Oracle® Linux
Release Notes for Unbreakable Enterprise Kernel Release 3
Copyright (c) 2013, Oracle and/or its affiliates. All rights
reserved.
Oracle Legal Notices
Copyright Notice
Copyright (c) 1994-2013, Oracle and/or its affiliates. All rights
reserved.
Trademark Notice
Oracle and Java are registered trademarks of Oracle and/or its
affiliates. Other names may be trademarks of their respective
owners.
Intel and Intel Xeon are trademarks or registered trademarks of
Intel Corporation. All SPARC trademarks are used under license and
are trademarks or registered trademarks of SPARC International,
Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are
trademarks or registered trademarks of Advanced Micro Devices.
UNIX is a registered trademark of The Open Group.
License Restrictions Warranty/Consequential Damages Disclaimer
This software and related documentation are provided under a
license agreement containing restrictions on use and disclosure
and are protected by intellectual property laws. Except as
expressly permitted in your license agreement or allowed by law,
you may not use, copy, reproduce, translate, broadcast, modify,
license, transmit, distribute, exhibit, perform, publish, or
display any part, in any form, or by any means. Reverse
engineering, disassembly, or decompilation of this software,
unless required by law for interoperability, is prohibited.
Warranty Disclaimer
The information contained herein is subject to change without
notice and is not warranted to be error-free. If you find any
errors, please report them to us in writing.
Restricted Rights Notice
If this is software or related documentation that is delivered to
the U.S. Government or anyone licensing it on behalf of the U.S.
Government, the following notice is applicable:
U.S. GOVERNMENT END USERS: Oracle programs, including any
operating system, integrated software, any programs installed on
the hardware, and/or documentation, delivered to U.S. Government
end users are "commercial computer software" pursuant to the
applicable Federal Acquisition Regulation and agency-specific
supplemental regulations. As such, use, duplication, disclosure,
modification, and adaptation of the programs, including any
operating system, integrated software, any programs installed on
the hardware, and/or documentation, shall be subject to license
terms and license restrictions applicable to the programs. No
other rights are granted to the U.S. Government.
Hazardous Applications Notice
This software or hardware is developed for general use in a
variety of information management applications. It is not
developed or intended for use in any inherently dangerous
applications, including applications that may create a risk of
personal injury. If you use this software or hardware in dangerous
applications, then you shall be responsible to take all
appropriate fail-safe, backup, redundancy, and other measures to
ensure its safe use. Oracle Corporation and its affiliates
disclaim any liability for any damages caused by use of this
software or hardware in dangerous applications.
Third-Party Content, Products, and Services Disclaimer
This software or hardware and documentation may provide access to
or information on content, products, and services from third
parties. Oracle Corporation and its affiliates are not responsible
for and expressly disclaim all warranties of any kind with respect
to third-party content, products, and services. Oracle Corporation
and its affiliates will not be responsible for any loss, costs, or
damages incurred due to your access to or use of third-party
content, products, or services.
Alpha and Beta Draft Documentation Notice Disclaimer
If this document is in preproduction status:
This documentation is in preproduction status and is intended for
demonstration and preliminary use only. It may not be specific to
the hardware on which you are using the software. Oracle
Corporation and its affiliates are not responsible for and
expressly disclaim all warranties of any kind with respect to this
documentation and will not be responsible for any loss, costs, or
damages incurred due to the use of this documentation.
E48380-01
October 2013
Abstract
This document contains information on the Unbreakable Enterprise
Kernel Release 3. This document may be updated after it is
released. To check for updates to this document, and to view other
Oracle documentation, refer to the Documentation section on the
Oracle Technology Network (OTN) Web site:
http://www.oracle.com/technology/documentation/
This document is intended for users and administrators of Oracle
Linux. It describes potential issues and the corresponding
workarounds you may encounter while using the Unbreakable
Enterprise Kernel Release 3 with Oracle Linux 6. Oracle recommends
that you read this document before installing or upgrading the
Unbreakable Enterprise Kernel Release 3.
Document generated on: 2013-10-21 (revision: 1321)
_______________________________________________________
Preface
The Oracle Linux Unbreakable Enterprise Kernel Release Notes
provides a summary of the new features, changes, and known issues
in the Unbreakable Enterprise Kernel Release 3.
Audience
This document is written for system administrators who want to use
the Unbreakable Enterprise Kernel with Oracle Linux. It is assumed
that readers have a general understanding of the Linux operating
system.
Documentation Accessibility
For information about Oracle's commitment to accessibility, visit
the Oracle Accessibility Program website at
http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.
Access to Oracle Support
Oracle customers have access to electronic support through My
Oracle Support. For information, visit
http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit
http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are
hearing impaired.
Related Documents
The latest version of this document and other documentation for
this product are available at:
http://www.oracle.com/technetwork/server-storage/linux/documentati
on/index.html.
Conventions
The following text conventions are used in this document:
Convention
Meaning
boldface
Boldface type indicates graphical user interface elements
associated with an action, or terms defined in text or the
glossary.
italic
Italic type indicates book titles, emphasis, or placeholder
variables for which you supply particular values.
monospace
Monospace type indicates commands within a paragraph, URLs, code
in examples, text that appears on the screen, or text that you
enter.
Chapter 1. New Features and Changes
The Unbreakable Enterprise Kernel Release 3 (UEK R3) is Oracle's
third major release of its heavily tested and optimized operating
system kernel for Oracle Linux 6 on the x86-64 architecture. It is
based on the mainline Linux kernel version 3.8.13.
The 3.8.13-16 release also updates drivers and includes bug and
security fixes.
Oracle actively monitors upstream checkins and applies critical
bug and security fixes to UEK3.
UEK R3 uses the same versioning model as the mainline Linux kernel
version. It is possible that some applications might not
understand the 3.x versioning scheme. If an application does
require a 2.6 context, you can use the uname26 wrapper command to
start it. However, regular Linux applications are usually neither
aware of nor affected by Linux kernel version numbers.
1.1. Notable Changes
The following sections describe the major new features of
Unbreakable Enterprise Kernel Release 3 (UEK R3) relative to UEK
R2. If applicable, the mainline version in which a feature was
introduced is noted in parentheses.
For brief summaries of other changes, see Appendix A, "Other
Changes."
1.1.1. Architecture
* Support for the Intel IVB processor family has been added.
* The efivars module provides an area of firmware-managed,
nonvolatile storage, which can be used as a persistent storage
backend to maintain copies of kernel oopses and aid the
diagnosis of problems. (3.1)
1.1.2. Control Groups and Linux Containers
Control groups (cgroups) and Linux Containers (LXC) are now
supported features. LXC is supported for 64-bit hosts, but not
32-bit hosts (in any case, UEK R3 is not available for the x86
32-bit architecture). Both 32-bit and 64-bit guest containers can
be configured. However, some applications might not be supported
for use with these features.
* The cgroups feature allows you to manage access to system
resources by processes. For more information, see Control
Groups
(http://docs.oracle.com/cd/E37670_01/E37355/html/ol_cgroups.ht
ml).
* LXC is based on the cgroups and namespaces functionality.
Containers allow you to safely and securely run multiple
applications or instances of an operating system on a single
host without risking them interfering with each other.
Containers are lightweight and resource-friendly, which saves
both rack space and power. For more information, see Linux
Containers
(http://docs.oracle.com/cd/E37670_01/E37355/html/ol_containers
.html).
The lxc-attach command is supported by UEK R3 with the
lxc-0.9.0-2.0.4 package. lxc-attach allows you to execute an
arbitrary command inside a running container from outside the
container. For more information, see the lxc-attach(1) manual
page.
Note
To access this feature, use yum update to install the
lxc-0.9.0-2.0.4 package (or later version of this package).
1.1.3. Core Kernel Functionality
* To avoid binary incompatibility in applications that do not
understand the 3.x versioning scheme, the UNAME26 personality
patch can be used to report the kernel version as 2.6.x where
x is derived from the real kernel version. The uname26 program
is provided to activate the UNAME26 personality patch for 3.x
kernels. uname26 does not replace the uname command. Instead,
it acts as a wrapper that modifies the return value of the
uname() system call to return a 2.6.x version number. If an
application fails due to the 3.8.x version number, you can use
the following command to start it in a 2.6 context:
# uname26 application
The following example demonstrates the effect of using uname26
as a wrapper program:
# uname -r
3.8.13-16.el6uek.x86_64
# uname26 uname -r
2.6.48-16.el6uek.x86_64
The uname26 program is available in the uname26 package. (3.1)
* Structured logging in /dev/kmsg uses printk() to attach
arbitrary key/value pairs to logged messages, which carry
machine-readable data that describes the context of the
message when it was created. The key/value pairs allow you to
reliably identify messages according to device, driver,
subsystem, class, and type. The addition of a facility number
to the syslog prefix allows continuation records to be merged.
(3.5)
* PCI Express runtime D3cold power state is supported. This
deepest power saving state for PCIe devices removes all main
power. (3.6)
* Virtual Function I/O (VFIO) allows safe, non-privileged access
to bare-metal devices from user-space drivers by virtual
machines that use direct device access (device assignment) to
obtain high I/O performance. From perspective of the device
and the host, the VM appears as a user-space driver, which
provides the benefits of reduced latency, higher bandwidth,
and the direct use of bare-metal device drivers. This feature
could potentially be used by high-performance computing and
similar applications. (3.6)
* Huge pages support a zero page as a performance optimization.
This feature was previously available only for normal sized
pages (4 KB). When a process references a new memory page, the
kernel assigns a pointer to the zero page rather than
allocating a real page of memory and filling this with zeroes.
When the process does attempt to write to the zero page, a
write-protection fault is generated and the kernel allocates a
real page of memory to the process's address space. (3.8)
* A new foundation for the NUMA implementation will be used as
the basis for future enhancements. (3.8)
* The memory control group now supports both stack and slab
kernel usage parameters with the following additional memory
usage parameters (specified relative to memory.kmem):
failcnt
Kernel memory usage hits (display only).
limit_in_bytes
Kernel memory hard limit (set or display).
max_usage_in_bytes
Maximum recorded kernel memory usage (display only).
usage_in_bytes
Current kernel memory allocation (display only).
memory.kmem.limit_in_bytes is intended to help limit the
effect of fork bombs. (3.8)
* Automatic balancing of memory allocation for NUMA nodes. (3.8)
* The value of the SCSI error-handling timeout is now tunable.
If a SCSI device times out while processing file system I/O,
the kernel attempts to bring the device back online by
resetting the device, followed by resetting the bus, and
finally by resetting the controller. The error-handling
timeout defines how many seconds the kernel should wait for a
response after each recovery attempt before performing the
next step in the process. For some fast-fail scenarios, it is
useful to be able to adjust this value as the kernel might
need additional time to try several combinations of bus
device, target, bus, and controller. You can read and set the
timeout via /sys/class/scsi_device/*/device/eh_timeout. The
default timeout value is 10 seconds. (3.8)
* Variable-sized huge pages via the flags argument to mmap() or
the shmflg argument to shmget(). Bits 26-31 of these arguments
specify the base-2 logarithm of the page size. For example,
values of 21 << 26 and 30 << 26 represent page sizes of 2 MB
(2^21) and 1 GB (2^30) respectively. A value of zero selects
the default huge page size. (3.8)
* The watchdog timer device (displayed in /proc/devices)
provides a framework for all watchdog timer drivers,
/dev/watchdog, and the sysfs interface for hardware-specific
watchdog code. (3.8)
* The Precision Time Protocol (PTP), defined in IEEE 1588
(http://www.nist.gov/el/isd/ieee/ieee1588.cfm), is enabled.
PTP can be used to achieve synchronization of systems to
within a few tens of microseconds. If hardware time-stamping
units are used, synchronization to within a few hundred
nanoseconds can be achieved. (3.8)
1.1.4. Cryptography
* An Extended Verification Module (EVM) includes a digital
signature that allows file metadata to be protected by using
digital signatures instead of Hashed Message Authentication
Control (HMAC). (3.3)
* Kernel modules can now be signed using X.509 certificates.
(3.7)
1.1.5. Device Mapper
The device mapper supports an external, read-only device as the
origin for a thinly-provisioned volume. Any reads to the
unprovisioned area of the thin device are passed through to this
device. For example, a host could run its guest VMs on thinly
provisioned volumes where the base image for all of the VMs
resides on a single device. (3.4)
1.1.6. Diagnostics
* The cpupowerutils feature extends the capabilities of
cpufrequtils, and provides statistics for CPU idle and
turbo/boost modes. On AMD systems, it also displays
information about boost states and their frequencies. For more
information, see http://lwn.net/Articles/433002/. (3.1)
* zcache version 3 supports multiple clients and in-kernel
transcendent memory (tmem) code, and adds tmem callbacks to
support RAMster and corresponding no-op stubs in the zcache
driver. New sysfs parameters provide additional information
and allow policy control. (3.1)
1.1.7. DTrace
DTrace is a comprehensive dynamic tracing framework that was
initially developed for the Oracle Solaris operating system.
DTrace provides a powerful infrastructure to permit
administrators, developers, and service personnel to concisely
answer arbitrary questions about the behavior of the operating
system and user programs in real time.
Note
The DTrace utility packages (dtrace-utils*) are available only on
the Unbreakable Linux Network (ULN).
DTrace 0.4 in UEK R3 has the following additional features
compared with DTrace 0.3.2 in UEK R2:
* In UEK R2, you had to install separately available packages
that contained a DTrace-enabled version of the kernel, and you
had to boot the system with this kernel to be able to use
DTrace. In UEK R3, DTrace support is integrated with the
kernel. To use DTrace, you still need to install the
dtrace-utils and dtrace-modules packages, which are available
on the ol6_x86_64_UEKR3_latest and
ol6_x86_64_Dtrace_userspace_latest channels. If you use yum to
install the dtrace-utils package, it automatically pulls in
the other packages, such as dtrace-modules, that are required.
* The libdtrace headers, which required for implementing a
libdtrace consumer, are now located in the separate
dtrace-utils-devel package. The headers for provider
development are located in the dtrace-modules-provider-headers
package. If you require these packages, you must install them
separately from the dtrace-modules or dtrace-utils packages.
