Release of Linux kernel 6.18

After two months of development, Linus Torvalds has released the Linux kernel 6.18. Among the most notable changes are: dm-pcache for disk caching in persistent memory (PMEM), removal of Bcachefs, online XFS checking mode, Binder (Android IPC) and Tyr (Mali GPU) drivers in Rust, the ability to create USB drivers in Rust, optimization of caching in the SLUB memory allocator, namespace addressing via file descriptors, improved swap performance, BPF program verification through digital signatures, Intel CET virtualization in KVM, the PSP network protocol (a hybrid of TLS and IPsec), support for the IP extension AccECN, and UDP stack optimization.

The new version includes 15,035 fixes from 2,217 developers, with a patch size of 45 MB (changes affected 13,142 files, added 601,897 lines of code, and removed 355,006 lines). The previous release had 14,334 fixes from 2,118 developers, and a patch size of 46 MB. Approximately 40% of the changes presented in 6.18 are related to device drivers, about 16% pertain to updating architecture-specific code, 12% relate to the network stack, 5% to file systems, and 3% to internal kernel subsystems.

Key innovations in kernel 6.18 (1, 2, 3):

• Disk subsystem, input/output, and file systems
  • The Device Mapper has added the dm-pcache handler for using persistent memory (CXL memory addressed through DAX devices) as an additional high-performance cache in front of slower traditional disk or flash storage. Dm-pcache ensures cache content preservation in the event of crashes (crash-safe) through the use of persistent memory, metadata duplication, and integrity checking of data and metadata using CRC32 checksums. Currently, only write-back caching mode is supported.
  • The Bcachefs filesystem code has been removed from the kernel, and it will now be distributed as an external module compiled using DKMS (Dynamic Kernel Module Support). The Bcachefs code may be reintroduced into the kernel once Kent Overstreet can demonstrably prove the ability to work correctly with other kernel developers and adhere to established development rules.
  • The pwritev2() system call has been added with the RWF_NOSIGNAL flag, disabling the sending of the SIGPIPE signal when writing to broken unnamed pipes or sockets.
  • The Procfs now includes a mounting option 'pidns' to specify process ID namespaces (PID namespace). For example: 'mount -t proc -o pidns=/proc/self/ns/pid proc /tmp/proc'.
  • The XFS utility fsck is now stable and enabled by default for checking and fixing detected issues in online mode, without unmounting the file system. System calls file_getattr and file_setattr have been added to modify attributes of special files (any inode). In KConfig, the options XFS_SUPPORT_V4 (version 4 of XFS) and XFS_SUPPORT_ASCII_CI (case-insensitive ASCII mode) have been disabled by default, as they are deprecated. Deprecated mount options attr2, noattr2, ikeep, and noikeep have been removed.
  • A new type of bitmaps — llbitmap (lockless bitmap) has been implemented in MD RAID, operating without locks and providing higher performance.
  • Information related to encryption and verification (pointers i_crypt_info and i_verity_info) has been extracted from the general 'inode' structure. This change reduces memory consumption in file systems that do not support encryption and verification.
  • The FUSE subsystem has added support for the copy_file_range() system call and direct copying of ranges using a 64-bit size (previously only a 32-bit size was supported). Support for synchronous initialization during mounting (FUSE_DEV_IOC_SYNC_INIT) has been added.
  • In the ext4 file system, the ability to use 32-bit user (uid) and group (gid) identifiers when accessing reserved blocks has been implemented. Ioctl operations for setting and reading parameters of the superblock of mounted file systems have been added (tune2fs will be able to change parameters in the superblock without write permissions on the block device). All deprecated settings specific to ext3 have been completely removed.
