Problems described in the following security advisories have been fixed. For more information, consult the individual advisories available from http://security.FreeBSD.org/.

The maximum number of pages used for DMA bounce buffer pool has been increased from 256 to 1024.

The default value of kern.hz has been increased from 100 to 1000.

The SMP kernel now works on MPC7400-based Apple desktop machines such as PowerMac3,3.

FreeBSD/powerpc now supports DMA bounce buffer which is required on systems with larger RAM than 4GB.

FreeBSD/mips support has been improved. It now supports SMP on a SWARM with a dual-core Sibyte processor.

FreeBSD/mips now supports Netlogic Microsystems' XLR and XLS multi-core processor families.

FreeBSD/sparc64 now supports reservation-based physical memory allocation which provides better performance.

FreeBSD/amd64 now always sets the KVA space as equal to or larger than physical memory size. The default size was calculated based on one-third of the physical memory size by a code derived from one for i386. It has been changed because constraints for memory space are not severe on amd64 and this change would help to prevent a “kmem_map too small” panic which often occurs when using ZFS.

CPU topology detection for Intel CPUs has been improved.

ACPI suspend/resume functionality support has been improved.

FreeBSD kernel now supports kern_fpu_enter() and kern_fpu_leave() KPIs which allow the kernel subsystems to use XMM register files used in Intel SSE (Streaming SIMD Extensions).

The acpi(4) driver now uses ACPI Reset Register capability by default only when a flag in the FADT which indicates it is available. This behavior was controlled by a sysctl(8) variable hw.acpi.handle_reboot and the default value was always set to 0.

The acpi(4) driver now supports new loader tunables hw.acpi.install_interface and hw.acpi.remove_interface. For more details, see acpi(4) manual page.

The alq(9) support has been improved. The alq_writen() and alq_getn() KPIs have been extended to support variable length messages, which is enabled at ALQ creation time depending on the arguments passed to alq_open(). Also, the ALQ_NOACTIVATE and ALQ_ORDERED flags have been added to allow ALQ consumers to have more control over I/O scheduling and resource acquisition respectively. These extensions are fully backward compatible.

The alq(9) support is now provided as a kernel module alq.ko.

The ddb(8) kernel debugger now supports an optional delay in reset and reboot commands. This allows an administrator to break the system into debugger and trigger automatic textdump when an unattended panic occurs.

The ddb(8) kernel debugger now supports a show cdev command. This displays the list of all created cdev's, consisting of devfs node name and struct cdev address.

The FreeBSD GENERIC kernel is now compiled with KDB and KDB_TRACE options. From 8.2-RELEASE the kernel supports displaying a stack trace on panic by using stack(9) facility with no debugger backend like ddb(8). Note that this does not change the default behaviors of the GENERIC kernel on panic.

The following sysctl(8) variables are also now loader tunables: vm.kmem_size, vm.kmem_size_max, and vm.kmem_size_min, debug.kdb.stop_cpus, debug.trace_on_panic, and kern.sync_on_panic. Also, new sysctl(8) variables vm.kmem_map_size for the current kmem map size and vm.kmem_map_free for largest contiguous free range in kmem map, vfs.ncsizefactor for size factor for namecache, and vfs.ncnegfactor for ratio of negative namecache entries have been added.

The FreeBSD memguard(9) framework has been improved to make it able to detect use-after-free of allocated memories over a longer time. For more details, see memguard(9) manual page.

PT_LWPINFO request to obtain information about the kernel thread that caused the traced process to stop in the ptrace(2) process tracing and debugging facility has been improved. It now reports system call entry and leave events, as well as availability of siginfo_t accompanying the reported signal.

The FreeBSD crypto(4) framework (opencrypto) now supports XTS-AES (XEX-TCB-CTS, or XEX-based Tweaked Code Book mode with CipherText Stealing), which is defined in IEEE Std. 1619-2007.

Xen HVM support in FreeBSD/amd64 kernel has been improved. For more details, see xen(4) manual page.

