Linux kernel release 6.7

After two months of development, Linus Torvalds introduced the release of the Linux kernel 6.7. Among the most notable changes are: integration of Bcachefs FS, discontinuation of support for the Itanium architecture, Nouveau's ability to work with GSP-R firmware, support for TLS encryption in NVMe-TCP, the use of exceptions in BPF, support for futex in io_uring, optimization of the fq (Fair Queuing) scheduler's performance, support for the TCP-AO (TCP Authentication Option) extension, and the ability to limit network connections in the Landlock protection mechanism, as well as added access control to user namespaces and io_uring through AppArmor.

The new version includes 18,405 fixes from 2,066 developers, with a patch size of 72 MB (the changes affected 13,467 files, adding 906,147 lines of code, and removing 341,048 lines). In the previous release, there were 15,291 fixes from 2,058 developers, with a patch size of 39 MB. About 45% of all changes in 6.7 are related to device drivers, roughly 14% pertain to updating architecture-specific code, 13% is related to the networking stack, 5% to file systems, and 3% to internal kernel subsystems.

Key innovations in kernel 6.7:

• Disk subsystem, input/output, and file systems
  • The kernel accepts Bcachefs filesystem code, which attempts to achieve performance, reliability, and scalability levels typical of XFS, combined with elements of enhanced functionality found in Btrfs and ZFS. For example, Bcachefs supports features such as the inclusion of multiple devices in a volume, layered storage layouts (a lower layer with frequently accessed data on fast SSDs, and an upper layer with less accessed data from hard drives), replication (RAID 1/10), caching, transparent data compression (LZ4, gzip, and ZSTD modes), state snapshots, integrity verification via checksums, the ability to store Reed-Solomon error correction codes (RAID 5/6), and storage of information in encrypted form (using ChaCha20 and Poly1305). In terms of performance, Bcachefs outperforms Btrfs and other Copy-on-Write-based filesystems, demonstrating speeds close to Ext4 and XFS.
  • The Btrfs filesystem has introduced a simplified quota mode that allows for higher performance by tracking extents only in the subvolume where they are created. This significantly simplifies calculations and enhances performance, but it does not allow for accounting extents that are jointly used across multiple subvolumes.
  • Btrfs has added a new data structure called 'stripe tree,' suitable for logical mapping of extents in situations where physical mapping differs across devices. This structure is currently implemented in RAID0 and RAID1 for zoned block devices. In the future, this structure is planned to be used in higher-level RAID, which will help solve several issues present in the current implementation.
  • The Ceph filesystem has implemented support for mapping user IDs of mounted filesystems. This is used to match files of a specific user on a mounted foreign partition with another user in the current system.
  • In efivarfs, the ability to specify uid and gid during mounting has been added to allow the modification of UEFI variables by processes running without root privileges.
  • In exFAT, ioctl calls have been added for reading and modifying filesystem attributes. Handling of zero-sized directories has also been implemented.
  • F2FS has implemented support for using blocks of size 16K.
  • The autofs automounting mechanism has been transitioned to utilize a new partition mounting API.
  • OverlayFS has introduced mounting options 'lowerdir+' and 'datadir+'. Support for nested OverlayFS mounting with xattrs has also been added.
  • XFS has optimized CPU load in the real-time block allocation code. It has been made possible to perform read operations and FICLONE concurrently.
  • The EXT2 code has been transitioned to use memory page folios.
• Memory and system services
  • Support for the ia64 architecture used in Intel Itanium processors has been discontinued, with sales completely halted in 2021. Intel introduced Itanium processors in 2001, but the ia64 architecture could not compete with AMD64, mainly due to the higher performance of AMD64 and a smoother transition from 32-bit x86 processors. As a result, Intel shifted its focus towards x86-64 processors, leaving Itanium in the past. servers HP Integrity, which stopped taking orders three years ago. The code for ia64 support has been removed from the kernel primarily due to the prolonged lack of maintenance for this platform. Linus Torvalds expressed willingness to restore ia64 support in the kernel, but only if a maintainer can demonstrate quality support for the platform outside the main kernel for at least a year.
  • A new kernel command-line parameter "ia32_emulation" has been added, allowing the enabling and disabling of 32-bit mode emulation support during the boot stage in kernels built for the x86-64 architecture. Practically, this new parameter allows building kernels with compatibility for 32-bit applications, but disables this mode by default to reduce the attack vector on the kernel, since the API for compatibility has been tested less than the main kernel interfaces.
