{"id":99149,"date":"2021-02-16T16:22:46","date_gmt":"2021-02-16T14:22:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-yadra-linux-5-11"},"modified":"2021-02-16T16:22:46","modified_gmt":"2021-02-16T14:22:46","slug":"reliz-yadra-linux-5-11","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-yadra-linux-5-11","title":{"rendered":"Linux kernel version 5.11","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After two months of development, Linus Torvalds released the Linux kernel 5.11. Among the most notable changes are: support for Intel SGX enclaves, a new system call interception mechanism, an auxiliary virtual bus, a prohibition on building modules without MODULE_LICENSE(), a quick filtering mode for system calls in seccomp, the discontinuation of support for the ia64 architecture, the relocation of WiMAX technology to the 'staging' branch, and the capability to encapsulate SCTP in UDP. <\/p>\n
The new version includes 15,480 fixes from 1,991 developers, with the patch size being 72 MB (the changes affected 12,090 files, added 868,025 lines of code, and removed 261,456 lines). Approximately 46% of the contributions in 5.11 are related to device drivers, around 16% pertain to updates in architecture-specific code, 13% involve the networking stack, 3% address file systems, and 4% concern internal kernel subsystems. <\/p>\n
Key innovations: <\/p>\n
\n
Disk subsystem, input\/output, and file systems<\/b>\n
\n
Btrfs has introduced several mount options for use when recovering data from a damaged file system: 'rescue=ignorebadroots' for mounting despite damage to certain root trees (extent, uuid, data reloc, device, csum, free space), 'rescue=ignoredatacsums' to disable checksum verification for data, and 'rescue=all' to simultaneously enable the 'ignorebadroots', 'ignoredatacsums', and 'nologreplay' modes. Support for the 'inode_cache' mount option, which had previously been marked as deprecated, has been discontinued. Code preparation has been conducted to implement support for blocks with metadata and data smaller than a page (PAGE_SIZE), as well as for zoned space allocation mode. Unbuffered (Direct IO) requests have been transitioned to the iomap infrastructure. The performance of several operations has been optimized, with speed increases in some cases reaching several tens of percent.\n
In XFS, the 'needsrepair' flag has been implemented to signal the need for recovery. When this flag is set, the file system cannot be mounted until the flag is cleared by the xfs_repair utility.\n
In Ext4, only bug fixes and optimizations have been proposed, along with code cleaning.\n
The re-export of filesystems mounted over NFS has been allowed (i.e., a partition mounted via NFS can now be exported over NFS and used as an intermediate cache).\n
The system call close_range() has been enhanced with the CLOSE_RANGE_CLOEXEC option, allowing a process to close an entire range of open file descriptors in close-on-exec mode.\n
New ioctl() calls have been added to the F2FS file system, allowing user space to manage which files are stored in compressed form. A mount option 'compress_mode=' has been added to choose the location of the compression control handler on the kernel side or in user space.\n
Overlayfs can now be mounted by unprivileged processes using a separate user namespace. A complete audit of the code has been conducted to verify compliance with the security model. Additionally, Overlayfs has gained the capability to run using copies of filesystem images by optionally disabling UUID checks.\n
The Ceph filesystem has been updated to support the msgr2.1 protocol, which enables the use of the AES-GCM algorithm for encrypted data transmission.\n
The dm-multipath module has implemented the ability to account for CPU affinity when selecting the route for input\/output requests. <\/ul>\n
Memory and system services<\/b>\n
\n
A new mechanism for intercepting system calls has been introduced, based on prctl(), allowing user space to generate exceptions when accessing certain system calls and emulate their execution. This functionality is in demand by Wine and Proton for emulating Windows system calls, which is necessary for compatibility with games and applications that directly invoke system calls bypassing the Windows API (e.g., to prevent unauthorized usage).\n
The userfaultfd() system call, designed to handle page faults (access to unallocated memory pages) in user space, now features the ability to disable exception handling that occurs at the kernel level to complicate the exploitation of certain vulnerabilities.\n
The BPF subsystem has added support for task-local storage, which binds data to a specific BPF handler.\n
Memory consumption tracking for BPF programs has been completely revamped \u2014 instead of using the memlock rlimit for managing memory usage in BPF objects, a cgroup controller is introduced.\n
The BTF (BPF Type Format) mechanism, which provides information for type checking in BPF pseudocode, has implemented support for kernel modules.\n
Support for the system calls shutdown(), renameat2(), and unlinkat() has been added to the io_uring asynchronous I\/O interface. The io_uring_enter() call now allows specifying a timeout (support for the timeout argument can be checked using the IORING_FEAT_EXT_ARG flag).\n
The ia64 architecture used in Intel Itanium processors has been categorized as orphaned, meaning testing has ceased. Hewlett Packard Enterprise has stopped accepting orders for new Itanium hardware, and Intel did this last year.\n
Support for systems based on the MicroBlaze architecture, which are not equipped with a memory management unit (MMU), has been discontinued. Such systems have long been out of everyday use.\n
Support for code coverage testing has been added for the MIPS architecture using the gcov utility.\n
