Vue normale

Aujourd’hui — 7 avril 2025LWN

[$] Three ways to rework the swap subsystem

Par : corbet
7 avril 2025 à 15:01
The kernel's swap subsystem is complex and highly optimized — though not always optimized for today's workloads. In three adjacent sessions during the memory-management track of the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit, Kairui Song, Nhat Pham, and Usama Arif all talked about some of the problems that they are trying to solve in the Linux swap subsystem. In the first two cases, the solutions take the form of an additional layer of indirection in the kernel's swap map; the third, which enables swap-in of large folios, may or may not be worthwhile in the end.

Security updates for Monday

Par : jake
7 avril 2025 à 13:42
Security updates have been issued by Debian (abseil, atop, jetty9, ruby-saml, tomcat10, trafficserver, xz-utils, and zfs-linux), Fedora (chromium, condor, containernetworking-plugins, cri-tools1.29, crosswords-puzzle-sets-xword-dl, exim, ghostscript, matrix-synapse, upx, varnish, and yarnpkg), Gentoo (XZ Utils), Mageia (augeas, corosync, nss & firefox, and thunderbird), Oracle (container-tools:ol8, firefox, freetype, and kernel), Red Hat (firefox), SUSE (chromium, gn, firefox-esr, go1.23-1.23.8, go1.24, go1.24-1.24.2, google-guest-agent, govulncheck-vulndb, gsl, python311-ecdsa, thunderbird, and webkit2gtk3), and Ubuntu (kamailio, libdbd-mysql-perl, linux-nvidia, linux-nvidia-6.8, and tomcat9).

Kernel prepatch 6.15-rc1

Par : corbet
6 avril 2025 à 23:09
Linus has released 6.15-rc1 and closed the merge window for this release. "As expected, this was one of the bigger merge windows, almost certainly just because we had some pent-up development due to the previous releases being impacted by the holiday season. That said, while it's bigger than normal, it's not some kind of record-breaking thing.". In the end, 12.633 non-merge changesets were pulled into the mainline during this merge window.
À partir d’avant-hierLWN

[$] The state of guest_memfd

Par : corbet
4 avril 2025 à 15:52
A typical cloud-computing host will share some of its memory with each guest that it runs. The host retains its access to that memory, though, meaning that it can readily dig through that memory in search of data that the guest would prefer to keep private. The guest_memfd subsystem removes (most of) the host's access to guest memory, making the guest's data more secure. In the memory-management track of the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit, David Hildenbrand ran a discussion on the state and future of this feature.

[$] The future of ZONE_DEVICE

Par : corbet
4 avril 2025 à 14:37
Alistair Popple started his session at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit by proclaiming that ZONE_DEVICE is "the ugly stepchild" of the kernel's memory-management subsystem. Ugly or not, the ability to manage memory that is attached to a peripheral device rather than a CPU is increasingly important on current hardware. Popple hoped to cover some of the challenges with ZONE_DEVICE and find ways to make the stepchild a bit more attractive, if not bring it into the family entirely.

[$] Supporting untorn buffered writes

Par : jake
4 avril 2025 à 13:39
At last year's Linux Storage, Filesystem, Memory-Management, and BPF Summit (LSFMM+BPF), there was a discussion about atomic writes that was accompanied by patches to support the feature in the block layer, and for direct I/O on XFS. That work was merged, but another piece of that discussion concerned adding the feature for buffered I/O, in part because the PostgreSQL database currently has to jump through hoops to ensure that its writes are not "torn" (partially written) when there is an error or crash. Luis Chamberlain led a combined storage and filesystem track at this year's summit to revisit the idea of providing atomic (or untorn) writes for buffered I/O.

[$] A strange BPF error message

Par : daroc
4 avril 2025 à 13:06

Yonghong Song brought a story about tracking down the cause of a strange verifier error message to the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit. He then presented some possible ways to improve Clang's user experience for anyone running into the same class of error in the future. Toward the end of his allotted time, he also discussed the problems with optimizations that change the signature of functions — a problem that José Marchesi had also brought up in the previous session.

