Linux kernel 5.14

After two months of development, Linus Torvalds presented kernel release Linux 5.14. Among the most notable changes are new system calls quotactl_fd() and memfd_secret(), the removal of ide and raw drivers, a new I/O priority controller for cgroups, the SCHED_CORE task scheduling mode, and infrastructure for creating verified BPF program loaders.

The new version includes 15,883 fixes from 2,002 developers, with a patch size of 69 MB (the changes affected 12,580 files, added 861,501 lines of code, and removed 321,654 lines). About 47% of all changes presented in 5.14 are related to device drivers, around 14% pertain to updating code specific to hardware architectures, 13% is associated with the network stack, 3% with filesystem changes, and 3% with internal kernel subsystems.

Key innovations:

• disk subsystem, input/output, and filesystems:
  • for cgroup is implemented a new I/O prioritization controller — rq-qos, which can manage the priority of block device request handling generated by members of each cgroup. Support for the new priority controller has been added to the mq-deadline I/O scheduler;
  • in ext4 filesystem within a new ioctl command EXT4_IOC_CHECKPOINT, which forcibly flushes all pending transactions from the journal and their associated buffers to disk, and also rewrites the journal's used area in storage. This change was prepared as part of an initiative to prevent information leaks from filesystems;
  • in Btrfs optimizations have been made performance optimizations: by eliminating unnecessary journaling of extended attributes during fsync execution, performance for intensive operations with extended attributes has increased by up to 17%. Additionally, during truncation operations that do not affect extents, full synchronization has been disabled, reducing the operation time by 12%. A setting has been added to sysfs to limit I/O throughput during filesystem checks. Ioctl calls have been added to cancel resize and device removal operations;
  • in XFS reworked the buffer cache implementation, which has been transitioned to batch mode memory page allocation. Cache efficiency has been improved;
  • In F2FS, an option has been added to work in read-only mode, and a caching mode for compressed blocks (compress_cache) has been implemented to enhance random read performance. Support for file compression reflected in memory using the mmap() operation has been introduced. A new mount option nocompress has been proposed for selectively disabling file compression by mask.
  • In the exFAT driver, work has been done to improve compatibility with storage devices of some digital cameras.
  • A system call has been added. quotactl_fd(), which allows managing quotas not through a special device file, but by specifying a file descriptor associated with the file system to which the quota applies.
  • Old drivers for block devices with the IDE interface have been removed from the kernel, as they have long been replaced by the libata subsystem. Support for old devices is fully maintained; the changes only concern the ability to use old drivers, under which storage was named /dev/hd*, rather than /dev/sd*.
  • The 'raw' driver, which provided unbuffered access to block devices via the /dev/raw interface, has been removed from the kernel. This functionality has long been implemented in applications using the O_DIRECT flag.
• Memory and system services:
  • A new scheduling mode has been implemented in the task scheduler. SCHED_CORE, allowing control over which processes can be executed together on a single CPU core. Each process can be assigned a cookie identifier that defines a trust domain between processes (e.g., belonging to the same user or container). When organizing code execution, the scheduler can ensure that a single CPU core is shared only among processes associated with the same owner, which can be used to block certain Spectre-class attacks by preventing the execution of both trusted and untrusted tasks in the same SMT (Hyper Threading) thread.
  • Support for the kill operation has been implemented for the cgroup mechanism, allowing all processes bound to the group to be terminated at once (sending SIGKILL) by writing '1' to the virtual file cgroup.kill.
  • Enhanced capabilities regarding the response to the detection of split locks, which occur when accessing unaligned data in memory due to atomic instructions crossing two CPU cache lines. Such locks lead to significant performance degradation, hence previously it was possible to forcibly terminate the application that caused the lock. The new release adds a kernel command line option 'split_lock_detect=ratelimit:N', allowing the configuration of a system-wide limit on lock operation intensity per second, after which any process that becomes the source of the split lock will be forcibly stopped for 20 ms instead of being terminated;
  • In the CFS bandwidth controller of the cgroup controller, which defines how much CPU time can be allocated to each cgroup, the ability to set limits conditioned by a specified duration has been implemented, allowing for better regulation of delay-sensitive workloads. For example, setting cpu.cfs_quota_us to 50000 and cpu.cfs_period_us to 100000 allows a group of processes to spend 50ms of CPU time every 100ms;
  • has added The initial infrastructure for creating BPF program loaders, which will subsequently allow the loading of only BPF programs signed by a trusted digital key;
  • A new futex operation FUTEX_LOCK_PI2 has been added, using a monotonic timer to calculate the timeout, which takes into account the time the system has spent in sleep mode;
  • Support for large memory pages (Transparent Huge Pages) has been implemented for the RISC-V architecture, along with the capability to apply the mechanism KFENCE for detecting memory-related errors;
  • In the system call madvise(), which provides means for optimizing process memory management, added the flags MADV_POPULATE_READ and MADV_POPULATE_WRITE generate a page fault in all memory pages allocated for read or write operations, without performing actual read or write (prefault). The use of these flags can be beneficial in reducing delays during program execution by preemptively executing the page fault handler for all unallocated pages at once, without waiting for actual access to them;
  • in the unit testing system kunit has added support for running tests in the QEMU environment;
