The following notable features of containers are implemented in UEK R4:

• Local device cgroup changes are now propagated down the device cgroup hierarchy.

  For more information, see git commit bd2953ebbb533aeda9b86c82a53d5197a9a38f1b.

• The __DEVEL__sane_behavior option has been introduced for mounting cgroup controllers.

  For more information, see git commit 873fe09ea5df6ccf6bb34811d8c9992aacb67598.

• memory.numa_stat now includes hierarchical statistics for child memory cgroups (memcgs) in addition to the parent memcg.

  For more information, see git commit 071aee138410210e3764f3ae8d37ef46dc6d3b42.

• An optional unified control group hierarchy has been introduced.

  For more information, see https://lwn.net/Articles/601840/.

• Hierarchy restrictions for swappiness and oom_control have been removed from memcgs.

  For more information, see git commit 3dae7fec5e884a4e72e5416db0894de66f586201.

The following notable core kernel features are implemented in UEK R4:

The following notable cryptographic features are implemented in UEK R4:

The following sections detail the most notable features that have been implemented for file systems in UEK R4:

The following notable memory management features are implemented in UEK R4:

• The MAP_HUGETLB flag has been implemented in mmap to support huge-page memory mapping with hugetlbfs.

• Problems have been addressed with kswapd and page reclaim behavior during large copy operations or when memory was low.

• Improved page table access scalability in threaded huge-page workloads by reducing lock contention in the page table.

  For more information, see https://lwn.net/Articles/568076/.

• Improve page-fault scalability in hugetlb by handing concurrent page faults. Previously, the kernel could only handle a single hugetlb page fault at a time. Typically, the startup time for a 10-gigabyte Oracle database, which generates approximately 5000 page table faults, decreases to 25.7 seconds from 37.5 seconds. Larger workloads should experience even greater improvements in start-up times.

• Support gigantic page allocation in hugetlb at runtime in addition to the existing boot-time allocation.

• The unqueued slab allocator (SLUB) is now the default memory allocator for kernel objects. SLUB eliminates the fragmentation that is caused by memory allocation and deallocation by reusing memory that was previously allocated to a data object of the same type.

The following notable networking features are implemented in UEK R4:

• The following VXLAN features have been implemented:

  • Layer 2 redirection with layer 3 switching.

  • Setting destination to a unicast address.

  • UDP tunnel segmentation.

  • IPv6 support.

  • Transmit-side VLAN offload for VXLAN devices.

  • Link configuration for transmitting UDPv4 checksums, and transmitting and receiving UDPv6 checksums.

  • Switch the network namespace when a packet is encapsulated or unencapsulated.

• Per-socket network polling is supported with the bnx2x, ixgbe, and mlx4 network card drivers, which reduces the latency inherent in the NAPI periodic polling method.

  For more information, see https://lwn.net/Articles/551284/ and 2012-lpc-Low-Latency-Sockets-slides-brandeburg.pdf.

• The new PIE (Proportional Integral controller Enhanced) network packet scheduler controls the average queueing latency to overcome buffer bloat, ensure low latency and achieve high link utilization under various congestion scenarios with very small overhead.

  For more information, see https://tools.ietf.org/html/draft-pan-tsvwg-pie-00.

• Support for configuring the SR-IOV virtual function (VF) minimum and maximum transmission rates by using the ip command.

  For more information, see git commit ed616689a3d95eb6c9bdbb1ef74b0f50cbdf276a.

• Support for SR-IOV VF link state control by using the ip command. Previously, VF links were always on, regardless of the physical link status, which allows VMs on the same virtual Ethernet bridge to communicate even if the physical function (PF) link state is down. However, if the VFs were bonded in active/standby mode, this configuration prevented failover when the physical link used by a VF went down. You can now use the ip link set command to configure the behavior of a VF link:

  # ip link set
  device
  vf
  number
  state { auto | enable | disable }

  The possible settings are:

  auto

  The VF link state is determined by the PF link state. This setting is suitable for VFs that are bonded in active/standby mode.

  disable

  The VF link state is permanently down.

  enable

  The VF link state is permanently up. This is the default setting.

• The following Open vSwitch (OvS) features have been implemented:

  • Generic routing encapsulation (GRE) tunnels.

  • User-space tunneling interface.

  • Stream Control Transmission Protocol (SCTP) support.

  • VXLAN tunneling support.

  • Wild-carded flow implementation.

  • TCP bitwise flag matching.

    For more information, see git commit 5eb26b156e29eadcc21f73fb5d14497f0db24b86

  • Allow user space to announce ability to accept unaligned Netlink messages.

  • Enable memory-mapped Netlink I/O.

