Release of Linux kernel 6.12 with Realtime mode support

After two months of development, Linus Torvalds presented the release of the Linux kernel 6.12. Among the most notable changes are: the ability to enable Realtime mode, sched_ext for creating CPU schedulers via eBPF, QR code output during emergency states, Device Memory TCP mechanism, SCHED_DEADLINE resource reservation mechanism for servers, improvements to the EEVDF task scheduler, and the IPE module for establishing integrity enforcement policies.

The new version includes 14,607 fixes from 2,167 developers, with a patch size of 37 MB (the changes affected 13,087 files, adding 507,913 lines of code and removing 234,083 lines). In the previous release, there were 15,130 fixes from 2,078 developers, with a patch size of 85 MB (the patch in kernel 6.10 was 41 MB). About 45% of all changes presented in 6.12 relate to device drivers, approximately 12% pertain to updates of hardware architecture-specific code, 13% is related to the network stack, 6% to file systems, and 3% to internal kernel subsystems.

Key innovations in kernel 6.12:

• Memory and system services
  • The ability to compile the kernel with the PREEMPT_RT option without additional patches for real-time operation has been introduced. The last missing feature in the kernel that prevented the activation of PREEMPT_RT mode was the support for non-blocking atomic output through the printk function, which has also been incorporated into the kernel. PREEMPT_RT support is available for x86, x86_64, ARM64, and RISC-V architectures. Until now, the implementation of the PREEMPT_RT mode was provided in the form of external patches, on the basis of which some distributions like RHEL, SUSE, and Ubuntu created separate Realtime editions of their products, used in areas such as financial systems, audio and video processing devices, aviation, medicine, robotics, telecommunications, and industrial systems, where predictable event processing time is required.
  • A 'sched_ext' (SCX) mechanism has been added, allowing the use of eBPF to create CPU schedulers that cover almost all aspects of task execution scheduling and CPU resource allocation. Such schedulers can be dynamically loaded and executed within the Linux kernel. virtual machine eBPF. The sched_ext mechanism simplifies the creation of task-specific schedulers, allows experimenting with various scheduling techniques and strategies, and enables rapid prototyping and on-the-fly replacement of schedulers in operational infrastructures. For instance, using sched_ext, one can create a scheduler that takes into account the specifics of a given application and dynamically alters its execution strategy depending on the system state and other additional factors.
  • Included are the remaining patches necessary for the operation of the SCHED_DEADLINE server mechanism, which addresses the issue of regular tasks not receiving CPU resources in situations where high-priority (realtime) tasks monopolize the CPU. To prevent CPU monopolization, the kernel previously employed a Realtime throttling mechanism that tried to reserve 5% for low-priority tasks, leaving 95% of time for realtime tasks. This mechanism left much to be desired, as regular tasks often did not receive adequate processor time. The SCHED_DEADLINE server implements a more efficient resource reservation mechanism.
  • The integration of the EEVDF (Earliest Eligible Virtual Deadline First) scheduler has been completed, which replaces the CFS (Completely Fair Scheduler), which has been included since kernel version 2.6.23. The new scheduler, when selecting the next process for execution, considers processes that have not received sufficient CPU resources or have unfairly received too much CPU time. In the former case, the control is forcibly transferred to the process, while in the latter case, it is postponed. The old CFS scheduler used heuristics and fine-tuning to identify processes requiring special attention, whereas the new scheduler tracks them more explicitly and does not require fine-tuning. It is expected that EEVDF will reduce delays in task execution, which had been problematic for CFS.
  • The kernel panic handler - DRM Panic, which uses the DRM (Direct Rendering Manager) subsystem to display a visual report similar to a 'blue screen of death,' has been updated to show a logo and a QR code with the kmsg report when a failure occurs. Since the QR code can only hold 2953 bytes, there is an option DRM_PANIC_SCREEN_QR_CODE_URL, where the kmsg report is compressed using zlib and attached as a parameter to the URL, allowing approximately 7500 bytes to be transmitted through a V40 QR code. When building kernel packages, distributions can set a base URL link, enabling users to transition to a page to report issues. A configuration for QR code format selection is provided with DRM_PANIC_SCREEN_QR_VERSION.
  • Support for the ARM POE (Permission Overlay Extension) has been added, allowing the specification of access rights to memory areas. This extension enables the implementation of Memory Protection Keys on systems with ARM64 processors, which is used to restrict access to memory pages without changing the memory page table.
