Linux 6.19

After two months of development, Linus Torvalds presented announced the release of the kernel Linux 6.19. Among the most notable changes are: the Live Update Orchestrator subsystem, support for PCIe Link Encryption, the system call listns, Zero-Copy Receive mode in io_uring, support for ARM extension MPAM, klp-build for generating live patches, support for the LoongArch32 architecture, QoS for s2idle, optimization of the audit subsystem, Intel LASS for protection against Spectre, support for SHA-3 and BLAKE2b hashes, the Confidential VMBus mechanism, TX optimizations in the networking subsystem, CAN XL protocol, and API for hardware acceleration of HDR output.

In the announcement of the new version, Linus mentioned that the next kernel release will be assigned the number 7.0, as there have been enough releases in the 6.x branch to change the first digit in the version number (the 6.0 release was formed following 5.19). The numbering change is made for aesthetic reasons and is a formal step to alleviate discomfort due to the accumulation of a large number of releases in the series. Linus joked that he gets confused by large numbers for which he doesn't have enough fingers on his hands and feet. At the same time, there is, in fact, reason for a significant version number change, as starting from the next release, support for Rust is planned to be moved from experimental to core functionalities of the kernel.

The new version includes 15,657 fixes from 2,237 developers, with a patch size of 52 MB (changes affected 13,682 files, 794,649 lines of code were added, and 335,498 lines were removed). In the previous release, there were 15,035 fixes from 2,217 developers, with a patch size of 45 MB. About 40% of all changes presented in 6.19 relate to device drivers, roughly 13% pertain to hardware-specific code updates, 12% is related to the networking stack, 5% concerns file systems, and 3% involves internal kernel subsystems.

The main innovations in kernel 6.19 (1, 2, 3):

• Disk subsystem, input/output, and file systems
  • In Btrfs file system check processes (scrub) and device replacement no longer block the system's transition to sleep mode (before sleeping, the scrub check state is saved; after waking up, the scrub check continues, and the device replacement operation is restarted). RAID56 implementation has added support for blocks larger than the memory page size. Preparation has been made for support of fscrypt. fscryptImproved performance in handling locks during operations related to space reservation. Added Support for the ioctl shutdown operation, allowing the file system to enter a state where it attempts to complete ongoing operations while blocking all new ones.
  • In the file system Ext4 enabled Support for blocks larger than the memory page size (>4KB on x86 systems). Using larger blocks , rather than taking focus. can improve the performance of buffered write operations by an average of 50%, but it reduces the performance of direct input/output due to increased checksum calculation time. The new version also added includes optimizations that enhance throughput during online defragmentation.
  • In the subsystem FUSE improved support for buffered reading when using large memory folios (large folios). Through iomap, it is now possible to track partially valid folios to load only the data missing in the buffer.
  • In VFS added support for recallable directory delegation, allowing implementation in NFS the transfer of directory control from the server to the client, enabling the NFS client to independently track the directory state based on the local cache without requests to the NFS server. If another NFS client makes changes related to this directory, the delegation will be revoked from the first client.
  • For NFS has added added support for direct input/output (direct I/O) reading. Implemented settings in /sys/kernel/debug/nfsd/io_cache_read and /sys/kernel/debug/nfsd/io_cache_write to control the enabling of caching and direct I/O operations; manipulating these settings can reduce overhead on the NFS client side during large I/O operations.
  • In NTFS the ioctl shutdown operation has been implemented, includes with default mounting options for acl and prealloc, added support for time up to January 1, 1970.
  • For block devices and file systems enabled default separate object caching for each CPU for "bio" (Block I/O), defining active I/O operations.
• Memory and system services

  • In the kernel enabled the subsystem Live Update Orchestrator (LUO), which allows for a complete reboot and update of the kernel without stopping operations and without losing the state of the system, devices, and processes. The LUO subsystem is based on the previously added kernel mechanism KHO (Kexec HandOver) and in addition to the ability to launch a new kernel from an old one without losing the state of the system, addresses tasks such as preserving the state of devices and memory, as well as ensuring the continuity of operations related to DMA and interrupt processing. The state is preserved until switching to the new kernel and restored after the new kernel is activated without interrupting continuous operations with the devices performed by the system and applications in user space.

  • Added the system call listns() to output a list of existing namespaces in the system without the need to traverse /proc//ns/ for all processes.