  • The transfer of changes from the Rust-for-Linux branch continues, related to using the Rust language as a second language for developing drivers and kernel modules (Rust support is not enabled by default and does not make Rust a mandatory build dependency for the kernel). The new version shifts to using Rust release 1.73 and offers a set of bindings for working with workqueues.
  • The ability to use the binfmt_misc mechanism has been provided to add support for new executable file formats (for example, to run compiled applications in Java or Python) within separate unprivileged namespaces.
  • In the cpuset cgroup controller, which allows management of CPU core allocation during task execution, there is a distinction between local and remote partitioning, based on whether the parent cgroup is a valid root section. New settings 'cpuset.cpus.exclusive' and 'cpuset.cpus.exclusive.effective' have been added for exclusive CPU binding.
  • The BPF subsystem has implemented support for exceptions, which are handled as an immediate exit from a BPF program with safe stack unwinding capabilities. Additionally, the use of kptr pointers in CPU binding is allowed within BPF programs.
  • The io_uring subsystem has added support for operations with futexes and implemented new operations: IORING_OP_WAITID (an asynchronous version of waitid), SOCKET_URING_OP_GETSOCKOPT (a variant of getsockopt), SOCKET_URING_OP_SETSOCKOPT (a variant of setsockopt), and IORING_OP_READ_MULTISHOT (multiple read operations that continue until there is no data left or the buffer is filled).
  • A lightweight single-linked FIFO queue has been implemented, requiring a spinlock only for removal from the queue in process context, while allowing atomic addition to the queue without spinlock in any context.
  • A ring buffer named 'objpool' has been added, featuring a scalable implementation of a high-performance queue for allocating and returning objects.
  • An initial set of changes has been added for the implementation of the new API futex2, which offers higher performance on NUMA systems, supports sizes other than 32 bits, and can be used instead of the multiplexed system call futex().
  • Support for the current instruction set (cpuv4) of BPF has been added for ARM32 and S390x architectures.
  • For the RISC-V architecture, the capability to use the Shadow-Call Stack checking mode available in Clang 17 has been implemented, intended to protect against the overwriting of a function's return address in the event of a stack buffer overflow. The protection mechanism involves saving the return address in a separate 'shadow' stack after control is transferred to the function, and retrieving this address before exiting the function.
  • A new smart scanning mode for identical memory page merging (KSM: Kernel Samepage Merging) has been added, which tracks unsuccessfully scanned pages and reduces the intensity of their re-scanning. A setting /sys/kernel/mm/ksm/smart_scan has been introduced to enable the new mode.
  • A new ioctl command PAGEMAP_SCAN has been added, which, when used with userfaultfd(), allows for the detection of writes to a specific range of memory. This new feature can, for example, be used by systems to save and restore process states with CRIU or in gaming anti-cheat systems.
  • In the build system, the compilation of perf subsystem usage examples written as BPF programs is now enabled by default when the Clang compiler is present.
  • The old videobuf layer, which was used for managing framebuffer buffers in the media subsystem and replaced over 10 years ago with a new implementation called videobuf2, has been removed.
• Virtualization and Security
  • The fscrypt subsystem now includes the capability to encrypt data in blocks smaller than the file system block size. This may be necessary to utilize hardware encryption mechanisms that only support small blocks (for instance, UFS controllers that only support a block size of 4096 will be able to work with a file system with a block size of 16K).
  • In the iommufd subsystem, which allows managing I/O Memory Management Unit (IOMMU) page tables through file descriptors from user space, tracking of dirty data that has not yet been flushed from the cache has been added for DMA operations, which is necessary to identify memory with unflushed data during process migration.
  • The Landlock mechanism, which restricts how a group of processes interacts with the external environment, has been enhanced with the ability to define access control rules for TCP sockets. For example, you can create a rule that only allows access through network port 443 for establishing HTTPS connections.
  • The AppArmor subsystem now includes the ability to manage access to the io_uring mechanism and create user namespace identifiers, allowing selective access to these capabilities for specific processes.
  • An attestation API has been added of virtual machines to verify the integrity of the process during its loading.
