Release of Linux Kernel 5.19

After two months of development, Linus Torvalds has released Linux Kernel 5.19. Among the most notable changes are support for the LoongArch processor architecture, integration of 'BIG TCP' patches, 'on-demand' mode in fscache, removal of code for supporting a.out format, the ability to apply ZSTD for firmware compression, an interface for managing memory eviction from user space, increased reliability and performance of the pseudo-random number generator, and support for Intel IFS (In-Field Scan), AMD SEV-SNP (Secure Nested Paging), Intel TDX (Trusted Domain Extensions), and ARM SME (Scalable Matrix Extension).

In the announcement, Linus stated that the next kernel release will likely be designated version 6.0, as there have been enough releases in the 5.x branch to justify a change in the major version number. This change in numbering is made for aesthetic reasons and serves as a formal step to alleviate the discomfort caused by the accumulation of a large number of releases in the series.

Linus also mentioned that he used an Apple laptop based on the ARM64 architecture (Apple Silicon) with a Linux environment based on the Asahi Linux distribution for the release. This is not Linus's main workstation, but he utilized this platform to test its suitability for kernel work and to ensure that he could produce kernel releases while traveling with a lightweight laptop in hand. Many years ago, Linus had experience using Apple hardware for development—he once used a machine based on the PPC970 CPU and a MacBook Air.

The new version includes 16,401 fixes from 2,190 developers (the previous release had 16,206 fixes from 2,127 developers), with a patch size of 90 MB (the changes affected 13,847 files, adding 1,149,456 lines of code and removing 349,177 lines). About 39% of all changes in 5.19 are related to device drivers, approximately 21% pertain to updates to architecture-specific code, 11% are related to the networking stack, 4% involve file systems, and 3% pertain to internal kernel subsystems.

Key innovations in Kernel 5.19:

