=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/plus.html,v retrieving revision 1.1390 retrieving revision 1.1391 diff -c -r1.1390 -r1.1391 *** www/plus.html 2016/07/03 11:20:30 1.1390 --- www/plus.html 2016/07/05 22:20:08 1.1391 *************** *** 80,89 ****

Convert ldapd(8) to use the libtls API.
In file(1), fix the default type to work properly. !
In bytgpio(4), mask all gpio interrupts when attaching. This fixes interrupt storm on the Lenovo Ideacentre Stick 300.
In sdhc(4) and sdmmc(4):
- Implement DMA support (only ADMA2 is supported). There is a remaining issue with simultaneous use of eMMC and external SD card on (some) Intel Bay Trail hardware. --- 80,296 ----
  - Add support for using SRPs without the garbage collection machinery. +
  - In sshd(8): +
    - Ensure that the client's proposed DH-GEX max value is at least as big as the minimum the server will accept. +
    - Check min and max sizes sent by the client against what we support before passing them to the monitor. +
    +
  - Fix ptrace PT_WRITE_D that returned EFAULT (broken in src/sys/kern/sys_process.c r1.33). +
  - In libexpat, fix CVE-2016-0718. +
  - In installboot(8), add support for armv7. +
  - In binutils, port over the binutils fix for PR ld/3111: greatly speed up linking of object files that contain lots of dwarf2 symbols by caching symbol tables. +
  - In newfs(8), permit wxallowed on mfs. +
  - In libedit, fix a crash that occurred when the history contained more than twice as many entries as the new limit. +
  - Ensure that softraid(4) crypto is not run on the crypto taskq. +
  - In video(1), guard against using tp_start uninitialized in case no frame was grabbed in verbose mode. +
  - Stop creating and inserting a route entry for ARP and ND automagically. +
  - Flush dynamic route entries attached to an interface when its link state becomes DOWN. This should fix stale RTF_DYNAMIC routes when switching WiFi network during suspend/resume. +
  - Plug a route entry leak triggered under memory pressure. + +
  - In video(1), add In mmap(2) support for frame grabbing and make it default over read.(2) unless overriden by the -g flag. +
  - Identify W^X labelled binaries at execve(2) time based upon the WX_OPENBSD_WXNEEDED flag set by ld -zwxneeded. +
  - In sed(1), fix a begin-of-word mismatch. +
  - On amd64, include rdtsc in the rdrand callback. +
  - Deal with interfaces removing the VLAN header before the packet has been feed to the pseudo-interfaces input handlers. +
  - Update to freetype-doc 2.6.3. + +
  - In libc on i386, do setjmp cookies for eip, esp, and ebp. +
  - In libc on mips64, do setjmp cookies for gp, sp, and ra. +
  - 5.8 and 5.9 RELIABILITY FIX: Bug in the libcrypto library when parsing certain ASN.1 elements.
    A source code patch is available for 5.8 and 5.9. +
  - Update to xserver 1.18.3. +
  - Update to freetype 2.6.3. +
  - In smu(4/macppc), add support for new smu-firmware fan commands. +
  - Update to mesa 11.2.2. + +
  - Fix a pledge(2) violation with "ncheck_ffs /dev/tty". +
  - In ld(1), implement -z wxneeded. +
  - Fix a pledge(2) violation with "pdisk /dev/tty". +
  - Implement the fork+exec pattern in smtpd(8). +
  - Fix pledge(2) issues in growfs(8). +
  - In nc(1): +
    - Fix -verbose mode when used on a Unix domain socket. +
    - Fix a pledge(2) violation when -P is used and a passwords needs to be supplied. +
    +
  - In iwm(4), add support for Intel Wireless 3165 devices. +
  - In fsirand(8) and fsck_msdos(8), fix a pledge(2) violation that can be triggered by using DIOCGDINFO on a file that is not a disk device. +
  - In disklabel(8), don't crash if no filename is provided. +
  - In iwm(4), add support for Intel Wireless 8260 devices. +
  - In aucat(1), fix file block size rounding and ensure it's large enough to store a full audio block. + +
  - In the install script, set the "wxallowed" mount(8) option for the filesystem /usr/local resides on. +
  - No longer allow W^X violations by default. A kernel log message is generated, and mprotect(2) and mmap(2) return ENOTSUP. If the kern.wxabort sysctl(8) is set, a SIGABRT occurs instead. W^X-violating programs can be permitted per FFS/NFS filesystem, using the "wxallowed" mount(8) option. +
