1Release notes for FreeBSD 14.0. 2 3This file describes new user-visible features, changes and updates relevant to 4users of binary FreeBSD releases. Each entry should describe the change in no 5more than several sentences and should reference manual pages where an 6interested user can find more information. Entries should wrap after 80 7columns. Each entry should begin with one or more commit IDs on one line, 8specified as a comma separated list and/or range, followed by a colon and a 9newline. Entries should be separated by a newline. 10 11Changes to this file should not be MFCed. 12 13c333758fca3e: 14 new MAC/do policy and mdo(1) utility which enables a user to 15 become another user without the requirement of setuid root. 16 17eeb04a736cb9: 18 date(1) now supports nanoseconds. For example: 19 `date -Ins` prints "2024-04-22T12:20:28,763742224+02:00" and 20 `date +%N` prints "415050400". 21 227b9a772f9f64: 23 usbconfig(8) now reads the descriptions of the usb vendor and products 24 from usb.ids when available, similarly to what pciconf(8) does. 25 26daf917daba9c: 27 One True Awk updated to 2nd Edition with new -csv support and UTF-8 28 support. See https://awk.dev for more details. 29 30b8e137d8d32d: 31 This commit added some statistics collection to the NFS-over-TLS 32 code in the NFS server so that sysadmins can moditor usage. 33 The statistics are available via the kern.rpc.tls.* sysctls. 34 3541582f28ddf7: 36 FreeBSD 15.0 will not include support for 32-bit platforms. 37 However, 64-bit systems will still be able to run older 32-bit 38 binaries. 39 40 Support for executing 32-bit binaries on 64-bit platforms via 41 COMPAT_FREEBSD32 will remain supported for at least the 42 stable/15 and stable/16 branches. 43 44 Support for compiling individual 32-bit applications via 45 `cc -m32` will also be supported for at least the stable/15 46 branch which includes suitable headers in /usr/include and 47 libraries in /usr/lib32. 48 49 Support for 32-bit platforms in ports for 15.0 and later 50 releases is also deprecated, and these future releases may not 51 include binary packages for 32-bit platforms or support for 52 building 32-bit applications from ports. 53 54 stable/14 and earlier branches will retain existing 32-bit 55 kernel and world support. Ports will retain existing support 56 for building ports and packages for 32-bit systems on stable/14 57 and earlier branches as long as those branches are supported 58 by the ports system. However, all 32-bit platforms are Tier-2 59 or Tier-3 and support for individual ports should be expected 60 to degrade as upstreams deprecate 32-bit platforms. 61 62 With the current support schedule, stable/14 will be EOLed 5 63 years after the release of 14.0. The EOL of stable/14 would 64 mark the end of support for 32-bit platforms including source 65 releases, pre-built packages, and support for building 66 applications from ports. Given an estimated release date of 67 October 2023 for 14.0, support for 32-bit platforms would end 68 in October 2028. 69 70 The project may choose to alter this approach when 15.0 is 71 released by extending some level of 32-bit support for one or 72 more platforms in 15.0 or later. Users should use the 73 stable/14 branch to migrate off of 32-bit platforms. 74 753cb2f5f369ec: 76 The lua-flavored loader(8) will now interpret .lua files that appear in 77 loader_conf_files as lua, and execute them in a sandbox. Existing 78 loader environment variables are available as globals in the sandbox, 79 and any global variable set, if not a table value, will be reflected in 80 the loader environment upon successful execution of the configuration 81 file. Environment variables with names that aren't valid lua names may 82 be accessed as indices of _ENV; e.g., _ENV['net.fibs']. 83 84bdc81eeda05d: 85 nda is now the default nvme device on all platforms. While nda creates 86 nvd links by default so fstab, etc continues to work, configuration 87 should be updated to the new nda devices. 88 89 To restore the old behavior, add hw.nvme.use_nvd=1 to loader.conf or 90 `options NVME_USE_NVD=1` to the kernel config. To disable the nvd 91 compatibility aliases, add kern.cam.nda.nvd_compat=0 to loader.conf. 92 93bbb2d2ce4220: 94 Change pw (hence bsdinstall) not to move /home to /usr/home. 95 Previously, when creating the path to home directories, pw 96 would move any path in the root directory under /usr, creating 97 a symlink in root. In particular, the default /home would become 98 /usr/home. Now /home is at the top level by default. /usr/home 99 can be used explicitly. 