Release of Linux kernel 5.15

After two months of development, Linus Torvalds presented the release of Linux kernel 5.15. Among the most notable changes are: a new NTFS driver with write support, the ksmbd module implementing an SMB server, the DAMON subsystem for monitoring memory access, locking primitives for real-time mode, fs-verity support in Btrfs, and the process_mrelease system call for memory shortage response systems, as well as a remote attestation module, dm-ima.

The new version includes 13,499 fixes from 1,888 developers, with the patch size being 42 MB (changes affected 10,895 files, added 632,522 lines of code, and removed 299,966 lines). About 45% of all changes in 5.15 are related to device drivers, approximately 14% deal with updates to architecture-specific code, 14% pertains to the networking stack, 6% to file systems, and 3% to the kernel's internal subsystems.

Key innovations:

• Disk subsystem, input/output, and file systems
  • The kernel now includes a new implementation of the NTFS file system, open-sourced by Paragon Software. The new driver can operate in write mode and supports all features of the current NTFS 3.1 version, including extended file attributes, access control lists (ACL), data compression mode, efficient handling of sparse files, and journaling for integrity recovery after failures.
  • The Btrfs file system has implemented support for the fs-verity mechanism, used for transparent integrity and authenticity verification of individual files through associated cryptographic hashes or keys stored in the metadata area. Previously, fs-verity was only available for Ext4 and F2fs file systems.

    Btrfs has also added support for mapping user IDs for mounted file systems (previously supported for FAT, ext4, and XFS file systems). This feature allows mapping files of a specific user on a mounted foreign partition to another user in the current system.

    Among other changes in Btrfs: acceleration of key addition to the directory index to improve file creation performance; the ability to use raid0 with a single device and raid10 with two (for example, during the reconfiguration of the array); the option "rescue=ibadroots" to ignore an invalid extent tree; acceleration of the "send" operation; reduction of lock conflicts during rename operations; and the ability to use 4K sectors on systems with a 64K memory page size.