  - In aucat(1), when resampling, use the exact resampling factor instead of the ratio between input and output block sizes. This change makes playback/recording rate match exactly the requested sample rate. +
  - In httpd(8), return 400 (Bad Request) instead of 500 (Internal Server Error) for requests not specifying the HTTP version. + +
  - When initializing the console, add a short delay so that baud rate changes on the console have a chance of working. This prevents the serial console on the APU from hanging when garbage is echoed to the tty. +
  - In procmap(1), reintroduce vnode-to-filename mapping. +
  - In rc(8): +
    - Skip library reordering if /usr/lib is on an NFS filesystem. +
    - Temporarily remount read-write if /usr/lib is on a read-only FFS filesystem. +
    +
  - Make amaps use less kernel memory. This is achieved by grouping amap slots into chunks that are allocated on-demand by pool(9). + +
  - In scp(1) and sftp(1), prevent screwing up terminal settings by escaping bytes not forming ASCII or UTF-8 characters. +
  - In regex(3), fix another one-byte buffer underflow (read access only). +
  - Avoid a use-after-free in ftp(1). +
  - In iwm(4), update to firmware API 16 and enable RTS/CTS frame protection. + +
  - In the armv7 install script, use efiboot when setting up the installed disk. +
  - On octeon, prevent gather buffer starvation on currently supported systems. + +
  - In acpitz(4), disable active cooling trip points when we lack the right method to operate. +
  - Place a cpu-dependent trap/illegal instruction over the remainder of the sigtramp page, so that it will generate a kernel fault if touched. +
  - Remove the kern.random sysctl(8). +
  - In umsm(4), support the Airprime/Sierra AirCard 313U and the Netgear/Sierra AirCard 770S. +
  - Various improvements to ldpd(8). +
  - In binutils on sparc64, make the PLT read-only. This allows the kernel and ld.so to load binaries without violating W^X. +
  - Add UTF-8 support to fold(1). + +
  - On macppc, use 64-bit integers to fix fan scaling calculations. +
  - Build armv7 efiboot. +
  - In libc on hppa, add XOR cookies for rp and sp. +
  - In libc on powerpc, add XOR cookies for r1 (stack) and lr. +
  - Avoid a uvm fault when pulling an msdos-formatted umass(4) stick during mount while the USB stack is busy. +
  - In smtpd(8), start work on improving the log format. + +
  - Build eeprom(8) on armv7. +
  - Implement openprom(4) for armv7. +
  - Make eeprom(8) -p print sensible numbers on little-endian platforms. +
  - Remove the -x flag from mount_msdos(8) and always assume the execute bit for readable directories subject to the mask option (-m). +
  - Stop making files executable on msdosfs. +
  - Fix a logic bug in DUID generation: we want to generate DUIDs until we have one that is not a duplicate and not a zero DUID. +
  - In ntpd(8), harden TLS for constraints. +
  - On armv7, dynamically attach imxiic(4/armv7) and use the FDT to enumerate devices on i2c busses. The CuBox-i and Hummingboard now need to be booted with an FDT to see the RTC. +
  - In cnmac(4/octeon), make the TX path MP-safe and add some ifq oactive logic. + +
  - On armv7, resolve problems with ommmc(4/armv7) sometimes not attaching properly with recent u-boot versions. +
  - On macppc, hook up smu(4/macppc) to the thermal management framework. +
  - On macppc, add a thermal management framework which controls the fan speed based on the temperature sensor values. +
  - In the install script, log questions and answers during install/upgrade and mail them to the root user in a format usable as a response file for autoinstall(8). +
  - In libcrypto, fix a short-read bug in the previous version of asn1_d2i_read_bio. + +
  - On i386, split the ACPI resume trampoline into code and data pages, and protect with proper permissions. +
  - Remove the net.inet6.ip6.v6only sysctl(8). + +
  - 5.9 RELIABILITY FIX: Possible data corruption in bnx(4).
    A source code patch is available for 5.9. +
  - In ieee80211(9), in hostap mode, don't re-use association IDs (AIDs) of nodes which are still lingering in the node cache. This could cause an AID to be assigned twice. + +
  - Split the i386 mp hatch trampoline into code and data pages, and protect each with proper W^X policy. +
  - On octeon, accept cnmac as a valid rootdev from uboot (e.g. rootdev=/dev/cnmac0). +
  - Rework the fix to prevent a kernel crash when sendsyslog(2) is called with LOG_CONS and the console device has not been intialized yet. +
  - In regex(3), fix a one-byte buffer underflow (read access only). +
  - Change the random event buffer from a queue to an endless ring so that no events are dropped when the queue is full. They are instead mixed into previous events. +
  - Fix "skeyinit username" run as root. +
  - 5.8 and 5.9 SECURITY FIX: Insufficient checks in the uvideo(4) V4L2 ioctl(2) handling leak kernel memory contents to a local user.
    A source code patch is available for 5.8 and 5.9. +
  - Completely skip link-layer address resolution and NUD on gif(4). + +
  - In uvideo(4), plug some holes in the V4L2 ioctl(2) interfaces that would leak kernel memory to a local user. Also fix a potential integer overflow issue. +
  - In httpd(8), fix some file-descriptor leaks. +
  - Enable the pcf8523 RTC on Hummingboard and CuBox-i. +
  - 5.9 RELIABILITY FIX: Issues in smtpd(8).
    A source code patch is available for 5.9. +
  - In smtpd(8): +
    - Fix a logic issue in the SMTP state machine that can lead to an invalid state and result in a crash. +
    - Plug a file-pointer leak that can lead to resource exhaustion and result in a crash. +
    +
  - Have POSTREAD flush the D-cache. This eliminates random data corruption on the CuBox-i4Pro. +
  - Add pfcrtc(4), a driver for the NXP PCF8523 Real Time Clock. + +
  - In xge(4), enable reception and transmission of Jumbo frames. + +
  - In smu(4/macppc), add support for pwm fans. +
  - Initial stab at an EFI bootloader for armv7. +
  - In sysmerge(8), no longer handle /etc/example files. + +
  - In install(1), add -F to call fsync(2) on the installed file right before closing it. +
  - In tmux(1), add -q to source-file to suppress errors about nonexistent files. + +
  - In eigrpd(8), disable EIGRPv6 on an interface when it loses its link-local address. +
  - Remove the hppa64 port. +
  - Allow zaudio(4) to start when large blocks are requested. +
  - Make the mips64 pmap MP-safe. +
  - In top(1), allow to filter process arguments if they are being displayed. + +
  - Avoid a kernel crash when sendsyslog(2) is called with LOG_CONS and the console device has not been intialized yet. +
  - Do SROP mitigation. sendsig() stores a cookie inside the sigcontext. sigreturn(2) checks the syscall entry was from the exact PC addr in the (per-process ASLR) sigtramp, verifies the cookie, and clears it to prevent sigcontext reuse +
  - Try harder to avoid using random data on the disk as an inode, because FFS2 does lazy inode initialization. This avoids crashes when translating a bogus filehandle to a vnode. + +
  - Update to libexpat 2.1.1. +
  - In rcs(1), implement Mdocdate keyword substitution. + +
  - In imxesdhc(4), add DMA support. It uses ADMA2 "Internal DMA" that is compatible with the SD Host Controller standard. +
  - In chvgpio(4), add support for level, active low gpio interrupts. +
  - In wall(1), enable UTF-8 detection in wall(1). This deliberately ignores UTF-8 characters and replaces them with a single question mark. +
  - In bytgpio(4) and chvgpio(4), add support for writing gpio pins. +
  - In ifconfig(8), stop printing the MPSAFE interface flag. It is a kernel-only hint and printing it only creates confusion. + +
  - Add chvgpio(4), a driver for the GPIO controllers found on Intel's Cherry View SoC. +
  - On powerpc, flush page (through the direct map) before mapping it into AGP. This fixes artifacts seen in X on some G5 machines. +
  - In the getpwnam(3) family of functions, stop opening the shadow database by default. +
  - In tcpdump(8), print RA Route Information prefix, preference and lifetime. +
  - Use a Thread Information Block in both single and multi-threaded programs. Make libpthread dlopen(3)'able. +
  - In bytgpio(4), implement ACPI 5.0 GeneralPurposeIo OpRegion support. +
  - Import Term::ReadKey 2.33. + +
  - In imxesdhc(4), add support for changing the bus width and set the 4-bit mode capability. +
  - Make the imxesdhc(4) work on the cubox-i. +
  - Revert the default cachepercent to 20. +
  - In tcpdump(8), print the router preference contained in RAs in verbose mode. + +
  - Fix efiboot not to hang with a disk whose block size is less than 512. +
  - Fix packet corruption in bnx(4). +
  - Add Dual Data Rate support for eMMC at 52 MHz. +
  - In gcc(1), add support for named initializers for anonymous structs/unions. This is a C11 feature that is starting to get used in places such as Mesa. +
  - In midiplay(1), fix one of the reads past the end of the buffer. + +
  - In acpithinkpad(4), avoid a division by zero in wsconsctl(8). +
  - In dc(4), cope with the broken DMA engine of the Davicom DM9102 found on some Sun sparc64 machines. +
  - On sparc64, avoid having to panic on hardware with a broken DMA engine that attempts to read beyond the end of the buffer that was programmed. +
  - Add initial support for MSI-X, only on amd64 for now. +
  - In ssh_config(5), add IdentityAgent. +
  - In sdmmc(4), add high-speed support for SD cards. This causes serious improvement in the read speeds. +
  - In bytgpio(4), don't mask pins configured as direct IRQ. This nbreaks the keyboard on the Asus x205ta. + +
  - In ssh(1), fix overriding of StreamLocalBindMask and StreamLocalBindUnlink in Match blocks. +
  - Stop using a soft-interrupt context to process incoming network packets. Use a new task that runs holding the KERNEL_LOCK to execute MP-unsafe code. +
  - 5.8 and 5.9 SECURITY FIX: Issues in the libcrypto library (CVE-2016-2108, CVE-2016-2107, CVE-2016-2105, CVE-2016-2106 and CVE-2016-2109). Refer to the advisory.
    A source code patch is available for 5.8 and 5.9. +
  - In libssl, fix several issues: missing padding check in aesni functions, overflow in evp encode functions, and use of invalid negative asn.1 types. +
  - Reduce the number of lookups to 1 for non-multicast traffic when pf(4) is disabled. +
  - In ssh, implement IUTF8 as per draft-sgtatham-secsh-iutf8-00. + +
  - In telnet(1), don't check if the hostname is a fully qualified domain. This prevents pledge(2) "dns" issues. +
  - In tmpfs, fix some issues regarding timestamp updating. +
  - In ssh: +
    - Support SHA256 and SHA512 RSA signatures in certificates. +
    - Add support for additional fixed DH groups from draft-ietf-curdle-ssh-kex-sha2-03. +
    +
  - On arm and armv7, rework mainbus and implement simplebus to be able to span a tree-like topology based on device tree information. + +
  - In ommmc(4/armv7), add support for changing the bus width to ommmc and set the 4-bit mode capability. +
  - Add bus width switching support for MMC. Enable 8-bit bus support on sdhc(4) controllers that support it. This makes the raw transfer rate of the eMMC on the Lenovo Ideacentre Stick 300 go up to 40 MB/s. +
  - In sdhc(4), fix the DMA issues on Bay Trail. +
  - Add support for changing the bus width to the sdmmc(4) subsystem and the sdhc(4) controller. Use this to switch SD cards to a 4-bit bus if they support it. +
  - In sppp(4), fix a bug causing breakage with LCP echoes. +
  - 5.9 RELIABILITY FIX: A problem in m_dup_pkt() can result in kernel crashes with carp(4).
    A source code patch is available for 5.9.
  - Convert ldapd(8) to use the libtls API.
  - In file(1), fix the default type to work properly. !
  - In bytgpio(4), mask all gpio interrupts when attaching. This fixes an interrupt storm on the Lenovo Ideacentre Stick 300.
  - In sdhc(4) and sdmmc(4):
    - Implement DMA support (only ADMA2 is supported). There is a remaining issue with simultaneous use of eMMC and external SD card on (some) Intel Bay Trail hardware. *************** *** 103,109 ****
    - In ssh(1), close the ControlPersist background process stderr when the daemon is not in debug mode or when logging to a file or syslog (bz#1988).