• Disk subsystem, input/output, and file systems
  • The EROFS (Enhanced Read-Only File System), designed for use on read-only mode partitions, has been transitioned to utilize the fscache subsystem, which provides data caching. This change significantly improved the performance of systems running a large number of containers from an EROFS-based image.
  • The fscache subsystem has introduced an on-demand reading mode, which is utilized to optimize EROFS. The new mode allows for caching reads from file system images present in the local system. Unlike the originally available mode, which focused on caching data in the local file system transmitted through network file systems, the 'on-demand' mode delegates data retrieval and caching functions to a separate background process running in user space.
  • XFS now supports the storage of billions of extended attributes in an i-node. The maximum number of extents for a single file has been increased from 4 billion to 247. An atomic update mode for multiple extended file attributes has been implemented.
  • In the Btrfs file system, lock handling has been optimized, leading to a performance increase of approximately 7% for direct writes in nowait mode. The performance of operations in NOCOW (without copy-on-write) mode has improved by about 3%. The load on the page cache has been reduced when executing the 'send' command. The minimum size of subpages has been reduced from 64K to 4K (now subpages smaller than kernel pages can be used). The transition from using the radix tree to the XArrays algorithm has been carried out.
  • The NFS server has added a mode to extend the retention of the client-set lock when it stops responding to requests. The new mode allows delaying the clearing of the lock for up to one day if no other client requests a competing lock. In normal operation, the lock is cleared 90 seconds after the client stops responding.
  • In the fanotify file system event tracking subsystem, the FAN_MARK_EVICTABLE flag has been implemented, which allows disabling the pinning of target i-nodes in the cache, for example, to ignore branches without pinning their parts in the cache.
  • The FAT32 filesystem driver has been updated to support retrieving file creation time information through the statx system call, implementing a more efficient and functional variant of stat() that returns extended file information.
  • Significant optimizations have been made to the exFAT driver related to ensuring simultaneous cleaning of a group of sectors in 'dirsync' mode, instead of the sequential sector-by-sector cleanup. The optimization reduced the number of block requests, resulting in over a 73-85% increase in performance for creating a large number of directories on SD cards, depending on the cluster size.
  • The first corrective update for the ntfs3 driver has been included in the kernel. Since ntfs3 was incorporated into kernel 5.15 last October, the driver had not been updated, and contact with the developers was lost, but now the developers have resumed publishing changes. The suggested patches fix bugs leading to memory leaks and crashes, resolve issues with running xfstests, clean up unused code, and correct typos.
  • OverlayFS now supports mapping user IDs of mounted filesystems, used for associating a specific user's files on a mounted foreign partition with another user in the current system.
• Memory and system services
  • Initial support has been added for the LoongArch instruction set architecture, used in Loongson 3 5000 processors, implementing a new RISC ISA similar to MIPS and RISC-V. The LoongArch architecture is available in three variants: a trimmed 32-bit (LA32R), standard 32-bit (LA32S), and 64-bit (LA64).
  • Code supporting the a.out executable file format has been removed, which was deprecated in release 5.1. The a.out format has long been obsolete on Linux systems, and generating a.out files is no longer supported by modern toolchains in default Linux configurations. The loader for a.out files can be fully implemented in user space.
  • Support for boot options specific to the x86 architecture has been discontinued: nosep, nosmap, nosmep, noexec, and noclflush.
  • Support for the obsolete h8300 (Renesas H8/300) CPU architecture has been discontinued, as it has long been unsupported.
  • The capabilities related to responding to the detection of split locks occurring when accessing unaligned data in memory have been enhanced. This situation arises because executing an atomic instruction causes the data to cross two CPU cache lines. Such locks lead to a significant drop in performance. Previously, the kernel would issue a warning with information about the process causing the lock by default; now, the problematic process will also be slowed down to preserve the performance of the rest of the system.
  • Support for the IFS (In-Field Scan) mechanism implemented in Intel processors has been added, allowing for low-level CPU diagnostic tests capable of detecting issues not identified by standard means based on error correction codes (ECC) or parity bits. The tests are presented in the form of downloadable firmware, similar to microcode updates. The test results are available through sysfs.
  • The ability to embed a bootconfig file in the kernel has been added, allowing kernel operation parameters to be defined via a configuration file in addition to command line options. The embedding is done using the build option ‘CONFIG_BOOT_CONFIG_EMBED_FILE="/PATH/TO/BOOTCONFIG/FILE"’. Previously, bootconfig was defined by attaching it to the initrd image. Embedding in the kernel allows bootconfig to be used in configurations without initrd.
  • Support for loading firmware compressed using the Zstandard algorithm has been implemented. A set of control files /sys/class/firmware/* has been added to sysfs, enabling the initiation of firmware loading from user space.
  • In the io_uring asynchronous I/O interface, a new flag IORING_RECVSEND_POLL_FIRST has been proposed. When set, the network operation will first be processed using polling, which can save resources in situations where some delay in processing the operation is acceptable. Additionally, support for the socket() system call has been added in io_uring, along with new flags to simplify file descriptor management, a ‘multi-shot’ mode for accepting multiple connections in the accept() call, and operations to pass NVMe commands directly to the device.
  • Support for the KCSAN (Kernel Concurrency Sanitizer) debugging tool is provided for the Xtensa architecture, aimed at dynamically detecting race conditions within the kernel. Sleep mode and coprocessor support have also been added.
  • Support for the m68k (Motorola 68000) architecture has been implemented. the virtual machine (platform simulator) based on the Android Goldfish emulator.
  • Support for Armv9-A SME (Scalable Matrix Extension) extensions has been implemented for the AArch64 architecture.
  • In the eBPF subsystem, storing typed pointers in map structures is permitted, and support for dynamic pointers has also been added.
