After two months of development, Linus Torvalds announced the release of the kernel Among the most noticeable changes are: case-insensitive operation of Ext4, separate system calls for mounting the file system, drivers for GPU Mali 4xx/6xx/7xx, the ability to process changes in sysctl values in BPF programs, the device-mapper module dm-dust, protection against MDS attacks, support for Sound Open Firmware for DSP, BFQ performance optimization, and enhancements to the PSI (Pressure Stall Information) subsystem for use in Android.
The new version includes 15,100 fixes from 1,882 developers.
The patch size is 62 MB (changes affected 30,889 files, added 625,094 lines of code, and removed 531,864 lines). About 45% of all changes in 5.2
are related to device drivers, approximately 21% pertain to updates specific to hardware architecture, 12%
is related to the network stack, 3% to file systems, and 3% to internal
kernel subsystems. 12.4% of all changes were prepared by Intel, 6.3% by Red Hat, 5.4% by Google, 4.0% by AMD, 3.1% by SUSE, 3% by IBM, 2.7% by Huawei, 2.7% by Linaro, 2.2% by ARM, and 1.6% by Oracle.
For Ext4, case-insensitive file name operation has been added, which is activated only when tied to specific empty directories using the new attribute "+F" (EXT4_CASEFOLD_FL). When this attribute is set on a directory, all operations with files and subdirectories within will be performed without regard to case, including ignoring case in search and open file operations (for example, files Test.txt, test.txt, and test.TXT in such directories will be considered the same). By default, the file system continues to be case-sensitive, except for directories with the attribute "chattr +F";
:
- Disk subsystem, input/output, and file systems
- Functions for handling UTF-8 characters in file names have been unified for use in comparison and string normalization operations; In XFS, infrastructure for monitoring the file system state has been added along with a new ioctl for querying operational status. An experimental feature for online scrubbing of superblock counters has been implemented.
- A new device-mapper module "
- dm-dust
- " has been added, allowing the simulation of bad blocks appearing on the device or read errors from disk. The module facilitates debugging and testing of applications and various storage systems under potential failure conditions.’ has been introduced, allowing the simulation of bad block emergence on the storage device or read errors from the disk. This module simplifies debugging and testing of applications and various storage systems under potential failure conditions.
- significant performance optimization of the BFQ I/O scheduler. The optimizations made under high I/O load reduce the time of operations such as application launches by up to 80%;
- A series of system calls for mounting file systems has been added: , , , , and . These system calls allow for separate processing of different stages of mounting (process the superblock, retrieve information about the FS, mount, attach to a mount point), which were previously executed through a common system call mount(). Separate calls enable more complex mounting scenarios and to perform operations such as reconfiguring the superblock, enabling options, changing the mount point, and moving to another namespace separately. Additionally, separate processing allows for accurate determination of the causes of error code outputs and the specification of multiple sources for layered FS such as overlayfs;
- A new operation IORING_OP_SYNC_FILE_RANGE has been added to the io_uring interface for asynchronous I/O, performing actions equivalent to the system call , and the ability to register eventfd with io_uring and receive notifications about the completion of operations has also been implemented;
- For the CIFS file system, ioctl FIEMAP has been added, providing efficient extent mapping, as well as support for SEEK_DATA and SEEK_HOLE modes;
- In the FUSE subsystem an API for managing data caching;
- In Btrfs, optimizations for qgroups implementation have been made and the speed of fsync for files with multiple hard links has increased. The data integrity check code has been improved to consider possible corruption of information in RAM before flushing data to disk;
- In CEPH, support for exporting snapshots via NFS has been added;
- The implementation of NFSv4 mounting in 'soft' mode has been improved (when an access error to the server occurs in 'soft' mode, the call immediately returns an error code, while in 'hard' mode control is not returned until the FS becomes available again or times out). The new release provides more accurate timeout handling, faster recovery from failures, and a new mount option 'softerr', allowing the modification of the error code (ETIMEDOUT) returned upon timeout;
- The API nfsdcld, intended for monitoring the state of NFS clients, now allows the NFS server to correctly track the client's status upon reboot. Thus, the nfsdcld daemon can now act as a handler for nfsdcltrack;
- For AFS byte range locking emulation in files ();
- Virtualization and Security
- Work has been done to eliminate places in the kernel susceptible to executing code from writable mapped memory areas, which allows blocking potential vulnerabilities that could be exploited in an attack;
- A new kernel command-line parameter 'mitigations=' has been added, providing a simplified way to manage the enabling of various techniques to protect against vulnerabilities related to speculative execution in the CPU. Passing 'mitigations=off' disables all existing methods, while the default mode 'mitigations=auto' enables protection without affecting the use of Hyper Threading. The 'mitigations=auto,nosmt' mode additionally disables Hyper Threading if required by the protection method.
