Release of the Linux kernel 6.19. The next kernel will be assigned the number 7.0

After two months of development, Linus Torvalds unveiled the release of the Linux kernel 6.19. Among the most notable changes are: the Live Update Orchestrator subsystem, support for PCIe Link Encryption, the listns system call, Zero-Copy Receive mode in io_uring, support for the ARM extension MPAM, klp-build for generating live patches, support for the LoongArch32 architecture, QoS for s2idle, optimization of the audit subsystem, Intel LASS for protection against Spectre, support for SHA-3 and BLAKE2b hashes, the Confidential VMBus mechanism, TX optimizations in the networking subsystem, the CAN XL protocol, and an API for hardware-accelerated HDR output.

In the announcement of the new version, Linus stated that the next kernel release will be assigned the number 7.0, as there have been enough releases in the 6.x branch to warrant a change in the first digit of the version number (the 6.0 release was formed following 5.19). The change in numbering is made for aesthetic reasons and is a formal step to alleviate the discomfort resulting from the accumulation of many releases in the series. Linus joked that he gets confused by large numbers for which he runs out of fingers on his hands and feet. At the same time, there is a formal reason for a significant change in the version number, as support for Rust is planned to transition from experimental to core kernel features starting with the next release.

The new version includes 15,657 fixes from 2,237 developers, and the patch size is 52 MB (changes affected 13,682 files, adding 794,649 lines of code and removing 335,498 lines). The previous release had 15,035 fixes from 2,217 developers, with a patch size of 45 MB. About 40% of the changes presented in 6.19 are related to device drivers, approximately 13% pertain to updates of code specific to hardware architectures, 12% are related to the networking stack, 5% involve file systems, and 3% concern the internal subsystems of the kernel.

Key innovations in kernel 6.19 (1, 2, 3):

• Disk subsystem, input/output, and file systems
  • In Btrfs, filesystem scrubbing processes and device replacement no longer block the system from entering sleep mode (the state of the scrub check is saved before sleep; after wake-up, the scrub check continues, and the device replacement operation is restarted). Support for blocks larger than the page size has been added to the RAID56 implementation. Preparation for fscrypt support has been made. Performance has been improved for operations related to space reservation. Support for the ioctl operation 'shutdown' has been introduced, allowing the filesystem to enter a state where an attempt is made to complete already running operations while blocking all new ones.
  • The Ext4 filesystem now supports blocks larger than the page size (>4KB on x86 systems). Using larger blocks can improve the performance of buffered write operations by an average of 50%, but decreases the performance of direct I/O due to increased checksum calculation time. The new version also includes optimizations that enhance throughput during online defragmentation.
  • In the FUSE subsystem, support for buffered reading has been improved when using large folios. The ability to track partially relevant folios through iomap has been implemented to load only data not present in the buffer.
  • In VFS, support for recallable directory delegation has been added, enabling the implementation of directory control transfer from the NFS client so that the NFS client can independently track the state of the directory based on the local cache without making requests to the NFS server. server to the client, allowing the NFS client to independently track the state of the directory based on the local cache without making requests to the NFS server. If another NFS client makes changes related to this directory, the delegation of control will be revoked from the first client.
  • NFS now supports direct input/output (direct I/O) reading. Settings /sys/kernel/debug/nfsd/io_cache_read and /sys/kernel/debug/nfsd/io_cache_write have been implemented to manage the enabling of caching and direct I/O operations. Manipulating these settings can reduce overhead on the NFS client side during large I/O operations.
  • In NTFS, support for the ioctl shutdown operation has been implemented, and the mount options 'acl' and 'prealloc' are enabled by default. Support has also been added for time up to January 1, 1970.
  • For block devices and file systems, separate caching of 'bio' (Block I/O) objects defining active I/O operations is enabled by default for each CPU.
• Memory and system services
  • The kernel now includes the Live Update Orchestrator (LUO) subsystem, allowing for a complete reboot and update of the kernel without stopping operations and without losing the system state, devices, and processes. The LUO subsystem is based on the previously added Kexec HandOver (KHO) mechanism, and in addition to the ability to boot a new kernel from an old one without losing system state, it addresses tasks such as preserving the state of devices and memory, and ensuring continuity of DMA operations and interrupt processing. The state is preserved until switching to the new kernel and is restored after the new kernel is activated without disrupting continuous operations with devices managed by the system and applications in user space.
  • A new system call, listns(), has been added to output the list of existing namespaces in the system without the need to iterate through /proc//ns/ for all processes.
  • The io_uring asynchronous I/O system has added support for placing elements of different sizes in the submission queue (SQE), similar to how mixing the size of completion queue result items (CQE) was allowed in the previous release. Previously, all elements in the queue had to be of the same size, leading to excess memory consumption due to the need to use the maximum size for all elements in the queue.

