Release of Linux kernel 5.14

After two months of development, Linus Torvalds presented the release of the Linux kernel 5.14. Among the most notable changes: new system calls quotactl_fd() and memfd_secret(), removal of ide and raw drivers, a new input/output priority controller for cgroups, task scheduling mode SCHED_CORE, and infrastructure for creating bootloaders for verified BPF programs.

The new version includes 15,883 fixes from 2,002 developers, with a patch size of 69 MB (changes affected 12,580 files, adding 861,501 lines of code and removing 321,654 lines). About 47% of all changes in 5.14 relate to device drivers, approximately 14% pertain to updates of architecture-specific code, 13% is related to the networking stack, 3% to file systems, and 3% to internal kernel subsystems.

Key innovations:

• Disk subsystem, input/output, and file systems
  • A new input/output prioritization controller — rq-qos — has been implemented for cgroups, which can manage the processing priority of requests to block devices generated by members of each cgroup. Support for the new priority controller has been added to the mq-deadline I/O scheduler.
  • In the ext4 filesystem, a new ioctl command EXT4_IOC_CHECKPOINT has been implemented, forcing all pending transactions from the journal and their associated buffers to be flushed to disk, as well as rewriting the journal area used in storage. This change has been prepared as part of an initiative to prevent information leakage from file systems.
  • Performance optimizations have been made in Btrfs: by eliminating unnecessary journaling of extended attributes during fsync operations, the performance of intensive operations with extended attributes has increased by up to 17%. Additionally, during truncation operations that do not affect extents, full synchronization has been disabled, reducing operation time by 12%. A configuration has been added in sysfs to limit input/output bandwidth during filesystem checks. Ioctl calls have been added to cancel resizing and device removal operations.
  • In XFS, the buffer cache implementation has been reworked, transitioning to batch mode memory page allocation. Cache efficiency has been improved.
  • F2FS has added an option for read-only mode and implemented a caching mode for compressed blocks (compress_cache) to enhance random read performance. Support for file compression reflected in memory via the mmap() operation has been implemented. A new mount option, nocompress, has been proposed to selectively disable file compression based on a mask.
  • Work has been done in the exFAT driver to improve compatibility with storage from certain digital cameras.
  • A system call, quotactl_fd(), has been added that allows quota management not through a special device file, but by specifying a file descriptor associated with the file system for which the quota is applied.
  • Old drivers for block devices with the IDE interface have been removed from the kernel, replaced long ago by the libata subsystem.
  • The 'raw' driver, providing unbuffered access to block devices through the /dev/raw interface, has been removed from the kernel. This functionality has long been implemented in applications using the O_DIRECT flag.
• Memory and system services
  • A new scheduling mode, SCHED_CORE, has been implemented in the task scheduler, allowing control over which processes can run concurrently on a single CPU core. Each process can be assigned a cookie identifier that defines the trust area among processes (for example, belonging to the same user or container). When organizing code execution, the scheduler can ensure that a single CPU core is shared only among processes related to a single owner, which can be used to block some Spectre-class attacks by preventing the concurrent execution of trusted and untrusted tasks in one SMT (Hyper Threading) thread.
  • Support for the kill operation has been implemented for cgroups, allowing the simultaneous termination of all processes bound to the group (sending SIGKILL) by writing '1' to the virtual file cgroup.kill.
  • The capabilities related to responding to the detection of split locks arising from accessing unaligned data in memory have been expanded. This occurs because, during the execution of an atomic instruction, the data crosses two CPU cache lines. Such locks lead to significant performance drops; therefore, previously there was an option to forcibly terminate the application that caused the lock. The new release includes a kernel command line parameter 'split_lock_detect=ratelimit:N', which allows you to set a system-wide limit on the intensity of lock operations per second. Once exceeded, any process that becomes the source of a split lock will be forcibly stopped for 20 ms instead of being terminated.
  • The CFS bandwidth controller in cgroup has implemented the ability to define limits constrained by a specified time duration, allowing for better regulation of latency-sensitive workloads. For instance, setting the value of cpu.cfs_quota_us to 50000 and cpu.cfs_period_us to 100000 enables a group of processes to use 50 ms of CPU time every 100 ms.
  • Initial infrastructure has been added for creating BPF program loaders, which will later allow only BPF programs signed with a trusted digital key to be loaded.
  • A new futex operation, FUTEX_LOCK_PI2, has been added, which uses a monotonic timer to calculate the timeout that takes into account the time spent by the system in a sleep state.
  • Support for large memory pages (Transparent Huge Pages) has been implemented for the RISC-V architecture, along with the ability to apply the KFENCE mechanism for detecting memory access errors.
  • The system call madvise(), which provides means for optimizing memory management of processes, has added the flags MADV_POPULATE_READ and MADV_POPULATE_WRITE to generate page faults for all memory pages reflected for read or write operations, without performing actual read or write actions (prefault). The use of flags can be beneficial in reducing delays during program execution by proactively executing the page fault handler at once for all unallocated pages, without waiting for actual access to them.
  • The kunit unit testing framework now supports running tests in a QEMU environment.