* Meta-provider support has been implemented, which allows
DTrace to instantiate providers dynamically on demand. An
example of a meta-provider is the fasttrap provider that is
used for user-space tracing.
* User-space statically defined tracing (USDT) supports SDT-like
probes in user-space executable and libraries. To ensure that
your program computes the arguments to a DTrace probe only
when required, you can use an is-enabled probe test to verify
whether the probe is currently enabled.
* USDT requires programs to be modified to include embedded
static probe points. The sys/sdt.h header file is provided to
support USDT, but you can also use the -h option to dtrace to
generate a suitable header file from a provider description
file.
The -G option to the dtrace command processes the provider
description file and the compiled object files for the code
that contains the probe points to generate a DOF ELF object
file (which is a Extensible Linking Format (ELF) object file
with a DTrace Object Format (DOF) section). You can then
create a DTrace-enabled executable or shared library by
linking this DOF ELF object file with the object files.
For more information, refer to the chapter Statically Defined
Tracing for User Applications
(http://docs.oracle.com/cd/E37670_01/E38608/html/dt_sdt.html)
in the Oracle Linux 6 Dynamic Tracing Guide, which you can
find in the Oracle Linux 6 documentation library at
http://docs.oracle.com/cd/E37670_01/index.html.
* To enable the use of USDT probes in DTrace-enabled programs,
you must load the new fasttrap module:
# modprobe fasttrap
Currently, the fasttrap provider only supports the use of USDT
probes. It is not used to implement a pid provider.
* DTrace-enabled versions of user-space applications are planned
to be made available via the playground repository of Oracle
Public Yum
(http://public-yum.oracle.com/repo/OracleLinux/OL6/playground/
latest/x86_64/). The packages that are provided in the
playground repository are intended for experimentation only
and you should not use them with production systems. Oracle
does not offer support for these packages and does not accept
any liability for their use.
PHP 5.4.20, PHP 5.5.4, and later versions can be built with
DTrace support on Oracle Linux. See
https://blogs.oracle.com/opal/entry/using_php_dtrace_on_oracle
.
PostgreSQL 9.2.4 includes support for DTrace as described in
http://www.postgresql.org/docs/9.2/static/dynamic-trace.html.
You can build a DTrace-enabled version of pgsql by specifying
the --enable-dtrace option to configure as described in
http://www.postgresql.org/docs/9.2/static/install-procedure.ht
ml. For information about obtaining the PostgreSQL packages,
see http://www.postgresql.org/download/linux/redhat/.
* The DTrace header files in the kernel, kernel modules, and
DTrace user-space utility have been restructured to provide
better support for custom consumers and DTrace-related
utilities.
* The systrace provider has been updated to account for changes
in the 3.8.13 kernel.
* Symbol lookup can now be performed by the & operator. ustack()
output contains symbolic names instead of addresses provided
that the symbols are present in the DT_NEEDED section of the
ELF objects or in libraries that have been loaded with
dlopen() or dlmopen(). Symbol lookup of global symbols in
user-space processes respects symbol interposition and similar
methods of symbol-ordering. Symbol lookup works correctly with
programs that you compiled against the version of the GNU C
Library (glibc) that ships with Oracle Linux 6.4 or later.
With other versions of glibc, symbol lookup might fall back to
using a simpler approach that does not support symbol
interposition or dlmopen(). As symbol lookup depends on new
machinery in the kernel that uses waitfd() and
PTRACE_GETMAPFD, it does not work with earlier DTrace kernels.
* The -x evaltime={exec | main | preinit | postinit} option to
dtrace is now available with the following limitations:
+ postinit (the default behavior) is equivalent to main.
+ For statically linked binaries, preinit is equivalent to
exec, and it might not skip ld.so initialization, which
can happen after main().
+ For stripped, statically linked binaries, both postinit
and main are equivalent to preinit, because the main
symbol cannot be looked up if there is no symbol table.
In previous versions of DTrace, the default behavior was
equivalent to evaltime=exec being set.
* You can now set DTrace options by using environment variables
named DTRACE_OPT_NAME, where NAME is the name of the option in
upper case. For example, the variable name corresponding to
incdir, which adds a #include directory to the preprocessor
search path, is DTRACE_OPT_INCDIR:
# export DTRACE_OPT_INCDIR=/usr/lib64/dtrace:/usr/include/sys
* The following changes have been made to user-visible
internals:
+ The name of the ELF section in which CTF data is stored
has been changed from .dtrace_ctf to .ctf.
+ The storage representation of internal kernel symbols has
been improved, which reduces DTrace memory usage at start
up by approximately one megabyte.
+ The libdtrace public API header now names its arguments.
+ The prototypes for several libdtrace functions have
changed.
+ Two undocumented libproc environment variables
(_LIBPROC_INCORE_ELF and _LIBPROC_NO_QSORT) from Oracle
Solaris have been removed because the code, whose
behaviour they adjusted, no longer exists.
+ New low-overhead debugging machinery has been
implemented. If you export the DTRACE_DEBUG=signal
environment variable, DTrace will emit debugging output
only when it receives a SIGUSR1, avoiding the overhead
due to printf() locking affecting any timings. The
mechanism uses a ring buffer with a default size of 100
(in units of megabytes), which you can adjust by setting
the value of the DTRACE_DEBUG_BUF_SIZE variable.
* Negative values specified to dtrace options that take only
positive integers are now correctly diagnosed as errors.
* It is now possible to obtain correct value for the ERR
registers.
* For more information about DTrace, refer to the Oracle Linux 6
Administrator's Solutions Guide and the Oracle Linux 6 Dynamic
Tracing Guide, which you can find in the Oracle Linux 6
documentation library at
http://docs.oracle.com/cd/E37670_01/index.html.
1.1.8. File Systems
btrfs
In UEK R3, btrfs is based on version 3.8, whereas btrfs in the
latest update to UEK R2 is based on version 3.0 with some
additional backported features, such as support for large metadata
blocks and device statistics.
The following notable features are implemented for the btrfs file
system in UEK R3 in addition to those features that are already
provided in UEK R2:
* Support for changing the RAID profile without unmounting the
file system. (3.3)
* The btrfs-restore data recovery tool attempts to extract files
from a damaged file system and copy them to a safe location.
(3.4)
* fsck in btrfs can now repair extent-allocation trees. (3.4)
* Support in mkfs for metadata blocks of up to 64 KB (either 16
or 32 KB is recommended). (3.4)
* Performance improvements to page cache and CPU usage, and the
copy-on-write mechanisms. (3.4)
* Improved auditing to handle unexpected conditions more
effectively. When unexpected errors occur, current
transactions abort, errors are returned to user-space callers,
and the file system enters read-only mode. (3.4)
* The btrfs device stats command reports I/O failure statistics,
including I/O errors, CRC errors, and generation checks of
metadata blocks for each drive. (3.5)
* Performance improvements to memory reclamation and synchronous
I/O latency. (3.5)
* Subvolume-aware quota groups (qgroups) allow you to set
different size limits for a volume and its subvolumes. For
more information, see
https://btrfs.wiki.kernel.org/index.php/UseCases
(https://btrfs.wiki.kernel.org/index.php/UseCases#How_do_we_im
plement_quota_in_BTRFS.3F). (3.6)
* The send and receive subcommands of btrfs allow you to record
the differences between two subvolumes, which can either be
snapshots of the same subvolume or parent and child
subvolumes. For an example of using the send/receive feature
to implement an efficient incremental backup mechanism, see
https://btrfs.wiki.kernel.org/index.php/Incremental_Backup.
(3.6)
* Cross-subvolume reflinks allow you to clone files across
different subvolumes within a single mounted btrfs file
system. However, you cannot clone files between subvolumes
that are mounted separately. (3.6)
* The copy-on-write mechanism can be disabled for an empty file
by using the chattr +C command to add the NOCOW file attribute
to the file, or by creating the file in a directory on which
you have set NOCOW. For some applications this feature can
reduce fragmentation and improve performance. (3.7)
* File hole punching, which allows you to mark a portion of a
file as unused, so freeing up the associated storage. The
FALLOC_FL_PUNCH_HOLE flag to the fallocate() system call
removes the specified data range from a file. The call does
not change the size of the file even if you remove blocks from
the end of the file. A typical use case for hole punching is
to deallocate unused storage previously allocated to virtual
machine images. (3.7)
* The fsync() system call writes the modified data of a file to
the hard disk. (3.7)
* Replacing devices without unmounting or otherwise disrupting
access to the file system by using the replace subcommand to
btrfs, for example:
# btrfs replace failed_device replacement_device mountpoint
You do not need to unmount the file system or to stop active
tasks. If the power fails during replacment, the process
resumes when the file system is next mounted. (3.8)
For more information, see
https://btrfs.wiki.kernel.org/index.php/Changelog.
cifs
The Common Internet File System (CIFS) now provides experimental
support for SMB v2, which is the successor to the CIFS and SMB
network file sharing protocols. (3.7)
ext3 and ext4
File system barriers are now enabled by default. If you experience
a performance regression, you can disable the feature by
specifying the barrier=0 option to mount. (3.1)
ext4
* Store checksums of various metadata fields. Each time that a
metadata field is read, the checksum of the read data is
compared with the stored checksum to detect metadata
corruption. (3.5)
* Quota files are now stored in hidden inodes as file system
metadata instead of as separate files in the file system
director hierarchy. Quotas are enabled as soon as the file
system is mounted. (3.6)
f2fs
f2fs is an experimental file system that is optimized for flash
memory storage devices and solid state drives (SSDs). (3.8)
FUSE
The numa mount option has been added to select code paths that
improve performance on NUMA systems.
NFS
The NFS version 4.1 client supports Sessions, Directory
Delegations, and parallel NFS (pNFS) as defined in RFC 5661
(http://tools.ietf.org/html/rfc5661). pNFS can take advantage of
cluster systems by providing scalable parallel access, either to a
file system or to individual files that are distributed on
multiple servers. (3.7)
XFS
Journals now implement checksums for verifying log integrity.
(3.8)
1.1.9. Memory Management
* The frontswap feature can store swap data is stored in
transcendent memory, which is neither directly accessible to
nor addressable by the kernel. Using transcendent memory in
this way can significantly reduce swap I/O. Frontswap is so
named because it can be thought of as being the opposite of a
backing store for a swap device. A suitable storage medium is
a synchronous, concurrency-safe, page-oriented, pseudo-RAM
device such as Xen Transcendent Memory (tmem) or in-kernel
compressed memory (zmem). (3.5)
* Safe swapping is supported using network block devices (NBDs)
or NFS. (3.6)
1.1.10. Networking
* TCP controlled delay management (CoDel) is a new active queue
management algorithm that is designed to handle excessive
buffering across a network connection (bufferbloat). The
algorithm is based on for how long packets are buffered in the
queue rather than the size of the queue. If the minimum
queuing time rises above a threshold value, the algorithm
discards packets and reduces the transmission rate of TCP.
(3.5)
* TCP connection repair implements process checkpointing and
restart, which allows a TCP connection to be stopped on one
host and restarted on another host. Container virtualization
can use this feature to move a network connection between
hosts. (3.5)
* TCP and STCP early retransmit allows fast retransmission
(under certain conditions) to reduce the number of duplicate
acknowledgements. (3.5)
* TCP fast open (TFO) can speed up the opening of successive TCP
connections between two endpoints by eliminating one round
time trip (RTT) from some TCP transactions. A performance
improvement of between 4 and 41% has been measured for web
page loading.
TFO is not enabled by default. To enable it, use the following
command:
# sysctl -w net.ipv4.tcp_fastopen=1
To make the change persist across system reboots, add the
following entry to /etc/sysctl.conf:
net.ipv4.tcp_fastopen = 1
Applications that want to use TFO must notify the system using
appropriate API calls, such as the TCP_FASTOPEN option to
setsockopt() on the server side or the MSG_FASTOPEN flag with
sendto() on the client side. (client side 3.6, server side
3.7)
* The TCP small queue algorithm is another mechanism intended to
help deal with bufferbloat. The algorithm limits the amount of
data that can be queued for transmission by a socket. The
limit is set by /proc/sys/net/ipv4/tcp_limit_output_bytes,
where the default value is 128 KB. To reduce network latency,
specify a lower value for this limit. (3.6)
1.1.11. Performance
* The slub slab allocator now implements wider lockless
operations for most paths on CPU architectures that support
CMPXCHG (compare and exchange) instructions. This change can
improve the performance of slab intensive workloads. (3.1)
* The perf report --gtk command launches a simple GTK2-based
performance report browser. (3.4)
* The perf annotate command now allows you to use the Enter key
to trace recursively through function calls in the TUI
interface. (3.4)
* The perf record -b command supports a new hardware-based,
branch-profiling feature on some CPUs that allows you to
examine branch execution. (3.4)
* Uprobes allow you to place a performance probe at any memory
address in a user application so that you can collect
debugging and performance information non-disruptively. (3.5)
* The perf trace command can be used to record a workload
according to a specified script, and to display a detailed
trace of a workload that was previously recorded. This command
provides an alternative interface to strace. (3.7)
1.1.12. Security
* The secure computing mode feature (seccomp) is a simple
sandbox mechanism that, in strict mode, allows a thread to
transition to a state where it cannot make any system calls
except from a very restricted set (_exit(), read(),
sigreturn(), and write()) and it can only use file descriptors
that were already open. In filter mode, a thread can specify
an arbitrary filter of permitted systems calls that would be
forbidden in strict mode. Access to this feature is by using
the prctl() system call. For more information, see the
prctl(2) manual page. (3.5)
* Supervisor mode access prevention (SMAP) is a new security
feature that will be supported by future Intel processors.
SMAP forbids kernel access to user-space memory pages, which
should help eliminate some forms of exploit. If the SMAP bit
has been set in CR4, an attempt is made to access user-space
memory from privileged mode causes a page-fault exception. For
more information, refer to the Intel(R) Architecture
Instruction Set Extensions Programming Reference
(http://download-software.intel.com/sites/default/files/319433
-014.pdf). (3.7)
1.1.13. Storage
* The LSI MPT3SAS driver has been added to support LSI MPT
Fusion based SAS3 (SAS 12.0 Gb/s) controllers.
