Release Notes for SUSE Linux Enterprise Server 11 Service Pack 1

GCC 4.3.4

glibc 2.11.1

Linux kernel 2.6.32

perl 5.10

php 5.2.6

python 2.6.0

ruby 1.8.7

Apache 2.2.10 - Webserver

Bind 9.5.0P2 - The Bind Domain Name Server

Samba 3.4.3

GNOME 2.28

GNOME was updated to the latest version and uses PulseAudio for sound.

KDE 4.3.5

KDE was updated to the latest 4.3.4 version.

X.org 7.4

Managing Access Control Lists over NFSv4

There is no single standard for Access Control Lists (ACL) in Linux beyond the simple user/group/others-rwx flags. One option for finer control are so-called "Draft Posix ACLs", which were never formally standardised by Posix. Another is the NFSv4 ACLs, which were design to be part of the NFSv4 network filesystem with the goal of making something that provided reasonable compatability between Posix systems (like Linux) and WIN32 systems (like Microsoft Windows). It turns out that NFSv4 ACLs are not sufficient to correctly implent Draft Posix ACLs so no attempt has been made to map ACL accesses on an NFSv4 client (using e.g. setfacl ).

So when using NFSv4, Draft Posix ACLs cannot be used even in emulation and NFSv4 ACLs need to be used directly; i.e., while setfacl can work on NFSv3, it cannot work on NFSv4.

To allow NFSv4 ACLs to be used on an NFSv4 filesystem we provide the "nfs4-acl-tools" package which contains:

These operate in a generally simillar way to getfacl and setfacl for examining and modifying NFSv4 ACLs.

Note that these can only be effective if the filesystem on the NFS server provides full support for NFSv4 ACLs. Any limitation imposed by the server will be felt by these programs running on the client in that some particular combinations of Access Control Entries (ACEs) may not be possible.

A future release of Linux may support "richacls", which are designed to provide access to NFSv4 ACLs in a way that is more integrated with other filessytems. If and when these become available we will need to transition from using nfs4-acl-tools towards whatever support tools will come with "richacls".

PAM Configuration

The common PAM configuration files (/etc/pam.d/common-*) are now created and managed with pam-config.

Basic SELinux Enablement

In addition to AppArmor, SELinux capabilities were added to SUSE Linux Enterprise Server. While it is not enabled by default, and not supported, this will allow customers to enable and run SELinux with SUSE Linux Enterprise Server if they want to do so.

What does SELinux basic enablement mean?

By enabling SELinux in our codebase, we add missing pieces of code that exist in the community already, and we allow those who wish to use SELinux to do so conveniently without having to replace a big portion of the distribution.

Enablement for TPM/Trusted Computing

SUSE Linux Enterprise Server 11 comes with support for Trusted Computing technology. To enable your system's TPM chip, make sure that the "security chip" option in your BIOS is selected. TPM support is entirely passive, meaning that measurements are being performed, but no action is taken based on any TPM-related activity. TPM chips manufactured by Infineon, NSC and Atmel are supported, in addition to the virtual TPM device for Xen.

IPv6 Improvements

SUSE Linux Enterprise Server can be installed in an IPv6 environment and run IPv6 applications. When installing via network, do not forget to boot with "ipv6=1" (accept v4 and v6) or "ipv6only=1" (only v6) on the kernel command line. For more information, see the Deployment Guide and also Section 12.6, “IPv6 Implementation and Compliance”.

10G networking capabilities

OFED 1.4

traceroute 1.2

Support for traceroute over TCP

FCoE

FCoE is an implementation of the Fibre Channel over Ethernet working draft. Fibre Channel over Ethernet is the encapsulation of Fibre Channel frames in Ethernet packets. It allows users with a FCF (Fibre Channel over Ethernet Forwarder) to access their existing Fibre Channel storage using an Ethernet adapter. When leveraging DCB's PFC technology to provide a loss-less environment, FCoE can run SAN and LAN traffic over the same link.

Data Center Bridging (DCB)

Data Center Bridging (DCB) is a collection of Ethernet enhancements designed to allow network traffic with differing requirements (e.g., highly reliable, no drops vs. best effort vs. low latency) to operate and co-exist on Ethernet. Current DCB features are:

Improved Update Stack

SUSE Linux Enterprise Server 11 comes with an improved update stack and the new command line tool zypper to manage the repositories and install or update packages.

Enhanced YaST Partitioner

Extended Built-In Management Infrastructure

SUSE Linux Enterprise Server provides CIM/WBEM enablement with the SFCB CIMOM.

For a complete list of providers and management profiles, see http://en.opensuse.org/SystemsManagement/CIM/Providers.

Support for Web Services for Management (WS-Management)

The WS-Management protocol is supported via Openwsman, providing client (package: openwsman-client) and server (package: openwsman-server) implementations.