  • In f2fs, a mount option "lookup_mode" has been added to choose the search mode: perf — hash search, compat — linear search, auto — automatic selection. Changing the mode is meaningful for configurations with directories that do not consider case sensitivity. The current search mode can be found in the file "/sys/fs/f2fs//effective_lookup_mode". A feature for reserving inodes has been added, accessible only to privileged users.
  • In Overlayfs, a case-insensitive mode has been added, which is enabled at the file system layer (setting for individual directories is not yet supported).
  • In BTRFS, parallelization of operations has been improved under high read load and low write load, reducing transaction commit time significantly, cutting synchronization time from minutes to tens of seconds. It is now possible to use blocks (bs) larger than the page size (ps).
  • In ksmbd (the SMB server operating at the kernel level), a parameter has been added to limit the maximum number of connections from one source. an IP address. smbdirect, smbclient and smbserver have been transitioned to use standard kernel structures.
  • In SQUASHFS, the ability to use options SEEK_DATA and SEEK_HOLE in the system call lseek() for searching data and holes in sparse files has been added. Some tests have shown an increase in the performance of copying sparse files by up to 150 times.
  • In EXFAT, support for ioctl FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL for reading and writing partition labels has been added. The ability to change mount options during remounting has been provided. The loading of bitmaps has been accelerated.
  • In NTFS3, support for ioctl FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL for reading and setting partition labels has been added.
• Memory and system services
  • The implementation of the interprocess communication mechanism Binder, written in Rust, has been accepted. Binder is used in Android to facilitate interaction between processes and remote method invocation (one Android process can call a method or function in another Android process, using Binder to identify, call, and pass arguments between processes). The Binder code was rewritten in Rust as part of Google’s initiative to enhance Android security.
  • In SLUB, the kernel memory allocator, an optional caching layer called "sheaves" has been implemented, utilizing multiple caches, each tied to a separate CPU core, allowing one core to localize operations when allocating or freeing memory. This cache has improved the performance of memory allocation and deallocation in the core by eliminating the excess synchronization primitives required when involving different CPU cores. In conducted tests, performance gains ranged from 6.3% to 31% depending on the type of load.
  • The ability to create file descriptors tied to a specific namespace has been added. Unlike accessing namespaces by identifiers ( /proc//ns/ ), the file descriptor is bound to a specific instance of the namespace and eliminates the situation where the identifier is reallocated and points to a different object. Similar to the use of pidfds, opening file descriptors referring to namespaces is done through the functions open_by_handle_at() and name_to_handle_at().
  • A "Swap Table" mechanism has been implemented to enhance swap performance. The acceleration is achieved by reducing competition for access to the swap cache, more efficient cache lookup, and reduced fragmentation. The Swap Table-based backend is used for caching swap instead of the XArray backend and has allowed for an average performance increase of 5-20%. In the usemem test, throughput increased by 17-28%, in the multi-threaded kernel rebuild test, the build time decreased by 1.12-3.19%, and the redis-benchmark test with BGSAVE showed an increase in the number of processed requests by 6-7%.
  • The Zswap subsystem has been switched to directly use the zsmalloc memory allocation system instead of the zpool layer, which is no longer used elsewhere and has now been removed from the kernel.
  • To control the behavior of the microcode loader on x86 systems, a command line option "microcode=list of flags" has been implemented. In its current form, the new option replaces "microcode.force_minrev" and also allows setting the minimum acceptable version of microcode for loading.