  • The asynchronous input/output system io_uring has added support for queuing elements of different sizes in the submission queue (SQE, Submission Queue Entry), similar to how mixing queue result sizes (CQE, Completion Queue Event) was allowed in the previous release. Previously, all elements in the queue had to be of uniform size, leading to excessive memory consumption due to the necessity of using the maximum size for all elements in the queue.

    io_uring has also added support for the zcrx (Zero-Copy Receive) mechanism for receiving data without copying between the kernel and user space. Support for memory layout requests for SQ (Submission Queue) and CQ (Completion Queue) has been added, allowing the acquisition of information about the size of the ring buffer needed during user memory allocation using the flags IORING_SETUP_NO_MMAP and IORING_MEM_REGION_TYPE_USER.

  • For quick stack tracing using utilities such as perf, support for the SFrame format with call stack unwind information has been added. SFrame is already supported in GCC and binutils, does not degrade performance, and unlike the DWARF format, contains only the minimal necessary information for stack tracing.

  • In the perf utility has added support for unified descriptions of metrics and events in JSON format, as well as deferred unwinding of the call stack in user space.

  • For AMD processors A mechanism has been implemented for substituting data into the cache, allowing input/output devices to directly insert data into the L3 CPU cache without first placing it in RAM.

  • Support added MPAM (Memory System Resource Partitioning and Monitoring), an extension of the ARMv8-A instruction set architecture for tagging each memory access with a section identifier (PARTID, Partition ID) and a monitoring group identifier (PMG, Monitoring Group ID). Resource consumption, such as memory bandwidth or cache size, can be limited based on PARTID, preventing any specific task group from monopolizing resources. In the context of monitoring, the combination of PMG and PARTID can be used to track memory resource consumption under certain load types.

  • In the event of a process terminating unexpectedly after receiving a signal, another process that has the pidfd of the terminated process can now determine the signal number that caused the termination.

  • The implementation of restartable sequences (restartable sequences), which allow applications to organize pseudo-atomic uninterrupted execution of a group of instructions (if interrupted by another thread, a retry of the sequence is attempted). The new implementation features improved performance.

  • For BPF programs is implemented BPF_JMP, BPF_X, and BPF_JA instructions for making indirect jumps to a specific position from the jump table. A concept of dynamic pointers (dynptr) has been introduced, allowing data to be read from structured files. Added the ability to attach multiple bytes of metadata to network packets.

  • Modules in Python, used for processing kernel documentation, have been moved to a separate directory tools/lib/python.

  • A function has been added mempool_alloc_bulk() for safely allocating elements from the memory pool for multiple objects at once.

  • Continued the transfer of changes from the branch Rust-for-Linux, related to the use of the Rust language as a second language for developing drivers and kernel modules (Rust support is not enabled by default and does not make Rust a required build dependency for the kernel). In the new version, the built-in library "synwith a Rust code parser that simplifies writing complex macros. Enhanced capabilities for the kernel, pin-init, and rbtree libraries. Added the num library with the Integer trait for manipulating integers. The module! macro now supports integer parameters. Implemented the ability to specify parameters when loading kernel modules written in Rust. Abstracts have been created for subsystems. I2C and PWM (Pulse Width Modulation).

  • Added The at_least macro (e.g., param[at_least 7]) informs about the minimum allowable size of the array passed to the function. If an array with fewer elements is passed to the function, the compiler will issue a warning.

  • finalrd included the klp-build script for generating kernel modules, making changes to the running kernel (livepatch), based on a patch file. Changes necessary for creating live patches have been made to the objtool utility.

  • In User-mode Linux (running the kernel as a user process) has added limited support for multiprocessing, but threads within a single process cannot yet execute simultaneously. Started porting User-mode Linux to the nolibc.

  • Added support for the LoongArch32 (LA32R, LA32S) in addition to LoongArch64.

  • Added the ability to set QoS limits on processor wake-up intensity in energy-saving mode s2idle (Suspend-To-Idle), which freezes the execution of user-space processes while keeping some handlers active in the kernel.

  • Added support for managing page tables for memory controllers IOMMU (Input-Output Memory Management Unit), which perform translation of virtual addresses visible to hardware devices into physical addresses, with the capability to filter DMA operations by virtual addresses, as well as to restrict and isolate input-output operations.

  • In system call tracing events, the ability to read buffers from user space and include their contents (e.g., file names) in the trace result has been implemented.

  • **Guard pages memory ( (guard page), access to which triggers an exception and the abrupt termination of the process (SIGSEGV), are now marked with a special label in the file /proc/PID/smaps.

  • Added the ability to manage large memory pages (transparent huge page) in the private memory of zoned devices.

  • In the device zram, used for compressed storage of the swap area in memory, within support for the multiplexing of multiple bio structures (Block I/O) in batch mode (writeback batching).

  • The package includes the font ‘Terminus 10×18’, enhancing the readability of information from the console on medium-resolution laptop screens (1440×900).