This allows for interoperable management with the Windows 'winrm' stack.

WebYaST - Web Based Remote Management

WebYaST is a simple, easy to use, web-based administration tool targeted at casual Linux administators.

SUSE Linux Enterprise Server 11 SP1 adds WebYaST through an online software repository. After successful registration you can install and start WebYaST by following these steps:

The last command will display the URL to connect to with a Web browser.

Hardware

z/VM

Storage

Network

Security

RAS

Web 2.0 Open Source Stack in SUSE Linux Enterprise Software Development Kit

Functionality implemented in SUSE Linux Enterprise Server 11 (and SUSE Linux Enterprise Server 10 Service Pack 2.)

Updated bnx driver to version 2.0.4

Updated bnx2x driver to version 1.52.1-7

Updated e100 driver to version 3.5.24-k2

Updated tg3 driver to version 3.106

Added bna driver for Brocade 10Gbit LAN card in version 2.1.2.1

Updated bfa driver to version 2.1.2.1

Updated qla3xxx driver to version 2.03.00-k5

Updated sky2 driver to version 1.25

Updated qla2xxx to version 8.03.01.04.11.1-k8

Updated qla4xxx to version v5.01.00.00.11.01-k13

Updated megaraid_mbox driver to version 2.20.5.1

Updated megaraid_sas to version 4.27

Updated MPT Fusion to version 4.22.00.00

Updated mpt2sas driver to version 04.100.01.02

Updated lpfc driver to version 8.3.5.7

Added bnx2i driver for Broadcom NetXtreme II in version 2.1.1

Updated bfa driver to version 2.1.2.1

The enic driver was updated to version 1.4.2 to support newer Cisco UCS systems. This update also replaces LRO (Large Receive Offload) to GRO (Generic Receive Offload).

Updated CIFS to version 1.50c

Updated OCFS2 to version 1.4.0

Updated intel-i810 driver

Added X11 driver for AMD Geode LX 2D (xorg-x11-driver-video-amd)

Updated X11 driver for Radeon cards

Updated XFS and DMAPI driver

Updated Wacom driver to version 1.46

L1: Installation and problem determination, which means technical support designed to provide compatibility information, installation configuration assistance, usage support, on-going maintenance and basic troubleshooting. Level 1 Support is not intended to correct product defect errors.

L2: Reproduction of problem isolation, which means technical support designed to duplicate customer problems, isolate problem area and potential issues, and provide resolution for problems not resolved by Level 1 Support.

L3: Code debugging and problem resolution, which means technical support designed to resolve complex problems by engaging engineering in patch provision, and resolution of product defects which have been identified by Level 2 Support.

Technology Previews and SELinux Basic Enablement

Sounds, Graphics, Fonts and Artwork

Packages, which require an additional customer contract

Packages on the Software Development Kit (SDK)

BEA Java (Itanium only)

MySQL Database

PostgreSQL Database

WebSphere CE Application Server

Hot-Add of Memory

Hot-Add-memory is currently only supported on the following hardware:

If your specific machine is not listed, please call Novell support to confirm whether or not your machine has been successfully tested. Also, please regularly check our maintenance update information, which will explicitly mention the general availability of this feature.

Restriction on using IBM eHCA InfiniBand adapters in conjunction with Hot-Add of Memory on IBM System p:

The current eHCA Device Driver will prevent dynamic memory operations on a partition as long as the driver is loaded. If the driver is unloaded prior to the operation and then loaded again afterwards, adapter initialization may fail. A Partition Shutdown / Activate sequence on the HMC may be needed to recover from this situation.

Internet Storage Naming Service (iSNS)

The Internet Storage Naming Service (iSNS) package is by design suitable for secure internal networks only. Novell will continue to work with the community on improving security on this.

Linux Filesystem Capabilities

Our kernel is compiled with support for Linux Filesystem Capabilities. This is disabled per default and can be enabled by adding file_caps=1 as kernel boot option.

eCryptfs Filesystem

The eCryptfs kernel modules and the ecryptfs-utils package shipped with SUSE Linux Enterprise Server 11 are a preview of a stacked cryptographic filesystem for Linux.

Ext4 Filesystem

The Ext4 kernel modules and userland tools shipped with SUSE Linux Enterprise Server 11 are a preview of a new filesystem for Linux.

biosdevname

biosdevname in its simplest form takes a kernel name as an argument, and returns the BIOS-given name it "should" be. This is necessary on systems where the BIOS name for a given device (e.g., the label on the chassis is "Gb1") doesn't map directly and obviously to the kernel name (e.g., eth0).

btrfs Filesystem

The btrfs kernel modules and userland tools shipped with SUSE Linux Enterprise Server 11 SP1 are a preview of a new filesystem for Linux.

