Release of Linux Kernel 6.10

After two months of development, Linus Torvalds has introduced the release of Linux Kernel 6.10. Among the most notable changes are: ntsync driver with synchronization primitives for Windows NT, DRM Panic components to implement an equivalent of the 'blue screen of death', dropping support for old Alpha CPUs, the ability to verify the integrity in FUSE-based file systems, restricting access to ioctl through the Landlock mechanism, a subsystem for profiling memory allocation operations, the mseal() system call, enabling encrypted data exchange with TPM devices, support for high-priority job queues in dm-crypt, and the panthor driver for the tenth generation of Mali GPUs.

The new version includes 14,564 fixes from 1,989 developers, with a patch size of 41 MB (changes affected 12,509 files, adding 547,663 lines of code, and deleting 312,464 lines). In the previous release, there were 15,680 fixes from 2,106 developers, with a patch size of 54 MB. About 41% of all changes in 6.10 are related to device drivers, approximately 15% pertain to updates of architecture-specific code, 13% relate to the networking stack, 5% involve file systems, and 4% concern internal kernel subsystems.

Key innovations in kernel 6.10:

• Disk subsystem, input/output, and file systems
  • A new fcntl operation, F_DUPFD_QUERY, has been added, allowing a process to determine that two different file descriptors refer to the same file. Unlike similar capabilities provided by the kcmp() system call, F_DUPFD_QUERY does not expose unnecessary information and works on systems with kcmp disabled.
  • In the FUSE subsystem, used to implement file systems in user space, it is now possible to apply the fs-verity mechanism for checking the integrity and authenticity of files.
  • In the dm-crypt module, used for encrypting block devices, a 'high_priority' option has been added, allowing for the use of high-priority job queues to enhance performance on powerful systems. servers. By default, this mode is off, as it can lead to increased latencies on regular PCs for tasks not related to encryption, such as audio processing.
  • A netlink-based protocol for managing NFS servers has been added to the kernel. A utility called nfsdctl has been developed in user space based on this protocol. Support for mounting NFS v2 is disabled by default (support for NFS v2 in the mount.nfs utility was discontinued back in 2021).
  • Work continues in the XFS file system on implementing the fsck utility for checking and fixing detected issues in online mode, without unmounting the file system. An ioctl, XFS_IOC_EXCHANGE_RANGE, has been added for exchanging byte ranges between two files atomically.
  • Btrfs has implemented support for shrinking unpinned extent maps, which can be useful for reducing memory consumption under low memory conditions. The data compression code and the put_file_data() function have been transitioned to use memory page folios. The extent locking mechanism has been reworked during write-back operations.
  • In the Ext4 file system, support for ioctl FS_IOC_GETFSSYSFSPATH has been added to determine the location of a specified mounted FS in the /sys/fs hierarchy.
  • The OPENPROMFS, ISOFS, QNX6, NILFS2, MINIX, and FREEVXFS file systems have been transitioned to use the new partition mounting API.
  • In the EROFS (Extendable Read-Only File System), designed for use on read-only accessible partitions, support for the Zstandard compression algorithm has been added.
  • In Bcachefs, preparations have been made to perform fsck without unmounting the partition (online check). Changes and fixes have been added to enhance operational reliability. The ability to update and revert the FS format in 'nochanges' mode, which disables writing and keeps metadata only in memory, has been implemented.
  • Support for creating temporary files using the O_TMPFILE option has been added to OverlayFS.
  • Support for the block device bandwidth limiting mechanism 'CONFIG_BLK_DEV_THROTTLING_LOW' has been discontinued. This mechanism, which has remained experimental since 2017, has not gained practical use and complicates the maintenance of the block device subsystem.
• Memory and system services
  • Added but disabled at compilation, the ntsync driver implements the character device /dev/ntsync and a set of primitives for synchronization used in the Windows NT kernel. Implementing such primitives at the kernel level significantly boosts the performance of Windows games running through Wine. The performance gain is achieved by eliminating the overhead associated with using RPC in user space. The creation of a separate driver for the Linux kernel is due to the complexity of correctly implementing the NT synchronization API on top of existing primitives in the kernel.
