Release of Linux kernel 6.8

After two months of development, Linus Torvalds has released the Linux 6.8 kernel. Among the most notable changes are: the Xe driver for Intel GPUs, protection mode for block devices with mounted file systems, the Deadline server task scheduler, automatic optimization for merging identical memory pages, the first driver written in Rust, system calls listmount and statmount, removal of bpfilter and SLAB, the guest_memfd mechanism in KVM, and data access profiling.

The new version includes 15,641 fixes from 2,018 developers, with a patch size of 44 MB (the changes affected 12,212 files, adding 663,864 lines of code and removing 339,094 lines). In the previous release, there were 18,405 fixes from 2,066 developers, with a patch size of 72 MB. About 42% of all changes presented in 6.8 are related to device drivers, roughly 15% pertain to updates of hardware architecture-specific code, 14% relate to the networking stack, 6% to file systems, and 3% to internal kernel subsystems.

The Git repository for kernel 6.8 contains 9.996 million objects, indicating that the next kernel, 6.9, will surpass the milestone of 10 million git objects. Previously, changes in branch numbers 3.x and 4.x correlated well with the number of git objects in the repository — kernel 3.0 was released when there were about 2 million objects in the repository, and kernel 4.0 had 4 million objects. However, in 2019, the release of 5.0 broke this logical pattern, as the repository contained about 6.5 million git objects during its formation.

Key innovations in kernel 6.8 include:

