{"id":100612,"date":"2021-06-28T10:23:04","date_gmt":"2021-06-28T08:23:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-yadra-linux-5-13"},"modified":"2021-06-28T10:23:04","modified_gmt":"2021-06-28T08:23:04","slug":"reliz-yadra-linux-5-13","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-yadra-linux-5-13","title":{"rendered":"Uvoln\u011bn\u00ed j\u00e1dra Linux 5.13","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Po dvou m\u011bs\u00edc\u00edch v\u00fdvoje p\u0159edstavil Linus Torvalds vyd\u00e1n\u00ed j\u00e1dra Linux 5.13. Mezi nejv\u00fdznamn\u011bj\u0161\u00edmi zm\u011bnami jsou: souborov\u00fd syst\u00e9m EROFS, po\u010d\u00e1te\u010dn\u00ed podpora \u010dip\u016f Apple M1, cgroup kontroler \u201emisc\u201c, ukon\u010den\u00ed podpory \/dev\/kmem, podpora nov\u00fdch GPU od Intelu a AMD, mo\u017enost p\u0159\u00edm\u00e9ho vol\u00e1n\u00ed funkc\u00ed j\u00e1dra z BPF program\u016f, randomizace z\u00e1sobn\u00edku j\u00e1dra pro ka\u017ed\u00fd syst\u00e9mov\u00fd hovor, mo\u017enost sestaven\u00ed s Clang s ochranou CFI (Control Flow Integrity), LSM modul Landlock pro dodate\u010dn\u00e9 omezen\u00ed proces\u016f, virtu\u00e1ln\u00ed zvukov\u00e9 za\u0159\u00edzen\u00ed zalo\u017een\u00e9 na virtio a multi-shot re\u017eim v io_uring.       <\/p>\n<p>V nov\u00e9 verzi bylo p\u0159ijato 17189 oprav od 2150 v\u00fdvoj\u00e1\u0159\u016f (nejv\u00edce v historii), velikost patche je 60 MB (zm\u011bny se dotkly 12996 soubor\u016f, bylo p\u0159id\u00e1no 794705 \u0159\u00e1dk\u016f k\u00f3du, odstran\u011bno 399590 \u0159\u00e1dk\u016f). P\u0159ibli\u017en\u011b 47% v\u0161ech zm\u011bn v 5.13 se t\u00fdk\u00e1 ovlada\u010d\u016f za\u0159\u00edzen\u00ed, asi 14% zm\u011bn souvis\u00ed s aktualizac\u00ed k\u00f3du specifick\u00e9ho pro hardwarov\u00e9 architektury, 13% se t\u00fdk\u00e1 s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku, 5% - souborov\u00fdch syst\u00e9m\u016f a 4% vnit\u0159n\u00edch subsyst\u00e9m\u016f j\u00e1dra.    <\/p>\n<p>Hlavn\u00ed novinky:  <\/p>\n<ul>\n<li class=\"l\"> <b>Diskov\u00fd subsyst\u00e9m, vstup\/v\u00fdstup a souborov\u00e9 syst\u00e9my<\/b>\n<ul>\n<li class=\"l\"> Byla p\u0159id\u00e1na podpora souborov\u00e9ho syst\u00e9mu EROFS (Enhanced Read-Only File System), kter\u00fd navrhla spole\u010dnost Huawei pro pou\u017eit\u00ed na odd\u00edlech dostupn\u00fdch v re\u017eimu pouze pro \u010dten\u00ed. Nov\u00fd syst\u00e9m podporuje uchov\u00e1v\u00e1n\u00ed dat ve zhu\u0161t\u011bn\u00e9 podob\u011b a ve srovn\u00e1n\u00ed s Ext4 vykazuje podobn\u00fd v\u00fdkon p\u0159i prov\u00e1d\u011bn\u00ed operac\u00ed sekven\u010dn\u00edho \u010dten\u00ed, ale n\u011bkolikan\u00e1sobn\u011b p\u0159ed\u010d\u00ed Ext4 p\u0159i n\u00e1hodn\u00e9m p\u0159\u00edstupu k dat\u016fm. Nap\u0159\u00edklad p\u0159i \u00farovni komprese 4 a testov\u00e1n\u00ed na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/dts-dronten\/\"   title=\"serveru\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2637\">serveru<\/a> s pevn\u00fdm diskem syst\u00e9m EROFS p\u0159ekonal Ext4 v operac\u00edch n\u00e1hodn\u00e9ho \u010dten\u00ed v\u00edce ne\u017e \u0161estkr\u00e1t, a p\u0159i pou\u017eit\u00ed smartphonu Android s Flash t\u00e9m\u011b\u0159 t\u0159ikr\u00e1t. Stejn\u011b jako v jin\u00fdch read-only souborov\u00fdch syst\u00e9mech je struktura EROFS v\u00fdrazn\u011b zjednodu\u0161ena d\u00edky vynech\u00e1n\u00ed n\u011bkter\u00fdch oblast\u00ed metadata, jako je bitmapa voln\u00fdch blok\u016f.