Apache HTTP Server or Perl is performed through the use of a system of makefiles. This can automatically fetch the source code, unpack, patch, configure, build and install the package such that it can be removed again later. An alternative to compiling from source is to use a precompiled binary package. In either case, any prerequisites or dependencies will be installed automatically by the package system, without need for manual intervention.

pkgsrc is a cross-platform packaging system, for it supports not only NetBSD, but can be used on several other Unix-like platforms, among which macOS, Solaris and Linux are considered primary targets. Other BSDs, HP-UX, Minix, SCO UNIX (Unixware and OpenServer) and QNX have a number of active pkgsrc users but do not receive active maintenance.

pkgsrc is the default package management system on SmartOS and Minix3. It was also previously adopted as the official package management system for DragonFly BSD, and made available as an alternative packaging framework on MirBSD and QNX.

Symmetric multiprocessing NetBSD has supported SMP since the NetBSD 2.0 release in 2004, which was initially implemented using the giant lock approach.

During the development cycle of the NetBSD 5 release, major work was done to improve SMP support; most of the kernel subsystems were modified to use the fine-grained locking approach. New synchronization primitives were implemented and scheduler activations was replaced with a 1:1 threading model in February 2007. A scalable M2 thread scheduler was also implemented, providing separate real-time (RT) and time-sharing (TS) queues, and improving the performance on MP systems. Threaded software interrupts were implemented to improve synchronization. The virtual memory system, memory allocator and trap handling were made MP safe. The file system framework, including the VFS and major file systems were modified to be MP safe. As of NetBSD 10.0, the only subsystems running with a giant lock are SATA device drivers, interrupt handlers, the autoconf(9) framework and most the network stack, unless the NET_MPSAFE kernel option is enabled.

In reality, starting with release 8.0, various parts of the network stack have been made MP safe already, but NET_MPSAFE is kept disabled by default, because non-MP-safe components that are also unprotected by the giant lock may otherwise crash the kernel when loaded in memory.

The 4.4BSD scheduler still remains the default, but was modified to scale with SMP, merging features from SCHED_M2. In 2017, the scheduler was changed to better distribute load of long-running processes on multiple CPUs, and tunable kern.sched sysctl(3) parameters were introduced. The release of NetBSD 10.0 brought significant performance enhancements, especially on multiprocessor and multicore systems; the scheduler gained major awareness of NUMA and hyperthreading, and became able to spread the load evenly across different physical CPUs, as well as to scale better on a mixture of slow and fast cores (e.g. ARM big.LITTLE).

Security NetBSD supports a number of features designed to improve system security. Some are listed below.

The Kernel Authorization framework (or kauth) is a subsystem managing all authorization requests inside the kernel, and used as system-wide security policy. kauth(9) acts as a gatekeeper between kernel's own routines, by checking whether a given call or a specific operation is allowed within the context, and returns EPERM if not. Most syscalls issue an authorization request in their corresponding handler via kauth_authorize_action(). kauth also allows external modules to plug-in the authorization process.

Verified Executables (or Veriexec) is an in-kernel file integrity subsystem in NetBSD. It allows the user to set digital fingerprints (hashes) of files, and take a number of different actions if files do not match their fingerprints. For example, one can allow Perl to run only scripts that match their fingerprints.

Starting with version 2.0, NetBSD supports non-executable mappings on platforms where the hardware allows it. Process stack and heap mappings are non-executable by default. This makes exploiting potential buffer overflows harder. NetBSD supports PROT_EXEC permission via mmap() for all platforms where the hardware differentiates execute access from data access, though not necessarily with single-page granularity.

NetBSD implements several exploit mitigation features, such as ASLR (in both userland and kernel), restricted mprotect() (W^X) and Segvguard from the PaX project, and GCC Stack Smashing Protection (SSP, or also known as ProPolice, enabled by default since NetBSD 6.0) compiler extensions.

The cryptographic device driver (CGD) provides transparent disk encryption by acting as a logical device that is layered on top of another block device, such as a physical disk or partition (including CDs and DVDs) or a vnd(4) pseudo device. It supports the Adiantum cipher, besides AES in CBC/XTS modes.

NPF, introduced with NetBSD 6.0, is a layer 3 packet filter, supporting stateful packet inspection, IPv6, NAT, IP sets, and extensions. It uses BPF as its core engine, and supports bpfjit. NPF was designed with a focus on high performance, scalability, multi-threading and modularity.