Upgrade Erebor from FreeBSD 14.3 to 15.x

[scottmuc]

I was doing some patching and saw that 14.3 is EOL soon:

ansible@erebor:~ $ doas freebsd-update fetch
src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 14.3-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 14.3-RELEASE-p15.

WARNING: FreeBSD 14.3-RELEASE is approaching its End-of-Life date.
It is strongly recommended that you upgrade to a newer
release within the next 2 days.

ansible@erebor:~ $ uname -a
FreeBSD erebor 14.3-RELEASE FreeBSD 14.3-RELEASE releng/14.3-n271432-8c9ce319fef7 GENERIC amd64
ansible@erebor:~ $ uptime
10:46AM  up 204 days, 30 mins, 1 user, load averages: 0.02, 0.15, 0.11

Look at the 15.1 upgrade docs, it looks like I should upgrade to 14.4 first. This blog post has lots of details to explore.

[scottmuc]

Why not repave?

I remember the upgrade experience of FreeBSD being really good so I want to sharpen my knowledge a bit. I do want to do a repave but for now, this will be a great exercise.

[scottmuc]

Minor Upgrade

ansible@erebor:~ $ doas freebsd-update -r 14.4-RELEASE upgrade
src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 14.3-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Fetching 1 metadata files... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic world/base world/lib32

The following components of FreeBSD do not seem to be installed:
kernel/generic-dbg world/base-dbg world/lib32-dbg

Does this look reasonable (y/n)? y

Fetching metadata signature for 14.4-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Fetching 1 metadata patches. done.
Applying metadata patches... done.
Fetching 1 metadata files... done.
Inspecting system... done.
Fetching files from 14.3-RELEASE for merging... done.
Preparing to download files... done.
Fetching 3168 patches.....10....20....30....40....50....60....70....80....90....100....110....120....130....140....150....160....170....180....190....200....210....220....230....240....250....260....270....280....290....300....310....320....330....340....350....360....370....380....390....400....410....420....430....440....450....460....470....480....490....500....510....520....530....540....550....560....570....580....590....600....610....620....630....640....650....660....670....680....690....700....710....720....730....740....750....760....770....780....790....800....810....820....830....840....850....860....870....880....890....900....910....920....930....940....950....960....970....980....990....1000....1010....1020....1030....1040....1050....1060....1070....1080....1090....1100....1110....1120....1130....1140....1150....1160....1170....1180....1190....1200....1210....1220....1230....1240....1250....1260....1270....1280....1290....1300....1310....1320....1330....1340....1350....1360....1370....1380....1390....1400....1410....1420....1430....1440....1450....1460....1470....1480....1490....1500....1510....1520....1530....1540....1550....1560....1570....1580....1590....1600....1610....1620....1630....1640....1650....1660....1670....1680....1690....1700....1710....1720....1730....1740....1750....1760....1770....1780....1790....1800....1810....1820....1830....1840....1850....1860....1870....1880....1890....1900....1910....1920....1930....1940....1950....1960....1970....1980....1990....2000....2010....2020....2030....2040....2050....2060....2070....2080....2090....2100....2110....2120....2130....2140....2150....2160....2170....2180....2190....2200....2210....2220....2230....2240....2250....2260....2270....2280....2290....2300....2310....2320....2330....2340....2350....2360....2370....2380....2390....2400....2410....2420....2430....2440....2450....2460....2470....2480....2490....2500....2510....2520....2530....2540....2550....2560....2570....2580....2590....2600....2610....2620....2630....2640....2650....2660....2670....2680....2690....2700....2710....2720....2730....2740....2750....2760....2770....2780....2790....2800....2810....2820....2830....2840....2850....2860....2870....2880....2890....2900....2910....2920....2930....2940....2950....2960....2970....2980....2990....3000....3010....3020....3030....3040....3050....3060....3070....3080....3090....3100....3110....3120....3130....3140....3150....3160.... done.
Applying patches... done.
Fetching 265 files... ....10....20....30....40....50....60....70....80....90....100....110....120....130....140....150....160....170....180....190....200....210....220....230....240....250....260.. done.
Attempting to automatically merge changes in files... done.