* The OpenFabrics Enterprise Distribution (OFED) 2.0 stack has
been integrated, which supports the following InfiniBand (IB)
hardware on systems with an x86-64 architecture:
+ Mellanox ConnectX-2 InfiniBand Host Channel Adapters
+ Mellanox ConnectX-3 InfiniBand Host Channel Adapters are
supported for Oracle X4-2, X4-2L, and Netra X3-2 servers
+ Sun InfiniBand QDR Host Channel Adapter PCIe #375-3696
OFED 2.0 supports the following protocols:
+ SCSI RDMA Protocol (SRP) enables access to remote SCSI
devices via remote direct memory access (RDMA)
+ iSCSI Extensions for remote direct memory access (iSER)
provide access to iSCSI storage devices
+ Reliable Datagram Sockets (RDS) is a high-performance,
low-latency, reliable connectionless protocol for
datagram delivery
+ Sockets Direct Protocol (SDP) supports stream sockets for
RDMA network fabrics
+ Ethernet over InfiniBand (EoIB)
+ IP encapsulation over InfiniBand (IPoIB)
+ Ethernet tunneling over IPoIB (eIPoIB)
and the following RDS features:
+ Async Send (AS)
+ Quality of Service (QoS)
+ Automatic Path Migration (APM)
+ Active Bonding (AB)
+ Shared Request Queue (SRQ)
+ Netfilter (NF)
* Support for IB, OFED, and RDS is integrated into the kernel.
The OFED user-space RPMs continue to be provided, but the
kernel-ib and ofa-kernel RPMs are not required.
* A new iSCSI implementation raises the supported iSCSI target
framework to LIO version 4.1. (3.1)
1.1.14. Virtualization
* Paravirtualization support has been enabled for Oracle Linux
guests on Windows Server 2008 Hyper-V or Windows Server 2008
R2 Hyper-V.
* VFS scalability improvements:
+ The inode_sta.nr_unused counter has been converted to a
per-CPU counter.
+ The global LRU list of unused inodes has been converted
to a per-superblock LRU list.
+ The ipruce_sem semaphore has been removed because of
changes to the LRU lists.
+ The i_alloc_sem functionality has been replaced with a
simplified scheme.
+ The scalability of mount locks has been improved for file
systems that do not have mount points.
+ The use of inode_hash_lock is avoided for pipes and
sockets.
(3.1)
* privcmd is a new character device driver that handles access
to arbitrary hypercalls through XenFS. (3.3)
* xenbus_backend is a new device driver for xenbus used by
XenFS. (3.3)
* The xenbus device driver adds a new character device featuring
nmap for the pre-allocated ring and an ioctl() for the event
channel via XenFS. (3.3)
* The Virtual Extensible LAN (VXLAN) tunneling protocol overlays
a virtual network on an existing Layer 3 infrastructure to
allow the transfer of Layer 2 Ethernet packets over UDP. This
feature is intended for use by a virtual network
infrastructure in a virtualized environment. Use cases include
virtual machine migration and software-defined networking
(SDN). (3.7)
1.2. Xen Improvements
Relative to Unbreakable Enterprise Kernel Release 2 Quarterly
Update 4, numerous bug fixes and performance improvements have
been incorporated into the Unbreakable Enterprise Kernel to
support Xen usage, including:
* Fixes for EDD, x2apic, XenBus, and PVHVM vCPU hotplug issues.
* The indirect-descriptor feature, which increases throughput
and reduces latency for block I/O.
1.3. Driver Updates
The Unbreakable Enterprise Kernel supports a large number of
hardware and devices. In close cooperation with hardware and
storage vendors, Oracle has updated several device drivers. The
list given below indicates the drivers whose versions differ from
the versions in mainline Linux 3.8.13.
1.3.1. Storage Adapter Drivers
Broadcom
* NetXtreme II Fibre Channel over Ethernet driver (bnx2fc)
version 2.3.4.
* NetXtreme II iSCSI driver (bnx2i) version 2.7.6.1d.
Cisco
* Cisco FCoE HBA Driver (fnic) version 1.5.0.45.
Emulex
* Blade Engine 2 Open-iSCSI driver (be2iscsi) version
10.0.467.0o.
* Fibre Channel HBA driver (lpfc) version 0:8.3.7.26.2p.
LSI
* LSI Fusion-MPT base driver (mptbase) version 4.28.20.03.
* LSI Fusion-MPT ioctl driver (mptctl) version 4.28.20.03.
* LSI Fusion-MPT Fibre Channel host driver (mptfc) version
4.28.20.03.
* LSI Fusion-MPT IP Over Fibre Channel driver (mptlan) version
4.28.20.03.
* LSI Fusion-MPT SAS driver (mptsas) version 4.28.20.03.
* LSI Fusion-MPT SCSI host driver (mptscsih) version 4.28.20.03.
* LSI Fusion-MPT SPI host driver (mptspi) version 4.28.20.03.
* LSI Fusion-MPT SAS 2.0 driver (mpt2sas) version 17.00.00.00.
* LSI Fusion-MPT SAS 3.0 driver (mpt3sas) version 03.00.00.00.
MegaRAID
* MegaRAID SAS driver (megaraid_sas) version 06.600.18.00.
Mellanox
* ConnectX Ethernet driver (mlx4_en) version 2.1.4.
Handles Ethernet-specific functions and plugs into the netdev
mid-layer.
QLogic
* Fibre Channel HBA driver (qla2xxx) version 8.05.00.03.39.0-k.
* iSCSI driver (qla4xxx) version 5.03.00.03.06.02-uek3.
Supports Open-iSCSI.
1.3.2. Network Adapter Drivers
Broadcom
* NetXtreme II network adapter driver (bnx2) version 2.2.3n.
* NetXtreme II 10Gbps network adapter driver (bnx2x) version
1.76.54.
* Converged Network Interface Card core driver (cnic) version
2.5.16g.
* Tigon3 Ethernet adapter driver (tg3) version 3.131d.
Emulex
* Blade Engine 2 10Gbps adapter driver (be2net) version
4.6.63.0u.
Intel
* Legacy (PCI and PCI-X*) Gigabit network adapter driver (e1000)
version 7.3.21-k8-NAPI.
The e1000 driver in UEK R3 is taken from the driver for the
mainline Linux kernel. The version number for this driver
appears to be lower than the Intel version (8.0.35-NAPI), but
it incorporates fixes that have been made since Intel ceased
supporting the driver.
* PRO/1000 PCI-Express Gigabit network adapter driver (e1000e)
version 2.4.14-NAPI.
* Gigabit Ethernet network adapter driver (igb) version 4.3.0.
* Base driver for Intel Ethernet Network Connection (igbvf)
version 2.3.2.
* 10 Gigabit PCI-Express network adapter driver (ixgbe) version
3.15.1.
* 10 Gigabit Server Adapter virtual function driver (ixgbevf)
version 2.8.7.
QLogic
* 1/10 GbE Converged/Intelligent Ethernet Adapter driver
(qlcnic) version 5.2.43.
* QLE81xx network adapter driver (qlge) version v1.00.00.32.
Realtek PCI Express Gigabit Ethernet controller
* Realtek PCI Express Gigabit Ethernet controller (r8169)
version 2.3LK-NAPI.
Oracle
* Sun Blade 40/10Gigabit Ethernet network driver (sxge) version
0.06202013.
VMware
* VMware VMXNET3 virtual ethernet driver (vmxnet3) version
1.1.30.0-k.
1.3.3. Miscellaneous Drivers
InfiniBand
* iSCSI Extensions for RDMA (iSER) Protocol over InfiniBand
(ib_iser) version 1.1.
* InfiniBand SCSI RDMA Protocol initiator (ib_srp) version 1.2.
Oracle
* Reliable Datagram Sockets driver (rds) version 4.1.
RDS provides in-order, non-duplicated, highly-available,
low-overhead, reliable delivery of datagrams between hundreds
of thousands of non-connected endpoints.
1.4. New and Updated Packages
To support the newly added functionality that the Unbreakable
Enterprise Kernel Release 3 provides, the following RPM packages
have been added or updated from the ones included in the base
distribution.
* bfa-firmware (Brocade Fibre Channel HBA firmware)
* crash (crash, kernel analysis utility)
crash-devel
* device-mapper-multipath (device mapper)
* device-mapper-multipath-libs
* dracut (event-driven initramfs infrastructure)
dracut-caps
dracut-fips
dracut-fips-aesni
dracut-generic
dracut-kernel
dracut-network
dracut-tools
* drbd84-utils (HA utilities for MySQL and Oracle Linux 6)
* dtrace-modules (DTrace modules)
dtrace-modules-headers
dtrace-modules-provider-headers
dtrace-utils (DTrace utilities)
dtrace-utils-devel
* e2fsprogs (ext* file-system utilities)
e2fsprogs-devel
e2fsprogs-libs
* fuse (FUSE file system)
fuse-devel
fuse-libs
* ib-bonding (ip-bond, IPoIB bonding-interface utility)
* ibacm (ib_acm daemon for InfiniBand fabrics)
ibacm-devel
* ibutils (OpenIB Mellanox InfiniBand diagnostic utilities)
* infiniband-diags (OpenFabrics Alliance InfiniBand diagnostic
utilities)
infiniband-diags-compat
* iscsi-initiator-utils (iSCSI daemon and utilities)
iscsi-initiator-utils-devel
* kernel-uek (UEK R3 kernel)
kernel-uek-debug
kernel-uek-debug-devel
kernel-uek-devel
kernel-uek-doc
kernel-uek-firmware
kernel-uek-headers
* kexec-tools (kexec and kdump user-space components)
* kpartx (kpartx, partition manager)
* libcom_err (common error description library)
libcom_err-devel
* libdtrace-ctf (DTrace CTF library)
libdtrace-ctf-devel
* libibcm (user-space InfiniBand connection manager)
libibcm-devel
* libibmad (OpenFabrics Alliance InfiniBand management datagram
library)
libibmad-devel
libibmad-static
* libibumad (OpenFabrics Alliance InfiniBand user MAD library)
ibibumad-devel
libibumad-static
* libibverbs (user-space RDMA (InfiniBand/iWARP) hardware
library)
libibverbs-devel
libibverbs-devel-static
libibverbs-utils
* libmlx4 (Mellanox ConnectX InfiniBand HCA user-space driver)
libmlx4-devel
* librdmacm (user-space RDMA connection manager)
librdmacm-devel
librdmacm-utils
* libsdp (user-space Sockets Direct Protocol library)
libsdp-devel
* libss (command-line interface parsing library)
libss-devel
* lxc (Linux Containers)
lxc-devel
lxc-libs
* mstflint (Mellanox firmware-burning utility)
* netxen-firmware (QLogic Linux Intelligent Ethernet (3000 and
3100 Series) adapter firmware)
* ofed-docs (OpenFabrics Enterprise Distribution documentation)
* ofed-scripts
* opensm (OpenIB InfiniBand subnet manager and management
utilities)
opensm-devel
opensm-libs
opensm-static
* perftest (InfiniBand performance tests for RDMA networks)
* ql2400-firmware (firmware for QLogic 2400 series mass storage
adapter devices)
* ql2500-firmware (firmware for QLogic 2500 series mass storage
adapter devices)
* qperf (qperf, utility for measuring socket and RDMA
performance)
* rdma (InfiniBand/iWARP kernel-module initialization scripts)
* rds-tools (RDS utilities)
* sdpnetstat (sdpnetstat, InfiniBand SDP diagnostic utility)
* srptools (InfiniBand SDP utilities)
* uname26 (uname26, wrapper utility for the UNAME26 personality
patch)
* xfsdump (administrative utilities for the XFS file system)
* xfsprogs (XFS file-system utilities)
xfsprogs-devel
xfsprogs-qa-devel
For details of the channels on which these packages are available,
see Chapter 3, "Installation and Availability."
1.5. Technology Preview
The following features included in the Unbreakable Enterprise
Kernel Release 3 are still under development, but are made
available for testing and evaluation purposes.
* DRBD (Distributed Replicated Block Device)
A shared-nothing, synchronously replicated block device (RAID1
over network), designed to serve as a building block for high
availability (HA) clusters. It requires a cluster manager (for
example, pacemaker) for automatic failover.
* Kernel module signing facility
Applies cryptographic signature checking to modules on module
load, checking the signature against a ring of public keys
compiled into the kernel. GPG is used to do the cryptographic
work and determines the format of the signature and key data.
* Transcendent memory
Transcendent Memory (tmem) provides a new approach for
improving the utilization of physical memory in a virtualized
environment by claiming underutilized memory in a system and
making it available where it is most needed. From the
perspective of an operating system, tmem is fast pseudo-RAM of
indeterminate and varying size that is useful primarily when
real RAM is in short supply. To learn more about this
technology and its use cases, see the Transcendent Memory
project page at http://oss.oracle.com/projects/tmem/.
1.6. Compatibility
Oracle Linux maintains user-space compatibility with Red Hat
Enterprise Linux, which is independent of the kernel version
running underneath the operating system. Existing applications in
user space will continue to run unmodified on the Unbreakable
Enterprise Kernel Release 3 and no re-certifications are needed
for RHEL certified applications.
To minimize impact on interoperability during releases, the Oracle
Linux team works closely with third-party vendors whose hardware
and software have dependencies on kernel modules. The kernel ABI
for UEK R3 will remain unchanged in all subsequent updates to the
initial release. In this release, there are changes to the kernel
ABI relative to UEK R2 that require recompilation of third-party
kernel modules on the system. Before installing UEK R3, verify its
support status with your application vendor.
Chapter 2. Known Issues
This chapter describes the known issues for the Unbreakable
Enterprise Kernel Release 3.
