KernelNewbies:

Linux 5.4 changelog.

Summary: This release includes the kernel lockdown mode, intended to strengthen the boundary between UID 0 and the kernel; virtio-fs, a high-performance virtio driver which allows a virtualized guest to mount a directory that has been exported on the host; fs-verity, for detecting file tampering, like dm-verity, but works on files rather than block devices; dm-clone, which allows live cloning of dm targets; two new madvise() flags for improved app memory management on Android,

1. Coolest features

1.1. Kernel lockdown mode

This release introduces an optional kernel lockdown feature, intended to strengthen the boundary between UID 0 (root) and the kernel. When enabled, various pieces of kernel functionality are restricted. Applications that rely on low-level access to either hardware or the kernel may cease working as a result - therefore this should not be enabled without appropriate evaluation beforehand. The original purpose of this feature was to honour the anti-tampering protections expected in a secure-boot environment, but it is not tied to that. The majority of mainstream distributions have been carrying variants of this patchset for many years now.

Kernel lockdown is implemented as a Linux Security Module that can be configured in integrity or lockdown mode. If set to integrity, kernel features that allow userland to modify the running kernel are disabled. If set to confidentiality, kernel features that allow userland to extract confidential information from the kernel are also disabled. Configuration can be done at runtime (through securityfs), boot time (via a kernel parameter) or build time (via a kconfig option).

Recommended LWN article: Lockdown as a security module

1.2. virtio-fs, a bridge to share file systems with virtualized guests

This release includes virtio-fs, a FUSE-based virtio driver for guest <-> host file system sharing. It allows a guest to mount a directory that has been exported on the host. Although there are existing technologies that allow this kind of functionality (NFS, virtio-9P), virtio-fs takes advantage of the proximity of VMs to achieve API semantics and performance more like local file systems. This is desirable both for performance and for application compatibility.

For more details, see the documentation, the design documentation and the official web site

1.3. fs-verity, for detecting file modifications

fs-verity is a support layer that filesystems can use to support transparent integrity and authenticity protection of read-only files. It is similar to dm-verity but works on files rather than block devices. Currently, it is supported by the ext4 and f2fs filesystems.

On regular files on filesystems supporting fs-verity, userspace can execute an ioctl that causes the filesystem to build a Merkle tree for the file and persist it to a filesystem-specific location associated with the file. Optionally, it is possible sign files with a key loaded into a keyring. After this, the file is made readonly, and all reads from the file are automatically verified against the file's Merkle tree. Reads of any corrupted data, including mmap reads, will fail. Userspace can efficently retrieve the root hash ("file measurement") with another ioctl, which can be used for a variety of security applications.

For more details, read the documentation

Recommended LWN article: Yet another try for fs-verity

1.4. dm-clone

dm-clone is a device mapper target which produces a one-to-one copy of an existing, read-only source device into a writable destination device: It presents a virtual block device which makes all data appear immediately, and redirects reads and writes accordingly. The main use case of dm-clone is to clone a potentially remote, high-latency, read-only, archival-type block device into a writable, fast, primary-type device for fast, low-latency I/O. The cloned device is visible/mountable immediately and the copy of the source device to the destination device happens in the background, in parallel with user I/O.

For more details, see the documentation

== New drivers for AMD and Intel This release adds support in the amdgpu driver for four new amdgpu products: Navi 12/14, Arcturus and Renoir APU support.

It also includes the first pieces for supporting the future Intel Tiger Lake GPU.

1.5. Two new madvise() flags: MADV_COLD and MADV_PAGEOUT

In order to improve memory usage in some systems (notably, Android), two new madvise() flags have been added: MADV_COLD and MADV_PAGEOUT. These new options complement MADV_DONTNEED and MADV_FREE by adding non-destructive ways to gain some free memory space.

MADV_COLD hints the kernel that the pages can be reclaimed when memory pressure happens but data should be preserved for future use, this can reduce workingset eviction so it ends up increasing performance. In contrast to MADV_FREE, the contents of the region are preserved regardless of subsequent writes to pages. MADV_PAGEOUT can be used by a process to mark a memory range as not expected to be used for a long time so that kernel reclaims *any LRU* pages instantly. The hint can help kernel in deciding which pages to evict proactively. Access in the range after successful operation could cause major page fault but never lose the up-to-date contents unlike MADV_DONTNEED

2. Core (various)

3. File systems

4. Memory management

5. Block layer

6. Tracing, perf and BPF

7. Virtualization

8. Cryptography

9. Security

10. Power Management

11. Networking

12. Architectures

13. Drivers

13.1. Graphics

13.2. Storage

13.3. Drivers in the Staging area

13.4. Networking

13.5. Audio

13.6. Tablets, touch screens, keyboards, mouses

13.7. TV tuners, webcams, video capturers

13.8. Universal Serial Bus

13.9. Serial Peripheral Interface (SPI)

13.10. Watchdog

13.11. Serial

13.12. CPU Frequency Scaling

13.13. Device Voltage and Frequency Scaling

13.14. Real Time Clock (RTC)

13.15. Voltage, current regulators, power capping, power supply

13.16. Pin Controllers (pinctrl)

13.17. Multi Media Card (MMC)

13.18. Memory Technology Devices (MTD)

13.19. Industrial I/O (iio)

13.20. Multi Function Devices (MFD)

13.21. Pulse-Width Modulation (PWM)

13.22. Inter-Integrated Circuit (I2C + I3C)

13.23. Hardware monitoring (hwmon)

13.24. General Purpose I/O (gpio)

13.25. Leds

13.26. DMA engines

13.27. Cryptography hardware acceleration

13.28. PCI

13.29. Non-Transparent Bridge (NTB)

13.30. Thunderbolt

13.31. Clock

13.32. PHY ("physical layer" framework)

13.33. EDAC (Error Detection And Correction)

13.34. Various

14. List of Pull Requests

15. Other news sites

KernelNewbies: Linux_5.4 (last edited 2019-11-24 23:41:07 by diegocalleja)