  • In XFS, the ability to use file systems with dates after 2038 has been stabilized. A mechanism for deferred inode deactivation and support for deferred setting and removal of file attributes has been implemented. To eliminate problems, the ability to disable disk quotas for already mounted partitions has been removed (quotas can still be forcibly disabled, but the associated counting will continue, so full disabling requires remounting).
  • In EXT4, work has been carried out to increase the write performance of delalloc buffers and the processing of orphan files that continue to exist because they remain open but are no longer attached to a directory. The processing of discard operations has been moved out of the jbd2 kthread stream to avoid locking issues with metadata operations.
  • In F2FS, the option "discard_unit=block|segment|section" has been added to bind discard operations (marking released blocks that no longer need to be physically stored) to alignment relative to a block, sector, segment, or section. Support for tracking changes in input/output latencies has also been added.
  • In the EROFS (Extendable Read-Only File System), support for direct input/output for files stored uncompressed, as well as support for fiemap, has been added.
  • In OverlayFS, proper handling of the mounting flags "immutable", "append-only", "sync", and "noatime" has been implemented.
  • In NFS, the handling of situations where the NFS server stops responding to requests has been improved. The ability to mount from an already used but accessible address through another network address has been added. server, but accessible through another network address.
  • Preparation for rewriting the FSCACHE subsystem has begun.
  • Support for EFI partitions with non-standard GPT table placement has been added.
  • The fanotify mechanism has introduced a new flag FAN_REPORT_PIDFD, which allows the pidfd to be included among the returned metadata. Pidfd helps handle situations with PID reuse for more accurate identification of processes accessing monitored files (pidfd is linked to a specific process and does not change, while PID may be reassigned to another process after the current process associated with this PID terminates).
  • The move_mount() system call has been updated to allow adding mount points to existing shared groups, which addresses issues with saving and restoring process states in the CRIU toolkit when multiple mount namespaces are shared across isolated containers.
  • Protection against hidden race conditions that could potentially lead to file corruption during cache reads while handling gaps in the file has been added.
  • Support for mandatory file locks implemented via file-modifying system calls has been discontinued. Due to potential race conditions, these locks were deemed unreliable and deprecated many years ago.
  • The LightNVM subsystem, which allowed direct access to SSDs bypassing the emulation layer, has been removed. LightNVM became obsolete after the introduction of NVMe standards that support zoned namespaces (ZNS).
• Memory and system services
  • The DAMON (Data Access MONitor) subsystem has been implemented to track memory access activity associated with a selected user-space process. The subsystem allows analysis of which memory areas the process has accessed during its entire execution and which areas remained unused. Notable features of DAMON include low CPU overhead, minimal memory consumption, high accuracy, and predictable constant overhead that does not depend on size. The subsystem can be used by the kernel for memory management optimization as well as by user-space utilities to understand what the process is doing and optimize memory usage, such as freeing up unnecessary memory for the system.
  • A system call process_mrelease has been implemented, allowing for a faster process of releasing memory of a process that is finishing execution. Under normal conditions, resource deallocation and process termination are not instant and can be delayed for various reasons, which hinders the operation of user-space systems for early response to memory shortages, such as oomd (provided in systemd) and lmkd (used in Android). With the process_mrelease call, such systems can more predictably initiate the return of memory from forcibly terminated processes.
  • From the PREEMPT_RT kernel branch, which develops support for real-time operation, variants of primitives for organizing mutex locks, ww_mutex, rw_semaphore, spinlock, and rwlock have been transferred, based on the RT-Mutex subsystem. Changes have been made to the SLUB slab allocator to enhance its operation in PREEMPT_RT mode and reduce its impact on interruptions.
  • Support for the task scheduler attribute SCHED_IDLE has been added to cgroup, allowing this designation to be applied to all processes in a specific cgroup at once. That is, these processes will only start when there are no other tasks in the system waiting for execution. Unlike setting the SCHED_IDLE attribute to each process individually, when binding SCHED_IDLE to a cgroup, the relative weight of tasks within the group is taken into account when selecting a task for execution.
  • The memory consumption tracking mechanism in cgroup has been expanded to monitor additional kernel data structures, including those created for polling, signal handling, and namespaces.
  • Support for asymmetric task binding scheduling to processor cores has been added on architectures where some CPUs allow the execution of 32-bit tasks while others operate only in 64-bit mode (for example, ARM). The new mode allows the scheduling of 32-bit tasks to consider only CPUs that support 32-bit tasks.
  • The interface of asynchronous I/O io_uring now supports opening files directly in the fixed-file index table without using a file descriptor, which significantly speeds up certain types of operations, but contradicts the traditional Unix process of using file descriptors for opening files.

    In io_uring for the BIO (Block I/O Layer) subsystem, a new mechanism for recycling BIOs has been implemented, which reduces overhead in managing internal memory and increases the number of I/O operations processed per second by approximately 10%. Support for the system calls mkdirat(), symlinkat(), and linkat() has also been added to io_uring.

