---
title: "FreeBSD 13.2-RELEASE Release Notes"
sidenav: download
---

:releaseCurrent: 13.2-RELEASE
:releaseBranch: 13-STABLE
:releasePrev: 13.1-RELEASE
:releaseNext: 13.3-RELEASE
:releaseType: release

include::shared/en/urls.adoc[]

= FreeBSD {releaseCurrent} Release Notes
:doctype: article
:toc: macro
:toclevels: 1
:icons: font

== Abstract

[.abstract-title]
The release notes for FreeBSD {releaseCurrent} contain a summary of the changes made to the FreeBSD base system on the {releaseBranch} development line.
This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland.
Some brief remarks on upgrading are also presented.

[[intro]]
== Introduction

This document contains the release notes for FreeBSD {releaseCurrent}.
It describes recently added, changed, or deleted features of FreeBSD.
It also provides some notes on upgrading from previous versions of FreeBSD.

The {releaseType} distribution to which these release notes apply represents the latest point along the {releaseBranch} development branch since {releaseBranch} was created.
Information regarding pre-built, binary {releaseType} distributions along this branch can be found at https://www.FreeBSD.org/releases/[].

The {releaseType} distribution to which these release notes apply represents a point along the {releaseBranch} development branch between {releasePrev} and the future {releaseNext}.
Information regarding pre-built, binary {releaseType} distributions along this branch can be found at https://www.FreeBSD.org/releases/[].

This distribution of FreeBSD {releaseCurrent} is a {releaseType} distribution.
It can be found at https://www.FreeBSD.org/releases/[] or any of its mirrors.
More information on obtaining this (or other) {releaseType} distributions of FreeBSD can be found in the link:{handbook}/mirrors[Obtaining FreeBSD appendix] to the link:{handbook}/[FreeBSD Handbook].

All users are encouraged to consult the release errata before installing FreeBSD.
The errata document is updated with "late-breaking" information discovered late in the release cycle or after the release.
Typically, it contains information on known bugs, security advisories, and corrections to documentation.
An up-to-date copy of the errata for FreeBSD {releaseCurrent} can be found on the FreeBSD Web site.

This document describes the most user-visible new or changed features in FreeBSD since {releasePrev}.
In general, changes described here are unique to the {releaseBranch} branch unless specifically marked as MERGED features.

Typical release note items document recent security advisories issued after {releasePrev}, new drivers or hardware support, new commands or options, major bug fixes, or contributed software upgrades.
They may also list changes to major ports/packages or release engineering practices.
Clearly the release notes cannot list every single change made to FreeBSD between releases; this document focuses primarily on security advisories, user-visible changes, and major architectural improvements.

[[upgrade]]
== Upgrading from Previous Releases of FreeBSD

Binary upgrades between RELEASE versions (and snapshots of the various security branches) are supported using the man:freebsd-update[8] utility.
The link:{handbook}cutting-edge/#freebsdupdate-upgrade[binary upgrade procedure] will update unmodified userland utilities, as well as unmodified GENERIC kernels distributed as a part of an official FreeBSD release.
The man:freebsd-update[8] utility requires that the host being upgraded have Internet connectivity.

Source-based upgrades (those based on recompiling the FreeBSD base system from source code) from previous versions are supported, according to the instructions in [.filename]#/usr/src/UPDATING#.

Users of all PowerPC architectures, after successful kernel and world installation, must run `kldxref /boot/kernel` manually.

[IMPORTANT]
====
Upgrading FreeBSD should only be attempted after backing up **all** data and configuration files.
====

[IMPORTANT]
====
After installing the new userland software, running daemons are still from the previous version.
After installing the user-level components with the second invocation of freebsd-update, or via an upgrade from source with `installworld`, the system should be rebooted to start everything with the new software.
For example, older versions of `sshd` failed to process incoming connections correctly after the new [.filename]#/usr/sbin/sshd# was installed; rebooting started a new `sshd` and other daemons.
====

////
XXX: gjb will fill this in just before the release is final
[[security-errata]]
== Security and Errata

This section lists the various Security Advisories and Errata Notices since {releasePrev}.

[[security]]
=== Security Advisories

[width="100%",cols="40%,30%,30%",options="header",]
|===
|Advisory |Date |Topic
|link:https://www.freebsd.org/security/advisories/FreeBSD-SA-20:31.icmp6.asc[FreeBSD-SA-20:31.icmp6] |1 December 2020 |Use-after-free in error message handling
|===

[[errata]]
=== Errata Notices

[width="100%",cols="40%,30%,30%",options="header",]
|===
|Errata |Date |Topic
|link:https://www.freebsd.org/security/advisories/FreeBSD-EN-20:19.audit.asc[FreeBSD-EN-20:19.audit] |1 December 2020 |execve/fexecve system call auditing
|===
////

[[userland]]
== Userland

This section covers changes and additions to userland applications, contributed software, and system utilities.

[[userland-config]]
=== Userland Configuration Changes

// SAMPLE ENTRY:
// A new man:rc.conf[5] variable has been added, `linux_mounts_enable`, which controls if Linux(R)-specific filesystems are mounted in [.filename]#/compat/linux# if `linux_enable` is set to `YES`.
// gitref:1234567890ab[repository=src] (Sponsored by The FreeBSD Foundation)

The man:growfs[7] startup script will now add a swap partition while expanding the root file system if possible, and if one did not previously exist.
This is primarily useful when installing on an SD card using a raw image.
A new man:rc.conf[5] variable has been added, `growfs_swap_size`, which can control the addition if necessary.
See man:growfs[7] for details.

The `zfskeys` startup script supports autoloading of keys stored on ZFS.
gitref:2411090f6940[repository=src] (Sponsored by Klara Inc.)

A new RC script, `zpoolreguid` has been added, which will assign a new GUID to one or more zpools, useful for virtualization environments when sharing datasets.

The `hostid` startup script will now generate a random (version 4) UUID if there is no [.filename]#/etc/hostid# file and no valid UUID from hardware.
Also, if there is no [.filename]#/etc/machine-id# file, the `hostid_save` script will store a compact version of the hostid (one without hyphens) in [.filename]#/etc/machine-id#.
This file is used by libraries such as GLib.
gitref:17333d92643d[repository=src] gitref:a379d5c5efb2[repository=src] gitref:71d88613d129[repository=src]

It is now possible to add default routes for FIBs other than the primary by using the `defaultrouter_fibN` and `ipv6_defaultrouter_fibN` man:rc.conf[5] variables.
gitref:c6ec1b441ad3[repository=src] (Sponsored by ScaleEngine Inc.)

[[userland-programs]]
=== Userland Application Changes

The man:bhyve[8] utility has gained virtio-input device emulation support.
This will be used to inject keyboard/mouse input events into a guest.
The command line syntax is: `-s <slot>,virtio-input,/dev/input/eventX`.
gitref:6192776124c5[repository=src]

The man:kdump[1] utility has gained support for decoding Linux system calls.

The man:killall[1] utility now allows sending signals to processes with their controlling terminal on man:pts[4] using the syntax `-t pts/N`.
gitref:a76fa7bb6cb7[repository=src]

An man:nproc[1] utility has been added, compatible with the Linux program of the same name.

The man:timeout[1] utility has been moved from [.filename]#/usr/bin# to [.filename]#/bin#.

The man:pciconf[8] utility has added support for decoding ACS extended capability.
gitref:dde4103a465b[repository=src] (Sponsored by Chelsio Communications)

The man:procstat[1] utility can now print information about advisory locks on files with the newly added `advlock` command.
gitref:f9daaf452a8a[repository=src]

The man:pwd_mkdb[8] utility no longer copies comments from [.filename]#/etc/master.passwd# to [.filename]#/etc/passwd#.
gitref:3e955733117d[repository=src]

MSS clamping has been improved for man:ppp[8].
gitref:301bff9bdd62[repository=src]

Metric aliasing has been changed in man:prometheus_sysctl_exporter[8] to avoid confusing Prometheus server due to conflicting metric names.
The `tcp_log_bucket` UMA zone has been renamed to `tcp_log_id_bucket`, and `tcp_log_node` was renamed to `tcp_log_id_node` for consistency.
Sysctl variables with `(LEGACY)` in their descriptions are no longer being exported, these are used by ZFS sysctls that have been replaced by others, many of which alias to the same Prometheus metric name (like `vfs.zfs.arc_max` and `vfs.zfs.arc.max`).
gitref:e4f508d5a211[repository=src] (Sponsored by Axcient)

The man:uuidgen[1] utility has a new option `-r` to generate a random UUID, version 4.
gitref:8fd1953b7eb2[repository=src]

When invoked by man:inetd[8], `ctlstat -P` will now produce output suitable for ingestion into Prometheus; see man:ctlstat[8].
gitref:f7896015fcde[repository=src] (Sponsored by Axcient)

[[userland-contrib]]
=== Contributed Software

Gavin Howard's `bc` has been upgraded to version 6.2.4.

`expat` (`libbsdxml`) has been upgraded to version 2.5.0.

`file` has been upgraded to version 5.43.

`less` has been upgraded to version 608.

`libarchive` has been upgraded to version 3.6.2 with many reliability fixes.
Release notes are available at https://github.com/libarchive/libarchive/releases[].

`libedit` has been upgraded to version 2022-04-11.

`LLVM` and the `clang` compiler have been upgraded to version 14.0.5.

Supported `LLVM` sanitizers are now enabled on `powerpc64` and variants.

`mandoc` has been upgraded to version 1.14.6.

`OpenSSH` has been upgraded to version 9.3p1.

`OpenSSL` has been upgraded to version 1.1.1t.

`sendmail` has been upgraded to version 8.17.1. 
gitref:68e86d5265bc[repository=src]

`sqlite3` has been upgraded to version 3.40.1.

`tzcode` has been upgraded to version 2022g with improved timezone change detection and reliability fixes.

`tzdata` has been upgraded to version 2023c.

`unbound` has been upgraded to version 1.17.1.

`xz` has been upgraded to version 5.4.1.

`xz-embedded` has been upgraded to 3f438e15109229bb14ab45f285f4bff5412a9542.

`zlib` has been upgraded to version 1.2.13.

[[userland-libraries]]
=== Runtime Libraries and API

Support of SHA-512/224 has been added to `libmd`.
gitref:e04ee7d95ef6[repository=src] (Sponsored by Klara, Inc.)

Linux-style system call tracing is now supported by man:sysdecode[3] and man:kdump[1].

The native pthread library functions can now support Linux semantics.

[[kernel]]
== Kernel

This section covers changes to kernel configurations, system tuning, and system control parameters that are not otherwise categorized.

[[kernel-general]]
=== General Kernel Changes

The man:bhyve[8] hypervisor and kernel module man:vmm[4] now support more than 16 vCPUs in a guest.
By default bhyve permits each guest to create the same number of vCPUs as the count of physical CPUs on the host.
This limit can be adjusted via the loader tunable `hw.vmm.maxcpu`.
gitref:3e02f8809aec[repository=src]

Address Space Layout Randomization (ASLR) is enabled for 64-bit executables by default.
It can be disabled as needed if applications fail unexpectedly, for example with segmentation faults.
To disable for a single invocation, use the man:proccontrol[1] command: `proccontrol -m aslr -s disable command`.
To disable ASLR for all invocations of a binary, use the man:elfctl[1] command: `elfctl -e +noaslr file`.
Problems should be reported via the problem reporting system, https://bugs.freebsd.org[], or posting to the `freebsd-stable@FreeBSD.org` mailing list.
gitref:10192e77cfac[repository=src] (Sponsored by Stormshield)

A workaround has been implemented for a hardware page invalidation problem on Intel Alder Lake (twelfth generation) and Raptor Lake (thirteenth generation) hybrid CPUs.
The bug can lead to file system corruption with UFS and MSDOSFS, and probably other memory corruption.
The slower cores (E-cores) automatically use a slower method of page invalidation with the workaround.
gitref:567cc4e6bfd9[repository=src] (Sponsored by The FreeBSD Foundation)

A new kernel configuration knob is available, `SPLIT_KERNEL_DEBUG`, which controls splitting of kernel and module debug data into separate standalone files.
This interacts with the `WITHOUT_KERNEL_SYMBOLS` option, which operates differently than in 13.0-RELEASE and {releasePrev}, but similarly to prior releases; it now controls only installation of the debug data.
The defaults are `WITH_KERNEL_SYMBOLS` and `WITH_SPLIT_KERNEL_DEBUG`, allowing the kernel and modules without debug data to be installed in [.filename]#/boot#, and standalone debugging files to be installed in [.filename]#/usr/lib/debug#, as was done by default in releases before 13.0-RELEASE.
Using `WITHOUT_KERNEL_SYMBOLS` and `WITH_SPLIT_KERNEL_DEBUG`, standalone debugging files are generated but not installed, as when using `WITHOUT_KERNEL_SYMBOLS` in releases before 13.0-RELEASE.
Finally, using `WITHOUT_KERNEL_SYMBOLS` and `WITHOUT_SPLIT_KERNEL_DEBUG` installs the kernel and modules with built-in debugging information in [.filename]#/boot#, as in {releasePrev} using `WITHOUT_KERNEL_SYMBOLS`.
gitref:0c4d13c521aa[repository=src] (Sponsored by The FreeBSD Foundation)

On the PowerPC, a radix pmap in pseries is supported for ISA 3.0.
This should make pseries significantly faster on POWER9 instances, as fewer hypercalls are needed to manage pmap now.
gitref:c74c77531248[repository=src]

Support for man:ptrace[2] is now available for Linux processes on arm64.
gitref:99950e8beb72[repository=src]

In order to facilitate ABI compatibility of `stable` branches, the CPU affinity system calls are now more tolerant of CPU sets that are smaller than used by the kernel.
This will facilitate increases to the size of the kernel set, `MAXCPU`.
gitref:72bc1e6806cc[repository=src]

64-bit man:linux[4] ABI support was added for saving CPU floating point state across signal delivery.
gitref:0b82c544de58[repository=src], gitref:20d601714206[repository=src]

vDSO (virtual dynamic shared object) support has been nearly completed in the man:linux[4] ABI.
gitref:a340b5b4bd48[repository=src]

The state of the arm64 man:linux[4] ABI was brought to parity with the amd64 man:linux[4] ABI.
gitref:0b82c544de58[repository=src], gitref:a340b5b4bd48[repository=src]

[[drivers]]
== Devices and Drivers

This section covers changes and additions to devices and device drivers since {releasePrev}.

[[drivers-device]]
=== Device Drivers

The man:em[4] driver now correctly supports the full range of receive buffer sizes available on newer chips 82580 and i350.
gitref:3f8306cf8e2d[repository=src]

The man:ena[4] driver has been upgraded to version 2.6.2.
(Sponsored by Amazon, Inc.)

Basic support for Intel Alder Lake CPUs has been implemented for man:hwpmc[4].
gitref:b8ef2ca9eae9[repository=src]

The man:ice[4] driver has been updated to version 1.37.7-k.

The man:irdma[4] RDMA driver was introduced for the Intel E810 Ethernet Controller, supporting both RoCEv2 and iWARP protocols in per-PF manner, RoCEv2 being the default, and was upgraded to version 1.1.5-k.
gitref:42bad04a2156[repository=src] (Sponsored by Intel Corporation)

Initial support is now available for DPAA2 (second generation Data Path Acceleration Architecture – a hardware-level networking architecture found in some NXP SoCs).
It runs NXP-supplied firmware which provides DPAA2 objects as an abstraction layer, and provides a `dpni` network interface.
gitref:d5a64a935bc9[repository=src] (Sponsored by Bare Enthusiasm :) and Traverse Technologies)

The man:iwlwifi[4] driver for Intel wireless interfaces was updated.
(Sponsored by The FreeBSD Foundation)

The man:rtw88[4] driver was added to support several Realtek wireless PCI interfaces.
It is currently limited to 802.11 a/b/g operation.
See https://wiki.freebsd.org/WiFi/Rtw88[] for additional information.

There were many additions and improvements to the KPI for support of Linux device drivers.
(Sponsored by The FreeBSD Foundation)

[[storage]]
== Storage

This section covers changes and additions to file systems and other storage subsystems, both local and networked.

[[storage-nfs]]
=== NFS Changes

A problem causing NFS server hangs has been fixed; the problem was caused by a bug with SACK handling in TCP.

[[storage-ufs]]
=== UFS Changes

It is now possible to take snapshots on UFS filesystems when running with journaled soft updates.
Thus it is now possible to do background dumps on live filesystems running with journaled soft updates.
Background dumps are requested by using the `-L` flag to man:dump[8].
(In previous releases UFS snapshots were incompatible with journaled soft updates.)
gitref:3f908eed27b4[repository=src] (Sponsored by The FreeBSD Foundation)

[[boot]]
== Boot Loader Changes

This section covers the boot loader, boot menu, and other boot-related changes.

