tencent cloud

TencentOS Server

DocumentaçãoTencentOS ServerUser GuideKernel FeaturesOverview of Kernel Features and Interfaces

Overview of Kernel Features and Interfaces

Baixar
Modo Foco
Tamanho da Fonte
Última atualização: 2026-10-19 16:00:39
Traduzido por IA

Overview

TencentOS Server 4 ships with the Linux 6.6 LTS kernel by default. Validated by massive internal workloads at Tencent, it provides rich kernel features and interfaces for cloud native, high-performance computing, AI inference, and big data scenarios, helping users achieve lower latency, higher throughput, and finer-grained resource control. This document serves as the overview page for the TencentOS Server 4 kernel feature series, helping you quickly understand the business value, applicable scenarios, and detailed documentation entry points of each kernel feature.

Background Information

When mixed workloads (containers, databases, AI inference, and Web services) are run on a public cloud, the default kernel configuration of a general-purpose Linux distribution often cannot meet the requirements of all scenarios. For example, container colocation requires precise CPU and memory limits enforced through cgroups. Large-memory databases require transparent huge pages to reduce TLB misses. Cross-region data transfer requires BBR congestion control to improve throughput. Production environments also require kdump to preserve the crash scene when a kernel crash occurs.
The TencentOS Server 4 kernel has been extensively optimized and tuned with adjusted defaults for the Tencent Cloud scenarios described above, making it ready to cover most workloads out of the box. However, certain advanced features, such as cgroup v2 I/O control, eBPF programs, and kdump, still require explicit configuration based on your actual workloads to deliver their full value. This document serves as an overview to help you quickly locate the configuration methods for each type of feature.

Must-Knows

This document is primarily based on TencentOS Server 4 (kernel 6.6). Some parameters may vary across minor kernel versions. Refer to the actual output of uname -r on your system.
Before modifying kernel feature configurations in a production environment, verify them in a test environment first. In particular, improper settings for parameters such as crashkernel reservation and cgroup limits may cause the system to fail to boot or workloads to be terminated unexpectedly.
Most commands listed in this document require root privileges to run. When these commands are executed inside a container, some /sys and /proc interfaces may be read-only due to host cgroup restrictions. Configure them on the host instead.

Prerequisites

Before running any kernel configuration, inspection, or tuning commands in this document, make sure the following conditions are met:
root privileges: Most commands in this document require root to run. Ordinary users should use sudo -i or an account with sudo privileges.
Kernel configuration file exists: /boot/config-$(uname -r) must exist. Otherwise, you cannot use grep to verify CONFIG_* items.
Host environment: Perform write operations involving /sys and /proc (such as cgroup and THP) on the host. When these write operations are executed inside a container, these interfaces are restricted by the host cgroup and may be read-only or not writable.
Kernel version confirmed: Run uname -r and confirm that the output starts with 6.6.x. If the output starts with 5.4.x, some features are unavailable. For details, see "Applicable Versions" below.
Maintenance window: Modifications to runtime parameters such as sysctl, cgroup, and BBR may affect online workloads. Perform these operations within a maintenance window and prepare a rollback plan.

Applicable Version

System Version
Kernel Series
Base Kernel Version
Support Status
TencentOS Server 4
Linux 6.6 LTS
6.6
Default version, fully supported, recommended.
TencentOS Server 3
Linux 5.4 LTS
5.4
Maintenance version
CPU architecture support: x86_64 (fully supported) and aarch64 (fully supported, with some peripheral drivers subject to the actual kernel CONFIG_* values).
View the current kernel version and architecture:
# View the running kernel version
uname -r
# Output: 6.6.79-25.8.tl4.x86_64

# View detailed kernel information (including architecture and compiler)
cat /proc/version
# Output: Linux version 6.6.79-25.8.tl4.x86_64 (gcc ...) 

# View the CPU architecture
uname -m
# Output: x86_64

Kernel Feature Overview

Scheduling and Process Management

Feature
Supported Kernel Versions
Business Values
Applicable Scenarios
EEVDF scheduler
Enabled by default in 6.6
Replaces the traditional CFS algorithm, reduces tail latency, and improves the response speed of interactive services.
Online services, Web applications, and latency-sensitive services
PSI(Pressure Stall Information)
5.4
Monitors CPU, memory, and I/O resource pressure in real time, helping quickly locate performance bottlenecks.
Container colocation, performance tuning, and capacity planning
cgroup CPU Control
All versions
Limits CPU usage at the process granularity to prevent a single workload from monopolizing resources.
Multi-tenant isolation and container resource management

Memory Management

Feature
Supported Kernel Versions
Business Values
Applicable Scenarios
Transparent Huge Pages (THP)
All versions (enabled by default in 6.6)
Reduce page table overhead and improve access efficiency for large-memory applications.
Databases, virtual machines, and AI inference
Explicit Huge Pages (HugeTLB)
All versions
Reserve fixed huge pages for large-memory applications to avoid runtime allocation latency.
Databases (such as Redis and MySQL) and HPC
cgroup v2 Memory Control
5.4+
Finely control memory usage of containers/processes to prevent a single process memory leak from crashing the entire machine.
Container orchestration and colocation scenarios
Multi-Gen LRU
Enabled by default in 6.6
Optimize memory reclamation efficiency and reduce unnecessary page swapping.
Memory-intensive workloads

