Linux kernel release 5.17

After two months of development, Linus Torvalds released the Linux kernel 5.17. Among the most notable changes are: a new performance management system for AMD processors, the ability to perform recursive mapping of user IDs in file systems, support for portable compiled BPF programs, a transition of the random number generator to the BLAKE2s algorithm, the RTLA utility for real-time execution analysis, a new fscache backend for caching network file systems, and the ability to attach names to anonymous mmap operations.

The new version includes 14,203 fixes from 1,995 developers, with the patch size being 37 MB (the changes affected 11,366 files, added 506,043 lines of code, and removed 250,954 lines). About 44% of all changes in 5.17 are related to device drivers, approximately 16% relate to updates of architecture-specific code, 15% pertains to the network stack, 4% involves file systems, and 4% concerns internal kernel subsystems.

Key innovations in kernel 5.17:

• Disk subsystem, input/output, and file systems
  • The capability for nested mapping of user IDs of mounted file systems has been implemented, which is used to match files of a specific user on a mounted foreign partition with another user in the current system. The added feature allows the recursive use of mapping over file systems for which mapping is already applied.
  • The fscache subsystem, used for organizing caching in the local file system of data transferred over network file systems, has been completely rewritten. The new implementation features significant code simplification and replaces complicated scheduling and state-tracking operations with simpler mechanisms. Support for the new fscache is implemented in the CIFS file system.
  • In the fanotify event tracking subsystem of the file system, a new event type FAN_RENAME has been introduced, which allows capturing the rename operation of files or directories in one go (previously, two separate events, FAN_MOVED_FROM and FAN_MOVED_TO, were used for handling renames).
  • The Btrfs file system has optimized logging and fsync operations for large directories by copying only index keys and reducing the volume of logged metadata. Support for indexing and searching by free space record size has been implemented, which has reduced latency by approximately 30% and shortened search times. Defragmentation operations can now be interrupted. It is possible to add devices while disabling balancing between drives, i.e., when mounting the FS with the skip_balance option.
  • A new syntax for mounting the Ceph file system has been proposed, addressing existing issues related to IP address binding. Additionally, (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. the server can now be identified using the cluster ID (FSID): mount -t ceph user@fsid.fs_name=\/[subdir] mnt -o mon_addr=monip1[:port][\/monip2[:port]]
  • The Ext4 file system has transitioned to a new API for mounting that separates the stages of parsing mount options and configuring the superblock. Support for the lazytime and nolazytime mount options has been discontinued, which were introduced as a temporary change to simplify the transition of util-linux to using the MS_LAZYTIME flag. Support has been added for setting and reading labels in the FS (ioctl FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL).
  • NFSv4 has added support for operation in file systems without case sensitivity in file and directory names. In NFSv4.1+, support for identifying aggregated sessions (trunking) has been added.
• Memory and system services
  • The amd-pstate driver has been added, providing dynamic frequency management to achieve optimal performance. The driver supports AMD CPU and APU starting from the Zen 2 generation, developed in collaboration with Valve and aims to improve energy efficiency management. The CPPC (Collaborative Processor Performance Control) mechanism is used for adaptive frequency adjustment, allowing for more precise changes in performance metrics (not limited to three performance levels) and quicker responses to state changes compared to previously used ACPI (CPUFreq) based P-state drivers.
  • In the eBPF subsystem, the bpf_loop() handler has been proposed, providing an alternative method for organizing loops in eBPF programs that is faster and easier for verification by the verifier.
  • At the core level, a CO-RE (Compile Once — Run Everywhere) mechanism has been implemented, allowing eBPF programs to be compiled just once and using a special universal loader that adapts the loaded program to the current kernel and BTF types (BPF Type Format).
  • The ability to assign names to areas of private anonymous memory (allocated via malloc) has been provided, which can simplify debugging and optimizing memory consumption in applications. Names are assigned through prctl with the flag PR_SET_VMA_ANON_NAME and displayed in /proc/pid/maps and /proc/pid/smaps in the form "[anon:]".
