Release of Linux kernel 6.16.

After two months of development, Linus Torvalds has released the Linux kernel version 6.16. Among the most notable changes are: a driver to accelerate OpenVPN, the Kexec HandOver mechanism, the inclusion of five-level page tables for x86 by default, the removal of the DCCP protocol, the zloop block driver, the ability to send core dumps via UNIX socket, support for atomic writes in XFS, offload handling of sound for USB devices, optimizations in Ext4, a virtual TPM (Trusted Platform Module) driver, a complete implementation of Device Memory TCP, support for unnamed pipes in io_uring, preparations for integrating the Asahi DRM driver, the 'usermode queue' mechanism in the AMDGPU driver, and support for Intel TDE (Trusted Domain Extensions) and Intel APE (Advanced Performance Extensions).

The new version includes 15,924 fixes from 2,145 developers, with a patch size of 50 MB (changes affected 13,793 files, adding 655,451 lines of code, and removing 316,441 lines). The previous release had 15,945 fixes from 2,154 developers, with a patch size of 59 MB. About 45% of all changes presented in 6.16 are related to device drivers, approximately 16% pertain to updates of architecture-specific code, 13% relate to the networking stack, 4% involve file systems, and 3% are associated with internal kernel subsystems.

Key innovations in kernel 6.16:

• Disk subsystem, input/output, and file systems
  • A zloop driver has been added to create zoned block loopback devices, which are mounted in loop mode. The driver emulates the behavior of regular block devices using several files from an existing file system (one file for each zone). This feature may be useful for testing file systems, device mapper handlers, and applications for their support of zoned devices that apply zone grouping of blocks or sectors, which only allow sequential data addition with the entire group of blocks being updated.
  • In the XFS file system, support for atomic writes of large data chunks has been implemented — several blocks can now be written in atomic mode (either all blocks will be successfully written, or none will be written).
  • The Ext4 file system has improved the performance of the 'fast commit' mechanism. Support for large memory pagefolios has been added for regular files, which, in conducted tests, increased performance by 37% during intensive sequential I/O. Support for atomic write operations spanning multiple blocks has been added.
  • Support for the DAX mechanism, which provides direct access to the FS bypassing the page cache, has been deprecated in the ext2 file system driver. The removal of DAX from the ext2 driver is scheduled for the end of the year. The reason mentioned is the consideration of the ext2 driver as a stable reference implementation, in which the use of specific features that have not gained proper adoption is unacceptable.
  • The OrangeFS, UFS, BFS, and OMFS file systems have been transitioned to use the new partition mounting API.
  • A new setting vfs_cache_pressure_denom has been added to sysctl to manage the number of entries in the 'dentry' cache (the internal representation of directory elements) under low memory conditions. The higher the value set, the more entries can be evicted from the cache (fewer entries will remain in the cache) when memory is low.
  • In the Bcachefs file system, the 'rebalance_on_ac_only' option has been added, preventing rebalancing and background compression operations when the system is powered by a battery. Operations for deleting snapshots and devices have been accelerated. Memory consumption during read-only mount mode has been reduced. The ability to run some recovery operations in the background without stopping work with the FS has been added.
  • The power management subsystem is allowed to independently freeze file systems and EFI variables for sleep and hibernation modes (if the FS is already frozen by the user-space handler, no re-freezing occurs).
  • The performance of EROFS can be accelerated using the built-in Intel QAT (QuickAssist Technology) processor accelerator, which offers tools for speeding up computations related to compression and encryption.
  • The maximum data packet size for read and write operations in NFS has been increased from 1 to 4 MB (the default is set to 1 MB, as not all clients support larger sizes).
  • Unprivileged users with CAP_SYS_ADMIN rights in a separate user namespace, but without elevated rights in the root namespace, are provided the ability to use the fanotify mechanism to monitor changes in file systems.
  • For file systems using the FUSE subsystem, functionality has been added to clear all cached directory entries (dentries) at once. Support for large page folios has been added to the FUSE subsystem.
  • In the OverlayFS, support has been implemented for creating data layers in unprivileged namespaces that utilize integrity checking based on the dm-verity module. This feature allows for combining trusted layers with metadata and untrusted data layers processed in unprivileged namespaces.