- support for electronic digital signatures according to GOST R 34.10-2012 (RFC 7091, ISO/IEC 14888-3), by Vitaly Chikunov from 'Bazalt SPO'. The built-in TLS implementation has added support for AES128-CCM. The crypto_simd module now supports AEAD algorithms;
- In Kconfig there is a separate section 'kernel hardening' with options to enhance kernel protection. Currently, the new section only contains configurations for enabling GCC plugin hardening checks;
- The kernel code is almost non-terminating case expressions in switch (without return or break after each case block). There are 32 out of 2311 instances of this switch usage left to fix, after which the '-Wimplicit-fallthrough' mode can be applied during kernel compilation;
- Support for hardware mechanisms to restrict unwanted kernel access paths to user-space data has been implemented for the PowerPC architecture;
- Code for blocking has been added. for the MDS (Microarchitectural Data Sampling) class in Intel processors. System vulnerability susceptibility can be checked through the SysFS variable '/sys/devices/system/cpu/vulnerabilities/mds'. Two protection modes: full, requiring updated microcode, and a bypass mode that does not fully guarantee clearing CPU buffers when transferring control to user space or guest systems. To manage the protection modes, a parameter "mds=" has been added to the kernel, which can take the values "full", "full,nosmt" (which turns off Hyper-Threads), and "off";
- On x86-64 systems, for IRQs, debugging mechanisms, and exception handlers, a protection called "stack guard-page" has been added, which substitutes a memory page at the boundary with the stack, access to which leads to generating an exception (page-fault);
- A sysctl setting vm.unprivileged_userfaultfd has been added, controlling the ability of unprivileged processes to use the userfaultfd() system call;
- Network subsystem
- Support for IPv6 gateways for IPv4 routes. For example, it is now possible to specify routing rules such as "ip ro add 172.16.1.0/24 via inet6 2001:db8::1 dev eth0";
- For ICMPv6, ioctl calls icmp_echo_ignore_anycast and icmp_echo_ignore_multicast have been implemented to ignore ICMP ECHO for anycast and
multicast addresses; the ability to limit the processing intensity of ICMPv6 packets; - For the B.A.T.M.A.N. mesh protocol ("Better Approach To Mobile Adhoc Networking"), which allows the creation of decentralized networks where each node is connected through neighboring nodes, support for translating multicast to unicast, as well as the ability to manage through sysfs;
- In ethtool, a new Fast Link Down parameter has been introduced, allowing for a reduction in the time taken to receive information about a link down event for 1000BaseT (under normal conditions, the delay can be up to 750ms);
- Now includes tunnel bindings for Foo-Over-UDP to a specific address, network interface, or socket (previously, binding was only done by common mask);
- In the wireless stack, the possibility of implementing handlers
OWE (Opportunistic Wireless Encryption) in user space; - In Netfilter, support for the inet address family has been added to nat chains (for example, it is now possible to use a single translation rule to handle both ipv4 and ipv6 without separating rules for ipv4 and ipv6);
- In netlink, strict for stringent validation of all messages and attributes, where exceeding the expected size of attributes is not allowed, and appending additional data at the end of messages is prohibited;
- Memory and system services
- A flag CLONE_PIDFD has been added to the system call clone(), allowing the parent process to receive a file descriptor 'pidfd' associated with the created child process. This file descriptor can be used, for example, to send signals without the risk of a race condition (immediately after sending a signal, the target PID may be released due to the process termination and occupied by another process);
- The second version of cgroups has introduced functionality for the freezer controller, which enables the suspension of work in a cgroup and temporarily releases some resources (CPU, input/output, and potentially even memory) for executing other tasks. Control is performed through the management files cgroup.freeze and cgroup.events in the cgroup tree. Writing 1 to cgroup.freeze freezes processes in the current cgroup and all child groups. Since the freezing process takes some time, an additional file cgroup.events is provided to monitor the completion of the operation;
- Export of memory attributes attached to each node in sysfs, allowing the user space to determine the nature of memory bank handling in systems with heterogeneous memory;
- The PSI (Pressure Stall Information) subsystem has been enhanced to analyze information regarding the wait time for various resources (CPU, memory, input/output) for specific tasks or sets of processes in a cgroup. With PSI, user-space handlers can more accurately assess system load levels and the nature of performance degradation compared to Load Average. The new version provides support for configuring sensitivity thresholds and allows the use of the poll() call to receive notifications when set threshold values are triggered within a specified time interval. This capability enables early-stage memory shortage tracking in Android, identifying the source of problems and terminating low-priority applications before noticeable issues arise for users. During stress testing, memory consumption monitoring tools based on PSI showed 10 times fewer false positives compared to vmpressure statistics;