• Disk subsystem, input/output, and file systems
  • A blocking mode for direct writes on block devices with mounted file systems has been added (once enabled, the root user will not be able to make changes to the file system through block device manipulations). By default, the mode is disabled and requires specifying the BLK_DEV_WRITE_MOUNTED parameter during compilation. Blocking currently does not work for partitions with Btrfs, as the necessary changes have not yet been accepted into the Btrfs code.
  • New system calls listmount() and statmount() have been added, allowing detailed information about mounted file systems to be obtained from user space.
  • In the XFS file system, work has continued on implementing the ability to use the fsck utility for checking and fixing identified problems in online mode, without unmounting the file system.
  • In Ext4, for blocks smaller than the memory page size, the dioread_nolock call has been implemented to enhance performance by eliminating unnecessary locks. Some functions have been converted to use memory page folios.
  • Btrfs has introduced support for the mount flag "nospace_cache" to disable the cache of free blocks. Some functions have been transitioned to the use of memory page folios.
  • In the EROFS (Extendable Read-Only File System) designed for use on read-only partitions, support for subpage compression has been added alongside improved performance in low-memory conditions.
  • The F2FS file system has improved support for zoned storage devices (dividing into zones of block groups or sectors where only sequential data additions are allowed with complete updates of the entire block group).
  • For the SMB FS, the capability to create block and character device files has been implemented.
  • Bcachefs has added partial support for checking and restoring the integrity of mounted file systems.
  • Support for handlers MD_LINEAR, MD_MULTIPATH, and MD_FAULTY has been deprecated in the device-mapper subsystem as of 2021.
• Memory and system services
  • The Zswap subsystem has introduced a feature that activates when memory is low, allowing for the forced eviction of 'cold' pages to the actual swap partition that have not been accessed and are likely to remain unused. Zswap caches pages evicted to the swap partition in memory in a compressed form as much as possible without dropping them into the actual uncompressed swap partition on disk. The changes made during low memory enable a reduction in the size of the Zswap pool stored in RAM and free up memory for the system.
  • A new mode has been proposed for Zswap that completely disables delayed writeback to the actual swap partition if a write attempt fails and does not drop already existing pages in the Zswap pool to the swap partition.
  • The task scheduler has been enhanced with the SCHED_DEADLINE server mechanism, which addresses the issue of normal tasks not receiving CPU resources when high-priority (realtime) tasks monopolize the CPU. Previously, the kernel utilized a Realtime throttling mechanism to reserve 5% for low-priority tasks, leaving 95% of the time for realtime tasks. This mechanism was less than optimal as normal tasks often struggled to receive adequate CPU time. The SCHED_DEADLINE server implements a more effective resource reservation mechanism.
  • The DAMON (Data Access MONitor) subsystem has been enhanced to monitor process access to data in RAM (for instance, it can indicate which memory areas a process accessed and which areas remained unused) with an automatic adjustment mechanism for memory consumption aggression based on specified quotas.
  • Support for multi-size Transparent Huge Pages (mTHP) has been added, enabling memory allocation in blocks larger than the base page but smaller than traditional THP pages.
  • Support for large folios (page folios, aggregated memory pages) for anonymous memory (not tied to the filesystem, such as memory allocated via malloc) has been added. This change aims to enhance performance by allocating larger chunks of memory when addressing unallocated memory pages (page faults). For example, the use of large folios has resulted in a 5% reduction in kernel rebuild time (with a 40% reduction in time spent at the kernel level).
  • A parameter TRANSPARENT_HUGEPAGE_NEVER has been added to the kernel configuration file, allowing the disabling of Transparent Huge Pages.
  • The userfaultfd() system call, which enables the creation of handlers for unallocated memory page accesses (page faults) in user space, has been enhanced with the UFFDIO_MOVE operation, allowing memory pages to be moved in virtual address space during heap compaction without performing a memory page allocation operation. In tests conducted, the use of UFFDIO_MOVE reduced packing time by 40% compared to the UFFDIO_COPY operation.
  • The "KSM advisor" mechanism has been added, allowing for the automatic optimization of the parameters of the subsystem for merging identical pages of memory (KSM - Kernel Samepage Merging).
  • Work continues on transferring changes from the Rust-for-Linux branch related to the use of the Rust language as a second language for developing kernel drivers and modules (Rust support is not enabled by default and does not include Rust in the mandatory build dependencies for the kernel). The new version includes changes that add a Rust wrapper above the abstraction level of phylib, utilizing this wrapper is the ax88796b_rust driver, providing support for the PHY interface of the Asix AX88772A Ethernet controller (100MBit). Functionally, the Rust driver is fully equivalent to the old ax88796b driver written in C and can be used with X-Surf 100 network cards equipped with the AX88796B chip. For the LoongArch architecture, there is the possibility to write modules in Rust. The transition to using Rust release 1.74.1 has been made.
  • The BPF token mechanism has been added, allowing selective delegation of the handling of certain BPF capabilities, such as loading a BPF program or creating a BPF map, to unprivileged processes in user space, whose authenticity is confirmed by a special token.
  • The functionality of the BPF program verifier has been expanded.
  • The perf utility has added support for data profiling, allowing tracking of reads and writes to data structures, for example, to identify the most actively modified fields in structures. On systems with processors that support memory operation tracking (Intel, AMD, ARM), the command “perf mem record” should be used for accumulating statistics, and for outputting a report on accesses to data structures — “perf annotate —data-type”.
  • Performance optimization of system call processing on the s390 (IBM Z) architecture has been carried out, resulting in an approximately 11% speedup in system call entry in tests.
  • The ability to change the size of tracing buffers used for buffering trace event information sent to user space has been provided.
  • The previously announced deprecated SLAB memory allocation mechanism has been removed; now only the SLUB allocator is used in the kernel. The reason cited includes maintenance issues, code problems, and functional duplication with the more advanced SLUB allocator.
  • The kernel build includes the flag '-Wmissing-prototypes', which generates warnings for calls to global functions that lack prototype definitions.
  • For the RISC-V architecture on systems supporting the SUSP extension, support has been implemented for entering a sleeping mode while preserving the state in RAM. A system call, riscv_hwprobe(), has been provided to obtain information about supported extensions of the RISC-V instruction set architecture.