Read-Only Root Filesystem

It is possible to run SUSE Linux Enterprise Server 11 on a shared read-only root filesystem. A read-only root setup consists of the read-only root filesystem, a scratch and a state filesystem. The /etc/rwtab file defines which files and directories on the read-only root filesystem are replaced by which files on the state and scratch filesystems for each system instance.

The readonlyroot kernel command line option enables read-only root mode; the state= and scratch= kernel command line options determine the devices on which the state and scratch filesystems are located.

In order to set up a system with a read-only root filesystem, set up a scratch filesystem, set up a filesystem to use for storing persistent per- instance state, adjust /etc/rwtab as needed, add the appropriate kernel command line options to your boot loader configuration, replace /etc/mtab with a symlink to /proc/mounts as described below, and (re)boot the system.

In order to replace /etc/mtab with the appropriate symlinks, do this:

rm -f /etc/mtab
ln -s /proc/mounts /etc/mtab
   

See the rwtab(5) manual page for further details and http://www.redbooks.ibm.com/abstracts/redp4322.html for limitations on System z.

Online migration from SP1 to SP2 is not supported, if debuginfo packages are installed.

Migration is supported from SUSE Linux Enterprise Server 10 SP3 and SP4 via bootable media (incl. PXE boot).

Upgrading from SLES 10 to SLES 11 with Root Filesystem on iSCSI

The upgrade or the unattended migration from SLES 10 to SLES 11 fails, if the root filesystem of the machine is located on iSCSI.

The reason is that on SLES 10, mount had the 'hotplug' option for iSCSI disks, which is replaced with 'nofail' on SLES 11. After upgrade, initrd does not mount the root filesystem complaining about wrong options.

To work around this limitation, replace the 'hotplug' option in /etc/fstab with 'nofail' before last reboot for the upgrade.

Upgrading from SLES 10 SP2

There are two supported ways to upgrade from SLES 10 SP2 to SLES 11 SP1, which require intermediate upgrade steps:

For more information, see http://www.novell.com/support/viewContent.do?externalId=7005410.

Kernel split in different packages

With SUSE Linux Enterprise Server 11 the kernel RPMs are split in different parts:

Tickless Idle

SUSE Linux Enterprise Server uses tickless timers. This can be disabled by adding nohz=off as a boot option.

Development Packages

SUSE Linux Enterprise Server will no longer contain any development packages, with the exception of some core development packages necessary to compile kernel modules. Development packages are available in the SUSE Linux Enterprise Software Development Kit.

Displaying manual pages with the same name

The man command now asks, which manual page the user wants to see if manual pages with the same name exist in different sections. The user is expected to type the section number to make this manual page visible.

If you want to revert back to the previously used method, set MAN_POSIXLY_CORRECT=1 in a shell initialization file such as ~/.bashrc.

YaST LDAP Server no longer using /etc/openldap/slapd.conf

The YaST LDAP Server module no longer stores the configuration of the LDAP Server in the file /etc/openldap/slapd.conf. It uses OpenLDAP's dynamic configuration backend, which stores the configuration in an LDAP database it self. That database consists of a set of .ldif files in the directory /etc/openldap/slapd.d. Normally, you do not need to access these files directly. To access the configuration you can either use the yast2-ldap-server module or any capable LDAP client (e.g., ldapmodify, ldapsearch, etc.). For details on the dynamic configuration of OpenLDAP, see the OpenLDAP Administration Guide.

Novell AppArmor

This release of SUSE Linux Enterprise Server ships with Novell AppArmor. The AppArmor intrusion prevention framework builds a firewall around your applications by limiting the access to files, directories, and POSIX capabilities to the minimum required for normal operation. AppArmor protection can be enabled via the AppArmor control panel, located in YaST under Novell AppArmor. For detailed information about using Novell AppArmor, see the documentation in /usr/share/doc/packages/apparmor-docs.

The AppArmor profiles included with SUSE Linux have been developed with our best efforts to reproduce how most users use their software. The profiles provided work unmodified for many users, but some users may find our profiles too restrictive for their environments.

If you discover that some of your applications do not function as you expected, you may need to use the AppArmor Update Profile Wizard in YaST (or use the aa-logprof(8) command line utility) to update your AppArmor profiles. Place all your profiles into learning mode with the following: aa-complain /etc/apparmor.d/*

When a program generates many complaints, the system's performance is degraded. To mitigate this, we recommend periodically running the Update Profile Wizard (or aa-logprof(8)) to update your profiles even if you choose to leave them in learning mode. This reduces the number of learning events logged to disk, which improves the performance of the system.

Updates with alternative Bootloader Programs (non-Linux)

Updating from SUSE Linux Enterprise Server 10 SP2 in a system where alternative bootloaders (not grub) are installed in the MBR (Master Boot Record) might override the MBR and place grub as the primary bootloader into the system.

We propose doing a fresh installation in this case. Don't forget to backup your data!

