DOCSLIB.ORG

Schweben Auf Wolke 7 Oracle Linux 7.X Unter Der Lupe

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Schweben Auf Wolke 7 Oracle Linux 7.X Unter Der Lupe Schweben auf Wolke 7 Oracle Linux 7.x unter der Lupe Ralf Germann Consultant Trivadis AG Glattbrugg (ZH) BASEL BERN BRUGG LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART WIEN 1 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Unser Unternehmen Trivadis ist führend bei der IT-Beratung, der Systemintegration, dem Solution-Engineering und der Erbringung von IT-Services mit Fokussierung auf und Technologien im D-A-CH-Raum. Unsere Leistungen erbringen wir aus den strategischen Geschäftsfeldern: B E T R I E B Trivadis Services übernimmt den korrespondierenden Betrieb Ihrer IT Systeme. 2 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Mit über 600 IT- und Fachexperten bei Ihnen vor Ort 12 Trivadis Niederlassungen mit Hamburg über 600 Mitarbeitenden 200 Service Level Agreements Mehr als 4'000 Trainingsteilnehmer Düsseldorf Forschungs- und Entwicklungs- budget: CHF 5.0 Mio. / EUR 4.0 Frankfurt Mio. Finanziell unabhängig und Stuttgart nachhaltig profitabel Wien Freiburg München Erfahrung aus mehr als 1'900 Projekten pro Jahr bei über 800 Basel Brugg Kunden Bern Zürich Lausanne Stand: 12/2013 3 3 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 3 19.11.2014 Trivadis an der DOAG Ebene 3 - gleich neben der Rolltreppe Wir freuen uns auf Ihren Besuch. Denn mit Trivadis gewinnen Sie immer. 4 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 eno16777736 Neues Installer GUI USB 3.0 für KVM Pacemaker Swap Memory Komprimierung Strenges kickstart ifconfig Samba 4.1.0 keepalived systemd ip firewalld BTRFS sysV GRUB 2 XFS Network Teaming HAProxy nmcli kpatch ksplice hostnamectl UEK R3 Kernel 3.10 pNFS Bonding pykickstart LVM Cache Linux Containers redhat-upgrade-tool Kontrollgruppen 5 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 6 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 AGENDA 1. Überblick 2. Installations Varianten 3. XFS 4. systemd 5. Neue System Kommandos 6. Netzwerk und Firewall 7. LVM 8. Update? 9. Fazit 7 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Überblick 8 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Überblick Willkommen bei Oracle Linux 7.0: . Installer . Anaconda GUI: Kein Wizard mehr, z.T. neu programmiert . Anaconda Text: Kein Wizard mehr, komplett neu programmiert . Kickstart: einige Syntax-Änderungen, sehr streng . LVM und Filesysteme . XFS . BTRFS . pNFS . LVM Cache 9 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Überblick Willkommen bei Oracle Linux 7.0: . Netzwerk und Firewall . Neues Naming für Interfaces (z.B. eno16777736) . Network teaming ersetzt bonding . Konsolen Interface: nmcli . firewalld . Support für 40GBit . System . systemd ersetzt sysV . GRUB 2 . UEK R3 / RedHat Kernel 3.10 . hostnamectl . Swap Memory Komprimierung (zswap => I/O-Reduktion) . Kontrollgruppen (cgroups) 10 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Überblick Willkommen bei Oracle Linux 7.0: . Tools und Software . kpatch / ksplice . pykickstart . rgmanager wird abgelöst durch Pacemaker . keepalived und HAProxy ersetzen Piranha (Loadbalancer) . redhat-upgrade-tool . Samba 4.1.0 . Virtualisierung . USB 3.0 für KVM Guests . Support für Windows 8 / 8.1 und Windows Server 2012 / 2012 R2 als KVM Guests . Read-Only-Support für VPC und VHDX in KVM (HyperV) . Linux Containers 11 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten 12 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten Fast alles ist neu… Anaconda GUI Anaconda Text Installer Kickstart 13 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten – Anaconda GUI Merkmale und Funktionen: . Kein Wizard mehr, nur noch eine Seite . Automatische Einstellungen (für öffentliche IPs) . User können während der Installation erstellt werden Achtung: . Aktivieren Sie Ihr Netzwerk-Interface, bevor Sie versuchen NTP zu aktivieren... 14 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten – Anaconda GUI Das neue Anaconda GUI: 15 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten – Anaconda Text Installer Der neue Anaconda Text Installer: 16 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten – Kickstart Was ist neu? . Einige Syntax Änderungen . timezone Europe/Zurich --isUtc (alt: timezone --utc Europe/Zurich) . keyboard --vckeymap=sg --xlayouts='ch' (alt: keyboard sg) . Sehr streng (setzen Sie immer den %end Tag) . KS-Files können mit dem ksvalidator (Teil von pykickstart) geprüft werden . Obsolet und entfernt . bytes-per-inode (von den logvol, part und raid Kommandos) . telnet vom firewall Befehl . upgrade . Alle Änderungen können mit dem ksverdiff Tool angeschaut werden (Teil von pykickstart) 17 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten – Kickstart Mögen Sie… ? 