• Virtualization and Security
  • New system calls lsm_list_modules(), lsm_get_self_attr(), and lsm_set_self_attr() have been added for displaying a list of loaded Linux Security Modules (LSM) and for getting/setting attributes of an LSM module. A new structure, lsm_ctx, has been introduced for communication within the LSM context between user space and the kernel.
  • The AppArmor subsystem has been transitioned to use the SHA-256 algorithm for rule verification instead of SHA-1 hashes.
  • The implementation of the strlcpy() function has been removed from the kernel; it was included in the Glibc 3.38 library last summer. Strlcpy is an alternative to strncpy(), providing protection against buffer overflow and guaranteeing a null byte at the end of the string.
  • In the hypervisor KVM Support for the guest_memfd (guest-first memory) subsystem has been added, offering memory management functions that enable capabilities and optimizations unattainable with the general memory management subsystem. For instance, guest_memfd allows allocating and reflecting a memory area to the guest system that is unreachable for the host environment, which can be used for organizing confidential computing.
  • Support for the LAM (Linear Address Masking) mode provided in Intel processors has been enabled for guest systems running under the KVM hypervisor, allowing the use of a portion of the bits in 64-bit pointers (from bits 57 to 62) to store metadata unrelated to addressing.
  • The KVM hypervisor for ARM64 architecture systems has added support for 52-bit (LPA2) physical addresses. For x86 architecture systems, there is now an option to compile without emulating Hyper-V hypercalls, which reduces the kernel size.
  • An iaa driver (IAA Compression Accelerator) has been added to speed up data compression and decompression operations using the DEFLATE method, leveraging the capabilities of Intel Analytics Accelerator (IAA) cryptographic accelerators.
  • On the host environment side, support for the Intel TDX (Trusted Domain Extensions) mechanism has been implemented, allowing the creation of secure guest environments with memory encryption when using the KVM hypervisor. of virtual machines.
  • A SID identifier "init" has been added to SELinux, allowing the identification of processes started during the boot phase before SELinux policies are applied. The interface /sys/fs/selinux for managing SELinux has been improved.
• Network subsystem
  • A low-level reorganization of the fundamental networking data structures has been performed to enhance caching efficiency. Previously, fields in the networking stack structures socks, netdev, netns, and mibs were arranged in a manner that limited CPU cache usage. The revision of variable placements in the structures has led to a significant increase in TCP performance by minimizing cache line usage during data transmission and optimizing variable access. In scenarios handling numerous parallel TCP connections, performance improvements can reach up to 40%.
  • The bpfilter subsystem, which used BPF for packet filtering, has been removed. Bpfilter was introduced starting with release 4.18 but was never brought to a usable state. In recent years, bpfilter code in the kernel has not been developed, with continued development carried out by Facebook in a separate repository.
• Hardware
  • The new DRM driver (Direct Rendering Manager) for GPUs based on Intel Xe architecture is included, which is used in Intel Arc graphics cards and integrated graphics starting with Tiger Lake processors. The Xe driver is positioned as the foundation for supporting new chips, independent of legacy platform support code. It is built with a new architecture that more actively utilizes existing components of the DRM subsystem, as well as standard components from the i915 driver that are not tied to specific GPUs, such as code for screen interaction, memory model, and execbuf implementation. In Mesa, OpenGL and Vulkan support over the Xe driver is implemented at the level of changes made to existing Mesa drivers Iris and ANV.
  • The development of support for Intel Lunar Lake (Xe 2) chips continues in the i915 driver. Support for Intel Meteor Lake chips has been improved.
  • In the Nouveau driver, a configuration for default use of GSP firmware functions for NVIDIA GPUs based on Turing and Ampere microarchitectures has been implemented, where GPU initialization and management operations are performed by a separate GSP (GPU System Processor) microcontroller. When the setting is enabled, the driver will operate through firmware calls instead of direct programming of hardware interaction operations.
  • The AMDGPU driver has implemented support for ACPI WBRF and VPE DPM, changed PCIe channel speed handling, utilized 64-bit sequence numbers in synchronization queues, added support for AMD-specific color management mechanisms, and resolved issues with transitioning to sleep mode.
  • An initial implementation of the driver for the Broadcom VideoCore 7.1 GPU, used in Raspberry Pi 5 boards, has been added.
  • A driver for the PowerVR 6 GPU series based on the Rogue microarchitecture from Imagination Technologies has been added.
  • Support for Thunderbolt/USB4 controllers integrated into chips based on Intel Lunar Lake microarchitecture has been added.
  • Drivers for cameras used in SoCs from Starfive, GalaxyCore GC2145/GC0308, Chips&Media Wave, and THine THP7312 have been added.
  • Support for NSO (Nintendo Switch Online) game controllers has been added — variants of older controllers from SNES (Super Nintendo), Genesis, and N64 (Nintendo 64), adapted for Nintendo Switch. A driver for Adafruit Seesaw gamepads has been added. The xpad driver now supports Lenovo Legion Go controllers.
  • Support for gaming devices Powkiddy RK2023, Powkiddy X55, and Anbernic RG351V has been added to the DTS driver.
  • Support for audio systems used in NXP i.MX8m MICFIL, Qualcomm SM8250, AMD ACP5x, Intel Arrow Lake, SM8550, SM8650, and X1E80100 chips added.
  • AMD has made changes related to support for the upcoming series of processors based on the new Zen 5 microarchitecture.
  • Support for ARM64 SoC has been added: Qualcomm SM8650 (Snapdragon 8 Gen 3), Qualcomm X1E80100 (Snapdragon X Elite), Samsung Exynos Auto v920, Google GS101 (Tensor G1), MediaTek MT8188, and Unisoc UMS9620 (Tanggula 7).
  • Support for ARM boards and devices has been added: Huashan Pi, Microsoft Lumia, HTC One Mini 2, Motorola MotoG 4G, Huawei Honor 5X/GR5, Anbernic RG351V, Powkiddy RK2023, Powkiddy X55, ComXpress based on Marvell CN913x, Lenovo Chromebook, Asus and Acer based on Mediatek MT8183, Toradex Verdin AM62, boards based on Allwinner H616/H618.
  • Support for ARM11 ARMv6K SMP processors discontinued.

At the same time, the Latin American Free Software Foundation has formed a variant of a fully free kernel 6.8 — Linux-libre 6.8-gnu, cleansed of firmware and driver elements containing non-free components or code fragments restricted by the manufacturer. In the 6.8 release, the cleaning code for blobs in various drivers and subsystems has been updated. Drivers Intel qat_420xx, Imagination PowerVR, Intel Xe, Chips&Media Wave5, Intel VSC, Aquantia PHY, and Realtek rtw8922a have been cleaned. With the removal from the kernel, the cleaning of drivers atmel, hermes, orinoco_usb, libertas_cs, and zd1201 has been stopped. The names of blobs in DTS files (devicetree) for ARM and Aarch64 architectures have been cleaned up. Issues with cleaning the i915 driver have been resolved.

Source: opennet.ru