Security updates for Friday

Par : daroc
4 avril 2025 à 13:05
Security updates have been issued by AlmaLinux (firefox), Debian (atop and thunderbird), Fedora (webkitgtk), Mageia (microcode), Oracle (expat), SUSE (apparmor, assimp-devel, aws-efs-utils, expat, firefox, ghostscript, go1.23, gotosocial, govulncheck-vulndb, GraphicsMagick, headscale, libmozjs-128-0, libsaml-devel, openvpn, perl-Data-Entropy, and xz), and Ubuntu (gnupg2, kernel, linux-azure-fips, linux-iot, openvpn, ruby-saml, and xz-utils).

[$] Page allocation for address-space isolation

Par : corbet
3 avril 2025 à 15:02
Address-space isolation may well be, as Brendan Jackman said at the beginning of his memory-management-track session at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit, "some security bullshit". But it also holds the potential to protect the kernel from a wide range of vulnerabilities, both known and unknown, while reducing the impact of existing mitigations. Implementing address-space isolation with reasonable performance, though, is going to require some significant changes. Jackman was there to get feedback from the memory-management community on how those changes should be implemented.

[$] Better hugetlb page-table walking

Par : corbet
3 avril 2025 à 14:15
The kernel must often step through the page tables of one or more processes to carry out various operations. This "page-table walking" tends to be performed by ad-hoc (duplicated) code all over the kernel. Oscar Salvador used a memory-management-track session at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit to talk about strategies to unify the kernel's page-table walking code just a little bit by making hugetlb pages look more like ordinary pages.

Security updates for Thursday

Par : jake
3 avril 2025 à 13:46
Security updates have been issued by AlmaLinux (expat), Debian (chromium, commons-vfs, firefox-esr, php-horde-editor, php-horde-imp, and thunderbird), Fedora (corosync, firefox, nextcloud, and suricata), Mageia (curl and upx), Oracle (emacs, fence-agents, freetype, kernel, libreoffice, libxml2, nginx:1.24, podman, python-jinja2, and tigervnc), Red Hat (firefox and python-jinja2), SUSE (assimp, ffmpeg-4, firefox, ghostscript, GraphicsMagick, libxslt, and tomcat), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-meta-raspi, linux-nvidia-tegra, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux-fips, linux-fips, linux-aws-fips, linux-gcp-fips, linux-hwe-5.15, and linux-realtime, linux-intel-iot-realtime).

[$] LWN.net Weekly Edition for April 3, 2025

Par : jake
3 avril 2025 à 00:21
Inside this week's LWN.net Weekly Edition:

  • Front: Calibre 8.0; Fedora reproducibility; OpenWrt One; 6.15 Merge Window; LSFMM+BPF coverage including BPF in GCC, Rust merging process, and more.
  • Briefs: Ubuntu namespaces; New FPL; PorteuX 2.0; Firefox 137.0; GCC Rust; Rockbox 4.0; Rust specification; Thundermail; Dave Täht RIP; Quotes; ...
  • Announcements: Newsletters, conferences, security updates, patches, and more.

[$] Catching up with calibre

Par : jzb
2 avril 2025 à 17:00

Saying that calibre is ebook-management software undersells the application by a fair margin. Calibre is an open-source Swiss Army knife for ebooks that can be used for everything from creating ebooks, converting ebooks from obscure formats to modern formats like EPUB, to serving up an ebook library over the web. The most recent major release, calibre 8.0, brings a better text-to-speech engine, a tool for creating audio overlays when authoring ebooks, support for profiles in the ebook viewer, and more.

[$] An update on GCC BPF support

Par : daroc
2 avril 2025 à 15:47

José Marchesi and David Faust kicked off the BPF track at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit with an extra-long session on what they have been doing to support compiling to BPF in GCC. Overall, the project is slowly working toward full support for BPF, with most of the self-tests now passing using Faust's in-progress patches. However, the progress toward that goal has turned up a number of problems with how Clang supports BPF that needed to be discussed at length to find a path forward for both projects.

Thunderbird plans "Thundermail" email and other services

Par : jzb
2 avril 2025 à 15:39

Ryan Sipes has announced efforts to expand Thunderbird's offerings with web services to "enhance the experience of using Thunderbird".

The Why for offering these services is simple. Thunderbird loses users each day to rich ecosystems that are both clients and services, such as Gmail and Office365. These ecosystems have both hard vendor lock-ins (through interoperability issues with 3rd-pary clients) and soft lock-ins (through convenience and integration between their clients and services). It is our goal to eventually have a similar offering so that a 100% open source, freedom-respecting alternative ecosystem is available for those who want it.