18 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Installations Varianten – Kickstart 19 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 XFS 20 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 XFS Willkommen bei Ihrem neuen Standard-Filesystem: XFS Limit EXT3 EXT4 XFS Max. FS Grösse 16TB 16TB 16EB Max. Filegrösse 2TB 16TB 8EB Max. Extentgrösse 4kB 128MB 8GB Max. Inodes 232 232 264 Limitierungen von XFS unter OL7: . Max. Grösse eines Volumen: 500TB . Max. Grösse eines Files: 16TB 21 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 XFS XFS: . Entwickelt von Silicon Graphics . Journaling Filesystem Vorteile: . Sehr gute Performance in Umgebungen mit vielen und grossen Daten . Das Filesystem kann online defragmentiert werden . Vergrösserungen der Filesysteme online möglich . Paralleles Kopieren und Möglichkeit von Dumps für den Backup Nachteile: . Verkleinerungen sind nicht möglich 22 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 systemd 23 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 systemd Syntax systemctl: systemctl [OPTION(S)] SUBCOMMAND [NAME] 24 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 systemd Systemd vs. sysV – Ein Vergleich Aktion Systemd Altes Kommando Zeige Services auf systemctl list-unit-files chkconfig --list Services aktivieren / deaktivieren systemctl enable / disable xyz chkconfig xyz on / off Herunterfahren systemctl poweroff poweroff Neustart systemctl reboot reboot Start / Stopp / eines Services systemctl start / stop xyz service xyz start / stop Service Status anzeigen systemctl status xyz service xyz status 25 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Neue System Kommandos 26 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Neue System Kommandos GRUB2: . Alle Menü-Einträge anzeigen: awk -F\' '$1=="menuentry " {print $2}' /etc/grub2.cfg . Den Default Eintrag ändern: grub2-set-default %Number% . Benuzterdefinierte Menü-Einträge: /etc/grub.d/40_custom . Standardeinstellungen: /etc/default/grub . Update GRUB-Menü: grub2-mkconfig -o /boot/grub2/grub.cfg 27 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Neue System Kommandos hostnamectl: . Status anzeigen: hostnamectl status . Hostname ändern: hostnamectl set-hostname %NEW_HOSTNAME% 28 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Netzwerk und Firewall 29 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Netzwerk und Firewall Was ist neu?: . Network teaming (bond2team für die Migration nutzen) . firewalld (neues Framework für iptables) . 40GBit Support . nmcli . ifconfig . ip . Neues Naming für Interfaces (kann geändert werden) 30 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Netzwerk und Firewall Kommandos und Syntax: firewall-cmd [OPTION(S)] SUBCOMMAND nmcli [OPTION(S)] OBJECT {SUBCOMMAND|help} 31 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 LVM 32 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 LVM Beschleunigen Sie Ihre Filesysteme mit einem LVM-Cache (nicht möglich mit dem UEK Kernel): . Benutzen Sie zum Beispiel eine PCIe SSD Disk für ihre grossen SAN oder DAS basierten Filesysteme . Benötigt wird eine LV für die Metadaten und eine LV für das Caching. Beides wird in einem Pool kombiniert . pvmove ist nicht möglich für die Cache LV . lvresize, lvreduce, lvextend einer Cache LV ist nicht möglich . vgsplit für VGs mit einer oder mehreren Cache LV(s) ist nicht möglich 33 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Update 34 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Update RedHat basierter Kernel: . Version 6.x x86_64 mit den letzten Patches installiert . Base oder minimal Installation . Anforderungen mit dem Assistent prüfen . Installation von preupgrade-assistant . Installation von redhat-upgrade-tool (wie fedup bei Fedora) UEK: . Kein installierter Oracle-Stack! 35 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Fazit 36 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Fazit 7.1? 7.2? 37 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Fazit Hilfreiche Links: https://access.redhat.com/documentation/en- US/Red_Hat_Enterprise_Linux/7/index.html http://docs.oracle.com/cd/E52668_01/ http://www.certdepot.net/rhel7/ 38 2014 © Trivadis Schweben auf Wolke 7 - Oracle Linux 7.x unter der Lupe 19.11.2014 Vielen Dank..
