Linux kernel version 5.11

After two months of development, Linus Torvalds released the Linux kernel 5.11. Among the most notable changes are: support for Intel SGX enclaves, a new system call interception mechanism, an auxiliary virtual bus, a prohibition on building modules without MODULE_LICENSE(), a fast filtering mode for system calls in seccomp, the discontinuation of support for the ia64 architecture, the relocation of WiMAX technology to the 'staging' branch, and the ability to encapsulate SCTP in UDP.

The new version includes 15,480 fixes from 1,991 developers, with a patch size of 72 MB (the changes affected 12,090 files, added 868,025 lines of code, and removed 261,456 lines). About 46% of the changes in 5.11 are related to device drivers, roughly 16% pertain to updates of architecture-specific code, 13% are related to the networking stack, 3% to file systems, and 4% to internal kernel subsystems.

Key innovations:

• Disk subsystem, input/output, and file systems
  • Btrfs has added several mount options for data recovery from a damaged filesystem: 'rescue=ignorebadroots' to mount despite the damage to some root trees (extent, uuid, data reloc, device, csum, free space), 'rescue=ignoredatacsums' to disable checksum verification for data, and 'rescue=all' to enable 'ignorebadroots', 'ignoredatacsums', and 'nologreplay' modes simultaneously. The mount option 'inode_cache', which was previously marked as deprecated, has been removed. Code preparation has been made for supporting blocks with metadata and data sizes smaller than a page (PAGE_SIZE), as well as support for zoned space allocation mode. Unbuffered (Direct IO) requests have been switched to the iomap infrastructure. Performance optimizations have been made for several operations, with speed improvements in some cases reaching double digits.
  • In XFS, the 'needsrepair' flag has been implemented, indicating the need for repair. When this flag is set, the filesystem cannot be mounted until the flag is cleared by the xfs_repair utility.
  • In Ext4, only bug fixes and optimizations have been proposed, along with code cleaning.
  • The re-export of filesystems mounted over NFS has been allowed (i.e., a partition mounted via NFS can now be exported over NFS and used as an intermediate cache).
  • The system call close_range() has been enhanced with the CLOSE_RANGE_CLOEXEC option, allowing a process to close an entire range of open file descriptors in close-on-exec mode.
  • New ioctl() calls have been added to the F2FS filesystem, enabling user space to manage which files are stored in compressed form. A mount option 'compress_mode=' has been introduced to choose whether to place the compression handler on the kernel side or in user space.
  • Overlayfs can now be mounted by unprivileged processes using a separate user namespace. A complete audit of the code has been conducted to verify compliance with the security model. Additionally, Overlayfs has gained the capability to run using copies of filesystem images by optionally disabling UUID checks.
  • The Ceph filesystem has been updated to support the msgr2.1 protocol, which enables the use of the AES-GCM algorithm for encrypted data transmission.
  • The dm-multipath module has implemented the ability to consider CPU affinity when selecting input/output request routing.
• Memory and system services
  • A new mechanism for intercepting system calls has been introduced, based on prctl(), allowing user space to generate exceptions when accessing certain system calls and emulate their execution. This functionality is in demand by Wine and Proton for emulating Windows system calls, which is necessary for compatibility with games and applications that directly invoke system calls bypassing the Windows API (e.g., to prevent unauthorized usage).
  • The userfaultfd() system call, designed to handle page faults (access to unallocated memory pages) in user space, now features the ability to disable exception handling that occurs at the kernel level to complicate the exploitation of certain vulnerabilities.
  • The BPF subsystem has added support for task-local storage, which binds data to a specific BPF handler.
  • The accounting of memory consumption by BPF programs has been completely revamped — a cgroup controller is proposed for managing memory usage in BPF objects instead of memlock rlimit.
  • The BTF (BPF Type Format) mechanism, which provides information for type checking in BPF pseudocode, has implemented support for kernel modules.
  • Support for the system calls shutdown(), renameat2(), and unlinkat() has been added to the io_uring asynchronous I/O interface. The io_uring_enter() call now allows specifying a timeout (support for the timeout argument can be checked using the IORING_FEAT_EXT_ARG flag).
  • The ia64 architecture, used in Intel Itanium processors, has been classified as orphaned, meaning testing will no longer continue. Hewlett Packard Enterprise has ceased taking orders for new Itanium hardware, and Intel did so last year.
  • Support for systems based on the MicroBlaze architecture, which are not equipped with a memory management unit (MMU), has been discontinued. Such systems have long been out of everyday use.