- Code optimization has been performed for checking BPF programs, which now executes the verification process up to 20 times faster for larger programs. The optimization has allowed the limit for BPF program size to increase from 4096 to one million instructions;
- For BPF programs the ability to access global data, allowing the definition of global variables and constants within the programs;
- Added , enabling control over modifications to sysctl parameters from BPF programs;
- A JIT compiler for the eBPF virtual machine has been implemented for the MIPS32 architecture;
- Support for the KASan (Kernel Address Sanitizer) debugging tool has been added for the 32-bit PowerPC architecture, enabling detection of memory-related errors;
- The limitation on crash-dump state storage above 896MB has been removed for x86-64 systems;
- Support for kernel address space randomization (KASLR) and the ability to verify digital signatures during kernel boot via kexec_file_load() has been implemented for the s390 architecture;
- Support for the kernel debugger (KGDB), jump labels, and kprobes has been added for the PA-RISC architecture;
- Hardware
- Included is the for Mali 400/450 GPUs, used in many older chips based on the ARM architecture. For newer Mali GPUs, the Panfrost driver has been added, supporting chips based on the Midgard (Mali-T6xx, Mali-T7xx, Mali-T8xx) and Bifrost (Mali G3x, G5x, G7x) microarchitectures;
- Support for sound devices using open firmware has been added. (). Despite the presence of open drivers, the firmware code for sound chips has remained closed and provided only in binary form. The Sound Open Firmware project has been developed by Intel to create open firmware for DSP chips related to sound processing (Google later joined the development). Currently, the project has prepared open firmware for sound chips on Intel platforms Baytrail, CherryTrail, Broadwell, ApolloLake, GeminiLake, CannonLake, and IceLake;
- Support for chips has been added to the Intel DRM driver (i915)
Elkhartlake (Gen11). PCI identifiers for Comet Lake (Gen9) chips have been added. Support for Icelake chips has been stabilized, with additional device PCI identifiers also added.
Asynchronous switching mode between two buffers in video memory (async flip) during operations performed via mmio has significantly boosted the performance of some 3D applications (for example, performance in the 3DMark Ice Storm test increased by 300-400%). Support for the technology has been added. (High-bandwidth Digital Content Protection) for encrypting video signals transmitted over HDMI; - The amdgpu driver for GPU Vega20 supports RAS (Reliability, Availability, Serviceability) and experimental support for the new SMU 11 subsystem, which replaces the Powerplay technology. For GPU Vega12, support for the BACO (Bus Active, Chip Off) mode has been added. Initial support for XGMI, a high-speed bus (PCIe 4.0) for connecting GPUs, has been introduced. Missing identifiers for GPUs based on Polaris10 have been added to the amdkfd driver;
- The Nouveau driver has added support for boards based on the NVIDIA Turing 117 (TU117, used in GeForce GTX 1650). In
kconfig setting to disable outdated features that are no longer applicable in current libdrm releases; - In the DRM API and amdgpu driver, support for 'timeline' synchronization objects has been added, allowing operations without classic locks.
- The vboxvideo driver for the VirtualBox virtual GPU has been moved from the staging branch to the main tree;
- An aspeed driver for the ASPEED SoC GFX chip has been added;
- Support for ARM SoC and Intel Agilex boards (SoCFPGA), NXP i.MX8MM, Allwinner (RerVision H3-DVK (H3), Oceanic 5205 5inMFD, Beelink GS2 (H6), Orange Pi 3 (H6)), Rockchip (Orange Pi RK3399, Nanopi NEO4, Veyron-Mighty Chromebook), and Amlogic: SEI Robotics SEI510,
ST Micro (stm32mp157a, stm32mp157c), NXP (
Eckelmann ci4x10 (i.MX6DL),i.MX8MM EVK (i.MX8MM),
ZII i.MX7 RPU2 (i.MX7),
ZII SPB4 (VF610),
Zii Ultra (i.MX8M),
TQ TQMa7S (i.MX7Solo),
TQ TQMa7D (i.MX7Dual),
Kobo Aura (i.MX50),
Menlosystems M53 (i.MX53)), NVIDIA Jetson Nano (Tegra T210).
At the same time, the Latin American Free Software Foundation
variant — , cleansed of firmware and driver elements containing non-free components or code sections with usage constraints imposed by the manufacturer. The new release includes the loading of files
Sound Open Firmware. Loading of blobs in drivers
mt7615, rtw88, rtw8822b, rtw8822c, btmtksdio, iqs5xx, ishtp and ucsi_ccg has been disabled. The blob cleaning code in drivers and subsystems ixp4xx, imx-sdma, amdgpu, nouveau, and goya has been updated, as well as in the microcode documentation. The blob cleaning in the r8822be driver has been discontinued due to its removal.
Source: opennet.ru