The qpi(4) pseudo bus driver has been added. This supports extra PCI buses on Intel QPI chipsets where various hardware such as memory controllers for each socket is connected.

The arp(8) utility has been improved. It now runs faster even when a single interface has a number of aliases.

A bug in the b64decode(1) utility that prevented an -r option from handling arbitrary breaks in a base64 encoded string has been fixed.

The calendar(1) utility now supports repeating events which span multiple years, lunar events, and solar events.

The dhclient(8) utility now reports a reason for exiting and the 10-second period in which the dhclient(8) ignores routing messages has been changed to start just after dhclient-script starts instead of just after it finished. This change fixes a symptom that dhclient(8) silently exits under a certain condition.

Userland support for the dtrace(1) subsystem has been added. This allows inspection of userland software itself and its correlation with the kernel, thus allowing a much better picture of what exactly is going on behind the scenes. The dtruss(1) utility has been added and the libproc library has been updated to support the facility.

The du(1) utility now supports a -t threshold option to display entries that exceeds the value of threshold. If the value is negative, it displays entries with a value less than the absolute value of threshold.

The fdisk(8) utility now supports partitions which are provided by gjournal(8) or geli(8) GEOM classes.

The gcore(1) utility now supports an -f flag which forces a full dump of all the segments except for the malformed ones.

The geli(8) utility now supports resize subcommand to resize encrypted file systems after growing it.

The geli(8) utility now supports suspend and resume subcommands. The suspend subcommand makes geli(8) devices wait for all in-flight I/O requests, suspend new I/O requests, remove all geli(8) sensitive data from the kernel memory (like encryption keys) and will wait for either geli resume or geli detach command. For more information, see geli(8) manual page.

The geli(8) utility now checks the metadata provider size strictly. If the check fails, the provider is not attached. A new option -f can override this behavior.

The geli(8) utility now supports -J newpassfile and -j oldpassfile options for loading passphrase from a file.

The gethost*(), getnet*(), and getproto*() functions now set the errno to ERANGE and the NSS backend terminates with NS_RETURN when the result buffer size is too small.

The gpart(8) utility now supports a resize command to resize partitions for all schemes but EBR.

The gpart(8) utility now supports backup and restore subcommands to backup partition tables and restore them.

The gpart(8) utility now handles given geom/provider names with and without /dev/ prefix.

The gpart(8) utility now supports an -F option for the destroy subcommand. This option forces destroying of the partition table even if it is not empty.

The gpart(8) utility now supports a recover subcommand for GPT partition tables. A corrupted GPT is now marked when the following three types of corruption:

Changes to the corrupted GPT table are not allowed except for destroy and recover subcommands.

The gpart(8) utility now supports GPT_ENT_ATTR_BOOTME, GPT_ENT_ATTR_BOOTONCE, and GPT_ENT_ATTR_BOOTFAILED attributes in GPT. The attribute keywords in the command line are bootme, bootonce, and bootfailed respectively.

An issue in the newfs(8) utility has been fixed. A UFS1 file system created with 64KB blocksize was incorrectly recognized as one with a broken superblock. This is because the FreeBSD kernel checks a partition first for a UFS2 superblock at 64KB offset while it is possible that a UFS1 file systems with 64KB blocksize has an alternative superblock at the same location. For example, a file system created by newfs -U -O 1 -b 65536 -f 8192 could lead to this symptom.

The hastd(8) utility now supports SIGHUP for reloading the configuration file. When SIGTERM or SIGINT is received, the worker processes terminate.

The ifconfig(8) utility now check an invalid CIDR subnet notation more strictly. It wrongly accepted 10.0.0.1/10.0.0.1 as 10.0.0.1/10.

An accuracy issue in the jn(3) and jnf(3) functions in libm has been fixed.

Incorrect behaviors in stuttering sequences and reverse ranges in the jot(1) utility have been fixed.