  • A subsystem for profiling memory allocation operations in the Linux kernel has been added, allowing the detection of memory leaks in the kernel and simplifying memory consumption optimizations. The subsystem provides low overhead, making it suitable for use not only in debugging kernel builds but also in production systems.
  • An initial implementation of the DRM Panic handler in the kernel has been added, utilizing the Direct Rendering Manager (DRM) subsystem to display a visual colored report similar to a 'blue screen of death.' The next release is expected to include the ability to display a logo and QR code on the screen when a crash occurs.
  • Continued the transition of changes from the Rust-for-Linux branch related to the use of the Rust language as a secondary language for developing drivers and kernel modules (Rust support is not enabled by default and does not make Rust a required build dependency for the kernel). Migration to Rust version 1.78 has been completed, allowing the switch to the standard alloc library instead of a custom fork. Abstractions for working with time in the kernel have been added (wrapping over the ktime_t structure). Support for using kernel components written in Rust on RISC-V architecture systems has also been added.
  • BPF programs have implemented the ability to use wait queues in the kernel. Functions bpf_preempt_disable and bpf_preempt_enable have been added, allowing the creation of non-preemptible sections of code by the task scheduler. BPF programs now have access to the kernel's cryptographic functions. Support for JIT compilation of BPF programs on 32-bit ARCv2 processor systems has been implemented.
  • Support for kernel building with the Clang compiler in CFI (Control Flow Integrity) mode has been implemented for 32-bit ARM systems, blocking violations of normal execution order due to exploits that alter stored function pointers in memory.
  • The ability to directly reflect ring buffer traces through mmap() to pass their contents to user space without additional copying has been added.
  • A system call 'mseal' has been added, allowing processes to impose a lock on modifications to certain parts of their address space. In practice, this new system call is planned to be used in the Chrome browser to enhance sandbox isolation.
  • For the x32 subarchitecture, which provides a hybrid x86_64 ABI allowing the use of a 32-bit memory addressing model on 64-bit systems (the processor operates in 64-bit mode but uses 32-bit pointers and arithmetic operations), support for the Shadow Stack mechanism has been added. This mechanism helps block many exploits by utilizing Intel processors' hardware capabilities to protect against overwriting the return address from a function in case of a stack buffer overflow.
  • On ARM64 architecture systems, the userfaultfd() system call, which allows the creation of handlers for page faults in user space, has been enhanced with features related to writing protection for memory regions and elements of the page table.
  • The code to support Alpha 21164 (EV5) processors and earlier series released since 1995 has been removed. Maintaining the code for these processors became complicated due to their lack of byte-level memory access. Alpha was the first architecture to have the Linux kernel ported, which was initially available only for x86 systems.
• Virtualization and Security
  • Support for encrypted data exchange with TPM (Trusted Platform Module) devices and transaction integrity verification has been added.
  • The Landlock LSM module, which restricts the interaction of a group of processes with the external environment, has been enhanced with the ability to apply rules to limit access to ioctl() calls.
  • An option init_mlocked_on_free has been proposed at boot time that ensures the memory content, protected from being swapped out by calling mlock(), is zeroed if that memory is freed without being unlocked by calling munlock(). Using this option helps prevent cryptographic keys from persisting in memory in case of an emergency termination of the application handling them.
  • The crypto subsystem has accelerated the performance of disk encryption operations using the AES-XTS algorithm on x86_64 systems with Intel and AMD processors that support VAES, AVX2, VPCLMULQDQ, AVX10, or AVX512 extensions.
  • The ability to collect statistics on the usage of the kernel cryptosubsystem (CONFIG_CRYPTO_STATS) has been removed. This feature was not practically used and led to a significant reduction in performance as well as creating noticeable additional load on maintainers.
• Network subsystem
  • The performance of data sending operations in zero-copy mode using the io_uring subsystem has been significantly improved. The ability to bundle multiple buffers for sending and receiving operations has been added.
  • The garbage collection code used when sending file descriptors over Unix sockets using SCM_RIGHTS messages has been rewritten. This change resolves the issue of accumulating cyclic reference counters.