    The io_uring also added support for the zcrx (Zero-Copy Receive) mechanism for receiving data without copying between the kernel and user space. Memory layout request support was added for SQ (Submission Queue) and CQ (Completion Queue), allowing retrieval of information about the size of the ring buffer needed for user memory allocation using the IORING_SETUP_NO_MMAP and IORING_MEM_REGION_TYPE_USER flags.

  • For quick stack tracing with utilities like perf, support for the SFrame format has been added, providing information on call stack unwinding. SFrame is already supported in GCC and binutils, does not degrade performance, and, unlike the DWARF format, contains only the minimal set of information required for stack tracing.
  • The perf utility has added support for unified descriptions of metrics and events in JSON format, as well as deferred unwinding of the call stack in user space.
  • For AMD processors, a data substitution mechanism has been implemented, allowing input/output devices to directly place data into the CPU's L3 cache without first storing it in RAM.
  • Support for MPAM (Memory System Resource Partitioning and Monitoring) has been added, an extension of the ARMv8-A architecture that tags each memory access with a section ID (PARTID, Partition ID) and a monitoring group ID (PMG, Monitoring Group ID). Resource consumption, such as memory bandwidth or cache size, can be limited based on the PARTID, preventing any group of tasks from monopolizing resources. In monitoring contexts, the combination of PMG and PARTID can be used to track memory resource consumption under specific types of load.
  • In the event of a process crashing after receiving a signal, another process with the pidfd of the terminated process can now determine the signal number that caused the termination.
  • The implementation of restartable sequences has been revamped, allowing applications to organize pseudo-atomic non-interruptible execution of a group of instructions (in case of interruption by another thread, a retry of the sequence is attempted). The new implementation features improved high performance.
  • For BPF programs, BPF_JMP, BPF_X, and BPF_JA instructions have been implemented to perform indirect jumps to a specific position from the jump table. The concept of dynamic pointers (dynptr) has been added, allowing data to be read from structured files. Additionally, the ability to attach multiple bytes of metadata to network packets has been introduced.
  • Modules written in Python, used for processing core documentation, have been moved to a separate directory tools/lib/python.
  • The function mempool_alloc_bulk() has been added for safely allocating elements from the memory pool at once for multiple objects.
  • The transfer of changes from the Rust-for-Linux branch continues, related to using the Rust language as a second language for driver and kernel module development (Rust support is not active by default and does not include Rust in the mandatory build dependencies for the kernel). In the new version, the kernel includes the 'syn' library with a Rust code parser, simplifying the writing of complex macros. The capabilities of the kernel, pin-init, and rbtree libraries have been expanded. The 'num' library with the Integer trait for manipulating whole numbers has been added. The macro 'module!' now supports integer parameters. It is now possible to specify parameters when loading kernel modules written in Rust. Abstractions for the I2C and PWM (Pulse Width Modulation) subsystems have been implemented.
  • The 'at_least' macro has been added (for example, 'param[at_least 7]'), which informs about the minimum acceptable size of the array passed to the function. If an array with fewer elements is passed to the function, the compiler will issue a warning.
  • A script klp-build has been included for generating kernel modules that make changes to a running kernel (livepatch) based on a patch file. Changes necessary for creating live patches have been made to the objtool utility.
  • In User-mode Linux (running the kernel as a user process), limited support for multiprocessing has been added, but threads within a single process cannot execute concurrently yet. The porting of User-mode Linux to the nolibc library has begun.
  • Support for the LoongArch32 architecture (LA32R, LA32S) has been added in addition to LoongArch64.
  • The ability to set QoS limits on CPU wake-up intensity in s2idle (Suspend-To-Idle) power-saving mode has been added, freezing the execution of user-space processes while keeping certain handlers in the kernel active.
  • Support for managing memory page tables for IOMMU (Input-Output Memory Management Unit) controllers, which translate virtual addresses visible to hardware devices into physical addresses, has been added, with the capability to filter DMA operations by virtual addresses and to limit and isolate input-output operations.
  • In system call tracing events, the ability to read buffers from user space and include their contents (e.g., file names) in the trace result has been implemented.
  • Guard pages, which cause an exception and terminate the process (SIGSEGV) when accessed, are now marked with a special label in the file /proc/PID/smaps.