  • LoongArch systems implement virtualization support using the KVM hypervisor.
  • With the KVM hypervisor on RISC-V systems, support for the Smstateen extension has been added, which blocks a virtual machine's access to CPU registers that are explicitly unsupported by the hypervisor. Support has also been added for the use of the Zicond extension in guest systems, allowing certain conditional integer operations.
  • Guest systems running under KVM based on the x86 architecture are permitted to use up to 4096 virtual CPUs.
• Network subsystem
  • The NVMe-TCP driver (NVMe over TCP), which allows access to NVMe drives over the network (NVM Express over Fabrics) using the TCP protocol, has been enhanced with support for data transmission channel encryption using TLS (KTLS is used along with the user-space background process tlshd for connection negotiation).
  • Performance optimization has been carried out for the fq (Fair Queuing) packet scheduler, achieving a 5% increase in throughput under heavy loads in the tcp_rr (TCP Request/Response) test and a 13% increase with an unrestricted stream of UDP packets.
  • The TCP protocol has added an optional feature for using timestamps (TCP TS) with microsecond precision (RFC 7323), enabling more accurate latency measurements and the creation of more advanced congestion control modules. You can enable this using the command "ip route add 10/8 … features tcp_usec_ts."
  • Support for the TCP-AO (TCP Authentication Option, RFC 5925) extension has been added to the TCP stack, allowing TCP headers to be verified using MAC codes (Message Authentication Code) with more modern HMAC-SHA1 and CMAC-AES-128 algorithms instead of the previously available TCP-MD5 option based on the outdated MD5 algorithm.
  • A new type of virtual network device called "netkit" has been added, whose data transfer logic is defined using a BPF program.
  • In KSMBD, the kernel-level SMB server implementation, support for filename conversion containing surrogate pairs for composite characters has been added.
  • In NFS, the implementation of streaming with RPC services has been improved. Support for write delegation has been added (for NFSv4.1+). The NFSD now supports the netlink handler rpc_status. Support for NFSv4.x clients has been enhanced during re-exporting to knfsd.
• Hardware
  • The Nouveau kernel module has added initial support for GSP-RM firmware, which is used in NVIDIA RTX 20+ GPUs to offload initialization and GPU management operations to a separate GSP (GPU System Processor) microcontroller. GSP-RM support allows the Nouveau driver to operate through firmware calls instead of directly programming hardware interaction operations, which significantly simplifies the addition of support for new NVIDIA GPUs by utilizing existing calls for initialization and power management.
  • The AMDGPU driver now supports GC 11.5, NBIO 7.11, SMU 14, SMU 13.0 OD, DCN 3.5, VPE 6.1, and DML2. Improved support for seamless booting (no flickering during video mode switching).
  • The i915 driver has implemented support for Intel Meteor Lake chips and added initial support for Intel LunarLake (Xe 2).
  • Support has been added for asymmetric transmission channels introduced in the USB4 v2 specifications (120/40G).
  • Support has been added for ARM SoCs: Qualcomm Snapdragon 720G (used in Xiaomi smartphones), AMD Pensando Elba, Renesas R8A779F4 (R-Car S4-8), USRobotics USR8200 (used in routers and NAS).
  • Support has been added for the Fairphone 5 smartphone and ARM platforms such as Orange Pi 5, QuartzPro64, Turing RK1, Variscite MX6, BigTreeTech CB1, Freescale LX2162, Google Spherion, Google Hayato, Genio 1200 EVK, and RK3566 Powkiddy RGB30.
  • Support has been added for RISC-V boards Milk-V Pioneer and Milk-V Duo.
  • Support has been added for audio interfaces in HUAWEI laptops using AMD CPUs. Support for additional speakers installed on Dell Oasis 13/14/16 laptops has also been added. Support for built-in speakers in ASUS K6500ZC has been included. A mute indicator has been added for HP 255 G8 and G10 laptops. Support for audio drivers acp6.3 has been included. Support for professional audio interfaces Focusrite Clarett+ 2Pre and 4Pre has been added.

At the same time, the Latin American Free Software Foundation has formed a version of the fully free kernel 6.7 — Linux-libre 6.7-gnu, cleaned of firmware and driver elements that contain non-free components or sections of code limited by the manufacturer. The 6.7 release updated the blob cleaning code in various drivers and subsystems, for example, in the drivers amdgpu, nouveau, adreno, mwifiex, mt7988, ath11k, avs, and btqca. The cleaning code for the localtalk and rtl8192u drivers has been removed due to their exclusion from the kernel. Unnecessary cleaning components for the xhci-pci, rtl8xxxu, and rtw8822b drivers, previously added by mistake, have been eliminated. Blob names have been cleaned in dts files for the Aarch64 architecture. Blobs in the new drivers mt7925, tps6598x, aw87390, and aw88399 have been removed.

Source: opennet.ru