  • Significantly optimized work audit subsystems — a reduction in overhead by half has been observed.

• Virtualization and Security
  • Support has been added for the capability provided by Intel processors for separation of linear address space (LASS, linear address-space separation), allowing hardware separation of the user and kernel address space ranges to enhance security. The address space is divided by the high bit of the address – half of the address space with the high bit set is used for the kernel, while the lower half is for user space. Early in the instruction execution (prior to speculative execution), a check is made to ensure that accesses from user space to addresses with the high bit set and vice versa are valid. This separation prevents kernel memory leaks into user space through side channels even during speculative execution of instructions, allowing the use of LASS to protect against Meltdown and Spectre class attacks without incurring significant overhead.
  • The ability to enable extensions for enhanced security of the PCI Express bus – PCIe Link Encryption and PCIe Device Authentication, which authenticate and encrypt the communication channel between a PCIe device and a virtual machine protected by Intel TDX (Trusted Domain Extensions) and AMD SEV-SNP (Secure Nested Paging) mechanisms. The implemented technologies prevent interception, analysis, and injection of data into DMA traffic when there is access to the host system or other devices.
  • In the integrated cryptographic library has added support for SHA-3 algorithms (SHA3-224, SHA3-256, SHA3-384, SHA3-512), SHAKE128, SHAKE256, and BLAKE2b has been added.
  • For LSM modules (Linux Security Modules) and, specifically for SELinux, within the capability to track the creation of memfd descriptors to enforce security policies on associated objects has been introduced.
  • In the LSM module IPE (Integrity Policy Enforcement), which defines the overall integrity policy for the entire system, support for the flag has been added AT_EXECVE_CHECK in the function execveat(), including a script integrity check before its execution by the interpreter.
  • Primitive functions scoped_user_read_access(), scoped_user_write_access, and scoped_user_rw_access() have been added for limited access to data in user space with protection against speculative attacks.
  • Added support for the Confidential VMBus, used in the HyperV hypervisor for secure, interference-free interaction between the guest system running in confidential mode (with memory encryption and register isolation based on AMD SNP and Intel TDX technologies) and the paravisor responsible for accessing devices that handle confidential data.
  • Added the ability to transmit information about a crashed process (for generating a coredump) via the pidfd mechanism. The PIDFD identifier is linked to a specific process and does not change, while the PID may be associated with another process after the current process associated with this PID has terminated. Using pidfd allows blocking the attacks replacement of the crashed suid process with another process, creating a race condition right after the kernel begins handling the emergency termination, but before the user-space handler checks the process parameters.
• Network subsystem
  • In the networking subsystem optimizations have been made to improve data transmission efficiency (TX). Eliminating the spinlock in the __dev_queue_xmit() function and using a lock-free llist structure has allowed to increase performance by 4 times under heavy load and double packet transmission intensity while reducing CPU load by two times.
  • Provided of disabling for individual network sockets of system limits on memory usage (in this case, common memory limits set for individual containers will be used). To manage the disconnection of limits, the sysctl net.core.bypass_prot_mem and the SK_BPF_BYPASS_PROT_MEM flag have been proposed in the bpf_setsockopt function.
  • Added support for the extension RFC 5837, which adds information about incoming network interfaces to the ICMP messages Time Exceeded returned when the packet's time to live (TTL) expires for more detailed information during route tracing by the traceroute utility.
  • Added support for continuous active polling (busy polling) in a separate kernel thread to extract descriptors from RX/TX queues for applications requiring minimal latency.
  • Support for the protocol CAN XL (Controller Area Network eXtended Length), where the data field size is increased to 2048 bytes to enable integration with TCP/IP networks, implemented Ethernet frame tunneling capability and added support for pulse-width modulation, allowing data to be transmitted at speeds of 20 Mbps and higher.
  • Added support for the structure sockaddr_unsized, a variant of the sockaddr structure that uses an array with flexible elements instead of a fixed-size array (sa_data[] instead of sa_data[14], which was essentially used for references to larger structures).