Support for an auxiliary bus has been added to interact with multifunction devices that combine functionalities requiring different drivers (for example, network cards supporting Ethernet and RDMA). The bus can be used to assign a primary and secondary driver for the device in situations where the MFD (Multi-Function Devices) subsystem is problematic to use.\n
Support for the CMA (Contiguous Memory Allocator) memory distribution system has been added for the RISC-V architecture, optimized for allocating large contiguous memory areas using memory page migration techniques. Access restrictions to \/dev\/mem and tracking of interrupt handling time have also been implemented for RISC-V.\n
Support for the KASan (Kernel Address Sanitizer) debugging tool, which detects memory errors, has been added for 32-bit ARM systems. For 64-bit ARM, the KASan implementation has transitioned to using MTE (MemTag) tags.\n
The epoll_pwait2() system call has been added, allowing the use of timeouts with nanosecond precision (the epoll_wait call manipulates milliseconds).\n
The build system now outputs an error when attempting to build core modules that do not define a license for the code using the MODULE_LICENSE() macro. Errors during the build will also be triggered by the use of the EXPORT_SYMBOL() macro for static functions.\n
Added support for mapping GEM objects from memory used for input\/output, which speeds up framebuffer operations on certain architectures.\n
Support for Qt4 has been removed in Kconfig (support for Qt5, GTK, and Ncurses has been retained). <\/ul>\n
Virtualization and Security<\/b>\n
\n
The seccomp() system call has added support for a fast response mode, allowing for very quick determination of whether a particular system call is allowed or blocked based on an attached privilege table (constant-action bitmap) that does not require launching a BPF handler.\n
Core components for creating and managing enclaves based on Intel SGX (Software Guard eXtensions) technology have been integrated, allowing applications to run code in isolated encrypted memory areas, access to which is restricted for the rest of the system.\n
As part of the initiative to limit user space access to MSR (model-specific register) registers, writing to the MSR_IA32_ENERGY_PERF_BIAS register is prohibited, which allows changing the processor's energy efficiency mode ('normal', 'performance', 'powersave').\n
The ability to disable high-priority task migration between CPUs has been ported from the kernel-rt branch for real-time systems.\n
For ARM64 systems, the ability to apply MTE (MemTag, Memory Tagging Extension) tags for memory addresses of signal handlers has been added. Using MTE is enabled by specifying the SA_EXPOSE_TAGBITS option in sigaction() and allows for pointer usage correctness checks to block exploitation of vulnerabilities caused by accessing already freed memory blocks, buffer overflows, pre-initialization accesses, and off-context usage.\n
The parameter 'DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING' has been added, allowing the dm-verity subsystem to verify the hash signatures of certificates stored in the secondary keyring. In practice, this setting allows verification of not only the certificates built into the kernel but also those loaded at runtime, enabling updates to certificates without updating the entire kernel.\n
User-mode Linux has added support for suspend-to-idle mode, which allows freezing the environment and using the SIGUSR1 signal to wake up from sleep mode.\n
The virtio-mem mechanism, which enables hot-plugging and unplugging memory to virtual machines, has added support for Big Block Mode (BBM), allowing memory to be transferred or reclaimed in blocks larger than the kernel's block size, necessary for optimizing VFIO in QEMU.\n
The kernel-level implementation of TLS has been enhanced with support for the CHACHA20-POLY1305 cipher. <\/ul>\n
Network subsystem<\/b>\n
\n
For 802.1Q (VLAN), a Connectivity Fault Management (CFM) mechanism has been implemented, allowing for the detection, verification, and isolation of failures in networks with Virtual Bridged Networks. For instance, CFM can be used to localize problems in networks spanning multiple independent organizations, whose employees only have access to their own equipment.\n
Support has been added for encapsulating SCTP protocol packets within UDP packets (RFC 6951), enabling the use of SCTP in networks with older address translators that do not directly support SCTP, as well as implementing SCTP on systems that do not provide direct access to the IP layer.\n
The implementation of WiMAX technology has been moved to staging and is slated for removal in the future if no users requiring WiMAX are found. WiMAX is no longer used in public networks, and the only driver that can be used for WiMAX in the kernel remains the outdated Intel 2400m driver. Support for WiMAX in the NetworkManager network configurator was discontinued in 2015. Currently, WiMAX has been nearly entirely replaced by technologies such as LTE, HSPA+, and Wi-Fi 802.11n.\n
Efforts have been made to optimize the performance of incoming TCP traffic processing in zerocopy mode, i.e., without additional copying to new buffers. For medium-sized traffic, covering tens or hundreds of kilobytes of data, using zerocopy instead of recvmsg() is significantly more efficient. For example, the implemented changes have achieved a 60-70% improvement in processing efficiency for RPC-style traffic with messages of 32 KB when using zerocopy.\n
New ioctl() calls have been added to create network bridges spanning multiple PPP channels. The proposed feature allows frames to move from one channel to another, for example, from PPPoE to a PPPoL2TP session.\n