New Features and Changes in UEK 8U2

UEK 8U2 is initially released with version 6.12.0-200.74.27 of the kernel.

A new FIPS 140 standalone kernel module is available as part of an effort to redesign and shrink the FIPS 140-3 cryptographic module boundary by encapsulating a stable kernel crypto API within a standalone fips140.ko kernel module.

This change helps to provide separation between the cryptographic module and the rest of the kernel, so FIPS certification can be targeted to the cryptographic module used by the kernel. This implementation means that the cryptographic module boundary doesn't change each time the kernel is compiled, and provides greater confidence in the certification.

The new implementation embeds the fips140.ko module and HMAC digest within the vmlinux kernel image after compilation. The HMAC is checked when the module is loaded using the HMAC algorithm from within the fips140.ko itself. The module and its digest are loaded into memory alongside the rest of the kernel by the boot loader when FIPS mode is enabled. These cryptographic components can easily be extracted from the kernel image for verification purposes.

XFS online file system repair is supported with UEK 8U2 and later. In this release, the experimental tag is removed from the tooling.

You can use this feature to check and repair XFS filesystems while they remain mounted and fully operational. XFS online repair can reduce downtime and improve maintainability for mission-critical and large-scale deployments.

XFS online file system repair is achieved using the xfs_scrub utility, which can detect and correct metadata corruption without requiring unmounting or disrupting active workloads. You can run xfs_scrub to systematically verify file system metadata such as inodes, directories, and allocation groups. When inconsistencies are detected, the tool provides options to perform targeted repairs while online.

To use this feature, ensure the system is running UEK 8 or later, and the latest XFS user-space tools.

See the xfs_scrub(8) manual page. See also https://docs.kernel.org/filesystems/xfs/xfs-online-fsck-design.html.

Memory allocation profiling is available in UEK 8U2. This feature tracks memory allocation to help when reviewing where memory is used and when tracking down memory leaks. The feature uses code tagging to track where memory was allocated, when allocated memory is freed, the number of allocations, and the amount of memory still in use.

The option is disabled by default but can be enabled at boot by using the boot parameter:

sysctl.vm.mem_profiling=1

You access runtime information for memory allocation profiling in /proc/allocinfo.

See https://docs.kernel.org/mm/allocation-profiling.html for more information. Note that the compressed option for memory allocation profiling isn't available in UEK 8U2.

This release introduces lightweight guard pages which provide a way to mark regions of virtual memory so that they trigger segmentation faults (SIGSEGV) when accessed. This feature is important for thread stacks and userland memory allocators. The mechanism is designed to remove any memory overhead, by using guard markers rather than creating or splitting Virtual Memory Areas (VMAs).

Before lightweight guard pages, similar functionality was achieved by using mmap(.., PROT_NONE), which incurred memory overhead. As processes and threads scale up using this method, overhead increases. Additionally, memory that's mapped in this way remains unavailable for allocation to user processes. By using lightweight guard pages, the overhead is avoided and significant memory gains are achieved.

The update uses new madvise() commands:

• MADV_GUARD_INSTALL installs guard markers and removes existing mappings in the range. Installation applies to anonymous-memory-only and installation isn't allowed for special, huge, or locked (mock'ed) VMAs.
• MADV_GUARD_REMOVE removes only the guard markers, keeping any normal mappings untouched.

Guarded ranges persist over MADV_DONTNEED or MADV_FREE (guaranteed protection until removed), but are cleared with process teardown or explicit unmapping.

AMD Secure Encrypted Virtualization (SEV) and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) are key components in AMD's confidential computing technology. SEV is a hardware-based feature that encrypts the memory of virtual machines running on AMD EPYC processors, to protect the data of the VM from unauthorized access by the hypervisor host, even if the hypervisor host is compromised. SEV uses a dedicated encryption key for each VM, managed by the processor. SEV must be enabled in both the guest OS and the KVM hypervisor host to work.

On Oracle Linux 9 and Oracle Linux 10, UEK 8U2 includes guest and hypervisor support for SEV-SNP, which helps to prevent malicious hypervisor-based attacks such as data replay, and memory remapping, among other vectors such as side channel attacks. SEV-SNP is available on AMD E4 based servers or later (Milan). This functionality requires the latest edk2-ovmf and qemu package versions.

Intel Trust Domain Extensions (TDX) is Intel's confidential computing technology used to provide Trusted Execution Environments. TDX is used to deploy virtual workloads in trust domains (TDs) to provide hardware-based isolation by managing and encrypting memory to maintain integrity and confidentiality of CPU states within TDs.

On Oracle Linux 9 and Oracle Linux 10, UEK 8U2 includes guest and hypervisor support for TDX.

See https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/overview.html for more information.

The Common Internet File System (CIFS) client can create symbolic links, symlinks, that are recognized by Server Message Block (SMB), Network File System (NFS) and Windows Subsystem for Linux (WSL). Use the symlink=default|none|native|unix|mfsymlinks|sfu|nfs|wsl mount option to disallow creating symlinks or to select the type of symlinks that the client creates.

The client can also create other special files, including character devices, block devices, pipes, and sockets. These file are created as NFS or WSL reparse points by using the reparse=default|none|nfs|wsl mount option. To create native Windows sockets used by Windows applications on NTFS, use the nativesocket mount option.

Device drivers included in UEK 8U2 are aligned with the drivers in the upstream mainline Linux 6.12 kernel. A few notable updates are included where drivers include functionality or fixes available in later upstream kernel versions.

Many driver modules no longer track version information. Oracle works with vendors to align device drivers included in UEK 8U2 with the code available in upstream kernel versions.

Notable driver updates are presented in the following table:

The following features are deprecated, removed, or no longer supported in UEK 8: