The release of the free UNIX-like operating system OpenBSD 7.7 has been announced. The OpenBSD project was founded by Theo de Raadt in 1995 after a conflict with the developers of NetBSD, which resulted in Theo being denied access to the NetBSD CVS repository. Subsequently, Theo de Raadt, along with a group of like-minded individuals, created a new open operating system based on the source code tree of NetBSD, with the main goals of development being portability (supporting 13 hardware platforms), standardization, correctness, proactive security, and integrated cryptographic tools. The size of the full installation ISO image of the OpenBSD 7.7 base system is 746 MB.
In addition to the operating system itself, the OpenBSD project is known for its components that have been adopted in other systems and proven to be among the most secure and high-quality solutions. Among them: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, routing daemons OpenBGPD and OpenOSPFD, the NTP server OpenNTPD, mail server OpenSMTPD, terminal multiplexer (analog of GNU screen) tmux, identd daemon implementing the IDENT protocol, BSDL alternative to the GNU groff package — mandoc, protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight HTTP server, and the file synchronization utility OpenRSYNC.
Key Changes:
- The implementation of the Direct Rendering Manager (drm) framework is synchronized with the Linux kernel 6.12.21 (previous release was 6.6.52). The inteldrm driver now supports the GPU used in Intel processors based on the Arrow Lake microarchitecture. The amdgpu driver has added support for the Ryzen AI 300 (Strix Point, Strix Halo, Krackan Point) and Radeon RX 9070 (Navi 48) GPUs.
- Support for the Scalable Vector Extension (SVE) instruction set has been implemented in the port for the ARM64 architecture. Power consumption states can now be displayed on systems with Apple M1 ARM chips. The operations for flushing the associative translation lookaside buffer (TLB) have been optimized in the physical memory mapping mechanism (pmap), which has accelerated kernel build tests by approximately 5%. On hardware supporting the QARMA3 cipher for user space protection, Pointer Authentication Code (PAC) authentication has been enabled.
- Support for the AMD SEV (Secure Encrypted Virtualization) mechanism used in virtualization systems for protecting guest systems running on x86_64 architecture via QEMU has been implemented. of virtual machines This protects against interference from the hypervisor or host system administrator. The psp driver, used for configuring and launching guest systems with AMD SEV enabled, has added a command for loading firmware into the chip.
- On x86_64 systems, the ability to allocate DMA memory regions larger than 4 GB has been added.
- Support has been improved for RISC-V, Sparc64, HPPA, i386, and Powerpc64 architectures.
- Memory shortage situations (OOM) handling has been improved in the system.
- The ptrace trace mechanism has been enhanced with capabilities that allow setting breakpoints in multi-threaded processes in the gdb debugger. Commands have been added to read and write the area where the state of the processor is saved in the traced process using the XSAVE instruction.
- BT language scripts (BPFtrace or Bug Tracing), used in the btrace tracing system, now support multi-line constructs. The btrace utility has been enhanced with additional profiles and naming of time intervals (hz, us, ms, s).
- A new sysctl parameter kern.audio.kbdcontrol has been added, which, when set to 0, will allow multimedia volume control keys on the keyboard to be processed as regular keys.
- Error handling has been improved and checks have been expanded when transitioning to sleep and waiting modes.
- The code for stopping processes upon receiving a signal has been redesigned, resolving issues with stopping multi-threaded processes, which were evident in packages such as golang and mpv.
- Support for multi-processor systems (SMP) has been enhanced. TCP input and output timers are now running in parallel, and the send() and recv() system calls have been moved to use a shared lock. Multiple user threads can now operate in parallel with different sockets, and TCP output no longer blocks the processing of IP packets.
Global locks have been removed from the system calls open, openat, ptsignal, psignal, and prsignal, as well as the sysctl parameters kern.timeout_stats, kern.allowkmem, kern.video.record, net.inet.gre.allow, net.inet.gre.wccp, kern.global_ptrace, kern.wxabort, and kern.malloc.kmemstat. The psp, wsmouse, and wstpad drivers, along with the video_filtops structure, have been made mp-safe.
- The VMM hypervisor has implemented the capability to use acpipci for attaching PCI buses.
- The ability to define an alternative performance policy (perfpolicy) has been provided for when the system operates on battery.
- The sysctl command has added the option '-f file' for loading all settings at once from a file. In rc scripts, the new option has been applied to load sysctl.conf entirely, instead of parsing it line by line.
- The pkg_add command has implemented a call to ldconfig if the list of shared libraries has changed as a result of installing new packages.
- Support for new hardware has been added. Enhanced support for MediaTek and Qualcomm Snapdragon SoCs (including X Elite). Improved support for Samsung Galaxy Book4 Edge, ThinkPad T14 Gen 5, Vivobook, ThinkPad X1 Nano Gen 2, ThinkPad X13, and various Chromebooks. Added the ice driver for Intel E810 Ethernet 1Gb/10Gb/25Gb/50Gb/100Gb and the ixv driver for Intel Ethernet 82598EB, 82559, and X540 virtual functions. Continued work on offloading network operations to network cards.