  • Support for code coverage testing has been added for the MIPS architecture using the gcov utility.
  • Support for an auxiliary bus has been added to interact with multifunction devices that combine functionalities requiring different drivers (for example, network cards supporting Ethernet and RDMA). The bus can be used to assign a primary and secondary driver for the device in situations where the MFD (Multi-Function Devices) subsystem is problematic to use.
  • Support for the CMA (Contiguous Memory Allocator) memory distribution system has been added for the RISC-V architecture, optimized for allocating large contiguous memory areas using memory page migration techniques. Access restrictions to /dev/mem and tracking of interrupt handling time have also been implemented for RISC-V.
  • Support for the KASan (Kernel Address Sanitizer) debugging tool, which detects memory errors, has been added for 32-bit ARM systems. For 64-bit ARM, the KASan implementation has transitioned to using MTE (MemTag) tags.
  • The epoll_pwait2() system call has been added, allowing the use of timeouts with nanosecond precision (the epoll_wait call manipulates milliseconds).
  • The build system now outputs an error when attempting to build core modules that do not define a license for the code using the MODULE_LICENSE() macro. Errors during the build will also be triggered by the use of the EXPORT_SYMBOL() macro for static functions.
  • Added support for mapping GEM objects from memory used for input/output, which speeds up framebuffer operations on certain architectures.
  • Support for Qt4 has been removed in Kconfig (support for Qt5, GTK, and Ncurses has been retained).
• Virtualization and Security
  • The seccomp() system call has added support for a fast response mode, allowing for very quick determination of whether a particular system call is allowed or blocked based on an attached privilege table (constant-action bitmap) that does not require launching a BPF handler.
  • Core components for creating and managing enclaves based on Intel SGX (Software Guard eXtensions) technology have been integrated, allowing applications to run code in isolated encrypted memory areas, access to which is restricted for the rest of the system.
  • As part of the initiative to restrict user space access to MSR (model-specific register) registers, writing to the MSR_IA32_ENERGY_PERF_BIAS register has been prohibited, allowing changes to the processor's energy efficiency mode ('normal', 'performance', 'powersave').
  • The ability to disable high-priority task migration between CPUs has been ported from the kernel-rt branch for real-time systems.
  • For ARM64 systems, the ability to apply MTE (MemTag, Memory Tagging Extension) tags for memory addresses of signal handlers has been added. Using MTE is enabled by specifying the SA_EXPOSE_TAGBITS option in sigaction() and allows for pointer usage correctness checks to block exploitation of vulnerabilities caused by accessing already freed memory blocks, buffer overflows, pre-initialization accesses, and off-context usage.
  • The parameter 'DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING' has been added, allowing the dm-verity subsystem to verify hash signatures of certificates stored in the secondary keyring. In practice, this setting allows for the verification of not only certificates embedded in the kernel but also certificates loaded during operation, enabling updates of certificates without updating the entire kernel.
  • User-mode Linux has added support for suspend-to-idle mode, which allows freezing the environment and using the SIGUSR1 signal to wake up from sleep mode.
  • The virtio-mem mechanism, which enables hot-plugging and unplugging memory to virtual machines, has added support for Big Block Mode (BBM), allowing memory to be transferred or reclaimed in blocks larger than the kernel's block size, necessary for optimizing VFIO in QEMU.
  • The kernel-level implementation of TLS has been enhanced with support for the CHACHA20-POLY1305 cipher.
• Network subsystem
  • For 802.1Q (VLAN), a Connectivity Fault Management (CFM) mechanism has been implemented, allowing for the detection, verification, and isolation of failures in networks with Virtual Bridged Networks. For instance, CFM can be used to localize problems in networks spanning multiple independent organizations, whose employees only have access to their own equipment.
  • Support has been added for encapsulating SCTP protocol packets within UDP packets (RFC 6951), enabling the use of SCTP in networks with older address translators that do not directly support SCTP, as well as implementing SCTP on systems that do not provide direct access to the IP layer.
  • The implementation of WiMAX technology has been moved to staging and is slated for removal in the future if no users requiring WiMAX are found. WiMAX is no longer used in public networks, and the only driver that can be used for WiMAX in the kernel remains the outdated Intel 2400m driver. Support for WiMAX in the NetworkManager network configurator was discontinued in 2015. Currently, WiMAX has been nearly entirely replaced by technologies such as LTE, HSPA+, and Wi-Fi 802.11n.
