By ByteBot
OpenBSD 8.0 shipped October 20. The 61st release lands with three features that make headlines — 64-vCPU virtual machines, Intel Arc Alchemist graphics support, ARM64 hibernation — and one that deserves more attention than it’s getting: LibreSSL 4.4 quietly makes hybrid post-quantum X25519MLKEM768 the default TLS 1.3 key exchange in libtls. Most coverage buried that. Here’s the full picture.
Virtualization Finally Gets Serious
OpenBSD’s built-in hypervisor, VMM/VMD, now supports up to 64 virtual CPUs per guest. Until 8.0, the practical ceiling sat around 8 vCPUs, which ruled out multi-threaded workloads: parallel builds, multi-core databases, CPU-heavy CI jobs. That ceiling is gone.
The implementation adds x2APIC mode, local APIC initialization, and interprocessor interrupt (IPI) support — the machinery required to make multiple vCPUs actually coordinate. MSI/MSI-X interrupt support for virtio devices arrives too, which reduces I/O overhead for network and disk in guests. QCOW2 image handling also improved.
To be clear about where OpenBSD VMM stands: this isn’t a KVM replacement. FreeBSD bhyve has had robust multi-vCPU support for a decade. Linux KVM dominates production. But for operators who want a security-hardened hypervisor without bolting on additional software, VMM just became viable for serious workloads.
Post-Quantum Is Now the Default — Pay Attention
LibreSSL 4.4, which ships with OpenBSD 8.0, makes X25519MLKEM768 the preferred TLS 1.3 key exchange group in libtls. That’s a hybrid post-quantum algorithm: classical X25519 plus ML-KEM-768 (NIST’s finalized post-quantum standard). Opt-out, not opt-in.
OpenSSH 10.6 goes further, adding experimental support for composite ML-DSA44/Ed25519 signatures — a post-quantum signature scheme layered over the classical Ed25519. The same release disables the LZ77 dictionary coder after a potential side-channel leak was identified.
This is characteristic OpenBSD behavior. They made curve25519 the default in OpenSSH in 2014, years before mainstream adoption. They’re doing the same with post-quantum now. NIST finalized ML-KEM and ML-DSA in 2024; OpenBSD is operationalizing them while most TLS stacks still treat post-quantum as experimental. For security-sensitive deployments, running a post-quantum-default TLS stack matters — “harvest now, decrypt later” attacks are a real threat model.
Hardware: Arc GPUs, 512 GB Address Space, ARM64 Hibernation
The inteldrm, amdgpu, and radeondrm DRM drivers update to Linux 6.18.53 as the upstream base. The practical result: Intel Arc A-Series (Alchemist — A770, A750, A380) now works on OpenBSD. The amd64 kernel virtual address space also expands from 4 GB to 512 GB, which is what enables mapping more than 4 GB of video memory. Arc GPUs with 8–16 GB VRAM previously ran into this limit. It also fixes GPU timeout issues on Intel Alder Lake systems.
ARM64 gains hibernation. The absence of hibernate on ARM64 has been a practical blocker for using OpenBSD as a daily driver on ARM laptops. Qualcomm Snapdragon suspend/resume reliability improves in the same release. Samsung Galaxy Book4 Edge and HONOR MagicBook multitouch support lands. The platform is maturing toward actual laptop use.
RISC-V64 adds kernel support for the V vector extension (RISC-V’s SIMD equivalent), the Advanced Interrupt Architecture (AIA) via new imsic(4) and aplic(4) drivers, and the Sstc timer extension. RISC-V support is tracking hardware maturity closely.
Other Notables
A new rtrd(8) daemon ships as an RPKI-to-Router Protocol cache server. BGP operators previously needed external software to centralize RPKI validation data; rtrd(8) brings that into the OpenBSD base. The httpd(8) web server gets RFC 9112 compliance (rejecting CL.TE framing attacks) and upgrades the default TLS cipher profile from compat to secure. The Loongson (MIPS-based) architecture is retired — incompatible with Clang 22, and the OpenBSD team made the pragmatic call.
GEFS, the lightweight copy-on-write filesystem under development, is not in 8.0. It remains a prototype. OpenBSD is not rushing it, which is the right call.
Getting OpenBSD 8.0
The release is available from the official OpenBSD 8.0 page. Existing installs upgrade via sysupgrade(8). The LWN discussion thread and Heise’s technical breakdown are worth reading for community perspective. For OpenSSH 10.6 specifics, Linuxiac has the detail.