  • For BPF programs, the ability to request and handle timer events has been implemented. An iterator for UNIX sockets has been added, as well as the ability to get and set socket options for setsockopt. Support for typed data has been added to the BTF dumper.
  • On NUMA systems with different types of memory that vary in performance, a mechanism has been implemented to transfer evicted memory pages from dynamic RAM (DRAM) to slower persistent memory instead of deleting those pages in situations where free space is exhausted. Tests have shown that this tactic generally improves performance on such systems. For NUMA, the ability to allocate memory pages for a process from a chosen set of NUMA nodes has also been implemented.
  • For the ARC architecture, support for three- and four-level page tables has been implemented, which will allow future support for 64-bit ARC processors.
  • For the s390 architecture, the KFENCE mechanism for detecting memory errors has been enabled, and support for the KCSAN race condition detector has been added.
  • Support for indexing the list of messages output via printk() has been added, allowing for the extraction of all such messages at once and monitoring changes in user space.
  • Support for the VM_DENYWRITE option in mmap() has been discontinued, and the kernel code has been cleared of the MAP_DENYWRITE mode, reducing the number of situations that lead to write failures with error ETXTBSY.
  • A new type of checks, ‘Event probes’, has been added to the tracing subsystem, which can be attached to existing trace events, allowing for a custom output format.
  • When building the kernel with the Clang compiler, the integrated assembler from the LLVM project is now used by default.
  • As part of the project to eliminate kernel code that causes compiler warnings, an experiment was conducted to enable the ‘-Werror’ mode by default, where compiler warnings are treated as errors. During the preparation for the 5.15 release, Linus began accepting only changes that do not generate warnings when building the kernel and activated the build with ‘-Werror’, but later agreed with the opinion that such a decision was premature and postponed enabling ‘-Werror’ by default. Management of the ‘-Werror’ flag during compilation is controlled by the WERROR parameter, which is set to COMPILE_TEST by default, meaning it is only enabled for test builds.
• Virtualization and Security
  • A new handler, dm-ima, has been added to the Device Mapper (DM) with the implementation of a remote attestation mechanism based on the IMA (Integrity Measurement Architecture) subsystem, allowing an external service to verify the state of kernel subsystems to ensure their authenticity. In practice, dm-ima enables the creation of storage linked to external cloud systems using the Device Mapper, where the validity of the executed DM target configuration is checked using IMA.
  • A new option, PR_SPEC_L1D_FLUSH, has been implemented in prctl(). When enabled, the kernel flushes the contents of the level 1 data cache (L1D) each time context switching occurs. This mode allows for additional protection against side-channel attacks that attempt to determine data left in the cache due to vulnerabilities caused by the speculative execution of instructions in the CPU, selectively for the most important processes. The cost of enabling PR_SPEC_L1D_FLUSH (which is disabled by default) is a significant decrease in performance.
  • The ability to compile the kernel with the addition of the GCC flag "-fzero-call-used-regs=used-gpr" has been implemented, which ensures that all registers are zeroed before control is returned from a function. This option helps protect against information leakage from functions and reduces the number of blocks suitable for constructing ROP gadgets (Return-Oriented Programming) in exploits by 20%.
  • The ability to compile kernels for the ARM64 architecture has been implemented in the form of clients for the Hyper-V hypervisor.
  • A new framework for driver development called "VDUSE" has been proposed, allowing for the implementation of virtual block devices in user space and using Virtio as a transport for access from guest systems.
  • A Virtio driver for the I2C bus has been added, enabling the emulation of I2C controllers in paravirtualization mode with the use of separate backends.
  • A gpio-virtio Virtio driver has been added, allowing guest systems to access GPIO lines provided by the host system.
  • The capability to restrict access to memory pages for device drivers with DMA support has been added on systems without an I/O MMU (memory management unit).
  • The KVM hypervisor has implemented the ability to output statistics in the form of linear and logarithmic histograms.
• Network subsystem
  • The ksmbd module has been added to the kernel, implementing a file server that uses the SMB3 protocol. This module supplements the previously available SMB client implementation in the kernel and, unlike the user-space SMB server, is more efficient in terms of performance, memory consumption, and integration with the kernel's advanced features. Ksmbd is presented as a high-performance extension to Samba ready for deployment on embedded devices, capable of integration with Samba tools and libraries when necessary. Noteworthy features of ksmbd include improved support for file caching technology (SMB leases) on local systems, which significantly reduces traffic. Future plans include adding support for RDMA ("smbdirect") and protocol extensions related to enhancing encryption reliability and digital signature verification.