  • The task scheduler has introduced monitoring and displaying in /proc/PID/sched the time spent by processes in a forced idle state, which is used, for example, to reduce load during CPU overheating.
  • A gpio-sim module has been added, designed to simulate GPIO chips for testing purposes.
  • A new subcommand "latency" has been added to the "perf ftrace" command to generate histograms with delay information.
  • A set of utilities called "RTLA" has been introduced for analyzing real-time operation. This includes utilities like osnoise (which determines the influence of the operating system on task execution) and timerlat (which modifies timer-related delays).
  • The second series of patches integrating the concept of page folios has been implemented. These are similar to compound pages but offer improved semantics and a clearer organization. Using folios allows for faster memory management in some kernel subsystems. The proposed patches complete the transition of page cache to using folios and add initial support for folios in the XFS filesystem.
  • A build mode "make mod2noconfig" has been added, which generates a configuration that builds all disabled subsystems as kernel modules.
  • The requirements for the version of LLVM/Clang that can be used for kernel building have been raised. Now, at least LLVM 11 release is required for building.
• Virtualization and Security
  • An updated implementation of the RDRAND pseudorandom number generator has been proposed, responsible for the operation of the /dev/random and /dev/urandom devices, notable for its transition to using the BLAKE2s hash function instead of SHA1 for entropy mixing operations. This change has enhanced the security of the pseudorandom number generator by eliminating the problematic SHA1 algorithm and preventing the overwriting of the RNG initialization vector. Since the BLAKE2s algorithm outperforms SHA1 in terms of performance, its application has also positively affected overall efficiency.
  • Protection against vulnerabilities in processors caused by speculative execution of instructions after unconditional branch operations has been added. This issue arises due to preemptive processing of instructions immediately following a branch command (SLS, Straight Line Speculation). To enable this protection, a build using GCC 12, which is currently in testing, is required.
  • A reference counting mechanism has been introduced, aimed at reducing the number of reference counting errors that lead to memory access after it has been freed. Currently, this mechanism is limited to the networking subsystem, but it may be adapted for other parts of the kernel in the future.
  • Extended checks for new entries in a process's memory page table have been implemented, allowing for the detection of certain types of corruption and halting the system to block attacks at an early stage.
  • The ability for the kernel to unpack kernel modules directly, rather than relying on a user space handler, has been added. This allows the LSM module LoadPin to ensure that kernel modules are loaded into memory from verified storage devices.
  • A build with the flag '-Wcast-function-type' has been provided, enabling warnings about casting function pointers to incompatible types.
  • A pvUSB virtual host driver has been added for the Xen hypervisor, providing access to USB devices passed through to guest systems (allowing guest systems to access physical USB devices assigned to them).
  • A module has been added that allows communication via Wi-Fi with the IME (Intel Management Engine) subsystem, which is included in most modern motherboards with Intel processors and implemented as a separate microprocessor that operates independently of the CPU.
  • Support for the KCSAN (Kernel Concurrency Sanitizer) debugging tool has been implemented for the ARM64 architecture, designed for dynamically detecting race conditions within the kernel.
  • The ability to use the KFENCE mechanism has been added for 32-bit ARM systems to detect memory access errors.
  • Support for AMX (Advanced Matrix Extensions) instructions, implemented in upcoming Intel Xeon Scalable server processors, has been added to the KVM hypervisor.
• Network subsystem
  • Support for offloading traffic management operations to network devices has been added.
  • Support for the MCTP (Management Component Transport Protocol) over devices with a serial interface has been added. MCTP can be used for communication between management controllers and associated devices (host processors, peripheral devices, etc.).
  • The TCP stack has been optimized, for example, delayed release of socket buffers has been implemented to improve the performance of recvmsg calls.