Tip

It is always a good plan to keep data separated from the system software. In other words, /home, /srv, ... and other volumes containing data should be on a separate partition, volume group or logical volume. The YaST partitioning module will propose doing this.

Upgrading MySQL to SUSE Linux Enterprise Server 11

During the upgrade to SUSE Linux Enterprise Server 11 MySQL is also upgraded to the latest version. To complete this migration you may have to upgrade your data as described in the MySQL documentation.

Fine-Tuning Firewall Settings

SuSEfirewall2 is enabled by default. That means that by default you cannot log in from remote systems. This also interferes with network browsing and multicast applications, such as SLP and Samba ("Network Neighborhood"). You can fine-tune the firewall settings using YaST.

Upgrading from SUSE Linux Enterprise Server 10 SP2 to SUSE Linux Enterprise Server 11 SP1 with the Xen Hypervisor may have incorrect network configuration

We have improved the network configuration from SUSE Linux Enterprise Server 10 to SUSE Linux Enterprise Server 11 SP1: If you install SUSE Linux Enterprise Server 11 SP1 and configure Xen, you get a bridged setup through YaST. However, if you upgrade from SUSE Linux Enterprise Server 10 SP2 to SUSE Linux Enterprise Server 11 SP1, the upgrade does not configure the bridged setup automatically.

Start the "YaST Control Center", choose "Virtualization" and then "Install Hypervisor and Tools" to start the bridge proposal for networking. Alternatively, call

yast2 xen

on the commandline.

Upgrading from SUSE Linux Enterprise Server 10 SP2 to SUSE Linux Enterprise Server 11 SP1 with the Xen Hypervisor does not preserve Xen configuration options

Due to changes in default settings, the Xen Management Daemon (xend) configuration file is replaced during upgrade. Customizations are saved to /etc/xen/xend-config.sxp.rpmsave for merging with the new configuration file.

LILO configuration via YaST/AutoYaST

The configuration of the LILO bootloader via YaST/AutoYaST is still possible, but not supported on the x86/x86_64 architecture any more. For further information, consult Novell TID 7003226 http://www.novell.com/support/documentLink.do?externalID=7003226.

Changed routing behavior

SUSE Linux Enterprise Server 10 and SUSE Linux Enterprise Server 11 set net.ipv4.conf.all.rp_filter = 1 in /etc/sysctl.conf with the intention of enabling route path filtering. However, the Kernel fails to enable routing path filtering, as intended, by default in these products.

In SUSE Linux Enterprise Server 11 SP1 this bug is fixed and most simple single-homed unicast server setups will not notice a change. But it may cause issues for applications that relied on reverse path filtering being disabled (e.g., multicast routing or multi-homed servers).

For more details, see http://ifup.org/2011/02/03/reverse-path-filter-rp_filter-by-example/.

Kernel devel packages

With SUSE Linux Enterprise Server 11 Service Pack1 the configuration files for recompiling the kernel were moved in an own sub-package:

Modified operation against Novell Customer Center

Effective on 2009-01-13, provisional registrations will be disabled in the Novell Customer Center. Registering an instance of SUSE Linux Enterprise Server or Open Enterprise Server (OES) products now requires a valid, entitled activation code. Evaluation codes for reviews or proofs of concept can be obtained from the product pages and from the download pages on novell.com. If a device is registered without a code at setup time, a provisional code is assigned by Novell Customer Center (NCC) to the device, and an entry for it is made in your NCC list of devices. No update repositories are assigned to the device at this time. Once you are ready to assign a code to the device, starting the YaST Novell Customer Center registration module and putting in the appropriate code (replacing the un-entitled provisional code that NCC generated) will fully entitle the device and activate the appropriate update repositories.

Operation against Subscription Management Tool

Operation under the Subscription Management Tool (SMT) package and registration proxy is not affected. Registration against SMT will assign codes automatically from your default pool in NCC until all entitlements have been assigned. Registering additional devices once the pool is depleted will result in the new device being assigned a provisional code (with local access to updates), and the SMT server will provide appropriate notification to the administrator that these new devices need to be entitled.

Minimal Pattern

The minimal pattern provided in YaST's Software Selection Dialog targets experienced customers and should be used as a base for your own specific software selections.

Do not expect that an unchanged or not-extended minimal pattern provides a useful basis for your business needs.

This pattern does not include any dump- or logging-tools. To fully support your configuration, Novell Technical Services (NTS) will request the installation of all the tools which are needed for further analysis, in case of a support request.

SPident

SPident is a tool to identify the Service Pack level of the current installation. This tool is not delivered with SUSE Linux Enterprise Server 11 GA, but is replaced by the new SAM tool (package "suse-sam").

