The systemd-resolved service provides name resolution to local applications. Its components include a caching and validating DNS stub resolver, a Link-Local Multicast Name Resolution (LLMNR), and Multicast DNS resolver and responder.

The Linux Kernel TLS (KTLS) handles TLS records for the AES-GCM cipher. KTLS also provides the interface for offloading TLS record encryption to NICs that support this functionality.

OpenSSL 3.0 is able to use KTLS if the enable-ktls configuration option is used during compiling.

The updated gnutls packages can use KTLS for accelerating data transfer on encrypted channels. To enable KTLS, add the tls.ko kernel module using the modprobe command, and create a new configuration file /etc/crypto-policies/local.d/gnutls-ktls.txt for the system-wide cryptographic policies with the following content:

[global]
ktls = true

Note that gnutls doesn't permit you to update traffic keys through TLS KeyUpdate messages, which impacts the security of AES-GCM ciphersuites.

WireGuard is a VPN solution that has improved security features and is easily configurable.

Note that WireGuard is fully supported in UEK. See Oracle Linux: Configuring Virtual Private Networks for more information on using WireGuard on Oracle Linux.

Intel® Arc A-Series graphics, also known as Alchemist or DG2, are available as a technology preview.

Add the following option to the kernel command line to enable hardware acceleration with Intel® Arc A-Series graphics:

i915.force_probe=pci-id

In this option, replace pci-id with the PCI ID of the Intel® GPU.

Software Guard Extensions (SGX) from Intel® protects software code and data from disclosure and modification. The Linux kernel partially supports SGX v1 and SGX v1.5. Version 1 enables platofmrs by using the Flexible Launch Control mechanism to use the SGX technology.

Note that SGX is supported in UEK.

The driver is an Intel® CPU integrated accelerator and shares a work queue with process address space ID (pasid) submission and shared virtual memory (SVM).

Oracle Linux 9 introduces the virtio-mem feature for AMD and Intel® systems. With virtio-mem, you can dynamically add or remove host memory in virtual machines (VMs).

To use virtio-mem, do the following:

1. Define virtio-mem memory devices in the XML configuration of a VM.

2. Use the virsh update-memory-device command to request memory device size changes while the VM is running.

To see the current memory size exposed by such memory devices to a running VM, view the XML configuration of the VM.

You can create KVM virtual machines on systems running on the Arm (aarch64) platforms using RHCK as a technical preview.

KVM is supported on aarch64 in UEK.

The Secure Encrypted Virtualization (SEV) feature is provided for AMD EPYC host machines that use the KVM hypervisor. It encrypts a virtual machine's memory and protects the VM from access by the host.

SEV's enhanced Encrypted State version (SEV-ES) encrypts all CPU register contents when a VM stops running, thus preventing the host from modifying the VM's CPU registers or reading any information from them.

Note that SEV is supported in UEK.

A local storage manager, Stratis manages file systems on top of pools of storage and provides features such as the following:

• Manage snapshots and thin provisioning

• Automatically grow file system sizes as needed

• Maintain file systems

You administer Stratis storage through the stratis utility, which communicates with the stratisd background service.

Non-Volatile Memory Express (NVMe) TP 8006, which is an in-band authentication for NVMe over Fabrics (NVMe-oF), is available as for technology preview. The NVMe Technical Proposal 8006 defines the DH-HMAC-CHAP in-band authentication protocol for NVMe-oF. For more information, see the dhchap-secret and dhchap-ctrl-secret option descriptions in the nvme-connect(1) manual page.

in-Band Authentication is fully available in UEK R7U2.

The nvme-stas package, which is a Central Discovery Controller (CDC) client for Linux, handles the following functionalities:

• Asynchronous Event Notifications (AEN)

• Automated NVMe subsystem connection controls

• Error handling and reporting

• Automatic (zeroconf) and Manual configuration.

This package consists of two daemons, Storage Appliance Finder (stafd) and Storage Appliance Connector (stacd).

The NVMe-oF Discovery Service features are defined in the NVMexpress.org Technical Proposals (TP) 8013 and 8014. To preview these features, install the nvme-cli 2.0 package and attach the host to an NVMe-oF target device that implements TP-8013 or TP-8014. For more information about TP-8013 and TP-8014, see the NVM Express 2.0 Ratified TPs from the https://nvmexpress.org/developers/nvme-specification/ website.

Note that NVMe-oF is supported in UEK.

In this release, the DAX file system is available as a Technology Preview for the ext4 and XFS file systems. DAX enables an application to directly map persistent memory into its address space. The system must have some form of persistent memory available to use DAX. Persistent memory can be in the form of one or more Non-Volatile Dual In-line Memory Modules (NVDIMMs). In addition, a file system that supports DAX must be created on the NVDIMMs; the file system must be mounted with the dax mount option. Then, an mmap of a file on the DAX mounted file system results in a direct mapping of storage into the application's address space.

jmc-core is a library that provides core APIs for Java Development Kit (JDK) Mission Control, including APIs for:

• Parsing and writing Java Flight Recording files

• Discovering Java Virtual Machines (JVMs) through the Java Discovery Protocol (JDP)

The owasp-java-encoder package provides a collection of high-performance low-overhead contextual encoders for Java.

The packages are available in the Oracle Linux 9 CodeReady Builder repository, which is unsupported, and which you must explicitly enable.

The socket API for TuneD maps one-to-one with the D-Bus API and provides an alternative communication method for cases where D-Bus isn't available. With the socket API, you can control the TuneD daemon to optimize the performance, and change the values of various tuning parameters. The socket API is disabled by default. You can enable it in the tuned-main.conf file.