ProHoster > Blog > Internet News > Release of FreeBSD 14.0

Release of FreeBSD 14.0

After two and a half years since the release of branch 13.0, FreeBSD 14.0 has been released. Installation images are prepared for the amd64, i386, powerpc, powerpc64, powerpc64le, powerpcspe, armv7, aarch64, and riscv64 architectures. Additionally, builds for virtualization systems (QCOW2, VHD, VMDK, raw) and cloud environments like Amazon EC2, Google Compute Engine, and Vagrant have been prepared. The FreeBSD 14 branch will be the last to support 32-bit platforms. FreeBSD 15 will only support 64-bit systems, but it will retain the ability to build 32-bit programs and the use of the COMPAT_FREEBSD32 mode to run 32-bit executables in a 64-bit environment.

Key Changes:

  • The default command interpreter for the root user is set to /bin/sh.
  • For NVME devices, the nda driver is enabled by default on all platforms. To revert to the old nvd driver, the setting 'hw.nvme.use_nvd=1' can be added to loader.conf.
  • A new utility 'fwget' has been added, which identifies hardware needing firmware and installs the corresponding firmware packages. Currently, only PCI devices and firmware for Intel and AMD GPUs are supported.
  • A new utility base64 has been added for encoding and decoding data in base64 format.
  • The tcpsso utility has been introduced, allowing the configuration of socket options for existing TCP connections (for example, one can change the congestion control module or the TCP stack).
  • The dma (DragonFly Mail Agent) is now used as the default mail delivery agent instead of sendmail. Sendmail is still included in the base installation and has been updated to version 8.17.1.
  • KTLS, the implementation of the TLS protocol working at the kernel level of FreeBSD, has added support for hardware acceleration of TLS 1.3 on the receiving side. This acceleration is achieved by offloading certain operations related to processing encrypted packets to the network card.
  • The '.include' directive has been added to the jail.conf configuration file, allowing additional files to be included during configuration load, with path masks permitted. The sysctl parameter security.bsd.see_jail_proc has been expanded, now allowing unauthorized users in a separate jail environment to be prohibited from forcibly terminating, changing priority, and debugging processes.
  • The pw and bsdinstall programs now default to creating users in the "/home" directory instead of "/usr/home". The symbolic link for "/home" pointing to "/usr/home" is no longer created.
  • The PROFILE build option is disabled by default — profiled versions of system libraries are no longer provided; instead, hardware profiling (hwpmc) should be used.
  • Executable file building for 64-bit architectures in PIE (Position Independent Executable) mode has been enabled.
  • The Bhyve hypervisor has added the ability to pass access to TPM (Trusted Platform Module) and GPU (in virtual environments for AMD and Intel chips).
  • The ZFS file system implementation has been updated to OpenZFS 2.2. The makefs utility has added support for the ZFS file system. It is now possible to create a ZFS pool associated with a single virtual disk vdev.
  • The number of supported CPU cores (MAXCPU parameter) in amd64 and arm64 based systems has been increased from 256 to 1024.
  • In UFS, for configurations with soft updates enabled, background file system checks can now be performed using UFS snapshots. Additional hash checks have been added to superblocks, cylinder group maps, and inodes to detect corruption.
  • A new tarfs file system has been added, which can be used with tar archives compressed with zstd.
  • The boottrace tool has been added to track events that occur during the system boot and shutdown phases.
  • The FIRECRACKER kernel option has been added to enable FreeBSD to run in the Firecracker virtualization system, designed for starting virtual machines with minimal overhead. The boot time of FreeBSD 14 under Firecracker has been reduced to 25 milliseconds, enabling the launch of FreeBSD environments on demand for serverless computing infrastructure.
  • In the Lua-based bootloader, support for executing lua files located in the loader_conf_files directory has been implemented in a special sandbox environment.
  • Support for NFS has been expanded. A new mount option "syskrb5" has been added for Kerberos support in NFSv 4.1/4.2, and support for the ExchangeID operation has been implemented. The ability to run nfsd, nfsuserd, mountd, gssd, and rpc.tlsservd in an isolated vnet network environment has been realized.
  • The growfs script now supports placing the swap partition at the end of the expandable disk area.
  • A new DTrace provider kinst (dtrace_kinst) has been added, allowing tracing of kernel structures.
  • The kernel's cryptosystem now includes support for the XChaCha20-Poly1035 AEAD encryption algorithm, as well as an API for using the elliptic curve curve25519 (for WireGuard).
  • Boot time has been reduced. A sysctl parameter kern.reboot_wait_time has been added, which allows changing the delay before the actual reboot after all diagnostic messages are displayed on the console. By default, the delay has been removed.
  • A timerfd subsystem has been added to the kernel, simplifying program porting from Linux.
  • The sysctl machdep.mitigations.zenbleed.enable has been added to block the Zenbleed vulnerability in AMD Zen2 processors.
  • Support for Wi-Fi 6 has been added to wpa_supplicant and hostapd. The iwlwifi driver now works with Intel chips supporting Wi-Fi 6E AX411/AX211/AX210.
  • Support for AddressSanitizer and MemorySanitizer tools from the LLVM project has been provided for the kernel on amd64 systems.