  • The ability to manage transparent huge pages in the private memory of zoned devices has been added.
  • In the zram device used for compressed swap storage in memory, support for batching multiple 'bio' (Block I/O) structures in writeback mode has been implemented.
  • The font 'Terminus 10×18' has been included, improving the readability of information from the console on laptop screens with medium resolution (1440×900).
  • The audit subsystem has been significantly optimized — a reduction in overhead by half has been noted.
• Virtualization and Security
  • Support has been added for Intel processors' feature of linear address-space separation (LASS), which allows the hardware to separate address ranges between user space and kernel space for improved security. The address space is divided by the most significant bit of the address — the upper half of the address space with the most significant bit set is used for the kernel, while the lower half is for user space. At an early stage of instruction execution (before speculative execution), the validity of access from user space to addresses with the most significant bit set and vice versa is checked. This separation helps prevent kernel memory leakage into user space through side channels, even during speculative execution of instructions, enabling LASS to protect against Meltdown and Spectre class attacks without incurring significant overhead.
  • The option to enable PCI Express security enhancement extensions — PCIe Link Encryption and PCIe Device Authentication — has been added, allowing authentication and encryption of the communication channel between the PCIe device and the virtual machine, secured using Intel TDX (Trusted Domain Extensions) and AMD SEV-SNP (Secure Nested Paging) mechanisms. The implemented technologies prevent interception, analysis, and injection of data into DMA traffic when access to the host system or other devices is available.
  • Support for SHA-3 algorithms (SHA3-224, SHA3-256, SHA3-384, SHA3-512), SHAKE128, SHAKE256, and BLAKE2b has been added to the built-in cryptographic library.
  • For LSM modules (Linux Security Modules) and specifically for SELinux, the ability to track the creation of memfd descriptors has been implemented to apply security policies to related objects.
  • Support for the AT_EXECVE_CHECK flag in the execveat() function has been added to the LSM module IPE (Integrity Policy Enforcement), which defines the overall integrity policy for the entire system, enabling integrity checks of scripts before their execution by the interpreter.
  • Primitives scoped_user_read_access(), scoped_user_write_access, and scoped_user_rw_access() have been added for limited access to data in user space with protection against speculative attacks.
  • Support has been added for the Confidential VMBus mechanism used in the Hyper-V hypervisor for secure interactions between a guest system running in confidential mode (with memory encryption and register isolation based on AMD SNP and Intel TDX technologies) and the paravisor responsible for accessing devices processing confidential data.
  • The ability to transmit information about a crashed process (for generating coredumps) through the pidfd mechanism has been added. The PIDFD identifier is tied to a specific process and does not change, while the PID can be linked to another process after the current process associated with that PID has been terminated. Using pidfd helps prevent attacks that involve the substitution of a crashed suid process with another process, achieving a race condition after the kernel starts handling the crash but before the user space handler checks the process parameters.
• Network subsystem
  • Optimizations have been made to the networking subsystem to enhance data transmission efficiency (TX). Removing the spin-lock from the __dev_queue_xmit() function and using the lock-free llist structure allowed for a fourfold increase in performance under heavy load and doubled the packet transmission intensity while reducing CPU load by half.
  • The ability to disable system limits on memory usage for individual network sockets has been provided (in this case, shared memory limits defined for individual containers will be used). To manage the disabling of limits, the sysctl net.core.bypass_prot_mem and the SK_BPF_BYPASS_PROT_MEM flag in the bpf_setsockopt function have been proposed.
  • Support has been added for the RFC 5837 extension, which adds information about incoming network interfaces to the ICMP "Time Exceeded" messages returned when a packet's time to live (TTL) expires, allowing for more detailed information when tracing routes with the traceroute utility.
  • Support has been added for continuous active polling (busy polling) in a separate kernel thread to retrieve descriptors from RX/TX queues for applications that require minimal latency.
  • Support for the CAN XL (Controller Area Network eXtended Length) protocol has been added, in which the data field size is increased to 2048 bytes to enable integration with TCP/IP networks, tunneling of Ethernet frames has been implemented, and support for pulse-width modulation has been added, allowing data transmission at speeds of 20 Mbps and higher.