\n<li class=\"l\"> Pro souborov\u00fd syst\u00e9m SMB3 byla implementov\u00e1na mo\u017enost mont\u00e1\u017ee \u201erasize\u201c, pomoc\u00ed kter\u00e9 lze ur\u010dit velikost okna p\u0159edb\u011b\u017en\u00e9ho \u010dten\u00ed (readahead) pro zv\u00fd\u0161en\u00ed v\u00fdkonu n\u011bkter\u00fdch typ\u016f z\u00e1t\u011b\u017ee.\n<li class=\"l\"> V syst\u00e9mu ext4 byla zaji\u0161t\u011bna p\u0159ekreslen\u00ed prvk\u016f adres\u00e1\u0159\u016f p\u0159i odstra\u0148ov\u00e1n\u00ed soubor\u016f. V ext4 je tak\u00e9 povoleno sou\u010dasn\u00e9 pou\u017e\u00edv\u00e1n\u00ed re\u017eimu bez ohledu na velikost p\u00edsmen a \u0161ifrov\u00e1n\u00ed.\n<li class=\"l\"> Ve \u0444\u0430\u0439\u043b\u043e\u0432\u00e9 sad\u011b exFAT byla p\u0159id\u00e1na podpora p\u0159\u00edkazu ioctl FITRIM (discard), kter\u00fd informuje \u00falo\u017ei\u0161t\u011b o nevyu\u017e\u00edvan\u00fdch bloc\u00edch v syst\u00e9mu soubor\u016f.\n<li class=\"l\"> Ve \u0444\u0430\u0439\u043b\u043e\u0432\u00e9 sad\u011b XFS byla p\u0159id\u00e1na mo\u017enost uvoln\u011bn\u00ed m\u00edsta z posledn\u00ed skupiny alokace ve FS, co\u017e se stalo prvn\u00edm krokem v realizaci funkce zmen\u0161en\u00ed velikosti existuj\u00edc\u00edch odd\u00edl\u016f se syst\u00e9mu soubor\u016f XFS.\n<li class=\"l\"> Byl p\u0159id\u00e1n nov\u00fd syst\u00e9mov\u00fd vol\u00e1n\u00ed quotactl_path, kter\u00e9 se li\u0161\u00ed od quotactl t\u00edm, \u017ee umo\u017e\u0148uje spravovat kv\u00f3ty nikoli prost\u0159ednictv\u00edm speci\u00e1ln\u00edho za\u0159\u00edzen\u00ed, ale zad\u00e1n\u00edm cesty k bodu p\u0159ipojen\u00ed FS.\n<li class=\"l\"> V mechanismu fanotify byly roz\u0161\u00ed\u0159eny mo\u017enosti dostupn\u00e9 pro nep\u0159ihl\u00e1\u0161en\u00e9 u\u017eivatele. Nap\u0159\u00edklad podobn\u011b jako v inotify je nyn\u00ed mo\u017en\u00e9 bez pr\u00e1v SYS_CAP_ADMIN sledovat ud\u00e1losti OPEN, ACCESS, MODIFY a CLOSE pro soubory a adres\u00e1\u0159e.                                    <\/ul>\n<li class=\"l\"> <b>Pam\u011b\u0165 a syst\u00e9mov\u00e9 slu\u017eby<\/b>\n<ul>\n<li class=\"l\"> Byl p\u0159id\u00e1n nov\u00fd cgroup kontroler - \u201eMisc\u201c (CONFIG_CGROUP_MISC), ur\u010den\u00fd pro omezen\u00ed a sledov\u00e1n\u00ed pr\u016fb\u011b\u017en\u00fdch zdroj\u016f, kter\u00e9 lze spravovat pomoc\u00ed jednoduch\u00e9ho po\u010d\u00edtadla a omezovat nastaven\u00edm maxim\u00e1ln\u011b povolen\u00fdch hodnot. Jako p\u0159\u00edklad pou\u017eit\u00ed nov\u00e9ho cgroup kontroleru se zmi\u0148uje spr\u00e1va identifik\u00e1tor\u016f adresn\u00edho prostoru pou\u017e\u00edvan\u00fdch v mechanismu AMD SEV (Secure Encrypted Virtualization).