1Release notes for FreeBSD 13.0. 2 3This file describes new user-visible features, changes and updates relevant to 4users of binary FreeBSD releases. Each entry should describe the change in no 5more than several sentences and should reference manual pages where an 6interested user can find more information. Entries should wrap after 80 7columns. Each entry should begin with one or more commit IDs on one line, 8specified as a comma separated list and/or range, followed by a colon and a 9newline. Entries should be separated by a newline. 10 11Changes to this file should not be MFCed. 12 1333ff39796ffe,8719e8a951b7: 14 A new rc(8) service script zfskeys allows for automatic decryption 15 of ZFS datasets encrypted with ZFS native encryption during boot. 16 See the rc.conf(5) manual page for more information. 17 18b7a2cf0d9102 - eae02d959363: 19 Upgrade bhyve's emulation to version 1.4 of the NVMe specification 20 210a6760a1de32, 3f3676a71266, 580c04df4db6: 22 Add WiFi 6 support. 23 24various: 25 Add support for the HiFive Unmatched RISC-V board. 26 279fb6e613373c: 28 Add a sysctl called vfs.nfsd.srvmaxio that can be used to 29 increase the NFS server's maximum I/O size from 128Kbytes 30 to any power of 2 up to 1Mbyte. It can only be set when 31 the nfsd threads are not running and will normally require 32 an increase in kern.ipc.maxsockbuf to at least the value 33 recommended by the console log message generated when 34 setting vfs.nfsd.srvmaxio is first attempted. 35 369ec7dbf46b0a: 37 Add a new NFSv4.1/4.2 mount option "nconnect" that can 38 be used to specify the number of TCP connections that 39 will be used for the mount, up to a maximum of 16. 40 The first (default) TCP connection will be used for 41 all RPCs that consist of small RPC messages. 42 The RPCs that can consist of large RPC messages 43 (Read/Readdir/ReaddirPlus/Write) will be sent on the 44 additional TCP connections in a round robin fashion. 45 If either the NFS client or NFS server have multiple 46 network interfaces aggregated together or a network 47 interface that uses multiple queues, this can increase 48 NFS performance for the mount. 49 50various: 51 One True Awk has been updated to the latest from upstream 52 (20210215). All the FreeBSD patches, but one, have now been 53 either up streamed or discarded. Notable changes include: 54 o Locale is no longer used for ranges 55 o Various bugs fixed 56 o Better compatibility with gawk and mawk 57 58 The one FreeBSD change, likely to be removed in FreeBSD 14, is that 59 we still allow hex numbers, prefixed with 0x, to be parsed and 60 interpreted as hex numbers while all other awks (including one 61 true awk now) interpret them as 0 in line with awk's historic 62 behavior. 63 648a04edfdcbd2: 65 Change the default minor version used for an NFSv4 mount 66 to the highest minor version supported by the NFSv4 server. 67 This default can be overridden by using the "minorversion" 68 mount option. 69 702c76eebca71b, 59f6f5e23c1a: 71 Add two daemons rpc.tlsclntd(8) and rpc.tlsservd(8) that provide 72 support for NFS-over-TLS as described in the Internet Draft titled 73 "Towards Remote Procedure Call Encryption By Default". 74 These daemons are only built when WITH_OPENSSL_KTLS is specified 75 and are only tested on amd64 at this time. 76 They use KTLS to encrypt/decrypt all NFS RPC message traffic, plus 77 optional verification of machine identity via X.509 certificates. 78 79f76393a6305b6: 80 Add AES-GCM support to armv8crypto(4) providing accelerated 81 support for KTLS, IPsec, and other crypto API consumers. 82 83074a91f746bd: 84 The aesni(4) and armv8crypto(4) devices are now included in 85 GENERIC on amd64, i386, and arm64. 86 872e1c94aa1fd5: 88 Add support for enforcing W^X mapping policy for user 89 processes. The policy is not enforced by default but can be 90 enabled by setting the kern.elf32.allow_wx and 91 kern.elf64.allow_wx sysctls to 0. Individual binaries can be 92 exempted from the policy by elfctl(1) via the wxneeded 93 feature. 