After two months of development, Linus Torvalds announced the release of the kernel . Among the most notable changes are: a new interface for asynchronous input/output io_uring, the ability to use NVDIMM as RAM, support in Nouveau for shared virtual memory, support for scalable monitoring of very large file systems via fanotify, the ability to configure Zstd compression levels in Btrfs, a new cpuidle handler TEO, implementation of system calls to address the year 2038 problem, booting from device-mapper without initramfs, the LSM module SafeSetID, and support for combined live patches.
:
- Disk subsystem, input/output, and file systems
- A new interface for asynchronous input/output has been implemented — , notable for supporting input/output polling and the ability to work both with and without buffering. It is worth noting that the previously proposed asynchronous input/output mechanism "aio" did not support buffered input/output, could only work in O_DIRECT mode (without buffering and circumventing the cache), had issues with blocking due to waiting for metadata availability, and displayed high overhead due to data copying in memory.
Within the API
io_uring, developers attempted to address the shortcomings of the old aio interface. According to io_uring is very close to and significantly outperforms libaio when polling is enabled. To use io_uring in end-user applications running in user space, a library has been prepared, , providing a high-level wrapper over the kernel interface; - In the event tracking mechanism in the file system fanotify() supports tracking of situations where the superblock and the structure (events of creation, deletion, and movement of directories). The presented capabilities help solve scalability issues that arise when creating recursive change tracking in very large file systems using the inotify mechanism (changes to dirent could previously only be tracked through inotify, but
the efficiency in recursive tracking of large nested directories left much to be desired). Now such monitoring can be effectively performed through fanotify; - In the Btrfs file system the ability to set the compression level for the zstd algorithm, which can be considered an optimal compromise between the fast but inefficient lz4 and the slow but highly compressing xz. Similar to how one could previously set the compression level when using zlib, support has been added for the mount option '-o compress=zstd:level'. During testing, the minimum first level provided a data compression ratio of 2.658 at a compression speed of 438.47 MB/s, a decompression speed of 910.51 MB/s, and a memory usage of 780 MB, while the maximum 15 level achieved a ratio of 3.126, but at a compression speed of 37.30 MB/s, a decompression speed of 878.84 MB/s, and a memory usage of 2547 MB;
- the ability to boot from a filesystem located on a device-mapper device, without using initramfs. Starting with the current kernel release, the device-mapper can be used directly in the boot process, for example, as a partition with root FS. The partition setup is done with the boot parameter 'dm-mod.create'. Among the allowed modules for booting with device-mapper are: 'crypt', 'delay', 'linear', 'snapshot-origin', and 'verity';
- In the Flash-oriented F2FS filesystem, a flag F2FS_NOCOW_FL has been added to disable copy-on-write mode for a given file;
- The filesystem , which is a variant of ext2 adapted for use with object storage devices (OSD), has been removed from the kernel. Support for the SCSI protocol for such object storage devices has also been removed;
- A new interface for asynchronous input/output has been implemented — , notable for supporting input/output polling and the ability to work both with and without buffering. It is worth noting that the previously proposed asynchronous input/output mechanism "aio" did not support buffered input/output, could only work in O_DIRECT mode (without buffering and circumventing the cache), had issues with blocking due to waiting for metadata availability, and displayed high overhead due to data copying in memory.
- Virtualization and Security
- An option PR_SPEC_DISABLE_NOEXEC has been added to prctl() to manage speculative execution of instructions for the chosen process. The new option allows selectively disabling speculative execution for processes that could potentially be attacked through a Spectre-type attack. The lock remains in effect until the first exec() call;
- An LSM module , allowing system services to safely manage users without privilege escalation (CAP_SETUID) and without gaining root user permissions. Privilege assignment is done by defining rules in securityfs based on a whitelist of acceptable bindings (in the form 'UID1:UID2');
- Low-level changes necessary for the stack organization of security module loading (LSM) have been introduced. A kernel boot parameter 'lsm' has been implemented to control which modules are loaded and in what order.
- Support for file namespace has been added to the audit subsystem.
- The GCC plugin structleak, which allows blocking potential memory content leaks, has been enhanced. Initialization is ensured for any variables used in the code via reference access on the stack.
- Network subsystem
- For sockets a new option 'SO_BINDTOIFINDEX', similar to
'SO_BINDTODEVICE', but taking an index number of the network interface as an argument instead of the interface name. - The mac80211 stack has been enhanced to allow multiple BSSIDs (MAC addresses) to be assigned to a single device. As part of the WiFi performance optimization project, the mac80211 stack now accounts for the distribution of air time and can allocate air time among multiple stations (in Access Point mode, less time for transmission is allocated to slow wireless stations, instead of evenly distributing time among all stations).
- A mechanism for theproviding notifications when problems with the network interface arise.