IO and Storage

Feature
Supported Kernel Versions
Business Values
Applicable Scenarios
io_uring
5.1+ (fully supported in 6.6)
High-performance asynchronous I/O interface that reduces system call overhead and significantly improves IOPS and throughput.
High-concurrency databases, network proxies, and file services
blk-mq multi-queue
All versions
Fully utilize NVMe/SSD multi-queue capabilities to improve block device I/O performance.
All-flash storage and high-IO workloads
cgroup v2 I/O Control
5.4+
Limit the IO bandwidth and IOPS of containers/processes to prevent a single workload from saturating the disk.
Multi-tenant storage isolation

Network Kernel

Feature
Supported Kernel Versions
Business Values
Applicable Scenarios
eBPF(XDP/TC)
5.4+ (fully supported in 6.6)
Kernel programmable data plane for high-performance packet processing, traffic analysis, and security filtering
Anti-DDoS, network monitoring, and load balancing
TCP BBR congestion control
4.9+
Replaces the traditional cubic algorithm and improves throughput on high-bandwidth, high-latency links.
Cross-region data transfer and public network services
Million-level conntrack connections
All versions
Supports ultra-large-scale concurrent connection tracking
High-concurrency gateways and load balancing

Security and Isolation

Feature
Supported Kernel Versions
Business Values
Applicable Scenarios
SELinux
All versions
Mandatory access control, providing fine-grained security policies.
Security compliance and multi-tenant environments
Linux Kernel Lockdown
5.4+
Restrict kernel interface exposure and work with Secure Boot to protect kernel integrity.
Scenarios with high security compliance requirements
Seccomp-BPF
All versions
System call filtering, reducing the container attack surface.
Container security baseline
Complete Namespace support
All versions
Support all mount/uts/ipc/pid/net/user/cgroup/time namespaces.
Container isolation and sandboxing

Debugging and Observability

Feature
Supported Kernel Versions
Business Values
Applicable Scenarios
eBPF observability toolchain
5.4+ (fully supported in 6.6)
Non-intrusive kernel tracing to identify performance bottlenecks and abnormal behaviors
Performance tuning, fault diagnosis, and security audit
ftrace
All versions
Built-in kernel tracing mechanism for analyzing function call relationships
Kernel debugging and performance analysis
perf
All versions
CPU profiling and PMU event sampling
Locate performance bottlenecks
kdump/kexec
All versions
Automatically save memory images upon kernel crash for post-incident analysis.
Ensuring production environment stability

API and Parameter Description

Kernel Feature Support Version Matrix

Feature Category
Feature
6.6 LTS
5.4 LTS
Scheduling
EEVDF scheduler
Enabled by default
Not supported
Scheduling
PSI
Supported
Supported
Memory Capacity
Transparent Huge Pages (THP)
Enabled by default
Supported
Memory Capacity
Multi-Gen LRU
Enabled by default
Not supported.
IO
io_uring
Supported
Supported
Network
eBPF (XDP/TC)
Supported
Supported
Network
TCP BBR
Supported
Supported
Security
Kernel Lockdown
Supported
Supported
Debugging
kdump/kexec
Supported
Supported

Kernel Configuration Viewing API

Interface File
Description
/boot/config-$(uname -r)
Kernel compilation configuration (full)
/proc/version
Kernel version information
uname -r
Running kernel version

Configuration Example

Warning:
These operations involve viewing and modifying kernel/runtime parameters. Before making changes in a production environment, be sure to:
1. First verify the commands and expected output in a test environment.
2. Confirm that you have root permissions and are within the maintenance window.
3. Prepare rollback commands (such as sysctl -w <parameter>=<original value> and echo <original value> > /sys/...).
4. Parameters such as crashkernel reservation and cgroup limits, if configured improperly, may cause the system to fail to boot or workloads to be terminated unexpectedly.

Viewing Kernel Version and Configuration

1. Confirm the kernel version (using TencentOS Server 4 as an example):
uname -r
# Expected output: 6.6.117-45.14.tl4.x86_64
2. View detailed kernel information (to confirm the compiler and release version):
cat /proc/version
# Expected output: Linux version 6.6.117-45.14.tl4.x86_64 (gcc ...) ...
3. Confirm that the configuration file exists and is readable:
ls -l /boot/config-$(uname -r)
# Expected output: -rw-r--r--. 1 root root 273465 ... /boot/config-6.6.117-45.14.tl4.x86_64
4. Verify that key features are compiled and enabled (each grep command should return output, indicating that =y is enabled):
grep CONFIG_CGROUPS=y /boot/config-$(uname -r)           # cgroup support
grep CONFIG_BPF=y /boot/config-$(uname -r)                # eBPF support
grep CONFIG_IO_URING=y /boot/config-$(uname -r)           # io_uring support
grep CONFIG_TRANSPARENT_HUGEPAGE=y /boot/config-$(uname -r)  # Transparent Hugepages
# Expected output: Each command returns CONFIG_CGROUPS=y / CONFIG_BPF=y / CONFIG_IO_URING=y / CONFIG_TRANSPARENT_HUGEPAGE=y respectively.