\n<li class=\"l\"> V rozhran\u00ed asynchronn\u00edho vstupu\/v\u00fdstupu io_uring pro \u017e\u00e1dosti POLL byl implementov\u00e1n re\u017eim \u201emulti-shot\u201c, p\u0159i kter\u00e9m POLL nen\u00ed po vygenerov\u00e1n\u00ed ud\u00e1losti odstran\u011bn, ale z\u016fst\u00e1v\u00e1 aktivn\u00ed a m\u016f\u017ee generovat v\u00edce ud\u00e1lost\u00ed.\n<li class=\"l\"> Z realtime-v\u011btve j\u00e1dra byl p\u0159esunut k\u00f3d, kter\u00fd zaji\u0161\u0165uje zpracov\u00e1n\u00ed softwarov\u011b generovan\u00fdch p\u0159eru\u0161en\u00ed v j\u00e1drov\u00fdch vl\u00e1knech, co\u017e umo\u017e\u0148uje jejich nahrazen\u00ed prioritn\u011bj\u0161\u00edmi procesy.\n<li class=\"l\"> Byla p\u0159id\u00e1na intern\u00ed knihovna netfs, do kter\u00e9 byly vy\u010dlen\u011bny typov\u00e9 funkce pou\u017e\u00edvan\u00e9 v s\u00ed\u0165ov\u00fdch souborov\u00fdch syst\u00e9mech.\n<li class=\"l\"> Pro architekturu PowerPC byla implementov\u00e1na podpora prostor\u016f jmen pro \u010das (time namespaces), kter\u00e1 umo\u017e\u0148uje v kontejneru pou\u017e\u00edvat sv\u016fj vlastn\u00ed \u010das.\n<li class=\"l\"> Pro architekturu RISC-V byla implementov\u00e1na podpora kexec, crash dump, kprobe a spu\u0161t\u011bn\u00ed j\u00e1dra p\u0159\u00edmo (execute-in-place, prov\u00e1d\u011bn\u00ed z p\u016fvodn\u00edho m\u00e9dia bez kop\u00edrov\u00e1n\u00ed do RAM).\n<li class=\"l\"> V BPF programech pro trasov\u00e1n\u00ed se objevila mo\u017enost pou\u017eit\u00ed \u00falo\u017ei\u0161t\u011b dat lokalizovan\u00e9ho pro \u00falohu (task-local storage), kter\u00e9 poskytuje vy\u0161\u0161\u00ed v\u00fdkon d\u00edky p\u0159i\u0159azen\u00ed dat konkr\u00e9tn\u00edmu BPF zpracovateli.\n<li class=\"l\"> Byl zaveden nov\u00fd mechanismus pro p\u0159\u00edm\u00e9 vol\u00e1n\u00ed funkc\u00ed j\u00e1dra z program\u016f BPF, kter\u00fd ji\u017e byl pou\u017eit p\u0159i implementaci algoritm\u016f p\u0159et\u00ed\u017een\u00ed TCP. Pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti mus\u00ed b\u00fdt volan\u00e9 funkce v\u00fdslovn\u011b uvedeny v b\u00edl\u00e9m seznamu.\n<li class=\"l\"> Do syst\u00e9mu sledov\u00e1n\u00ed funkc\u00ed ftrace byla p\u0159id\u00e1na mo\u017enost func-no-repeats, kter\u00e1 umo\u017e\u0148uje zaznamen\u00e1vat opakuj\u00edc\u00ed se sekven\u010dn\u00ed vol\u00e1n\u00ed funkce formou \u010d\u00edta\u010de.\n<li class=\"l\"> Do syst\u00e9mov\u00e9ho vol\u00e1n\u00ed userfaultfd(), ur\u010den\u00e9ho pro zpracov\u00e1n\u00ed page faults (p\u0159\u00edstupy k nep\u0159id\u011blen\u00fdm str\u00e1nk\u00e1m pam\u011bti) v prostoru u\u017eivatele, byla p\u0159id\u00e1na mo\u017enost spr\u00e1vy \u010d\u00e1ste\u010dn\u00fdch fault\u016f, kdy str\u00e1nka pam\u011bti existuje, ale nen\u00ed z\u00e1znam v tabulce str\u00e1nek pam\u011bti.\n<li class=\"l\"> Byla ukon\u010dena podpora speci\u00e1ln\u00edho souboru \/dev\/kmem, pomoc\u00ed kter\u00e9ho je mo\u017en\u00e9 p\u0159istupovat ke v\u0161emu adresn\u00edmu prostoru j\u00e1dra. Tento soubor byl uzn\u00e1n za zastaral\u00fd a vytv\u00e1\u0159ej\u00edc\u00ed bezpe\u010dnostn\u00ed probl\u00e9my.