Load more

Recommended publications
  • Red Hat Enterprise Linux 7 7.1 Release Notes
    Red Hat Enterprise Linux 7 7.1 Release Notes Release Notes for Red Hat Enterprise Linux 7 Red Hat Customer Content Services Red Hat Enterprise Linux 7 7.1 Release Notes Release Notes for Red Hat Enterprise Linux 7 Red Hat Customer Content Services Legal Notice Copyright © 2015 Red Hat, Inc. This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js ® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
    [Show full text]
  • Oracle® Linux Administrator's Solutions Guide for Release 6
    Oracle® Linux Administrator's Solutions Guide for Release 6 E37355-64 August 2017 Oracle Legal Notices Copyright © 2012, 2017, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S.
    [Show full text]
  • Adaptive Android Kernel Live Patching
    Adaptive Android Kernel Live Patching Yue Chen Yulong Zhang Zhi Wang Liangzhao Xia Florida State University Baidu X-Lab Florida State University Baidu X-Lab Chenfu Bao Tao Wei Baidu X-Lab Baidu X-Lab Abstract apps contain sensitive personal data, such as bank ac- counts, mobile payments, private messages, and social Android kernel vulnerabilities pose a serious threat to network data. Even TrustZone, widely used as the se- user security and privacy. They allow attackers to take cure keystore and digital rights management in Android, full control over victim devices, install malicious and un- is under serious threat since the compromised kernel en- wanted apps, and maintain persistent control. Unfortu- ables the attacker to inject malicious payloads into Trust- nately, most Android devices are never timely updated Zone [42, 43]. Therefore, Android kernel vulnerabilities to protect their users from kernel exploits. Recent An- pose a serious threat to user privacy and security. droid malware even has built-in kernel exploits to take Tremendous efforts have been put into finding (and ex- advantage of this large window of vulnerability. An ef- ploiting) Android kernel vulnerabilities by both white- fective solution to this problem must be adaptable to lots hat and black-hat researchers, as evidenced by the sig- of (out-of-date) devices, quickly deployable, and secure nificant increase of kernel vulnerabilities disclosed in from misuse. However, the fragmented Android ecosys- Android Security Bulletin [3] in recent years. In ad- tem makes this a complex and challenging task. dition, many kernel vulnerabilities/exploits are publicly To address that, we systematically studied 1;139 An- available but never reported to Google or the vendors, droid kernels and all the recent critical Android ker- let alone patched (e.g., exploits in Android rooting nel vulnerabilities.
    [Show full text]
  • Protecting Your Linux Systems with Oracle Ksplice
    Staying Ahead of Cyberthreats: Protecting Your Linux Systems with Oracle Ksplice The Advantages Of Zero-Downtime Patching April 23, 2020 Copyright © 2020, Oracle and/or its affiliates Public TABLE OF CONTENTS Introduction 2 Why Patching Matters 2 About Oracle Ksplice 3 Other Benefits 3 Conclusion 4 Learn More 4 1 WHITE PAPER | Staying Ahead of Cyberthreats: Protecting Your Linux Systems Copyright © 2020, Oracle and/or its affiliates |Public INTRODUCTION IT systems require regular patching for security, performance, and compliance reasons. For Linux operating system (OS) kernel updates, which include “Availability requirements important new security enhancements and bug fixes, releases happen about 1 are on the rise for once per month. These updates help keep systems current with the latest organizations undergoing innovations. However, manually patching systems has many inherent digital transformations. challenges and difficulties which tends to delay their timely application. For this Downtimes are costly, reason, zero-downtime patching solutions for Linux, like Oracle Ksplice, are with unplanned becoming essential tools. In this paper, Oracle Ksplice’s capabilities and many infrastructure downtimes advantages are explained. costing $100,000 per hour on an average. With Why Patching Matters the possibility of every organization being a Inadequate patch management can leave loopholes in the IT infrastructure leading to target for cyberattacks various security and performance issues. Ideally, patches should be applied shortly after and attackers moving very release to ensure the latest system protections. Patching typically requires downtime quickly to exploit system which, depending on operations, can require weeks or months of advanced planning. vulnerabilities, IDC Most Linux patching also traditionally happens at the disk level for file systems, which has recommends several disadvantages.
