=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/73.html,v retrieving revision 1.21 retrieving revision 1.22 diff -c -r1.21 -r1.22 *** www/73.html 2023/04/03 19:08:11 1.21 --- www/73.html 2023/04/03 21:51:34 1.22 *************** *** 84,108 ****

Various kernel improvements:

On arm64, avoid usin 1GB mappings for the identity map in the early kernel bootstrap phase and when booting the secondary CPUs. This avoids accidentally mapping memory regions that should not be mapped (i.e. secure memory) as all mapped memory can be accessed speculatively. -
Added arm64 detection of EPAN feature bit. Enhanced Privileged Access Never (EPAN) allows Privileged Access Never to be used with Execute-only mappings. -
Removed copystr(9) from public API. -
Made the USB ports work after a suspend/resume cycle on the x13s. !
Set the arm64 default for the machdep.lidaction sysctl(8) to 1, making the system suspend when the lid is closed. aplsmc(4) provides support for the lid position sensor. !
Changed arm64 suspend idle loop from WFE to WFI, avoiding spurious wakeups while other CPUs are still active.
Added cursor back tab support to Various kernel improvements:
- Implemented the waitid(2) system call ! which is now part of POSIX and used by Mozilla. !
- Introduced clockintr(9), a ! machine-independent clock interrupt controller. Switched all ! architectures to use this new kernel subsystem. !
- Introduced a new kern.autoconf_serial sysctl(8) that can be used ! by userland to monitor state changes of the kernel device tree. !
- Fixed pmap(9) bugs ! involving entering an executable mapping for a page before ! synchronizing the data and instruction cache on arm64 and riscv64. !
- Add detection for Spectre-BHB Branch History Injection ! vulnerability related CLRBHB, ECBHB and CSV2_3/HCXT feature bits. !
- Add getnsecruntime(9) ! to the kernel timecounting API. Together with getbinruntime(), it ! provides a fast, monotonic clock that only advances while the system ! is not suspended. !
- Prevent detatching ("bioctl -d detach") of a boot volume on a RAID managed by bioctl(8). !
- Added WTRAPPED option for waitid(2) to control ! whether CLD_TRAPPED state changes, i.e., ptrace(2) on a process, are reported.
- On arm64, avoid usin 1GB mappings for the identity map in the early kernel bootstrap phase and when booting the secondary CPUs. This avoids accidentally mapping memory regions that should not be mapped (i.e. secure memory) as all mapped memory can be accessed speculatively.
- Added arm64 detection of EPAN feature bit. Enhanced Privileged Access Never (EPAN) allows Privileged Access Never to be used with Execute-only mappings.
- Removed copystr(9) from public API.
- Made the USB ports work after a suspend/resume cycle on the x13s. !
- On arm64, add a machdep.lidaction sysctl(8) for aplsmc(4) Apple Silicon ! laptops.
  ! The arm64 default for the machdep.lidaction is 1, making the system suspend when the lid is closed. aplsmc(4) provides support for the lid position sensor. !
- Disable the screen backlight with aplsmc(4) on Apple Silicon ! laptops when the lid is closed.
- Changed arm64 suspend idle loop from WFE to WFI, avoiding spurious wakeups while other CPUs are still active.
- Added cursor back tab support to Added a priority queue to clockintr(9). -
SMP Improvements
- Made tun(4) and tap(4) event filters MP-safe.
- Unlocked utrace(2). --- 146,175 ---- DTIOCARGS to get the type of probe arguments.
- Added a priority queue to clockintr(9).
SMP Improvements
- Unlocked mmap(2), munmap(2), and mprotect(2). !
- Unlocked sched_yield(2). !
- Added support for per-cpu event counters, to be used for clock and ! IPI counters where the event counted occurs across all CPUs in the ! system. !
- Moved pf(4) purge ! tasks out from under the kernel lock. !
- Unlocked ioctl(2) ! SIOCGIFCONF, SIOCGIFGMEMB, SIOCGIFGATTR, and SIOCGIFGLIST. !
- Protected interface tables in pf(4) with PF_LOCK(), allowing ! removal of NET_LOCK() protection from the ioctl(2) code path in pf. !
- Unlocked getsockopt(2) and setsockopt(2). !