- In sysupgrade, a mode for offline system upgrades using packages saved in local FS has been implemented.
- The fw_update utility has been enhanced to allow downloading (not installing) firmware under a regular user without root privileges. A '-l' flag has been added to list drivers and files.
- For the sshd-auth process, protection against vulnerability exploitation has been enabled, based on random relinking of the executable on each system boot. Relinking makes function offsets less predictable, making it harder to create exploits that use return-oriented programming methods.
- Process isolation for mountd has been ensured using the unveil system call.
- Support for AF_FRAME sockets and the IFT_ETHER protocol family has been implemented in the network stack, allowing applications to send and receive Ethernet frames. A new hashing method has been introduced for outgoing UDP and TCP packets, optimizing traffic distribution across queues and significantly speeding up (~20%) UDP transmission for IPv4/IPv6 and TCP for IPv6. For the tun device, ioctl TUNSCAP has been implemented, and communication between the kernel and user space has been optimized. A separate routing cache for each thread has been realized. The vio driver has been enabled with multiqueue mode.
- In the pfctl utility for network interfaces and queues, it is now allowed to define bandwidth exceeding 4Gbit.
- In iked, the IKEv2 protocol implementation for IPsec, an 'natt' option has been added to force the use of nat-t.
- In relayd, the background process for redirecting and load balancing requests, support for client-side has been implemented. for TLS certificates.
- The network performance measurement tool tcpbench has added support for TLS.
- In bgpd, support for RFC 8654 (BGP Extended Message) and RFC 8538 (BGP Notification Message) has been implemented, with the 'reject as-set' option enabled by default, ensuring Adj-RIB-Out caching.
- LibreSSL 4.1.0 has added experimental support for the loongarch64 architecture, introduced new assembly implementations of the SHA-1, SHA-256, and SHA-512 algorithms for the amd64 architecture (utilizing the SHA-NI instruction), new assembly implementations of SHA-256 and SHA-512 for Aarch64 (using the CE extension), simplified the MD5 implementation for amd64, and provided caching of the revoked certificate list (CRLs). The ML-KEM 768 and 1024 implementation has been ported from BoringSSL.
- OpenSSH has been updated. The change log can be viewed in the OpenSSH 10 announcement (DSA digital signature support has been removed, authentication operations have been separated into a dedicated sshd-auth process, and the hybrid key exchange algorithm ‘mlkem768x25519-sha256’ is enabled by default).
- The number of ports for the AMD64 architecture is 12593 (up from 12312), for aarch64 - 12446 (up from 12148), and for i386 - 10429 (down from 10534). Among the application versions in ports:
- Asterisk 16.30.1, 18.26.1, 20.13.0, and 22.3.0
- Audacity 3.7.3
- CMake 3.31.6
- Chromium 135.0.7049.52
- Emacs 30.1
- FFmpeg 6.1.2
- GCC 8.4.0 and 11.2.0
- GNOME 47
- Go 1.24.1
- JDK 8u442, 11.0.26, 17.0.14, and 21.0.6
- KDE Gears 24.12.3
- KDE Frameworks 6.12.0
- KDE Plasma 6.3.3
- Krita 5.2.9
- LLVM/Clang 13.0.0, 16.0.6, 18.1.8, 19.1.7
- LibreOffice 25.2.1.2
- Lua 5.1.5, 5.2.4, 5.3.6, 5.4.7
- MariaDB 11.4.5
- Mono 6.12.0.199
- Mozilla Firefox 137.0 and ESR 128.9.0
- Mozilla Thunderbird 128.9.0
- Mutt 2.2.14 and NeoMutt 20250113
- Node.js 22.14.0
- OpenLDAP 2.6.9
- PHP 8.2.28, 8.3.19, and 8.4.5
- Postfix 3.10.1
- PostgreSQL 17.4
- Python 2.7.18 and 3.12.9
- Qt 5.15.16 (+ patches from the KDE project) and 6.8.2
- Ruby 3.2.8, 3.3.7, 3.4.2
- Rust 1.86.0
- SQLite 3.49.1
- Shotcut 25.01.25
- Sudo 1.9.16p1
- Suricata 7.0.7
- Tcl/Tk 8.5.19 and 8.6.16
- Vim 9.1.1265 and Neovim 0.10.4
- Xfce 4.20.0
- Third-party components included in OpenBSD 7.7 have been updated:
- The Xenocara graphic stack based on X.Org 7.7 with xserver 21.1.16 + patches, freetype 2.13.3, fontconfig 2.15.0, Mesa 23.3.6, xterm 395, xkeyboard-config 2.20, fonttosfnt 1.2.4.
- LLVM/Clang 16.0.6 (+ patches)
- GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
- Perl 5.40.1 (+ patches)
- NSD 4.9.1
- Unbound 1.22.0
- Ncurses 6.4
- Binutils 2.17 (+ patches)
- Gdb 6.3 (+ patches)
- Awk 20250116
- Expat 2.7.1
- zlib 1.3.1 (+ patches)
Source: opennet.ru