  • The implementation of the getrandom() system call has been ported for Loongarch, ARM64, PowerPC, and s390 architectures, optimized using the vDSO (virtual dynamic shared object) mechanism, which allows moving the system call handler from the kernel to user space, thus avoiding context switches. This optimization can speed up the retrieval of random numbers by up to 15 times.
  • The io_uring subsystem has been enhanced to support absolute timeouts, triggering when a specified time is reached on the system clock (previously, only relative timeouts were allowed, indicating duration from the start of the operation).
  • Files for generating bindings for the libcpupower library using the SWIG toolchain have been added, which allows the creation of bindings from C/C++ code for various programming languages. These bindings enable the development of scripts in Python and other languages to extend the functionality of the libcpupower library, which provides an API for managing cpufreq and drivers from user space.
  • The cpuidle utility has implemented the display of the "residency" idle state value, which is used for real-time systems and takes into account the minimum time the processor must be in the idle state to justify the energy costs of transitioning to and from that state.
  • Support for using the Clang compiler to build the standard C library nolibc, included in the Linux kernel source code, has been added. This library provides a wrapper over basic system calls. When building nolibc with Clang, link-time optimization (LTO) is allowed.
  • Certain cgroup1 interfaces, such as TCP accounting, the first version of soft limits, and free memory exhaustion control, have been deprecated. Support for these features is still fully maintained, and the warning has been issued to assess the number of users who continue to use these capabilities.
  • The ability to configure the trace ring buffer to retain accumulated data after a reboot has been added, preventing loss of gathered debugging information in the event of a kernel crash. The data is stored in memory. Activation is done via the kernel command line parameter trace_instance; for example, setting "trace_instance=boot_map@0x285400000:12M" reserves 12 MB of memory at address 0x285400000 for the "boot_map" buffer, which will be accessible through the file /sys/kernel/tracing/instances/boot_map.
  • The transfer of changes from the Rust-for-Linux branch, related to the use of the Rust language as a second language for developing drivers and kernel modules (Rust support is not enabled by default and does not make Rust a mandatory build dependency of the kernel), has continued. The ‘list’ and ‘rbtree’ modules for working with doubly linked lists and red-black trees have been added. The capabilities of the ‘init’, ‘sync’, ‘types’, and ‘error’ modules have been expanded. The use of Rust code when building the kernel with protection against Spectre attacks (MITIGATION_{RETHUNK, RETPOLINE, SLS} options), the KASAN debugging system, kCFI (kernel Control Flow Integrity) protection mechanisms, and Shadow Call, as well as the use of additional GCC plugins, has been provided. A driver for the Applied Micro QT2025 PHY Ethernet controller, written in Rust, has been added. A separate site with documentation has been prepared — rust.docs.kernel.org.
  • The kernel source code has been supplemented with the xdrgen utility for transforming XDR specifications (eXternal Data Representation) into encoding and decoding functions written in the C style adopted in the Linux kernel.
  • The kernel has accepted a change implementing a pointer masking mechanism to reduce the number of slow calls to barrier_nospec() in the 64-bit copy_from_user() function used for copying data from user space to the kernel. The use of masking speeds up the per_thread_ops test, which estimates the number of operations that can be performed in a single thread, by 2.6%.
  • A new USB driver has been added, allowing the 9pfs protocol to be used as a transport for transmitting and receiving data from a USB device when mounting a 9p file system over USB (for example, 'mount -t 9p -o trans=usbg,aname=/path/to/fs /mnt/9'). An example of using the new driver is to replace NFS to organize the root partition boot when developing embedded devices.
• Disk subsystem, input/output, and file systems
  • The VFS subsystem has added the ability to work with storage devices that have a block size larger than the memory page size in the system. This capability is currently only supported in XFS file systems.
  • The FUSE subsystem, which allows the creation of file system implementations that operate in user space, has been enhanced with support for mapping user identifiers of mounted file systems, used for associating a specific user's files on a mounted foreign partition with another user in the current system.
  • A new fcntl operation, F_CREATED_QUERY, has been implemented, giving applications the ability to determine whether a file opened with the O_CREAT flag was newly created or already existed.
  • The system call name_to_handle_at() has been enhanced to support the use of unique 64-bit identifiers for mount points to eliminate race conditions when parsing /proc/mountinfo.
  • The size of the 'file' structure in the kernel has been reduced from 232 to 184 bytes, which helps to decrease memory consumption on systems that handle files actively.
  • Mounting file systems to mount points within the /proc hierarchy, such as /proc/PID/fd, has been prohibited due to potential security issues.