  • Support for the sockaddr_unsized structure, a variant of the sockaddr structure that uses a flexible array member instead of a fixed-size array (sa_data[] instead of sa_data[14], which was essentially used for references to larger structures), has been added.
  • The functionality of getsockname and getpeername can now be utilized through the io_uring subsystem.
  • New sysctl settings net.ipv4.tcp_rcvbuf_low_rtt and net.ipv4.tcp_comp_sack_rtt_percent have been added for optimizing TCP.
  • Support for links with bandwidths of 1600 Gbps (1.6T) has been added.
• Hardware
  • An API for utilizing hardware color conversion capabilities has been added to the DRM (Direct Rendering Manager) subsystem, allowing such conversions to be performed without using shaders or CPU code. For outputting content to HDR monitors, complex color conversions can now be performed by the display controller at the stages before and after layer blending, instead of through software compositing in the final display buffer. Besides reducing overhead and energy consumption for HDR output, the proposed functionality can be used for accurate color reproduction in video or image editors.
  • The 'ethosu' driver for Arm Ethos U65 and U85 NPUs, designed for hardware acceleration of AI model execution, has been added.
  • The i915 driver for Lunar Lake GPUs and newer has added support for hardware image sharpening.
  • Work on the Xe DRM (Direct Rendering Manager) driver for GPUs based on the Intel Xe architecture, used in Intel Arc graphics cards and integrated graphics starting from Tiger Lake processors, has continued. Initial support for the Xe3P architecture, used in Crescent Island GPUs and Nova Lake integrated graphics processors, has been added.
  • The AMDGPU driver provides full support for AMD graphics cards from the GCN 1.0 'Southern Islands' and 1.1 'Sea Islands' families, which previously required the Radeon driver. The AMDGPU driver has been brought up to parity with the Radeon driver and is enabled by default for the specified GPUs. GCN 1.x cards were produced from 2012 to 2019 and include models such as the Radeon HD 77xx/78xx/79xx/87xx/88xx/89xx, Radeon R9 280, FirePro W4000-W9000, Radeon Sky 700/900, Radeon R9 265/270/370, Radeon R9 290/390, HD 7790/8870, and other Radeon Rx 200/Rx 300 series graphics cards. In addition to an average performance increase of 24%, the switch to AMDGPU has enabled support for the Vulkan 1.3 graphics API for these GPUs. Moreover, AMDGPU adds support for analog connectors and Video Coding Engine 1.0, and the DC (Display Core) stack is used by default for GPUs based on the Bonaire microarchitecture (Radeon HD 7700).
  • The Nouveau driver has implemented support for the NVJPG hardware accelerator present in the Tegra210 SoC.
  • The Panthor driver adds support for the Mali-G1 GPU and initial support for the MediaTek MT8196 chip.
  • Support has been added for the audio subsystem of Intel Nova Lake S chips, HP laptops with HDA CS35L41, and audio interfaces CIX IPBLOQ HD and Onkyo SE-300PCIE.
  • The integration of Nova driver components for NVIDIA GPUs equipped with GSP firmware, used starting from the NVIDIA GeForce RTX 2000 series based on the Turing microarchitecture, has continued. The driver is written in Rust. In the new version, work began on RPC, and the implementation of the GSP (GPU System Processor) co-processor boot has been completed.
  • Support has been added for ARM platforms, SoCs, and devices: Bananapi r4 pro, LinkEase EasePi R1, Qualcomm MSM8937 (Snapdragon 430), Renesas R-Car X5H, FriendlyElec NanoPi R76S, TI AM62L, Black Sesame Technologies C1200, Aspeed AST2600, Genio 1200 EVK, grinn geniosbc-510/700, Tanix TX9 Pro, Radxa Dragon Q6A, Tinker Board 3/3S, Aquila AM69, phyBOARD-Segin-i.MX91, i.MX 95 Verdin Evaluation Kit, Toradex SMARC iMX95, VIDIA Jetson Nano 2GB, Renesas rz/g3s, Indiedroid Nova, and 24 variants of Enclustra Mercury boards.
  • Support for smartphones and tablets based on SoC Mediatek MT6582 (Alcatel yarisxl), Nvidia Tegra124 (Xiaomi Mi Pad), and Qualcomm MSM8939 (ASUS ZenFone 2) has been added. Support for laptops on SoC Qualcomm sdm850, such as the Huawei MateBook E 2019, has also been included.
  • Support has been added for SoCs and boards based on the RISC-V architecture: OrangePi R2S, OrangePi RV, Anlogic dr1v90, Tenstorrent Blackhole.

At the same time, the Latin American Free Software Foundation has released a fully free kernel version 6.19 — Linux-libre 6.19-gnu, stripped of firmware and driver elements that contain proprietary components or code segments restricted by the manufacturer. In release 6.19, the code for loading binary firmware has been removed from the SDCA audio subsystem. The code for cleaning blobs in Intel XE, Nova-Core, Qualcomm Iris, Venus and Q6V5, TI PRUeth, Intel iwlwifi, Marvell mwifiex, FourSemi fs210x, Realtek rt1320, and TI tas2783 audio codec drivers has been updated. The cleaning of blob names in dts files (device tree) for ARM chips has been completed. The cleaning of the STM C8SECTPFE DVB driver, which was removed from the kernel, has been discontinued.

Source: opennet.ru