\n<li class=\"l\"> Pro \u010dipy Intel byl zaveden nov\u00fd ovlada\u010d pro spr\u00e1vu chlazen\u00ed, kter\u00fd umo\u017e\u0148uje sni\u017eovat frekvenci procesoru v p\u0159\u00edpad\u011b nebezpe\u010d\u00ed p\u0159eh\u0159\u00e1t\u00ed. Na rozd\u00edl od st\u00e1vaj\u00edc\u00edho mechanismu aktivace TCC (Thermal Control Circuit) nov\u00fd ovlada\u010d manipuluje s relativn\u00edmi hodnotami, tj. m\u016f\u017ee sn\u00ed\u017eit frekvenci na za\u010d\u00e1tku v\u00fdrazn\u00e9ho n\u00e1r\u016fstu teploty, ani\u017e by \u010dekal na p\u0159ekro\u010den\u00ed kritick\u00e9 prahov\u00e9 hodnoty.                <\/ul>\n<li class=\"l\"> <b>Virtualizace a bezpe\u010dnost<\/b>\n<ul>\n<li class=\"l\"> Do slo\u017een\u00ed byl zahrnut LSM modul pro zaji\u0161t\u011bn\u00ed izolace aplikac\u00ed Landlock, kter\u00fd umo\u017e\u0148uje omezit interakci s extern\u00edm prost\u0159ed\u00edm skupiny proces\u016f a byl vyvinut s ohledem na takov\u00e9 mechanismy izolace, jako jsou XNU Sandbox, FreeBSD Capsicum a OpenBSD Pledge\/Unveil. Logika poskytov\u00e1n\u00ed p\u0159\u00edstupu je ur\u010dena pomoc\u00ed BPF programu, ale na rozd\u00edl od seccomp-bpf, Landlock nefiltruje syst\u00e9mov\u00e9 vol\u00e1n\u00ed a jejich argumenty, ale umo\u017e\u0148uje omezit pou\u017eit\u00ed objekt\u016f j\u00e1dra, jako jsou hierarchie soubor\u016f. Pomoc\u00ed Landlocku m\u016f\u017ee ka\u017ed\u00fd proces, v\u010detn\u011b nep\u0159ivilegovan\u00fdch, bezpe\u010dn\u011b izolovat s\u00e1m sebe a zabr\u00e1nit obch\u00e1zen\u00ed izolace v p\u0159\u00edpad\u011b zji\u0161t\u011bn\u00ed zranitelnost\u00ed nebo \u0161kodliv\u00fdch zm\u011bn v aplikaci. Landlock umo\u017e\u0148uje procesu vytv\u00e1\u0159et chr\u00e1n\u011bn\u00e1 izolovan\u00e1 prost\u0159ed\u00ed, implementovan\u00e1 ve form\u011b dal\u0161\u00ed vrstvy nad st\u00e1vaj\u00edc\u00edmi syst\u00e9mov\u00fdmi mechanismy \u0159\u00edzen\u00ed p\u0159\u00edstupu. Nap\u0159\u00edklad program m\u016f\u017ee zak\u00e1zat p\u0159\u00edstup k soubor\u016fm mimo pracovn\u00ed adres\u00e1\u0159.\n<li class=\"l\"> Byla p\u0159id\u00e1na mo\u017enost randomizace ofset\u016f v j\u00e1drov\u00e9m z\u00e1sobn\u00edku p\u0159i zpracov\u00e1n\u00ed syst\u00e9mov\u00fdch vol\u00e1n\u00ed s c\u00edlem zt\u00ed\u017eit \u00fatoky na z\u00e1sobn\u00edk. Podstata navrhovan\u00e9 ochrany spo\u010d\u00edv\u00e1 ve v\u00fdb\u011bru n\u00e1hodn\u00e9ho ofsetu z\u00e1sobn\u00edku p\u0159i ka\u017ed\u00e9m syst\u00e9mov\u00e9m vol\u00e1n\u00ed, co\u017e zt\u011b\u017euje ur\u010den\u00ed rozlo\u017een\u00ed z\u00e1sobn\u00edku v pam\u011bti, i kdy\u017e jsou k dispozici informace o adres\u00e1ch, nebo\u0165 p\u0159i dal\u0161\u00edm syst\u00e9mov\u00e9m vol\u00e1n\u00ed se z\u00e1kladn\u00ed adresa z\u00e1sobn\u00edku zm\u011bn\u00ed. Pro aktivaci randomizace byly navr\u017eeny parametry p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku j\u00e1dra \u201erandomize_kstack_offset=on\/off\u201c a nastaven\u00ed CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT. N\u00e1kldy se odhaduj\u00ed na p\u0159ibli\u017en\u011b 1% ztr\u00e1tu v\u00fdkonu.