  • Support for NTLM and less secure authentication algorithms based on the DES algorithm used in SMB1 has been discontinued in the CIFS client.
  • Multicast support has been implemented in the VLAN bridge implementation.
  • The bonding driver, used for aggregating network interfaces, has added support for the XDP (eXpress Data Path) subsystem, which allows manipulation of network packets before they are processed by the Linux kernel network stack.
  • The mac80211 wireless stack now supports 6GHz STA (Special Temporary Authorization) in LPI, SP, and VLP modes, as well as the ability to set individual TWT (Target Wake Time) in access point mode.
  • Support for the MCTP (Management Component Transport Protocol) has been added, which is used for communication between management controllers and associated devices (host processors, peripherals, etc.).
  • Integration of MPTCP (MultiPath TCP) into the kernel continues, which is an extension of the TCP protocol for establishing TCP connections with packet delivery over multiple routes through different network interfaces bound to different IP addresses. The new release adds support for fullmesh mode addresses.
  • Network stream handlers encapsulated in the SRv6 (Segment Routing IPv6) protocol have been added to netfilter.
  • Sockmap support for streaming Unix sockets has been added.
• Hardware
  • The amdgpu driver now supports the APU Cyan Skillfish (equipped with GPU Navi 1x). Support for video codecs has been implemented for APU Yellow Carp. Enhanced support for GPU Aldebaran has been provided. New identifiers for GPU Navi 24 'Beige Goby' and RDNA2 have been added. An improved implementation of virtual screens (VKMS) has been proposed. Support for monitoring the temperature of AMD Zen 3 chips has been added.
  • The amdkfd driver (for discrete GPUs such as Polaris) has implemented a shared virtual memory (SVM) manager based on the HMM (Heterogeneous Memory Management) subsystem, allowing the use of devices with their own memory management units (MMU) that can access main memory. Using HMM, a shared address space between GPU and CPU can be organized, enabling the GPU to access the main memory of a process.
  • The i915 driver for Intel graphics cards has expanded the use of the TTM video memory management system and included the ability to manage power consumption based on the GuC (Graphics micro Controller). Preparations have begun for the implementation of support for the Intel ARC Alchemist graphics card and Intel Xe-HP GPU.
  • The nouveau driver implements control of eDP panel backlighting using DPCD (DisplayPort Configuration Data).
  • The msm driver has added support for the Adreno 7c Gen 3 and Adreno 680 GPUs.
  • An IOMMU driver has been implemented for the Apple M1 chip.
  • A sound driver has been added for systems based on AMD Van Gogh APU.
  • The staging branch has added the Realtek R8188EU driver, which has replaced the old rtl8188eu driver for Realtek RTL8188EU 802.11 b/g/n wireless chips.
  • The ocp_pt driver has been accepted for the PCIe card developed by Meta (Facebook), implementing miniature atomic clocks and GNSS receivers, which can be used for organizing isolated precision time synchronization. servers precise time synchronization.
  • Support has been added for smartphones Sony Xperia 10II (Snapdragon 665), Xiaomi Redmi 2 (Snapdragon MSM8916), Samsung Galaxy S3 (Snapdragon MSM8226), and Samsung Gavini/Codina/Kyle.
  • Support has been added for ARM SoCs and NVIDIA Jetson TX2 NX Developer Kit, Sancloud BBE Lite, PicoITX, DRC02, SolidRun SolidSense, SKOV i.MX6, Nitrogen8, Traverse Ten64, GW7902, Microchip SAMA7, Qualcomm Snapdragon SDM636/SM8150, Renesas R-Car H3e-2G/M3e-2G, Marvell CN913x, ASpeed AST2600 (server boards Facebook Cloudripper, Elbert, and Fuji), 4KOpen STiH418-b2264.
  • Support has been added for LCD panels Gopher 2b, EDT ETM0350G0DH6/ETMV570G2DHU, LOGIC Technologies LTTD800480070-L6WH-RT, Multi-Innotechnology MI1010AIT-1CP1, Innolux EJ030NA 3.0, ilitek ili9341, E Ink VB3300-KCA, Samsung ATNA33XC20, Samsung DB7430, and WideChips WS2401.
  • The LiteETH driver has been added with support for Ethernet controllers used in LiteX software SoCs (for FPGAs).
  • The usb-audio driver has added a lowlatency option to manage operations in reduced delay mode. A quirk_flags option has also been added to pass device-specific settings.

At the same time, the Latin American Free Software Foundation has released a variant of the fully free kernel 5.15 — Linux-libre 5.15-gnu, cleaned of firmware and driver elements containing non-free components or segments of code restricted by the manufacturer. The new release includes logging the completion message of the cleaning process. Issues in package formation using mkspec have been resolved, and support for snap packages has been improved. Some warnings previously shown during the processing of the firmware.h header file have been removed. Certain types of warnings ("format-extra-args", comments, unused functions, and variables) are now allowed during compilation in the "-Werror" mode. The cleaning for the gehc-achc driver has been added. The blob cleaning code in the drivers and subsystems for adreno, btusb, btintel, brcmfmac, and aarch64 qcom has been updated. The cleaning of the prism54 drivers (removed) and rtl8188eu (replaced with r8188eu) has been discontinued.

Source: opennet.ru