  • Enable tunnel generic segmentation offloading (GSO) for Open vSwitch bridge devices so that Open vSwitch can take advantage of hardware offloading to the underling devices.

  • Add recirc and hash action to support distributing packets between the ports of bond devices.

  • Add support for generic network virtualization encapsulation (Geneve) tunneling.

• The nftables framework provides packet filtering and packet classification features as a replacment for the arptables, ebtables, iptables, and ip6tables frameworks. For example, see https://lwn.net/Articles/564095/.

  The following nftables features have been implemented:

  • Replaced iptables, while providing backwards compatibility.

  • IPv4 and IPv6 masquerading

  • Pre-routing and post-routing filtering.

  • Extended NFT_MSG_DELTABLE call to support flushing the rule set.

  • Add filter support for skipping accounting objects.

  • Add support for exporting the rule-set generation ID.

  • Add CPU attribute support for matching packets against CPU number.

  • Add support for matching packet types for the inet, ip, and ipv6 table families based on link-layer information. For loopback traffic, the packet type is deduced from the network layer header.

  • Add support for matching the device group of a packet's incoming or outgoing interface.

• TCP Fast Open optimization is enabled by default in UEK R4 for applications that take advantage of this feature.

• Generic network virtualization encapsulation (Geneve) provides a tunneling framework for establishing layer 2 networks over layer 3 networks.

  For more information, see http://tools.ietf.org/html/draft-gross- geneve-01 and http://blogs.vmware.com/cto/geneve-vxlan-network-virtualization-encapsulations/.

• Transmission queue batching defers flushing transmission socket buffers to the network driver to reduce the overall cost of processing the transmission queue and can result in a higher effective packet transmission rate. The i40e, igb, ixgbe, mlx4, and virtio_net drivers support this feature.

  For more information, see https://lwn.net/Articles/615238/ and http://netoptimizer.blogspot.com/2014/10/unlocked-10gbps-tx-wirespeed-smallest.html.

Many modern multiprocessors have non-uniform memory access (NUMA) memory designs, where the performance of a process can depend on whether the memory range being accessed is attached to the local CPU or to another CPU. As performance is different depending on memory locality, the operating system should ideally schedule a process to run on the CPU whose memory controller is connected to the memory to be accessed.

The following notable NUMA features are implemented in UEK R4:

• Support NUMA affinity for unbound workqueues.

• A new NUMA subsystem provides improved performance for NUMA systems. New NUMA policies attempt to place a process near its memory, can share pages between processes and handle transparent huge pages. (3.8, 3.13)

  The following sysctl parameters allow you to enable, disable and tune NUMA scheduling:

  numa_balancing_scan_delay_ms

  Scan delay in milliseconds used for starting a task when it initially forks.

  numa_balancing_scan_period_max_ms

  Maximum delay in milliseconds between scanning for tasks.

  numa_balancing_scan_period_min_ms

  Minimum delay in milliseconds between scanning for tasks.

  numa_balancing_scan_period_reset

  Resets the scan delay period.

  numa_balancing_scan_size_mb

  Amount of pages in megabytes scanned per scan.

  For more information, see https://lwn.net/Articles/568870/.

• Add the numa_balancing sysctl parameter to enable or disable automatic NUMA memory balancing.

• Improved algorithm for NUMA migrations that maximizes the performance of workloads that do not fit on one NUMA node.

• Memory zones are allocated by the page allocator in node order on 64-bit NUMA systems by default.

The following notable security features are implemented in UEK R4:

• The physical and virtual address at which the kernel image is decompressed is randomized to deter exploit attempts that rely on knowing the location of the kernel internals.

• The Kexec feature, which allows faster rebooting or automatically booting a new kernel after a crash, now incorporates support for allowing only signed Kexec kernels for use with UEFI secure booting.

• The kexec_load_disabled sysctl parameter can be used to disable Kexec, which allows a system to be better protected against privilege escalation.

• An exe field has been added to the auditing log to record the pathname of executables that produce core dumps.

• An audit_backlog_wait_time configuration option has been added to the auditing subsystem so that if auditd cannot keep up or is blocked, callers are not blocked.

• If the value of the audit_backlog_limit parameter is set to zero, the length of the backlog queue is limited only by the amount of system memory.

• By default, errors on AUDIT_NEVER rules are now logged.

• The auditing subsystem now logs task information when the state of a feature is changed.

• A netlink multicast socket has been added to read-only user-space clients such as systemd to allow read-only access to the audit logs.

• Secure generation of random numbers with the getrandom system call. Linux systems traditionally obtained their random numbers from /dev/[u]random. This interface is vulnerable to file descriptor exhaustion attacks, where the attacker consumes all available file descriptors, and is also inconvenient for use in containers. The getrandom system call, which analogous to the getentropy call in OpenBSD overcomes these problems.