Linux Completely Fair Scheduler affects Java performance

Problem (Abstract)

Java applications that use synchronization extensively might perform poorly on Linux systems that include the Completely Fair Scheduler. If you encounter this problem, there are two possible workarounds.

Symptom

You may observe extremely high CPU usage by your Java application, and very slow progress through synchronized blocks. The application may appear to hang due to the slow progress.

Cause

The Completely Fair Scheduler (CFS) is a scheduler that was adopted into the mainline Linux kernel as of release 2.6.23. The CFS algorithm is different from previous Linux releases. It might change the performance properties of some applications. In particular, CFS implements sched_yield() differently, making it more likely that a thread that yields will be given CPU time regardless. More information on CFS can be found here: "Multiprocessing with the Completely Fair Scheduler", http://www.ibm.com/developerworks/linux/library/l-cfs/?ca=dgrlnxw06CFC4Linux

The new behavior of sched_yield() might adversely affect the performance of synchronization in the IBM JVM.

Environment

This problem may affect IBM JDK 5.0 and 6.0 (all versions) running on Linux kernels that include the Completely Fair Scheduler, including Linux kernel 2.6.27 in SUSE Linux Enterprise Server 11.

Resolving the problem

If you observe poor performance of your Java application, there are two possible workarounds:

You should not use these workarounds unless you are experiencing poor performance.

Tuning performance of simple database engines

Simple database engines like Berkeley DB use memory mappings (mmap(2)) to manipulate database files. When the mapped memory is modified, those changes need to be written back to disk. In SUSE Linux Enterprise 11, the kernel includes modified mapped memory in its calculations for deciding when to start background writeback, and when to throttle processes which modify additional memory. (In previous versions, mapped dirty pages were not accounted for, and the amount of modified memory could exceed the overall limit defined.) This can lead to a decrease in performance; the fix is to increase the overall limit.

The maximum amount of dirty memory is 40% in SUSE Linux Enterprise 11 by default. This value is chosen for average workloads, so that enough memory remains available for other uses. The following settings may be relevant when tuning for database workloads:

These limits can be observed or modified with the sysctl utility (see sysctl(1), sysctl.conf(5)).

openSSH with Cryptographical Hardware Acceleration

openSSH now makes use of cryptographical hardware acceleration. As a result, the transfer of large quantities of data through a ssh connection is considerably faster. As an additional benefit, the CPU of the system with cryptographical hardware will see a significant reduction in load.

Multipathing—SCSI Hardware Handler

Some storage devices, e.g. IBM DS4K, require special handling for path failover and failback. In SUSE Linux Enterprise Server 10 SP2, this was handled at the dm layer as hardware handler.

One drawback of this implementation was that the underlying SCSI layer didn't know about the existence of the Hardware Handler. Hence, during device probing, SCSI would send I/O on the passive path, which would fail after a timeout and also print extraneous error messages in the console.

In SUSE Linux Enterprise Server 11, this problem is resolved by moving the hardware handler to the SCSI layer, hence the term SCSI Hardware Handler. These handlers are modules created under the SCSI directory in the Linux Kernel.

In SUSE Linux Enterprise Server 11, there are four SCSI Hardware Handlers: scsi_dh_alua, scsi_dh_rdac, scsi_dh_hp_sw, scsi_dh_emc.

These modules need to be included in the initrd image so that SCSI knows about the special handling during probe time itself.

This can be done by following these steps:

Multipathing: failed paths do not return after a path failure

To work in a fully certified environment with all storage backend systems and fully supported by Novell and your storage vendor, please make sure that you have installed at least multipath-tools-0.4.8-40.2 or a later version. Appropriate packages are available as a maintenance update for SUSE Linux Enterprise 11.

Local Mounts of iSCSI Shares

An iSCSI shared device should never be mounted directly on the local machine. In an OCFS2 environment, doing so causes all hardware to hard hang.

Installation on systems with many LUNs (storage)

While the number of LUNs for a running system is virtually unlimited, we suggest not having more than 64 LUNs online while installing the system, to reduce the time to initialize and scan the devices and thus reduce the time to install the system in general.

Supported Hardware / Systems

All POWER3, POWER4, PPC970 and RS64–based models that were supported by SUSE Linux Enterprise Server 9 are no longer supported.

Loading the installation kernel via network on POWER

With SUSE Linux Enterprise Server 11 the bootfile DVD1/suseboot/inst64 can not be booted directly via network anymore, because its size is larger than 12MB. To load the installation kernel via network, copy the files yaboot.ibm, yaboot.cnf and inst64 from the DVD1/suseboot directory to the TFTP server. Rename the yaboot.cnf file to yaboot.conf. yaboot can also load config files for specific ethernet MAC addresses. Use a name like yaboot.conf-01-23-45-ab-cd-ef match a MAC address. An example yaboot.conf for TFTP booting looks like this:

  default=sles11
  timeout=100
  image[64-bit]=inst64
    label=sles11
    append="quiet install=nfs://hostname/exported/sles11dir"
   

Note that this will not work on POWER4 systems. Their firmware can only load files up to 12MB via TFTP.