The libarchive library and tar(1) utility now support LZMA (Lempel-Ziv-Markov chain-Algorithm) compression format.

The tar(1) utility now supports a blocksize which is up to 8192 (4MB) in the -b blocksize option.

A bug in the lpr(1) utility that prevented it from working with some files on a ZFS file system has been fixed.

The -p option in the mount(8) utility now displays the rw mount option correctly as in the fstab(5) format.

The ncal(1) utility has been updated. The option -b has been replaced with -C and -B number. Options -3 to show previous, current and next month, and -A number to show months after current month have been added. The option -m N YYYY now prints only the month, not the whole year.

The newsyslog(8) utility now supports an -S pidfile option to override the default syslogd(8) PID file.

The newsyslog(8) utility now supports a special log file name <include> for processing file inclusion. Globbing in the file name and circular dependency detection are supported. For more details, see the newsyslog.conf(5) manual page.

The ntpd(8) utility is now compiled with shared memory reference clock driver. For example, GPS devices can be used as source of precise time via astro/gpsd in the Ports Collection.

An off-by-one error in the pax(1) utility when ustar file name is too long has been fixed.

The pkill(1) utility now supports an -l option like the kill(1) utility does.

The pmcstat(8) utility now supports a file and a network socket as a top source. A new option -O filename specifies to send log output to filename, and another new option -R filename specifies to receive events from filename. For a socket, the filename is in a form of ipaddr:port. This allows top monitoring over TCP on a system with no local symbols, for example.

The pom(6) utility now supports a -p flag to print only the percentage.

The powerd(8) utility now supports an -m freq and -M freq to control the minimum and maximum frequency, respectively.

The ruptime(1) utility now displays hostnames longer than 12 characters.

A behavior of the sh(1) program when an -u option is specified has been changed. The special parameters $@ and $* no longer cause an error when there are no positional parameters.

A bug in the sh(1) program has been fixed. A SIGINT signal is now passed through from a child process if the shell is interactive and the job control is enabled. For example, aborting sleep(1) command by Ctrl-C no longer display ok in the following command line:

The sh(1) program now supports a bg command consisting solely of redirections. For example:

The sleep(1) utility now supports the SIGINFO signal and reports the specified sleep time and the remaining time.

The tftp(1) and tftpd(8) utilities have been improved for better interoperability and they now support RFC 1350, 2347, 2348, 2349, and 3617.

A bug in [=]=] equivalent class handling in the tr(1) utility has been fixed. A closing bracket immediately after [= was incorrectly treated as special.

The uname(1) utility now supports an -o flag as a synonym for the -s flag for compatibility with other systems.

Bugs in vi(1) utility have been fixed. They include handling of ^@ and ^C in insert mode when reading an ex command.

The watchdogd(8) program now uses MADV_PROTECT memory flag to protect itself from being terminated by the FreeBSD kernel when available memory becomes short. This kind of process termination happens in a swap-intensive workload.

The set sharenfs command in the zfs(8) utility now supports sec option.

The ACPI-CA has been updated to 20101013.

The ee(1) program has been updated to version 1.5.2.

ISC BIND has been updated to version 9.6-ESV-R3.

netcat has been updated to version 4.8.

OpenSSL has been updated to version 0.9.8q.

sendmail has been updated to version 8.14.7.

The timezone database has been updated to the tzdata2010o release.

The xz has been updated from snapshot as of 12 April 2010 to 5.0.0 release

The pkg_create(1) utility now supports LZMA (xz) compression. Note that the default is still bzip2.

The sysinstall(8) utility now uses the following numbers for default and minimum partition sizes: 1GB for /, 4GB for /var, and 1GB for /tmp.

The sysinstall(8) utility now attempts to enable getty(8) on a serial port when no VGA card is detected on the system.

The supported version of the GNOME desktop environment (x11/gnome2) has been updated to 2.32.1.

The supported version of the KDE desktop environment (x11/kde4) has been updated to 4.5.5.