    [Show full text]
  • Linux Kernal II 9.1 Architecture
    Page 1 of 7 Linux Kernal II 9.1 Architecture: The Linux kernel is a Unix-like operating system kernel used by a variety of operating systems based on it, which are usually in the form of Linux distributions. The Linux kernel is a prominent example of free and open source software. Programming language The Linux kernel is written in the version of the C programming language supported by GCC (which has introduced a number of extensions and changes to standard C), together with a number of short sections of code written in the assembly language (in GCC's "AT&T-style" syntax) of the target architecture. Because of the extensions to C it supports, GCC was for a long time the only compiler capable of correctly building the Linux kernel. Compiler compatibility GCC is the default compiler for the Linux kernel source. In 2004, Intel claimed to have modified the kernel so that its C compiler also was capable of compiling it. There was another such reported success in 2009 with a modified 2.6.22 version of the kernel. Since 2010, effort has been underway to build the Linux kernel with Clang, an alternative compiler for the C language; as of 12 April 2014, the official kernel could almost be compiled by Clang. The project dedicated to this effort is named LLVMLinxu after the LLVM compiler infrastructure upon which Clang is built. LLVMLinux does not aim to fork either the Linux kernel or the LLVM, therefore it is a meta-project composed of patches that are eventually submitted to the upstream projects.
    [Show full text]
  • A Hybrid Swapping Scheme Based on Per-Process Reclaim for Performance Improvement of Android Smartphones (August 2018)
    Received August 19, 2018, accepted September 14, 2018, date of publication October 1, 2018, date of current version October 25, 2018. Digital Object Identifier 10.1109/ACCESS.2018.2872794 A Hybrid Swapping Scheme Based On Per-Process Reclaim for Performance Improvement of Android Smartphones (August 2018) JUNYEONG HAN 1, SUNGEUN KIM1, SUNGYOUNG LEE1, JAEHWAN LEE2, AND SUNG JO KIM2 1LG Electronics, Seoul 07336, South Korea 2School of Software, Chung-Ang University, Seoul 06974, South Korea Corresponding author: Sung Jo Kim ([email protected]) This work was supported in part by the Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education under Grant 2016R1D1A1B03931004 and in part by the Chung-Ang University Research Scholarship Grants in 2015. ABSTRACT As a way to increase the actual main memory capacity of Android smartphones, most of them make use of zRAM swapping, but it has limitation in increasing its capacity since it utilizes main memory. Unfortunately, they cannot use secondary storage as a swap space due to the long response time and wear-out problem. In this paper, we propose a hybrid swapping scheme based on per-process reclaim that supports both secondary-storage swapping and zRAM swapping. It attempts to swap out all the pages in the working set of a process to a zRAM swap space rather than killing the process selected by a low-memory killer, and to swap out the least recently used pages into a secondary storage swap space. The main reason being is that frequently swap- in/out pages use the zRAM swap space while less frequently swap-in/out pages use the secondary storage swap space, in order to reduce the page operation cost.
    [Show full text]
  • An Evolutionary Study of Linux Memory Management for Fun and Profit Jian Huang, Moinuddin K
    An Evolutionary Study of Linux Memory Management for Fun and Profit Jian Huang, Moinuddin K. Qureshi, and Karsten Schwan, Georgia Institute of Technology https://www.usenix.org/conference/atc16/technical-sessions/presentation/huang This paper is included in the Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC ’16). June 22–24, 2016 • Denver, CO, USA 978-1-931971-30-0 Open access to the Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC ’16) is sponsored by USENIX. An Evolutionary Study of inu emory anagement for Fun and rofit Jian Huang, Moinuddin K. ureshi, Karsten Schwan Georgia Institute of Technology Astract the patches committed over the last five years from 2009 to 2015. The study covers 4587 patches across Linux We present a comprehensive and uantitative study on versions from 2.6.32.1 to 4.0-rc4. We manually label the development of the Linux memory manager. The each patch after carefully checking the patch, its descrip- study examines 4587 committed patches over the last tions, and follow-up discussions posted by developers. five years (2009-2015) since Linux version 2.6.32. In- To further understand patch distribution over memory se- sights derived from this study concern the development mantics, we build a tool called MChecker to identify the process of the virtual memory system, including its patch changes to the key functions in mm. MChecker matches distribution and patterns, and techniues for memory op- the patches with the source code to track the hot func- timizations and semantics. Specifically, we find that tions that have been updated intensively.
