1Release notes for FreeBSD 13.0. 2 3This file describes new user-visible features, changes and updates relevant to 4users of binary FreeBSD releases. Each entry should describe the change in no 5more than several sentences and should reference manual pages where an 6interested user can find more information. Entries should wrap after 80 7columns. Each entry should begin with one or more commit IDs on one line, 8specified as a comma separated list and/or range, followed by a colon and a 9newline. Entries should be separated by a newline. 10 11Changes to this file should not be MFCed. 12 13r368559: 14 The hme(4) driver was removed. 15 16r367660: 17 Fixes the case where gssd will not startup because /usr is a separate 18 local file system that is not yet mounted. It does not fix the case 19 where /usr is a separately mounted remote file system (such as NFS). 20 This latter case can be fixed by adding mountcritremote to the 21 REQUIRED line. Unfortunately doing so implies that all Kerberized 22 NFS mounts in /etc/fstab will need the "late" mount option. 23 This was not done, since the requirement for "late" would introduce 24 a POLA violation. 25 26r367423: 27 This commit added a new startup scripts variable called 28 nfsv4_server_only which uses the -R option on mountd added by r367026. 29 When nfsv4_server_only is set to "YES" in /etc/rc.conf, the NFS server 30 only handles NFSv4 and does not register with rpcbind. As such, rpcbind 31 does not need to be running. Useful for sites which consider rpcbind a 32 security issue. 33 34r366267: 35 Kernel option ACPI_DMAR was renamed to IOMMU. amd64's IOMMU subsystem 36 was split out from amd64 DMAR support and is now generic, i.e., it can 37 be used by all architectures. 38 39r364896: 40 A series of commits ending with r364896 added NFS over TLS 41 to the kernel. This is believed to be compatible with 42 the Internet Draft titled "Towards Remote Procedure Call Encryption 43 By Default" (expected to soon become an RFC). 44 The mount_nfs(8) and exports(5) man pages describe the mount and 45 export option(s) related to NFS over TLS. 46 For NFS over TLS to work, the rpctlscd(8) { client } or rpctlssd(8) 47 { server } must be running on a kernel built with "options KERN_TLS" 48 on an architecture where PMAP_HAS_DMAP != 0. 49 50r364725: 51 Changes to one obscure devd event generated on resume need to 52 be documented. The old form will still be generated in 13, but not 53 in 14. 54 55r363679: 56 Applications using regex(3), e.g. sed/grep, will no longer accept 57 redundant escapes for most ordinary characters. 58 59r363253: 60 SCTP support has been removed from GENERIC kernel configurations. 61 The SCTP stack is now built as sctp.ko and can be dynamically loaded. 62 63r363233: 64 Merge sendmail 8.16.1: See contrib/sendmail/RELEASE_NOTES for details. 65 66r363180: 67 The safexcel(4) crypto offload driver has been added. 68 69r363084: 70 nc(1) now implements SCTP mode, enabled by specifying the --sctp option. 71 72r362681: 73 A new implementation of bc and dc has been imported. It offers 74 better standards compliance, performance, localization and comes 75 with extensive test cases that are optionally installed. 76 Use WITHOUT_GH_BC=yes to build and install the world with the 77 previous version instead of the new one, if required. 78 79r362158, r362163: 80 struct export_args has changed so that the "user" specified for 81 the -maproot and -mapall exports(5) options may be in more than 82 16 groups. 83 84r361884: 85 sed(1) has learned about hex escapes (e.g. \x27) and will now do the 86 right thing with them, removing the need for printf magic or obnoxious 87 escaping in many scenarios. 88 89r361238, r361798, r361799: 90 ZFS will now unconditionally reject read(2) of a directory with EISDIR. 91 Additionally, read(2) of a directory is now rejected with EISDIR by 92 default and may be re-enabled for non-ZFS filesystems that allow it with 93 the sysctl(8) MIB 'security.bsd.allow_read_dir'. 