There are two fundamental levels of memory allocator in the Linux kernel:
the page allocator, which allocates memory in units of pages, and the slab
allocator, which allocates arbitrarily-sized chunks that are usually (but
not necessarily) smaller than a page. The slab allocator is the one that
stands behind commonly used kernel functions like kmalloc(). At
the 2024 Linux
Storage, Filesystem, Memory Management, and BPF Summit, slab maintainer
Vlastimil Babka provided an update on recent changes at the slab level and
discussed the changes that are yet to come.
The term “memory tiering” refers to the management of memory placement on
systems with multiple types of memory, each of which has its own
performance characteristics. On such systems, poor placement can lead to
significantly worse performance. A memory-management-track discussion at
the 2024 Linux Storage,
Filesystem, Memory Management, and BPF Summit took yet another look at
tiering challenges with a focus on upcoming technologies that may simplify
(or complicate) the picture.
Bundles are multiple buffers used in a single operation. On the
receive side, this means a single receive may utilize multiple
buffers, reducing the roundtrip through the networking stack from N
per N buffers to just a single one. On the send side, this also
enables better handling of how an application deals with sends from
a socket, eliminating the need to serialize sends on a single
socket. Bundles work with provided buffers, hence this feature also
adds support for provided buffers for send operations.
Security updates have been issued by Debian (bind9, chromium, and thunderbird), Fedora (buildah, chromium, firefox, mingw-python-werkzeug, and suricata), Mageia (golang), Oracle (firefox and nodejs:20), Red Hat (firefox, httpd:2.4, nodejs, and thunderbird), and SUSE (firefox, git-cliff, and ucode-intel).
Non-uniform memory access (NUMA) systems are organized with their CPUs
grouped into nodes, each of which has memory attached to it. All memory in
the system is accessible from all CPUs, but memory attached to the local
node is faster. The kernel’s memory-policy
(“mempolicy”) interface allows threads to inform the kernel about how
they would like their memory placed to get the best performance. In recent
years, the NUMA concept has been extended to support the management of
different types of memory in a system, pushing the limits of the mempolicy
subsystem. In a remotely presented session at the 2024 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Gregory Price discussed
the ways in which the kernel’s memory-policy support should evolve to
handle today’s more-complex systems.
The DAMON
subsystem was the subject of the first session in the memory-management
track at the Linux
Storage, Filesystem, Memory Management, and BPF Summit. DAMON
maintainer SeongJae Park introduced the data-access monitoring
framework, which can generate snapshots of how memory is accessed, enabling
the detection of hot and cold regions of memory in both the virtual and
physical address spaces. The session covered recent changes and future
plans for this tool.
Ronnie Sahlberg, Jonathan Maple, and Jeremy Allison of CiQ have published a white
paper looking at the security-relevant bug fixes applied (or not
applied) to the RHEL 8.x kernel over time.
This means that over time, the security of the RHEL kernels get
worse and worse as more issues are discovered in the upstream code
and are potentially exploitable but fewer and fewer of the fixes
for these known bugs are back-ported into RHEL kernels.
After reaching RHEL 8.7, the theory is that the kernel has been
stabilized, with a corresponding improvement in security. However
we still have an influx of newly discovered bugs in the upstream
kernel affecting RHEL 8.7 that are not addressed. Each minor
version of upstream is released on an approximately quarterly basis
and we can see that the influx of new bugs that are unaddressed in
RHEL is growing. The number of known issues in these kernels
increases by approximately 250 new bugs per quarter or more.
The merge window for the 6.10 kernel release opened on May 12; between
then and the time of this writing, 6,819 non-merge commits were pulled into
the mainline kernel for that release. Your editor has taken some time out
from LSFMM+BPF in an attempt to keep
up with the commit flood. Read on for an overview of the most significant
changes that were pulled in the early part of the 6.10 merge window.
The Mozilla Foundation has announced
that its new executive director will be Nabiha Syed.