The following changes, which occurred between FreeBSD 14.3-RELEASE and
FreeBSD 14.4-RELEASE have been merged into /etc/ssh/sshd_config:
--- current version
+++ new version
@@ -1,6 +1,6 @@
-#      $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+#      $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.

 # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
@@ -54,16 +54,19 @@
 # HostbasedAuthentication
 #IgnoreUserKnownHosts no
 # Don't read the user's ~/.rhosts and ~/.shosts files
 #IgnoreRhosts yes

-# Change to yes to enable built-in password authentication.
+# Change to "yes" to enable built-in password authentication.
 # Note that passwords may also be accepted via KbdInteractiveAuthentication.
 #PasswordAuthentication no
 #PermitEmptyPasswords no

-# Change to no to disable PAM authentication
+# Change to "no" to disable keyboard-interactive authentication.  Depending on
+# the system's configuration, this may involve passwords, challenge-response,
+# one-time passwords or some combination of these and other methods.
+# Keyboard interactive authentication is also used for PAM authentication.
 #KbdInteractiveAuthentication yes

 # Kerberos options
 #KerberosAuthentication no
 #KerberosOrLocalPasswd yes
@@ -103,11 +106,11 @@
 #PidFile /var/run/sshd.pid
 #MaxStartups 10:30:100
 #PermitTunnel no
 #ChrootDirectory none
 #UseBlacklist no
-#VersionAddendum FreeBSD-20250219
+#VersionAddendum FreeBSD-20250801