ACPI
* On some systems you might see ACPI-related error messages in
dmesg similar to the following:
ACPI Error: [CDW1] Namespace lookup failure, AE_NOT_FOUND
ACPI Error: Method parse/execution failed [_SB_._OSC||\||]
ACPI Error: Field [CDW3] at 96 exceeds Buffer [NULL] size 64 (bits)]]
>
These messages, which are not fatal, are caused by bugs in the
BIOS. Contact your system vendor for a BIOS update. (Bug ID
13100702)
* The following messages indicate that the BIOS does not present
a suitable interface, such as _PSS or _PPC, that the
acpi-cpufreq module requires:
kernel: powernow-k8: this CPU is not supported anymore, using acpi-cp
ufreq instead.
modprobe: FATAL: Error inserting acpi_cpufreq
There is no known workaround for this error. (Bug ID 17034535)
ASM
Calling the oracleasm init script, /etc/init.d/oracleasm, with the
parameter scandisks can lead to error messages about missing
devices similar to the following:
oracleasm-read-label: Unable to open device "device": No such file or
directory
However, the device actually exists. You can ignore this error
message, which is triggered by a timing issue. Only use the init
script to start and stop the oracleasm service. All other options,
such as scandisks, listdisk, and createdisk, are deprecated. For
these and other administrative tasks, use /usr/sbin/oracleasm
instead. (Bug ID 13639337)
bnx2x driver
When using the bnx2x driver in a bridge, disable Transparent
Packet Aggregation (TPA) by including the statement options bnx2x
disable_tpa=1 in /etc/modprobe.conf. (Bug ID 14626070)
btrfs
* If you use the --alloc-start option with mkfs.btrfs to specify
an offset for the start of the file system, the size of the
file system should be smaller but this is not the case. It is
also possible to specify an offset that is higher than the
device size. (Bug ID 16946255)
* The usage information for mkfs.btrfs reports raid5 and raid6
as possible profiles for both data and metadata. However, the
kernel does not support these features and cannot mount file
systems that use them. (Bug ID 16946303)
* The btrfs filesystem balance command does not warn that the
RAID level can be changed under certain circumstances, and
does not provide the choice of cancelling the operation. (Bug
ID 16472824)
* Converting an existing ext2, ext3, or ext4 root file system to
btrfs does not carry over the associated security contexts
that are stored as part of a file's extended attributes. With
SELinux enabled and set to enforcing mode, you might
experience many permission denied errors after reboot, and the
system might be unbootable. To avoid this problem, enforce
automatic file system relabeling to run at bootup time. To
trigger automatic relabeling, create an empty file named
.autorelabel (for example, by using touch) in the file
system's root directory before rebooting the system after the
initial conversion. The presence of this file instruct SELinux
to recreate the security attributes for all files on the file
system. If you forget to do this and rebooting fails, either
temporarily disable SELinux completely by adding selinux=0 to
the kernel boot parameters, or disable enforcing of the
SELinux policy by adding enforcing=0. (Bug ID 13806043)
* Commands such as du can show inconsistent results for file
sizes in a btrfs file system when the number of bytes that is
under delayed allocation is changing. (Bug ID 13096268)
* The copy-on-write nature of btrfs means that every operation
on the file system initially requires disk space. It is
possible that you cannot execute any operation on a disk that
has no space left; even removing a file might not be possible.
The workaround is to run sync before retrying the operation.
If this does not help, remount the file system with the -o
nodatacow option and delete some files to free up space. See
https://btrfs.wiki.kernel.org/index.php/ENOSPC.
* Btrfs has a limit of 237 or fewer hard links to a file from a
single directory. The exact limit depends on the number of
characters in the file name. The limit is 237 for a file with
up to eight characters in its file name; the limit is lower
for longer file names. Attempting to create more than this
number of links results in the error Too many links. You can
create more hard links to the same file from another
directory. Although the limitation of the number of hard links
in a single directory has been increased to 65535, the version
of mkfs.btrfs that is provided in the btrfs-progs package does
not yet support the compatibility flag for this feature. (Bug
ID 16278563)
* The -c option to the btrfs qgroup limit command is redundant
as the quota limit is always enforced after compression. (Bug
ID 16557528)
* If you run the btrfs quota enable command on a non-empty file
system, any existing files do not count toward space usage.
Removing these files can cause usage reports to display
negative numbers and the file system to be inaccessible. The
workaround is to enable quotas immediately after creating the
file system. If you have already written data to the file
system, it is too late to enable quotas. (Bug ID 16569350)
* The btrfs quota rescan command is not currently implemented.
The command does not perform a rescan and returns without
displaying any message. (Bug ID 16569350)
* When you overwrite data in a file, starting somewhere in the
middle of the file, the overwritten space is counted twice in
the space usage numbers that btrfs qgroup show displays. (Bug
ID 16609467)
* If you run btrfsck --init-csum-tree on a file system and then
run a simple btrfsck on the same file system, the command
displays a Backref mismatch error that was not previously
present. (Bug ID 16972799)
* Btrfs tracks the devices on which you create btrfs file
systems. If you subsequently reuse these devices in a file
system other than btrfs, you might see error messages such as
the following when performing a device scan or creating a
RAID-1 file system, for example:
ERROR: device scan failed '/dev/cciss/c0d0p1' - Invalid argument
You can safely ignore these errors. (Bug ID 17087097)
* If you use the -s option to specify a sector size to
mkfs.btrfs that is different from the page size, the created
file system cannot be mounted. By default, the sector size is
set to be the same as the page size. (Bug ID 17087232)
CPU microcode update failures on PVM or PVHVM guests
When running Oracle Linux 6 with UEK R3, you might see error
messages in dmesg or /var/log/messages similar to this one:
microcode: CPU0 update to revision 0x6b failed.
You can ignore this warning. You do not need to upgrade the
microcode for virtual CPUs as presented to the guest. (Bug ID
12576264, 13782843)
DHCP lease is not obtained at boot time
If DHCP lease negotiation takes more than 5 seconds at boot time,
the following message is displayed:
ethX: failed. No link present. Check cable?
If the ethtool ethX command confirms that the interface is
present, edit /etc/sysconfig/network-scripts/ifcfg-ethX and set
LINKDELAY=N, where N is a value greater than 5 seconds (for
example, 30 seconds). Alternatively, use NetworkManager to
configure the interface. (Bug ID 16620177)
dm-nfs obsoleted
In UEK R2, the dm-nfs module provided the ability to create a
loopback device for a mounted NFS file or file system. For
example, the feature allowed you to create the shared storage for
an Oracle 3 VM cluster on an NFS file system. The dm-nfs module
provided direct I/O to the server and bypassed the loop driver to
avoid an additional level of page caching. The dm-nfs module is
not provided with UEK R3. The loop driver can now provide the same
I/O functionality as dm-nfs by extending the AIO interface to
perform direct I/O. To create the loopback device, use the losetup
command instead of dmsetup.
DTrace
* Using kill -9 to terminate dtrace can leave breakpoints
outstanding in processes being traced, which might sooner or
later kill them.
* Argument declarations for probe definitions cannot be declared
with derived types such as enum, struct, or union.
* The following compiler warning can be ignored for probe
definition arguments of type string (which is a D type but not
a C type):
provider_def.h:line#: warning: parameter names (without types) in fun
ction declaration
ERST message
You can safely ignore the following message that might be
displayed in syslog or dmesg:
ERST: Failed to get Error Log Address Range.
The message indicates that the system BIOS does not support an
Error Record Serialization Table (ERST). (Bug ID 17034576)
ext4 inline data
The inline data feature that allows the data of small files to be
stored inside their inodes is not yet available. The -O
inline_data option to the mkfs.ext4 and tune2fs commands is not
supported. (Bug ID 17210654)
Firmware warning message
You can safely ignore the following firmware warning message that
might be displayed on some Sun hardware:
[Firmware Warn]: GHES: Poll interval is 0 for generic hardware error
source:
1, disabled.
(Bug ID 13696512)
Huge pages
One-gigabyte (1 GB) huge pages are not currently supported for the
following configurations:
* HVM guests
* PV guests
* Oracle Database
Two-megabyte (2 MB) huge pages have been tested and work with
these configurations.
(Bug ID 17299364, 17299871, 17271305)
I/O scheduler
The Unbreakable Enterprise Kernel uses the deadline scheduler as
the default I/O scheduler. For the Red Hat Compatible Kernel, the
default I/O scheduler is the cfq scheduler.
ioapic failure messages
You can safely ignore messages such as ioapic: probe of
0000:00:05.4 failed with error -22. Such messages are the result
of the ioapic driver attempting to re-register I/O APIC PCI
devices that were already registered at boot time. (Bug ID
17034993)
InfiniBand warning messages when disabling a switch port
You might see the following warning messages if you use the
ibportstate disable command to disable a switch port:
ibwarn: [2696] _do_madrpc: recv failed: Connection timed out
ibwarn: [2696] mad_rpc: _do_madrpc failed; dport (Lid 38)
ibportstate: iberror: failed: smp set portinfo failed
You can safely ignore these warnings. (Bug ID 16248314)
libfprint
The following message might appear in dmesg or /var/log/messages:
WARNING! power/level is deprecated; use power/control instead.
The USB subsystem in UEK R3 deprecates the power/level sysfs
attribute in favor of the power/control attribute. The libfprint
fingerprinting library triggers this warning via udev rules that
try to use the old attribute first. You can safely ignore this
warning. The setting of the appropriate power level still
succeeds. (Bug ID 13523418)
Large memory system fails to boot
If a large memory system fails to start, boot it using an
alternate kernel to UEK R3 and disable the kdump service before
booting into the UEK R3 kernel:
# chkconfig kdump off
(Bug ID 16765434)
Linux Containers (LXC)
* The correct operation of containers might require that you
completely disable SELinux on the host system. For example,
SELinux can interfere with container operation under the
following conditions:
+ Running the halt or shutdown command from inside the
container hangs the container or results in a permission
denied error. (An alternate workaround is to use the init
0 command from inside the container to shut it down.)
+ Setting a password inside the container results in a
permission denied error, even when run as root.
+ You want to allow ssh logins to the container.
To disable SELinux on the host:
1. Edit the configuration file for SELinux,
/etc/selinux/config and set the value of the SELINUX
directive to disabled.
2. Shut down and reboot the host system.
* The root user in a container can affect the configuration of
the host system by setting some /proc entries. (Bug ID
17190287)
* Using yum to update packages inside the container that use
init scripts can undo changes made by the Oracle template.
* Migrating live containers (lxc-checkpoint) is not yet
supported.
* Oracle Database is not yet supported for use with Linux
Containers. The following information is intended for those
who want to experiment with such a configuration.
The following /proc parameter files may only be set on the
host and not for individual containers:
+ /proc/sys/fs/aio-max-nr
+ /proc/sys/net/core/rmem_default
+ /proc/sys/net/core/rmem_max
+ /proc/sys/net/core/wmem_default
+ /proc/sys/net/core/wmem_max
+ /proc/sys/net/ipv4/ip_local_port_range
Setting the parameters in the host to the Oracle recommended
values sets them for all containers and allows the Oracle
database to run in a container. For more information, see
Configuring Kernel Parameters
(http://docs.oracle.com/cd/E11882_01/install.112/e24326/toc.ht
m#BHCCADGD). (Bug ID 17217854)
NUMA warning messages on a non-NUMA system
You can safely ignore the following warning messages in dmesg and
/var/log messages if you see them on a non-NUMA system:
kernel: NUMA: Warning: node ids are out of bound, from=-1 to=-1 dista
nce=10
hcid[4293]: Register path:/org/bluez fallback:1
kernel: No NUMA configuration found
(Bug ID 13711370)
pcspkr driver error message
You can safely ignore the following error message:
Error: Driver 'pcspkr' is already registered, aborting...
The message arises from an alias conflict between snd-pcsp and
pcspkr. To prevent the message from being displayed, add the
following line to /etc/modprobe.d/blacklist.conf:
blacklist snd-pcsp
(Bug ID 10355937)
sched_yield() settings for CFS
For the Unbreakable Enterprise Kernel, kernel.sched_compat_yield=1
is set by default. For the Red Hat Compatible Kernel,
kernel.sched_compat_yield=0 is used by default.
Soft lockup errors when booting
When upgrading or installing the UEK R3 kernel on fast hardware,
usually with SAN storage attached, the kernel can fail to boot and
BUG: soft lockup messages are displayed in the console log. The
workaround is to increase the baud rate from the default value of
9600 by amending the kernel boot line in /boot/grub/grub.conf to
include an appropriate console setting, for example:
console=ttyS0,115200n8
A value of 115200 is recommended as smaller values such as 19200
are known to be insufficient for some systems (for example, see
http://docs.oracle.com/cd/E19045-01/blade.x6220/820-0048-18/sp.htm
l#0_pgfId-1002490). If the host implements an integrated system
management infrastructure, such as ILOM on Sun and Oracle systems
or iLO on HP systems, configure the integrated console baud rate
to match the setting for the host system. Otherwise, the
integrated console is likely to display garbage characters. (Bug
ID 17064059, 17252160)
Transparent Huge Pages
This release removes the Transparent Huge Pages (THP) feature.
Following extensive benchmarking and testing, Oracle found that
THP caused a performance degradation of between 5 and 10% for some
workloads. This performance degradation was a result of a slower
memory allocator code path being used even when the applications
were not using THP. When the fact that huge pages are not
swappable was taken into account, the positive effect that THP
should provide was outweighed by its negative effects.
After installing this UEK release, you cannot enable THP (for
example, by specifying kernel boot parameters). The THP settings
under /sys/kernel/mm/transparent_hugepage have also been removed.
A future update might contain an updated THP implementation which
resolves the performance issue.
Note
This change does not affect support for applications that use
explicit huge pages (for example, Oracle Database).