\n<li class=\"l\"> Byla p\u0159id\u00e1na podpora sestaven\u00ed j\u00e1dra s aktivac\u00ed mechanismu ochrany CFI (Control Flow Integrity) v kompil\u00e1toru Clang, kter\u00fd p\u0159id\u00e1v\u00e1 p\u0159ed ka\u017ed\u00fdm nep\u0159\u00edm\u00fdm vol\u00e1n\u00edm funkce kontroly pro identifikaci n\u011bkter\u00fdch forem nedefinovan\u00e9ho chov\u00e1n\u00ed, kter\u00e9 mohou potenci\u00e1ln\u011b v\u00e9st k naru\u0161en\u00ed norm\u00e1ln\u00edho po\u0159ad\u00ed vykon\u00e1v\u00e1n\u00ed (control flow) v d\u016fsledku pou\u017eit\u00ed exploit\u016f, kter\u00e9 m\u011bn\u00ed v pam\u011bti ulo\u017een\u00e9 ukazatele na funkce. Pro aktivaci CFI byl navr\u017een parametr CONFIG_CFI_CLANG.\n<li class=\"l\"> V poskytovan\u00e9 slu\u017eb\u011b j\u00e1dra pro ukl\u00e1d\u00e1n\u00ed \u0161ifrovac\u00edch kl\u00ed\u010d\u016f (key ring) nyn\u00ed mechanismus d\u016fv\u011bryhodn\u00fdch kl\u00ed\u010d\u016f (Trusted Keys) pokr\u00fdv\u00e1 nejen kl\u00ed\u010de z modul\u016f TPM, ale tak\u00e9 z prost\u0159ed\u00ed TEE (Trusted Execution Environment). Pro spr\u00e1vu zdroje d\u016fv\u011bryhodn\u00fdch kl\u00ed\u010d\u016f byl navr\u017een spou\u0161t\u011bc\u00ed parametr \u201etrusted.source\u201c. Krom\u011b toho byla p\u0159 p\u0159id\u00e1na mo\u017enost zpracov\u00e1n\u00ed d\u016fv\u011bryhodn\u00fdch kl\u00ed\u010d\u016f ve form\u00e1tu ASN.1.\n<li class=\"l\"> Byl p\u0159id\u00e1n parametr pro proaktivn\u00ed na\u010d\u00edt\u00e1n\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f b\u011bhem zav\u00e1d\u011bn\u00ed j\u00e1dra. Byla vy\u0159e\u0161ena chyba (CVE-2020-26541) s ignorov\u00e1n\u00edm \u010dern\u00e9ho seznamu certifik\u00e1t\u016f Secure Boot UEFI dodan\u00fdch ve form\u00e1tu EFI_CERT_X509_GUID, co\u017e umo\u017enilo zav\u00e9st syst\u00e9m s odvolan\u00fdm certifik\u00e1tem.\n<li class=\"l\"> Do kryptosyst\u00e9mu j\u00e1dra byla p\u0159id\u00e1na podpora pro ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f ECDSA zalo\u017een\u00fdch na eliptick\u00fdch k\u0159ivk\u00e1ch.\n<li class=\"l\"> Byla implementov\u00e1na mo\u017enost ov\u011b\u0159ov\u00e1n\u00ed politik SELinux pomoc\u00ed subsyst\u00e9mu IMA (Integrity Measurement Architecture), kter\u00fd zaji\u0161\u0165uje udr\u017eov\u00e1n\u00ed datab\u00e1ze hash\u016f pro kontrolu integrity dat.                              <\/ul>\n<li class=\"l\"> <b>S\u00ed\u0165ov\u00e1 subsyst\u00e9m<\/b>\n<ul>\n<li class=\"l\"> Byla zru\u0161ena podpora technologie WiMAX, kter\u00e1 ji\u017e nen\u00ed pou\u017e\u00edv\u00e1na v ve\u0159ejn\u00fdch s\u00edt\u00edch, a v j\u00e1d\u0159e z\u016fst\u00e1v\u00e1 jedin\u00fdm ovlada\u010dem, s n\u00edm\u017e lze pou\u017e\u00edvat WiMAX, zastaral\u00fd ovlada\u010d Intel 2400m. V s\u00ed\u0165ov\u00e9m konfigurova\u010di NetworkManager byla podpora WiMAX ukon\u010dena v roce 2015. V sou\u010dasn\u00e9 dob\u011b je WiMax prakticky zcela vytla\u010dena takov\u00fdmi technologiemi, jako jsou LTE, HSPA+ a Wi-Fi 802.11n.\n<li class=\"l\"> Byl p\u0159id\u00e1n ovlada\u010d pro s\u00ed\u0165ov\u00fd adapt\u00e9r MANA (Microsoft Azure Network Adapter).\n<li class=\"l\"> Do ovlada\u010de ath11k byla p\u0159id\u00e1na podpora bezdr\u00e1tov\u00fdch modul\u016f Qualcomm QCN9074 s podporou 802.11ax.