94 954979620ece98: 96 Add AES-XTS support to armv8crypto(4) providing accelerated 97 software support for the default GELI cipher on arm64 systems. 98 99022ca2fc7fe0: 100 Add aio_writev(2) and aio_readv(2), vectored analogues of aio_write(2) 101 and aio_read(2). 102 10392bbfe1f0d1f: 104 The fusefs(5) protocol has been updated to 7.28. Support for 105 FUSE_COPY_FILE_RANGE and FUSE_LSEEK is added. 106 107r368667: 108 GDB 6.1.1 was removed. Users of crashinfo(8) should install the 109 gdb package or devel/gdb port. 110 111r368559: 112 The hme(4) driver was removed. 113 114r367660: 115 Fixes the case where gssd will not startup because /usr is a separate 116 local file system that is not yet mounted. It does not fix the case 117 where /usr is a separately mounted remote file system (such as NFS). 118 This latter case can be fixed by adding mountcritremote to the 119 REQUIRED line. Unfortunately doing so implies that all Kerberized 120 NFS mounts in /etc/fstab will need the "late" mount option. 121 This was not done, since the requirement for "late" would introduce 122 a POLA violation. 123 124r367423: 125 This commit added a new startup scripts variable called 126 nfsv4_server_only which uses the -R option on mountd added by r367026. 127 When nfsv4_server_only is set to "YES" in /etc/rc.conf, the NFS server 128 only handles NFSv4 and does not register with rpcbind. As such, rpcbind 129 does not need to be running. Useful for sites which consider rpcbind a 130 security issue. 131 132r366267: 133 Kernel option ACPI_DMAR was renamed to IOMMU. amd64's IOMMU subsystem 134 was split out from amd64 DMAR support and is now generic, i.e., it can 135 be used by all architectures. 136 137r364896: 138 A series of commits ending with r364896 added NFS over TLS 139 to the kernel. This is believed to be compatible with 140 the Internet Draft titled "Towards Remote Procedure Call Encryption 141 By Default" (expected to soon become an RFC). 142 The mount_nfs(8) and exports(5) man pages describe the mount and 143 export option(s) related to NFS over TLS. 144 For NFS over TLS to work, the rpctlscd(8) { client } or rpctlssd(8) 145 { server } must be running on a kernel built with "options KERN_TLS" 146 on an architecture where PMAP_HAS_DMAP != 0. 147 148r364725: 149 Changes to one obscure devd event generated on resume need to 150 be documented. The old form will still be generated in 13, but not 151 in 14. 152 153r363679: 154 Applications using regex(3), e.g. sed/grep, will no longer accept 155 redundant escapes for most ordinary characters. 156 157r363253: 158 SCTP support has been removed from GENERIC kernel configurations. 159 The SCTP stack is now built as sctp.ko and can be dynamically loaded. 160 161r363233: 162 Merge sendmail 8.16.1: See contrib/sendmail/RELEASE_NOTES for details. 163 164r363180: 165 The safexcel(4) crypto offload driver has been added. 166 167r363084: 168 nc(1) now implements SCTP mode, enabled by specifying the --sctp option. 169 170r362681: 171 A new implementation of bc and dc has been imported. It offers 172 better standards compliance, performance, localization and comes 173 with extensive test cases that are optionally installed. 174 Use WITHOUT_GH_BC=yes to build and install the world with the 175 previous version instead of the new one, if required. 176 177r362158, r362163: 178 struct export_args has changed so that the "user" specified for 179 the -maproot and -mapall exports(5) options may be in more than 180 16 groups. 181 182r361884: 183 sed(1) has learned about hex escapes (e.g. \x27) and will now do the 184 right thing with them, removing the need for printf magic or obnoxious 185 escaping in many scenarios. 186 187r361238, r361798, r361799: 188 ZFS will now unconditionally reject read(2) of a directory with EISDIR. 