    [Show full text]
  • Review Der Linux Kernel Sourcen Von 4.9 Auf 4.10
    Review der Linux Kernel Sourcen von 4.9 auf 4.10 Reviewed by: Tested by: stecan stecan Period of Review: Period of Test: From: Thursday, 11 January 2018 07:26:18 o'clock +01: From: Thursday, 11 January 2018 07:26:18 o'clock +01: To: Thursday, 11 January 2018 07:44:27 o'clock +01: To: Thursday, 11 January 2018 07:44:27 o'clock +01: Report automatically generated with: LxrDifferenceTable, V0.9.2.548 Provided by: Certified by: Approved by: Account: stecan Name / Department: Date: Friday, 4 May 2018 13:43:07 o'clock CEST Signature: Review_4.10_0_to_1000.pdf Page 1 of 793 May 04, 2018 Review der Linux Kernel Sourcen von 4.9 auf 4.10 Line Link NR. Descriptions 1 .mailmap#0140 Repo: 9ebf73b275f0 Stephen Tue Jan 10 16:57:57 2017 -0800 Description: mailmap: add codeaurora.org names for nameless email commits ----------- Some codeaurora.org emails have crept in but the names don't exist for them. Add the names for the emails so git can match everyone up. Link: http://lkml.kernel.org/r/[email protected] 2 .mailmap#0154 3 .mailmap#0160 4 CREDITS#2481 Repo: 0c59d28121b9 Arnaldo Mon Feb 13 14:15:44 2017 -0300 Description: MAINTAINERS: Remove old e-mail address ----------- The ghostprotocols.net domain is not working, remove it from CREDITS and MAINTAINERS, and change the status to "Odd fixes", and since I haven't been maintaining those, remove my address from there. CREDITS: Remove outdated address information ----------- This address hasn't been accurate for several years now.
    [Show full text]
  • Kshot: Live Kernel Patching with SMM and SGX
    KShot: Live Kernel Patching with SMM and SGX Lei Zhou∗y, Fengwei Zhang∗, Jinghui Liaoz, Zhengyu Ning∗, Jidong Xiaox Kevin Leach{, Westley Weimer{ and Guojun Wangk ∗Department of Computer Science and Engineering, Southern University of Science and Technology, Shenzhen, China, zhoul2019,zhangfw,ningzy2019 @sustech.edu.cn f g ySchool of Computer Science and Engineering, Central South University, Changsha, China zDepartment of Computer Science, Wayne State University, Detroit, USA, [email protected] xDepartment of Computer Science, Boise State University, Boise, USA, [email protected] Department of Computer Science and Engineering, University of Michigan, Ann Arbor, USA, kjleach,weimerw @umich.edu { f g kSchool of Computer Science and Cyber Engineering, Guangzhou University, Guangzhou, China, [email protected] Abstract—Live kernel patching is an increasingly common kernel vulnerabilities also merit patching. Organizations often trend in operating system distributions, enabling dynamic up- use rolling upgrades [3], [6], in which patches are designed dates to include new features or to fix vulnerabilities without to affect small subsystems that minimize unplanned whole- having to reboot the system. Patching the kernel at runtime lowers downtime and reduces the loss of useful state from running system downtime, to update and patch whole server systems. applications. However, existing kernel live patching techniques However, rolling upgrades do not altogether obviate the need (1) rely on specific support from the target operating system, to restart software or reboot systems; instead, dynamic hot and (2) admit patch failures resulting from kernel faults. We patching (live patching) approaches [7]–[9] aim to apply present KSHOT, a kernel live patching mechanism based on patches to running software without having to restart it.