100 1013416e102c4e9: 102 Remove TI code from armv7 GENERIC kernel. 103 This code doesn't cope with newer DTS and hasn't in a long time so 104 support for TI armv7 platform (like BeagleBone and Pandaboard) is now 105 removed from GENERIC. 106 107d198b8774d2c: 108 Add a new "fwget" utility. 109 The goal of this utility is to inspect the system for peripherals 110 that needs firmware and install the appropriate packages for them. 111 For now only pci subsystem is supported and only firmwares for Intel 112 and AMD GPUs are known. 113 114896516e54a8c: 115 Add a new "syskrb5" mount option for Kerberized NFSv4.1/4.2 mounts. 116 Without this patch, a Kerberized NFSv4.1/4.2 mount must provide 117 a Kerberos credential for the client at mount time. 118 This patch uses a feature of NFSv4.1/4.2 called SP4_NONE, which 119 allows the state maintenance operations to be performed by any 120 authentication mechanism, so that these operations may be done via 121 AUTH_SYS instead of RPCSEC_GSS (KerberosV). As such, no Kerberos 122 credential is required at mount time. 123 See mount_nfs(8). 124 125330aa8acdec7,ff2f1f691cdb: 126 Adds support for the SP4_MACH_CRED case for the 127 NFSv4.1/4.2 ExchangeID operation since the Linux 128 NFSv4.1/4.2 client is now using this for Kerberized mounts. 129 This change should only affect Kerberized NFSv4.1/4.2 mounts. 130 The Linux Kerberized NFSv4.1/4.2 mounts currently work without 131 support for this because Linux will fall back to SP4_NONE, 132 but there is no guarantee this fallback will work forever. 133 1347344856e3a6d and many others: 135 Add support so that nfsd(8), nfsuserd(8), mountd(8), gssd(8) 136 and rpc.tlsservd(8) can be run in an appropriately configured 137 vnet prison. The vnet prison must be on its own file system, 138 have the "allow.nfsd" jail parameter set on it and enforce_statfs 139 cannot be set to "0". Use of UDP and pNFS server configurations 140 are not permitted. (ie. The nfsd command line options "-u", "-p" 141 and "-m" are not supported.) 142 See jail(8), nfsd(8) and mountd(8). 143 1442fb4f839f3fc,d89513ed2050,3413ee88c39d,f97a19ecb985,021562c5020d,431d2a81d421: 145 sendmail has been updated to the latest upstream version (8.17.1). 146 1474a30d7bb373c,d670a8f7c596,af01b4722577,4e240e55d818: 148 The growfs(7) script can now add a swap partition at the end of 149 the expansion area, and does so by default if there is no existing 150 swap. See growfs(7). 151 15286edb11e7491: 153 llvm-objdump is now always installed as objdump. 154 155616f32ea6da7: 156 mta_start_script along with othermta rc.d script has been retired. 157 158a67b925ff3e5: 159 The default mail transport agent is now dma(8) replacing sendmail. 160 16122893e584032: 162 L3 filtering on if_bridge will do surprising things which aren't 163 fail-safe, so net.link.bridge.pfil_member and 164 net.link.bridge.pfil_bridge now default to zero. 165 166f0bc4ed144fc: 167 A new DTrace provider, kinst, is introduced and documented in 168 dtrace_kinst(4). The provider allows kernel instructions to be traced, 169 similar to the FBT (function boundary tracing) provider except that all 170 instructions may be probed instead of logical entry and return 171 instructions. The provider is currently amd64-only. 172 1730aa2700123e2: 174 OPIE has been removed from the base system. If you still wish 175 to use it, install the security/opie port. Otherwise, make 176 sure to remove or comment out any mention of pam_opie and 177 pam_opieaccess from your PAM policies (etcupdate will normally 178 take care of this for the stock policies). 179 1800eea46fb1f83: 181 Removed telnetd. 182 183981ef32230b2,33721eb991d8: 184 These commits make the use of NFSv4.1/4.2 mounts with the "intr" 185 mount option fairly usable, although not 100% correct, so long as 186 the "nolockd" mount option is used as well. See the mount_nfs(8) 187 manual page for more information. 188 189b875d4f5ddcb,0685c73cfe88: 190 The NFSv4.1/4.2 client and server will now generate console messages 191 if sessions are broken, suggesting that users check to ensure 192 that the /etc/hostid strings are unique for all NFSv4.1/4.2 clients. 193 194240afd8c1fcc: 195 makefs(8) has ZFS support; it can create a ZFS pool, backed by a 196 single disk vdev, containing one or more datasets populated from 197 the staging directory. 