MFC r239649:

[FreeBSD/releng/9.1.git] / release / doc / en_US.ISO8859-1 / relnotes / article.sgml

<!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
%articles.ent;

<!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
%release;
]>

<article>
<articleinfo>
  <title>&os; &release.current; Release Notes</title>

  <corpauthor>The &os; Project</corpauthor>

  <pubdate>$FreeBSD$</pubdate>

  <copyright>
    <year>2012</year>
    <holder role="mailto:doc@FreeBSD.org">The &os; Documentation Project</holder>
  </copyright>

  <legalnotice id="trademarks" role="trademarks">
    &tm-attrib.freebsd;
    &tm-attrib.ibm;
    &tm-attrib.ieee;
    &tm-attrib.intel;
    &tm-attrib.sparc;
    &tm-attrib.general;
  </legalnotice>

  <abstract>
    <para>The release notes for &os; &release.current; contain a summary
      of the changes made to the &os; base system on the
      &release.branch; development line.
      This document lists applicable security advisories that were issued since
      the last release, as well as significant changes to the &os;
      kernel and userland.
      Some brief remarks on upgrading are also presented.</para>
  </abstract>
</articleinfo>

<sect1 id="intro">
  <title>Introduction</title>

  <para>This document contains the release notes for &os;
    &release.current;.  It
    describes recently added, changed, or deleted features of &os;.
    It also provides some notes on upgrading
    from previous versions of &os;.</para>

  <para>This distribution of &os; &release.current; is a
    &release.type; distribution.  It can be found at <ulink
    url="&release.url;"></ulink> or any of its mirrors.  More
    information on obtaining this (or other) &release.type;
    distributions of &os; can be found in the <ulink
    url="&url.books.handbook;/mirrors.html"><quote>Obtaining
    &os;</quote> appendix</ulink> to the <ulink
    url="&url.books.handbook;/">&os;
    Handbook</ulink>.</para>

  <para>All users are encouraged to consult the release errata before
    installing &os;.  The errata document is updated with
    <quote>late-breaking</quote> information discovered late in the
    release cycle or after the release.  Typically, it contains
    information on known bugs, security advisories, and corrections to
    documentation.  An up-to-date copy of the errata for &os;
    &release.current; can be found on the &os; Web site.</para>

</sect1>

<sect1 id="new">
  <title>What's New</title>

  <para>This section describes
    the most user-visible new or changed features in &os;
    since &release.prev;.</para>

  <para>Typical release note items
    document recent security advisories issued after
    &release.prev;,
    new drivers or hardware support, new commands or options,
    major bug fixes, or contributed software upgrades.  They may also
    list changes to major ports/packages or release engineering
    practices.  Clearly the release notes cannot list every single
    change made to &os; between releases; this document focuses
    primarily on security advisories, user-visible changes, and major
    architectural improvements.</para>

  <sect2 id="security">
    <title>Security Advisories</title>

      <para>Problems described in the following security advisories have
        been fixed.  For more information, consult the individual
        advisories available from
        <ulink url="http://security.FreeBSD.org/"></ulink>.</para>

      <informaltable frame="none" pgwide="1">
        <tgroup cols="3">
          <colspec colwidth="1*">
          <colspec colwidth="1*">
          <colspec colwidth="3*">
          <thead>
            <row>
              <entry>Advisory</entry>
              <entry>Date</entry>
              <entry>Topic</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc"
                  >SA-11:01.mountd</ulink></entry>
              <entry>20&nbsp;April&nbsp;2011</entry>
              <entry><para>Network ACL mishandling in &man.mountd.8;</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:02.bind.asc"
                  >SA-11:02.bind</ulink></entry>
              <entry>28&nbsp;May&nbsp;2011</entry>
              <entry><para>BIND remote DoS with large RRSIG RRsets and negative
                  caching</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc"
                  >SA-11:04.compress</ulink></entry>
              <entry>28&nbsp;September&nbsp;2011</entry>
              <entry><para>Errors handling corrupt compress file in
                  &man.compress.1; and &man.gzip.1;</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc"
                  >SA-11:05.unix</ulink></entry>
              <entry>28&nbsp;September&nbsp;2011</entry>
              <entry><para>Buffer overflow in handling of UNIX socket
                  addresses</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:06.bind.asc"
                  >SA-11:06.bind</ulink></entry>
              <entry>23&nbsp;December&nbsp;2011</entry>
              <entry><para>Remote packet Denial of Service against &man.named.8;
                  servers</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc"
                  >SA-11:07.chroot</ulink></entry>
              <entry>23&nbsp;December&nbsp;2011</entry>
              <entry><para>Code execution via chrooted ftpd</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc"
                  >SA-11:08.telnetd</ulink></entry>
              <entry>23&nbsp;December&nbsp;2011</entry>
              <entry><para>telnetd code execution vulnerability</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc"
                  >SA-11:09.pam_ssh</ulink></entry>
              <entry>23&nbsp;December&nbsp;2011</entry>
              <entry><para>pam_ssh improperly grants access when user account has
                  unencrypted SSH private keys</para></entry>
            </row>

            <row>
              <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc"
                  >SA-11:10.pam</ulink></entry>
              <entry>23&nbsp;December&nbsp;2011</entry>
              <entry><para><function>pam_start()</function> does not validate
                  service names</para></entry>
            </row>
          </tbody>
        </tgroup>
      </informaltable>
    </sect2>

  <sect2 id="kernel">
    <title>Kernel Changes</title>

      <para revision="219129">The &os; kernel now supports Capsicum
        Capability Mode.  Capsicum is a set of features for sandboxing
        support, using a capability model in which the capabilities
        are file descriptors.  Two new kernel options
        <literal>CAPABILITIES</literal> and
        <literal>CAPABILITY_MODE</literal> have been added to the
        <filename>GENERIC</filename> kernel.  For more information
        about Capsicum, see <ulink
        url="http://www.cl.cam.ac.uk/research/security/capsicum/"></ulink>.</para>

      <para revision="219559,219561" arch="amd64,i386">The &os;
        &man.dtrace.1; framework now supports
        <literal>systrace</literal> for system calls of
        <literal>linux32</literal> and <literal>freebsd32</literal> on
        &os;/&arch.amd64;.  Two new
        <filename>systrace_linux32</filename> and
        <filename>systrace_freebsd32</filename> kernel modules provide
        support for tracing compat system calls in addition to the native
        system call tracing provided by the
        <filename>systrace</filename> module.</para>

      <para revision="217152,217396" arch="amd64,i386,powerpc">The
        &os; ELF image activator now supports the
        <literal>PT_GNU_STACK</literal> program header.  This is
        disabled by default.  New &man.sysctl.8; variables
        <varname>kern.elf32.nxstack</varname> and
        <varname>kern.elf64.nxstack</varname> allow enabling
        <literal>PT_GNU_STACK</literal> for the specified ABIs
        (e.g. <literal>elf32</literal> for 32-bit ABI).</para>

      <para revision="216758,216615">The &man.hhook.9; (Helper Hook)
        and &man.khelp.9; (Kernel Helpers) KPIs have been implemented.
        These are a kind of superset of &man.pfil.9; framework for
        more general use in the kernel.  The &man.hhook.9; KPI
        provides a way for kernel subsystems to export hook points
        that &man.khelp.9; modules can hook to provide enhanced or new
        functionality to the kernel.  The &man.khelp.9; KPI provides a
        framework for managing &man.khelp.9; modules, which indirectly
        use the &man.hhook.9; KPI to register their hook functions
        with hook points of interest within the kernel.  These allow a
        structured way to dynamically extend the kernel at runtime in
        an ABI preserving manner.</para>

      <para revision="224516" arch="amd64,i386,pc98">A &man.loader.8;
        tunable <varname>hw.memtest.tests</varname> has been added.
        This controls whether to perform memory testing at boot time
        or not.  The default value is <literal>1</literal> (perform a
        memory test).</para>

      <para revision="220137">A new resource accounting API has been
        implemented.  It can keep per-process, per-jail, and
        per-loginclass resource accounting information.  Note that
        this is not built nor installed by default.  To build and
        install them, specify <literal>options RACCT</literal> in the
        kernel configuration file and rebuild the base system as
        described in the <ulink
        url="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html">&os;
        Handbook</ulink>.</para>

      <para revision="220163">A new resource-limiting API has been
        implemented.  It works in conjunction with the
        <literal>RACCT</literal> resource accounting implementation
        and takes user-configurable actions based on the set of rules
        it maintains and the current resource usage.  The &man.rctl.8;
        utility has been added to manage the rules in userland.  Note
        that this is not built nor installed by default.  To build and
        install them, specify <literal>options RCTL</literal> in the
        kernel configuration file and rebuild the base system as
        described in the <ulink
        url="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html">&os;
        Handbook</ulink>.</para>

      <para revision="220031">The &man.sendmsg.2; and &man.recvmsg.2;
        system calls in the &os; Linux ABI compatibility have been
        improved.</para>

      <para revision="219999">The &man.open.2; and &man.fhopen.2;
        system calls now support the <literal>O_CLOEXEC</literal> flag,
        which allows setting the <literal>FD_CLOEXEC</literal> flag for the
        newly created file descriptor.  This is standardized in IEEE
        Std 1003.1-2008 (POSIX, Single UNIX Specification Version
        4).</para>

      <para revision="220791">The &man.posix.fallocate.2; system call has
        been implemented.  This is a function in POSIX to ensure that
        a part of the storage for regular file data is allocated on the
        file system storage media.</para>

      <para revision="219304">Two new system calls
        <function>setloginclass(2)</function> and
        <function>getloginclass(2)</function> have been added.  This
        makes it possible for the kernel to track the login class a
        process is assigned to, which is required for the
        <literal>RCTL</literal> resource limiting framework.</para>

      <para revision="220238" arch="amd64">&os; now supports executing
        &os; 1/&arch.i386; a.out binaries on &os;/&arch.amd64;.  Note
        that this is not built nor installed by default.  To build and
        install them, specify <literal>options COMPAT_43</literal> in
        the kernel configuration file and rebuild the base system as
        described in the <ulink
        url="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html">&os;
        Handbook</ulink>.</para>

      <para revision="218485,219028,219029">The following
        &man.sysctl.8; variables have been added to show the availability
        of various kernel features:</para>

      <informaltable frame="none" pgwide="1">
        <tgroup cols="2">
          <colspec colwidth="1*">
          <colspec colwidth="3*">
          <thead>
            <row>
              <entry>&man.sysctl.8; variable name</entry>
              <entry>Description</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry><varname>kern.features.ufs_acl</varname></entry>
              <entry>ACL (Access Control List) support in UFS</entry>
            </row>

            <row>
              <entry><varname>kern.features.ufs_gjournal</varname></entry>
              <entry>journaling support through &man.gjournal.8; for
                UFS</entry>
            </row>

            <row>
              <entry><varname>kern.features.ufs_quota</varname></entry>
              <entry>UFS disk quotas support</entry>
            </row>

            <row>
              <entry><varname>kern.features.ufs_quota64</varname></entry>
              <entry>64-bit UFS disk quotas support</entry>
            </row>

            <row>
              <entry><varname>kern.features.softupdates</varname></entry>
              <entry>FFS soft-updates support</entry>
            </row>

            <row>
              <entry><varname>kern.features.ffs_snapshot</varname></entry>
              <entry>FFS snapshot support</entry>
            </row>

            <row>
              <entry><varname>kern.features.nfsclient</varname></entry>
              <entry>NFS client (old implementation)</entry>
            </row>

            <row>
              <entry><varname>kern.features.nfscl</varname></entry>
              <entry>NFS client (new implementation)</entry>
            </row>

            <row>
              <entry><varname>kern.features.nfsserver</varname></entry>
              <entry>NFS server (old implementation)</entry>
            </row>

            <row>
              <entry><varname>kern.features.nfsd</varname></entry>
              <entry>NFS server (new implementation)</entry>
            </row>

            <row>
              <entry><varname>kern.features.kdtrace_hooks</varname></entry>
              <entry>Kernel DTrace hooks which are required to load
                DTrace kernel modules</entry>
            </row>

            <row>
              <entry><varname>kern.features.ktr</varname></entry>
              <entry>Kernel support for KTR kernel tracing facility</entry>
            </row>

            <row>
              <entry><varname>kern.features.ktrace</varname></entry>
              <entry>Kernel support for system call tracing</entry>
            </row>

            <row>
              <entry><varname>kern.features.hwpmc_hooks</varname></entry>
              <entry>Kernel support for HW PMC</entry>
            </row>

            <row>
              <entry><varname>kern.features.sysv_msg</varname></entry>
              <entry>System V message queues support</entry>
            </row>

            <row>
              <entry><varname>kern.features.sysv_sem</varname></entry>
              <entry>System V semaphores support</entry>
            </row>

            <row>
              <entry><varname>kern.features.p1003_1b_mqueue</varname></entry>
              <entry>POSIX P1003.1B message queues support</entry>
            </row>

            <row>
              <entry><varname>kern.features.p1003_1b_semaphores</varname></entry>
              <entry>POSIX P1003.1B semaphores support</entry>
            </row>

            <row>
              <entry><varname>kern.features.kposix_priority_scheduling</varname></entry>
              <entry>POSIX P1003.1B real-time extensions</entry>
            </row>

            <row>
              <entry><varname>kern.features.stack</varname></entry>
              <entry>Support for capturing the kernel stack</entry>
            </row>

            <row>
              <entry><varname>kern.features.sysv_shm</varname></entry>
              <entry>System V shared memory segments support</entry>
            </row>

            <row>
              <entry><varname>kern.features.pps_sync</varname></entry>
              <entry>Support usage of external PPS signal by kernel PLL</entry>
            </row>

            <row>
              <entry><varname>kern.features.regression</varname></entry>
              <entry>Kernel support for interfaces necessary for
                regression testing</entry>
            </row>

            <row>
              <entry><varname>kern.features.invariant_support</varname></entry>
              <entry>Support for modules compiled with the INVARIANTS option</entry>
            </row>

            <row>
              <entry><varname>kern.features.zero_copy_sockets</varname></entry>
              <entry>Zero copy sockets support</entry>
            </row>

            <row>
              <entry><varname>kern.features.libmchain</varname></entry>
              <entry>mchain library</entry>
            </row>

            <row>
              <entry><varname>kern.features.scbus</varname></entry>
              <entry>SCSI devices support</entry>
            </row>

            <row>
              <entry><varname>kern.features.mac</varname></entry>
              <entry>Mandatory Access Control Framework support</entry>
            </row>

            <row>
              <entry><varname>kern.features.audit</varname></entry>
              <entry>BSM audit support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_gate</varname></entry>
              <entry>GEOM Gate module</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_uzip</varname></entry>
              <entry>GEOM uzip read-only compressed disks support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_cache</varname></entry>
              <entry>GEOM cache module</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_mirror</varname></entry>
              <entry>GEOM mirroring support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_stripe</varname></entry>
              <entry>GEOM striping support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_concat</varname></entry>
              <entry>GEOM concatenation support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_raid3</varname></entry>
              <entry>GEOM RAID-3 functionality</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_fox</varname></entry>
              <entry>GEOM FOX redundant path mitigation support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_multipath</varname></entry>
              <entry>GEOM multipath support</entry>
            </row>

            <row>
              <entry><varname>kern.features.g_virstor</varname></entry>
              <entry>GEOM virtual storage support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_bde</varname></entry>
              <entry>GEOM-based Disk Encryption</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_eli</varname></entry>
              <entry>GEOM crypto module</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_journal</varname></entry>
              <entry>GEOM journaling support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_shsec</varname></entry>
              <entry>GEOM shared secret device support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_vol</varname></entry>
              <entry>GEOM support for volume names from UFS superblocks</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_label</varname></entry>
              <entry>GEOM labeling support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_sunlabel</varname></entry>
              <entry>GEOM Sun/Solaris partitioning support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_bsd</varname></entry>
              <entry>GEOM BSD disklabels support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_pc98</varname></entry>
              <entry>GEOM NEC PC9800 partitioning support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_linux_lvm</varname></entry>
              <entry>GEOM Linux LVM partitioning support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_pc98</varname></entry>
              <entry>GEOM partitioning class for PC-9800 disk partitions</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_vtoc8</varname></entry>
              <entry>GEOM partitioning class for SMI VTOC8 disk labels</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_bsd</varname></entry>
              <entry>GEOM partitioning class for BSD disklabels</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_ebr</varname></entry>
              <entry>GEOM partitioning class for extended boot records support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_ebr_compat</varname></entry>
              <entry>GEOM EBR partitioning class:
                backward-compatible partition names</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_gpt</varname></entry>
              <entry>GEOM partitioning class for GPT partitions
                support</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_apm</varname></entry>
              <entry>GEOM partitioning class for Apple-style
                partitions</entry>
            </row>

            <row>
              <entry><varname>kern.features.geom_part_mbr</varname></entry>
              <entry>GEOM partitioning class for MBR support</entry>
            </row>
          </tbody>
        </tgroup>
      </informaltable>

    <sect3 id="boot">
      <title>Boot Loader Changes</title>

        <para revision="222417">The default boot loader menu has been
          updated.</para>

        <para revision="219541" arch="ia64">The &man.loader.8; loader
          now supports PBVM (Pre-Boot Virtual Memory).  This allows
          linking the kernel at a fixed virtual address without having to
          make any assumptions about the physical memory layout.  The
          PBVM also allows fine control of the address where the
          kernel and its modules are to be loaded.</para>
      </sect3>

    <sect3 id="proc">
      <title>Hardware Support</title>

        <para revision="217044" arch="powerpc">&os;/powerpc now
          supports Sony Playstation 3 using the OtherOS feature
          available on firmwares 3.15 and earlier.</para>

        <para revision="219473,220577">A new &man.loader.8; tunable
          <varname>machdep.disable_tsc</varname> has been added.
          Setting this to a non-zero value disables use of TSC (Time
          Stamp Counter) by turning off boot-time CPU frequency
          calibration, DELAY(9) with TSC, and using TSC as a CPU
          ticker.  Another new &man.loader.8; tunable
          <varname>machdep.disable_tsc_calibration</varname> allows to
          skip the TSC frequency calibration only.  This is useful when
          one wants to use the nominal frequency of the chip in Intel
          processors, for example.</para>

        <para revision="223098" arch="amd64,i386">The &os; &man.usb.4;
          subsystem now supports USB 3.0 by default.</para>

        <para revision="215649">The &os; &man.usb.4; subsystem now
          supports USB packet filter.  This allows to capture packets
          which go through each USB host controller.  The
          implementation is almost based on &man.bpf.4; code.
          The userland program &man.usbdump.8; has been added.</para>

      <sect4 id="net-if">
        <title>Network Interface Support</title>

          <para revision="217649">A bug in the &man.alc.4; driver which
            could make AR8152-based network interfaces stop working
            has been fixed.</para>

          <para revision="219647">A bxe(4) driver for Broadcom
            NetXtreme II 10GbE controllers (BCM57710, BCM57711,
            BCM57711E) has been added.</para>

          <para revision="220009">The &man.cxgb.4; driver has been
            updated to version 7.11.0.</para>

          <para revision="218794">A &man.cxgbe.4; driver for Chelsio
            T4 (Terminator 4) based 10Gb/1Gb adapters has been
            added.</para>

          <para revision="218832" arch="i386">The &man.dc.4; driver
            now works correctly in kernels with the
            <option>PAE</option> option.</para>

          <para revision="219753">The &man.em.4; driver has been
            updated to version 7.3.2.</para>

          <para revision="223350">The &man.igb.4; driver has been
            updated to version 2.2.5.</para>

          <para revision="218530">The &man.igb.4; driver now supports
            Intel I350 PCIe Gigabit Ethernet controllers.</para>

          <para revision="217593">The &man.ixgbe.4; driver has been
            updated to version 2.3.8.</para>

          <para revision="220892">Firmware images in the &man.iwn.4;
            driver for 1000, 5000, 6000, and 6500 series cards have been
            updated.</para>

          <para revision="216860">A bug in the &man.msk.4; driver has been
            fixed.  It could prevent RX checksum offloading from
            working.</para>

          <para revision="217794">A bug in the &man.nfe.4; driver which
            could prevent reinitialization after changing the MTU has
            been fixed.</para>

          <para revision="217511">A bug in the &man.ral.4; and &man.run.4;
            drivers which could prevent <literal>hostap</literal> mode
            from working has been fixed.</para>

          <para revision="216828">A rdcphy(4) driver for RDC Semiconductor
            R6040 10/100 PHY has been added.</para>

          <para revision="217498,218760">The &man.re.4; driver now supports
            RTL8168E/8111E-VL PCIe Gigabit Ethernet controllers and
            RTL8401E PCIe Fast Ethernet controllers.</para>

          <para revision="217766">The &man.re.4; driver now supports
            TX interrupt moderation on RTL810xE PCIe Fast Ethernet
            controllers.</para>

          <para revision="217902">The &man.re.4; driver now supports
            another mechanism for RX interrupt moderation because of
            performance problems.  A &man.sysctl.8; variable
            <varname>dev.re.<replaceable>N</replaceable>.int_rx_mod</varname>
            has been added to control amount of time to delay RX
            interrupt processing, in units of microsecond.  Setting it
            to <literal>0</literal> completely disables RX interrupt
            moderation.  A &man.loader.8; tunable
            <varname>hw.re.intr_filter</varname> controls whether the
            old mechanism utilizing MSI/MSI-X capability on
            supported controllers is used or not.  When set to
            a non-zero value, the &man.re.4; driver uses the old
            mechanism.  The default value is <literal>0</literal> and
            this tunable has no effect on controllers without MSI/MSI-X
            capability.</para>

          <para revision="217246,217832">The &man.re.4; driver now
            supports TSO (TCP Segmentation Offload) on RealTek
            RTL8168/8111 C or later controllers.  Note that this is
            disabled by default because broken frames can be sent
            under certain conditions.</para>

          <para revision="217381,218289">The &man.re.4; driver now
            supports enabling TX and/or RX checksum offloading
            independently from each other.  Note that TX IP checksum
            is disabled on some RTL8168C-based network interfaces
            because it can generate an incorrect IP checksum when the
            packet contains IP options.</para>

          <para revision="217296">A bug in the &man.re.4; driver has
            been fixed.  It could cause a panic when receiving a jumbo
            frame on an RTL8169C, 8169D, or 8169E controller-based
            network interface.</para>

          <para revision="217911">The &man.re.4; driver now supports
            RTL8105E PCIe Fast Ethernet controllers.</para>

          <para revision="217910">The rlphy(4) driver now supports the
            Realtek RTL8201E 10/100 PHY found in RTL8105E
            controllers.</para>

          <para revision="217548">A bug in the &man.sis.4; driver has
            been fixed.  It could prevent a proper reinitialization
            on DP83815, DP83816, and SiS 900/7016 controllers when the
            configuration of multicast packet handling and/or
            promiscuous mode is changed.</para>

          <para revision="216650">A bug in the &man.vlan.4; pseudo interface
            han been fixed.  It could have a random interface
            identifier in an automatically configured IPv6 link-local
            address, instead of one generated with the parent
            interface's IEEE 802 48-bit MAC address and an algorithm
            described in RFC 4291.</para>

          <para revision="216829">A &man.vte.4; driver for RDC R6040 Fast
            Ethernet controllers, which are commonly found on the Vortex86
            System On a Chip, has been added.</para>

          <para revision="221167">A &man.vxge.4; driver for the Neterion
            X3100 10GbE Server/Storage adapter has been added.</para>

          <para revision="216824">A bug in the &man.wpi.4; driver has been
            fixed.  It could display the following error messages and
            result in the device being unusable:</para>

          <screen>wpi0: could not map mbuf (error 12)
wpi0: wpi_rx_intr: bus_dmamap_load failed, error 12</screen>

      </sect4>
    </sect3>

    <sect3 id="net-proto">
      <title>Network Protocols</title>

        <para revision="225044">&man.ipfw.8; now supports IPv6 in
          the <command>fwd</command> action.</para>

        <para revision="223666">&man.ipfw.8; now supports the
          <command>call</command> and <command>return</command>
          actions.  Upon the <command>call
          <replaceable>number</replaceable></command> action, the
          current rule number is saved in the internal stack and
          ruleset processing continues with the first rule numbered
          <replaceable>number</replaceable> or higher.  The
          <command>return</command> action takes the rule number saved
          to internal stack by the latest <command>call</command>
          action and returns ruleset processing to the first rule with
          number greater than that saved number.</para>

        <para revision="218794">&os;'s &man.ipsec.4; support now uses
          half of the hash size as the authenticator hash size in
          Hashed Message Authentication Mode (HMAC-SHA-256,
          HMAC-SHA-384, and HMAC-SHA-512) as described in RFC 4868.
          This was a fixed 96-bit length in prior releases because the
          implementation was based on an old Internet draft
          draft-ietf-ipsec-ciph-sha-256-00.  Note that this means
          &release.current; and later are no longer interoperable with
          the older &os; releases.</para>

        <para revision="219820">For Infiniband support, OFED
          (OpenFabrics Enterprise Distribution) version 1.5.3 has been
          imported into the base system.  Note that this is not built
          nor installed by default.  To build and install them,
          specify <literal>WITH_OFED=yes</literal> in
          <filename>/etc/src.conf</filename> and rebuild the base
          system as described in the <ulink
          url="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html">&os;
          Handbook</ulink>.</para>

        <para revision="226572">The &os; TCP/IP network stack now supports
          IPv4 prefixes with /31 as described in RFC 3021,
          <quote>Using 31-Bit Prefixes on IPv4 Point-to-Point
          Links</quote>.</para>

        <para revision="217169">A bug in the &os; TCP/IP network stack has
          been fixed.  Source address selection could not be
          performed when multicast options were present but without an
          interface being specified.</para>

        <para revision="225682">A bug in the
          <literal>IPV6_PKTINFO</literal> option used in
          &man.sendmsg.2; has been fixed.  The
          <literal>IPV6_USE_MIN_MTU</literal> state set by
          &man.setsockopt.2; was ignored.</para>

        <para revision="216109,216114,216115,218152,218153,218155">
          The &os; TCP/IP network stack now supports the &man.mod.cc.9; pluggable
          congestion control framework.  This allows TCP congestion
          control algorithms to be implemented as dynamically loadable
          kernel modules.  The following kernel modules are available
          as of &release.current;: &man.cc.chd.4; for the
          CAIA-Hamilton-Delay algorithm, &man.cc.cubic.4; for the CUBIC
          algorithm, &man.cc.hd.4; for the Hamilton-Delay algorithm,
          &man.cc.htcp.4; for the H-TCP algorithm, &man.cc.newreno.4; for
          the NewReno algorithm, and &man.cc.vegas.4; for the Vegas algorithm.
          The default algorithm can be set by a new &man.sysctl.8;
          variable <varname>net.inet.tcp.cc.algorithm</varname>.  The
          value must be set to one of the names listed by
          <varname>net.inet.tcp.cc.available</varname>, and
          <literal>newreno</literal> is the default set at boot time.
          For more
          detail, see the &man.mod.cc.4; and &man.mod.cc.9; manual pages.</para>

        <para revision="217806">An &man.h.ertt.4; (Enhanced Round Trip
          Time) &man.khelp.9; module has been added.  This module
          allows per-connection, low noise estimates of the
          instantaneous RTT in the TCP/IP network stack with a robust
          implementation even in the face of delayed acknowledgments
          and/or TSO (TCP Segmentation Offload) being in use for a
          connection.</para>

        <para revision="218912">A new &man.tcp.4; socket option
          <literal>TCP_CONGESTION</literal> has been added.  This
          allows to select or query the congestion control algorithm
          that the TCP/IP network stack will use for connections on
          the socket.</para>

        <para revision="225586">The &man.ng.ipfw.4; &man.netgraph.4;
          node now supports IPv6.</para>

        <para revision="219127">The &man.ng.one2many.4;
          &man.netgraph.4; node now supports the
          <literal>XMIT_FAILOVER</literal> transmit algorithm.  This
          makes packets deliver out of the first active
          <literal>many</literal> hook.</para>

        <para revision="219183">The &man.ng.netflow.4;
          &man.netgraph.4; node now supports NetFlow version 9.  A new
          <literal>export9</literal> hook has been added for NetFlow
          v9 data.  Note that data export can be done
          simultaneously in both version 5 and version 9.</para>

        <para revision="239615">The IEEE 802.11s element identifiers have
          been updated to reflect the final version of the amendment.  This
          update breaks compatibility with older mesh setups but is necessary
          as the previous IDs are used by another amendment leading to
          unexpected results when trying to associate with an accesspoint
          using the affected IDs.</para>

    </sect3>

    <sect3 id="disks">
      <title>Disks and Storage</title>

        <para revision="220412">The &man.ada.4; driver now supports
          write cache control.  A new &man.sysctl.8 variable
          <varname>kern.cam.ada.write_cache</varname> determines
          whether the write cache of &man.ada.4; devices is enabled or
          not.  Setting to <literal>1</literal> enables and
          <literal>0</literal> disables the write cache, and <literal>-1</literal>
          leaves the device default behavior.  &man.sysctl.8 variables
          <varname>kern.cam.ada.<replaceable>N</replaceable>.write_cache</varname>
          can override the configuration in a per-device basis (the
          default value is <literal>-1</literal>, which means to use
          the global setting).  Note that the value can be changed at
          runtime, but it takes effect only after a device
          reset.</para>

        <para revision="224905">The &man.arcmsr.4; driver has been
          updated to version 1.20.00.22.</para>

        <para revision="226067">The &man.cam.4; subsystem now supports the
          descriptor format sense data of the SPC-3 (SCSI Primary Commands
          3) specification.</para>

        <para revision="220559">The &man.geom.map.4; GEOM class has
          been added.  This allows to generate multiple geom providers
          based on a hard-coded layout of a device with no explicit
          partition table such as embedded flash storage.  For more
          information, see the &man.geom.map.4; manual page.</para>

        <para revision="218014">The &man.gpart.8; GEOM class now
          supports the following aliases for the MBR and EBR schemes:
          <literal>fat32</literal>, <literal>ebr</literal>,
          <literal>linux-data</literal>,
          <literal>linux-raid</literal>, and
          <literal>linux-swap</literal>.</para>

        <para revision="218014">The &man.gpart.8; GEOM class now
          supports <literal>bios-boot</literal> GUID for the GPT
          scheme which is used in GRUB 2 loader.</para>

        <para revision="219974">The &man.graid.8; GEOM class has been
          added.  This is a replacement of the &man.ataraid.4; driver
          supporting various BIOS-based software RAID.</para>

        <para revision="219056">The &man.sysctl.8; variable
          <varname>kern.geom.confxml</varname> now contains
          information about disk identification in an
          <sgmltag>ident</sgmltag> tag and disk model strings in a
          <sgmltag>descr</sgmltag> tag.</para>

        <para revision="216793">The &man.md.4; memory-backed pseudo disk
          device driver now supports a &man.sysctl.8; variable
          <varname>vm.md_malloc_wait</varname> to specify whether a
          malloc-backed disk will use <varname>M_WAITOK</varname> or
          <varname>M_NOWAIT</varname> for &man.malloc.9; calls.  The
          <varname>M_WAITOK</varname> setting can prevent memory allocation
          failure under high load.  If it is set to
          <literal>0</literal>, a malloc-backed disk uses
          <varname>M_NOWAIT</varname> for memory allocation.  The
          default value is <literal>0</literal>.</para>

        <para revision="216941,217509">A bug in the &man.mmc.4; driver
          that could cause device detection to fail has been fixed.</para>

        <para revision="223958">The &man.mxge.4; driver has been
          updated.</para>

        <para revision="226115">A &man.tws.4; driver for 3ware 9750
          SATA+SAS 6Gb/s RAID controllers has been added.</para>
      </sect3>

    <sect3 id="fs">
      <title>File Systems</title>

        <para revision="207141,218726">The &os; Fast File System now supports
          softupdates journaling.  It introduces a intent log into a
          softupdates-enabled file system which eliminates the need
          for background &man.fsck.8; even on unclean shutdown.  This
          can be enabled in a per-filesystem basis by using the
          <option>-j</option> flag of the &man.newfs.8; utility or the
          <option>-j enable</option> option of the &man.tunefs.8;
          utility.  Note that the &release.current; installer
          automatically enables softupdates journaling for
          newly-created UFS file systems.</para>

        <para revision="216796">The &os; Fast File System now
          supports the <literal>TRIM</literal> command when freeing data
          blocks.  A new flag <option>-t</option> in the &man.newfs.8;
          and &man.tunefs.8; utilities sets the TRIM-enable flag for a
          file system.  The TRIM-enable flag makes the file system
          send a delete request to the underlying device for each
          freed block.  The <literal>TRIM</literal> command is
          specified as a Data Set Management Command in the ATA8-ACS2
          standard to carry the information related to deleted data
          blocks to a device, especially for a SSD (Solid-State Drive) for
          optimization.</para>

        <para revision="221233">A new flag <option>-E</option> has
          been added to the &man.newfs.8; and &man.fsck.ffs.8; utilities.
          This clears unallocated blocks, notifying the underlying
          device that they are not used and that their contents may be
          discarded.  This is useful in &man.fsck.ffs.8; for file
          systems which have been mounted on systems without
          <literal>TRIM</literal> support, or with
          <literal>TRIM</literal> support disabled, as well as
          filesystems which have been copied from one device to
          another.</para>

        <para revision="221124">The &os; NFS subsystem has been
          updated.  The new implementation supports NFS version 4 in
          addition to 2 and 3.  The kernel options for the NFS server
          and client are changed from <literal>NFSSERVER</literal> and
          <literal>NFSCLIENT</literal> to <literal>NFSD</literal> and
          <literal>NFSCL</literal>.  &man.sysctl.8; variables which
          start with <varname>vfs.nfssrv.</varname> have been renamed
          to <varname>vfs.nfsd.</varname>.  The NFS server now
          supports <varname>vfs.nfsd.server_max_nfsvers</varname> and
          <varname>vfs.nfsd.server_min_nfsvers</varname>
          &man.sysctl.8; variables to specify the maximum and the
          minimum NFS version number which the server accepts.  The
          default value is set to <literal>3</literal> and
          <literal>2</literal>, respectively.</para>

        <para>To enable NFSv4, the following variables are needed on
          the server side in &man.rc.conf.5;:</para>

          <programlisting>nfsv_server_enable="YES"
nfsv4_server_enable="YES"
nfsuserd_enable="YES"</programlisting>

        <para>and the following line is needed in
          <filename>/etc/exports</filename>:</para>

        <programlisting>V4: /</programlisting>

        <para>For more information about NFSv4 and its configuration,
          see the &man.nfsv4.4; and &man.exports.5; manual pages.</para>

        <para revision="221436">The &os; NFS subsystem now supports a
          <option>nocto</option> mount option.  This disables the
          close-to-open cache coherency check at open time.  This
          option may improve performance for read-only mounts, but
          should only be used only if the data on the server changes
          rarely.  The &man.mount.nfs.8; utility now also supports
          this flag keyword.</para>

        <para revision="225537">A &man.loader.8; tunable
          <varname>vfs.typenumhash</varname> has been added and set to
          <literal>1</literal> by default.  This enables to use a hash
          calculation on the file system identification number internally
          used in the kernel.  This fixes the <quote>Stale NFS file
          handle</quote> error on NFS clients when upgrading or
          rebuilding the kernel on the NFS server due to unexpected
          change of these identification number values.</para>

        <para revision="219089">The &os; ZFS subsystem has been
          updated to the SPA (Storage Pool Allocator, also known as
          zpool) version 28.  It now supports data deduplication,
          triple parity RAIDZ (raidz3), snapshot holds, log device
          removal, zfs diff, zpool split, zpool import
          <option>-F</option>, and read-only zpool import.</para>
    </sect3>
  </sect2>

  <sect2 id="userland">
    <title>Userland Changes</title>

      <para revision="219359,219571">Complex exponential functions
        &man.cexp.3; and &man.cexpf.3;, and cube root function
        &man.cbrtl.3; have been added to
        <application>libm</application>.</para>

      <para revision="224152,224153,224154">The &man.bsdtar.1; and
        &man.cpio.1; utilities are now based on
        <application>libarchive</application> version 2.8.4.</para>

      <para revision="217416">The &man.cpuset.1; utility now supports
        a <option>-C</option> flag to create a new cpuset and assign
        an existing process into that set, and an
        <literal>all</literal> keyword in the <option>-l
        <replaceable>cpu-list</replaceable></option> option to specify
        all CPUs in the system.</para>

      <para revision="219739">The &man.dhclient.8; utility now uses
        &man.resolvconf.8; to manage the &man.resolv.conf.5; file by
        default.  A <varname>resolvconf_enable</varname> variable in
        <filename>/etc/dhclient-enter-hooks</filename> controls the
        behavior.</para>

      <para revision="217505">A bug in the &man.fetch.1; utility which
        could prevent the <command>STAT</command> FTP command from working
        properly has been fixed.</para>

      <para revision="219415">The &man.gpart.8; utility now supports a
        <option>-p</option> flag to the <command>show</command>
        subcommand.  This allows showing providers' names of
        partitions instead of the partitions' indexes.</para>

      <para revision="218049">The &man.hastd.8; utility now drops
        <literal>root</literal> privileges of the worker processes to the
        <literal>hast</literal> user.</para>

      <para revision="219351">The &man.hastd.8; utility now supports a
        <literal>checksum</literal> keyword to specify the checksum
        algorithm in a <literal>resource</literal> section.  As of
        &release.current;, <literal>none</literal>,
        <literal>sha256</literal>, and <literal>crc32</literal> are
        supported.</para>

      <para revision="219354">The &man.hastd.8; utility now supports a
        <literal>compression</literal> keyword to specify the compression
        algorithm in a <literal>resource</literal> section.  As of
        &release.current;, <literal>none</literal>,
        <literal>hole</literal> and <literal>lzf</literal> are
        supported.</para>

      <para revision="219818">The &man.hastd.8; utility now supports a
        <literal>source</literal> keyword to specify the local address
        to bind to before connecting the remote &man.hastd.8
        daemon.</para>

      <para revision="219019">An implementation of
        <function>iconv()</function> API libraries and utilities which
        are standardized in Single UNIX Specification has been
        imported.  These are based on NetBSD's Citrus implementation.
        Note that these are not built nor installed by default.  To
        build and install them, specify
        <literal>WITH_ICONV=yes</literal> in
        <filename>/etc/src.conf</filename> and rebuild the base system
        as described in the <ulink
        url="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html">&os;
        Handbook</ulink>.</para>

      <para revision="217013">The &man.ifconfig.8; utility now
        supports <literal>fdx</literal>, <literal>flow</literal>,
        <literal>hdx</literal>, and <literal>loop</literal> keywords
        as aliases of <literal>full-duplex</literal>,
        <literal>flowcontrol</literal>,
        <literal>half-duplex</literal>,
        and <literal>loopback</literal>, respectively.</para>

      <para revision="220370">A &man.readline.3; API set has been
        imported into <application>libedit</application>.  This is
        based on NetBSD's implementation and BSD licensed utilities
        now use it instead of GNU
        <application>libreadline</application>.</para>

      <para revision="224762">The &man.makefs.8; utility now supports the
        ISO 9660 format.</para>

      <para revision="220496,220497"><application>libmd</application>
        and <application>libcrypt</application> now support the SHA-256
        and SHA-512 algorithms.</para>

      <para revision="217642">The &man.netstat.1; utility now does not
        expose the internal scope address representation used in the &os;
        kernel, which is derived from KAME IPv6 stack, in the results
        of <command>netstat -ani</command> and <command>netstat
          -nr</command>.</para>

      <para revision="218127">The &man.newsyslog.8; utility now
        supports &man.xz.1; compression.  An <literal>X</literal> flag
        in the optional field has been added to specify the
        compression.</para>

      <para revision="219563">The &man.pam.group.8; module now
        supports <option>ruser</option> and <option>luser</option>
        options.  The <option>ruser</option> make it accept or reject
        based on the supplicant's group membership and this is the
        default behavior.  The <option>luser</option> checks the
        target user's group membership instead of the supplicant's
        one.  If neither option was specified, &man.pam.group.8;
        assumes <option>ruser</option> and issues a warning.</para>

      <para revision="216823">A &man.poweroff.8; utility has been added.
        This is equivalent to:</para>

      <screen>&prompt.root; shutdown -p now</screen>

      <para revision="218397">The &man.ppp.8; utility now supports
        <command>iface name <replaceable>name</replaceable></command>
        and <command>iface description
        <replaceable>description</replaceable></command> commands.
        These have the same functionalities as the <literal>name</literal>
        and <literal>description</literal> subcommands of the
        &man.ifconfig.8; utility.</para>

      <para revision="219307,219713">The &man.ps.1; utility now
        supports an <option>-o class</option> option to display the login
        class information of each process, and <option>-o
        usertime</option> and <option>-o systime</option> options for
        accumulated system and user CPU time, respectively.</para>

      <para revision="222732">The &man.rtadvd.8; daemon now supports a
        <literal>noifprefix</literal> keyword to disable gathering
        on-link prefixes from interfaces when no
        <literal>addr</literal> keyword is specified.  An entry in
        <filename>/etc/rtadvd.conf</filename> with
        <literal>noifprefix</literal> and no <literal>addr</literal>
        generates an RA message with no prefix information
        option.</para>

      <para revision="222732,224006">The &man.rtsold.8; and
        &man.rtadvd.8; daemons now support the RDNSS and DNSSL options
        described in RFC 6106, <quote>IPv6 Router Advertisement
        Options for DNS Configuration</quote>.  A &man.rtadvctl.8;
        utility to control the &man.rtadvd.8; daemon has been
        added.</para>

      <para revision="216695">The &man.rtld.1; runtime linker now supports
        shared objects as filters in ELF shared libraries.  Both
        standard and auxiliary filtering have been supported.  The
        &man.rtld.1; linker's processing of a filter defers loading a
        filtee until a filter symbol is referenced unless the
        <varname>LD_LOADFLTR</varname> environment variable is defined
        or a <literal>-z loadfltr</literal> option was specified when
        the filter was created.</para>

      <para revision="217133">A race condition in the &man.sed.1;
        utility has been fixed.  When an <option>-i</option> option is
        specified, there could be a short time window with no file
        with the original file name.</para>

      <para revision="216629">The &man.sh.1; program now supports
        <command>kill</command> as a built-in command.  This allows
        specifying <literal>%<replaceable>job</replaceable></literal>
        which is equivalent to the corresponding process group.  Note
        that this built-in command returns the exit status
        <literal>2</literal> instead of <literal>1</literal> if a
        fatal error occurs as other built-in commands do.</para>

      <para revision="217176,217472">A bug in the &man.sh.1; program has been
        fixed for POSIX conformance.  It could return an incorrect exit
        status when an <command>exit</command> command with no
        parameter is specified in the <literal>EXIT trap</literal>
        handler, which is triggered when the shell terminates.
        In trap actions for other signals, an <command>exit</command>
        command with no parameter returns an exit status corresponding
        to the received signal.</para>

      <para revision="217557">A bug in the &man.sh.1; program has been
        fixed.  When a foreground job exits on a signal, a message is
        printed to <filename>stdout</filename> about this. The buffer
        was not flushed after printing which could result in the message
        being written to the wrong file if the next command was a
        built-in and had <filename>stdout</filename> redirected.</para>