    [Show full text]
  • Mitigating the Performance-Efficiency Tradeoff in Resilient Memory Disaggregation
    Mitigating the Performance-Efficiency Tradeoff in Resilient Memory Disaggregation Youngmoon Lee∗, Hasan Al Maruf∗, Mosharaf Chowdhury∗, Asaf Cidonx, Kang G. Shin∗ University of Michigan∗ Columbia Universityx ABSTRACT State-of-the-art solutions take three primary approaches: (i) local We present the design and implementation of a low-latency, low- disk backup [36, 66], (ii) remote in-memory replication [31, 50], and overhead, and highly available resilient disaggregated cluster mem- (iii) remote in-memory erasure coding [61, 64, 70, 73] and compres- ory. Our proposed framework can access erasure-coded remote sion [45]. Unfortunately, they suffer from some combinations of memory within a single-digit `s read/write latency, significantly the following problems. improving the performance-efficiency tradeoff over the state-of- High latency: The first approach has no additional memory the-art – it performs similar to in-memory replication with 1.6× overhead, but the access latency is intolerably high in the presence lower memory overhead. We also propose a novel coding group of any of the aforementioned failure scenarios. The systems that placement algorithm for erasure-coded data, that provides load bal- take the third approach do not meet the single-digit `s latency ancing while reducing the probability of data loss under correlated requirement of disaggregated cluster memory even when paired failures by an order of magnitude. with RDMA (Figure 1). High cost: While the second approach has low latency, it dou- bles memory consumption as well as network bandwidth require- ments. The first and second approaches represent the two extreme 1 INTRODUCTION points in the performance-vs-efficiency tradeoff space for resilient To address the increasing memory pressure in datacenters, two cluster memory (Figure 1).
    [Show full text]
  • Porting Linux Embedded Linux Conference (Europe)
    Porting Linux Embedded Linux Conference (Europe) Porting Linux About Jon Masters ● Been playing with Linux for 14 years (and the kernel for 13 of those), since the age of 13. ● Built embedded NMR scientific instruments, worked with Montavista UK, now at Red Hat. ● Author of the LKML Summary Podcast and the kernel column in Linux User & Developer. ● Co-author of Building Embedded Linux Systems (second edition) – O'Reilly (2008) ● My car still has an empeg :) Porting Linux Overview ● Why port Linux anyway? ● Background pre-requisities ● Early board work ● Bootloader bringup ● Initial kernel bringup ● Debugging ● Working with Upstream ● Trends Porting Linux Why port Linux anyway? ● Linux is very portable ● Supports 23 architectures in the upstream “mainline” kernel tree of Linus Torvalds. ● Kernel is mostly written in C, with some assembly (most architectures only need a dozen such files) ● Split between high-level generic functions and low- level functions to abstract architectural differences. Porting Linux Why port Linux anyway? ● Linux is competitive ● The number of Linux kernel developers contributing to the official kernel has tripled since 2005. ● Feature growth continues with an average of 10K new lines of source code added every day. ● In the hour you spend here 5.45 patches will on average be added to the upstream Linux kernel. ● Source: Linux Foundation analysis Porting Linux Why port Linux anyway? ● Linux is cost effective. ● A large amount of code to build upon. ● Large (growing) community of developers. ● I think we all know the rest. Porting Linux Background pre-requisities ● Hardware ● Development board or simulator – Optional debugger, some kind of UART – Boards range in value from $200-$crazy – Implement the same architecture and platform as the final design but maybe with a number of hacks.
    [Show full text]
  • Think ALL Distros Offer the Best Linux Devsecops Environment?
    Marc Staimer, Dragon Slayor Consulting WHITE PAPER Think All Distros Offer the Best Linux DevSecOps What You’re Not Being Told About Environment? Database as a Service (DBaaS) Think Again! WHITE PAPER • Think Again! Think All Distros Provide the Best Linux DevSecOps Environment? Think Again! Introduction DevOps is changing. Developing code with after the fact bolt-on security is dangerously flawed. When that bolt-on fails to correct exploitable code vulnerabilities, it puts the entire organization at risk. Security has been generally an afterthought for many doing DevOps. It was often assumed the IT organization’s systemic multiple layers of security measures and appliances would protect any new code from malware or breaches. And besides, developing code with security built in, adds tasks and steps to development and testing time. More tasks and steps delay time-to-market. Multi-tenant clouds have radically changed the market. Any vulnerability in a world with increasing cyber-attacks, can put millions of user’s data at risk. Those legacy DevOps attitudes are unsound. They are potentially quite costly in the current environment. Consider that nearly every developed and most developing countries have enacted laws and regulation protecting personally identifiable information or PII1. PII is incredibly valuable to cybercriminals. Stealing PII enables them to commit many cybercrimes including the cybertheft of identities, finances, intellectual property, admin privileges, and much more. PII can also be sold on the web. Those PII laws and regulations are meant to force IT organizations to protect PII. Non-compliance of these laws and regulations often carry punitive financial penalties.
    [Show full text]