\n<li class=\"l\"> V ovlada\u010di iwlwifi byla implementov\u00e1na mo\u017enost pasivn\u00edho skenov\u00e1n\u00ed kan\u00e1l\u016f v p\u00e1smu 6GHz. Pro Ukrajinu byla p\u0159id\u00e1na podpora zapnut\u00ed\/vypnut\u00ed IEEE 802.11ax na z\u00e1klad\u011b parametr\u016f v BIOSu.\n<li class=\"l\"> Byla provedena optimalizace subsyst\u00e9mu XDP (eXpress Data Path), kter\u00e1 umo\u017e\u0148uje manipulaci se s\u00ed\u0165ov\u00fdmi pakety ve st\u00e1diu p\u0159ed jejich zpracov\u00e1n\u00edm s\u00ed\u0165ov\u00fdm stekem j\u00e1dra Linux. Prov\u00e1d\u011bn\u00e9 testy vykazuj\u00ed zv\u00fd\u0161en\u00ed v\u00fdkonu XDP o 4-8%. Pro za\u0159\u00edzen\u00ed virtio m\u016f\u017ee n\u00e1r\u016fst v\u00fdkonu softwarov\u00e9ho zpracov\u00e1n\u00ed AF_XDP dosahovat 33%.\n<li class=\"l\"> V ICMP byla implementov\u00e1na podpora roz\u0161\u00ed\u0159en\u00fdch PROBE zpr\u00e1v definovan\u00fdch v RFC 8335.\n<li class=\"l\"> Pokra\u010duje integrace roz\u0161\u00ed\u0159en\u00ed protokolu TCP MPTCP (MultiPath TCP) do j\u00e1dra pro organizaci TCP p\u0159ipojen\u00ed s doru\u010dov\u00e1n\u00edm paket\u016f sou\u010dasn\u011b n\u011bkolika r\u016fzn\u00fdmi trasami prost\u0159ednictv\u00edm r\u016fzn\u00fdch s\u00ed\u0165ov\u00fdch rozhran\u00ed, p\u0159ipojen\u00fdch k r\u016fzn\u00fdm. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/lir\/ipv4\/\"   title=\"IP adresy\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4455\">IP adresy<\/a>. V nov\u00e9 verzi byla p\u0159id\u00e1na podpora sockopt pro nastaven\u00ed typov\u00fdch voleb TCP. Byla implementov\u00e1na mo\u017enost resetov\u00e1n\u00ed jednotliv\u00fdch subproces\u016f (subflow).\n<li class=\"l\"> V netfilter byla p\u0159id\u00e1na podpora spr\u00e1vy zdroj\u016f pomoc\u00ed sjednocen\u00e9 hierarchie cgroups v2.\n<li class=\"l\"> V ethtool byl implementov\u00e1n rozhran\u00ed pro \u010dten\u00ed statistik IEEE MIB s podporou mlx5 a bnxt. S\u00ed\u0165ov\u00fdm ovlada\u010d\u016fm bylo povoleno z\u00edsk\u00e1v\u00e1n\u00ed libovoln\u00fdch dat z SFP EEPROM, manipuluj\u00edc\u00edmi nikoli p\u00e1rov\u00e1n\u00edm offset + velikost, ale str\u00e1nkami pam\u011bti.        <\/ul>\n<li class=\"l\"> <b>Hardware<\/b>\n<ul>\n<li class=\"l\"> Byla implementov\u00e1na po\u010d\u00e1te\u010dn\u00ed podpora ARM \u010dipu Apple M1, zahrnuj\u00edc\u00ed \u0159adi\u010d p\u0159eru\u0161en\u00ed, \u010dasova\u010d, UART, SMP, funkce pro organizaci vstupu\/v\u00fdstupu a MMIO. Zp\u011btn\u00e9 in\u017een\u00fdrstv\u00ed GPU zat\u00edm nebylo dokon\u010deno, pro organizaci v\u00fdstupu je poskytov\u00e1na podpora r\u00e1mcov\u00e9ho bufferu a konzole p\u0159es s\u00e9riov\u00fd port.\n<li class=\"l\"> Pokra\u010duje \u00faklid j\u00e1dra od star\u00fdch ovlada\u010d\u016f, byly odstran\u011bny ovlada\u010de \u201egasket\u201c (Google ASIC), \u201esysace\u201c, \u201eumem\u201c a n\u011bkolik star\u00fdch ovlada\u010d\u016f pro s\u00e9riov\u00e9 porty.\n<li class=\"l\"> Po 13 letech v stagingov\u00e9 v\u011btvi byl stabilizov\u00e1n a p\u0159enesen do hlavn\u00edho j\u00e1dra ovlada\u010d \u201ecomedi\u201c pro podporu za\u0159\u00edzen\u00ed pro sb\u011br dat.