After two months of development, Linus Torvalds announced the release of the kernel Among the most notable changes are: integration of the WireGuard VPN interface, support for USB4, namespace for time, the ability to create TCP overload handlers using BPF, initial support for MultiPath TCP, resolution of the year 2038 problem in the kernel, the 'bootconfig' mechanism, and the ZoneFS file system.
The new version has accepted 13,702 fixes from 1,810 developers.
The patch size is 40 MB (changes affected 11,577 files, with 610,012 lines of code added,
and 294,828 lines removed). About 45% of the changes presented in 5.6
are related to device drivers, approximately 15% of the changes pertain
are related to hardware architecture-specific code updates, 12%
are related to the network stack, 4% are related to file systems, and 3% are related to internal
kernel subsystems.
:
- Network subsystem
- implementation of the VPN interface , which is based on modern encryption methods (ChaCha20, Poly1305, Curve25519, BLAKE2s), is easy to use, free from complications, has proven itself in several large deployments, and delivers very high performance (3.9 times faster than OpenVPN in terms of throughput). WireGuard employs a concept of key-based routing, where a private key is tied to each network interface and is used for binding public keys. The exchange of public keys for establishing a connection is analogous to SSH. The cryptographic primitives necessary for the operation of WireGuard from the library into the default Crypto API and into the kernel .
- include integration of components necessary to support MPTCP (MultiPath TCP), an extension of the TCP protocol for establishing TCP connections that deliver packets simultaneously over multiple routes through different network interfaces linked to different IP addresses. For network applications, such an aggregated connection appears as a regular TCP connection, while the logic of stream splitting is handled by MPTCP. Multipath TCP can be used to both increase bandwidth and enhance reliability. For example, MPTCP can be employed to facilitate data transfer on a smartphone using both WiFi and 4G links simultaneously, or to reduce costs by connecting to a server using multiple cheaper links instead of a single more expensive one.
- support for the sch_ets network queue management discipline (, IEEE 802.1Qaz), providing the ability to distribute bandwidth among different traffic classes. If the load on a specific traffic class is below the provided bandwidth, ETS allows other traffic classes to use the available (unused) bandwidth. The Qdisc sch_ets is configured as a PRIO discipline and uses traffic classes to define strict and shared bandwidth limits. ETS operates as a combination of disciplines and — with strictly limited traffic classes, PRIO is used, but if there is no traffic in the queue, it operates as DRR.
- A new type of BPF program has been added , allowing the implementation of kernel function handlers via BPF. This capability can currently be used to implement TCP congestion control algorithms in the form of BPF programs. For example, BPF program implementing the algorithm .
- The following have been accepted into the kernel , translating the tools from ioctl() to the use of . The new interface simplifies the addition of extensions, improves error handling, allows notifications when state changes occur, facilitates interaction between the kernel and user space, and reduces the number of synchronized named lists.
- An implementation of the FQ-PIE (Flow Queue PIE) queue management algorithm has been added, aimed at reducing the negative impact of packet buffering on border network equipment (bufferbloat). FQ-PIE demonstrates high efficiency when used in systems with cable modems.
- Disk subsystem, input/output, and file systems
- For the Btrfs filesystem an asynchronous implementation of the DISCARD operation (marking freed blocks that can no longer be physically stored) has been introduced. Initially, DISCARD operations were performed synchronously, which could lead to performance drops due to waiting for the corresponding commands to complete from the storage devices. The asynchronous implementation allows not to wait for the completion of DISCARD by the storage device and to perform this operation in the background.
- In XFS Code cleanup involving outdated 32-bit time counters (type time_t replaced with time64_t), leading to the 2038 problem. Memory errors and corruption that appeared on 32-bit platforms have been resolved. Code has been redesigned to work with extended attributes.
- In the ext4 file system performance optimizations related to inode lock handling during read and write operations. Enhanced rewrite performance in direct I/O mode. For easier issue diagnosis, the first and last error codes are preserved in the superblock.
- In the F2FS file system the ability to store data in a compressed form. Compression for an individual file or directory can be enabled using the command 'chattr +c file' or 'chattr +c dir; touch dir/file'. To compress an entire partition, the option '-o compress_extension=ext' can be used in the mount utility.
- The kernel now includes the file system , which simplifies low-level operations with zoned storage devices. Zoned storage devices refer to hard disk or NVMe SSD devices where storage space is divided into zones that consist of groups of blocks or sectors, where only sequential data addition is allowed, updating the entire group of blocks. The ZoneFS file system was developed by Western Digital and links each zone in the storage with a separate file that can be used to store data in raw mode without manipulation at the block or sector level, enabling applications to use the file API instead of direct block device access via ioctl.