• SELinux now reports permissive mode in avc: denied messages.

The following notable storage features are implemented in UEK R4:

• The device mapper dm-cache target allows you to use a fast device such as an SSD as a cache for a slower device such as a rotating disk. You can use various policy plugins to change the selection algorithms for performing actions such as promoting, demoting, cleaning blocks. dm-cache supports both writeback and write-through modes. This feature is still flagged as experimental and might not be suitable for production systems.

  Updates to dm-cache added support for a passthrough mode when the cache contents might not be consistent with the underlying device, cache block invalidation, and cache shrinking.

  For more information, see https://www.kernel.org/doc/Documentation/device-mapper/cache.txt.

• Bcache is a block layer cache that allows you to use SSDs to cache slower block devices. Bcache can perform both writeback and write-through caching, has no file-system dependencies, is simple to use, and works well on any setup without requiring any configuration.

  For more information, see https://www.kernel.org/doc/Documentation/bcache.txt, https://bcache.evilpiepirate.org/, and https://lwn.net/Articles/497024/.

• The new, scalable multiqueue block layer subsystem (blk-mq) for supporting high performance SSD storage implements per-CPU submission queues for receiving I/O requests, which are directed to hardware submission queues. The separate per-CPU submission and hardware submission queues balances the I/O workload across multiple CPU cores and reduces latency. The design supports the interface and features of the traditional block layer, but it is also capable of supporting many millions of I/O operations per second by taking advantage of the capabilities of NVM-Express or high-end PCI-E devices and multicore CPUs.

  For more information, see https://lwn.net/Articles/552904/.

• The device mapper dm-era target behaves similarly to the linear target with the addition of tracking any blocks that were written within an era, which is a time period that you can define. Typical use cases are tracking the changed blocks in backup software and restoring cache coherency after rolling back a snapshot by partially invalidating the cache contents.

  For more information, see https://www.kernel.org/doc/Documentation/device-mapper/era.txt.

The following notable virtualization features are implemented in UEK R4:

• Hyper-V support for netpoll allows a network console to be used to debug kernel issues.

• The following Xen features have been implemented:

  • xen-netback support for changing the MAC address of an interface

  • ACPI support for CPU and memory hotplug, including a new memory hotplug driver.

  • xen-netback support for gathering zerocopy statistics and TX grant mapping.

  • Support for MSI message groups in Dom0.

  • Substantially improved performance of Xen virtual network interfaces by implementing multiple queue support between xen-netback and xen-netfront.

  • EFI support in Dom0.

  • Xen PVSCSI backend and frontend driver support for high performance passthrough of SCSI devices or LUNs from Dom0 to a Xen PV or HVM guest.

  • Remapping of existing MFNs that were replaced by the identity map to prevent non-contiguous pages occurring in Dom0.

  • Improved PV ticket locks provide more efficient locking of guests for workloads that rely on this mechanism. If a spin lock is not available for more than a brief period, the lock code stops spinning and calls the hypervisor to wait until the lock becomes available again.

  • NUMA topology and I/O exposure to guests.

  • PVH guests now support Paravirtualized Hardware extensions (v3).

Zram compresses everything written to specified block devices in RAM, and is used typically for swap devices to improve the responsiveness of systems that have a limited amount of memory. The following example illustrates how to create and enable a zram swap device:

# mkswap /dev/zram0
# swapon /dev/zram0

The next example illustrates how to create a file system on a zram device and then mount this file system:

# mkfs.ext4 /dev/zram1
# mount /dev/zram1 /tmp

The following notable zram features are implemented in UEK R4:

• Zram has been moved out of staging to drivers/block/zram.

• Support for LZ4 compression in addition to LZO.

• Performance improvements to concurrent compression of multiple compression streams.

• Support for switching the compression algorithm in /sys/block/zramN/comp_algorithm.

• Support for limiting the maximum amount of useable memory for a zram device in /sys/block/zramN/mem_limit. You can use memory unit suffixes when setting a value, for example:

  # echo 1G > /sys/block/zram0/mem_limit

  To disable the limit, set the value to 0.

• Support for displaying the maximum memory that a zram device has consumed in /sys/block/zramN/mem_used_max. Writing 0 to this file resets the counter.

Zswap is a lightweight, write-behind compressed caching mechanism for swap pages that attempts to compress a page being swapped out to RAM. A successful compression defers and, in many cases, prevents writeback to the swap device, reducing I/O and increasing the performance of a system that is swapping.

For more information, see https://lwn.net/Articles/537422/.