- For sockets a new option 'SO_BINDTOIFINDEX', similar to
- Memory and system services
- Secure delivery of signals, considering the possibility of PID reuse. For instance, when executing the kill call, a situation could arise where, immediately after sending the signal, the target PID could be freed due to process termination and taken by another process, ultimately sending the signal to the wrong process. To prevent such situations, a new system call pidfd_send_signal has been added, which uses file descriptors from /proc/pid to ensure stable binding to the process. Even if the PID gets reused during system call handling, the file descriptor will not change, allowing it to be safely used to send a signal to the process.
- the ability to use persistent memory devices (persistent-memory, for example ) as RAM. Until now, similar devices were supported as storage devices, but they can now also be used as additional RAM. This capability was implemented in response to user requests willing to compromise on performance latency and wishing to use the native Linux kernel memory management API instead of existing user-space memory allocation systems that operate over mmap for the dax file;
- A new CPU idle handler (cpuidle), which determines when the CPU can be put into deeper energy-saving modes— the deeper the mode, the greater the savings, but the longer it takes to exit the mode— has been added: the TEO (Timer Events Oriented Governor). Previously, two cpuidle handlers were proposed— 'menu' and 'ladder', which differ in their heuristics. The 'menu' handler has known issues with making heuristic decisions, so a new handler was prepared to address them. TEO is positioned as an alternative to the 'menu' handler, achieving higher performance while maintaining the same level of power consumption.
The new handler can be activated using the boot parameter 'cpuidle.governor=teo'; - As part of the work to address , caused by overflow of the 32-bit time_t type, system calls have been included that offer 64-bit time counters for 32-bit architectures. As a result, the 64-bit time_t structure can now be used on all architectures. Similar changes have also been implemented in the networking subsystem for options network sockets;
- For the live patching system of the kernel The 'Atomic Replace' feature allows atomic application of a series of changes to a single function. This feature enables the distribution of combined patches covering multiple changes at once, rather than a cumbersome incremental process of applying live patches in a defined order. Previously, each subsequent change had to depend on the state of the function after the last change; now, it is possible to distribute several changes tied to a single initial state (i.e., maintain one combined patch against the base core instead of a chain of interdependent patches).
- is the support for a.out executable file format and
code for generating core files in the a.out format, which is now obsolete. The a.out format has not been used on Linux systems for a long time, and generating a.out files is no longer supported by modern toolsets in default configurations for Linux. Additionally, the loader for a.out files can be fully implemented in user space. - The BPF program verification mechanism has been enhanced with the capability to identify and remove unused code. The kernel also includes patches with spinlock support for the BPF subsystem, providing additional functionalities for managing the parallel execution of BPF programs.
- Hardware
- In the Nouveau driver support for heterogeneous memory management, allowing CPU and GPU access to shared synchronized memory areas. Shared Virtual Memory (SVM) is implemented based on the HMM (Heterogeneous Memory Management) subsystem, enabling devices with their own memory management units (MMUs) to access main memory. Additionally, through HMM, a shared address space can be organized between GPU and CPU, in which the GPU can access the main memory of the process. SVM support is currently enabled only for Pascal family GPUs, although support is also provided for Volta and Turing GPUs. Furthermore, in Nouveau, a new ioctl for managing migration of process memory areas to GPU memory;
- In the Intel DRM driver for Skylake and newer GPUs (gen9+). By default, fastboot mode is enabled, which avoids unnecessary mode switches during boot. device identifiers based on Coffelake and Ice Lake microarchitectures. For Coffelake chips support for GVT (). For virtual GPUs support for VFIO EDID. For MIPI/DSI LCD panels support for ACPI/PMIC elements. new TV modes 1080p30/50/60 TV;
- The amdgpu driver has added support for GPU Vega10/20 BACO. Power management features for Vega 10/20 and cooler management tables for Vega 10 have been implemented. New PCI device identifiers for GPU Picasso have been added. dependency management interface to avoid deadlocks;
- DRM/KMS driver for screen operation accelerators (Mali D71);
- Support for screen panels Toppoly TPG110, Sitronix ST7701, PDA 91-00156-A0, LeMaker BL035-RGB-002 3.5, and Kingdisplay kd097d04 has been added;
- Support for audio codecs Rockchip RK3328, Cirrus Logic CS4341 and CS35L36, MediaTek MT6358, Qualcomm WCD9335, and Ingenic JZ4725B, as well as the audio platform Mediatek MT8183 has been added;
- Support for NAND flash controllers STMicroelectronics FMC2, Amlogic Meson has been added;
- Support for accelerators for Habana AI machine systems has been added;
- Support for gigabit Ethernet controllers NXP ENETC and wireless interfaces MediaTek MT7603E (PCIe) and MT76x8 has been added.
At the same time, the Latin American Free Software Foundation
variant — , cleansed of firmware and driver elements containing non-free components or code segments limited in scope by the manufacturer. In the new release, blob loading in the mt7603 and goya drivers has been disabled. The blob cleaning code in the wilc1000, iwlwifi, soc-acpi-intel, brcmfmac, mwifiex, btmrvl, btmtk, and touchscreen_dmi drivers and subsystems has been updated. Blob cleaning in the lantiq xrx200 firmware loader has ceased due to its removal from the kernel.
Source: opennet.ru