The planned services include hosted email, appointment scheduling, a revival of Firefox Send, and (of course) an AI assistant based on a partnership with Flower AI. The AI features will "always be optional for use by people who want them". Sipes is managing director of product for Thunderbird's parent organization, MZLA Technologies Corporation. LWN covered his GUADEC 2024 keynote last July.

Introducing Fedora Project Leader Jef Spaleta

Par : jzb
2 avril 2025 à 14:40

Outgoing Fedora Project Leader (FPL) Matthew Miller has announced his successor, Jef Spaleta.

Some of you may remember Jef's passionate voice in the early Fedora community. He got involved all the way back in the days of fedora.us, before Red Hat got involved. Jef served on the Fedora Board from July 2007 through the end of 2008. This was the critical time after Fedora Extras and Fedora Core merged into one Fedora Linux where, with the launch of the "Features" process, Fedora became a truly community-led project.

Spaleta will be joining Red Hat full time in May and Miller will be formally handing off FPL duties at the Flock conference in June.

PorteuX 2.0 released

Par : jzb
2 avril 2025 à 14:34

Version 2.0 of PorteuX, a distribution based on Slackware Linux, has been released. This release adds the ability to test experimental Wayland sessions for the Cinnamon, LXQt, and Xfce desktops. PorteuX 2.0 updates the Linux kernel to 6.14 and includes many package updates and bug fixes. Users have the choice of PorteuX stable or its rolling release called current. See the install.txt for instructions on installing PorteuX to disk.

[$] Approaches to reducing TLB pressure

Par : corbet
2 avril 2025 à 13:45
The CPU's translation lookaside buffer (TLB) caches the results of virtual-address translations, significantly speeding memory accesses. TLB misses are expensive, so a lot of thought goes into using the TLB as efficiently as possible. Reducing pressure on the TLB was the topic of Rik van Riel's memory-management-track session at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit. Some approaches were considered, but the session was short on firm conclusions.

Rockbox 4.0 released

Par : corbet
2 avril 2025 à 13:11
For those of you who still have dedicated audio players: version 4.0 of Rockbox, a replacement firmware for many players, has been released. This release brings support for a number of new devices, updated codecs, a number of user-interface improvements, some new games, and more. (LWN last reviewed Rockbox in 2010 — and looked at the ill-fated Android port that year as well).

Security updates for Wednesday

Par : jzb
2 avril 2025 à 13:03
Security updates have been issued by Debian (firefox-esr, jetty9, openjpeg2, and tomcat9), Fedora (dokuwiki, firefox, php-kissifrot-php-ixr, php-phpseclib3, and rust-zincati), Red Hat (kernel and pki-core), Slackware (mozilla), SUSE (apparmor, atop, docker, docker-stable, firefox, govulncheck-vulndb, libmodsecurity3, openvpn, upx, and warewulf4), and Ubuntu (inspircd, linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oem-6.8, linux-oracle, linux-oracle-6.8, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure-6.8, linux-hwe-6.8, linux-raspi, linux-realtime, nginx, phpseclib, and vim).

[$] Slab allocator: sheaves and any-context allocations

Par : corbet
1 avril 2025 à 18:54
The kernel's slab allocator is charged with providing small objects on demand; its performance and reliability are crucial for the functioning of the system as a whole. At the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit, two adjacent sessions in the memory-management track dug into current work on the slab allocator. The first focused on the new sheaves feature, while the second discussed a set of allocation functions that are safe to call in any context.

Dave Täht RIP

Par : corbet
1 avril 2025 à 18:28
[Dave Täht] From the LibreQoS site comes the sad news that Dave Täht has passed away. Among many other things, he bears a lot of credit for our networks functioning as well as they do. "We're incredibly grateful to have Dave as our friend, mentor, and as someone who continuously inspired us – showing us that we could do better for each other in the world, and leverage technology to make that happen. He will be dearly missed".

Searching through LWN's archives will turn up many references to his work fixing WiFi, improving queue management, tackling bufferbloat, and more. Farewell, Dave, we hope the music is good wherever you are.

(Thanks to Jon Masters for the heads-up).