- Completed removing kernel lock from IPv6 read ioctls. !
- Unlocked minherit(2).
- Made tun(4) and tap(4) event filters MP-safe.
- Unlocked utrace(2). *************** *** 134,140 **** 3-thread deadlock between msync(2), page-fault and mmap(2). -
- Unlocked select(2), pselect(2),
- Fixed frame buffer corruption and additional bugs after wakeup on Apple Silicon laptops and the Lenovo x13s.
VMM/VMD improvements
- Implemented zero-copy operations on virtqueues in vmd(8). -
- Provided a detailed e820 memory map when booting vmd(8) guests with SeaBIOS. When a vm initializes memory ranges, we now track what each range --- 199,237 ----
- Fixed frame buffer corruption and additional bugs after wakeup on Apple Silicon laptops and the Lenovo x13s. + +
- Added support for the backlight connector property to amdgpu(4) as in inteldrm(4), making xbacklight(1) work + when using the Xorg modesetting driver. +
VMM/VMD improvements
- Updated vmm(4) to + allow guests to read MSR_HWCR and MSR_PSTATEDEF, which is necessary to + determine the TSC frequency on AMD families 17h and 19h. +
- Allocated reference for vm and vcpu SLISTs in vmm(4), keeping vmm from + triggering excessive wakeup calls while iterating through the list of + vms while servicing an ioctl(2). +
- Set vmm(4) RAX guest + register state based on VMCB. +
- Removed locking in vmm(4) vmm_intr_pending, + reducing slowdowns due to requests for a lock held while the VM is + running. +
- Increased speed of delivery of interrupts to a running vcpu in vmm(4). +
- Made vmm(4) treat vcpu + lists as immutable, removing the need to reference count individual + vcpu objects and use a rwlock.
- Implemented zero-copy operations on virtqueues in vmd(8).
- Provided a detailed e820 memory map when booting vmd(8) guests with SeaBIOS. When a vm initializes memory ranges, we now track what each range *************** *** 194,210 ****
- Various new userland features:
  - Added lastcomm(1) reporting for process kills due to execve(2) from non-pinned syscall address -
- Various bugfixes and tweaks in userland:
  - Added support for a personal units(1) library by passing -f multiple times. --- 263,323 ----
  - Various new userland features:
    - Added kdump(1) + argument support for msyscall, pledge, unveil, __realpath, ypconnect + and __tmpfd.
    - Added mimmutable(2) and munmap(2) reporting to kdump(1). +
    - Added lastcomm(1) reporting for process kills due to execve(2) from non-pinned syscall address
  - Various bugfixes and tweaks in userland:
    - The libc functions that use the zoneinfo database to convert + time between different timezones allowed the TY environment variable + to point to any file on the system to be reas as zoneinfo file. This + was restricted to paths starting with /usr/share/zoneinfo in the TZ + environement variable. Reject other absolute paths in TZ. The + assumption is that zoneinfo files under /usr/share/zoneinfo are + trustworthy, but + + +
    - Made ldomctl(8) + accept more descriptive name-based paths in addition to number-based + paths in ldom.conf(5). +
    - Dropped support for $rc_exec in rc.subr(8). The rc_exec + function should be used instead. +
    - Excluded /tmp/*.shm files from /tmp cleaning in daily(8). Removing them + interferes with programs that use shared memory via shm_open(3). +
    - Added zap-to-char and zap-up-to-char to mg(1). Bound zap-to-char to + M-z. +
    - Added support to gunzip(1) for zip files + that contain a single member. +
    - Fixed ed(1) to print + bytes read/written and the ? prompt to stdout, not stderr. +
    - Modified the vmstat view in systat(1) to measure + elapsed time using clock_gettime(2). +
    - Fixed handling of escaped backslashes in vi(1) ex_range. +
    - Corrected top(1) + display of online CPUs which can change based on the sysctl(2) sysctl setting.
    - Added support for a personal units(1) library by passing -f multiple times. *************** *** 214,219 **** --- 327,336 ---- href="https://man.openbsd.org/netstart.8">netstart(8), as this does not depend on network access. +
    - Made rc(8) print the + name of each library before relinking as a signal to the operator that + boot has not stalled. +
    - Implemented periodic display in iostat(8). *************** *** 230,236 **** href="https://man.openbsd.org/timeout.1">timeout(1) -s.
