22.10.0.0

October 2022 CPU and PSU release security fixes

Compatibility with Cloud Native Compiler (CNC) version 1.5

Support for the GA release of Azul Vulnerability Detection (AVD).

Changes for containers regarding thread pool size calculation and number of available CPUs.

With the October 2022 release of Java 11 and 17, the default calculation of available CPU cores will change, following JDK-8281181. Previously, the number of available CPU cores was in some situations calculated based on the lower bound defined in the environment. With the change in this release, the lower bound won’t be used anymore and the calculation will only be based on the upper limit of the environment. If in container-based systems no upper limit is defined, the total number of CPUs on the host machine is read as upper limit.

A situation where a change will occur is, for example, a Kubernetes container where neither CPU requests nor CPU Limits are set, as previously the JVM would select only 1 CPU core as available in this situation while after the chance, it will select all available CPU cores of the environment which can lead to higher resource usage as thread pools of various open source frameworks are using this calculation for sizing. To verify if your systems are effect, check especially those where no upper limit is defined.

In case you need to switch back to the previous calculation, add -XX:+UseContainerCpuShares to the Java command line.

Other terms used in the context of CPU definitions are for lower bound "CPU Requests" or "cgroups cpu.shares", and for upper limit "CPU Limits" or "cgroups cpu.cfs_quota_us".

When both quota and shares are specified for a cgroup and UseContainerCpuShares is true, the number of GC and compiler threads are derived based on a total processor count calculated as (quota+shares)/2. When UseContainerCpuShares is false the number is derived based on a total processor count calculated as (quota/2).

To check the current setting, for example, to compare previous and current Java versions in your environment, use the following example to display the actual number of CPUs as seen by application code and run it inside your container environment:

File AvailableCPUs.java:

 
public class AvailableCPUs {
    public static void main(String[] args) {
        System.out.println("CPUs: "
            + Runtime.getRuntime().availableProcessors());
    }
}

To run it:

 
java -showversion AvailableCPUs.java

There are no new issues to report in this release.

ZVM-25268 - As a part of the PSU update, UseContainerCpuShares has been set to false (off) by default.

ZVM-22642 - The GC log now reports data from remote compilations which can be viewed in GC Log Analyzer.