[$] Updates on storage standards

Par : jake
1 avril 2025 à 14:32
As he has in some previous editions of the Linux Storage, Filesystem, Memory-Management, and BPF Summit (LSFMM+BPF), Fred Knight gave an update on the status of various storage standards this year. In it, he looked at changes to the NVM Express (NVMe) standards in some detail. He also updated attendees on the fairly small changes that have come to the SCSI (T10) and ATA (T13) standards over the last few years.

[$] Memory persistence over kexec

Par : corbet
1 avril 2025 à 14:00
The kernel's kexec mechanism allows one kernel to directly boot a new one; it can be thought of as a sort of kernel equivalent to the execve() system call. Kexec has a number of uses, including booting a special kernel to perform dumps after a crash. Normally, one does not expect user-space processes to survive booting into a new kernel, but that has not stopped developers from trying to implement that ability. Mike Rapoport ran a memory-management-track session at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit to discuss one piece of that problem: enabling the contents of memory to persist across a kexec handover so that the new kernel can pick up where the old one left off.

Security updates for Tuesday

Par : corbet
1 avril 2025 à 13:54
Security updates have been issued by AlmaLinux (freetype, grub2, kernel, kernel-rt, and python-jinja2), Debian (freetype, linux-6.1, suricata, tzdata, and varnish), Fedora (mingw-libxslt and qgis), Mageia (elfutils, mercurial, and zvbi), Oracle (grafana, kernel, libxslt, nginx:1.22, and postgresql:12), Red Hat (opentelemetry-collector), SUSE (corosync, opera, and restic), and Ubuntu (aom, libtar, mariadb, ovn, php7.4, php8.1, php8.3, rabbitmq-server, and webkit2gtk).

[$] Improving the merging of anonymous VMAs

Par : corbet
31 mars 2025 à 22:26
The virtual memory area (VMA), represented by struct vm_area_struct, is one of the core abstractions of the kernel's memory-management subsystem; a VMA represents a portion of a process's address space with the same characteristics. A memory-mapped file will be represented by (at least) one VMA, as will the process's stack or a region of anonymous memory. Efficiently managing VMAs and the logic around them is crucial for good performance overall. Lorenzo Stoakes focused on one specific problem area: the merging of anonymous VMAs, during the memory-management track at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit.

[$] A herd of migration discussions

Par : corbet
31 mars 2025 à 15:07
Migration is the act of moving data from one location in physical memory to another. The kernel may migrate pages for many reasons, including defragmentation, improving NUMA locality, moving data to or from memory hosted on a peripheral device, or freeing a range of memory for other uses. Given the importance of migration to the memory-management subsystem, there is a lot of interest in improving its performance and removing impediments to its success. Several sessions in the memory-management track of the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit were dedicated to this topic.

[$] Fedora change aims for 99% package reproducibility

Par : jzb
31 mars 2025 à 14:04

The effort to ensure that open-source software is reproducible has been gathering steam over the years, and gaining traction with major Linux distributions. Debian, for example, has been working toward reproducible builds for more than a decade; it can now produce official live CDs of the current stable release that are reproducible. Fedora started on the path much later, but it has progressed far enough that the project is now considering a change proposal for the Fedora 43 development cycle, expected to be released in October, with a goal of making 99% of Fedora's package builds reproducible. So far, reaction to the proposal seems favorable and focused primarily on how to achieve the goal—with minimal pain for packagers—rather than whether to attempt it.

Security updates for Monday

Par : jake
31 mars 2025 à 13:58
Security updates have been issued by Debian (amd64-microcode, flatpak, intel-microcode, libdata-entropy-perl, librabbitmq, and vim), Fedora (augeas, containerd, crosswords-puzzle-sets-xword-dl, libssh2, libxml2, nodejs-nodemon, and webkitgtk), Red Hat (libreoffice and python-jinja2), SUSE (389-ds, apparmor, corosync, docker, docker-stable, erlang26, exim, ffmpeg-4, govulncheck-vulndb, istioctl, matrix-synapse, mercurial, openvpn, python3, rke2, and skopeo), and Ubuntu (ansible, linux, linux-hwe-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux-azure-fips, linux-gcp-fips, linux-fips, linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-realtime, linux-intel-iot-realtime, linux-xilinx-zynqmp, opensc, and ruby-doorkeeper).