    - Fixed .wav files generated by aucat(1) by using extended header format.
    - In disklabel(8), use the --- 347,353 ---- href="https://man.openbsd.org/timeout.1">timeout(1) -s.
    - Fixed .wav files generated by aucat(1) by using extended header format.
    - In disklabel(8), use the *************** *** 255,267 ****
    - Improved hardware support and driver bugfixes, including:
      - Enabled pcagpio(4) and pcamux(4), making the SFP port on the ClearFog Base (CN9130) work. ! !
      - Added uftdi(4) support for FTDI FT232R. !
      - Hooked up the same USB device drivers on riscv64 as done in the arm64 architecture kernel.
        Enabled access to usb(4), Improved hardware support and driver bugfixes, including:
        +
        Added support for the Wacom One M CTL-672 tablet to uwacom(4). +
        Added support for the Rockchip RK3566/RK3568 SoCs. +
        Added support for the RK3568 PCIe controller to dwpcie(4). +
        Converted more RTC drivers to use todr_attach(). Quality of the + RTC is set such that "discrete" RTC chips are preferred over RTCs + integrated on a SoC. +
        Added support for the DS1339 RTC as found on the PiJuice. +
        Introduced pijuice(4), an apm/sensor + driver for the PiJuice HAT UPS. +
        Added qcdwusb(4), a driver + controlling the interface logic for the Synopsis DesignWare USB 3.0 + controller found on various Qualcomm Snapdragon SoCs. +
        Disabled smmu(4) + for the Qualcomm SC8280XP on FDT attachment as on ACPI. +
        Added support for the PCIe controller on the Qualcomm SC8280XP + to dwpcie(4). +
        Extended arm64 suspend/resume to include support for parking + CPUs in a WFE/WFI loop. +
        Added qcrtc(4), a + driver for the RTC found on Qualcomm PMICs. +
        Added qcpon(4), a + driver for the Qualcomm PMIC block that hosts the powerkey and reset + input. +
        Added qcpmicgpio(4), a + driver for the GPIO block inside the Qualcomm PMICs. +
        Added qcpmic(4), + a driver for the SPMI-connected PMICs found on Qualcomm SoCs. +
        Added qcspmi(4), + a driver for the SPMI PMIC Arbiter found on Qualcomm SoCs. +
        Made aplhidev(4) recognize M1 + laptops with touchbars and Translated Fn+(1-10,-,=) keys to F1-F12 on + these systems. +
        Added suspend/resume support to aplns(4). +
        Implemented wakeup interrupt support in aplintc(4). +
        Added suspend/resume support to control the power domain to aplsart(4). +
        Added qcpdc(4), a + driver for the Qualcomm Power Domain controller found on Qualcomm + SoCs. +
        Made the power button function as a wakeup button during suspend + in aplsmc(4). +
        Put CPUs in the lowest P-state before the final suspend step, + needed for systems where we park CPUs in a low-power idle state + ourselves. +
        Added qcpwm(4), a + driver for the PWM found on Qualcomm SoCs. +
        Added aplpwm(4), + a driver for the PWM controller found on Apple Silicon. +
        Added pwmleds(4), a driver for + PWM controlled LEDs. +
        Implemented dwpcie(4) support for the + (optional) MSI controller of the Synopsis Designware PCIe host bridge. +
        Added uhidpp(4) + support for the Unified Battery feature often found in newer Logitech + HID++ hardware. +
        Worked around incomplete ACPI tables on the Lenovo x13s by + loading the alternate device tree binaries from disk. +
        Set console output to the framebuffer on Lenovo x13s machines. +
        Improve Apple support by increasing the apliic(4) transfer + completion timeout to 100ms to accommodate USB Type-C PD chips. +
        Added tipd(4), a + driver fixing USB hotplug of type-C connectors on Apple Silicon + hardware. +
        Improved aplpmu(4) range check to + protect against overflow. +
        Added aplefuse(4), a driver + for the eFuses on Apple Silicon SoCs. +
        Prevented a possible crash when a ugen(4) device is detached. +
        Implemented wakeup interrupt handling in agintc(4).