  • The use of the status method has been allowed in rc.d scripts even if the program name (procname) and PID file are not defined in the script.
  • The data transfer rate through the serial port in the kernel, bootloaders, and user space has been increased from 9600 to 115200 bps by default. The beep tone is now set to 800Hz by default. Integration with devd has been implemented for outputting beeps through the sound card. The beep in the vt console is disabled by default (to enable, execute the commands 'sysctl kern.vt.enable_bell=1' and 'kbdcontrol -b normal').
  • Support for the NXP DPAA2 (Data Path Acceleration Architecture Gen2) network operations hardware acceleration architecture has been improved.
  • The igc driver for Intel I225 Ethernet controllers has been added, supporting speeds of 2.5 Gbps.
  • By default, the configuration net.inet.tcp.nolocaltimewait is enabled, disabling the creation of timewait records for TCP connections terminated on the local system side.
  • Support for the Netlink communication protocol (RFC 3549) has been expanded and is enabled by default, which is used in Linux to facilitate interaction between the kernel and user-space processes. Some networking utilities have been transitioned to use Netlink.
  • The pf packet filter ensures compatibility with the syntax and behavior of packet normalization (scrubbing) operations from the pf version of OpenBSD. The pfsync implementation now supports IPv6 transport. The pfsync packet format has been extended to support queues, packet normalization, and route-to rules.
  • The network interface if_stf (IPv6 over IPv4) has been added. support for IPv6 Rapid Deployment (RFC 5969). The IPv6 nodeinfo mode (RFC 4620) is disabled by default.
  • The sysctl parameter net.inet.tcp.nolocaltimewait is enabled by default, which prevents the creation of timewait state records for locally terminated TCP connections.
  • By default, the CUBIC congestion control mechanism is used for TCP instead of NewReno, which has allowed for the increased usage of available bandwidth.
  • In IPv4, the sending of broadcast packets to the zero subnet address is disabled unless that address is explicitly declared as a broadcast. This change allows hosts to use addresses ending in '.0'.
  • OpenSSH settings have been changed: the SFTP protocol is now used by default in scp instead of scp/rcp, support for RSA/SHA-1 signatures has been disabled, VerifyHostKeyDNS and X11Forwarding parameters are set to 'no', the VersionAddendum directive has been removed, and support for HPN settings has been dropped.
  • The date utility has added the '-z' option for timezone conversion.
  • The diff utility has added the '—color' option for visualizing changes in color.
  • The sleep utility now supports units of measurement other than seconds (for example, you can specify 'sleep 1h 30m').
  • The head and tail utilities have added support for the '-q' and '-h' options, and it is now possible to specify values with SI metric system suffixes. The restriction on the maximum number of lines in head has been removed, allowing up to 2^31 lines.
  • The systat utility has added the 'iolat' command to output information about input/output latencies calculated by the CAM scheduler.
  • The libncursesw library has been split into two libraries: libtinfow and libncursesw. Support for using terminfo database in ncurses has been added, rather than only termcap.
  • For the aarch64 (arm64) architecture, the COMPAT_LIB32 build option has been implemented and is enabled by default, which allows for the building of 32-bit libraries for ARM64 systems, enabling the execution of binaries compiled for the armv7 platform.
  • Improved support for cloud systems. Experimental builds with ZFS root filesystem and cloud-init have been added for AWS EC2. For Azure, images are provided for arm64 and amd64 architectures, with a choice of UFS or ZFS. A driver for the gve (Google Virtual NIC) virtual network card has been added.
  • ACPI system now includes support for the _CR3 threshold value, allowing the temperature at which the system will enter sleep mode (S3) to be set.
  • Updated versions of third-party applications and libraries included in the base system: OpenSSH 9.5p1, OpenSSL 3.0.12 (previously branch 1.1.1), awk 2021072, bc 6.6.0, libbsdxml 2.4.7, libfido2 1.13.0, tcpdump 4.99.4, libpcap 1.10.4, xz 5.4.3, zlib 1.3, zstd 1.5.2. The objdump utility implementation has been replaced with llvm-objdump. The Clang compiler has been updated to version 16.
  • Cleaned up deprecated systems:
    • Support for one-time passwords OPIE has been removed from the base system (the security/opie port can be installed to restore the functionality).
    • Drivers for sound cards with an ISA interface have been removed.
    • Utilities fmtree and minigzip have been removed.
    • ATM components in netgraph (NgATM) have been removed.
    • The telnetd background process has been removed (the net/freebsd-telnetd port can be used).
    • The VINUM class in geom has been removed.
    • Deprecated drivers amr, iscsi_initiator, iir, mn, mly, nlmrsa, and twa have been removed.
    • The VESA parameter has been removed from the GENERIC and MINIMAL kernels.
    • Support for asymmetric cryptographic operations has been removed from the Open Cryptographic Framework (OCF) running at the kernel level.
    • The mergemaster utility has been marked as deprecated; etcupdate should be used instead.
    • The portsnap utility has been removed (to extract ports use 'git clone https://git.FreeBSD.org/ports.git /usr/ports').
    • Builds for the armv6 architecture have been discontinued.
    • Support for the MIPS architecture has been removed.

Source: opennet.ru

Buy reliable website hosting with DDoS protection, VPS VDS servers 🔥 Buy reliable website hosting with DDoS protection, VPS VDS servers | ProHoster