\n<li class=\"l\"> Byl p\u0159id\u00e1n ovlada\u010d GUD (Generic USB Display) s implementac\u00ed z\u00e1kladn\u00edho ovlada\u010de pro obrazovky a TV adapt\u00e9ry p\u0159ipojiteln\u00e9 p\u0159es rozhran\u00ed USB. Ovlada\u010d poskytuje vlastnosti DRM (Direct Rendering Manager) pro rotaci obrazu, \u0159\u00edzen\u00ed jasu, p\u0159\u00edstup k EDID, nastaven\u00ed video re\u017eim\u016f a p\u0159ipojen\u00ed TV, kter\u00e9 mohou slou\u017eit jako z\u00e1klad pro vytv\u00e1\u0159en\u00ed ovlada\u010d\u016f pro specifick\u00e1 za\u0159\u00edzen\u00ed.\n<li class=\"l\"> Byl p\u0159id\u00e1n zvukov\u00fd ovlada\u010d \u201evirtio\u201c s implementac\u00ed virtu\u00e1ln\u00edho zvukov\u00e9ho za\u0159\u00edzen\u00ed, kter\u00e9 lze pou\u017e\u00edt v hostitelsk\u00fdch syst\u00e9mech pro p\u0159ehr\u00e1v\u00e1n\u00ed a nahr\u00e1v\u00e1n\u00ed zvuku bez nutnosti p\u0159\u00edstupu k zvukov\u00e9 kart\u011b a bez emulace.\n<li class=\"l\"> Do ovlada\u010de amdgpu byla p\u0159id\u00e1na po\u010d\u00e1te\u010dn\u00ed podpora GPU Aldebaran (gfx90a). Byla aktivov\u00e1na po\u010d\u00e1te\u010dn\u00ed podpora technologie adaptivn\u00ed synchronizace FreeSync pro HDMI (d\u0159\u00edve dostupn\u00e1 pro DisplayPort), kter\u00e1 umo\u017e\u0148uje upravit obnovovac\u00ed frekvenci zobrazen\u00ed. Byla p\u0159id\u00e1na podpora ASSR (Alternate Scrambler Seed Reset). P\u0159id\u00e1n ioctl pro dotazy na schopnosti souvisej\u00edc\u00ed s k\u00f3dov\u00e1n\u00edm a dek\u00f3dov\u00e1n\u00edm videa. Byl p\u0159id\u00e1n re\u017eim CONFIG_DRM_AMD_SECURE_DISPLAY pro detekci zm\u011bn na displej\u00edch zobrazuj\u00edc\u00edch kritick\u00e9 informace. P\u0159id\u00e1na podpora mechanismu \u00faspory energie ASPM.\n<li class=\"l\"> Do ovlada\u010de i915 pro grafick\u00e9 karty Intel byla p\u0159id\u00e1na podpora \u010dip\u016f Intel Alderlake-S. P\u0159id\u00e1na podpora eDP MSO (Embedded DisplayPort Multi-SST Operation).\n<li class=\"l\"> Byla p\u0159id\u00e1na podpora hern\u00edho ovlada\u010de Luna (Amazon) a tak\u00e9 dotykov\u00fdch obrazovek Hycon HY46XX, ILITEK Lego Series a MStar MSG2638.      <\/ul>\n<\/ul>\n<p>Sou\u010dasn\u011b latinskoamerick\u00e1 Nadace pro svobodn\u00fd software vytvo\u0159ila variantu pln\u011b svobodn\u00e9ho j\u00e1dra 5.11 \u2014 Linux-libre 5.11-gnu, o\u010dist\u011bn\u00e9ho od prvk\u016f firmwaru a ovlada\u010d\u016f, kter\u00e9 obsahuj\u00ed nesvobodn\u00e9 komponenty nebo \u00faseky k\u00f3du, jejich\u017e pou\u017eit\u00ed je omezeno v\u00fdrobcem. V nov\u00e9m vyd\u00e1n\u00ed byla provedena o\u010dista ovlada\u010de comedi. O\u010dista ovlada\u010d\u016f cyclades, isicom tty a i2400m wimax, kter\u00e9 byly odstran\u011bny z j\u00e1dra, byla ukon\u010dena. K\u00f3d pro \u010di\u0161t\u011bn\u00ed blob\u016f v ovlada\u010d\u00edch a subsyst\u00e9mech amdgpu, i915 csr, r8152 usb, mhi bus, x86 touchscreen a qualcomm arm64 byl aktualizov\u00e1n.