        Enabled pcagpio(4) and pcamux(4), making the SFP port on the ClearFog Base (CN9130) work. !
        Added uftdi(4) ! support for FTDI FT232R.
        Hooked up the same USB device drivers on riscv64 as done in the arm64 architecture kernel.
        Enabled access to usb(4), ucom(4) and ujoy(4). + +
        Made azalia(4) + match on Intel 500 Series HD Audio. +
        Made aplaudio(4) calculate + the bit clock based on numbers of channels, bytes/sample and sample + rate. +
        Attached Apollo Lake HD Audio device to azalia(4), enabling audio. +
        Enabled aplpcie(4) power management for PCI devices. *************** *** 311,318 ****
        Added psci(4) (ARM Power State Coordination Interface) support for available deep idle states as advertised in device trees. -
        Attached Apollo Lake HD Audio device to azalia(4), enabling audio.
        In rkgpio(4), handled different register layouts in modern Rockchip SoCs as seen in the RK356x and RK3588. --- 521,526 ---- *************** *** 323,343 ****
        Added RK3588 support to rkclock(4) and rkpinctrl(4). !
        Switched sparc64 to clockintr(9). !
        Switched arm amptimer(4) and agtimer(4/armv7) to ! clockintr(9). !
        Switched armv7 dmtimer(4) and sxitimer(4) to clockintr(9). !
        Switched armv7 gptimer(4) to clockintr(9). !
        Added a kernel-facing API for clockintr(9).
        Added mvortc(4), a driver for the RTC on the ARMADA 38x series.
        Added mvodog(4), --- 531,537 ----
        Added RK3588 support to rkclock(4) and rkpinctrl(4). !
        Added mvortc(4), a driver for the RTC on the ARMADA 38x series.
        Added mvodog(4), *************** *** 376,381 **** --- 570,582 ----
        New or improved network hardware support:
        +
        Enabled em(4) IPv4, + TCP and UDP checksum offloading and VLAN HW tagging on devices with 82575, 82576, + i350 and i210 chipsets. +
        Improved mcx(4) + performance by using interrupt-based command completion. +
        Fixed a panic seen with rge(4) RTL8125 with MCLGETL.
        Add dwqe(4), a driver for the Synopsis DesignWare Ethernet QoS controller used on the NXP i.MX8MP, the Rockchip RK35xx series and Intel Elkhart Lake. *************** *** 389,410 ****
        Added or improved wireless network drivers:
        !
        Fixed bwfm(4) issues with suspend/resume and possible firmware crashes on the M2 Macbook Air.
        Prevented an iwx(4) firmware error when authentication to the AP times out.
        Fixed a crash in iwx(4) when connecting to WEP networks via ifconfig(8) join.
        Fixed an alignment issue in iwx(4) Rx descriptors.
        Avoided trying to remove keys while doing crypto in hardware if the station is not active in iwx(4) firmware, fixing a firmware panic. !
        Prevented potential panics by disallowing the iwx(4) init task from running in parallel to wakeup code during resume. !
        Switched all iwx(4) devices to -77 firmware images. !
        Made iwx(4) get the primary channel number from AP beacon info, preventing problems on 40/80Mhz channels if there is a mismatch. !
        Fixed iwx(4) session protection event duration. !
        Added support for the new iwx(4) SCD_QUEUE_CONFIG command, required for adding/removing Tx queues on new firmware versions. !
        Added support for the iwx(4) BAID allocation config command, required to set up Rx aggregation on new firmware. !
        Added support for iwx(4) RLC config command, IWX_STA_MAC_DATA_API_S_VER_2 API, and PHY context cmd version 4. !
        Added support for iwx(4) rate_n_flags API version 2 and removed fixed Tx rate support. !
        Added support for iwx(4) TLC config command v4. !
        Added support for iwx(4) firmware alive response version 6.
        
        IEEE 802.11 wireless stack improvements and bugfixes: --- 590,645 ----
        Added or improved wireless network drivers:
        !
        Bumped tsleep timeout for bwfm(4) PCI devices to help ! prevent failures loading firmware, particularly on Apple M2 laptops.OA !
        Implemented alternative mailbox handling mechanism required by ! newer bwfm(4) firmware. !