- In NFS, mounting partitions over UDP is disabled by default. Support has been added for the direct file copying feature between servers defined in the NFS 4.2 specification. A new mount option 'softreval' has been added, which allows using cached attribute values in the event of server failure. For example, with this option specified, after a server becomes unavailable, it remains possible to navigate paths in the NFS partition and access information that has been cached.
- Optimization of the fs-verity performance mechanism used for integrity control and authenticity verification of individual files. Sequential read speed has increased thanks to the implementation of a Merkle hash tree. The performance of FS_IOC_ENABLE_VERITY has been optimized under conditions of missing cache data (using proactive page reading).
- Virtualization and Security
- The ability to disable the SELinux module during operation is deprecated, and in the future, unloading an already activated SELinux will be prohibited. To disable SELinux, it will be necessary to pass the parameter 'selinux=0' in the kernel command line.
- Support for time namespaces, which allow binding the state of system clocks (CLOCK_REALTIME,
CLOCK_MONOTONIC, CLOCK_BOOTTIME) to a container, enabling it to use its own time and ensuring the invariance of CLOCK_MONOTONIC and CLOCK_BOOTTIME readings when migrating the container to another host (considering the time after booting with or without accounting for sleeping time). - The blocking pool /dev/random has been removed. The behavior of /dev/random has been made closer to /dev/urandom in terms of preventing entropy blocking after pool initialization.
- A driver has been included in the main kernel that allows guest systems running under VirtualBox to mount directories exported by the host environment (VirtualBox Shared Folder).
- A set of patches has been added to the BPF subsystem (), under the use of the Retpoline mechanism to protect against Spectre V2 class attacks, allowing for increased efficiency in calling BPF programs when associated events occur (for example, enhancing the call speed of XDP handlers upon receiving a network packet).
- A driver has been added to support TEE (Trusted Execution Environment) environments embedded in AMD APU.
- Memory and system services
- Support for global functions has been added to the BPF. Development is underway as part of the initiative to add support for function libraries that can be incorporated into BPF programs. The next step will be the support of dynamic extensions allowing the loading of global functions, including the replacement of existing global functions during their usage. The BPF subsystem has also added support for a map operation variant (used for storing persistent data) capable of executing in batch mode.
- The device 'cpu_cooling' allows cooling an overheated CPU by putting it into an idle state for short periods.
- A system call has been added , offering a set of additional flags to restrict path resolution (prohibit crossing mount points, symbolic links, magic links (/proc/PID/fd), components '..').
- For heterogeneous systems based on the big.LITTLE architecture, which combine powerful and less performance-efficient energy-saving CPU cores on one chip, the uclamp_min parameter is ensured in real-time task execution ( in kernel 5.3, the load pinning mechanism). This parameter guarantees that the scheduler will place the task on a CPU core with sufficient performance.
- The kernel is free from . The last remaining handlers have been replaced, where a 32-bit (signed int) time_t type was used for the epoch time counter, which is expected to overflow in 2038 based on the report from 1970.
- The improvement of the asynchronous input/output interface has continued , arguing that the ruling discriminates against providers and violates with support for new operations: IORING_OP_FALLOCATE (reserving empty regions), IORING_OP_OPENAT,
IORING_OP_OPENAT2,
IORING_OP_CLOSE (opening and closing files),
IORING_OP_FILES_UPDATE (adding and removing files from the fast-access list),
IORING_OP_STATX (requesting file information),
IORING_OP_READ,
IORING_OP_WRITE (simplified analogs of IORING_OP_READV and IORING_OP_WRITEV),
IORING_OP_FADVISE,
IORING_OP_MADVISE (asynchronous variants of posix_fadvise and madvise calls), IORING_OP_SEND,
IORING_OP_RECV (sending and receiving network data),
IORING_OP_EPOLL_CTL (performing operations on epoll file descriptors). - A system call has been added , allowing a process to extract a file descriptor of an open file from another process.
- The 'bootconfig' mechanism allows defining kernel operation parameters through a configuration file in addition to command line options. A utility called bootconfig has been proposed to add such files to the initramfs image. This capability can be used, for example, to configure kprobes during boot.
- The mechanism for waiting to read and write data in unnamed channels (pipe) has been improved. This change accelerated the execution of tasks such as parallel assembly of large projects. However, optimization may lead to a race condition in GNU make due to a bug in release 4.2.1, which has been fixed in version 4.3.
- A flag PR_SET_IO_FLUSHER has been added to prctl(), which can be used to mark processes involved in releasing memory, for which limitations should not be applied in low-memory situations.
- Based on the memory distribution system used in Android, the ION subsystem has been implemented. , allowing for the management of DMA-buffer allocations for sharing memory areas by drivers, applications, and various subsystems.
- Hardware architectures
- Support for the E0PD extension, introduced in ARMv8.5, has been added, allowing for protection against attacks related to speculative execution of instructions in CPUs. Protection based on E0PD incurs lower overhead than KPTI (Kernel Page Table Isolation).
