After two months of development, Linus Torvalds released the Linux kernel 5.13. Among the most notable changes are the EROFS file system, initial support for Apple M1 chips, a new 'misc' cgroup controller, the discontinuation of support for /dev/kmem, support for new Intel and AMD GPUs, the ability to directly call kernel functions from BPF programs, kernel stack randomization for each system call, the possibility of building with Clang with CFI (Control Flow Integrity) protection, the Landlock LSM module for additional process confinement, a virtual sound device based on virtio, and a multi-shot mode in io_uring.
The new version includes 17,189 fixes from 2,150 developers (the largest in history); the patch size is 60 MB (changes affected 12,996 files, adding 794,705 lines of code and removing 399,590 lines). Approximately 47% of all changes in 5.13 are related to device drivers, about 14% pertain to updates of architecture-specific code, 13% relate to the network stack, 5% to file systems, and 4% to internal kernel subsystems.
Key innovations:
- Disk subsystem, input/output, and file systems
- Support for the EROFS (Enhanced Read-Only File System), proposed by Huawei for use on read-only accessible partitions, has been added. The new file system supports the storage of data in a compressed form and, compared to Ext4, demonstrates similar performance when performing sequential read operations, but outperforms Ext4 significantly during random data access. For example, at a compression level of 4 during testing with server a hard disk, the EROFS file system surpassed Ext4 in random read operations by more than six times, and when using an Android smartphone with Flash, by nearly three times. Like other read-only file systems, the structure of EROFS is greatly simplified by discarding certain areas of metadata during implementation, such as the free block bitmap.
- For the SMB3 file system, the 'rasize' mount option has been implemented, allowing users to define the size of the readahead window to improve performance for certain types of workloads.
- In the ext4 file system, the rewriting of directory entries upon file deletion has been enabled. In ext4, simultaneous use of case-insensitive mode and encryption is also allowed.
- The exFAT file system has added support for the ioctl command FITRIM (discard), to inform the storage about the unused blocks in the file system.
- The XFS file system has introduced the ability to reclaim space from the last distribution group, marking the first step in implementing a feature to reduce the size of existing partitions with the XFS file system.
- A new system call quotactl_path has been added, which differs from quotactl in that it allows managing quotas not through a special device file but by specifying the path to the file system mount point.
- The fanotify mechanism has expanded its capabilities available to unprivileged users. For example, similar to inotify, without SYS_CAP_ADMIN rights, users can now track OPEN, ACCESS, MODIFY, and CLOSE events for files and directories.
- Memory and system services
- A new cgroup controller called 'Misc' (CONFIG_CGROUP_MISC) has been added, designed to limit and track scalar resources that can be managed using a simple counter and constrained by setting maximum allowed values. One example of using the new cgroup controller includes managing address space identifiers employed in the AMD SEV (Secure Encrypted Virtualization) mechanism.
- In the io_uring asynchronous I/O interface, the POLL requests now have a 'multi-shot' mode, where POLL is not removed after an event is generated but remains active and can generate multiple events.
- Code ensuring the handling of software-generated interrupts in kernel threads has been moved from the realtime branch of the kernel, allowing them to be preempted by higher-priority processes.
- An internal library named netfs has been added, containing standard functions used in network file systems.
- Support for time namespaces has been implemented for the PowerPC architecture, allowing containers to have their own time.
- Support for kexec, crash dump, kprobe, and execute-in-place (running from the original medium without copying to RAM) has been implemented for the RISC-V architecture.
- In BPF tracing programs, the ability to use task-local storage has been introduced, providing higher performance by binding data to a specific BPF handler.
- A new mechanism has been implemented for directly invoking kernel functions from BPF programs, which is already used in the implementation of TCP overload algorithms. To ensure security, the called functions must be explicitly defined in a whitelist.
- An option 'func-no-repeats' has been added to the ftrace function tracing system, allowing to reflect consecutive repeated function calls as a counter.
- The userfaultfd() system call, intended for handling page faults (accessing unallocated memory pages) in user space, has been enhanced with the ability to manage partial faults, in which a memory page is present but there is no entry in the page table.
- Support for the special file /dev/kmem has been discontinued, which allowed access to the entire kernel address space. This file has been deemed obsolete and problematic for security.
- A new driver for managing cooling has been implemented for Intel chips, allowing the CPU frequency to be reduced in case of overheating danger. Unlike the existing TCC (Thermal Control Circuit) activation mechanism, the new driver manipulates relative values, meaning it can lower the frequency at the onset of significant temperature increases, without waiting for the critical threshold to be exceeded.
- Virtualization and Security
- The package includes the Landlock application isolation LSM module, which limits the interactions with the external environment of a group of processes, designed with consideration of isolation mechanisms such as XNU Sandbox, FreeBSD Capsicum, and OpenBSD Pledge/Unveil. Access logic is defined through a BPF program, but unlike seccomp-bpf, Landlock does not filter system calls and their arguments, but allows limiting the use of kernel objects, such as file hierarchies. Using Landlock, any process, including unprivileged ones, can securely isolate itself and prevent bypassing isolation in the event of vulnerabilities or malicious changes in the application. Landlock allows a process to create secure isolated environments, implemented as an additional layer over existing access control mechanisms. For example, a program can prohibit access to files outside the working directory.
- A feature has been added to randomize stack offsets in the kernel during system call processing to complicate stack attack attempts. The essence of the proposed protection lies in selecting a random stack offset for each system call, which makes it more difficult to determine the stack layout in memory even if address information is obtained, as the base stack address will change with the next system call. To enable randomization, the kernel command line parameter "randomize_kstack_offset=on/off" and the configuration setting CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT have been proposed. The overhead is estimated to be approximately a 1% performance loss.
