Release of Linux kernel 6.15

After two months of development, Linus Torvalds released the Linux kernel 6.15. Among the most notable changes are: the auditing mechanism in Landlock, the memory mapping locking mode, the fwctl subsystem, the Nova driver for NVIDIA GPUs, the implementation of the host system for the Hyper-V hypervisor, support for zoned storage devices in XFS, optimization of the network subsystem, scrub checks in Bcachefs, and the ability to control operations via io_uring.

The new version includes 15,945 fixes from 2,154 developers, with a patch size of 59 MB (changes affected 13,596 files, adding 739,608 lines of code and removing 312,168 lines). The previous release had 12,115 fixes from 1,984 developers, with a patch size of 39 MB. About 41% of all changes presented in 6.15 are related to device drivers, approximately 16% pertain to hardware-specific code updates, 13% relate to the network stack, 5% to file systems, and 4% to internal kernel subsystems.

The main innovations in kernel 6.15:

• Disk subsystem, input/output, and file systems
  • The fanotify mechanism now includes the ability to track mount and unmount events.
  • XFS has added support for zoned storage devices (a division into zones of groups of blocks or sectors, where only sequential data addition is allowed, updating the entire group of blocks at once). A rwf_dontcache flag has been added to disable caching on write operations. Support for atomic writing of multiple data blocks at once has been implemented.
  • Btrfs now allows specifying negative zstd compression levels (-15 to -1, for example, 'compress=zstd:-5') during mounting, providing higher speed at the cost of decreased compression efficiency. File path caching has been improved (in a conducted test, the 'send' operation sped up by 30%). Support for 2K blocks has been added.
  • In EXT4, performance has been enhanced for journaling with a very high number of revoked entries (a load characteristic of filesystems under Lustre). A linear search for 'dentry' records (the internal representation of directory entries) has been implemented, addressing issues with access to certain files in case-insensitive mode. The 'errors=remount-ro' mount option has been fixed. Resilience has been enhanced when handling corrupted filesystems.
  • F2FS implements an ioctl for retrieving information about the I/O operation priority for a specified file. Work has been done to transition to using page folios.
  • Bcachefs has added a "scrub" mode, which checks the integrity of reading all data and metadata from the filesystem. If errors are detected, a recovery procedure is initiated. Bcachefs also supports filesystems where the block size is greater than the page size. The disk structure format of Bcachefs has been stabilized (further format changes will be implemented as optional extensions).
  • EROFS now includes support for 48-bit block addressing.
  • The FUSE subsystem implements sysctl default_request_timeout and max_request_timeout to set timeouts for request execution, which allows monitoring for hangs in FUSE components running in user space. The maximum file name size in FUSE has been increased to 1024 characters.
  • The statmount() system call now allows obtaining information about the mapping of user identifiers of mounted filesystems, which is used to map a specific user's files on a mounted foreign partition to another user in the current system.
  • The ability to create a mount point with a different mapping of user identifiers from that of the original mounted partition has been released.
  • Changes have been made to the API for managing mounting, simplifying the assembly of complex filesystems hierarchies without exposing individual parts of the filesystems that need to remain hidden.
  • Support for hardware encryption key protection devices has been added to the subsystem for working with block devices.
  • The SMB filesystem now implements the is_network_name_deleted option and the smb_server_kerberos5 mode is enabled by default.
  • For OverlayFS, a mount option "override_creds" has been added, which specifies that access to the lower levels of the storage will use the credentials of the calling user instead of that of the user who performed the mount. This change, for example, allows requiring a user with CAP_SYS_ADMIN privileges to mount OverlayFS but to use the filesystem with credentials lacking this privilege.
  • In exFAT, file deletion operations have been accelerated. Instead of sending 'discard' requests individually for each released cluster of the deleted file, the driver now groups the requests together. In the conducted test, the time to delete an 80 GB file decreased from 286 seconds to 1.6 seconds.
  • All pseudo-FS and EXT2 FS have been migrated to use the new partition mounting API.
  • The code for supporting the SYSV file systems (SystemV/386, Xenix, and Coherent), which has been marked as unsupported (orphaned) since 2023, has been removed.
• Memory and system services
  • The minimum required version of GCC for building the kernel has been raised to 8.1, and Clang to 15.0.0.
  • The fwctl (Firmware Control) subsystem has been added, providing an API for secure firmware management and execution of handlers on firmware from user space. Drivers for CXL (Compute Express Link) devices, Mellanox ConnectX (mlx5) Ethernet adapters, and AMD/Pensando service cards have been prepared based on fwctl.
  • The capabilities of the pidfd mechanism have been expanded, allowing the use of identifiers associated with specific processes that are not reusable, unlike pid. It now provides the ability to extract the exit status of a process identified through pidfd after the parent process has received confirmation of the termination of the child process (reaped) and its resources have been released. A PIDFD_SELF flag has been added to system calls, enabling a process to reference itself.
  • Support for BFloat16, Zaamo (atomic memory operations), Zalrsc (Load-Reserved/Store-conditional), and ZBKB (bitwise operations for cryptography) extensions has been implemented for the RISC-V architecture.
  • When tracing, the ability to save the arguments of called functions and display them in trace logs has been provided.
  • Support for reading event information from epoll has been added to the asynchronous input/output system io_uring. Using io_uring for processing epoll events reduces the number of context switches and allows handling multiple epoll events at once.
  • The eBPF subsystem has improved the verification of programs with loops. New instructions 'timed_may_goto', 'load-acquire', and 'store-release' have been added. It is now possible to modify extended file attributes from BPF programs. A new function try_alloc_pages() has been introduced, designed to allocate memory under a high likelihood of operation failure (when running BPF programs in constrained contexts).