  • A new proactive memory eviction mechanism has been proposed, supporting management from user space via the memory.reclaim file. Writing a number to the specified file will attempt to evict the corresponding number of bytes from the set associated with the cgroup.
  • The accuracy of memory usage accounting has been improved when compressing data in swap space using the zswap mechanism.
  • Support for running 32-bit executables on 64-bit systems has been provided for the RISC-V architecture, a mode for binding restrict attributes to memory pages (e.g., prohibiting caching) has been added, and the kexec_file_load() function has been implemented.
  • Support for 32-bit Armv4T and Armv5 systems has been adapted for use in universal cross-platform kernel builds suitable for various ARM systems.
• Virtualization and Security
  • In the EFI subsystem, the ability to privately transmit sensitive information to guest systems without revealing it to the host system has been implemented. Data is provided through the security/coco directory in securityfs.
  • In Lockdown protection mode, which restricts the root user's access to the kernel and blocks UEFI Secure Boot bypass paths, a vulnerability that allowed bypassing protection through kernel debugger manipulation has been eliminated.
  • Patches aimed at increasing the reliability and performance of the random number generator have been included.
  • Support for the kernel structure randomization mechanism has been implemented when building with Clang 15.
  • In the Landlock mechanism, which allows limiting the interaction of a group of processes with the external environment, support for rules controlling the execution of file renaming operations has been provided.
  • The IMA (Integrity Measurement Architecture) subsystem, designed to verify the integrity of operating system components through digital signatures and hashes, has been updated to use the fs-verity module for file verification.
  • The logic of actions when disabling unprivileged access to the eBPF subsystem has been changed — previously, all commands related to the bpf() system call were disabled, but starting from version 5.19, access to commands that do not lead to object creation is retained. With this behavior, a privileged process is required to load a BPF program, but then unprivileged processes can interact with this program.
  • Support for the AMD SEV-SNP (Secure Nested Paging) extension has been added, ensuring safe operation with nested memory page tables and protecting against 'undeSErVed' and 'SEVerity' attacks on AMD EPYC processors, which can circumvent the AMD SEV (Secure Encrypted Virtualization) protection mechanism.
  • Support for the Intel TDX (Trusted Domain Extensions) mechanism has been added, which allows blocking attempts for unauthorized access to encrypted memory. of virtual machines.
  • The virtio-blk driver, used for block device emulation, has been enhanced with support for input/output using polling, which tests have shown reduces latency by approximately 10%.
• Network subsystem
  • A series of BIG TCP patches have been included, allowing an increase in the maximum TCP packet size to 4GB to optimize the performance of high-speed internal data center networks. This increase in packet size, within the 16-bit header field, is achieved through the implementation of 'jumbo' packets, where the size in the IP header is set to 0, and the actual size is transmitted in a separate 32-bit field in an attached header. Performance testing with a packet size set to 185 KB resulted in a 50% throughput increase and significantly reduced data transmission latency.
  • Work has continued on integrating tools into the network stack for tracking reasons for packet drops (reason codes). The reason code is transmitted during the memory release associated with the packet and allows accounting for situations such as packet drops due to header field fill errors, spoofing detection by the rp_filter, incorrect checksums, memory shortages, triggering of IPSec XFRM rules, incorrect TCP sequence numbers, etc.
  • Support for connection fallback from MPTCP (MultiPath TCP) to regular TCP has been added in situations where specific MPTCP features cannot be utilized. MPTCP is an extension of the TCP protocol that enables a TCP connection to deliver packets simultaneously across multiple routes through different network interfaces tied to different IP addresses. An API has been added for managing MPTCP streams from user space.
• Hardware
  • More than 420,000 lines of code related to the amdgpu driver have been added, of which about 400,000 lines are automatically generated header files containing data for ASIC registers in the AMD GPU driver, and an additional 22,500 lines provide initial support for AMD SoC21. The total size of the AMD GPU driver has exceeded 4 million lines of code. In addition to SoC21, the AMD driver includes support for SMU 13.x (System Management Unit), updated support for USB-C and GPUVM, and preparations for supporting the next generations of RDNA3 (RX 7000) and CDNA (AMD Instinct) platforms.
  • The i915 (Intel) driver has expanded capabilities related to power management. Identifiers for the Intel DG2 (Arc Alchemist) GPUs used in laptops have been added, initial support for the Intel Raptor Lake-P (RPL-P) platform has been provided, information about Arctic Sound-M graphics cards has been included, an ABI for compute engines has been implemented, support for the Tile4 format has been added for DG2 cards, and DisplayPort HDR support has been implemented for systems based on the Haswell microarchitecture.
  • In the Nouveau driver, a transition to using the drm_gem_plane_helper_prepare_fb handler has been made; static memory allocation has been applied to some structures and variables. Regarding the use of NVIDIA's open-source kernel module source code in Nouveau, the work is currently focused on identifying and fixing bugs. In the future, the published firmware is planned to be used to enhance driver performance.
  • A driver for the NVMe controller used in Apple computers based on the M1 chip has been added.

At the same time, the Latin American Free Software Foundation has formed a fully free kernel variant 5.19 — Linux-libre 5.19-gnu, cleaned of firmware and driver elements containing non-free components or code sections restricted by the manufacturer. The new release includes a cleanup of drivers for pureLiFi X/XL/XC and TI AMx3 Wkup-M3 IPC. The blob cleanup code has been updated in the drivers and subsystems for Silicon Labs WFX, AMD amdgpu, Qualcomm WCNSS Peripheral Image Loader, Realtek Bluetooth, Mellanox Spectrum, Marvell WiFi-Ex, Intel AVS, IFS, and pu3-imgu drivers. Support for Qualcomm AArch64 device tree files has been implemented. A new naming scheme for Sound Open Firmware components has been added. The cleanup of the ATM Ambassador driver, which has been removed from the kernel, has been discontinued. Control of blob cleanup in HDCP and Mellanox Core has been moved to separate kconfig tags.

Source: opennet.ru