- Support has been added for building the kernel with the CFI (Control Flow Integrity) protection mechanism enabled in the Clang compiler, which adds a check before each indirect function call to identify some forms of undefined behavior that could potentially disrupt normal control flow due to exploits that alter stored function pointers in memory. The CONFIG_CFI_CLANG parameter has been proposed to enable CFI.
- In the kernel-provided encryption key storage service (key ring), the Trusted Keys mechanism now encompasses not only keys from TPM modules but also from TEE (Trusted Execution Environment). A boot parameter, "trusted.source," has been proposed to manage the source of trusted keys. Additionally, the ability to process trusted keys in ASN.1 format has been added.
- A parameter for preloading the list of revoked certificates during kernel boot has been added. The issue (CVE-2020-26541) with ignoring revoked UEFI Secure Boot certificates provided in the EFI_CERT_X509_GUID format has been resolved, allowing the system to boot with a revoked certificate.
- Support for ECDSA digital signature verification based on elliptic curves has been added to the kernel crypto subsystem.
- The possibility of verifying SELinux policies using the IMA (Integrity Measurement Architecture) subsystem has been implemented, ensuring the maintenance of a hash database for data integrity verification.
- Network subsystem
- Support for the WiMAX technology, which is no longer used in public networks, has been removed. The only driver that can be used with WiMAX in the kernel remains the outdated Intel 2400m driver. Support for WiMAX in the NetworkManager configuration was discontinued in 2015. Currently, WiMAX has been almost completely replaced by technologies such as LTE, HSPA+, and Wi-Fi 802.11n.
- A driver has been added for the MANA (Microsoft Azure Network Adapter).
- Support for Qualcomm QCN9074 wireless modules with 802.11ax support has been added to the ath11k driver.
- The iwlwifi driver has implemented passive channel scanning capabilities in the 6GHz band. For Ukraine, support for enabling/disabling IEEE 802.11ax based on BIOS parameters has been added.
- Optimization of the XDP (eXpress Data Path) subsystem has been carried out, allowing manipulation of network packets before they are processed by the Linux kernel's network stack. Tests show an increase in XDP performance by 4-8%. For virtio devices, the performance boost for AF_XDP software processing can reach 33%.
- Support for extended PROBE messages defined in RFC 8335 has been implemented in ICMP.
- Integration into the kernel for MPTCP (MultiPath TCP), an extension of the TCP protocol for enabling TCP connections that deliver packets simultaneously over multiple routes through different network interfaces linked to various IP addressesThe new release adds sockopt support for setting standard TCP options. The ability to reset individual subflows has been implemented.
- In netfilter, support for resource management through a unified cgroups v2 hierarchy has been added.
- ethtool has implemented an interface for reading IEEE MIB statistics with support for mlx5 and bnxt. Network drivers are allowed to extract arbitrary data from SFP EEPROM, manipulating memory pages rather than a combination of offset+size.
- Hardware
- Initial support for the Apple M1 ARM chip has been implemented, covering the interrupt controller, timer, UART, SMP, I/O management functions, and MMIO. Reverse engineering of the GPU is not yet complete; framebuffer and console support via the serial port are provided for output.
- The kernel cleanup from old drivers continues; the "gasket" (Google ASIC), "sysace", "umem" drivers, and several old drivers for serial ports have been removed.
- After 13 years in the staging branch, the "comedi" driver for data acquisition devices has been stabilized and moved to the mainline.
- The GUD (Generic USB Display) driver has been added with the implementation of a basic driver for screens and TV adapters connected via USB interface. The driver provides DRM properties (Direct Rendering Manager) for image rotation, brightness control, access to EDID, video mode settings, and TV connectivity, which can be used as a foundation for creating drivers for specific devices.
- The 'virtio' sound driver has been added, implementing a virtual sound device that can be used in guest systems for audio output and recording without the need for passthrough access to the sound card or emulation.
- Initial support for the Aldebaran GPU (gfx90a) has been added to the amdgpu driver. Initial support for FreeSync adaptive sync technology for HDMI (previously available for DisplayPort) has been included, allowing for the adjustment of the screen refresh rate. Support for ASSR (Alternate Scrambler Seed Reset) has been added. An ioctl has been introduced for querying capabilities related to video encoding and decoding. A CONFIG_DRM_AMD_SECURE_DISPLAY mode has been added to detect changes in displays showing critical information. Support for the ASPM power-saving mechanism has been added.
- Support for Intel Alderlake-S chips has been included in the i915 driver for Intel graphics cards. Support for eDP MSO (Embedded DisplayPort Multi-SST Operation) has been added.
- Support for the Luna game controller (Amazon) has been added, as well as support for Hycon HY46XX touch screens, ILITEK Lego Series, and MStar MSG2638.
Meanwhile, the Latin American Free Software Foundation has created a version of the fully free kernel 5.11 — Linux-libre 5.11-gnu, cleaned of firmware and driver elements containing non-free components or code segments restricted by the manufacturer. In this new release, the comedi driver has been cleaned. The cleaning of the cyclades, isicom tty, and i2400m wimax drivers has been discontinued, and they have been removed from the kernel. The cleaning code for blobs in the amdgpu, i915 csr, r8152 usb, mhi bus, x86 touchscreen, and qualcomm arm64 drivers and subsystems has been updated.
Source: opennet.ru