94 95 Aliases for grep to default to '-d skip' may be desired if commonly 96 non-recursively grepping a list that includes directories and the 97 possibility of EISDIR errors in stderr is not tolerable. Example 98 aliases, commented out, have been installed in /root/.cshrc and 99 /root/.shrc. 100 101r361066: 102 Add exec.prepare and exec.release hooks for jail(8) and jail.conf(5). 103 exec.prepare runs before mounts, so can be used to populate new jails. 104 exec.release runs after unmounts, so can be used to remove ephemeral 105 jails. 106 107r360920,r360923,r360924,r360927,r360928,r360931,r360933,r360936: 108 Remove support for ARC4, Blowfish, Cast, DES, Triple DES, MD5, 109 MD5-KPDK, MD5-HMAC, SHA1-KPDK, and Skipjack algorithms from 110 the kernel open cryptographic framework (OCF). 111 112r360562: 113 Remove support for ARC4, Blowfish, Cast, DES, Triple DES, 114 MD5-HMAC, and Skipjack algorithms from /dev/crypto. 115 116r360557: 117 Remove support for DES, Triple DES, Blowfish, Cast, and 118 Camellia ciphers from IPsec(4). Remove support for MD5-HMAC, 119 Keyed MD5, Keyed SHA1, and RIPEMD160-HMAC from IPsec(4). 120 121r359945: 122 Remove support for Triple DES, Blowfish, and MD5 HMAC from 123 geli(4). 124 125r359786-r359787: 126 Remove support for DES, Triple DES, and RC4 from in-kernel GSS 127 authentication. 128 129r357627: 130 remove elf2aout. 131 132r357560-r357565: 133 init(8), service(8), and cron(8) will now adopt user/class environment 134 variables (excluding PATH, by default, which will be overwritten) by 135 default. Notably, environment variables for all cron jobs and rc 136 services can now be set via login.conf(5). 137 138r357455: 139 sparc64 has been removed from FreeBSD. 140 141r355677: 142 Adds support for NFSv4.2 (RFC-7862) and Extended Attributes 143 (RFC-8276) to the NFS client and server. 144 NFSv4.2 is comprised of several optional features that can be supported 145 in addition to NFSv4.1. This patch adds the following optional features: 146 - posix_fadvise(POSIX_FADV_WILLNEED/POSIX_FADV_DONTNEED) 147 - posix_fallocate() 148 - intra server file range copying via the copy_file_range(2) syscall 149 --> Avoiding data tranfer over the wire to/from the NFS client. 150 - lseek(SEEK_DATA/SEEK_HOLE) 151 - Extended attribute syscalls for "user" namespace attributes as defined 152 by RFC-8276. 153 154 For the client, NFSv4.2 is only used if the mount command line option 155 minorversion=2 is specified. 156 For the server, two new sysctls called vfs.nfsd.server_min_minorversion4 157 and vfs.nfsd.server_max_minorversion4 have been added that allow 158 sysadmins to limit the minor versions of NFSv4 supported by the nfsd 159 server. 160 Setting vfs.nfsd.server_max_minorversion4 to 0 or 1 will disable NFSv4.2 161 on the server. 162 163r356263: 164 armv5 support has been removed from FreeBSD. 165 166r354517: 167 iwm(4) now supports most Intel 9260, 9460 and 9560 Wi-Fi devices. 168 169r354269: 170 sqlite3 is updated to sqlite3-3.30.1. 171 172r352668: 173 cron(8) now supports the -n (suppress mail on succesful run) and -q 174 (suppress logging of command execution) options in the crontab format. 175 See the crontab(5) manpage for details. 176 177r352304: 178 ntpd is no longer by default locked in memory. rlimit memlock 32 179 or rlimit memlock 0 can be used to restore this behaviour. 180 181r351863: 182 rc.subr(8) now honors ${name}_env in all rc(8) scripts. Previously, 183 environment variables set by a user via ${name}_env were ignored 184 if the service defined a custom *_cmd variable to control the behavior 185 of the run_rc_command function, e.g., start_cmd, instead of relying on 186 the variables like command and command_args, 187 188r351770,r352920,r352922,r352923: 189 dd(1) now supports conv=fsync, conv=fdatasync, oflag=fsync, oflag=sync, 190 and iflag=fullblock flags, compatible with illumos and GNU. 191 192r351522: 193 Add kernel-side support for in-kernel Transport Layer Security 194 (KTLS). KTLS permits using sendfile(2) over sockets using 195 TLS. 196 197r351397: 198 WPA is updated from 2.8 to 2.9. 