      <para revision="217461">The &man.sh.1; program now supports a
        <option>--</option> flag in <command>trap</command> command to
        stop the option processing.</para>

      <para revision="217206">The <literal>%builtin</literal> keyword
        support in the <varname>$PATH</varname> variable has been removed
        from the &man.sh.1; program.  All built-in commands are always
        found before looking up directories in
        <varname>$PATH</varname>.</para>

      <para revision="218466">Arithmetic expression handling code in
        the &man.sh.1; program has been updated by importing code from
        <application>dash</application>.  It now supports the conditional
        operator (<literal>?:</literal>) and a bug in evaluation of
        &amp;&amp; and || around an arithmetic expression has been
        fixed.</para>

      <para revision="224536">A bug in the &man.tftpd.8; daemon has
        been fixed.  It had an interoperability issue when
        transferring a large file.</para>

      <para revision="202188">The &man.utmp.5; user accounting
        database has been replaced by &man.utmpx.3;. User accounting
        utilities will now use <filename>utmpx</filename> database
        files exclusively.  The &man.wtmpcvt.1; utility can be used to
        convert <filename>wtmp</filename> files to the new format,
        making it possible to read them using the updated
        utilities.</para>

      <para revision="218847">A &man.utxrm.8; utility has been added.
        This allows one to remove an entry from the
        <filename>utmpx</filename> database by hand. This is useful
        when a login daemon crashes or fails to remove the entry
        during shutdown.</para>

      <para revision="224171">The &man.zpool.8: utility now supports a
        <command>zpool labelclear</command> command.  This allows to
        wipe the label data from a drive that is not active in a
        pool.</para>
  </sect2>

  <sect2 id="contrib">
    <title>Contributed Software</title>

      <para revision="222544"><literal>ACPI CA</literal> has been
        updated to version 20110527.</para>

      <para revision="224731">The <application>awk</application> has
        been updated to the 7 August 2011 release.</para>

      <para revision="228189"><application>ISC BIND</application> has
        been updated to version 9.8.1-P1.</para>

      <para revision="218822"><application>GNU binutils</application>
        has been updated to 2.17.50 (as of 3 July 2007), which is the
        last available version under GPLv2.</para>

      <para revision="222656">The
        <application>compiler-rt</application> library, which provides
        low-level target-specific interfaces such as functions in
        <application>libgcc</application>, has been imported.</para>

      <para revision="224014"><literal>dialog</literal> has been
        updated to version 1.1-20110707.</para>

      <para revision="221793">The <literal>netcat</literal> utility
        has been updated to version 4.9.</para>

      <para revision="223328">The <application>tnftp</application> (formerly
        known as <application>lukemftp</application>) has been updated
        to tnftp-20100108.</para>

      <para revision="220150"><application>GNU GCC</application> and
        <application>libstdc++</application> have been updated to rev
        127959 of <literal>gcc-4_2-branch</literal> (the last
        GPLv2-licensed version).</para>

      <para revision="219557"><application>gdtoa</application>, a set
        of binary from/to decimal number conversion routines used in
        &os;'s <application>libc</application> library has been updated
        to a snapshot as of 4 March, 2011.</para>

      <para revision="222906">The <application>LESS</application>
        program has been updated to version v444.</para>

      <para revision="208954">The <application>LLVM</application>
        compiler infrastructure and
        <application>clang</application>, a C language family
        front-end, version 3.0 have been imported.  Note that it is not
        used for building the &os; base system by default.  In the &os; build
        infrastructure, the &man.clang.1;, &man.clang...1;, and
        &man.clang-cpp.1; utilities can be used in
        <varname>CC</varname>, <varname>CXX</varname>, and
        <varname>CPP</varname> &man.make.1; variables,
        respectively.</para>

      <para revision="219734"><application>Openresolv</application>
        version 3.4.4 has been imported.  The &man.resolvconf.8;
        utility now manages the &man.resolv.conf.5; file.</para>

      <para revision="221484,224638">The
        <application>OpenSSH</application> utility has been updated to
        5.8p2, and optimization for large bandwidth-delay product
        connection and <literal>none</literal> cipher support have
        been merged</para>

      <para revision="223637">The <application>pf</application> packet
        filter has been updated to version 4.5.</para>

      <para revision="223067"><application>sendmail</application>
        has been updated to version 8.14.5.</para>

      <para revision="226750">The <application>timezone</application>
        database has been updated to the
        <application>tzdata2011m</application> release.</para>

      <para revision="217698">The &man.unifdef.1; utility has been updated
        to version 2.5.6.</para>

      <para revision="223935">The <application>xz</application>
        program has been updated from 5.0.0 to a snapshot as of 11
        July, 2011.</para>
    </sect2>

  <sect2 id="releng">
    <title>Release Engineering and Integration</title>

      <para revision="218799">A new installer &man.bsdinstall.8; has
        been added and integrated into installation ISO images.  The
        &man.sysinstall.8; utility is also available for configuration
        after the installation.</para>

      <para>The supported version of
        the <application>KDE</application> desktop environment
        (<filename role="package">x11/kde4</filename>) has been
        updated from 4.5.5 to 4.7.3.</para>
  </sect2>
</sect1>

<sect1 id="upgrade">
  <title>Upgrading from previous releases of &os;</title>

    <sect2>
      <title>Upgrading using freebsd-update(8) or a source-based
        procedure</title>

  <para arch="amd64,i386">Beginning with &os; 6.2-RELEASE,
    binary upgrades between RELEASE versions (and snapshots of the
    various security branches) are supported using the
    &man.freebsd-update.8; utility.  The binary upgrade procedure will
    update unmodified userland utilities, as well as a unmodified GENERIC kernel
    distributed as a part of an official &os; release.
    The &man.freebsd-update.8; utility requires that the host being
    upgraded have Internet connectivity.</para>

  <para>Source-based upgrades (those based on recompiling the &os;
    base system from source code) from previous versions are
    supported, according to the instructions in
    <filename>/usr/src/UPDATING</filename>.</para>

      <para>For more specific information about upgrading
        instructions, see <ulink
        url="http://www.FreeBSD.org/releases/9.0R/installation.html"></ulink>.</para>

  <important>
    <para>Upgrading &os; should, of course, only be attempted after
      backing up <emphasis>all</emphasis> data and configuration
      files.</para>
  </important>
    </sect2>

    <sect2>
      <title id="upgrade-pitfalls">User-visible incompatibilities</title>

      <para>This section describes notable incompatibilities which you
        might want to know before upgrading your system.
        <emphasis>Please read this section and the <ulink
        url="http://www.FreeBSD.org/releases/9.0R/errata.html">Errata
            document</ulink> carefully before submitting a problem report
        and/or posting a question to the FreeBSD mailing
        lists.</emphasis></para>

      <sect3>
        <title>Update of <literal>dialog</literal></title>

        <para>The <literal>dialog</literal> library is used in &os;'s
          new installer and the &os; Ports Collection to display a dialog
          window and allow users to select various options.  Note that
          it is updated in &release.current; and there are several
          differences in key operations which might confuse users
          who are familiar with releases prior to &release.current;.
          For example, pushing the enter key in a checklist window will
          no longer check an item.  The new version
          consistently uses space bar for selecting an item and the
          enter key for OK/Cancel selection.</para>
      </sect3>

      <sect3>
        <title>Partition Metadata Integrity Check</title>

        <para>&os; now checks the integrity of partition metadata when
          a partition table is found on a disk though the GEOM
          <application>PART</application> subsystem.  This detection
          is automatically performed when a disk device is ready.
          The GEOM <application>PART</application> class in the kernel
          verifies all generic partition parameters obtained from the
          disk metadata, and if some inconsistency is detected, the
          partition table will be rejected with the following
          diagnostic message:</para>

        <screen>GEOM_PART: Integrity check failed</screen>

        <para>This integrity check is enabled by default.  On a system
          prior to &release.current;, the inconsistencies were
          silently ignored.  Therefore, there is a possibility that this
          prevents a system from booting after upgrading it to
          &release.current;.  More specifically, the kernel cannot
          mount the system partition at boot time in some
          cases.</para>

        <para>If this happens, a &man.loader.8; tunable
          <varname>kern.geom.part.check_integrity</varname> can be
          used as a workaround.  Enter the following lines in the
          &man.loader.8; prompt at boot time:</para>

        <screen><userinput>set kern.geom.part.check_integrity="0"</userinput>
<userinput>boot</userinput></screen>

        <para>These commands temporarily disable the integrity check.
          If it was the cause of the boot failure, the &os; kernel should detect the
          partitions as the prior release
          did, after entering the commands.  This configuration can be added into
          <filename>/boot/loader.conf</filename> as follows:</para>

