This selection is intended to include all important
and all user-visible changes.
For a complete record of all changes, please see the "source-changes"
mailing list, called "OpenBSD CVS"
in the archives,
or use CVS.
Reintroduced checks against heavy amap allocations for MAP_SHARED to prevent a panic reachable with mmap(2).
On arm64 and powerpc64, changed kcopy(9) to perform 64-bit and 32-bit copies whenever possible, needed for kbind(2) to update PLT/GOT entries atomically when doing lazy binding.
Added support for the PCA9546 I2C switch to pcamux(4).
Set length correctly in ugen(4) to prevent incorrect copy of descriptors to userland and kernel memory leaks.
Made apmd(8) always ask the kernel about current hw.perfpolicy rather than maintaining state.
Added a new "set cert_partial_chain" config option to iked.conf(5) to allow verification of partial certificate chains if a trusted intermediate CA is found in /etc/iked/ca.
Used an IPI on powerpc64 so hw.setperf affects all cores in the mp kernel.
Allowed handling of long lines in an smtpd(8) aliases table.
Ensured sysupgrade(8) on systems with multiple root disks will proceed on the disk with auto_upgrade.conf present.
Moved to Mesa 20.0.8 in response to hard hangs on certain systems.
Fixed eeprom(8) error when setting variables on macppc.
Cleared the screen in ksh(1)'s vi editing mode before redrawing the line with ^L.
Capped ssh(1) channel input buffer size at 16MB, avoiding high memory use when a peer advertises a large window but is slow to consume sent data.
Fixed a memory leak in x509_constraints_extract_names.
Fixed frame pointer slot on aarch64 for functions not saving callee registers with reguard enabled.
Added a bsd.schema to ldapd(8) including a shadowPassword and an sshPublicKey attribute which can be used to extend existing LDAP users with the additional bsdAccount objectclass.
Added a check for pfctl(8) that an rtable exists when parsing the config.
Disabled acpivout(4) brightness control on machines aware of Windows 8, enabling inteldrm to handle brightness ioctls.
Defaulted to showing full IPv6 address entries in the routing tables displayed by route(8) show and netstat(1) -r.
Introduced abl(4), a new driver to control the backlight brightness on Intel-based Apple machines, and allowed it to be controlled through wsconsctl(8).
Added a "-s timeout" feature to rpki-client(8) with a one hour default, allowing fresh attempts with cron(8) if rpki-client gets stuck.
Prevented established TCP and TLS sockets of syslogd(8) from staying open forever if a client aborted the connection silently.
Ensured certain registers are read before a potential sleep in trap()
Added support for "&" and "|" operators in btrace scripts.
Fixed smtpd(8) handling of user names containing "@" symbols.
Prevented improper disabling of the backlight in umstc(4) when brightness is adjusted to 0.
Allowed snmp(1) mibtree to take one or more arguments to be converted to a chosen output format.
Skipped scanning file systems which are both nodev and nosuid for SUID, SGID and device files with security(8).
Added an explanation for acme-client(1) account creation failure.
Allowed slaacd(8) to handle all rdomains in a single daemon.
Used READ(16)/WRITE(16) commands for disks large enough to require them to access the last sectors, fixing large 512E devices plugged into USB to ATA/ATAPI bridges which mistakenly use 4K sector addresses/sizes.
Introduced xicp(4), a driver for the interrupt control presenter hardware found on POWER8 CPUs.
Added the new iked(8) configuration option "set enforcesingleikesa" to limit the number of connections for each peer.
Added powerpc64 support for "normal" external interrupts, needed for running POWER8 and earlier CPUs.
Updated to libfido2 46710ac06.
Prevented concurrent CREATE_CHILD_SA and INFORMATION exchanges in iked(8).
Added fstat(1) support for looking up unix domain sockets by file name.
Moved sysctl(2) CTL_DEBUG from DEBUG to the new DEBUG_SYSCTL.
Added the tmux(1) n: modifier to get the length of a format.
Allowed SIOCSWGDPID and SIOCSWGMAXFLOW ioctls for non-root, preventing switch(4) interfaces from appearing partially as bridge(4) devices for unprivileged users running ifconfig(8).
Added support for IODA2 bridges such as those found on POWER8 chips.
Added a ROUTE_FLAGFILTER socket option for routing sockets, allowing routing daemons to opt out of receiving messages for L2 and broadcast route entries.
Prioritized incoming certificate requests by the order of CERTEQ payloads in the received message in iked(8).
Ensured the STOP command sent by sd(4) on powerdown will not result in hanging the machine if commands to the USB mass storage fail.
Modified ldapd(8) use of "ldaps" and "tls" keywords to enable only the libtls defaults for protocols and ciphers. The new "legacy" keyword can be used before these keywords in ldapd.conf(5) to enable them all.
Stopped incrementing openclass for a literal "[" in awk(1), allowing parsing of expressions such as "/[[/[]/".
Increased pbuild datasize limit to 8G to allow Firefox to build with Rust 1.44.
Implemented pci_intr_establish_cpu() for pyro(4) and vpci(4)-based sparc64 systems.
Introduced gettime(9) and getuptime(9) and substituted these for time_second(9) and time_uptime(9) throughout the kernel to prevent split-read problems on 32-bit platforms.
Introduced opalcons(4), a driver for the OPAL console.
Added support for the Ericsson F5521gw Mobile Broadband Modem.
Resolved a panic in bridge_ioctl() by ensuring the netlock is held when calling ioctl handlers and dropped for the wg(4)-specific ioctls.
Enabled critical temperature detection in iwx(4) firmware.
Added ssh(1) support for fido(4) WebAuthn (verification only).