        Fixed bwfm(4) ! issues with suspend/resume and possible firmware crashes on the M2 ! Macbook Air.
        Prevented an iwx(4) firmware error when authentication to the AP times out. +
        Fixed a crash in iwx(4) when connecting to WEP networks via ifconfig(8) join. +
        Fixed an alignment issue in iwx(4) Rx descriptors. +
        Avoided trying to remove keys while doing crypto in hardware if the station is not active in iwx(4) firmware, fixing a firmware panic. ! !
        Prevented potential panics by disallowing the iwx(4) init task from running ! in parallel to wakeup code during resume. ! !
        Switched all iwx(4) ! devices to -77 firmware images. ! !
        Made iwx(4) get the ! primary channel number from AP beacon info, preventing problems on ! 40/80Mhz channels if there is a mismatch. ! !
        Fixed iwx(4) session ! protection event duration. ! !
        Added support for the new iwx(4) SCD_QUEUE_CONFIG ! command, required for adding/removing Tx queues on new firmware ! versions. !
        Added support for the iwx(4) BAID allocation config ! command, required to set up Rx aggregation on new firmware. !
        Added support for iwx(4) RLC config command, ! IWX_STA_MAC_DATA_API_S_VER_2 API, and PHY context cmd version 4. !
        Added support for iwx(4) rate_n_flags API ! version 2 and removed fixed Tx rate support. !
        Added support for iwx(4) TLC config command v4. !
        Added support for iwx(4) firmware alive ! response version 6. !
        
        IEEE 802.11 wireless stack improvements and bugfixes: *************** *** 441,451 **** --- 676,694 ----
        Fixed passing explicit stages files to installboot(8). + +
        Added mount_nfs(8) to the + sparc64 installer, to fetch sets over NFS. +
        Copy the apple-boot firmware to EFI system partition, enabling + automatic bootloader updates on Apple Silicon computers.
        Made the installer stop printing MD post installation instructions on upgrades.
        Made it possible to set keyboard layout(s) in arm64's installer.
        Added initial support in the installer for guided disk encryption for amd64, i386, riscv64 and sparc64. +
        Added passing of boot device information from the bootloader to + the kernel on luna88k.
        Switched luna88k boot loader to MI boot code.
        Made the luna88k bootloader display a puffy boot logo.
        Made ls(1) work *************** *** 491,496 **** --- 734,743 ----
        Implemented a --executable-only option in ld.bfd(1). +
        Changed ld.so(1) + to map certain regions of memory as immutable when loading shared + libraries. +
        Added execve(2) violations of pinsyscall(2) policy *************** *** 509,519 **** --- 756,796 ---- making this address ranges unreadable to the kernel. No programs have been discovered which require reading their own text segments with a system call. + +
        On arm64, introduce mitigation of the Spectre-BHB (Branch + History Injection) CPU vulnerability by using core-specific trampoline + vectors. + +
        Tightened the pledge(2) after ssh(1) session establishment. + +
        Enabled the Data Independent Timing (DIT) feature in both the kernel and + userland on arm64 CPUs that support it to mitigate timing side-channel + attacks. +
        
        Changes in the network stack:
        +
        Made /dev/pf a clonable device to better track kernel ressources + used by processes. +
        Modified TCP receive buffer size auto-scaling to use the smoothed + RTT (SRTT) instead of the timestamp option, which improves performance + on high latency networks if the timestamp option isn't available. +
        Relaxed the requirement for multicast suppport of interfaces for + configuring IPv6. This allows non-multicast interfaces such as + point-to-point interfaces and the NBMA / point-to-multipoint + interfaces like mpe(4), mgre(4) and wg(4) to work with IPv6. + +
        Use the new getnsecruntime(9) + timer to check the TCP_KEEPALIVE timer only against the system + runtime, not the uptime. Prevents TCP connections to fail after + wakeing up from suspend. + +
        Used stoeplitz (symmetric Toeplitz hash algorithm) to generate a hash/flowid for pf(4) state keys. With this change, pf will hash traffic the same way that *************** *** 533,538 **** --- 810,817 ---- href="https://man.openbsd.org/em.4">em(4) sparc64 systems.
