Oracle Corporation the first stable release (UEK R6), an enhanced build of the Linux kernel, positioned for use in the Oracle Linux distribution as an alternative to the standard package with the kernel from Red Hat Enterprise Linux. The kernel is available only for x86_64 and ARM64 (aarch64) architectures. The source code of the kernel, including a breakdown into separate patches, in the public Git repository of Oracle.
The Unbreakable Enterprise Kernel 6 package is based on the kernel (UEK R5 was based on kernel 4.14), which has been enhanced with new features, optimizations, and fixes, and has been validated for compatibility with most applications running on RHEL, specifically optimized for use with Oracle's industrial software and hardware. Installation and src packages of the UEK R6 kernel have been prepared for Oracle Linux and . Support for the 6.x branch has ended, and to use UEK R6, the system must be upgraded to Oracle Linux 7 (there are no barriers to using this kernel in similar versions of RHEL, CentOS, and Scientific Linux).
Key Unbreakable Enterprise Kernel 6:
- Extended support for systems based on 64-bit ARM architecture (aarch64).
- Support for all features of Cgroup v2 has been implemented.
- The ktask framework has been implemented for parallelizing kernel tasks that consume significant CPU resources. For example, ktask can organize the parallelization of memory page range clearing operations or inode list processing;
- A parallel version of kswapd has been included for handling memory page replacement operations in asynchronous mode, allowing for a reduction in the number of direct (synchronous) replacement operations. When the number of free memory pages decreases, kswapd scans for unused pages that can be freed.
- Support for verifying the integrity of the kernel image and firmware via digital signatures when loading the kernel using the Kexec mechanism (loading the kernel from an already loaded system).
- Performance optimization of the virtual memory management system has been conducted, improving the efficiency of memory page and cache clearing, as well as enhancing the handling of accesses to unallocated memory pages (page faults).
- Support for NVDIMM has been expanded, and the specified persistent memory can now be used as traditional RAM.
- The transition to the DTrace 2.0 dynamic debugging system has been made, which uses the eBPF kernel subsystem. DTrace now operates on top of eBPF, similar to how existing tracing tools in Linux work over eBPF.
- Improvements have been made to the OCFS2 (Oracle Cluster File System).
- Support for the Btrfs file system has been enhanced. The ability to use Btrfs on root partitions has been added. An option for selecting Btrfs when formatting devices has been included in the installer. The ability to place swap files on Btrfs partitions has been added. Support for compression using the ZStandard algorithm has been introduced in Btrfs.
- Support has been added for the asynchronous I/O interface — io_uring, which is notable for supporting I/O polling and the ability to work both with and without buffering. In terms of performance, io_uring is very close to SPDK and significantly outperforms libaio when polling is enabled. A library called liburing has been prepared for use with io_uring in end-user applications, providing a high-level wrapper around the kernel interface;
- Support for the mode for fast disk encryption has been added.
- Support for compression using the (zstd) algorithm has been added.
- In the ext4 file system, 64-bit timestamps are utilized in the superblock fields.
- XFS now includes tools for informing about file system integrity status during operation and obtaining the status of fsck execution on the fly.
- The TCP stack has been changed by default to the "" model instead of "As Fast As Possible" for packet sending. Support for GRO (Generic Receive Offload) has been enabled for UDP. Support for receiving and sending TCP packets in zero-copy mode has been added.
- An implementation of the TLS protocol at the kernel level (KTLS) has been enabled, which can now be applied not only to sent data but also to received data.
- The default backend for the firewall is now set to
nftables. Optionally, support for . - has been added. Support for the XDP (eXpress Data Path) subsystem has been introduced, allowing Linux to run BPF programs at the network driver level with direct access to the DMA buffer of packets and at the stage before skbuff buffer allocation by the network stack.
- The mode has been improved and enabled when using UEFI Secure Boot , which restricts the root user's access to the kernel and blocks UEFI Secure Boot bypass paths. For example, in lockdown mode, access to /dev/mem, /dev/kmem, /dev/port, /proc/kcore, debugfs, kprobes debug mode, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), certain ACPI interfaces and CPU MSR registers is restricted; kexec_file and kexec_load calls are blocked; sleep mode is prohibited; DMA usage for PCI devices is limited; importing ACPI code from EFI variables is forbidden; input/output port manipulation is not allowed, including changing IRQ and I/O port numbers for the serial port.
- Support for Enhanced Indirect Branch Restricted Speculation (IBRS) instructions has been added, allowing adaptive enabling and disabling of speculative execution of instructions during interrupt handling, system calls, and context switches. When Enhanced IBRS is supported, this method is used to protect against Spectre V2 class attacks instead of Retpoline, as it achieves better performance.
- Improved protection in directories that are writable by all. In such directories, the creation of FIFO files and files owned by users that do not match the directory owner's sticky flag is prohibited.
- By default, kernel address space layout randomization (KASLR) is enabled on ARM systems. Pointer authentication is enabled for Aarch64.
- Support for NVMe over Fabrics TCP has been added.
- A virtio-pmem driver has been added, providing access to storage devices mapped into physical address space, such as NVDIMM.
Source: opennet.ru