 # no default banner path
 #Banner none

 # override default of no subsystems
Does this look reasonable (y/n)?

I hit y

The following files will be removed as part of updating to
14.4-RELEASE-p6:
/sbin/ipfs
/usr/include/dev/an
/usr/include/dev/wi
/usr/include/machine/runq.h
/usr/include/netgraph/atm
/usr/lib/libnss_tacplus.a
/usr/lib32/libnss_tacplus.a
/usr/share/examples/dma/auth.conf
/usr/share/examples/drivers
/usr/share/examples/drivers/README
/usr/share/examples/drivers/make_device_driver.sh
/usr/share/examples/drivers/make_pseudo_driver.sh
/usr/share/flua/yaml.lua
/usr/share/man/man3/pthread_switch_add_np.3.gz
/usr/share/man/man3/pthread_switch_delete_np.3.gz
/usr/share/man/man3/quota_statfs.3.gz
/usr/share/man/man4/_hn.4.gz
/usr/share/man/man4/pccard.4.gz
/usr/share/man/man4/pcic.4.gz
/usr/share/man/man4/vn.4.gz
/usr/share/man/man8/amd64/apmconf.8.gz
/usr/share/man/man8/ipfs.8.gz
The following files will be added as part of updating to
14.4-RELEASE-p6:
/boot/images/freebsd-install-brand-rev.png
/boot/kernel/p9fs.ko
/boot/kernel/virtio_p9fs.ko
/boot/lua/gfx-install.lua
/etc/dma/auth.conf
/etc/rc.d/noshutdown
/etc/rc.d/nuageinit_post_net
/etc/rc.d/nuageinit_user_data_script
/sbin/dnctl15
/sbin/ipfw15
/usr/bin/clang-scan-deps
/usr/include/private/yaml
/usr/include/private/yaml/yaml.h
/usr/include/sys/_nv.h
/usr/include/sys/_param.h
/usr/include/sys/stdarg.h
/usr/lib/flua/freebsd
/usr/lib/flua/freebsd/kenv.so
/usr/lib/flua/freebsd/sys
/usr/lib/flua/freebsd/sys/linker.so
/usr/lib/flua/ucl.so
/usr/lib/flua/yaml.so
/usr/lib/libprivateclang.so
/usr/lib/libprivateclang.so.19
/usr/lib/libprivatelldb.so
/usr/lib/libprivatelldb.so.19
/usr/lib/libprivatellvm.so
/usr/lib/libprivatellvm.so.19
/usr/lib/libprivateyaml.a
/usr/lib/libprivateyaml.so
/usr/lib/libprivateyaml.so.1
/usr/lib32/libprivateyaml.a
/usr/lib32/libprivateyaml.so
/usr/lib32/libprivateyaml.so.1
/usr/lib32/pkgconfig/bzip2.pc
/usr/libdata/pkgconfig/bzip2.pc
/usr/libexec/bsdinstall/mount_aux
/usr/libexec/sshd-auth
/usr/sbin/sndctl
/usr/share/flua/lyaml
/usr/share/flua/lyaml/explicit.lua
/usr/share/flua/lyaml/functional.lua
/usr/share/flua/lyaml/implicit.lua
/usr/share/flua/lyaml/init.lua
/usr/share/man/man1/flua.1.gz
/usr/share/man/man1/keybinds.1.gz
/usr/share/man/man3/STAILQ_REVERSE.3.gz
/usr/share/man/man3/atf_require_kmod.3.gz
/usr/share/man/man3/atf_tc_require_kmod.3.gz
/usr/share/man/man3/atf_tc_require_prog.3.gz
/usr/share/man/man3/daylight.3.gz
/usr/share/man/man3/fdscandir.3.gz
/usr/share/man/man3/fdscandir_b.3.gz
/usr/share/man/man3/link_ntoa_r.3.gz
/usr/share/man/man3/login_getcapenum.3.gz
/usr/share/man/man3/pidfile_signal.3.gz
/usr/share/man/man3/pthread_signals_block_np.3.gz
/usr/share/man/man3/pthread_signals_unblock_np.3.gz
/usr/share/man/man3/pw_initpwd.3.gz
/usr/share/man/man3/quota_check_path.3.gz
/usr/share/man/man3/quota_convert.3.gz
The following files will be updated as part of updating to
14.4-RELEASE-p6:
/bin/[
/bin/cat
/bin/chflags
/bin/chio
/bin/chmod
/bin/cp
/bin/cpuset
/bin/csh
/bin/date
/bin/dd
/bin/df
/bin/domainname
/bin/echo
/bin/ed
/bin/expr
/bin/freebsd-version
/bin/getfacl
/bin/hostname
/bin/kenv
/bin/kill
/bin/link
/bin/ln
/bin/ls
/bin/mkdir
/bin/mv
/bin/nproc
/bin/pax
/bin/pgrep
/bin/pkill
/bin/ps
/bin/pwait
/bin/pwd
/bin/realpath
/bin/red
/bin/rm
/bin/rmail
/bin/rmdir
/bin/setfacl
/bin/sh
/bin/sleep
/bin/stty
/bin/sync
/bin/tcsh
/bin/test
/bin/timeout
/bin/unlink
/bin/uuidgen
/boot/boot
/boot/boot1.efi
/boot/boot2
/boot/defaults/loader.conf
/boot/fonts/INDEX.fonts
/boot/gptboot
/boot/gptboot.efi
/boot/kernel/aac.ko
/boot/kernel/aacraid.ko
/boot/kernel/accf_data.ko
/boot/kernel/accf_dns.ko
/boot/kernel/accf_http.ko
/boot/kernel/acl_nfs4.ko
/boot/kernel/acl_posix1e.ko
To install the downloaded upgrades, run 'freebsd-update [options] install'.

I'm predicting that the upgrade will succeed, but I'll no longer have network. I think I'll need to re-install the network card kernel driver. Looks like I'll have to fetch my external monitor from the basement.

ansible@erebor:~ $ doas freebsd-update install
src component not installed, skipped
Creating snapshot of existing boot environment... done.
Installing updates...
Kernel updates have been installed.  Please reboot and run
'freebsd-update [options] install' again to finish installing updates.

Not sure why the boot environment is still 14.3???

ansible@erebor:~ $ bectl list
BE                                 Active Mountpoint Space Created
14.3-RELEASE-p15_2026-06-28_110210 -      -          3.38M 2026-06-28 11:02
14.3-RELEASE_2026-06-23_210854     -      -          491M  2026-06-23 21:08
default                            NR     /          2.90G 2025-11-23 18:47

Now rebooting!