Enabling TCP BBR Congestion Control (Demonstration Example)

The following demonstration switches the default congestion control of the running kernel from cubic to bbr, which is suitable for cross-region data transfer and public network service scenarios:
1. View the currently available and selected congestion control algorithms:
sysctl net.ipv4.tcp_available_congestion_control
# Expected output: net.ipv4.tcp_available_congestion_control = reno cubic bbr ... (bbr should be included)
2. If bbr is not in the list, load the kernel module:
modprobe tcp_bbr
echo tcp_bbr > /etc/modules-load.d/bbr.conf   # Load automatically at boot
# Expected output: No errors. Run sysctl net.ipv4.tcp_available_congestion_control again and bbr should be displayed.
3. Set the runtime default algorithm to bbr:
sysctl -w net.ipv4.tcp_congestion_control=bbr
# Expected output: net.ipv4.tcp_congestion_control = bbr
4. Persist the configuration to the sysctl configuration file:
echo "net.ipv4.tcp_congestion_control=bbr" > /etc/sysctl.d/99-bbr.conf
sysctl -p /etc/sysctl.d/99-bbr.conf
# Expected output: net.ipv4.tcp_congestion_control = bbr
5. Verify that the configuration takes effect:
sysctl net.ipv4.tcp_congestion_control
# Expected output: net.ipv4.tcp_congestion_control = bbr

Enabling Transparent Huge Pages (THP) Runtime Configuration (Demonstration Example)

1. Check the current THP status:
cat /sys/kernel/mm/transparent_hugepage/enabled
# Expected output: [always] madvise never (Brackets around always indicate that it is globally enabled)
2. Set to always (takes effect immediately):
echo always > /sys/kernel/mm/transparent_hugepage/enabled
# Expected output: None. Run cat again and [always] madvise never should be displayed.
3. Persist (optional, managed by the tuned or sysctl service):
echo "echo always > /sys/kernel/mm/transparent_hugepage/enabled" >> /etc/rc.local
chmod +x /etc/rc.local
# Expected output: None. The status remains always after a restart.

FAQs

Q1: Why does running cat /boot/config-$(uname -r) return "No such file or directory"?

A: This indicates that the configuration file for the current kernel is not installed. Run the installation command yum install -y kernel-debuginfo-$(uname -r), or extract /boot/config-* from the RPM package of the same kernel version. Alternatively, you can use zcat /proc/config.gz if the kernel was compiled with CONFIG_IKCONFIG_PROC.

Q2: Why does grep CONFIG_BPF=y return nothing, but grep CONFIG_BPF=m has output?

A: =m means compiled as a module, and =y means built-in. Both are functionally available, but the module form requires loading with modprobe before it can be used. During verification, check both =y and =m:
grep -E '^CONFIG_BPF=(y|m)' /boot/config-$(uname -r)

Q3: Why does loading a feature module fail on TencentOS Server 3 (Kernel 5.4)?

A: This feature may only be built in or enabled by default in the Linux 6.6 kernel. You can troubleshoot it by following these steps:
Run grep CONFIG_<feature> /boot/config-$(uname -r) to check whether the feature is compiled in the current kernel.
If =y is returned, the feature is built in and can be used directly without loading a module. If =m is returned, run modprobe <module_name> to load the module before use.
If grep returns no output, the feature is not compiled in the current 5.4.x kernel. Some features, such as the EEVDF scheduler, cannot be enabled through modules. You need to upgrade to TencentOS Server 4 to obtain default support.

Q4: Why do settings configured with sysctl -w take effect immediately but become invalid after a reboot?

A: sysctl -w takes effect only at runtime. To persist the setting, write it to /etc/sysctl.d/*.conf. For example, run echo "net.ipv4.tcp_congestion_control=bbr" > /etc/sysctl.d/99-bbr.conf, and then run sysctl -p /etc/sysctl.d/99-bbr.conf to load it.

Q5: Why does modifying /sys/fs/cgroup/... in a container return a "Read-only file system" error?

A: Inside a container, /sys is typically mounted read-only and is restricted by the host cgroup. Run the relevant cgroup configuration as root on the host. On the container side, configure it indirectly through a systemd unit or container runtime parameters, such as Docker's --cpu-quota.
Anterior: Security Remediation Recommendation Commands: Precisely Executing Critical Security UpdatesPróximo: eBPF Feature Support Notes

Ajuda e Suporte

Esta página foi útil?

comentários

Search
    Enter keywords to search documentation