  • The NSFS (NameSpace FS) pseudo-filesystem, used for managing namespaces, has been enhanced to provide additional information about the namespace mount points.
  • The EROFS (Extendable Read-Only File System), designed for use on read-only partitions, now supports mounting file systems directly from disk images saved as files.
  • New ioctl commands, XFS_IOC_START_COMMIT and XFS_IOC_COMMIT_RANGE, have been added to XFS for exchanging content between two files.
  • Support for the 'LOCALIO' protocol has been added in NFS, allowing for the determination of whether the client and NFS are on the same host, enabling relevant optimizations. server Performance optimizations have been proposed for the Btrfs file system, involving code refactoring, reduced extent locking during read operations, continued work on transitioning to the use of page folios, and automatic memory release for the btrfs_path structure.
  • In the Ext4 file system, bugs related to block allocation, extent management, the 'fast commit' mechanism, and logging have been resolved.
  • Errors related to block allocation, extent management, the 'fast commit' mechanism, and journaling have been fixed in the Ext4 file system.
• Virtualization and Security
  • The LSM module IPE (Integrity Policy Enforcement), developed by Microsoft, has been added to enhance the existing mandatory access control system. This module allows for the definition of a comprehensive integrity assurance policy for the entire system, indicating which operations are permissible and how to authenticate components. For instance, IPE can specify which executable files are allowed to run based on their compliance with a reference version using cryptographic hashes provided by the dm-verity system.
  • At the kernel compilation stage, the option to separately enable the available protection methods against different Spectre class vulnerabilities in the CPU has been provided. New parameters in Kconfig include: MITIGATE_MDS (protection against Microarchitectural Data Sampling vulnerability), MITIGATE_TAA (protection against TSX Asynchronous Abort vulnerability), MITIGATE_MMIO_STALE_DATA (protection against MMIO Stale Data vulnerability), MITIGATE_L1TF (protection against L1 Terminal Fault vulnerability), MITIGATE_RETBLEED (protection against Retbleed vulnerability), MITIGATE_SPECTRE_V1, MITIGATE_SPECTRE_V2 (protection against Spectre vulnerabilities), MITIGATE_SRBDS (protection against Special Register Buffer Data Sampling vulnerability), and MITIGATE_SSB (protection against Speculative Store Bypass vulnerability).
  • A new command-line parameter proc_mem.force_override and a set of build settings in Kconfig (PROC_MEM_FORCE_ALWAYS, PROC_MEM_FORCE_PTRACE, and PROC_MEM_FORCE_NEVER) have been added to restrict memory modification through /proc/pid/mem.
  • The LSM (Linux Security Module) subsystem has been transitioned to static calls, which has enhanced security and increased performance.
  • Support for using standard kernels for the ARM64 architecture in guest environments running on Android systems with a modified KVM hypervisor (protected KVM) has been ensured.
  • The LSM module Landlock, which allows limiting the interaction of a group of processes with the external environment, has implemented the concept of 'IPC scoping' for selectively restricting interaction with sandbox environments using Unix sockets and signals. For example, it can prohibit establishing connections using Unix sockets from a sandbox environment to processes where isolation is not applied, while allowing connections to processes within the same scope area.
  • In the KVM hypervisor, a flag has been added to the CPUID for guest systems, indicating support for AVX10.1 extensions.
• Network subsystem
  • The Device Memory TCP mechanism has been added, allowing network sockets to directly send the contents of peripheral device memory over the network (zero-copy mode) and to directly place the contents of network packets into the memory area on the recipient's side. The data transmitted in packets is transferred directly from the network card to the peripheral device's memory or from the device's memory to the network card, bypassing the CPU, while the packet headers go to the standard kernel buffers.
  • The capabilities of many Ethernet and wireless drivers have been expanded. For example, the Intel iwlwifi driver now supports offloading RLC/SMPS operations to firmware, while the RealTek rtw89 driver has seen performance improvements and support for RTL8852BT/8852BE-VT (WiFi 6) chips. The microchip Ethernet driver added support for IEEE 802.3bw (100BASE-T1) and IEEE 802.3bp specifications, along with improvements to the virtual Ethernet implementations of Microsoft vNIC and IBM veth. New drivers have been added for Realtek Ethernet chips RTL9054, RTL9068, RTL9072, RTL9075, RTL9068, RTL9071, and Microchip LAN8650/1 10BASE-T1S MAC-PHY.
  • In MPTCP (MultiPath TCP), an extension of the TCP protocol for simultaneously delivering TCP packets over multiple paths through different network interfaces, the size of the weighting coefficients used for routing has been increased from 8 to 16 bits. Detection of blackhole traffic has been implemented, along with a temporary pause on attempts to establish connections with systems leading to traffic loss.