Edmundson: a modern Plasma Login Manager

Par : jzb
28 mars 2025 à 20:17

KDE contributor David Edmundson has published a blog post about improving KDE Plasma's login experience by replacing SDDM with a new Plasma Login Manager.

It's worth stressing nothing is official or set in stone yet, whilst it has come up in previous Plasma online meetings and in the 2023 Akademy. I'm posting this whilst starting a more official discussion on the plasma-devel mailing list.

Oliver Beard and I have made a new mutli-process greeter, that uses the same startup mechanism as the desktop session. It doesn't have all the features that we propose at the start of the blog, but an architecture where features and services can be slowly and safely added.

That discussion is here for those who would like to follow along. The prototype is currently in two repositories: plasma-login for the frontend work, and plasma-login-manager, which is a fork of SDDM.

[$] Making the OpenWrt One

Par : jake
28 mars 2025 à 16:31
In a keynote on the final day of SCALE 22x, Denver Gingerich said that he wanted to talk "a little bit about a router and also the big picture around that router". Gingerich is the director of compliance at the Software Freedom Conservancy (SFC), which is the organization behind the OpenWrt One router that LWN looked at back in November. The router is, of course, based on firmware from the OpenWrt project, which got its start because of GPL-enforcement activities and is a member project at the SFC.

[$] The first part of the 6.15 merge window

Par : corbet
28 mars 2025 à 15:08
As of this writing, 6,653 non-merge changesets have been pulled into the mainline kernel repository for the 6.15 release. This merge window is thus well underway. A number of significant changes have been merged so far; read on for our summary of the first half of the 6.15 merge window.

Security updates for Friday

Par : daroc
28 mars 2025 à 13:10
Security updates have been issued by Debian (mercurial and opensaml), Fedora (augeas, mingw-libxslt, and nodejs-nodemon), Mageia (chromium-browser-stable), Red Hat (grafana, kernel, kernel-rt, opentelemetry-collector, and podman), SUSE (apache-commons-vfs2, python3, and python36), and Ubuntu (ghostscript, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-intel-iotg, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-azure, linux-gcp, linux-hwe-6.11, linux-oracle, linux-realtime, linux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle, linux-oracle-6.8, linux-aws-5.15, linux-kvm, linux-azure, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oem-6.11, linux-oem-6.8, linux-realtime, smarty, and snakeyaml).

Bypassing Ubuntu's user-namespace restrictions

Par : jzb
27 mars 2025 à 20:51

Ubuntu 23.10 and 24.04 LTS introduced a feature using AppArmor to restrict access to user namespaces. Qualys has reported three ways to bypass AppArmor's restrictions and enable local users to gain full administrative capabilities within a user namespace. Ubuntu has followed up with a post that explains the namespace-restriction feature in detail, and says these bypasses do not constitute security vulnerabilities.

While a superficial observation of the application of user namespaces may indicate privileged (root level) access, this is a fictitious state that is operating as expected, with access control still mapped to the real (root namespace) user's permissions. As such, these bypasses do not enable more access than what the default Linux kernel unprivileged user namespace feature allows in most Linux distributions. They do, however, demonstrate limitations that we are looking to address in order to strengthen existing protections against as-of-yet-unknown Linux kernel vulnerabilities.

LWN covered Ubuntu 24.04 LTS last May.

Rust adopting Ferrocene Language Specification

Par : daroc
27 mars 2025 à 19:38

One recurring criticism of Rust has been that the language has no official specification. This is a barrier to adoption in some safety-conscious organizations, as well as to writing alternate language implementations. Now, the Rust project has announced that it will be adopting the Ferrocene Language Specification (FLS) developed by Ferrous Systems and maintaining it as part of the core project. While this may not satisfy die-hard standardization-process enthusiasts, it's a step toward removing another barrier to using Rust in safety-critical systems.

It's in that light that we're pleased to announce that we'll be adopting the FLS into the Rust Project as part of our ongoing specification efforts. This adoption is being made possible by the gracious donation of the FLS by Ferrous Systems. We're grateful to them for the work they've done in assembling the FLS, in making it fit for qualification purposes, in promoting its use and the use of Rust generally in safety-critical industries, and now, for working with us to take the next step and to bring the FLS into the Project.
❌
❌