Huge Page Memory Support on POWER

Huge Page Memory (16GB pages, enabled via HMC) is supported by the Linux Kernel, but special kernel parameters must be used to enable this support. Boot with the parameters "hugepagesz=16G hugepages=N" in order to use the 16GB huge pages, where N is the number of 16GB pages assigned to the partition via the HMC. The number of 16GB huge pages available can not be changed once the partition is booted. Also, there are some restrictions if huge pages are assigned to a partition in combination with eHEA / eHCA adapters:

IBM eHEA Ethernet Adapter:

The eHEA module will fail to initialize any eHEA ports if huge pages are assigned to the partition and Huge Page kernel parameters are missing. Thus, no huge pages should be assigned to the partition during a network installation. To support huge pages after installation, the huge page kernel parameters need to be added to the boot loader configuration before huge pages are assigned to the partition.

IBM eHCA InfiniBand Adapter:

The current eHCA device driver is not compatible with huge pages. If huge pages are assigned to a partition, the device driver will fail to initialize any eHCA adapters assigned to the partition.

Installation on POWER onto IBM vscsi target

The installation on a vscsi client will fail with old versions of the AIX VIO server. Please upgrade the AIX VIO server to version 1.5.2.1-FP-11.1 or later.

iSCSI installations with multiple NICs may lose network connectivity at the end of firstboot stage

After installing SLES 11 SP1 on an iSCSI target system boots properly, network is up and the iSCSI root device is found as expected, and the install completes (firstboot part) as usual. However, at the end of firstboot, network is shut down before the root filesystem is unmounted, leading to read failures accessing the root (iSCSI) device; the system hangs.

Solution: reboot the system.

IBM Linux VSCSI server support in SUSE Linux Enterprise Server 11

Customers using SLES 9 or SLES 10 to serve Virtual SCSI to other LPARs, using the ibmvscsis driver, who wish to migrate from these releases, should consider migrating to the IBM Virtual I/O server. The IBM Virtual I/O server supports all the IBM PowerVM virtual I/O features as well as provides integration with the Virtual I/O management capabilities of the HMC. It can be downloaded at: http://www14.software.ibm.com/webapp/set2/sas/f/vios/download/home.html

Virtual Fibre Channel devices

When using IBM Power Virtual Fibre Channel devices utilizing N-Port ID Virtualization, the Virtual I/O Server may need to be updated in order to function correctly. Linux requires VIOS 2.1, Fixpack 20.1, and the LinuxNPIV I-Fix in order for this feature to function properly. These updates can be downloaded from the following URL: http://www14.software.ibm.com/webapp/set2/sas/f/vios/home.html

Virtual Tape Devices

When using virtual tape devices served by an AIX VIO server, the Virtual I/O Server may need to be updated in order to function correctly. The latest updates can be downloaded from the following URL: http://www14.software.ibm.com/webapp/set2/sas/f/vios/home.html

For further information regarding IBM Virtual I/O Server documentation please see: http://www14.software.ibm.com/webapp/set2/sas/f/vios/documentation/home.html

ITrace

Using the ITrace instrumentation library, libperfutil, to start and stop tracing on your application may result in a system hang. A workaround for this problem is to insert a call to ITraceDisable() prior to calling ITrace_off() in your instrumented application.

Chelsio cxgb3 iSCSI offload engine

The Chelsio hardware supports ~16K packet size (the exact value depends on the system configuration). It is recommended that you set the parameter MaxRecvDataSegmentLength in /etc/iscsid.conf to 8192.

For the cxgb3i driver to work properly, this parameter needs to be set to 8192.

In order to use the cxgb3i offload engine, the cxgb3i module needs to be loaded manually after open-scsi has been started.

For additional information, refer to /usr/src/linux/Documentation/scsi/cxgb3i.txt in the kernel source tree.

Known TFTP issues with yaboot

When attempting to netboot yaboot users may see the following error message: "Can't claim memory for TFTP download (01800000 @ 01800000-04200000)" and the netboot will stop and immediately display the yaboot "boot:" prompt. Use the following steps to work around the problem.

Graphical administration of remotely installed hardware

If you do a remote installation in text mode, but want to connect to the machine later in graphical mode, please be sure to set the default runlevel to 5 via YaST. Otherwise it might be, that xdm/kdm/gdm will not be started.

The itrace tracing software may affect GDB functionality

After using the itrace program, a subsequent GDB session may repeatedly stop the debugged program, failing with the error message "Program received signal ?, Unknown signal." or "warning: Signal ? does not exist on this system."

To solve the problem, please unload the itrace kernel module by running the /usr/bin/pi_unload.sh program.