  • At the CAP_NET_RAW privileges level, the setting of SO_PRIORITY and SO_MARK modes via the setsockopt function is now permitted.
  • For IPv4, it is now allowed to attach raw sockets to non-local IP addresses using the IP_FREEBIND and IP_TRANSPARENT options.
  • A sysctl arp_missed_max has been added to configure the threshold number of failures in ARP monitoring after which the network interface is set to disabled.
  • The ability to configure separate sysctl values min_pmtu and mtu_expires for network namespaces has been provided.
  • The API ethtool has been enhanced to allow setting and retrieving the size of incoming and outgoing packet buffers.
  • Support for filtering transit PPPoE traffic in the network bridge has been added to Netfilter.
  • The ksmbd module implementing file sharing using the SMB3 protocol has been enhanced to support key exchange, utilizing network port 445 for smbdirect, and added support for the parameter 'smb2 max credit. server, использующего протокол SMB3, добавлена поддержка обмена ключами, задействован сетевой порт 445 для smbdirect и добавлена поддержка параметра «smb2 max credit.
• Hardware
  • The drm (Direct Rendering Manager) subsystem and the i915 driver have added support for screens that display confidential information, such as some laptops equipped with screens featuring a built-in privacy mode that makes viewing from the side difficult. The changes allow specialized drivers for such screens to be attached and manage the privacy modes through property settings in standard KMS drivers.
  • The amdgpu driver has added support for the STB (Smart Trace Buffer) debugging technology for all compatible AMD GPUs. STB simplifies crash analysis and troubleshooting by storing information about the functions executed before the last crash in a special buffer.
  • The i915 driver has added support for Intel Raptor Lake S chips and has enabled support for the graphic subsystem of Intel Alder Lake P chips by default. It also allows screen backlight control via the VESA DPCD interface.
  • Support for hardware-accelerated scrolling in the console has been returned in the fbcon/fbdev drivers.
  • Integration of changes to support Apple M1 chips has continued. The simpledrm driver can now be used on systems with Apple M1 chips to output through the framebuffer provided by the firmware.
  • Support has been added for ARM SoCs, devices, and boards such as Snapdragon 7c, 845, and 888 (Sony Xperia XZ2 / XZ2C / XZ3, Xperia 1 III / 5 III, Samsung J5, Microsoft Surface Duo 2), Mediatek MT6589 (Fairphone FP1), Mediatek MT8183 (Acer Chromebook 314), Mediatek MT7986a/b (used in Wi-Fi routers), Broadcom BCM4908 (Netgear RAXE500), Qualcomm SDX65, Samsung Exynos7885, Renesas R-Car S4-8, TI J721s2, TI SPEAr320s, NXP i.MX8 ULP8, Aspeed AST2500/AST2600, Engicam i.Core STM32MP1, Allwinner Tanix TX6, Facebook Bletchley BMC, Goramo MultiLink, JOZ Access Point, Y Soft IOTA Crux/Crux+, t6000/t6001 MacBook Pro 14/16.
  • Support has been added for ARM Cortex-M55 and Cortex-M33 processors.
  • Support has been added for MIPS-based devices: Linksys WRT320N v1, Netgear R6300 v1, Netgear WN2500RP v1/v2.
  • Support has been added for the StarFive JH7100 SoC based on the RISC-V architecture.
  • The lenovo-yogabook-wmi driver has been added for keyboard backlight control and access to various sensors on the Lenovo Yoga Book.
  • The asus_wmi_sensors driver has been added to access sensors used on Asus X370, X470, B450, B550, and X399 motherboards based on AMD Ryzen processors.
  • The x86-android-tablets driver has been added for tablets based on the x86 architecture shipped with the Android platform.
  • Support for touch screens on TrekStor SurfTab duo W1 and the stylus for Chuwi Hi10 Plus and Pro tablets has been added.
  • Power management and voltage control support has been added to the drivers for SoC Tegra 20/30. Booting on older 32-bit devices based on SoC Tegra, such as ASUS Prime TF201, Pad TF701T, Pad TF300T, Infinity TF700T, EeePad TF101 and Pad TF300TG, is now possible.
  • Drivers for Siemens industrial computers have been added.
  • Support for LCD panels Sony Tulip Truly NT35521, Vivax TPC-9150, Innolux G070Y2-T02, BOE BF060Y8M-AJ0, JDI R63452, Novatek NT35950, Wanchanglong W552946ABA and Team Source Display TST043015CMHX has been added.
  • Support for audio systems and codecs AMD Renoir ACP, Asahi Kasei Microdevices AKM4375, Intel systems using NAU8825/MAX98390, Mediatek MT8915, nVidia Tegra20 S/PDIF, Qualcomm ALC5682I-VS, Texas Instruments TLV320ADC3xxx has been added. Issues with Tegra194 HD audio have been resolved. HDA support for codecs CS35L41 has been added. Improved audio system support for Lenovo and HP laptops, as well as Gigabyte motherboards.

Source: opennet.ru