[scottmuc]

Post Reboot

~/workspace/website $ ssh ansible@erebor
Last login: Sun Jun 28 10:42:20 2026 from gandalf.middle-earth.internal
FreeBSD 14.4-RELEASE-p6 GENERIC

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories:   https://www.FreeBSD.org/security/
FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
FreeBSD FAQ:           https://www.FreeBSD.org/faq/
Questions List:        https://www.FreeBSD.org/lists/questions/
FreeBSD Forums:        https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with:  pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed:  freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages:  man man
FreeBSD directory layout:      man hier

To change this login announcement, see motd(5).
After you compiled and installed a new version of FreeBSD, use etcupdate(8) to merge
configuration updates.
Run "etcupdate extract" once when your sources match your running system, then run
"etcupdate" after every upgrade and "etcupdate resolve" to resolve any conflicts.

                -- Lars Engels <lme@FreeBSD.org>

My prediction was wrong! My network card driver still works. Now completing the upgrade.

ansible@erebor:~ $ doas freebsd-update install
src component not installed, skipped
Creating snapshot of existing boot environment... done.
Installing updates...
Restarting sshd after upgrade
Performing sanity check on sshd configuration.
Stopping sshd.
Waiting for PIDS: 1080.
Performing sanity check on sshd configuration.
Starting sshd.
 done.
ansible@erebor:~ $ doas pkg update
Updating FreeBSD repository catalogue...
Fetching data: 100%    10 MiB   2.8 MB/s    00:04
Processing entries: 100%
FreeBSD repository update completed. 37077 packages processed.
Updating FreeBSD-kmods repository catalogue...
pkg: Repository FreeBSD-kmods has a wrong packagesite, need to re-create database
Fetching meta.conf: 100%     179 B   0.2 kB/s    00:01
Fetching data: 100%    36 KiB  37.0 kB/s    00:01
Processing entries: 100%
FreeBSD-kmods repository update completed. 245 packages processed.
All repositories are up to date.
ansible@erebor:~ $ doas pkg upgrade
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
Updating FreeBSD-kmods repository catalogue...
FreeBSD-kmods repository is up to date.
All repositories are up to date.
Checking for upgrades (45 candidates): 100%
Processing candidates (45 candidates): 100%
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
        realtek-re-kmod: 1100.00.1403000_1 -> 1101.00.1404000 [FreeBSD-kmods]

Number of packages to be upgraded: 1

157 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching realtek-re-kmod-1101.00.1404000: 100%   157 KiB 160.7 kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Upgrading realtek-re-kmod from 1100.00.1403000_1 to 1101.00.1404000...
[1/1] Extracting realtek-re-kmod-1101.00.1404000: 100%

Looks like my network driver now has an update.

[scottmuc]

Post reboot after network controller update

It still boots and gets an IP!

Here's some output from dmesg:

re0: <Realtek PCIe 2.5GbE Family Controller> port 0xe000-0xe0ff mem 0xfc300000-0xfc30ffff,0xfc310000-0xfc313fff irq 28 at device 0.0 on pci5
re0: Using Memory Mapping!
re0: Using 1 MSI-X message
re0: version:1.101.00
re0: Ethernet address: 10:ff:e0:85:13:83

This product is covered by one or more of the following patents:
US6,570,884, US6,115,776, and US6,327,625.
re0: Using defaults for TSO: 65518/35/2048
re0: Ethernet address: 10:ff:e0:85:13:83

Interesting to see the declaration of patents in use. While looking at the dmesg output I saw a useful warning:

ansible@erebor:~ $ dmesg | grep -i warning
WARNING: sysctl vfs.zfs.min_auto_ashift is deprecated. Use vfs.zfs.vdev.min_auto_ashift instead.

I'm also seeing that merry is swtiching network interfaces (it has a physical and wireless NIC:

Jun 28 11:10:53 erebor kernel: arp: 192.168.2.11 moved from 00:e0:4c:01:15:6b to 44:1c:a8:e2:17:81 on re0
Jun 28 11:10:58 erebor kernel: arp: 192.168.2.11 moved from 44:1c:a8:e2:17:81 to 00:e0:4c:01:15:6b on re0