- For systems based on the ARMv8.5 architecture, support for the RNG instruction has been added, providing access to a hardware pseudorandom number generator. In the kernel, the RNG instruction is utilized to generate entropy when initializing the pseudorandom number generator provided by the kernel.
- Support for MPX (Memory Protection Extensions) has been removed from the kernel, which allowed for pointer boundary checking. This technology was not widely adopted in compilers and has been removed from GCC. Support for the KASan (Kernel Address Sanitizer) debugging tool has been implemented for the RISC-V architecture, facilitating the detection of memory-related errors.
- Support for the specification
- Hardware
- USB 4.0 Thunderbolt Type-C connector. , including PCIe, Display Port and USB 3.x, as well as software implementations of protocols, for example, to organize network links between hosts. The implementation is based on the existing Linux kernel driver for Thunderbolt and adapts it for use with hosts and devices compatible with USB4. Changes also add support for Thunderbolt 3 devices in the software implementation of the Connection Manager, which is responsible for creating tunnels to connect multiple devices through a single port.
- In the amdgpu driver , initial support for HDCP 2.x (High-bandwidth Digital Content Protection) technology. Support for the AMD Pollock ASIC chip based on Raven 2 has been added. The ability to reset the GPU has been implemented for the Renoir and Navi families.
- In the Intel graphics card DRM driver , support for DSI VDSC for chips based on the Ice Lake and Tiger Lake microarchitectures has been added, implemented LMEM mmap (device local memory), improved VBT (Video BIOS Table) parsing, and support for HDCP 2.2 for Coffee Lake chips has been realized.
- Work continues to unify the amdkfd driver code (for discrete GPUs such as Fiji, Tonga, Polaris) with the amdgpu driver.
- The k10temp driver has been redesigned to provide support for voltage and current output parameters for AMD Zen CPUs, as well as extended information from temperature sensors used in Zen and Zen 2 CPUs.
- In the nouveau driver , support for verified firmware loading mode for NVIDIA GPUs based on the Turing microarchitecture (GeForce RTX 2000) has been implemented, allowing support for 3D acceleration for these cards (official firmware with NVIDIA digital signature is required). Support for the TU10x graphics engine has been added. Issues with HD Audio have been resolved.
- Support for data compression during transmission via DisplayPort MST (Multi-Stream Transport) has been added.
- A new driver "" for Qualcomm wireless chips with 802.11ax support has been added.
The driver is based on the mac80211 stack and supports access point, workstation, and mesh node modes. - Accessible readable metrics from temperature sensors used in modern hard drives and SSDs have been provided through sysfs.
- Significant changes to the ALSA sound system are aimed at removing code from (moving away from the use of 32-bit type time_t in the interfaces snd_pcm_mmap_status and snd_pcm_mmap_control). New sound codecs supported include
Qualcomm WCD9340/WCD9341, Realtek RT700, RT711, RT715, RT1308, Ingenic JZ4770. - drivers for LCD panels Logic PD 28, Jimax8729d MIPI-DSI, igenic JZ4770, Sony acx424AKP, Leadtek LTK500HD1829, Xinpeng XPP055C272, AUO B116XAK01, GiantPlus GPM940B0,
BOE NV140FHM-N49,
Satoz SAT050AT40H12R2,
Sharp LS020B1DD01D. - support for ARM platforms and Gen1 Amazon Echo platforms (OMAP3630-based), Samsung Galaxy S III mini (GT-I8190), Allwinner Emlid Neutis, Libre Computer ALL-H3-IT, PineH64 Model B, Aibretech Amlogic GX PC,
Armada SolidRun Clearfog GTR, NXPGateworks GW59xx,
Tolino Shine 3 eBook reader,
Embedded Artists COM (i.MX7ULP), SolidRun Clearfog CX/ITX and HoneyComb (LX2160A), Google Coral Edge TPU (i.MX8MQ),
Rockchip Radxa Dalang Carrier, Radxa Rock Pi N10, VMARC RK3399Pro SOM
ST Ericsson HREF520, Inforce 6640, SC7180 IDP, Atmel/Microchip AM9X60 (ARM926 SoC, Kizboxmini), ST stm32mp15, AM3703/AM3715/DM3725, ST Ericsson ab8505, Unisoc SC9863A, Qualcomm SC7180. Added support for the PCIe controller used in Raspberry Pi 4.
At the same time, the Latin American Free Software Foundation
variant — , cleaned of firmware and driver elements containing non-free components or code sections whose use is restricted by the manufacturer. In this new release, blob loading in drivers for AMD TEE, ATH11K, and Mediatek SCP has been disabled. The blob cleaning code in the AMD PSP, amdgpu, and nouveau drivers and subsystems has been updated.
Source: opennet.ru