Added an ioctl allowing userland to access read-only support information about pci devices via the vpd register.
Added simpleaudio(4), a driver for "simple audio cards." This is a wrapper connecting the I25 controller, the codec and some aux devices.
Introduced a framework for digital audio interfaces.
Populated a list of 256 brightness levels as a fallback when the device tree does not specify a list, making the Pinebook Pro display work with the dtb from Linux 5.7.
Added Marvel 88SE9215 and 88SE9235 AHCI pci(4) ids.
Prevented callers inspecting unrelated fields in the libc resolver function asr_run().
Moved Powerbook5,4 audio from aoa(4) to snapper(4), adding the missing TAS3004 volume control.
Added ssl(8) support for additional GOST curves and aliases for 256-bit GOST curves.
Added support for pausing a tmux(1) pane when the output buffered for a control mode client is too far behind, controllable with refresh-client -f and -A.
Prevented the HID parser from overflowing if a malicious device provides too many PUSH.
Added support for the Cortex-A78 cpu.
Improved TLSv1.3 client certificate selection to allow use of EC certificates.
Fixed pf.conf(5) "route-to TABLE least-states" in an anchor.
Added umstc(4), a driver for Microsoft Surface Type Cover keyboards.
Began looking for non-expired certificates first when building a chain, making certificate validation possible for various sites that are serving expired AddTrust certificates.
Improved CPU frequency scaling in automatic performance mode by removing accounting for offline CPUs.
Added to ssh_config(5) a selection of keywords allowed to expand shell-style ${ENV} environment variables on the client side.
Adjusted to complete group key renewal immediately if no station is associated when ieee80211_proto.c runs.
Prevented a panic where athn(4) attempted to transmit old, unencryptable frames after switching to a new group key in hostap mode.
Prevented unconditional initialization of VGA on amd64 boot causing video distortion.
Corrected getopt_long(3) parsing of a trailing dash in an option group, which was being incorrectly returned as an argument.
Removed mail.local(8) support for world-writable mail spools.
Added AES-GCM mode ciphers for IKEv2, configurable in iked.conf(5) with the new "ikesa enc" options aes-128-gcm, aes-256-gcm, aes-128-gcm-12 and aes-256-gcm-12.
Rewrote the entropy enqueue ring to collect damage asynchronously and adapted the dequeue to mix a selection of "best" ring entries, exponentially backing off the dequeue timeout, to compensate rapidly for weak seeding in unidentifiable conditions and ensure quality to arc4random() calls early in boot.
Introduced detection of /etc/random.seed reuse.
Reworked kernel loading with octboot(4), which now does not rely on a mounted filesystem.
Prevented a fatal iwx(4) firmware error when the driver moves out of AUTH state.
Rewrote m88k mutex code as a slight variation of the MI mutex code, potentially improving stability and rendering mutex spinning time visible in top(1).
Allowed passage of unencrypted 802.11 frames during hardware decryption post-processing, fixing failure of some ral(4) devices to receive packets on encrypted networks.
Added support to urtwn(4) for TP-Link TL-WN822N-EU v5 (and v4).
Restricted ssh-agent(1) from signing web challenges for FIDO keys, preventing ssh-agent forwarding on a host that has FIDO keys attached from granting the ability for the remote side to also sign challenges for web authentication using those keys.
Increased the default number of ldom and ttyV devices for sparc64 from eight to sixteen.
Passed boothowto from the sparc64 bootloader to the kernel using .openbsd.bootdata.
Added support for the ThingM blink(1) USB notification light.
Stopped syslogd(8) from closing UDP sockets for sending messages when DNS lookup of a UDP loghost fails, alloiwing them to be used to send if DNS is working during the next SIGHUP.
Made non-root filesystems FFS2 for landisk, sgi and luna88k.
Made ldomctl(8) "init-system -n" check vcpu and memory constraints.
Relaxed filename checks in syspatch(8) to allow use of hyphens.
Adjusted dwpcie(4) timing to improve likelihood of a successful PCIe link on the i.MX8MM. Avoids a failure to detect em(4) on the HummingBoard Pulse.
Added RB_GOODRANDOM passed from bootloader to kernel in boothowto, indicating confidence a "great seed" was loaded.
Added an option to set the pane border lines style as single lines, double or heavy, simple or number (the pane numbers).
Added a client flag 'active-pane' which stores the active pane in the client and allows it to be changed independently from the real active pane stored in the window.
Added a -D flag to run in non-daemonized mode.
Added a customize mode (C) where keys and options can be browsed and changed.
Added M-+ and M-- to expand and collapse all items in tree mode.
Changed refresh-client -F to -f and added -f flags to attach-session and switch-client.
Added -e for new-session to set environment variables.
Added the 'e' key in buffer mode to open the buffer in an editor.
Added -W and -T flags to command-prompt to only complete a window and a target.
Ensured that a TLSv1.3 server has provided a certificate before attempting validation.
Improved reporting of remaining power with batteries of different capacities in acpi(4).
Allowed specifying -d multiple times in slowcgi(8).
Added bgpctl(8) support for VPNv6 in the family option of the "show rib" command.
Fixed two out-of-bounds array accesses in ioctl code pathways in wscons(4).
Made "reason" parsing in bgpctl(8) more generic and introduced it to the "reload" command.
Added an optional "domain name" acme-client.conf(5) option allowing use of multiple domain sections with the same name and creation of an rsa and an ecdsa key for the same domain name.
Fixed a crash on landisk in unwind(8) due to cmsg buffer misalignment.
Prevented hangs in existing processes due to an indefinite wait for flushing when closing a tty.