189 Additionally, read(2) of a directory is now rejected with EISDIR by 190 default and may be re-enabled for non-ZFS filesystems that allow it with 191 the sysctl(8) MIB 'security.bsd.allow_read_dir'. 192 193 Aliases for grep to default to '-d skip' may be desired if commonly 194 non-recursively grepping a list that includes directories and the 195 possibility of EISDIR errors in stderr is not tolerable. Example 196 aliases, commented out, have been installed in /root/.cshrc and 197 /root/.shrc. 198 199r361066: 200 Add exec.prepare and exec.release hooks for jail(8) and jail.conf(5). 201 exec.prepare runs before mounts, so can be used to populate new jails. 202 exec.release runs after unmounts, so can be used to remove ephemeral 203 jails. 204 205r360920,r360923,r360924,r360927,r360928,r360931,r360933,r360936: 206 Remove support for ARC4, Blowfish, Cast, DES, Triple DES, MD5, 207 MD5-KPDK, MD5-HMAC, SHA1-KPDK, and Skipjack algorithms from 208 the kernel open cryptographic framework (OCF). 209 210r360562: 211 Remove support for ARC4, Blowfish, Cast, DES, Triple DES, 212 MD5-HMAC, and Skipjack algorithms from /dev/crypto. 213 214r360557: 215 Remove support for DES, Triple DES, Blowfish, Cast, and 216 Camellia ciphers from IPsec(4). Remove support for MD5-HMAC, 217 Keyed MD5, Keyed SHA1, and RIPEMD160-HMAC from IPsec(4). 218 219r359945: 220 Remove support for Triple DES, Blowfish, and MD5 HMAC from 221 geli(4). 222 223r359786-r359787: 224 Remove support for DES, Triple DES, and RC4 from in-kernel GSS 225 authentication. 226 227r357627: 228 remove elf2aout. 229 230r357560-r357565: 231 init(8), service(8), and cron(8) will now adopt user/class environment 232 variables (excluding PATH, by default, which will be overwritten) by 233 default. Notably, environment variables for all cron jobs and rc 234 services can now be set via login.conf(5). 235 236r357455: 237 sparc64 has been removed from FreeBSD. 238 239r355677: 240 Adds support for NFSv4.2 (RFC-7862) and Extended Attributes 241 (RFC-8276) to the NFS client and server. 242 NFSv4.2 is comprised of several optional features that can be supported 243 in addition to NFSv4.1. This patch adds the following optional features: 244 - posix_fadvise(POSIX_FADV_WILLNEED/POSIX_FADV_DONTNEED) 245 - posix_fallocate() 246 - intra server file range copying via the copy_file_range(2) syscall 247 --> Avoiding data tranfer over the wire to/from the NFS client. 248 - lseek(SEEK_DATA/SEEK_HOLE) 249 - Extended attribute syscalls for "user" namespace attributes as defined 250 by RFC-8276. 251 252 For the client, NFSv4.2 is only used if the mount command line option 253 minorversion=2 is specified. 254 For the server, two new sysctls called vfs.nfsd.server_min_minorversion4 255 and vfs.nfsd.server_max_minorversion4 have been added that allow 256 sysadmins to limit the minor versions of NFSv4 supported by the nfsd 257 server. 258 Setting vfs.nfsd.server_max_minorversion4 to 0 or 1 will disable NFSv4.2 259 on the server. 260 261r356263: 262 armv5 support has been removed from FreeBSD. 263 264r354517: 265 iwm(4) now supports most Intel 9260, 9460 and 9560 Wi-Fi devices. 266 267r354269: 268 sqlite3 is updated to sqlite3-3.30.1. 269 270r352668: 271 cron(8) now supports the -n (suppress mail on succesful run) and -q 272 (suppress logging of command execution) options in the crontab format. 273 See the crontab(5) manpage for details. 274 275r352304: 276 ntpd is no longer by default locked in memory. rlimit memlock 32 277 or rlimit memlock 0 can be used to restore this behaviour. 278 279r351863: 280 rc.subr(8) now honors ${name}_env in all rc(8) scripts. Previously, 281 environment variables set by a user via ${name}_env were ignored 282 if the service defined a custom *_cmd variable to control the behavior 283 of the run_rc_command function, e.g., start_cmd, instead of relying on 284 the variables like command and command_args, 285 286r351770,r352920,r352922,r352923: 287 dd(1) now supports conv=fsync, conv=fdatasync, oflag=fsync, oflag=sync, 288 and iflag=fullblock flags, compatible with illumos and GNU. 289 290r351522: 291 Add kernel-side support for in-kernel Transport Layer Security 292 (KTLS). KTLS permits using sendfile(2) over sockets using 293 TLS. 294 295r351397: 296 WPA is updated from 2.8 to 2.9. 297 298r351361: 299 Add probes for lockmgr(9) to the lockstat DTrace provider, add 300 corresponding lockstat(1) events, and document the new probes in 301 dtrace_lockstat.4. 302 303r351356: 304 Intel RST is a new 'feature' that remaps NVMe devices from 305 their normal location to part of the AHCI bar space. This 306 will eliminate the need to set the BIOS SATA setting from RST 307 to AHCI causing the nvme drive to be erased before FreeBSD 308 will see the nvme drive. FreeBSD will now be able to see the 309 nvme drive now in the default config. 310 311r351201, r351372: 312 Add a vop_stdioctl() call, so that file systems that do not support 313 holes will have a trivial implementation of lseek(SEEK_DATA/SEEK_HOLE). 314 The algorithm appears to be compatible with the POSIX draft and 315 the implementation in Linux for the case of a file system that 316 does not support holes. Prior to this patch, lseek(2) would reply 317 -1 with errno set to ENOTTY for SEEK_DATA/SEEK_HOLE on files in 318 file systems that do not support holes. 319 r351372 maps ENOTTY to EINVAL for lseek(SEEK_DATA/SEEK_HOLE) for 320 any other cases, such as a ENOTTY return from vn_bmap_seekhole(). 321 322r350665: 323 The fuse driver has been renamed to fusefs(5) and been substantially 324 rewritten. The new driver includes many bug fixes and performance 325 enhancements, as well as the following user-visible features: 326 * Optional kernel-side permissions checks (-o default_permissions) 327 * mknod(2), socket(2), and pipe(2) support 328 * server side locking with fcntl(2) 329 * FUSE operations are now interruptible when mounted with -o intr 330 * server side handling of UTIME_NOW during utimensat(2) 331 * mount options may be updated with "mount -u" 332 * fusefs file system may now be exported over NFS 333 * RLIMIT_FSIZE support 334 * support for fuse file systems using protocols as old as 7.4 335 336 FUSE file system developers should also take note of the following new 337 features: 338 * The protocol level has been raised from 7.8 to 7.23 339 * kqueue support on /dev/fuse 340 * server-initiated cache invalidation via FUSE_NOTIFY_REPLY 341 342r350471: 343 gnop(8) can now configure a delay to be applied to read and write 344 request delays. See the -d, -q and -x parameters. 345 346r350315, r350316: 347 Adds a Linux compatible copy_file_range(2) syscall. 348 349r350307: 350 libcap_random(3) has been removed. Applications can use native 351 APIs to get random data in capability mode. 352 353r349529,r349530: 354 Add support for using unmapped mbufs with sendfile(2). 355 356r349352: 357 nand(4) and related components have been removed. 358 359r349349: 360 The UEFI loader now supports HTTP boot. 361 362r349335: 363 bhyve(8) now implements a High Definition Audio (HDA) driver, allowing 364 guests to play to and record audio data from the host. 365 366r349286: 367 swapon(8) can now erase a swap device immediately before enabling it, 368 similar to newfs(8)'s -E option. This behaviour can be specified by 369 adding -E to swapon(8)'s command-line parameters, or by adding the 370 "trimonce" option to a swap device's /etc/fstab entry. 371 372r347908-r347923: 373 The following network drivers have been removed: bm(4), cs(4), de(4), 374 ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), 375 vx(4), wb(4), xe(4). 376 377r347532: 378 Wired page accounting has been split into kernel wirings and user 379 wirings (e.g., by mlock(2)). Kernel wirings no long count towards 380 the global limit, which is renamed to vm.max_user_wired. bhyve -S 381 allocates user-wired memory and is now subject to that limit. 382 383$FreeBSD$ 384