• Memory and system services
  • The KHO (Kexec HandOver) mechanism has been added to launch a new kernel from an old one without losing system state. Before handing control to the new kernel version, the state of key kernel subsystems can be serialized in a memory area that will not be affected by subsequent operations. The new kernel, upon gaining control, restores the serialized state. The Live Update Orchestrator (LUO) subsystem, which allows for kernel reloads without stopping device operations, is being developed based on KHO.
  • A new kernel build parameter CONFIG_X86_NATIVE has been added, allowing the use of the '-march=native' option during compilation to optimize based on the capabilities of the current system’s processor.
  • Support for the Intel APX (Advanced Performance Extension) instruction set architecture extension has been added, providing 16 additional general-purpose registers (in addition to the existing 16), allowing for fewer memory read and write operations in code to enhance performance and reduce power consumption.
  • A mode for automatic memory distribution policy tuning in NUMA systems has been added, where all node weights are recalculated when new bandwidth information is available during boot or when memory is hot-plugged.
  • The implementation of futexes has introduced support for a local hash table of processes (local futex_hash_bucket), which, unlike the previously supported global hash table for all processes, is local to a single process and is shared by all threads of that process. Local hash tables are used only for the PROCESS_PRIVATE futex operation. Additionally, the new release adds support for FUTEX2_NUMA and FUTEX2_MPOL options, allowing control over the placement of futexes in memory, positioning them closer to the processes that use them.
  • For x86_64 systems, permanent support for five-level page tables (the CONFIG_X86_5LEVEL parameter that controlled the inclusion of five-level tables has been removed) is included.
  • The intel_pstate driver, which manages power consumption parameters (P-state) on systems with Intel processors, has added support for a task scheduler that considers energy consumption (EAS — Energy Aware Scheduling) on hybrid processors that combine high-performance and energy-efficient CPU cores, such as Intel Lunar Lake.
  • Interfaces have been added to sysfs: "/sys/devices/system/cpu/cpuN/cpu_capacity" to obtain information about the capabilities of various CPUs in hybrid processors and "/sys/devices/system/cpu/cpuidle/intel_c1_demotion" to manage the ability to keep a CPU in a more productive state even if the core is trying to transition the CPU to a lower power state (for example, a core may request a transition to power state C6, but firmware may keep it in state C1 during high awakening intensity).
  • For the ARM64 architecture, support for the lazy task preemption mode (PREEMPT_LAZY) has been included, which corresponds to the full preemption mode for real-time tasks (RR/FIFO/DEADLINE) but delays preemption of normal tasks (SCHED_NORMAL) until the tick boundary.
  • For the ARM64 architecture, support for the use of SME (Scalable Matrix Extension) extensions has been added, enabled through the CONFIG_ARM64_SME parameter.
  • Continued the transfer of changes from the Rust-for-Linux branch related to using the Rust language as a second language for developing drivers and kernel modules (Rust support is not enabled by default and does not require Rust to be among the mandatory build dependencies for the kernel). For modules written in Rust, the option to use configfs is provided. Added necessary abstractions for developing graphics drivers. Enhanced capabilities of the alloc, time, str, list, workqueue, and page modules. Added support for the "assert!" macro in tests based on KUnit. Introduced a set of abstractions for managing CPU frequency and the API related to power management. Support for the data structure 'xarray' has been added.
  • For the RISC-V architecture, the implementation of the getrandom() system call has been ported, optimized using the vDSO (virtual dynamic shared object) mechanism, which allows shifting the system call handler from the kernel to user space and avoids context switches. In conducted tests, the optimization accelerated random number generation by 17 times. For RISC-V, support for vector extensions Zicbop, Zabha, and Svinval, used in SiFive processors, has also been implemented.
  • For the LoongArch architecture, the limit on the number of CPUs in the system has been raised from 256 to 2048. Support for the SCHED_MC (Multi-core) task scheduler has been added.
  • The ability to use Unix sockets for passing file descriptors has been introduced. To disable this functionality, applications can use the SO_PASSRIGHTS flag in setsockopt().
  • The ability to map a ring buffer used for kernel tracing into user space memory has been provided.
  • Crash-dump handlers used to generate a report on issues after the kernel crashes can now utilize the LUKS keys used by the faulty kernel to save crash dumps in encrypted file systems.
  • The io_uring asynchronous input/output system has added the IORING_OP_PIPE operation for creating unnamed pipes, similar to the pipe2 system call, except it supports fixed file descriptors.