  • Support for the 'p' flag in PIO (Prefix Information Option) has been implemented for IPv6, used in RA (IPv6 Router Advertisements) to select the client deployment model via DHCPv6-PD (DHCPv6 Prefix Delegation, RFC9663), instead of assigning individual addresses based on prefixes using SLAAC (Stateless Address Autoconfiguration). In IPv6 IOAM6, support for a new tunsrc encapsulation mode has been added to achieve higher performance.
  • The performance of IPsec control packet processing has been improved.
  • The performance of flushing large sets of nftables rules has been enhanced. Support for the SCTP protocol has been improved in nfnetlink_queue.
  • Support for binding multiple network cards to a single network interface has been added to the ethtool API.
• Hardware
  • In the AMDGPU driver, work has continued on implementing support for AMD RDNA4 GPUs ("GFX12"). The ability to reset individual task queues without resetting the state of the entire GPU has been added.
  • Continued work on the DRM driver (Direct Rendering Manager) Xe for GPUs based on the Intel Xe architecture, which is used in Intel Arc graphics cards and integrated graphics starting with Tiger Lake processors. The new version includes support for GPUs based on the Battlemage and Lunar Lake microarchitectures. Support for CCS modifiers (Color Control Surface) Xe2 is introduced for managing the parameters of integrated and discrete GPUs.
  • The i915 driver now supports output via the HWMON or sysfs interface (the attribute 'fan1_input') to provide information about fan speed. The parameter 'i915.modeset' is deprecated; instead of 'i915.modeset=0', the 'i915.nomodeset' parameter should be used.
  • Support for GPUs A615, A306, and A621 has been added to the DRM msm driver (Qualcomm Adreno GPU).
  • The Nouveau driver has undergone restructuring and internal cleanup.
  • The intel_pstate driver, which manages power consumption parameters (P-state) on systems with Intel processors, has added support for hybrid systems with asymmetric (differing specifications) CPUs, as well as power management support for processors based on the Granite Rapids and Sierra Forest microarchitectures. The intel_idle driver has added support for Xeon Granite Rapids CPUs. The intel_rapl driver enables recognition of AMD family 1Ah processes and Intel ArrowLake-U processors.
  • Continued enabling of changes to support the ARM SoC Snapdragon X Elite, which features its own 12-core Qualcomm Oryon CPU and Qualcomm Adreno GPU. The chip is aimed at use in laptops and PCs and outperforms Apple M3 and Intel Core Ultra 155H chips in many performance tests.
  • Support for ARM platforms, SoCs, and devices has been added: Broadcom bcm2712 (Raspberry Pi 5), Renesas R9A09G057 (RZ/V2H), Qualcomm Snapdragon 414 (MSM8929), Lenovo ThinkPad T14s Gen 6, Lenovo A6000/A6010, Surface Laptop 7, Anbernic RG35XXSP, Firefly Core-PX30-JD4, Lunzn Fastrhino R68S, Aspeed Riser, AGX Orin, Rockchip Qnap-TS433, Huashan Pi, Meta Catalina, BeagleY-AI, NanoPi R2S Plus, ExynosAuto v920, SOPHGO SG2002, Qualcomm IPQ5332, LG G4 (h815), Cool Pi CM5 GenBook, Anbernic RG35XXSP, GameForce Ace, IBM P11, Kontron i.MX93 OSM-S, NanoPC-T6.
  • Support for display panels Anbernic RG28XX, On Tat Industrial Company KD50G21-40NT-A1, Innolux G070ACE-LH3, Melfas lmfbx101117480, Densitron DMT028VGHMCMI-1D, Microchip AC40T08A, AOU B116XTN02.3, AUO B116XAN06.1, AOU B116XAT04.1, BOE TV101WUM-LL2, BOE NV140WUM-N41, BOE NV133WUM-N63, BOE NV116WHM-A4D, BOE NE140WUM-N6G, CMN N116BCA-EA2, CMN N116BCP-EA2, CSW MNB601LS1-4, Starry er88577 has been added.
  • The audio subsystem has been updated to support RME Digiface USB, AMD ACP 7.1, Mediatek MT6367, MT8365, Realtek RTL1320, and C-Media CM9825 chips and codecs. Older audio drivers for ASoC Intel have been deprecated, and it is recommended to use AVS drivers instead. Many improvements have been made to the SoundWire driver.

Source: opennet.ru