(Bug ID 16823432)
User Namespaces
The kernel functionality (CONFIG_USER_NS) that allows unprivileged
processes to create namespaces for users inside which they have
root privileges is not currently implemented because of a clash
with the implementation of XFS. This functionality is primarily
intended for use with Linux Containers. As a result, the
lxc-checkconfig command displays User namespace: missing. (Bug ID
16656850)
Virtualization
* When booting UEK R3 as a PVHVM guest, you can safely ignore
the following kernel message:
register_vcpu_info failed:
err=-38
(Bug ID 13713774)
* Under Oracle VM Server 3.1.1, migrating a PVHVM guest that is
running the UEK R3 kernel causes a disparity between the date
and time as displayed by date and hwclock. The workaround post
migration is either to run the command hwclock --hctosys on
the guest or to reboot the guest. (Bug ID 16861041)
* On virtualized systems that are built on Xen version 3,
including all releases of Oracle VM 2 including 2.2.2 and
2.2.3, disk synchronization requests for ext3 and ext4 file
systems result in journal corruption with kernel messages
similar to the following being logged:
blkfront: barrier: empty write xvda op failed
blkfront: xvda: barrier or flush: disabled
In addition, journal failures such as the following might be
reported:
Aborting journal on device xvda1
The workaround is to add the mount option barrier=0 to all
ext3 and ext4 file systems in the guest VM before upgrading to
UEK R3. For example, you would change a mount entry such as:
UUID=4e4287b1-87dc-47a8-b69a-075c7579eaf1 / ext3 defaults 1 1
so that it reads:
UUID=4e4287b1-87dc-47a8-b69a-075c7579eaf1 / ext3 defaults,barrier=
0 1 1
This issue does not apply to Xen 4 based systems, such as
Oracle VM 3. (Bug ID 17310816)
X.509 Certificates for module verification
The system reports a message similar to the following if there is
a problem loading an in-kernel X.509 module verification
certificate at boot time:
Loading module verification certificates
X.509: Cert 0c21da3d73dcdbaffc799e3d26f3c846a3afdc43 is not yet valid
MODSIGN: Problem loading in-kernel X.509 certificate (-129)
This error occurs because the hardware clock lags behind the
system time as shown by hwclock, for example:
# hwclock
Tue 20 Aug 2013 01:41:40 PM EDT -0.767004 seconds
The solution is to set the hardware clock from the system time by
running the following command:
# hwclock --systohc
After correcting the hardware clock, no error should be seen at
boot time, for example:
Loading module verification certificates
MODSIGN: Loaded cert 'Slarti: Josteldalsbreen signing key:
0c21da3d73dcdbaffc799e3d26f3c846a3afdc43'
(Bug ID 17346862)
Chapter 3. Installation and Availability
You can install Unbreakable Enterprise Kernel Release 3 on Oracle
Linux 6 Update 4 or newer, running either the Red Hat compatible
kernel or a previous version of the Unbreakable Enterprise Kernel.
If you are still running an older version of Oracle Linux, first
update your system to the latest available update release.
The Unbreakable Enterprise Kernel Release 3 is supported on the
x86-64 architecture but not on x86.
3.1. Installation Overview
If you have a subscription to Oracle Unbreakable Linux support,
you can obtain the packages for Unbreakable Enterprise Kernel
Release 3 by registering your system with the Unbreakable Linux
Network (ULN) and subscribing it to additional channels. See
Section 3.2, "Subscribing to ULN Channels."
If your system is not registered with ULN, you can obtain most of
the packages from Oracle Public Yum. See Section 3.3, "Enabling
Access to Public Yum Channels."
If you have previously installed any OFED packages on your system,
and you want to replace these with the latest packages that are
provided on the ol6_x86_64_ofed_UEK channel, you must manually
remove some of the existing packages. See Section 3.4, "Upgrading
OFED Packages."
Having subscribed your system to the appropriate channels on ULN
or Public Yum, upgrade your system. See Section 3.5, "Upgrading
Your System."
3.2. Subscribing to ULN Channels
The kernel image and user-space packages are available on the
following ULN channels:
* ol6_latest (latest user-space packages for Oracle Linux 6
other than DTrace, OFED, and DRBD packages)
* ol6_UEK_latest (latest user-space packages for UEK other than
DTrace, OFED, and DRBD packages)
* ol6_x86_64_UEKR3_latest (kernel-uek*, dtrace-modules-*,
libdtrace-*, and uname26)
* ol6_x86_64_Dtrace_userspace_latest (dtrace-utils*)
* ol6_x86_64_ofed_UEK (latest OFED tools packages)
* ol6_x86_64_mysql-ha-utils (drbd84-utils)
The following procedure assumes that you have already registered
your system with ULN.
To subscribe your system to a channel on ULN:
1. Log in to http://linux.oracle.com with your ULN user name and
password.
2. On the Systems tab, click the link named for the system in the
list of registered machines.
3. On the System Details page, click Manage Subscriptions.
4. On the System Summary page, select each required channel from
the list of available channels and click the right arrow to
move the channel to the list of subscribed channels.
Subscribe the system to the ol6_latest, ol6_UEK_latest, and
ol6_x86_64_UEKR3_latest channels. If required, you can also
add the channels for the DTrace, OFED, and DRBD packages.
5. Click Save Subscriptions.
For information about using ULN, see the Oracle Linux Unbreakable
Linux Network User's Guide at
http://docs.oracle.com/cd/E37670_01/index.html.
3.3. Enabling Access to Public Yum Channels
At the Oracle Public Yum repository at
http://public-yum.oracle.com/, the kernel image and user-space
packages are available on the following channels:
* ol6_latest (latest user-space packages for Oracle Linux 6
other than the OFED tool packages)
* ol6_UEK_latest (latest user-space packages for UEK other than
the OFED tool packages)
* ol6_x86_64_UEKR3_latest (kernel-uek*, dtrace-modules-*,
libdtrace-*, and uname26)
* ol6_x86_64_ofed_UEK (latest OFED tools packages)
Note
The DTrace utility and DRBD packages are not available on Public
Yum.
To enable access to the channels on Oracle Public Yum, create
entries such as the following in /etc/yum.conf or in a repository
file in the /etc/yum.repos.d directory:
[ol6_latest]
name=Oracle Linux $releasever Latest ($basearch)
baseurl=http://public-yum.oracle.com/repo/OracleLinux/OL6/latest/$bas
earch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1
[ol6_UEK_latest]
name=Latest Unbreakable Enterprise Kernel for Oracle Linux $releaseve
r ($basearch)
baseurl=http://public-yum.oracle.com/repo/OracleLinux/OL6/UEK/latest/
$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1
[ol6_UEKR3_latest]
name=Latest Unbreakable Enterprise Kernel Release 3 for Oracle Linux
$releasever ($basearch)
baseurl=http://public-yum.oracle.com/repo/OracleLinux/OL6/UEKR3/lates
t/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1
[ol6_playground_latest]
name=Latest mainline stable kernel for Oracle Linux 6 ($basearch) - U
nsupported
baseurl=http://public-yum.oracle.com/repo/OracleLinux/OL6/playground/
latest/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0
[ol6_ofed_UEK]
name=OFED supporting tool packages for Unbreakable Enterprise Kernel
on Oracle Linux 6 ($basearch)
baseurl=http://public-yum.oracle.com/repo/OracleLinux/OL6/ofed_UEK/$b
asearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=0
To enable a channel, set the value of the enabled parameter for
the channel to 1.
To disable a channel, set the value of the enabled parameter for
the channel to 0.
In this example, access is enabled to the ol6_latest,
ol6_UEK_latest, and ol6_UEKR3_latest channels but not to the
ol6_playground_latest and ol6_ofed_UEK channels.
You can find more information about installing the software at
http://public-yum.oracle.com/, from where you download a copy of a
suitable repository file
(http://public-yum.oracle.com/public-yum-ol6.repo).
Note
By default, the ol6_UEKR3_latest channel is not enabled in the
public-yum-ol6.repo file. You must enable this channel to be able
to install the kernel packages for UEK R3.
3.4. Upgrading OFED Packages
If you have enabled the ol6_ofed_UEK channel, you must remove any
existing OFED packages for the x86 architecture before you can
upgrade the remaining OFED packages on your system. You must also
completely remove and reinstall the ibutils packages. The latest
version of the ibutils package no longer depends on an
ibutils-libs package as the libraries are now included in ibutils
itself.
1. Use the following command to remove any non-upgradable
packages for the x86 architecture:
# rpm -e infiniband-diags-1.5.12-5.el6.i686 \
libibcm-1.0.5-3.el6.i686 \
libibcm-devel-1.0.5-3.el6.i686 \
libibmad-1.3.9-1.el6.i686 \
libibmad-devel-1.3.9-1.el6.i686 \
libibumad-1.3.8-1.el6.i686 \
libibumad-devel-1.3.8-1.el6.i686 \
libibverbs-1.1.6-5.el6.i686 \
libibverbs-devel-1.1.6-5.el6.i686 \
libmlx4-1.0.4-1.el6.i686 \
librdmacm-1.0.17-0.git4b5c1aa.el6.i686 \
librdmacm-devel-1.0.17-0.git4b5c1aa.el6.i686 \
opensm-devel-3.3.15-1.el6.i686 \
opensm-libs-3.3.15-1.el6.i686 \
ibacm-devel-1.0.8-0.git7a3adb7.el6.i686
2. Enter the following commands to remove the existing ibutils
and ibutils-libs packages and install the new ibutils package:
# rpm -e ibutils-1.5.7-7.el6.x86_64 \
ibutils-libs-1.5.7-7.el6.x86_64
# yum install ibutils
3.5. Upgrading Your System
After enabling access to the appropriate channels, including
ol6_UEKR3_latest, in the Public Yum repository or on ULN, run the
following command to upgrade the system to UEK R3:
# yum update
If you have questions regarding configuring or using yum to
install updates, refer to the Oracle Linux Administrator's
Solutions Guide at http://docs.oracle.com/cd/E37670_01/index.html.
The kernel's source code is available via a public git source code
repository at https://oss.oracle.com/git/?p=linux-uek3-3.8.git.
Appendix A. Other Changes
The following sections describe other features of Unbreakable
Enterprise Kernel Release 3 (UEK R3). The mainline version in
which a feature was introduced is noted in parentheses.
A.1. Architecture
* vsysscall emulation and vsyscall parameter. (3.1)
* INTEL_MID configuration. (3.1)
* mrst_pmu driver for Intel Moorestown Power Management Unit.
(3.1)
* Hardware memory error recovery support for ACPI, APEI, and
GHES. (3.1)
* printk() support for recoverable error via NMI for ACPI, APEI,
and GHES. (3.1)
A.2. Block Devices
* Strict CPU affinity can be enabled by setting the value of
/sys/block/blkdev/queue/rq_affinity to 2. Performance on some
systems benefits from being directed to the strict requester
CPU rather than using per-socket steering. (3.1)
* CFQ I/O scheduler performance tuning adds think time check for
a group, which makes bandwidth usage more efficient by not
leaving queues active when there are no further requests for
the group. (3.1)
* Flakey target support in the device mapper adds the
corrupt_bio_byte parameter to simulate corruption by
overwriting a byte at a specified position with a specified
value while the device is down. The drop_writes option
parameter drops writes silently while the device is down.
(3.1)
* The device mapper supports MD RAID-1 personality through the
dm-raid target. (3.1)
* The device mapper supports the ability to parse and use
metadata devices with dm-raid. Without the metadata devices,
many RAID features would be unavailable. (3.1)
* Experimental support for thin provisioning in the device
mapper allows the creation of multiple thinly provisioned
volumes from a storage pool and recursive snapshots to an
arbitrary depth. (3.2)
* I/O-less dirty throttling and reduced file-system writeback
from page reclamation greatly reduces I/O seeks and CPU
contention. (3.2)
* The cfq_target_latency parameter under sysfs allows throughput
and read latency to be tuned. (3.4)
* The device mapper supports adding and removing space at the
end of the devices when resizing RAID-10 arrays with near and
offset layouts. (3.4)
* Thin target in the device mapper supports discards. When
non-discard I/O completes and the associated mappings are
quiesced, any discards that were deferred (via ds_add_work()
in process_discard()) are queued for processing by the worker
thread. (3.4)
* Thin target in the device mapper provides user-space access to
pool metadata. Two new messages can be sent to the thin pool
target allowing it to take a snapshot of the metadata. This
read-only snapshot can be accessed from user space
concurrently with the live target. (3.5)
* Thin target in the device mapper uses dedicated slab caches
(whose names are prefixed with dm_) rather than relying on
kmalloc memory pools backed by generic slab caches. This
allows independent accounting of memory usage and any
associated memory leakage by thin provisioning. (3.5)
* RAID-5 XOR checksumming is optimized by taking advantage of
the 256-bit YMM registers introduced by Advanced Vector
Extensions (AVX). (3.5)
* RAID-6 includes Supplemental Streaming SIMD Extensions 3
(SSSE3) optimized recovery functions and a new algorithm for
selecting the most appropriate function to use for recovery.
(3.5)
* MD allows a reshape operation to be reversed by implementing a
new reshape_direction attribute that can be set when
delta_disks is zero, and which can take one of the values
forward or backwards. (3.5)
* A RAID-10 array can be reshaped to a different near or offset
layout, a different chunk size, and a different number of
devices. The number of copies cannot be changed. (3.5)
* An existing partition can be resized, even if currently in
use, by using the operation code BLKPG_RESIZE_PARTITION with
the BLKPG ioctl(). (3.6)
* Add MD support for RAID10 (striped mirrors) and RAID1E
(integrated adjacent stripe mirroring). (3.6)
* Thin target in the device mapper adds read-only and fail-io
modes to thin provisioning. If a transaction commit fails, a
pool's metadata device transitions to read-only mode. If a
commit fails when the device is in read-only mode, a
transition to fail-io mode occurs. In fail-io mode, the pool
and all associated thin devices report a status of fail if a
commit fails. (3.6)
* The persistent data debug space map checker has been removed
from the device mapper. The feature consumed a lot of memory
and caused other issues when enabled on large pools. (3.6)
* RAID-1 in MD now prevents the merging of large requests to
enhance the performance of SSD devices that function more
efficiently with large request transfers. (3.6)
* Support for the WRITE SAME request implemented on some SCSI
devices to allow a block to be efficiently replicated
throughout a block range. Only a single logical block need be
transferred from the host. The storage device writes the same
data to all blocks specified by the request. (3.7)
* The BLKZEROOUT ioctl() can be used to zero out block ranges
via blkdev_issue_zerooout(). (3.7)
* Fastmap support provides a method for attaching an unsorted
block image (UBI) device in real-time. Rather than scanning
the entire device, Fastmap locates a checkpoint. (3.7)
* MD adds TRIM discard support for linear RAID-0, RAID-1,
RAID-5, and RAID-10. (3.7)
* DM adds rebuild capacity and replacement slot validation for
RAID-10 arrays. (3.7)
* RAID-6 recovery is optimized by taking advantage of the
256-bit YMM registers introduced by Advanced Vector Extensions
2 (AVX2). (3.8)
A.3. Core Kernel Functionality
* Add a lock-less NULL-terminated single list. (3.1)
* Add a library function implementing a crc8 algorithm to
support the brcm80211 driver. (3.1)
* Make the gen_pool memory allocator lockless. This change makes
it safe to use the memory allocator in NMI handlers and other
special unblockable contexts where deadlocks might occur.