  • A kernel command line option 'rt_group_sched' has been added to control the enabling of the scheduler for managing groups of realtime tasks (SCHED_RR). The option is similar to the RT_GROUP_SCHED setting in Kconfig.
  • For devices based on the CXL (Compute Express Link) bus, used to organize high-speed interaction between the CPU and memory devices, support for RAS (Reliability, Availability, Serviceability) extensions has been implemented, allowing for various error detection and correction schemes. CXL enables the connection of new memory areas provided by external memory devices and uses them as additional resources for the physical address space to expand system RAM (DDR) or persistent memory (PMEM).
  • The minimum required GCC version for kernel compilation across all architectures has been raised to GCC 8. Additionally, at least version 2.30 of the binutils package is now required for compilation.
  • The system call uselib() has been removed, as it has long been deprecated; mmap() is now used for program access to shared libraries.
• Virtualization and Security
  • Initial support has been added for the Intel TDX (Trusted Domain Extensions) mechanism to protect guest systems running under the KVM hypervisor from intrusion and analysis by the host system administrator, as well as physical attacks on the hardware. Protection is ensured through memory encryption. of virtual machines.
  • A virtual TPM (Trusted Platform Module) driver has been added, allowing virtual machines to interact with TPM devices emulated by the SVSM (Secure VM Service Module).
  • The use of the GCC plugin randstruct has been restored, which randomizes the layout of data structures at compile time to complicate the exploitation of vulnerabilities.
  • Support for using IMA (Integrity Measurement Architecture) technology to check integrity at the start of new kernels via the kexec system call has been added.
  • Work has been done to reduce the performance impact of using SELinux. To speed up operations, a cache of access check results for directories has been added. The genfscon rules now allow the use of masks.
  • In the code interacting with EFI, the ability to embed the SBAT (UEFI Secure Boot Advanced Targeting) section with metadata about revoked boot component versions has been provided.
  • In the loaded modules, the '.static_call_sites' section has been switched to read-only mode after initialization is complete.
  • For 64-bit ARM systems, nested virtualization support is implemented in the KVM hypervisor (disabled by default).
  • Stable support for the RISC-V architecture has been declared in the KVM hypervisor.
• Network subsystem
  • The ovpn driver has been accepted, allowing significant performance improvements for OpenVPN by offloading encryption, packet processing, and channel management operations to the Linux kernel. The driver eliminates overhead associated with context switching, optimizes performance through direct access to the kernel's internal APIs, and avoids slow data transfers between the kernel and user space (encryption, decryption, and routing are performed by the module without sending traffic to the user-space handler).
  • The Device Memory TCP mechanism has been updated to support sending data from device memory (TX path). Previously, to simplify the integration of Device Memory TCP into the kernel, functionality was limited to data reception (RX path). Device Memory TCP allows for the use of network sockets for direct sending of peripheral device memory content over the network (zero-copy mode), as well as direct placement of network packet content in the device memory on the receiver's side. Data transmitted in packets moves from the network card to the peripheral device's memory (DMABUF), such as GPU memory, or from device memory directly to the network card, bypassing the CPU, while packet headers are stored in regular kernel buffers.
  • Sending the contents of core dumps through the AF_UNIX socket is now possible, enabling the creation of more secure user-space core dump handlers that are not reliant on privileged process calls from the kernel.
  • Support for the DCCP (Datagram Congestion Control Protocol) network protocol, which has not gained popularity and has remained unmaintained in the kernel for five years, has been removed. The removal of DCCP from the kernel will eliminate barriers that hinder the redesign of the inet_connection_sock data structure to enhance TCP stack efficiency. Support for netfilter modules for DCCP packet filtering has been retained.
  • To simplify error handling when using sockets, the kernel can now pass pidfd for already terminated processes (pidfd is tied to specific processes and unlike pid, is not reassigned).
  • With BPF, it is now possible to create packet queue management handlers in the network stack (qdiscs) to influence the order of network packet processing.
  • The AFS network file system has implemented GSSAPI (Generic Security Services API) for managing encryption of connections with servers YFS and OpenAFS.