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55397\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0434\u0432\u0443\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0440\u0435\u043b\u0438\u0437 \u044f\u0434\u0440\u0430 Linux 5.13. \u0421\u0440\u0435\u0434\u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u043c\u0435\u0442\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439: \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 EROFS, \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0447\u0438\u043f\u043e\u0432 Apple M1, cgroup-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440 &#171;misc&#187;, \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \/dev\/kmem, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u043d\u043e\u0432\u044b\u0445 GPU Intel \u0438 AMD, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u044f\u0434\u0440\u0430 \u0438\u0437 BPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0438 \u0432 Clang \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 CFI [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100612","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0434\u0432\u0443\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0440\u0435\u043b\u0438\u0437 \u044f\u0434\u0440\u0430 Linux 5.13.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-yadra-linux-5-13\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 \u044f\u0434\u0440\u0430 Linux 5.13 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0434\u0432\u0443\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0440\u0435\u043b\u0438\u0437 \u044f\u0434\u0440\u0430 Linux 5.13.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-yadra-linux-5-13\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-06-28T08:23:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-06-28T08:23:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vyd\u00e1n\u00ed j\u00e1dra Linux 5.13 | ProHoster","description":"Po dvou m\u011bs\u00edc\u00edch v\u00fdvoje Linus Torvalds p\u0159edstavil vyd\u00e1n\u00ed j\u00e1dra Linux 5.13.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-yadra-linux-5-13","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 \u044f\u0434\u0440\u0430 Linux 5.13 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0434\u0432\u0443\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041b\u0438\u043d\u0443\u0441 \u0422\u043e\u0440\u0432\u0430\u043b\u044c\u0434\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0440\u0435\u043b\u0438\u0437 \u044f\u0434\u0440\u0430 Linux 5.13.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-yadra-linux-5-13","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-28T08:23:04+00:00","article:modified_time":"2021-06-28T08:23:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100612","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-28 08:57:57","updated":"2026-02-09 21:38:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=100612"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100612\/revisions"}],"predecessor-version":[{"id":164333,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100612\/revisions\/164333"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=100612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=100612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=100612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}