(3.1)
* Implement the PTRACE_INTERRUPT, PTRACE_LISTEN, PTRACE_SEIZE,
and TRAP_NOTIFY ptrace() requests. (3.1)
* Adds /sys/module/module_name/uevent files to all module
entries to provide a method for managing built-in modules from
user space. (3.1)
* Add support for the implementation of SEEK_HOLE and SEEK_DATA
in lseek(). (3.1)
* Add the ! escape character to / in hostname and comm strings
in core dumps. (3.1)
* If the value of the sysctl parameter shm_rmid_forced is set to
11, all shared memory objects are marked for removal with
IPC_RMID. As this change breaks POSIX compliance, you need to
ensure that no threads are using the orphaned memory. (3.1)
* Add support for generic I/O power management domains (v8) by
introducing common headers, helper functions, and callbacks to
allow platforms to use simple, generic power domains for
runtime power management. (3.1)
* Add system-wide power transitions (system suspend and
hibernation) support for generic domains (v5). Add suspend,
resume, freeze, thaw, poweroff, and restore callbacks that are
associated with struct generic_pm_domain objects and have
pm_genpd_init() interpret them as appropriate. (3.1)
* Add wakeup device support for system-sleep transitions.
Introduce a new generic power management domain callback
routine, .active_wakeup(). This routine is used during the
noirq phase of system suspend and hibernation to decide how to
handle wakeup devices. (3.1)
* Add the ability to set a maximum limit for allowable CPU
bandwidth to the process bandwidth controller. The limit is
specified as a quota and a period for a group of processes.
(3.2)
* To reduce the performance impact from using i_mutex lock with
generic_file_llseek(), an almost lockless
generic_file_llseek() is added to VFS that allows the maximum
file size of the file system to be passed in, instead of
always using maxbytes from the superblock. (3.2)
* A boot parameter of the form
root=PARTUUID=uuid,PARTNROFF=partition_number_offset extends
the root=PARTUUID=uuid syntax to select the root partition by
specifying an integer offset from a known, unique partition.
(3.2)
* Add a fault reporting mechanism to the input/output memory
management unit (IOMMU) API. (3.2)
* Allow partition creation from user space and add discard
support for loop devices. (3.2)
* When performing AIO, allocate kiocb structures in batches to
reduce the CPU overhead of a process taking and releasing the
context lock. (3.2)
* Add support for the tagged files ease-of-use feature in sysfs.
(3.2)
* Add a comm change event to the process connector. (3.2)
* Add architecture-independent support for highmem page
poisoning and verification to debug-pagealloc. (3.2)
* Add support for poll() in sysctl so that user-space
applications can be notified of changes to sysctl entries.
(3.2)
* The x32 kernel ABI (kABI) allows programs to take advantage of
x86-64 features such as a larger number of CPU registers,
better floating-point performance, faster position-independent
code shared libraries, function parameters passed via
registers, and faster system-call instructions. The kABI uses
32-bit pointers and avoids the overhead of 64-bit pointers.
The program is limited to a 4-GB virtual address space.
However, reducing the memory footprint can also allow a
program to run faster. (3.4)
* The nomodule kernel parameter can be used to disable module
loading as an alternative to using sysctl.
* The prctl() PR_GET_CHILD_SUBREAPER and PR_SET_CHILD_SUBREAPER
options implement simple process supervision of orphaned
processes. (3.4)
* Thread stacks are now marked correctly for proc/pid/maps under
procfs. (3.4)
* Restore the sysctl setting kernel.pty.max as the global limit
of pseudo terminals (by default, 4096). (3.4)
* Add abilities to turn the reboot notifier on or off, and to
enter the debugger and stop kernel execution before rebooting.
(3.4)
* To improve performance, VFS now uses unsigned long accesses
for dcache name comparison and hashing. (3.4)
* /proc/pid/task/tid/children entries provide information about
task children and can be useful for process checkpoint and
restore operations. (3.5)
* /proc/pid/pagemap now reports whether file pages are
shared-anon or file-page. (3.5)
* The skew_tick boot option mitigates xtime_lock contention on
larger systems or read-copy-update (RCU) lock contention on
all systems when CONFIG_MAXSMP is set. This option increases
power consumption and should only be enabled if the system
runs jitter-sensitive workloads (typically, HPC or RT). (3.5)
* Inode stat information is moved closer together to increase
the likelihood of cache hits. (3.5)
* The fallocate() file-system operation allows preallocation
space for a file. (3.5)
* Stale power-aware scheduling remnants and dysfunctional knobs
have been removed from the process scheduler. (3.5)
* The EPOLLWAKEUP flag prevents system suspension while epoll
events are ready. (3.5)
* ramoops uses the pstore interface instead of /dev/mem. (3.5)
* Add ECC support to pstore/ram. (3.5)
* make tools is now integrated with the kernel build system.
(3.5)
* The kernel parameter RCU_FANOUT_LEAF can be used to control
leaf-level fanout for RCU locking to reduce cache-miss
initialization latencies on large systems. (3.5)
* RCU locking now implements a direct algorithmic sleepable RCU
(SRCU) implementation to prevent OS jitter and performance
degredation. (3.5)
* Add rbtree node caching support to IPC mqueue for the case
where the queue is empty, improve performance of send/recv,
and update maximums for the mqueue subsystem. (3.5)
* Add symbolic and hard link restrictions to VFS to address
security issues. (3.6)
* Improvements to the IOMMU group implementation. (3.6)
* Remove the non-working x86 power estimation feature from the
process scheduler. (3.6)
* Add hysteresis attributes (used by most thermal sensors) on a
per-trip-point basis to the thermal framework. (3.6)
* Add support for states that affect multiple CPUs. This is
potentially useful in implementations where CPUs leverage a
shared, coupled power state. (3.6)
* The rcutree.rcu_fanout_leaf boot parameter allows the value of
RCU_FANOUT_LEAF to be increased but not decreased. (3.6)
* Firmware files can be loaded directly from the file system
rather than from udev. (3.7)
* xattr support in cgroups allow run-time metadata to be
attached to cgroups. (3.7)
* The disable_nmi command in kdb disables NMI-entry and releases
the port. (3.7)
* Add a special serial console driver to allow the temporary use
of an NMI debugger port as a normal console via the
nmi_console command. (3.7)
* RCU locking changes:
+ Control grace period duration from sysfs.
+ Make rcutree module parameters visible in sysfs.
+ Allow an RCU lock to be placed in an extended quiescent
state when the CPU runs in user space.
(3.7)
* Add system call to enforce that kernel modules are loaded only
from a read-only cryptographically verified root file system.
(3.8)
* Applications can choose between using 1-GB and 2-MB huge
pages. Typically, this feature is used in conjunction with a
NUMA policy. (3.8)
* Add option to allow assignment of a memory node as movable
memory, which allows an entire node to be hot-pluggable. (3.8)
* Add sysctl variables to tune checkpoint/restart in user space
(CRIU) including specifying the ID of the next IPC object to
be allocated. (3.8)
* Introduce CRIU message queue copy feature so that all pending
IPC messages can be retrieved without deleting them from the
queue. (3.8)
* Correct the implementation of hierarchy support for the
freezer cgroup. If a cgroup is frozen, all its descendants are
also frozen. (3.8)
* Implement the PTRACE_O_EXITKILL ptrace() request. (3.8)
* Add the VmFlags field to /proc/PID/smaps output. Required by
CRIU. (3.8)
* Add TIOCGPKT, TIOCGPTLCK and TIOCGEXCL ioctl() calls to obtain
the package mode and locking state of a pseudo terminal, and
to obtain exclusive mode on a tty. (3.8)
* Add a module parameter to force the use of expedited RCU
primitives, which can benefit some embedded applications.
(3.8)
* Allow selected CPUs to have RCU callbacks offloaded to
kthreads to prevent or minimize OS jitter. (3.8)
* Provide support in sysfs to determine the maximum number of
virtual functions (VFs) and Single Root I/O Virtualization
(SR-IOV) capable PCIe devices that are supported, and the
methods that are available for enabling and disabling VFs on a
per-device basis. (3.8)
* Add a sysfs node to present the available frequencies for
power management. (3.8)
* Add the PM_QOS_FLAG_NO_POWER_OFF and PM_QOS_FLAG_REMOTE_WAKEUP
power management QoS device flags. (3.8)
* Add a sysfs node to present frequency transition information
for power management. (3.8)
A.4. Cryptography
* Ablkcipher now support encryption and decryption for AES, DES,
and 3DES. (3.1)
* Add an eCryptfs mount option to check that the UID of the
device being mounted is the same as the expected UID. (3.1).
* The encrypted key type has been extended with the introduction
of the ecryptfs format, intended for use with the eCryptfs
file system. The ecryptfs format stores an authentication
token structure inside an encrypted key payload, containing a
randomly generated symmetric key. (3.1)
* An new user-space configuration API enables the instantiation,
removal, and display of cryptographic algorithms from user
space. (3.2)
* An x86-64 implementation of Blowfish provides two sets of
assembler functions:
+ Regular one-block-at-a-time (1-way) encryption and
decryption functions
+ Four-blocks-at-a-time (4-way) functions that provide
improved performance on out-of-order CPUs
On in-order CPUs, the performance of 4-way functions should be
equal to that of 1-way functions. (3.2)
* An x86-64 assembler implementation of the SHA1 algorithm uses
Supplemental Streaming SIMD Extensions 3 (SSSE3) instructions
or Advanced Vector Extensions (AVX) if available. Testing with
the tcrypt module demonstrates that raw hash performance is up
to 2.3 times faster than the C implementation. (3.2)
* A 3-way parallel x86-64 assembler implementation of Twofish
encrypts data in three-block chunks, which improves cipher
performance on out-of-order CPUs. (3.2)
* Add support for MD5 algorithms to CAAM. (3.3)
* RSA digital-signature verification is implemented using the
multiprecision math library from GnuPG, and is used by the
IMA/EVM digital signature extension. (3.3)
* A 4-way parallel i586/SSE2 assembler implementation of Serpent
encrypts data in 4-block chunks. (3.3)
* An 8-way parallel x86-64/SSE2 assembler implementation of
Serpent encrypts data in 8-block chunks (two 4-block chunk
SSE2 operations are performed in parallel to improve
performance on out-of-order CPUs). (3.3)
* LRW and XTS support added to Serpent-sse2. (3.3)
* HMAC algorithms added to Talitos. (3.3)
* XTS support added to twofish-x86_64-3way. (3.3)
* Add sha224 and sha384 variants to existing AEAD algorithms in
CAAM. (3.4)
* Add x86-64 assembler implementation of the Camellia block
cipher. Two sets of functions are provided:
+ Regular one-block-at-a-time (1-way) encryption and
decryption functions
+ Two-blocks-at-a-time (2-way) functions that provide
improved performance on out-of-order CPUs
On in-order CPUs, the performance of 2-way functions should be
equal to that of 1-way functions. (3.4)
* Add Tegra AES hardware driver supporting ecb, cbc, ofb, and
ansi_x9.31rng modes, and 128, 192 and 256-bit key sizes. (3.4)
* Add a slice-by-8 algorithm to the existing slice-by-4
algorithm in crc32. The BITS size is expanded from 32 to 64,
tables are extended from tab[4][256] to tab[8][256], and
inner-loop code is added. (3.4)
* Improve performance of aesni_intel by using parallel LRW and
XTS encryption with AES-NI hardware pipelines. (3.7)
* Add IPSec extended sequence number (ESN) support to CAAM and
Talitos. (3.7)
* A x86-64/AVX assembler implementation of the Cast5 block
cipher allows 16 blocks to be processed in parallel. (3.7)
* Implement signature verification algorithms for RSA public key
cryptography. At present, only the signature verification
algorithm is supported (PKCS# | RFC3447). (3.7)
* Add a crypto key parser for binary (DER) X.509 certifications,
an ASN.1 decoder, and a simple ASN.1 grammar compiler. (3.7)
* Add HASH-HMAC with SHA algorithms and MD5 to CAAM. (3.6)
* Add hardware random number generator support to CAAM. (3.6)
* Add a x86-64/AVX assembler implementation of the Serpent block
cipher. (3.6)
* Add x86-64/AVX assembler implementation of the Twofish block
cipher. (3.6)
* Add sha224, sha384, and sha512 to the existing AEAD algorithms
in Talitos so that it supports all combinations of CBC (AES,
3DES-EDE) and HMAC (SHA-1, 224, 256, 384, and 512). (3.6)
A.5. Device Mapper
* The always writable feature indicates that a target does not
support read-only mode. (3.2)
* The immutable feature indicates that a target type cannot be
mixed with any other target type. Once loaded into a device,
it cannot be replaced with a table that contains a different
type. (3.2)
* Add a singleton table that can contain only one target. (3.2)
* Log device dependency allows registration of a log device so
that it is included in the list of device dependencies. (3.2)
* A verity target allows a device to store cryptographic hashes
of file system blocks. The device can be used to check every
read of the file system. If the hash of the block does not
match that of the file system, the read fails. (3.4)
A.6. Driver Support
* Broadcom NetXtreme II 10Gbps network adapter driver (bnx2x):
Add AutogrEEEn support for BCM84833 and 5418se, and multiple
concurrent I2 traffic classes. (3.1)
* Broadcom NetXtreme II iSCSI driver (bnx2i): Add support for
57800, 57810, and 57840. (3.1)
* Brocade BFA FC SCSI driver (bfa):
+ FAA support
+ HBA diagnostic support
+ CEE information and statistics query
+ Flash configuration
+ Collect and reset fcport statistics
+ Configure LUN masking
+ Configure QoS and collect statistics
+ Support for obtaining SFP information
+ Support for FC-transport based Asynchronous Event
Notification
+ Support for I/O profiling
+ Collect or reset fabric statistics
+ Configure and query flash boot partition
+ Configure trunking on Brocade adapter ports
+ store driver configuration in flash memory
+ Brocade-1860 Fabric Adapter 16Gbs support and flash
controller fixes
+ Brocade-1860 Fabric Adapter Hardware enablement
+ Brocade-1860 Fabric Adapter vHBA support
+ Initiator-based LUN masking
(3.1)
* Emulex Blade Engine 2 10Gbps adapter driver (be2net): Add
support for multiple Tx queues. (3.1)
* Emulex FC/FCoE driver (lpfc): Add FCF priority failover
functionality. (3.1)
* Intel PRO/1000 PCI-Express Gigabit network adapter driver
(e1000e): Add Jumbo Frame support for the 82583 Gigabit
Ethernet Controller. (3.1)
* QLogic 1/10 GbE Converged/Intelligent Ethernet Adapter driver
(qlcnic): Add multi-protocol internal loopback support. Driver
can now generate loopback traffic, conduct tests, and return
the results to an application. (3.1)
* coretemp: Add core and package threshold support. The
thresholds are configured using the tempX_max and
tempX_max_hyst interfaces in sysfs. An interrupt is generated
if the CPU temperature reaches or crosses above tempX_max or
if it drops below tempX_max_hyst. To allow the hysteresis
mechanism to work, the value of tempX_max should be configured
to be several degrees higher than the value of tempX_max_hyst.