  • Work has begun on reorganizing the overly bloated 'page' structure used for managing memory pages. A new type 'memdesc_flags_t' has been added for fields with universal flags that can be utilized after the expected future allocation of separate structures for slab and folios from the 'page' structure.
  • Support for the clone3() system call has been implemented for the nios2 architecture used in Altera Nios II processors (a soft processor based on FPGA).
  • A 'transitional' attribute has been added to the kernel configuration (KConfig), which can be used to mark settings that are not displayed in user interfaces like 'make menuconfig' and are not included in generated configuration files. The main purpose of this attribute is to facilitate renaming options while maintaining backward compatibility.
  • The minimum version of the Clang compiler required to build the kernel has been raised to LLVM 15 toolchain. LLVM 14 is included with Debian 12 and Ubuntu 22.04.
  • The transfer of changes from the Rust-for-Linux branch related to the use of the Rust language as a secondary language for developing drivers and kernel modules has continued (Rust support is not enabled by default and does not make Rust a mandatory build dependency for the kernel). The new version includes atomic memory operations for Rust code, a maple tree structure, the ability to create DebugFS files, and functions for manipulating bitmap tables. Access to the API for driver development has been expanded. A complete set of abstractions for developing USB device drivers has been added (including an example USB driver). The perf utility now supports debug symbols generated by the rustc compiler.
• Virtualization and Security
  • Support has been added for cryptographic verification of loaded BPF programs via digital signatures. This capability will be further expanded to include mechanisms for defining rules for loading signed BPF programs and allowing unprivileged users to use verified BPF programs.
  • The KVM hypervisor has implemented support for Intel CET (Control-flow Enforcement Technology) virtualization, aimed at protecting against exploits that use return-oriented programming (ROP) methods. The essence of the protection is that after control is transferred to a function, the return address is stored by the processor not only in the usual stack but also in a separate shadow stack that cannot be altered directly.
  • The ability to utilize more than 255 CPUs in guest systems running under the Bhyve hypervisor on hosts with FreeBSD 15 has been added.
  • A dibs (Direct Internal Buffer Sharing) layer has been added for managed co-sharing of buffers within an isolated environment, such as a hypervisor or a Linux kernel instance.
  • Support for the simultaneous operation of multiple enabled LSM (Linux Security Module) modules has been added to the auditing subsystem.
  • A virtio driver for spi-virtio has been added for accessing SPI devices (Serial Peripheral Interface) from of virtual machines.
  • Support for SEV-SNP CipherText Hiding mode has been added to the KVM hypervisor, blocking unauthorized reading of the memory ciphertext of protected guest systems in unauthorized CPUs.
  • A qtee driver for TEE environments (Trusted Execution Environment) of Qualcomm chips has been added.
• Network subsystem
  • Support for encrypting TCP connections using the PSP (PSP Security Protocol), developed by Google for encrypting traffic between data centers, has been added. PSP provides encryption, cryptographic integrity checking, and source authentication, implementing a unique combination of capabilities from both TLS and IPsec protocols. PSP uses per-connection-level encryption rather than entire communication channels. It employs separate encryption keys for different tunneled TCP connections to ensure strict traffic isolation among various applications and handlers. To reduce CPU load, support for offloading encryption and decryption operations to network cards is provided. The UDP protocol is used as the transport for data transmission, overlaying the content of the original TCP packet.
    