        <programlisting>kern.geom.part.check_integrity="0"</programlisting>

        <para>To check inconsistent metadata after booting on the
          system, use the &man.gpart.8; utility on the system.  A
          corrupted entry will be displayed like the following:</para>

        <screen>&prompt.user; gpart show
=>        63  1953525104  mirror/gm0  MBR  (931G) [CORRUPT]
          63  1953525105           1  freebsd  [active]  (931G)</screen>

        <para>For more information, see the &man.gpart.8; manual page.</para>
      </sect3>

      <sect3>
        <title>ATA/SATA subsystem now &man.cam.4;-based</title>

        <para>In &release.current;, the &os; ATA/SATA disk subsystem has
          been replaced with a new &man.cam.4;-based implementation.
          &man.cam.4; stands for Common Access Method, which is an
          implementation of an API set originally for SCSI-2 and
          standardized as "SCSI-2 Common Access Method Transport and
          SCSI Interface Module".  &os; has used the &man.cam.4; subsystem
          to handle SCSI devices since 3.X.</para>

        <para>Although the new &man.cam.4;-based ATA/SATA subsystem
          provides various functionality which the old &man.ata.4; did
          not have, it also has some incompatibilities:</para>

        <itemizedlist>
          <listitem>
            <para>An ATA/SATA disk is now recognized as a device node
              with a name
              <devicename>ada<replaceable>0</replaceable></devicename>
              instead of
              <devicename>ad<replaceable>0</replaceable></devicename>.
              Currently, a symbolic link
              <filename>/dev/ad<replaceable>0</replaceable></filename>
              is automatically generated for
              <filename>/dev/ada<replaceable>0</replaceable></filename>
              to keep backward compatibility.  This symbolic link
              generation can be controlled by a
              <varname>kern.cam.ada.legacy_aliases</varname> (enabled
              by default).  You might want to update
              <filename>/etc/fstab</filename> and/or consider using
              volume labels (see &man.glabel.8; for more details) for
              specifying each file system to be mounted.</para>
          </listitem>

          <listitem>
            <para>The &man.atacontrol.8; utility cannot be used for
              &man.cam.4;-based devices.  The &man.camcontrol.8
              utility is a replacement.</para>
          </listitem>

          <listitem>
            <para>&man.ataraid.4; software RAID is now supported by the
              &man.graid.8; GEOM class.  It generates a device node
              with a name
              <filename>/dev/raid/r<replaceable>0</replaceable></filename>
              if you previously had
              <filename>/dev/ar<replaceable>0</replaceable></filename>.
              Note that this is not enabled by default.  To enable it,
              enter the following line in the &man.loader.8; prompt:</para>

            <screen>set geom_raid_load="YES"
boot</screen>

            <para>or add the following line to
              <filename>/boot/loader.conf</filename>:</para>

            <programlisting>geom_raid_load="YES"</programlisting>

            <para>and reboot the system.  A symbolic link like
              <filename>/dev/ar<replaceable>0</replaceable></filename>
              will NOT be generated for
              <filename>/dev/raid/r<replaceable>0</replaceable></filename>.
              Therefore, if your system used
              <filename>/dev/ar<replaceable>0</replaceable></filename>
              as the root partition, mounting local file systems will
              fail because it is renamed to
              <filename>/dev/raid/r<replaceable>0</replaceable></filename>.
              You need to update <filename>/etc/fstab</filename>
              manually in that case.</para>
          </listitem>

          <listitem>
            <para>The &man.burncd.8; utility does not work with
              &man.cam.4;-based devices.  Use the cdrecord(1) utility
              in <filename role="package">sysutils/cdrtools</filename>
              instead.</para>
          </listitem>
        </itemizedlist>
      </sect3>

      <sect3>
        <title>Network Configuration Changes in
          <filename>/etc/rc.conf</filename></title>

        <para>Although variables in &man.rc.conf.5; are basically
          compatible with earlier releases, ones related to network
          configuration are changed because of reorganization of the
          &man.rc.8; scripts.</para>

        <itemizedlist>
          <listitem>
            <para>An address configuration now always needs an address
              family keyword.  For example, the following line</para>

            <programlisting>ifconfig_em0="192.168.2.1 netmask 255.255.255.0"</programlisting>

            <para>should be</para>

            <programlisting>ifconfig_em0="inet 192.168.2.1 netmask 255.255.255.0"</programlisting>

            <para>Although the old convention is still supported in
              the existing variables for backward compatibility, some
              new variables do not support it.</para>
          </listitem>

          <listitem>
            <para>The
              <varname>ifconfig_<replaceable>IF</replaceable>_alias<replaceable>0</replaceable></varname>
              variable now requires an address family keyword to
              support non-IPv4 address families.  For instance,</para>

            <programlisting>ifconfig_em0_alias0="192.168.2.10 netmask 255.255.255.255"</programlisting>

            <para>should be</para>

            <programlisting>ifconfig_em0_alias0="inet 192.168.2.10 netmask 255.255.255.255"</programlisting>

            <para>Different address families can coexist like the
              following:</para>

            <programlisting>ifconfig_em0_alias0="inet 192.168.2.10 netmask 255.255.255.255"
ifconfig_em0_alias1="inet6 2001:db8:1::1 prefixlen 64"</programlisting>

            <para>Note that IPv6 alias configurations in
              <varname>ifconfig_<replaceable>IF</replaceable>_alias<replaceable>N</replaceable></varname>
              will be ignored when no
              <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname>
              variable is defined because it determines whether IPv6
              functionality is enabled on that interface or not (this
              variable will be explained later).</para>
          </listitem>

          <listitem>
            <para>All alias and static routing configurations
              through &man.rc.conf.5; variables will be deactivated when
              invoking &man.rc.8; scripts or the &man.service.8; command
              with the <literal>stop</literal> keyword.</para>

            <screen>&prompt.root; service netif stop em0</screen>

            <para>stops the interface <literal>em0</literal>.</para>

            <screen>&prompt.root; service routing stop</screen>

            <para>deactivates all static route configurations.</para>

            <para>Releases prior to &os; &release.current; did not
              support this functionality properly for non-IPv4
              protocols.</para>
          </listitem>

          <listitem>
            <para>IPv6 configuration handling has been changed in the
              following way.  Before in-depth explanations, here is a
              before-and-after example.  What was previously:</para>

            <programlisting>ifconfig_em0="192.168.2.1 netmask 255.255.255.0"
ifconfig_em0_alias0="192.168.2.2 netmask 255.255.255.255"

ipv6_enable="YES"
ipv6_ifconfig_em0="2001:db8:1::1 prefixlen 64"
ipv6_ifconfig_em0_alias0="2001:db8:2::1 prefixlen 64"
# em1 uses SLAAC for IPv6 address configuration</programlisting>

            <para>should be in &release.current;:</para>

            <programlisting>ifconfig_em0="inet 192.168.2.1 netmask 255.255.255.0"
ifconfig_em0_ipv6="inet6 2001:db8:1::1 prefixlen 64 accept_rtadv"
ifconfig_em0_alias0="inet 192.168.2.2 netmask 255.255.255.255"
ifconfig_em0_alias1="inet6 2001:db8:2::1 prefixlen 64"

ifconfig_em1_ipv6="inet6 accept_rtadv"</programlisting>

            <para>More specific explanations of the changes are as
              follows:</para>

            <itemizedlist>
              <listitem>
                <para>The <varname>ipv6_enable</varname> variable is
                  deprecated.  IPv6 functionality on the system is
                  enabled by default.  No IPv6 communication will
                  happen if you configure no IPv6 address.</para>

                <para>&release.current; now supports intermediate
                  configurations between a host and a router IPv6
                  node.  The <varname>ipv6_enable</varname> variable
                  assumed that the system was a host node when
                  <varname>ipv6_gateway_enable</varname> was set to
                  <literal>NO</literal> (default), and a router node
                  if not.  A host node always accepted ICMPv6 Router
                  Advertise messages, and a router did not.</para>

                <para>In &release.current;, this model is still
                  applied but on a per-interface basis, not a
                  system-wide basis.  Specifically, if an interface has
                  an <literal>ACCEPT_RTADV</literal> flag, RA messages
                  will be accepted on that interface for SLAAC
                  (StateLess Address AutoConfiguration) regardless of
                  whether the packet forwarding is enabled or
                  not.</para>

                <para>In addition to them, a per-interface flag
                  <literal>NO_RADR</literal> and a &man.sysctl.8;
                  variable <varname>net.inet6.ip6.rfc6204w3</varname>
                  have been added.  This controls whether default
                  router list information via RA messages on an
                  RA-accepting interface should be ignored or not.  In
                  an IPv6 router model, it is not supposed to accept
                  RA messages as an information source for the default
                  router list.  Because of that, &os; &release.current;
                  ignores the default router list part when IPv6
                  packet forwarding is enabled, even if the interface
                  has an <literal>ACCEPT_RTADV</literal> flag.  However,
                  this can make for a difficult situation when the system
                  has to work as a CPE (Customer Premises Equipment)
                  which needs RA messages from the upstream network
                  for network configuration and acts as a router for
                  the LAN simultaneously.  For more information about
                  this kind of configuration, see RFC 6204.</para>