(3.1)
A.7. File Systems
btrfs
* Add a DCACHE_NEED_LOOKUP flag to d_flags to improve the
performance of ls and readdir(). (3.1)
* Switching from tree locks to reader/writer locks improves the
performance of read and write-intensive workloads. (3.1)
* Performance improvements in several areas, particularly for
random write workloads. (3.2)
* Allowing overcommit of ENOSPC reservations to improve
performance. (3.2)
* Add automatic backup of superblock information about tree
roots for the previous 4 commits. Add the -o recovery mount
option to enable use the root history log if required. (3.2)
* Add code to follow back references, replacing the manual
process for walking those references, and including more
detailed corruption messages. (3.2)
* Allow user-space utilities to inspect metadata. (3.2)
* Improve performance of checksum verification of read-aheads.
(3.2)
* Add the nospace_cache mount option to disable cache loading
without clearing the cache. (3.2)
* Improve performance of committing transactions. (3.2)
* When mounting a subvolume, allow a path relative to the tree
root to be specified to -o subvol. (3.2)
* Rework the logic for cluster allocation. (3.3)
* Rewrite the block group trimming code. (3.3)
* Increase the size of system chunks. (3.3)
* Remove caching code that caused unnecessary fragmentation and
complexity. (3.4)
* Remove the code to silently switching single chunks to RAID-0
when balancing a file system. The restriper now allows a
choice of RAID-0 or concatenation. (3.4)
* Support metadata blocks that are larger than 4 KB. (3.5)
* The thread_pool size can be changed at remount time. (3.5)
* Add the DEVICE_READY ioctl() to be used in conjunction with
btrfs device ready device, providing a lightweight method of
telling if all the devices required for a file system are
currently in the cache. (3.6)
* Allow compression to be disabled by specifying the compress=no
mount option. (3.6)
* Improve multithread buffer reads. (3.6)
* Support UUIDs for subvolumes, and introduce ctime, otime,
stime, and rtime for subvolumes, including a transid for each
time. (3.6)
* Rework the DEV_STATS ioctl() to allow it to either get or
reset device statistics depending on the argument specified.
(3.6)
* Make the compress and nodatacow mount options mutually
exclusive. To improve O_SYNC performance, asynchronous
metadata checksumming is not performed under some
circumstances. (3.7)
For more information, see
https://btrfs.wiki.kernel.org/index.php/Changelog.
cifs
* Add UID/GID to SID mapping. (3.2)
* Add backup mount option. (3.2)
* Allow larger rsize (up to 16 MB) and change the default to 1
MB. (3.2)
* Introduce credit-based flow control. (3.4)
* Add the cache=strict|none mount option to specify the cache
type instead of the strictcache and forcedirectio options. The
legacy options are now mutually exclusive. (3.5)
* The vers=2.1 mount option forces an SMB2 mount. By default,
vers=1 (CIFS) is used. (3.5)
* The vers=2.0 mount option forces an SMB2.02 mount. (3.8)
ext4
* Reduce CPU overhead when appending files preallocated using
fallocate() with mode FALLOC_FL_KEEP_SIZE via direct I/O.
(3.2)
* Reduce CPU overhead by optimizing memmove() lengths in extent
and index insertions. (3.2)
* Support block sizes of up to 1 MB using the -C option to
mkfs.ext4. This change is not backwards compatible with older
kernels. (3.2)
* Remove the resize and journal=update mount option. (3.4)
* Improve performance of truncate and unlink. (3.7)
* Support online resizing of metablock group (META_BG) and
64-bit file systems. (3.7)
* Add max_dir_size_kb mount option to specify a maximum
directory size. (3.7)
* Re-enable -o discard functionality in no-journal mode. (3.7)
* Remove support for disabling extended attributes. (3.8)
* Implement support for SEEK_DATA and SEEK_HOLE. (3.8)
NFS
* Add support for the RAID-5 read-4-write interface. (3.2)
* Add v4.0 and v4.1 mount options. (3.4)
* The kernel can deduce the value of clientaddr if this mount
option is not specified for NFS v4. (3.4)
* Add the migration mount option that specifies whether a server
supports Transparent State Migration (TSM). (3.7)
* Handle IPv6 remote addresses from GETDEVICEINFO (required for
pNFS). (3.8)
* Remove the deprecated nfsctl() system call and all related
code. (3.8)
pstore
* Add runtime logging support for kernel messages to allow
debugging of hangs caused by hardware issues. (3.6)
* Add console message handling. The log size is configurable by
using the ramoops.console_size module option, and the log is
accessible at pstore-mountpoint/console-ramoops. (3.6)
* Add persistent function tracing. The kernel can save the
function call chain log to a persistent RAM buffer, which can
be decoded and dumped after a reboot. You can use the log to
determine the function that was called immediately prior to a
reset or panic. (3.6)
tmpfs
* Increase the file size limit for tmpfs. (3.1)
* Support fallocate() FALLOC_FL_PUNCH_HOLE and preallocation.
(3.5)
XFS
* Improve performance of the inode cache. (3.1)
* Improve scalability of per-file-system quotas. (3.4)
* Implement support for SEEK_DATA and SEEK_HOLE. (3.5)
* Make the inode32 and inode64 mount options work with remounts.
(3.7)
* Make inode64 the default allocation mode. (3.7)
* Add the XFS_IOC_FREE_EOFBLOCKS ioctl() to enable EOFBLOCKS
scanning. (3.8)
A.8. Memory Management
* Add memory.vmscan_stat memory control group that displays
numbers of scanned, rotated, and freed pages, and elapsed
times for direct reclaim and soft reclaim. (3.1)
* Extend the memory hotplug API to allow memory hotplug in
virtual machines. Also required for the Xen balloon driver.
(3.1)
* Fix significant stalls in the page allocator when copying
large amounts of data on NUMA machines. (3.1)
* Add slub_debug method to the slub slab allocator to check if
memory is not freed and help diagnose memory usage. (3.1)
* Reduce CPU overhead of slub_debug. (3.1)
* The cross memory attach feature adds the system calls
process_vm_readv and process_vm_writev(), which allow data to
be transferred between the address spaces of the two processes
without passing through kernel space. (3.2)
* Add a block plug for page reclaim to vmscan that reduces CPU
overhead by reducing lock contention and merging requests.
(3.2)
* Implement per-CPU cache in slub for partial pages. (3.2)
* Restrict access to slab files under procfs and sysfs, hiding
slabinfo and /sys/kernel/slab/*. (3.2)
* Add the slab_max_order kernel parameter that determines the
maximum allowed order for slabs. High settings can cause OOMs
due to memory fragmentation. The default value is 1 for
systems with more than 32 MB of RAM. Otherwise, the default
value is 0. (3.3)
* To increase the probability of detecting memory corruption,
change the buddy allocator to retain more free, protected
pages and to interlace free, protected pages and allocated
pages. (3.3)
* Charge the pages dirtied by an exited process to random
dirtying tasks. (3.3)
* Allow the poll time and call intervals to balance dirty pages
to be controlled by the value of the max_pause parameter.
(3.3)
* Fix dirtied pages accounting on sub-page writes. (3.3)
* Introduce the dirty rate limit to compensate a task's think
time when computing the final pause time. (3.3)
* Reduce dirty throttling polls and CPU overhead. (3.3)
* Avoid tiny dirty poll intervals. (3.3)
* Make swap-in read-ahead skip over holes, allowing the system
to swap back in at several MB/s, instead of a few hundred
kB/s. (3.4)
* Introduce bit-optimized iterator and radix tree cleanup in the
core page cache. (3.4)
* Improve allocation of contiguous memory chunks by adding DMA
mapping helper functions. (3.5)
* Remove swap token code and lumpy reclaim. (3.5)
* Improve throughput and reduce CPU overhead by allowing swap
read-ahead to be merged. (3.6)
* Add cgroup controller that allows HugeTLB usage per control
group to be limited and enforces the limit during page faults.
(3.6)
A.9. Networking
* Add CPU fanout policies for hashing to the packet interface
based on mapping socket buffers to Rx hashes, and a pure
round-robin scheme. (3.1)
* Improve the client announcement mechanism in the Better
Approach To Mobile Adhoc Networking (B.A.T.M.A.N.) routing
protocol. The change resolves performance and latency issues
with the previous implementation by appending client changes
(new client joined or client left) to the OGM. System overhead
is reduced by allowing nodes to modify their global tables by
means of updates. The new ROAMING_ADVERTISEMENT packet type
eliminates latency and packet drop issues seen with OGM
broadcasting. (3.1)
* Add support for zero-copy socket buffers. Adds user-space
buffer support in the socket buffer shared information. (3.1)
* Use MD5 to compute protocol sequence numbers and fragment IDs
per RFC1948. Update code to take into account current CPU
speeds and to use a full 32-bit sequence number. (3.1)
* Add a multicast group for DCB to provide a clean method for
disseminating kernel DCB link attributes to user space. (3.1)
* Add SELinux context support to the AUDIT target of netfilter.
(3.1)
* Add range support for IPv4 to netfilter. (3.1)
* Lower the default init retransmission timeout (RTO) from 3
seconds to 1 second per RFC2988bis. The RTO falls back to 3
seconds if a SYN or SYN-ACK packet has been retransmitted and
the TCP time stamp option is not on. (3.1)
* Implement support for Auto-ASCONF (see RFC5061) in the Stream
Control Transmission Protocol (SCTP) stack. The change
includes features for enabling and configuring settings. (3.1)
* Reduce the false sharing effect. (3.1)
* Reduce CPU overhead of check_leaf() with the route cache
disabled. (3.1)
* Add support to the virtio_net driver to obtain Rx and Tx ring
parameter information from an Ethernet device. Used by the
ethtool -g ethX command. (3.2)
* Implement AP isolation on the receiver and sender side for
B.A.T.M.A.N. When a node receives a unicast packet, it checks
whether the source and destination client can communicate due
to the AP isolation. (3.2)
* Remove the IPv4 gc_interval from sysctl. (3.2)
* Add TPACKET_V3 support including a flexible buffer
implementation. (3.2)
* Allow forwarding of some link-local frames by network bridges.
You can use /sys/class/net/brX/bridge/group_fwd_mask in sysfs
to control frame forwarding. (3.2)
* Implement TCP proportional rate reduction. (3.2)
* Add netlink-based Content Addressable Network (CAN) routing.
(3.2)
* Add support for the socket monitoring interface used by the ss
tool. (3.3)
* Add support for the SCSI RDMP Protocol (SRP) target driver.
The SRP protocol allows an initiator to access a block storage
device on another host (target) over a network that supports
the RDMA protocol. Currently, the RDMA protocol is supported
by InfiniBand. (3.3)
* Add unresolved queue limits to neigh. Deprecate
/proc/sys/net/ipv4/neigh/default/unres_qlen, and replace it
with unres_qlen_bytes. (3.3)
* Add CAIF USB support. (3.3)
* Add an extended accounting infrastructure for netfilter over
nfnetlink, which allows the display of real-time traffic
accounting without requiring a complicated and
resource-consuming implementation in user space. (3.3)
* Add nfacct match to netfilter, which supports extended
accounting. (3.3)
* Add reverse patch filter (rpfilter) to netfilter, which allows
matching of packets where replies use the same interface on
which the packet arrived. (3.3)
* Add adaptive random early detection (RED) active queue
management (AQM) to the packet scheduler. (3.3)
* Add an optional RED on top of stochastic fairness queueing
(SFQ) to the packet scheduler, enabling SFQ features such as
specifying a smaller per flow limit for in-flight packets, up
to 65408 active flows (as compared to 127 previously), head
drops instead of tail drops, and optional RED on each SFQ flow
queue. (3.3)
* Add 802.1q netpoll support to vlan. (3.3)
* Add NTF_USE bridge support plus other changes to allow the
control of forwarding database via netlink. (3.3)
* New plug-queuing discipline allows a user space application to
plug or unplug a network output queue via the Netlink
interface. (3.4)
* Add the ability to change the routing algorithm at runtime to
B.A.T.M.A.N. (3.4)
* RCU conversion in TCP allows access to MD5 keys without
locking the listener socket. (3.4)
* For some workloads, allowing splice() to build full TSO
packets can reduce number of logical packets sent by an order
of magnitude, making zero-copy TCP faster than one-copy. (3.4)
* Add the SO_PEEK_OFF socket option. (3.4)
* Support peeking offset for datagram sockets, seqpacket
sockets, and stream sockets. (3.4)
* Add MSG_TRUNC support for datagram sockets so that recv()
returns the real length of the packet, even if it is longer
than the passed buffer. (3.4)
* Add missing SO_NOFCS socket option. (3.4)
* Add timeout extension to netfilter, which allows timeout
policies to be attached to the flow via the connection
tracking target. Add the cttimeout infrastructure for fine
timeout tuning. (3.4)
* Add NAT support for expectation classes in netfilter. (3.4)
* Add exceptions support to netfilter. (3.4)
* Merge ipt_LOG and ip6_LOG into xt_log in netfilter. (3.4)
* Add hardware-independent IEEE 802.15.4 networking stack for
softMAC devices. (3.5)
* Tune performance of sk_add_backlog. (3.5)
* Add binary option type, a load-balancer module, a per-port
option for enabling or disabling ports, and support for
per-port options to the team device. (3.5)
* Add raw packet QP type IB_QPT_RAW_PACKET to InfiniBand core.