  • Initial support for the AccECN (Accurate Explicit Congestion Notification) extension has been added, which is an improved version of the ECN extension, allowing hosts to mark IP packets instead of dropping them in case of congestion. This enables the detection of the initial stage of congestion in communication channels without packet loss. The original ECN extension has a limitation that allows signaling only one overload per round of TCP transmission (RTT, Round-Trip Time, sending a request and receiving a response). AccECN removes this limitation, allowing the receiver to send multiple congestion tags back to the sender in the TCP packet header. Congestion control algorithms can use this information for more accurate responses to congestion without resorting to a drastic reduction in packet sending intensity when minor congestion occurs.
  • The UDP stack has optimized the processing of incoming packets under DDoS attacks, which lead to a large number of packets being received in one or several UDP sockets. Optimizations such as reducing competing locks, optimizing data structure placement in memory, and utilizing locks that consider NUMA (Non-Uniform Memory Access) architecture have improved UDP packet reception performance by 47% and more in extreme conditions.
  • The ability to disable input/output caching in the NFS server has been implemented, allowing the NFS server to be used in systems with limited memory (for example, in stripped-down cloud environments). Disabling the cache may also be useful on heavily loaded NFS servers to prevent the eviction of data related to local storage from the cache due to freeing memory for the NFS cache.
  • The maximum size of incoming and outgoing packet buffers for network sockets (net.core.rmem_max and net.core.wmem_max) has been increased from 2 MB to 4 MB. The default size remains unchanged (net.core.rmem_default and net.core.wmem_default = 2 MB).
  • A driver for the Qualcomm PPE (Packet Processing Engine) network operation accelerator has been added, used in Qualcomm SoC IPQ9574.
• Hardware
  • The kernel includes the Tyr driver, written in Rust, which enables compatibility with ARM Mali GPUs utilizing the CSF (Command Stream Frontend) technology, such as the Mali G310, G510, and G710. The driver is not yet ready for regular users and is considered an experimental prototype for testing abstractions for driver development in Rust.
  • Support for touchpads with tactile feedback and pressure sensitivity sensors has been added to the drivers for HID (Human Interface Device) input devices.
  • Work continues on the drm driver (Direct Rendering Manager) Xe for GPUs based on the Intel Xe architecture, used in Intel Arc graphics cards and integrated graphics, beginning with Tiger Lake processors. The new version adds the madvise interface, includes support for SR-IOV PF (Single Root I/O Virtualization Physical Function), introduces Intel PSMI mode for hardware validation, ensures processing of firmware-provided error information, implements the SLPC power consumption profile, and adds support for loading auxiliary firmware (e.g., for the cooler controller and voltage regulator) during driver validation.
  • The AMDGPU driver has added support for devices with the APU Cyan Skillfish, improved compatibility with AMD GCN 1.0, and achieved compatibility with the criu toolkit. Temperature metrics have been added to sysfs, and MMIO remapping requests from user space are now allowed.
  • The i915 driver has enabled support for Wildcat Lake family chips and improved compatibility with the Jasper Lake, Elkhart Lake, Gen7, and Gen6 GPUs.
  • The Nouveau driver now defaults to using NVIDIA GSP firmware and has improved error handling.
  • Integration of the Nova driver components for NVIDIA GPUs equipped with GSP firmware, used starting from the NVIDIA GeForce RTX 2000 series based on Turing architecture, has continued. The driver is written in Rust. The new version expands GSP firmware support, improves the implementation of the 'register!' macro, and adds support for PCI device classes and vendor identifiers.
  • A rocket driver has been added for NPU accelerators used in the Rockchip RK3588 SoC.
  • A kernel parameter 'boot_display' has been added to select the output device for displaying the boot process on systems with multiple GPUs.
  • The vesadrm driver has implemented support for 8-bit palettes.
  • The msm driver has added support for the Adreno 663 GPU and implemented support for the Inter Frame Power Collapse (IFPC) energy-saving technology.
  • The panthor driver has added support for the Mali-G710, Mali-G510, Mali-G310, Mali-Gx15, Mali-Gx20, and Mali-Gx25 GPUs.
  • Support for audio systems ASoC Qualcomm Glymur and PM4125, Realtek RT1321, Shanghai FourSemi FS2104/5S, Texas Instruments PCM1754, and TAS2783A, qcs615, CS35L56 B2, tas2118, tas2x20, tas5825 has been added. Support for USB audio interfaces Tascam US-144mkII and Presonus S1824c has also been added.
  • Support for ARM CPUs Cortex-A320/A520AE/A720AE and C1-Nano/Pro/Premium/Ultra has been added.
  • Support for ARM platforms, SoCs, and devices has been added: Apple M2 Pro, M2 Max, and M2 Ultra, Sony Xperia SP, Samsung Galaxy S22, Samsung Galaxy S20 FE, ASUS Eee Pad Slider SL101, Lenovo ThinkBook 16, HP Omnibook X14 X1P42100, Dell Inspiron 7441 / Latitude 7455, Sige1, NanoPi Zero2, Axis Artpec8, NXP i.MX91, ROCK 2A/2F, Qualcomm Lemans Auto, Renesas RZ/T2H, RZ/N2H, RZ/T2H and RZ/N2H, Aspeed AST27xx, Meta Clemente BMC, Netcube Nagami som, Tqma91xx, Ultratronik i.MX8MP Ultra-MACH, i.MX8ULP EVK9, Buffalo WXR-1750DHP.

At the same time, the Latin American Free Software Foundation has created a fully free kernel variant 6.18 — Linux-libre 6.18-gnu, cleansed of firmware and driver elements that contain non-free components or code segments restricted in use by the manufacturer. In the 6.18 release, the blob-cleansing code has been updated in Nova-Core, Intel XE, TI PRUeth, Lantiq GSWIP, and Marvell WiFi-Ex drivers. Blob names have been cleansed in dts files (device tree) for ARM chips from Qualcomm, Mediatek, and TI ARM64. Loading of blobs has been neutralized in the new drivers FourSemi fs2104/5s, TI TAS2783, and Qualcomm GENI.

Source: opennet.ru