                <para>To support this kind of configuration, the
                  <varname>ipv6_cpe_wanif</varname> variable in
                  &man.rc.conf.5; can be used.</para>

                <programlisting>ipv6_gateway_enable="YES"
ipv6_cpe_wanif="em0"</programlisting>

                <para>means the <literal>em0</literal> interface
                  accepts RA messages and the default router
                  information in them, and the other interfaces ignore
                  the default router information part even when
                  the <literal>ACCEPT_RTADV</literal> flag is set on
                  them.</para>

                <para><varname>ipv6_cpe_wanif</varname> handling internally
                  sets the <varname>net.inet6.ip6.rfc6204w3</varname>
                  and the <varname>net.inet6.ip6.no_radr</varname>
                  &man.sysctl.8; variables to <literal>1</literal>.
                  Note that both are set to <literal>0</literal> by
                  default.  When the former is set to
                  <literal>1</literal>, &os; accepts the default
                  router list even when IPv6 packet forwarding is
                  enabled.  Note that a system administrator needs to
                  set a <literal>NO_RADR</literal> flag on the other
                  RA-accepting interfaces, if any, to prevent it from
                  accepting unexpected default router information.
                  The latter variable means the <literal>NO_RADR</literal> flag is automatically
                  set on them.</para>

                <para>If <literal>ipv6_enable="YES"</literal> is
                  defined in &os; &release.current;, it sets
                  <literal>ipv6_activate_all_interfaces="YES"</literal>
                  in <filename>/etc/rc.conf</filename> and the
                  <literal>inet6 accept_rtadv</literal>
                  &man.ifconfig.8; option on all network interfaces.
                  Note that this is only for backward compatibility.
                  The <varname>ipv6_enable</varname> should not be
                  used in &os; &release.current;.</para>
              </listitem>

              <listitem>
                <para>The
                  <varname>ipv6_ifconfig_<replaceable>IF</replaceable></varname>
                  variable is renamed to
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname>.
                  This variable controls whether IPv6 functionality
                  should be enabled on that interface or not.  If
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname>,
                  is not set, there is no IPv6 functionality on the interface
                  <replaceable>IF</replaceable>.</para>

                <para>Note that the
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname> variable
                  always needs the address family keyword
                  <literal>inet6</literal>.  If you need an automatic
                  link-local address only, the following line is enough:</para>

                <programlisting>ifconfig_em0_ipv6="inet6 auto_linklocal"</programlisting>

                <para>If you need full-blown IPv6 functionality on all
                  interfaces like prior releases with
                  <literal>ipv6_enable="YES"</literal>, including ones
                  with no
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6
                  line</varname>, you might want to use the
                  <varname>ipv6_activate_all_interfaces</varname>
                  variable as explained later.</para>

                <para>If <literal>ipv6_ifconfig_<replaceable>IF</replaceable>="..."</literal> is
                  defined in &os; &release.current;, it means
                  <literal>ifconfig_<replaceable>IF</replaceable>_ipv6="inet6 ..."</literal>.
                  Note that this is only for backward compatibility.
                  The <literal>inet6</literal> address family keyword
                  is required for <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname>,
                  but was NOT required for
                  <varname>ipv6_ifconfig_<replaceable>IF</replaceable></varname>.  The
                  <varname>ipv6_ifconfig_<replaceable>IF</replaceable></varname> variables should not be
                  used in &release.current;.</para>
              </listitem>

              <listitem>
                <para>An interface with no corresponding
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname> variable is
                  marked with an <literal>IFDISABLED</literal> flag by
                  &man.devd.8; daemon.  This flag means IPv6
                  communication is disabled on that interface.  This
                  can also be found in output of
                  &man.ifconfig.8;:</para>

                <screen>&prompt.user; ifconfig em0
em0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; metric 0 mtu 1500
        options=9b&lt;RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM&gt;
        ether xx:xx:xx:xx:xx:xx
        inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
        nd6 options=3&lt;PERFORMNUD,IFDISABLED,ACCEPT_RTADV&gt;
        media: Ethernet autoselect (1000baseT &lt;full-duplex&gt;)
        status: active
</screen>

                <para>To enable IPv6 functionality, this flag should
                  be removed first.  There are several ways to do so.
                  Adding an IPv6 address automatically removes this
                  flag.  It is possible to remove this flag explicitly
                  by using the following command:</para>

                <screen>&prompt.root; ifconfig em0 inet6 -ifdisabled</screen>

                <para>Note that defining an
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname> is the most
                  reasonable way to activate IPv6 functionality on
                  that interface.  This <literal>IFDISABLED</literal>
                  flag is to prevent unintended IPv6 communications
                  in an IPv4-only environment even when the interface
                  has an IPv6 link-local address.  If you need
                  full-blown IPv6 functionality on all interfaces, you
                  might want to use the
                  <varname>ipv6_activate_all_interfaces</varname>
                  variable as explained later.</para>
              </listitem>

              <listitem>
                <para>The &man.sysctl.8; variable
                  <varname>net.inet6.ip6.accept_rtadv</varname> has
                  been changed.  It was a system-wide configuration
                  knob which controlled whether the system accepts ICMPv6
                  Router Advertisement messages or not.  In
                  &os; &release.current;, this knob is converted into a
                  per-interface <literal>inet6 accept_rtadv</literal>
                  &man.ifconfig.8; option.  Although the
                  &man.sysctl.8; variable is available still in
                  &os; &release.current;, it now controls whether the
                  per-interface option is set by default or not.  The
                  default value is <literal>0</literal> (not accept
                  the RA messages).</para>
              </listitem>

              <listitem>
                <para>The &man.sysctl.8; variable
                  <varname>net.inet6.ip6.auto_linklocal</varname> has
                  been changed.  It was a system-wide configuration
                  knob which controlled whether an IPv6 link-local address
                  was generated on a network interface when it became
                  up.  In &os; &release.current;, this knob is converted
                  into a per-interface <literal>inet6
                  auto_linklocal</literal> &man.ifconfig.8; option.
                  Although the &man.sysctl.8; variable is still available
                  in &os; &release.current;, it now controls whether the
                  per-interface option is set by default or not.  The
                  default value is <literal>1</literal> (generate a
                  link-local automatically).</para>
              </listitem>

              <listitem>
                <para>The functionality of
                  <varname>ipv6_ifconfig_<replaceable>IF</replaceable>_alias<replaceable>0</replaceable></varname>
                  is integrated into
                  <varname>ifconfig_<replaceable>IF</replaceable>_alias<replaceable>0</replaceable></varname>.
                  Note that address family keywords are always required:</para>

                <programlisting>ifconfig_em0_alias0="inet 192.168.2.10 netmask 255.255.255.255"
ifconfig_em0_alias1="inet6 2001:db8:1::1 prefixlen 64</programlisting>

                <para>Although
                  <varname>ipv6_ifconfig_<replaceable>IF</replaceable>_alias<replaceable>N</replaceable></varname>
                  is still usable in &os; &release.current;, it is only for
                  backward compatibility.</para>
              </listitem>

              <listitem>
                <para>A new
                  <varname>ipv6_activate_all_interfaces</varname> variable
                  has been added.  If this variable is set to
                  <literal>YES</literal>, the <literal>IFDISABLED</literal>
                  option will not be added even if
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname> variables are not
                  defined.  This can prevent <literal>IFDISABLED</literal>
                  on dynamically-added interfaces such as &man.ppp.4;,
                  &man.tap.4;, and &man.ng.iface.4; where defining
                  <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname> in advance is
                  difficult.</para>
              </listitem>
            </itemizedlist>
          </listitem>
        </itemizedlist>
      </sect3>

      <sect3>
        <title>Openresolv and <filename>/etc/resolv.conf</filename></title>

        <para>The &man.resolvconf.8; utility has been added and it now
          handles updating the &man.resolv.conf.5; file.  Direct
          modifications to <filename>/etc/resolv.conf</filename> can
          be overwritten by network configuration utilities such as
          &man.dhclient.8; and &man.rtsold.8;.</para>
      </sect3>

      <sect3>
        <title>Disk Partition Management Utilities</title>

        <para>In earlier releases various utilities were available to
          manage disk partition information.  They are deprecated in
          favor of the &man.gpart.8; utility.  Specifically, the
          &man.fdisk.8;, &man.disklabel.8; &man.bsdlabel.8;, and
          &man.sunlabel.8; utilities are no longer supported actively
          though these are still available for backward
          compatibility.</para>
      </sect3>
    </sect2>
  </sect1>
</article>