  • The ability to use the functionality of getsockname and getpeername through the io_uring subsystem has been added.
  • Added sysctl net.ipv4.tcp_rcvbuf_low_rtt and net.ipv4.tcp_comp_sack_rtt_percent for TCP optimization.
  • Added support for links with a bandwidth of 1600 Gbps (1.6T).
• Hardware
  • An API has been added to the DRM (Direct Rendering Manager) subsystem for utilizing hardware color conversion capabilities, allowing color conversions to be performed without executing such conversions through shaders or executing code on the CPU. For output to HDR monitors, complex color conversions can now be handled by the display controller at the stage before and after layer blending, instead of through software compositing of content into the final display buffer. In addition to reducing overhead and power consumption when organizing HDR output, the proposed functionality can be used for accurate color reproduction in video or image editors.
  • Added the ethosu driver for the Arm Ethos U65 and U85 NPUs, designed for hardware acceleration of AI model execution.
  • The i915 driver for Lunar Lake GPUs and newer has added support for hardware image sharpening.
  • Continued development of the drm-driver (Direct Rendering Manager) Xe for GPUs based on the Intel Xe architecture, which is used in Intel Arc family graphics cards and integrated graphics starting from Tiger Lake processors. Initial support for the Xe3P architecture, used in Crescent Island GPUs and Nova Lake integrated graphics processor families, has been added.
  • The AMDGPU driver provides full support for AMD graphics cards of the GCN 1.0 "Southern Island" and 1.1 "Sea Islands" families, for which the Radeon driver was previously used. The AMDGPU driver has been updated to match the feature set of the Radeon driver and is enabled by default for the specified GPUs. GCN 1.x cards were produced from 2012 to 2019 and include models such as Radeon HD 77xx/78xx/79xx/87xx/88xx/89xx, Radeon R9 280, FirePro W4000-W9000, Radeon Sky 700/900, Radeon R9 265/270/370, Radeon R9 290/390, HD 7790/8870, and other Radeon Rx 200/Rx 300 family graphics cards. In addition, an increase in performance by an average of 24%, the transition to AMDGPU has allowed the implementation of support for the Vulkan 1.3 graphics API for these GPUs. Additionally, AMDGPU includes support for analog connectors and Video Coding Engine 1.0, and the DC (Display Core) stack for GPUs based on the Bonaire microarchitecture (Radeon HD 7790) is used by default.
  • The Nouveau driver within includes support for the NVJPG hardware accelerator present in the Tegra210 SoC.
  • In the Panthor driver, has added support for the Mali-G1 GPU and initial support for the MediaTek MT8196 chip has been added.
  • Added support for the audio subsystem of Intel Nova Lake S chips, HP laptops with HDA CS35L41, as well as audio interfaces CIX IPBLOQ HD and Onkyo SE-300PCIE.
  • Integration of Nova driver components for NVIDIA GPUs equipped with GSP firmware, used starting from the NVIDIA GeForce RTX 2000 series based on Turing microarchitecture, has continued. The driver is written in Rust. In the new version, work on RPC has begun and completed the implementation of GSP (GPU System Processor) co-processor loading.
  • Added Support for ARM platforms, SoCs, and devices: Bananapi r4 pro, LinkEase EasePi R1, Qualcomm MSM8937 (Snapdragon 430), Renesas R-Car X5H, FriendlyElec NanoPi R76S, TI AM62L, Black Sesame Technologies C1200, Aspeed AST2600, Genio 1200 EVK, grinn geniosbc-510/700, Tanix TX9 Pro, Radxa Dragon Q6A, Tinker Board 3/3S, Aquila AM69, phyBOARD-Segin-i.MX91, i.MX 95 Verdin Evaluation Kit, Toradex SMARC iMX95, VIDIA Jetson Nano 2GB, Renesas rz/g3s, Indiedroid Nova, and 24 variants of Enclustra Mercury boards has been added.
  • Support for smartphones and tablets based on SoC Mediatek MT6582 (Alcatel yarisxl), Nvidia Tegra124 (Xiaomi Mi Pad), and Qualcomm MSM8939 (ASUS ZenFone 2) has been added. Support for laptops on SoC Qualcomm sdm850, such as the Huawei MateBook E 2019, has also been included.
  • Support for SoCs and boards based on RISC-V architecture: OrangePi R2S, OrangePi RV, Anlogic dr1v90, Tenstorrent Blackhole has been added.

At the same time, the Latin American Free Software Foundation has formed variant a fully free kernel 6.19 — Linux-libre 6.19-gnucleaned of firmware and driver elements containing non-free components or code areas restricted by the manufacturer. In release 6.19, the code for loading binary firmware has been removed from the SDCA audio subsystem. The blob-cleaning code has been updated in drivers for Intel XE, Nova-Core, Qualcomm Iris, Venus and Q6V5, TI PRUeth, Intel iwlwifi, Marvell mwifiex, FourSemi fs210x, Realtek rt1320, and TI tas2783 audio codecs. The cleanup of blob names in dts files (device trees) for ARM chips has been completed. The cleaning of the STM C8SECTPFE DVB driver, which was removed from the kernel, has been discontinued.

Source: linux.org.ru