198 19978ee8d1c4cda,f4f56ff43dbd: 200 The in-tree qat(4) driver has been replaced with Intel's QAT driver. 201 The new version provides additional interfaces to the chipset's 202 cryptographic and compression offload functionality. 203 204 This will have no visible change for most users; however, the new 205 driver does not support Atom C2000 chipsets. To preserve support for 206 those chipsets, the old driver has been renamed to qat_c2xxx and kept 207 in the tree. Users of qat(4) on C2000 hardware will thus need to 208 ensure that qat_c2xxx(4) is loaded instead of qat(4). 209 210da5b7e90e740,5a8fceb3bd9f,7b0a665d72c0,13ec1e3155c7,318d0db5fe8a,1ae2c59bcf21: 211 Boottrace is a new kernel-userspace interface for capturing trace 212 events during system boot and shutdown. Event annotations are 213 present in: 214 215 - The boot and shutdown paths in the kernel 216 - Some key system utilities (init(8), shutdown(8), reboot(8)) 217 - rc(8) scripts (via boottrace(8)) 218 219 In contrast to other existing boot-time tracing facilities like TSLOG, 220 Boottrace focuses on the ease of use and is aimed primarily at system 221 administrators. 222 223 It is available in the default GENERIC kernel and can be enabled by 224 toggling a single sysctl(8) variable. 225 226 See boottrace(4) for more details. 227 22805a1d0f5d7ac: 229 Kernel TLS offload now supports receive-side offload of TLS 1.3. 230 23119dc64451179: 232 if_stf now supports 6rd (RFC5969). 233 234c1d255d3ffdb, 3968b47cd974, bd452dcbede6: 235 Add WiFi 6 support to wpa. 236 237ba48d52ca6c8,4ac3d08a9693,2533eca1c2b9: 238 The default bell tone is now 800Hz. It may be set with kbdcontrol 239 again. There's devd integration for people wishing to use their sound 240 cards for the beep. 241 24292b3e07229ba: 243 net.inet.tcp.nolocaltimewait enabled by default. It prevents 244 creation of timewait entries for TCP connections that were 245 terminated locally. 246 247d410b585b6f0: 248 sh(1) is now the default shell for the root user. 249 250396851c20aeb: 251 libncursesw has been split into libtinfow and libncursesw, linker 252 scripts should make it transparent for consumers. pkg-config files 253 are also now installed to ease ports detecting the ncurses setup from 254 base. 255 256a422084abbda: 257 LLVM's MemorySanitizer can now be used in amd64 kernels. See the 258 kmsan(9) manual page for more information. 259 26038da497a4dfc: 261 LLVM's AddressSanitizer can now be used in amd64 kernels. See the 262 kasan(9) manual page for more information. 263 264f39dd6a97844,23f24377b1a9,628bd30ab5a4: 265 One True Awk has been updated to the latest from upstream 266 (20210727). All the FreeBSD patches, but one, have now been 267 either up streamed or discarded. Notable changes include: 268 o Locale is no longer used for ranges 269 o Various bugs fixed 270 o Better compatibility with gawk and mawk 271 272 The one FreeBSD change, likely to be removed in FreeBSD 14, is that 273 we still allow hex numbers, prefixed with 0x, to be parsed and 274 interpreted as hex numbers while all other awks (including one 275 true awk now) interpret them as 0 in line with awk's historic 276 behavior. 277 278 A second change, less likely to be noticed, is the historic wart 279 if -Ft meaning to use hard tab characters as the field separator 280 is deprecated and will likely be removed in FreeBSD 14. 281 282ee29e6f31111: 283 Commit ee29e6f31111 added a new sysctl called vfs.nfsd.srvmaxio 284 that can be used to increase the maximum I/O size for the NFS 285 server to any power of 2 up to 1Mbyte while the nfsd(8) is not running. 286 The FreeBSD NFS client can now be set to use a 1Mbyte I/O size 287 via the vfs.maxbcachebuf tunable and the Linux NFS client 288 can also do 1Mbyte I/O. 289 kern.ipc.maxsockbuf will need to be increased. A console 290 message will suggest a setting for it. 291 292d575e81fbcfa: 293 gconcat(8) has added support for appending devices to the device 294 not present at creation time. 295 29676681661be28: 297 Remove support for asymmetric cryptographic operations from 298 the kernel open cryptographic framework (OCF). 299 300a145cf3f73c7: 301 The NFSv4 client now uses the highest minor version of NFSv4 302 supported by the NFSv4 server by default instead of minor version 0, 303 for NFSv4 mounts. 304 The "minorversion" mount option may be used to override this default. 305