        Denied "pipex no" tunnel setting for pppx(4) interfaces. +
        Fixed pfsync(4) + crashing on pf_state_key removal.
        Fixed a panic in pfsync(4) when there are no data ready for bulk transfer. *************** *** 681,695 ****
        In snmpd(8),
        !
        ...
        
        Added support for configuring interfaces by lladdr to support interface configurations bound to a specfic hardware device. The "if" part of the hostname.if(5) configuration file can now be a MAC address.
        Prevented smtpd(8) abort due to a connection from a local, scoped ipv6 address. --- 960,1043 ----
        In snmpd(8),
        !
        +
        Switched tftpd(8) to + default to read-only unless -w is specified for write access (the + previous default). +
        Stopped printing the prompt for non-interactive usage of tftp(1). +
        Changed rarpd(8) to + only unveil /tftpboot if -t is specified. +
        Added client certificate authentication and an optional SASL + EXTERNAL bind to ypldap(8). +
        Adjusted ipv6 address width to align the display columns better + in the output of ndp(8), + route(8) and netstat(1) as already + available in systat(1)'s netstat. +
        Used stravis(3) to + sanitize redirect URIs from ftp(1) fetch before printing. +
        Prevent an unwind(8) crash when a tcp + query is larger than the length field indicated. + +
        Preserve the original order of nameservers as configured via resolv.conf(5) in resolvd(8). + +
        Restrict the characters allowed in the hostname argument of getaddrinfo(3) to the + set [A-z0-9-_.]. Additionally two consecutive dots ('.') are not + allowed nor can the string start with - or '.'. This removes + characters like '$', '`', '\n' or '*' that can traverse the DNS + without problems, but have special meaning, for example a shell. + +
        Added ifconfig(8) -M (mac) to + find the mac address on an interface and print it.
        Added support for configuring interfaces by lladdr to support interface configurations bound to a specfic hardware device. The "if" part of the hostname.if(5) configuration file can now be a MAC address. +
        Limited display of wireguard peers by ifconfig(8) to when + either a wireguard interface is specified or the flag "-A" is used. +
        Implemented the RFC 8781 PREF64 router advertisement option in + rad(8) which is used to o + communicate NAT64 prefixes to hosts. + +
        Moved the documentation of flag mappings displayed by "route show" from the netstat(1) manpage to route(8). + +
        Improvements in nc(1): +
        +
        Stop claiming connection success in udp mode unless true. +
        Do not test the connection in non-interactive mode. The test + writes characters to the socket which can corrupt data that is + possible piped into nc. +
        + +
        Added support for newlines inside the alternative names block in + acme-client.conf. +
        Made acme-client(1) use + time checks which eliminate time-zone variation. +
        Encode Subject Alternative Name (SAN) entries before printing in acme-client(1). +
        Prevent acme-client(1) from + leaking an http get request when receiving a redirect without a + location header. +
        Prevented smtpd(8) abort due to a connection from a local, scoped ipv6 address. *************** *** 716,726 **** --- 1064,1087 ---- to read-only unless -w is specified for write access (the previous default).
        Changed rarpd(8) to only unveil /tftpboot if -t is specified. +
        Fixed the DIOCIGETIFACES ioctl so all network interfaces and + interface groups are reported in pfctl(8). +
        
        tmux(1) improvements and bug fixes:
        +
        Added scroll-top and scroll-bottom tmux(1) commands to scroll so cursor is at the top or bottom respectively. +
        Added a -T flag to tmux(1) capture-pane to capture up to the last used cell and not the full width of the pane. +
        Preserved the marked pane when renumbering windows in tmux(1). +
        Added modified tab key sequences to tmux(1). +
        Changed tmux(1) to only set the extended flag when searching, which allows send-keys to work. +
        Added a -l flag to tmux(1) display-message to disable format expansion. +
        Fixed a tmux(1) crash when there are no window buffers. +
        Fixed tmux(1) C-S-Tab without extended keys. +
        Added tmux(1) send-keys -K to handle keys directly as if typed.
        Made tmux(1) tty-keys accept \007 as terminator to OSC 10 or 11.
        Made tmux(1) recognize pasted texts wrapped in bracket paste sequences, rather than only forwarding to the program inside.
        Supported -1 without -N for list-keys in tmux(1).