[[boot-loader]]
=== Boot Loader Changes

The `teken.fg_color` and `teken.bg_color` man:loader.conf[5] variables now accept a `bright` or `light` prefix (and color numbers 8 through 15) to select bright colors.
gitref:1dcb6002c500[repository=src] (Sponsored by The FreeBSD Foundation).
See also gitref:233ab015c0d7[repository=src]

Several bugs have been fixed in man:loader[8] that caused the video console output to disappear.
These appeared to be hangs after the boot loader starts the kernel.
(Sponsored by Netflix)

[[network]]
== Networking

This section describes changes that affect networking in FreeBSD.

[[network-general]]
=== General Network

The kernel man:wg[4] WireGuard driver has been reintegrated; it provides Virtual Private Network (VPN) interfaces using the WireGuard protocol.
gitref:5ae69e2f10da[repository=src] (Sponsored by Rubicon Communications, LLC ("Netgate") and The FreeBSD Foundation)

KTLS (the kernel TLS implementation) has added receive offload support for TLS 1.3.
Receive offload is now supported for TLS 1.1 through 1.3; send offload is supported for TLS 1.0 through 1.3.
gitref:1462dc95f796[repository=src] (Sponsored by Netflix)

The man:netlink[4] network configuration protocol is now available.
It is a communication protocol defined in RFC 3549, and uses a raw socket to exchange configuration information between user space and kernel.
It is used by third-party routing programs and by the man:linux[4] ABI.
The man:netlink[4] protocol is not included in the GENERIC configuration in {releaseCurrent}, but is available as a kernel module.
gitref:6058f6cc48f5[repository=src]

Radix tables and lookups are now supported for MAC addresses in man:ipfw[4].
This allows MAC address tables to be constructed and used for filtering.
gitref:c31f8b7bd895[repository=src]

Kernel modules dpdk_lpm4 and dpdk_lpm6 are now available and can be loaded via man:loader.conf[5].
They provide optimized routing functions for hosts with a very large amount of routing tables.
They can be configured via man:route[8] and are part of the modular FIB lookup mechanism.
gitref:0ca122044369[repository=src]

There are numerous bug fixes in TCP and SCTP.

[[future-releases]]
== General Notes Regarding Future FreeBSD Releases

`OPIE` has been deprecated and will be removed in FreeBSD 14.0.

The man:ce[4] and man:cp[4] synchronous serial drivers have been deprecated and will be removed in FreeBSD 14.0.

Drivers for ISA sound cards have been deprecated and will be removed in FreeBSD 14.0.
gitref:d7620b6ec941[repository=src] (Sponsored by The FreeBSD Foundation)

The man:mergemaster[8] utility has been deprecated and will be removed in FreeBSD 14.0.
Its replacement is man:etcupdate[8].
gitref:5fa16e3c50c5[repository=src] (Sponsored by The FreeBSD Foundation)

The man:minigzip[1] utility has been deprecated and will be removed in FreeBSD 14.0.
gitref:84d3fc26e3a2[repository=src]

The remaining components of ATM in netgraph (NgATM) have been deprecated and will be removed in FreeBSD 14.0.
Support for ATM NICs was removed previously.

The Telnet daemon, man:telnetd[8], has been deprecated and will be removed in FreeBSD 14.0.
The Telnet client is not affected.

The VINUM class in man:geom[8] has been deprecated and will be removed in a future release.

[[future-releases-cputype]]
=== Default `CPUTYPE` Change

Starting with FreeBSD-13.0, the default `CPUTYPE` for the i386 architecture will change from `486` to `686`.

This means that, by default, binaries produced will require a 686-class CPU, including but not limited to binaries provided by the FreeBSD Release Engineering team.
FreeBSD 13.x will continue to support older CPUs, however users needing this functionality will need to build their own releases for official support.

As the primary use for i486 and i586 CPUs is generally in the embedded market, the general end-user impact is expected to be minimal, as new hardware with these CPU types has long faded, and much of the deployed base of such systems is nearing retirement age, statistically.

There were several factors taken into account for this change.
For example, i486 does not have 64-bit atomics, and while they can be emulated in the kernel, they cannot be emulated in the userland.
Additionally, the 32-bit amd64 libraries have been i686 since their inception.

As the majority of 32-bit testing is done by developers using the lib32 libraries on 64-bit hardware with the `COMPAT_FREEBSD32` option in the kernel, this change ensures better coverage and user experience.
This also aligns with what the majority of Linux(R) distributions have been doing for quite some time.

This is expected to be the final bump of the default `CPUTYPE` in i386.

[IMPORTANT]
====
This change does not affect the FreeBSD 12.x series of releases.
====