This allows applications to build a complete packet, including
L2 headers, when sending. On the receive side, the hardware
does not strip any headers. This feature is designed for
user-space direct access to Ethernet. (3.5)
* Treat ND option 31 as user land (DNSSL support) in IPv6 per
RFC6106. The 8-bit identifier of the DNSSL option type
assigned by the IANA has the value 31. (3.5)
* Replace basic bridge loop avoidance code in the batman-adv
module. (3.5)
* Set traffic class for CAIF packets based on socket priority,
CAIF protocol type, or type of message. (3.5)
* Add generic PF_BRIDGE:RTM_FDB hooks and two new flags:
NTF_MASTER and NTF_SELF. (3.5)
* Add Explicit Congestion Notification (ECN) capability to
pktsched. Instead of dropping packets, attempt to mark them as
ECN. (3.5)
* Remove support for token ring. (3.5)
* Remove support for Econet protocol. (3.5)
* Add an optional QoS attribute to DCB netlink to allow the
setting of a rate limit for an ETS TC. 3.5
* Add CEE notify calls when an APP change or setall command is
made from user space. (3.5)
* Add HMARK target support to netfilter. (3.5)
* If net.bridge.bridge-nf-filter-vlan-tagged is enabled in
sysctl, bridge netfilter removes the vlan header temporarily
and feeds the packet to iptables or ip6tables. Add
bridge-nf-pass-vlan-input-device, which if set to on (default
is off), netfilter also sets the in interface to the vlan
interface if this interface exists. This change allows the
iptables REDIRECT target work with vlan-on-top-of-bridge
configurations and the use of iptables -i" to match the vlan
device name. (3.5)
* Allow byte-based limit mode can be used with netfilter, for
example, to support ingress-traffic policing or to detect when
a host or port consumes more bandwidth than expected. (3.5)
* Add support for sync threads to netfilter. (3.5)
* Remove ip_queue support from netfilter. (3.5)
* Add support for Layer 2 Tunneling Protocol (L2TP) over UDP in
IPv6. (3.5)
* Add L2TPv3 IP encapsulation support for IPv6. (3.5)
* Add netlink API for L2TPv3 unmanaged tunnels over IPv6. (3.5)
* Remove IPv4 routing cache that was vulnerable to denial of
service attacks. (3.6)
* Implement RFC 5691 3.2 and RFC 5961 4.2 (Mitigation against
Blind Reset attack using RST bit and SYN bit). (3.6)
* Add VTI support. (3.6)
* Add an interface option route_localnet that enables the
routing of the 127/8 address block and processing of ARP
requests on a specific interface (for example, to address a
pool of virtual guests behind a load balancer). (3.6)
* Add multiqueue and netpoll support to team. (3.6)
* Add experimental zero-copy Tx support to tun. (3.6)
* Add support for 40GbE. (3.6)
* Add fail-open support to netfilter, where the queue-full
condition does not drop packets. (3.6)
* Add user-space connection tracking helper infrastructure to
netfilter. (3.6)
* Extends the ethtool interface to add support for the EEE
commands: get_eee'and set_eee. (3.6)
* Add Generic Routing Encapsulation (GRE) over IPv6, generic
segmentation offload (GSO), and GRO capability. (3.7)
* Set default MTU for loopback devices to 64 KB. Allows TCP
stacks to build large frames and significantly reduces stack
overhead. (3.7)
* Add an extended attribute to store data for the mapping
between inode numbers in sockfs and protocol types for use by
lsof. 3.7
* Implement a per-task fragmentation allocator, which can
improve TCP stream performance by 20% on loopback devices.
(3.7)
* Various netfilter changes:
+ Add a protocol-independent NAT core.
+ Add IPv6 MASQUERADE target.
+ Add IPv6 NETMAP target.
+ Add IPv6 REDIRECT target.
+ Add IPv6 AT support.
+ Support IPv6 FTP NAT helper.
+ Support IPv6 IRC NAT helper.
+ Support IPv6 SIP NAT helper.
+ Support IPv6 in the amanda NAT helper.
+ Add stateless IPv6-to-IPv6 Network Prefix Translation
target.
+ Remove xt_NOTRACK.
(3.7)
* Add link layer control (LLC) core layer to HCI 2, add an SHDLC
llc module to the lic core, and add LLCP raw socket support to
NFC. (3.7)
* Support IPv6 transmit hashing (and TCP or UDP over IPv6) in
the bonding driver. (3.7)
* Add support for dumping diagnostic core and basic socket
information (family, type and protocol) at socket creation
time. (3.7)
* Add support to ethtool for setting the MDI/MDI-x state for
twisted-pair wiring. (3.7)
* Add 64-bit statistics support to PPP, including tx_bytes,
rx_bytes, tx_packets, and rx_packets. 3.7
* Add generic netlink support for tcp_metrics that allows
unlinking and deletion of entries after a grace period. (3.7)
* Add bridge port parameters over netlink to permit dumping,
monitoring, and changing the bridge multicast database. (3.8)
* Add support for RFC 5961 5.2 Blind Data Injection Attack
Mitigation. (3.8)
* Change default TCP hash size, and add support for
hardware-offloaded encapsulation and offloading of
encapsulated packets for VXLAN and IP GRE. (3.8)
* Add vlan tag access to netfilter. (3.8)
* Add extensions to VXLAN to support Distributed Overlay Virtual
Ethernet (DOVE) networks. (3.8)
* Add IPv6 set action functionality to openswitch. (3.8)
* Add GSO support to IPIP tunnels, increasing the performance of
a single TCP flow. (3.8)
* Implement IPv6 fragment handling for IPVS (3.8)
* Add support in netfilter for querying the destination address
of a redirected connection. (3.8)
* Add NOTRACK target recovery to netfilter. (3.8)
* Implement QFQ+ in sched. (3.8)
* Add support for RTM_GETNETCONF to routing netlink. (3.8)
* Add support for per-association statistics by implementing the
SCTP_GET_ASSOC_STATS call for the Stream Control Transmission
Protocol (SCTP). (3.8)
* Add a sysctl that allows the selection of the HMAC algorithm
(static or dynamic) used by SCTP. (3.8)
* Add support for SO_ATTACH_FILTER required to save the full
state of a socket. (3.8)
* Convert tun/tap into a multiqueue device and expose the queues
as file descriptors in user space. (3.8)
A.10. perf Utility
* Add the --symfs option to perf annotate. (3.2)
* Add the drop monitor script. (3.2)
* Add the -o and --append options to perf stat. (3.2)
* Add the -M option. (3.2)
* Add annotation output controls to all perf tools that have
integrated annotation. (3.2)
* Include information about the host environment in perf.data:
HEADER_HOSTNAME
Host name.
HEADER_OSRELEASE
Kernel release number.
HEADER_ARCH
Hardware architecture.
HEADER_CPUDESC
Generic CPU description.
HEADER_NRCPUS
Number of online, available CPUs.
HEADER_CMDLINE
perf command line.
HEADER_VERSION
perf version.
HEADER_TOPOLOGY
CPU topology.
HEADER_EVENT_DESC
Full event description (attrs).
HEADER_CPUID
Easy-to-parse, low-level CPU identification.
(3.2)
* Accept FIFOs as input files. (3.3)
* Add -a option for system-wide profiling. (3.3)
* Implement printing snapshots to files. (3.6)
* Add sort by source line number. (3.6)
* Add PMU event alias support. (3.6)
* Add support for perf kvm stat to analyze kvm vmexit, mmio, and
ioport. (3.7)
* Add union member access. (3.7)
* Add --list-opts option to print long option names for use with
bash. (3.7)
* Add script browser. (3.8)
* Add new display options (-F, -p, and -P) to perf diff. (3.8)
* perf inject now supports input from a file. 3.8
* Add --pre and --post options to perf stat. (3.8)
* Add gtk.command config option to launch the GTK browser. This
is equivalent to specifying --gtk option on command line (3.8)
* Add new features to perf trace. (3.8)
* Expose hardware events translations in sysfs. (3.8)
* Add trace_options boot parameter to set trace options at boot
time, such as enabling event stack dumps. (3.8)
A.11. Power Management
* Add a generic DVFS framework with device-specific (non-CPU)
OPPs. (3.2)
* Improve performance of LZO/plain hibernation. (3.2)
* Implement per-device power management QoS contraints. (3.2)
A.12. Security
* Add /sys/kernel/security/tomoyo/audit_interface, which
generates audit logs in the form of domain policy so they can
be reused and appended to domain_policy interface by the
TOMOYO auditing daemon (tomoyo-auditd). TOMOYO is a kernel
security module which implements mandatory access control
(MAC). (3.1)
* Add ACL group support for TOMOYO, which allows permissions to
be globally granted. (3.1)
* Add policy namespace support for LXC (Linux containers). The
policy namespace has its own set of domain policy, exception
policy and profiles, independent of other namespaces. (3.1)
* Add built-in policy support needed to support enforcing mode
from early in the boot sequence. (3.1)
* Make several TOMOYO options configurable to support activating
access controls without calling an external policy loader
program. (3.1)
* Permit the use of the following properties as conditions with
TOMOYO: argv[], envp[], execve(), executable's real path and
symlink target, owner or group of file objects, and the UID or
GID of the current thread. (3.1)
* Implement Extended Verification Module (EVM), which protects a
file's security extended attributes (xattrs) against integrity
attacks. (3.2)
* Implement Smack protections for domain transition: BPRM unsafe
flags, secure exec, clear unsafe personality bits, and clear
parent death signal. (3.2)
* Enhance performance of Smack rule list lookups. (3.2)
* Allow user access to /smack/access, removing the requirement
for CAP_MAC_ADMIN. (3.2)
* Add environment variable name restriction to TOMOYO. (3.2)
* Add socket operation restriction to TOMOYO. (3.2)
* Add control for generation of access granted logs in TOMOYO.
(3.2)
* Allow domain transition without execve() in TOMOYO. (3.2)
* Allow audit matching on inode gid. (3.3)
* Allow inter-field comparison in audit rules between the gid of
a running task and the gid of an inode. (3.3)
* Add a new audit filter type AUDIT_FIELD_COMPARE to indicate
which fields should be compared. (3.3)
* Allow system call exit filter matching based on the uid of the
owner of an inode used in the call. (3.3)
* Add support for digital signature verification in EVM. File
metadata can be protected using digital signatures instead of
HMAC. (3.3)
* Add a Yama Linux security module to collect DAC security
improvements. (3.4)
* Add AppArmor security module file tracking to securityfs.
(3.4)
* Add AppArmor security module initial features directory to
securityfs for displaying boolean features flags and the known
capability mask. (3.4)
* Add default_type statements to SELinux. (3.5)
* Add default source and target selectors for the user, role,
and range of new objects in SELinux. (3.5)
* Allow seek operations on the file-exposing policy used by the
sesearch SELinux policy query tool. (3.5)
* Add auditing of failed attempts to set invalid labels in
SELinux. (3.5)
* Add checking for the open permission on truncate calls to
SELinux. (3.5)
* Support long Smack labels. (3.5)
* Set recursive transmute attribute for Smack in all cases.
(3.5)
* Allow manager programs which do not start with / in TOMOYO to
handle differences between distributions. (3.5)
* Add two modes to the Yama ptrace restrictions. (3.5)
* Add support for invalidating a key. (3.5)
* Implement revoking of all rules for a subject label in Smack.
(3.7)
* Allow Yama to be unconditionally stacked, regardless of which
LSM module is primary. (3.7)
* Add the Integrity Measurement Architecture, which supports
audit log hashes, digital signature verification, and the
integrity appraisal extension. (3.7)
A.13. Storage
Block management in the software RAID MD layer now adds bad blocks
to a bad-block list so that the system does not use them. (3.1)
A.14. Virtualization
* Add memory hotplug support for the Xen balloon driver. (3.1)
* Add Xen PCI backend driver. (3.1)
* Implement discard requests and support old-style BARRIER.
(3.2)
* Increase recommended maximum number of VCPU from 64 to 160.
(3.4)
* Allow host IRQ sharing for assigned PCI 2.3 devices. (3.4)
* Add infrastructure for software and hardware-based TSC rate.
(3.4)
* Move the Hyper-V storage driver out of the staging area. (3.4)
* Add support for VLAN trunking to Hyper-V. Linux guests can now
configure multiple VLANs using a single synthetic NIC on a
Windows 8 Hyper-V host. (3.4)
* Support new KVP message types. (3.4)
* Support new KVP verbs for Hyper-V in the user level daemon.
(3.4)
* Implements multiconsole support for Hyper-V. 3.4
* Support enumeration from all available pools for Hyper-V.
(3.4)
* Update Xen ACPI processor to implement C and P state driver
that uploads ACPI data to the hypervisor. (3.4)
* Add netconsole support to Xen. (3.4)
* Use the S4 code to provide S3 support for virtio devices.
(3.4)
* Add a virtio-based remote processor messaging bus to allow
message-based communication with the remote processor (if
supported by the firmware). (3.4)
* Add direct MSI message injection for in-kernel IRQ chips.
(3.5)
* Unregister from the hwrng interface and remove the virtio
queue before entering the S3 or S4 states. On restore, add the
virtio queue and re-register with hwrng. (3.6)
* Add mcelog support to Xen. (3.6)
* Reduce the I/O path in the guest kernel to achieve high IOPS
and lower latency. (3.7)
* Add Xen EFI video mode support. (3.7)
* Implement backend support for paged out grant targets (retry
loop and hooks). (3.7)
* Implement Xen ACPI processor aggregator driver (pad). (3.8)
* Remove support for i386 processors. (3.8)
Copyright (c) 2013, Oracle and/or its affiliates. All rights
reserved. Legal Notices