  • The ability to set filters for the PFCP (Packet Forwarding Control Protocol) used in 4G and 5G networks has been added.
  • Support has been added for the network socket option SO_PEEK_OFF, which, similar to the corresponding option for Unix sockets, allows determining the offset of data in the queue used by the recv system call when the MSG_PEEK flag is specified (marks the data as unread and it will be delivered again on the next recv call).
  • Support for the operation IORING_CQE_F_SOCK_NONEMPTY has been added to the io_uring subsystem, allowing the detection of pending connection requests on a network socket.
  • An implementation of PoE (Power over Ethernet) technology has been proposed, based on previously available code for supporting PoDL (Power over Data Line) and compatible with Microchip PD692x0 and TI TPS23881 PoE controllers.
  • Support for the rstreason mechanism has been added for TCP, DCCP, and MPTC protocols, allowing the determination of the reason for sending RST packets (e.g., NO_SOCKET).
• Hardware
  • The panthor driver for the tenth generation Mali GPU (G310, G510, G710) has been included, utilizing the CSF (Command Stream Frontend) technology that offloads certain driver functions to the firmware to reduce CPU load and offers a new model of task execution organization on the GPU. Changes for supporting the new driver have also been accepted in Mesa and included in the Gallium panfrost driver for Mali GPUs.
  • PCI identifiers for new Intel Arc (DG2/Alchemist) discrete graphics cards have been added to the i915 driver.
  • Work on the Xe drm driver (Direct Rendering Manager) for GPUs based on the Intel Xe architecture, used in Intel Arc graphics cards and integrated graphics starting from Tiger Lake processors, has continued. Support for Arrow Lake H CPUs has been added. The implementation of support for Lunar Lake processors has continued. Initial support for the SR-IOV (Single Root I/O Virtualization) mechanism has been added.
  • Support for SMU 14.0 (System Management Unit) has been added in the AMDGPU driver. The ability to use new AMD GPUs on RISC-V architecture systems has been introduced.
  • A driver for the Tegra Security Engine cryptographic operation accelerator has been added, which can be used to accelerate AES and various hashing algorithms.
  • Support has been added for the following display panels: LG SW43408, Innolux G121XCE-L01 LVDS, RK3326 GameForce Chi, Crystal Clear CMT430B19N00, POWERTIP PH128800T006-ZHC01, Startek KD050HDFIA020-C020A, Pixel 3a, Khadas TS050 V2, Raydium RM69380, BOE NT116WHM-N44, CMN N116BCA-EA1, and AUO B120XAN01.0.
  • Support has been added for the audio subsystem of Lenovo Thinkbook 13x Gen 4, Lenovo Thinkbook 16P Gen 5, Lenovo Thinkbook 13X, and ASUS Zenbook 2024 HN7306W. Support has also been added for external sound cards Vocaster One and Vocaster Two. A driver for NAU8325 amplifiers from Nuvoton Technology has been added.
  • The HID-Steam driver has added support for the IMU (Inertial Measurement Unit) of the Steam Deck game controller, allowing access to gyroscope and accelerometer data via a separate evdev node.
  • Changes have been included to support the ARM SoC Snapdragon X Elite, which features its own 12-core Qualcomm Oryon CPU and Qualcomm Adreno GPU. The chip is aimed at use in laptops and PCs and outperforms many tests against Apple M3 and Intel Core Ultra 155H chips.
  • Support has been added for ARM platforms, SoCs, and devices: PocketBook 614 Plus, Sony Xperia Z3, Xperia 1 V, Samsung Galaxy S5 China, Motorola Moto G, RK3326 GameForce Chi, Anbernic RG35XX (Plus/H/2024), Airoha EN7581, Radxa ROCK 3C, ArmSom Sige7, Tanix TX1, Toradex Colibri iMX8DX, Renesas RZ/V2H, Forlinx OK3588-C, Protonic MECSBC, NXP S32G3, Wolfvision pf5, Amlogic A4/A5, ASUS RT-AC3200, ASUS RT-AC5300, ASrock E3C256D4I, IBM system1 BMC, Meta Harma BMC(AST2600), ASRock X570D4U BMC, Au-Zone Maivin AI Vision Starter Kit.
  • Support has been added for Milk-V Mars boards using the Starfive JH7110 SoC based on the RISC-V architecture.

At the same time, the Latin American Free Software Foundation has created a fully free kernel variant 6.10 — Linux-libre 6.10-gnu, cleaned of firmware and driver elements containing non-free components or code segments limited by manufacturers. The 6.10 release updates the blob cleaning code in Intel i915, rtl8xxxu, qla2xxx, and QCAI sahara drivers. Blob names have been cleaned in dts files (device tree) for the Aarch64 architecture. New files added in Adreno, Intel IPU3, and PRUEth drivers have been cleaned of blobs. New drivers Panthor, Intel IPU6, PRUEth SR1, rtw8703b, tps23881, air_en8811h, Intel ISH HID, and pcm6240 have undergone cleaning. The cleaning of the Prism2.5/3 USB driver has been discontinued as it has been removed from the kernel.

Source: opennet.ru