    - In MAKEDEV(8), replace /dev/bpf[0-9] with /dev/bpf and /dev/bpf0. !
    - If the attempt to broadcast a DHCPDISCOVER packet returns EAFNOSUPPORT, just print an error message and exit.
    - In installboot(8/i386), plug a couple of leaks of input buffers.
    - In libssl, allow ^C to break operations such as reading passwords.
    - In libssl, implement the IETF ChaCha20-Poly1305 cipher suites. The old Google implementation continues to be supported, but the ChaCha20-Poly1305 cipher suites names now refer to the ciphers from draft-ietf-tls-chacha20-poly1305-04. --- 310,316 ----
    - In ssh(1), close the ControlPersist background process stderr when the daemon is not in debug mode or when logging to a file or syslog (bz#1988).
    - In MAKEDEV(8), replace /dev/bpf[0-9] with /dev/bpf and /dev/bpf0. !
    - In dhclient(8), if the attempt to broadcast a DHCPDISCOVER packet returns EAFNOSUPPORT, just print an error message and exit.
    - In installboot(8/i386), plug a couple of leaks of input buffers.
    - In libssl, allow ^C to break operations such as reading passwords.
    - In libssl, implement the IETF ChaCha20-Poly1305 cipher suites. The old Google implementation continues to be supported, but the ChaCha20-Poly1305 cipher suites names now refer to the ciphers from draft-ietf-tls-chacha20-poly1305-04. *************** *** 135,141 ****
    - In rtsx(4), match on RTS522A found in 2016 ThinkPads.
    - Remove systrace support. !
    - In install script, when upgrading automatically run sysmerge(8) in batch mode before fw_update(1).
    - On macppc and socppc, don't check if the CPU is inside the idle loop when entering ddb(4). This allows putting breakpoints in interrupt context and have them work if an interrupt fires while the CPU is idle.
    - In httpd(8), always pass the QUERY_STRING variable to the FastCGI handler. --- 342,348 ----
    - In rtsx(4), match on RTS522A found in 2016 ThinkPads.
    - Remove systrace support. !
    - In the install script, when upgrading automatically run sysmerge(8) in batch mode before fw_update(1).
    - On macppc and socppc, don't check if the CPU is inside the idle loop when entering ddb(4). This allows putting breakpoints in interrupt context and have them work if an interrupt fires while the CPU is idle.
    - In httpd(8), always pass the QUERY_STRING variable to the FastCGI handler. *************** *** 332,338 ****
    - Update to tzdata2016b from ftp.iana.org.
    - Allocate amap slots for a virtual memory range reserved with sbrk(2) lazily. This avoids wasting kernel memory if the user process does not make use of the allocated memory.
    - For amaps with only a few slots, allocate the slots via pool(9). This saves some memory and reduces kmem pressure. !
    - 5.9 RELIABILITY FIX: Incorrect path processing in pledge_namei() could result in unexpectedprogram termination of pledge(2)'d programs.
      A source code patch is available for 5.9.
    - 5.7, 5.8 and 5.9 SECURITY FIX: Insufficient checks in IPv6 socket binding and UDP IPv6 option processing allow a local user to send UDP packets with a source (IPv6 address + port) already reserved by another user.
      A source code patch is available for 5.7, 5.8 and 5.9.
    - In puc(4), add support for the Exar XR17V354 device. --- 539,545 ----
    - Update to tzdata2016b from ftp.iana.org.
    - Allocate amap slots for a virtual memory range reserved with sbrk(2) lazily. This avoids wasting kernel memory if the user process does not make use of the allocated memory.
    - For amaps with only a few slots, allocate the slots via pool(9). This saves some memory and reduces kmem pressure. !
    - 5.9 RELIABILITY FIX: Incorrect path processing in pledge_namei() could result in unexpected program termination of pledge(2)'d programs.
      A source code patch is available for 5.9.
    - 5.7, 5.8 and 5.9 SECURITY FIX: Insufficient checks in IPv6 socket binding and UDP IPv6 option processing allow a local user to send UDP packets with a source (IPv6 address + port) already reserved by another user.
      A source code patch is available for 5.7, 5.8 and 5.9.
    - In puc(4), add support for the Exar XR17V354 device.