  • A significant amount of optimizations has been made. The lock organization for IPv6 routing tables has been reworked (some routing operations now perform up to 3 times faster). The software computation of crc32c checksums has been accelerated. The GRO engine for tunneled UDP traffic has been sped up by 10%. The auto-tuning of the receiving buffer for TCP has been improved and the default limits have been increased (in conducted tests, throughput for single streams over a 200Gbs channel increased by 60%).
  • Netfilter has added the ability to use masks in the names of network devices used in netdev and flowtable. The conntrack tracing information has been integrated into the nft trace infrastructure. The extraction of connection tracking tables (conntrack) via procfs has been accelerated.
• Hardware
  • Support has been added for offloading audio stream processing to USB interface sound devices (USB audio offload). This change significantly reduces the power consumption of portable devices by continuing to process the audio stream while the rest of the system is in sleep mode. Previously, a specific implementation of audio offload processing for USB devices was provided in kernels for the Android platform, and now a universal implementation has appeared in the main kernel that can be used by any projects.
  • Continued integration of Nova driver components for NVIDIA GPUs equipped with GSP firmware, used starting from the NVIDIA GeForce RTX 2000 series based on the Turing microarchitecture. The driver is written in Rust. In addition to the nova-core component added in the previous release, which implements a basic level of abstraction over the GSP firmware programming interfaces, version 6.16 includes the initial implementation of the nova-drm (Direct Rendering Manager) DRM driver for interacting with the GPU from user space.
  • The process of promoting the Asahi DRM driver for Apple AGX GPUs, used in Apple Silicon chips, has begun. The driver is written in Rust. At this stage, only UAPI header files from the Asahi driver necessary for Mesa have been included in the kernel, while the main code of the Asahi driver will be integrated later.
  • Support for NVIDIA Hopper and Blackwell family GPUs has been added to the Nouveau driver.
  • Work on the Xe DRM driver (Direct Rendering Manager) for GPUs based on the Intel Xe architecture, which is used in Intel Arc family graphics cards and integrated graphics starting from Tiger Lake processors, has continued. The ability to use different firmware files for different Intel GPU families has been added.
  • Support for the 'usermode queue' mechanism has been implemented in the AMDGPU driver, allowing the creation of custom work queues in user space and sending them directly to the GPU without contacting the scheduler in the kernel. Support for 'usermode queue' is enabled for Navi 4X and GFX 12 GPUs.
  • Support for Intel WCL (Whiskey Lake) audio systems, AMD ACP 7.x (Audio Co-Processor), Cirrus Logic CS35L63 and CS48L32, Everest Semiconductor ES8375 and ES8389, Pioneer DJM-V10, Longsoon-1 AC’97, NVIDIA Tegra264, Richtek ALC203, RT9123, and Rockchip SAI, as well as new Intel AVS platforms, has been added.
  • Support for ARM platforms, SoCs, and devices has been added: Samsung Exynos7870, Qualcomm Snapdragon X1P42100, Qualcomm MSM8926, RK3562, NXP i.MX94, Renesas RZ/V2N, Amlogic S6/S7/S7D, WonderMedia wm8950, Amlogic s805y, Allwinner A523, Toradex Verdin AM62P, ROCK 5B+, Nitrogen8M Plus, Retronix R-Car V4H Sparrow Hawk, MT8186 Ponyta Chromebook, VIA APC Rock/Paper, Renesas rz/t2h, ASUS Transformer Pad LTE TF300TL, LG Nexus 4, Google Pixel 4a, Raspberry Pi 2.
  • The driver for video capture cards based on STA2X11 chips has been removed.

At the same time, the Latin American Free Software Foundation has formed a fully free kernel version 6.16 — Linux-libre 6.16-gnu, stripped of firmware and driver elements that contain non-free components or code segments restricted by the manufacturer. In release 6.16, blob loading in the new Intel qat 6xxx crypto, ST vd55g1 sensor, ath12k AHB wifi, Aeonsemi AS21xxx, and MediaTek 25Gb Ethernet drivers has been neutralized. The cleanup of blob names in dts files (device tree) for Qualcomm and MediaTek ARM chips has been completed. The blob cleanup code in the Nova Core, Nouveau, Realtek r8169 Ethernet, Qualcomm Iris, Venus, Mediatek mt7996 wifi, Qualcomm ath11k and ath12k wifi, Texas Instruments tas2781, and Renesas R-Car gen4 PCIe drivers has been updated.

Source: opennet.ru