  • Efforts have been made to optimize the performance of incoming TCP traffic processing in zerocopy mode, i.e., without additional copying to new buffers. For medium-sized traffic, covering tens or hundreds of kilobytes of data, using zerocopy instead of recvmsg() is significantly more efficient. For example, the implemented changes have achieved a 60-70% improvement in processing efficiency for RPC-style traffic with messages of 32 KB when using zerocopy.
  • New ioctl() calls have been added to create network bridges spanning multiple PPP channels. The proposed feature allows frames to move from one channel to another, for example, from PPPoE to a PPPoL2TP session.
  • Integration with the MPTCP (MultiPath TCP) kernel continues, extending the TCP protocol to facilitate TCP connection work with packet delivery simultaneously over multiple routes through different network interfaces assigned to different IP addresses. The new release implements support for the ADD_ADDR option to announce available (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. connections when adding new streams to an existing MPTCP connection.
  • The ability to configure actions when exceeding the budget for connection polling (busy-polling) has been added. The previously available SO_BUSY_POLL mode implied switching to softirq when the budget was exhausted. For applications that need to continue using polling, a new option SO_PREFER_BUSY_POLL has been proposed.
  • Support for SRv6 End.DT4 and End.DT6 modes has been implemented in IPv6, used for creating multi-user IPv4 L3 VPN and VRF (Virtual Routing and Forwarding) devices.
  • In Netfilter, the implementation of set expressions has been unified, allowing multiple expressions to be specified for each element of set lists.
  • In the wireless 802.11 stack, APIs have been added to configure SAR power constraint settings, as well as AE PWE and HE MCS parameters. Support for the 6GHz range (Ultra High Band) has been added to the Intel iwlwifi driver. The Qualcomm Ath11k driver has added support for fast connection setup technology FILS (Fast Initial Link Setup, standardized as IEEE 802.11ai), which eliminates delays during roaming while migrating from one access point to another.
• Hardware
  • Support for AMD APU "Green Sardine" (Ryzen 5000) and GPU "Dimgrey Cavefish" (Navi 2) has been implemented in the amdgpu driver, as well as initial support for the AMD Van Gogh APU with Zen 2 architecture and RDNA 2 (Navi 2) GPU. Support for new APU identifiers for Renoir (based on Zen 2 CPU and Vega GPU) has also been added.
  • The i915 driver for Intel graphics cards has implemented support for IS (Integer Scaling) technology with a filter for scaling considering the state of neighboring pixels (Nearest-neighbor interpolation) to determine the color of missing pixels. Support for Intel DG1 discrete graphics cards has been expanded. The support for the 'Big Joiner' technology, present starting from Ice Lake / Gen11 chips, has been implemented, allowing the use of a single transcoder to handle two streams, for example, for output to an 8K screen via a single DisplayPort. An asynchronous switching mode between two buffers in video memory (async flip) has been added.
  • The nouveau driver has added initial support for NVIDIA GPUs based on the 'Ampere' microarchitecture (GA100, GeForce RTX 30xx), currently limited to utilities for managing video modes.
  • Support for the 3WIRE protocol used in LCD panels has been added. Support has been added for novatek nt36672a, TDO tl070wsh30, Innolux N125HCE-GN1, and ABT Y030XX067A 3.0 panels. Notably, support for the OnePlus 6 and 6T smartphone panels has been added, allowing for booting on devices with an unmodified kernel.
  • Support for the first discrete USB4 host controller Intel Maple Ridge has been added.
  • Support for audio codecs Allwinner H6 I2S, Analog Devices ADAU1372, Intel Alderlake-S, GMediatek MT8192, NXP i.MX HDMI and XCVR, Realtek RT715, and Qualcomm SM8250 has been added.
  • Support for ARM platforms, devices, and systems has been added: Galaxy Note 10.1, Microsoft Lumia 950 XL, NanoPi R1, FriendlyArm ZeroPi, Elimo Initium SBC, Broadcom BCM4908, Mediatek MT8192/MT6779/MT8167, MStar Infinity2M, Nuvoton NPCM730, Marvell Armada 382, MikroTik based on Marvell Prestera 98DX3236, servers with Nuvoton NPCM750 BMC, Kontron i.MX8M Mini, Espressobin Ultra, 'Trogdor' Chromebook, Kobol Helios64, Engicam PX30.Core.
  • Built-in support for the Ouya gaming console based on NVIDIA Tegra 3 has been added.

At the same time, the Latin American Free Software Foundation has formed a version of the fully free kernel 5.11 — Linux-libre 5.11-gnu, cleaned of firmware and drivers that contain non-free components or code sections limited by the manufacturer. In the new release, driver cleaning has been conducted for qat_4xxx (crypto), lt9611uxcm (dsi/hdmi bridge), ccs/smia++ (sensor), ath11k_pci, nxp audio transceiver, and mhi pci controller. The blob cleaning code in amdgpu, btqca, btrtl, btusb, i915 csr drivers and subsystems has been updated. New blobs in m3 rproc, idt82p33 ptp clock, and qualcomm arm64 have been disabled.

Source: opennet.ru