Syed is known for her mission-driven leadership, focused on
increasing transparency into the most powerful institutions in
society. She comes to Mozilla after leading The Markup, an
award-winning publication that challenges technology to serve the
public good, from its launch through its successful acquisition in
2024.
In 2014, ESET researchers said the 2011 attack likely infected
kernel.org servers with a second piece of malware they called
Ebury. The malware, the firm said, came in the form of a malicious
code library that, when installed, created a backdoor in OpenSSH
that provided the attackers with a remote root shell on infected
hosts with no valid password required. In a little less than 22
months, starting in August 2011, Ebury spread to 25,000
servers. Besides the four belonging to the Linux Kernel
Organization, the infection also touched one or more servers inside
hosting facilities and an unnamed domain registrar and web hosting
provider.
Version
126.0 of the Firefox browser is out. Changes include improvements to
the “copy link without site tracking” feature, support for zstd
compression, and a new tracking “feature”: “Telemetry was added to create
an aggregate count of searches by category to broadly inform search feature
development.“
The advent of the folio structure to
describe groups of pages has been one of the most fundamental
transformations within the kernel in recent years. Since the folio
transition affects many subsystems, it is fitting that the subject was
covered at the beginning of the 2024 Linux Storage,
Filesystem, Memory Management, and BPF Summit in a joint session of the
storage, filesystem, and memory-management tracks. Matthew Wilcox used the
session to review the work that has been done in this area and to discuss
what comes next.
The 6.9 kernel was released
on May 12 after a typical nine-week development cycle. Once again,
this is a major release containing a lot of changes and new features. Our
merge-window summaries (part 1, part 2) covered those changes; now that
the development cycle is complete, the time has come to look at where all
that work came from — and to introduce a new and experimental LWN feature
for readers interested in this kind of information.
Linus has released the 6.9 kernel.
“So 6.9 is now out, and last week has looked quite stable (and the
whole release has felt pretty normal).”
Significant changes in this release include
the ability to create pidfds for individual
threads,
the BPF arena subsystem,
the BPF token security mechanism, truncate() support in io_uring,
support for the Rust language on 64-bit Arm systems, weighted interleaving in the
memory-management subsystem,
the device-mapper
virtual data optimizer target,
initial FUSE passthrough support,
and more.
See the LWN merge-window summaries
(part 1, part 2) for more information.
The extensible scheduler class (or “sched_ext”) is a comprehensive
framework that enables the implementation of CPU schedulers as a set of BPF
programs that can be loaded at run time. Despite having attracted a fair
amount of interest from the development community, sched_ext has run into
considerable opposition and seems far from acceptance into the mainline.
The posting by Tejun Heo of a new
version of the sched_ext series at the beginning of May has restarted
this long-running discussion, but it is not clear what the end result will
be.
Version
14.1 of the GCC compiler suite has been released. The list of changes
is long; it includes support for more C++26 features, preparation for
Fortran 2023 support, a new -fhardened flag to enable
security-hardening features, vectorizer improvements, and a number of static-analyzer improvements. See the release notes for
details.
The Go Blog has a detailed
article on the new, more secure random-number generator implemented for
the 1.22 release.
For example, when Go 1.20 deprecated math/rand’s Read, we heard
from developers who discovered (thanks to tooling pointing out use
of deprecated functionality) they had been using it in places where
crypto/rand’s Read was definitely needed, like generating key
material. Using Go 1.20, that mistake is a serious security problem
that merits a detailed investigation to understand the
damage. Where were the keys used? How were the keys exposed? Were
other random outputs exposed that might allow an attacker to derive
the keys? And so on. Using Go 1.22, that mistake is just a mistake.
Security updates have been issued by Debian (kernel), Gentoo (libjpeg-turbo, xar, and Xpdf), Red Hat (bind, dhcp and glibc), and SUSE (bouncycastle, curl, flatpak, less, and xen).
The collective thoughts of the interwebz
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.