    A new locking primitive has been implemented — rqspinlock (Resilient Queued Spin Lock), which identifies deadlock situations during execution. This new primitive allows the loading of BPF programs for which the verifier does not ensure correctness when it comes to locks.

  • The reliability of allocating huge pages of memory has been significantly increased.
  • The performance of CRC64 checksum calculations on x86 systems has been significantly accelerated. Among other things, new vector instructions from the AVX-512 set have been utilized for this acceleration. In some cases, performance has increased by 100 times.
  • The transfer of changes from the Rust-for-Linux branch has continued, related to the use of Rust as a secondary language for developing drivers and kernel modules (support for Rust is not enabled by default and does not require Rust to be included as a mandatory build dependency for the kernel). The kernel code can now utilize the macro ‘#[kunit_tests()]’ to run unit tests. Support for the ARMv7 architecture has been added. The dma and hrtimer modules with Rust bindings for DMA (added by Linus bypassing the maintainer, who subsequently resigned from his position) and high-resolution timers have been implemented. The ‘list,’ ‘str,’ ‘sync,’ ‘error,’ and ‘alloc’ modules have been expanded. Support for the new syntax ‘&raw’ (raw_ref_op) has been added.
  • In the perf subsystem, profiling delays has been enabled using information from the task scheduler.
  • A new kernel command line parameter ‘traceoff_after_boot’ has been added, which disables tracing after the kernel has booted and the init process has started. This parameter can be used for diagnosing boot-related issues, ensuring that data collected during boot will not be overwritten.
  • Support for 32-bit x86 systems with more than 8 CPUs and 4 GB of RAM has been discontinued. Such hardware has not been produced for a long time, and systems requiring these resources have been migrated to 64-bit CPUs.
  • Changes have been made to the implementation of POSIX timers, allowing the CRIU (Checkpoint/Restore in Userspace) toolkit to save and restore timer IDs.
• Virtualization and Security
  • The capability to use Linux as the root environment (Dom0, root partition) for the Hyper-V hypervisor (Microsoft Hypervisor) has been added. The host environment is responsible for managing the hypervisor, organizing the start of guest systems, allocating resources, and ensuring interaction of virtual machines with the hardware. The management of the Hyper-V hypervisor in Linux is done through the /dev/mshv device.
  • The Landlock module, which provides unprivileged programs with means to limit the use of Linux kernel objects (file hierarchies, network sockets, ioctl, etc.), has been enhanced with an auditing mechanism. The audit allows for a detailed evaluation of the reasons for access denials enforced by Landlock, as well as providing insight into when and what operation was blocked, the reason for the block, and which rule was triggered.
  • The ability to implement handlers in LSM modules (Linux Security Modules) that control accesses to the io_uring asynchronous I/O system and block the use of io_uring to bypass access restrictions to system calls has been added. Such a handler has been implemented in the SELinux LSM module.
  • In SELinux, the ability to apply policies to any type of data loaded by the kernel, including firmware images, security policies, and certificates, has been implemented.
  • A sealing mode for certain memory mapping operations performed by the kernel in the process's address space has been added. Sealing changes the mapping to read-only mode and prevents modification in the event of an exploited vulnerability. This applies to the mappings of vDSO, vsyscall, vvar, sigpage, and uprobes. The mode is disabled by default, as it may disrupt the operation of some applications. To enable it, the CONFIG_MSEAL_SYSTEM_MAPPINGS build option has been added.
• Network subsystem
  • Work continues on removing the global RTNL lock (rtnl_lock) from the network stack and transforming it into locks tied to individual network namespace spaces.
  • The initial capability to receive network packets via io_uring has been added, allowing for the content to be directly copied into the program's memory space without intermediate buffering (zero-copy). In conducted tests, this change enabled handling traffic through a 200 Gigabit channel using a single CPU core.
  • The sysctl tcp_rto_max_ms and TCP socket option TCP_RTO_MAX_MS have been implemented, allowing you to set the maximum time between packet retransmission attempts.
  • A series of callback calls have been added to BPF to obtain timing information from various locations in the network stack, which can be used for diagnosing network latency issues.
  • Performance optimizations for network operations have been added:
    • The GRO (Generic Receive Offload) optimization, which combines multiple small packets into a larger one, is now utilized when switching packet processing to another CPU (for load balancing) while using the XDP (eXpress Data Path) subsystem, allowing packet processing at the network driver level before they are sent to the network stack. The performance gain in TCP stream processing from this optimization can reach up to twofold.
    • Under heavy load, the performance of the connect() function has increased by up to two times by replacing spin-locking with the RCU (Read-Copy-Update) synchronization mechanism when searching for records containing connection information (source and target ports). Additionally, hash optimization has provided a further performance boost of 229%. an IP address The implementation of MPTCP (Multipath TCP), an extension of the TCP protocol for enabling packet delivery simultaneously over multiple routes through different network interfaces tied to different IP addresses, has been accelerated. In single-stream mode, MPTCP has been sped up by 29%.
    • In netfilter, when a socket exists, route lookups in the FIB (Forwarding Information Base) have been discontinued. Thanks to this optimization, performance has increased by 20%.
    • UDP performance under flood conditions has been enhanced by 10% by eliminating unnecessary operations with the sk_tsflags structure when receiving packets.
    • UDP performance during flooding conditions has been increased by 10% by eliminating unnecessary operations with the sk_tsflags structure when receiving packets.
  • A driver implementing the MCTP-over-USB protocol has been added.
• Hardware
  • The initial implementation of the Nova driver for NVIDIA GPUs equipped with GSP firmware has been accepted into the kernel, used since the NVIDIA GeForce RTX 2000 series based on the Turing microarchitecture. The driver is written in Rust. In the first phase, only the nova-core framework has been added, consisting of about 400 lines of code and implementing a basic level of abstractions over GSP firmware APIs. In the next phase, the kernel plans to include the DRM driver nova-drm (Direct Rendering Manager) for interaction with the GPU from user space, as well as the VFIO driver with a vGPU manager, allowing the use of virtual NVIDIA GPUs in virtualization systems.
  • Work on the Xe DRM driver (Direct Rendering Manager) for GPUs based on the Intel Xe architecture, which is used in Intel Arc family graphics cards and integrated graphics from Tiger Lake processors, has continued. Support for SVM (Shared Virtual Memory), a component of the DRM framework managing shared memory used jointly by CPU and GPU, has been added.
  • Identifiers for new GPUs have been added to the i915 driver.
  • In the Nouveau driver, the GSP RPC has been redesigned and the drm_slave_encoder interface has been integrated.
  • Support for the DCN36 (Display Core Next) architecture has been implemented in the AMDGPU driver. The ability to set custom brightness curves used for display brightness correction has been added.
  • Support for the Qualcomm Adreno 623 GPU has been added to the adreno driver.
  • Support for Apple Touch Bar touch panels has been added.
  • Support has been added for version two of the eUSB2 extension (eUSB2V2 - Embedded USB2 Version 2.0), allowing for reduced power supply voltage (down to 1.2 volts) and improved USB 2.0 performance. Data transfer speeds in eUSB2V2 can reach 4.8 Gbps, which is ten times faster than the typical 480 Mbps of USB 2.0. eUSB2V2 will enable laptop manufacturers to equip their devices with higher-resolution webcams while continuing to use the Embedded USB2 bus for connection.
  • Support has been added for Intel Killer E5000 Ethernet adapters (RTL8126).
  • Support has been added for the Visionox RM692E5 display panels, Rockchip w552793dba-v10, kingdisplay-kd110n11-51ie, and starry-2082109qfh040022-50e.
  • A driver for Samsung Galaxy Book laptops has been added.
  • Support for audio systems Presonus Studio 1824c and Jabra Evolve 65 has been added. Support has also been added for AMD ACP 7.x DSP modules, AWINC WM88166, Everest ES8388, Intel AVS PEAKVOL, and GAIN. Audio support has been improved on ASUS, HP, and Lenovo laptops.
  • Support has been added for ARM platforms, SoCs, and devices: Arm Morello, AMD (Xilinx) Versal NET, Google Pixel Pro 6, NetCube Kumquat, MYIR Remi Pi, Huawei Matebook E Go, Milk-V Jupiter ST STM32MP2, Mediatek MT8370, Apple T2, Skov (i.MX8MP), EVK (i.MX95), Rockchip RK35xx, Allwinner A523, and 11 Toradex boards based on i.MX6.

Simultaneously, the Latin American Free Software Foundation has formed a version of the fully free kernel 6.15 - Linux-libre 6.15-gnu, which is cleansed of firmware and driver elements that contain non-free components or portions of code restricted by the manufacturer. In release 6.15, blob loading has been neutralized in drivers nova, Qualcomm iris v4l2, Airoha NPU, Tehuti Networks TN40xx 10G ethernet, Realtek 8814A wifi, Apple Silicon SoC touchscreen, Renesas UFS, and aw88166 audio. The cleaning of the Spider 1Gb ethernet driver has been halted, as it was removed from the kernel. Links to tivonized binary files have been removed. Blob loading from Rust code has been blocked.

Source: opennet.ru