InfiniBand - SDP protocol is not supported on IBM hardware

To disable SDP on IBM hardware please set SDP=no in openib.conf so that by default SDP is not loaded. After you have set this setting in openib.conf to 'no' please run "openibd restart" or reboot the system for this setting to take effect.

RDMA NFS Server May Hang During Shutdown (OFED)

If your system is configured as an NFS over RDMA server, the system may hang during a shutdown if a remote system has an active NFS over RDMA mount. To avoid this problem, prior to shutting down the system, run "openibd stop"; run it in the background, because the command will hang and otherwise block the console:

/etc/init.d/openibd stop &

A shutdown can now be run cleanly.

Note: the steps to configure and start NFS over RDMA are as follows:

IBM System z Architecture Level Set (ALS) preparation

To exploit new IBM System z architecture capabilities during lifecycle of SUSE Linux Enterprise Server 11 support for machines of type z900, z990, z800, z890 is deprecated in this release. Novell plans to introduce an ALS earliest with SUSE Linux Enterprise Server 11 Service Pack 1 (SP1), latest with SP2. After ALS SUSE Linux Enterprise Server 11 only executes on z9 or newer processors.

With SUSE Linux Enterprise Server 11 GA only machines of type z9 or newer are supported.

When developing software, we recommend to switch gcc to z9/z10 optimization:

The minimum required machine loader level for IPL of SUSE Linux Enterprise Server 11 from a SCSI disk is v1.4 which is included in the follow MCLs:

For older levels of the machine loader, the ramdisk load address of the installed SUSE Linux Enterprise Server 11 system needs to be manually changed from 0x2000000 to 0x1000000. To do this, open the /etc/zipl.conf file and change lines containing ramdisk = <initrd filename>,0x2000000 into ramdisk = <initrd filename>,0x1000000and run the zipl command afterwards. Note that this workaround may not work on systems with large amount of memory.

For LUN Scanning to work properly, the minimum Storage firmware level should be:

Large Page support in IBM System z

Possibility for processes to allocate process memory in chunks of 1 MByte instead of 4 KByte. This works through the hugetlbfs.

Collaborative memory management Stage II (CMM2) currently not available

IBM and Novell are working to integrate this technology into the Linux Kernel and move it to a supported solution in SUSE Linux Enterprise Server as soon as available upstream.

Issue with SLES 11 and NSS under z/VM

Starting SLES 11 under z/VM with NSS sometimes makes guest to logoff by itself.

Solution: IBM addresses this issue with APAR VM64578.

All modules of a self-recompiled kernel are by default marked as unsupported.

Kernel Modules supported by SUSE partners and delivered using SUSE's Partner Linux Driver process are marked "external".

If the "supported" flag is not set, loading a module will taint the kernel. Kernels which are tainted are not supported. To avoid this, not supported Kernel modules are included in an extra RPM (kernel-<flavor>-extra) and will not be loaded by default ("flavor"=default|smp|xen|...). In addition, those unsupported modules are not available in the installer, and the package kernel-$flavor-extra is not on the SUSE Linux Enterprise Server media.

Kernel Modules not provided under a license compatible to the License of the Linux Kernel will also taint the Kernel; see /usr/src/linux/Documentation/sysctl/kernel.txt and cf. the state of "/proc/sys/kernel/tainted".

Linux Kernel

The value of /proc/sys/kernel/unsupported defaults to 2 on SUSE Linux Enterprise Server 11 ("do not warn in syslog when loading unsupported modules"). This is the default used in the installer as well as in the installed system. See /usr/src/linux/Documentation/sysctl/kernel.txt for more information.

modprobe

The "modprobe" utility for checking module dependencies and loading modules appropriately checks for the value of the "supported" flag. If the value is "yes" or "external" the module will be loaded, otherwise it will not. See below, for information on how to override this.

Note: SUSE does not generally support removing of storage modules via modprobe -r.

You can override the default by changing the variable allow_unsupported_modules in /etc/modprobe.d/unsupported-modules and set the value to "1".

If you only want to try loading a module once, the --allow-unsupported-modules command-line switch can be used with modprobe. (see: man modprobe).

During installation, unsupported modules may be added through driver update disks, and they will be loaded.

To enforce loading of unsupported modules during boot and afterwards, please use the kernel command line option oem-modules.

While installing and initializing the module-init-tools package, the kernel flag "TAINT_NO_SUPPORT" ("/proc/sys/kernel/tainted") will be evaluated. If the kernel is already tainted, allow_unsupported_modules will be enabled. This will prevent unsupported modules from failing in the system being installed. (If no unsupported modules are present during installation and the other special kernel command line option is not used, the default will still be to disallow unsupported modules.)

If you install unsupported modules after the initial installation and want to enable those modules to be loaded during system boot, do not forget to run depmod and mkinitrd.