199 200r351361: 201 Add probes for lockmgr(9) to the lockstat DTrace provider, add 202 corresponding lockstat(1) events, and document the new probes in 203 dtrace_lockstat.4. 204 205r351356: 206 Intel RST is a new 'feature' that remaps NVMe devices from 207 their normal location to part of the AHCI bar space. This 208 will eliminate the need to set the BIOS SATA setting from RST 209 to AHCI causing the nvme drive to be erased before FreeBSD 210 will see the nvme drive. FreeBSD will now be able to see the 211 nvme drive now in the default config. 212 213r351201, r351372: 214 Add a vop_stdioctl() call, so that file systems that do not support 215 holes will have a trivial implementation of lseek(SEEK_DATA/SEEK_HOLE). 216 The algorithm appears to be compatible with the POSIX draft and 217 the implementation in Linux for the case of a file system that 218 does not support holes. Prior to this patch, lseek(2) would reply 219 -1 with errno set to ENOTTY for SEEK_DATA/SEEK_HOLE on files in 220 file systems that do not support holes. 221 r351372 maps ENOTTY to EINVAL for lseek(SEEK_DATA/SEEK_HOLE) for 222 any other cases, such as a ENOTTY return from vn_bmap_seekhole(). 223 224r350665: 225 The fuse driver has been renamed to fusefs(5) and been substantially 226 rewritten. The new driver includes many bug fixes and performance 227 enhancements, as well as the following user-visible features: 228 * Optional kernel-side permissions checks (-o default_permissions) 229 * mknod(2), socket(2), and pipe(2) support 230 * server side locking with fcntl(2) 231 * FUSE operations are now interruptible when mounted with -o intr 232 * server side handling of UTIME_NOW during utimensat(2) 233 * mount options may be updated with "mount -u" 234 * fusefs file system may now be exported over NFS 235 * RLIMIT_FSIZE support 236 * support for fuse file systems using protocols as old as 7.4 237 238 FUSE file system developers should also take note of the following new 239 features: 240 * The protocol level has been raised from 7.8 to 7.23 241 * kqueue support on /dev/fuse 242 * server-initiated cache invalidation via FUSE_NOTIFY_REPLY 243 244r350471: 245 gnop(8) can now configure a delay to be applied to read and write 246 request delays. See the -d, -q and -x parameters. 247 248r350315, r350316: 249 Adds a Linux compatible copy_file_range(2) syscall. 250 251r350307: 252 libcap_random(3) has been removed. Applications can use native 253 APIs to get random data in capability mode. 254 255r349529,r349530: 256 Add support for using unmapped mbufs with sendfile(2). 257 258r349352: 259 nand(4) and related components have been removed. 260 261r349349: 262 The UEFI loader now supports HTTP boot. 263 264r349335: 265 bhyve(8) now implements a High Definition Audio (HDA) driver, allowing 266 guests to play to and record audio data from the host. 267 268r349286: 269 swapon(8) can now erase a swap device immediately before enabling it, 270 similar to newfs(8)'s -E option. This behaviour can be specified by 271 adding -E to swapon(8)'s command-line parameters, or by adding the 272 "trimonce" option to a swap device's /etc/fstab entry. 273 274r347908-r347923: 275 The following network drivers have been removed: bm(4), cs(4), de(4), 276 ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), 277 vx(4), wb(4), xe(4). 278 279r347532: 280 Wired page accounting has been split into kernel wirings and user 281 wirings (e.g., by mlock(2)). Kernel wirings no long count towards 282 the global limit, which is renamed to vm.max_user_wired. bhyve -S 283 allocates user-wired memory and is now subject to that limit. 284 285$FreeBSD$ 286