  • new tracers added: "osnoise" for tracking delays in applications caused by interrupt handling, and "timerlat" for providing detailed information about delays during wake-ups from timer signals;
• virtualization and security:
  • implemented system call memfd_secret(), allowing the creation of a private memory area in an isolated address space, visible only to the owning process, not reflected in other processes, and directly inaccessible to the kernel;
  • in the seccomp system call filtering system, the possibility of using a single atomic operation to create a file descriptor for the isolated task and return it during system call processing has been provided by moving lock handlers to user space. The proposed operation addresses the issue interrupting the handler in user space upon receiving a signal;
  • implemented a new mechanism for managing resource limits in user ID namespace, which binds individual rlimit counters to users in the 'user namespace'. The change addresses the issue of applying shared resource counters when a user starts processes in different containers;
  • the KVM hypervisor for ARM64 systems has added support for using the MTE (Memory Tagging Extension) in guest systems, allowing tags to be bound to each memory allocation operation and ensuring pointer correctness checks to block exploitation of vulnerabilities caused by accessing already freed memory blocks, buffer overflows, accessing before initialization, and using out of the current context;
  • the pointer authentication features provided by the ARM64 platform can now be separately configured for the kernel and user space. The technology allows the use of specialized ARM64 instructions to verify return addresses using digital signatures stored in the unused upper bits of the pointer itself;
  • in User-mode Linux has added support for using drivers for PCI devices with a virtual PCI bus implemented by the PCI-over-virtio driver;
  • Support for the paravirtualized device virtio-iommu has been added for x86 systems, allowing IOMMU requests such as ATTACH, DETACH, MAP, and UNMAP to be sent over the virtio transport without emulating memory page tables;
  • For Intel CPUs, from the Skylake family up to Coffee Lake, the use of Intel TSX (Transactional Synchronization Extensions) is disabled by default, which provides mechanisms to improve the performance of multi-threaded applications by dynamically eliminating unnecessary synchronization operations. The extensions are disabled due to the potential for attacks Zombieload, which manipulate information leaks through side channels occurring during the operation of the asynchronous interrupt abort mechanism (TAA, TSX Asynchronous Abort);
• Network subsystem:
  • Integration into the MPTCP (MultiPath TCP) kernel has continued, an extension of the TCP protocol to facilitate TCP connection operation with packet delivery simultaneously over multiple routes through different network interfaces linked to different IP addresses. In this release, implemented a mechanism for defining custom traffic hash policies for IPv4 and IPv6 (multipath hash policy) has been introduced, allowing the user space to determine which fields in packets, including encapsulated ones, will be used when computing the hash that determines the path selection for the packet;
  • Support for sockets SOCK_SEQPACKET has been added to the virtual transport virtio (for ordered and reliable transmission of datagrams);
  • The capabilities of the SO_REUSEPORT socket mechanism have been expanded, allowing multiple listening sockets to connect to a single port to accept connections with simultaneous distribution of incoming requests among all connected sockets through SO_REUSEPORT, simplifying the development of multi-threaded server applications. In the new version, added tools for transferring control to another socket in case of failure when processing a request by the initially selected socket have been provided (solving the issue of losing individual connections during service restarts);
• Hardware:
  • in the amdgpu driver within support for new series of AMD Radeon RX 6000 GPUs, developed under the code names "Beige Goby" (Navi 24) and "Yellow Carp," as well as improved support for Aldebaran GPU (gfx90a) and Van Gogh APU. Added the ability to work with multiple eDP panels simultaneously. For Renoir APU, support for working with encrypted buffers in video memory (TMZ, Trusted Memory Zone) has been implemented. Added support for hot unplugging of graphics cards. For Radeon RX 6000 GPUs (Navi 2x) and older AMD GPUs, support for the ASPM (Active State Power Management) power-saving mechanism is enabled by default, which was previously activated only for Navi 1x, Vega, and Polaris GPUs;
  • for AMD chips, support for shared virtual memory (SVM) based on the HMM (Heterogeneous memory management) subsystem has been added, allowing the use of devices with their own memory management units (MMU) that can access main memory. With HMM, a shared address space can be organized between the GPU and CPU, in which the GPU can access the main memory of the process;
  • initial support for the technology has been added AMD Smart Shift, which dynamically changes the power consumption parameters of the CPU and GPU on laptops with AMD chipset and graphics card to enhance performance during gaming, video editing, and 3D rendering;
  • in the i915 driver for Intel graphics cards enabled support for Intel Alderlake P chips;
  • added drm/hyperv driver for Hyper-V virtual graphics adapter;
  • implemented the simpledrm graphics driver uses EFI-GOP or VESA framebuffer output provided by UEFI firmware or BIOS. The main purpose of the driver is to provide graphical output at early stages of booting, before a full DRM driver becomes available. The driver can also be used as a temporary solution for hardware that currently lacks native DRM drivers;
  • has added support for the all-in-one computer Raspberry Pi 400;
  • added dell-wmi-privacy driver to support hardware camera and microphone switch provided in Dell laptops;
  • for Lenovo laptops implemented WMI interface for changing BIOS settings via sysfs /sys/class/firmware-attributes/;
  • expanded support for devices with USB4 interface;
  • has added Support for sound cards and codecs AmLogic SM1 TOACODEC, Intel AlderLake-M, NXP i.MX8, NXP TFA1, TDF9897, Rockchip RK817, Qualcomm Quinary MI2, and Texas Instruments TAS2505. Improved audio support on HP and ASUS laptops. Additional Patches to reduce latency before sound playback on USB interface devices.

Source – opennet.ru.

Source: linux.org.ru