Section 3: RFC 4862 - IPv6 Stateless Address Autoconfiguration

Some tests fail because of the default DAD handling in Linux; disabling the complete interface is possible, but not the default behavior (because security-wise, this might open a DoS attack vector, a malicious node on a network could shutdown the complete segment) this is still conforming to RFC 4862: the shutdown of the interface is a "should", not a mandatory ("must") rule.

The Linux kernel allows you to change the default behavior with a sysctl parameter. To do this on SUSE Linux Enterprise Server 11, you need to make the following changes in configuration:

Section 4: RFC 1981 - Path MTU Discovery for IPv6

On these two tests ping6 needs to be told to allow defragmentation of multicast packets. Newer ping6 versions have this disabled by default. Use: ping6 -M want <other parameters>. see man ping6 for more information

Enable IPv6 in Yast for SCTP support

SCTP is dependent on IPv6, so in order to successfully insert the SCTP module, IPv6 must be enabled in YaST. This allows for the IPv6 module to be automatically inserted when `modprobe sctp` is called.

Log Files on tmpfs Filesystem Is Unsupported

Ensure all your logs go through permanent local storage or the network. For example, putting /var/log on a tmpfs filesystem means that they will not survive a system boot which limits your ability, and the one of SUSE, to analyze log files in case of a support request.

An exception are configurations where you save log files via syslog on a remote log server and store them there permanently. But note that not all log files can be redirected to a remote log server (e.g. yast-logs, boot logs and others); if these files are not available, support may be very hard to effectively diagnose issues and support the system.

libica 2.0.2 is available in SLES 11 SP1 for s390x customers

The libica package contains the interface library routines used by IBM modules to interface with IBM Cryptographic Hardware (ICA). Starting with SLES 11 SP1, libica is provided in the s390x distribution in two flavors of packages: libica-1_3_9 and libica-2_0_2, providing libica versions 1.3.9 and 2.0.2 respectively.

libica 1.3.9 is provided for compatibility reasons with legacy hardware present e.g. in the ppc64 architecture. For s390x users it's always recommended to use the new libica 2.0.2 library since it supports all newer s390x hardware, larger key sizes and is backwards compatible with any ICA device driver in the s390x architecture.

You may choose to continue using libica 1.3.9 if you don't have newer Cryptographic hardware to exploit or wish continue using custom applications that don't support the libica 2.0.2 library yet. Both openCryptoki and openssl-ibmca, the two main exploiters for the libica interface, are provided in SLES 11 SP1 to support the newer libica 2.0.2 library.

Changes to network setup

The script modify_resolvconf is removed in favor of a more versatile script called netconfig. This new script handles specific network settings from multiple sources more flexibly and transparently. Please review the documentation and man-page of netconfig for more details.

Memory cgroups

Memory cgroups are now disabled for machines where they cause memory exhaustion and crashes. Namely, X86 32-bit systems with PAE support and more than 8G in any memory node have this feature disabled.

MCELog

The mcelog package logs and parses/translates Machine Check Exceptions (MCE) on hardware errors (also including memory errors). Formerly this has been done by a cronjob executed hourly. Now hardware errors are immediately processed by an mcelog daemon.

However the mcelog service is not enabled by default resulting in memory and CPU errors also not being logged by default. In addition, mcelog has a new feature to also handle predictive bad page offlining and automatic core offlining when cache errors happen.

The service can either be enabled via commandline with

	chkconfig mcelog on
	rcmcelog start 

or via the YaST runlevel editor.

Locale Settings in ~/.i18n

If you are not satisfied with locale system defaults, change the settings in ~/.i18n. Entries in ~/.i18n override system defaults from /etc/sysconfig/language. Use the same variable names but without the RC_ namespace prefixes; for example, use LANG instead of RC_LANG. For more information about locales in general, see "Language and Country-Specific Settings" in the Reference Manual.

Configuration of kdump

The kernel is crashing or otherwise misbehaving and a kernel core dump needs to be captured for analysis.

Please use YaST (System->Kernel Kdump) to configure your environment.

JPackage Standard for Java Packages

Java packages are changed to follow the JPackage Standard (http://www.jpackage.org/). Please read the documentation in /usr/share/doc/packages/jpackage-utils/ for more information.

Pulseaudio

For better sound functionality on SUSE Linux Enterprise systems we strongly recommend that pulseaudio 0.9.14 or higher is installed. This version is available via maintenance channels for SUSE Linux Enterprise systems registered with Novell.

Stopping Cron Status Messages

To avoid the mail-flood caused by cron status messages, the default value of SEND_MAIL_ON_NO_ERROR in /etc/sysconfig/cron is now set to "no" for new installations. Even with this setting to "no", cron data output will still be send to the MAILTO address, as documented in the cron manpage. In the update case it is recommended to set these values according to your needs.