  • New tracers have been added: "osnoise" for tracking application delays caused by interrupt handling, and "timerlat" for providing detailed information about delays during wakeups by timer signals.
• Virtualization and Security
  • A new system call memfd_secret() has been added, allowing the creation of a private memory area in an isolated address space, visible only to the owning process, not reflected in other processes, and not directly accessible to the kernel.
  • In the seccomp system call filtering, when moving lock handlers to user space, it is now possible to use a single atomic operation to create a file descriptor for an isolated task and return it during system call handling. This proposed operation addresses the issue of interrupting the handler in user space when a signal is received.
  • A new mechanism for managing resource limits in user ID namespace has been added, which binds separate rlimit counters to users in the user namespace. This change addresses the problem of applying shared resource counters when a single user launches processes in different containers.
  • In the hypervisor KVM For ARM64 systems, support has been added for using MTE (MemTag, Memory Tagging Extension) in guest systems, allowing tags to be associated with each memory allocation operation and enabling validation for pointer usage to prevent exploitation of vulnerabilities caused by accessing already freed memory blocks, buffer overflows, accesses before initialization, and use outside the current context.
  • The Pointer Authentication features provided by ARM64 can now be configured separately for the kernel and user space. This technology allows the use of specialized ARM64 instructions for verifying return addresses using digital signatures stored in the unused upper bits of the pointer itself.
  • User-mode Linux now supports the use of drivers for PCI devices with a virtual PCI bus implemented by the PCI-over-virtio driver.
  • Support for the paravirtualized virtio-iommu device has been added to x86 systems, allowing IOMMU requests such as ATTACH, DETACH, MAP, and UNMAP to be sent over the virtio transport without emulating memory page tables.
  • For Intel CPUs, from the Skylake family to Coffee Lake, the use of Intel TSX (Transactional Synchronization Extensions) is disabled by default. These extensions provide means to enhance the performance of multithreaded applications by dynamically excluding unnecessary synchronization operations. The extensions have been disabled due to the possibility of Zombieload attacks that manipulate information leakage through side channels arising from the asynchronous interrupt operation mechanism (TAA, TSX Asynchronous Abort).
• Network subsystem
  • Integration into the kernel for MPTCP (MultiPath TCP), an extension of the TCP protocol for enabling TCP connections that deliver packets simultaneously over multiple routes through different network interfaces linked to various IP addresses. The new release adds a mechanism for defining custom traffic hashing policies for IPv4 and IPv6 (multipath hash policy), allowing user space to specify which fields in the packets, including encapsulated ones, will be used for calculating the hash that determines the path selection for the packet.
  • Support for SOCK_SEQPACKET sockets (ordered and reliable transmission of datagrams) has been added to the virtio virtual transport.
  • The SO_REUSEPORT socket mechanism has been enhanced, allowing multiple listening sockets to connect to a single port for accepting connections while distributing incoming requests simultaneously across all connected sockets via SO_REUSEPORT, simplifying the creation of multithreaded server applications. The new version includes features for transferring control to another socket in case of a failure while processing a request that was initially selected by the original socket (solving the problem of lost individual connections during service restarts).
• Hardware
  • The amdgpu driver has implemented support for new series of AMD Radeon RX 6000 GPUs, developed under the code names 'Beige Goby' (Navi 24) and 'Yellow Carp', and improved support for the Aldebaran GPU (gfx90a) and Van Gogh APU. The ability for simultaneous operation with multiple eDP panels has been added. For the Renoir APU, support for working with encrypted buffers in video memory (TMZ, Trusted Memory Zone) has been implemented. Hot-unplug support for graphics cards has been added. Default support for the ASPM (Active State Power Management) power-saving mechanism has been enabled for Radeon RX 6000 GPUs (Navi 2x) and older AMD GPUs, which was previously activated only for Navi 1x, Vega, and Polaris GPUs.
  • Support for shared virtual memory (SVM) based on the HMM (Heterogeneous Memory Management) subsystem has been added for AMD chips, allowing the use of devices with their own memory management units (MMUs) that can access the main memory. This includes the organization of a shared address space between GPU and CPU, where the GPU can access the main memory of the process.
  • Initial support for AMD Smart Shift technology has been added, dynamically changing the power consumption parameters of CPU and GPU in laptops with AMD chipsets and graphics cards to enhance performance during gaming, video editing, and 3D rendering.
  • Support for Intel Alderlake P chips has been included in the i915 driver for Intel graphics cards.
  • The drm/hyperv driver for the Hyper-V virtual graphics adapter has been added.
  • Support for the Raspberry Pi 400 all-in-one computer has been added.
  • The dell-wmi-privacy driver has been added to support hardware camera and microphone switches supplied in Dell laptops.
  • For Lenovo laptops, a WMI interface has been added to modify BIOS settings via sysfs /sys/class/firmware-attributes/.
  • Support for USB4 interface devices has been expanded.
  • Support for audio cards and codecs AmLogic SM1 TOACODEC, Intel AlderLake-M, NXP i.MX8, NXP TFA1, TDF9897, Rockchip RK817, Qualcomm Quinary MI2, and Texas Instruments TAS2505 has been added. Improved audio support on HP and ASUS laptops. Patches have been added to reduce latency before audio playback starts on USB interface devices.

Source: opennet.ru