Linux_2_6_19 - Linux Kernel Newbies

Important things (AKA: ''the cool stuff'')

GFS2

GFS2 is a clustering filesystem developed mainly by Red Hat (after [http://www.theregister.co.uk/2003/12/18/red_hat_sweetens_q3/ purchasing Sistina] and opening the source code). It's not the first: OCFS2, another clustering filesystem developed by Oracle, was already merged in [http://kernelnewbies.org/Linux_2_6_16 Linux 2.6.16]. Clustering filesystems allow to share a filesystem between several machines with no compromises. GFS includes his own DLM (distributed locking manager) and a userspace API interface for that DLM.

Like OCFS2 and like any other filesystem that wants to be merged in the linux kernel, GFS2 developers asked for submission long time ago. They were asked to fix things (even considering that GFS2 had already been developed at Sistina and it was already a stable final product), they submitted it again, they were asked to fix more things, and so on, for a long period of time. Their developers have fixed every thing they were asked to fix. Because of their hard work, GFS2 is now ready to be merged, and everyone is happy. And nobody flames the kernel or GFS2 developers. Amazing, isn't?

[http://sources.redhat.com/cluster/ GFS2 project page]; Source code [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/gfs2 for GFS2] (840 KB) and [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/dlm for the DLM] (384 KB)

EXT 4

ECRYPTFS

Coming from IBM, ecryptfs aims to bring "enterprise level" file encryption to the masses.

"Oh no, another filesystem!". No, Ecryptfs is not a traditional filesystem: it doesn't implements his own disk format. From [http://lwn.net/Articles/156921/ this LWN article]:

The eCryptfs developers took the stacking approach, meaning that, rather than implement its own platter-level format, eCryptfs sits on top of another filesystem. It is, essentially, a sort of translation layer which makes encrypted file capabilities available. The system administrator can thus create encrypted filesystems on top of whatever filesystem is in use locally, or even over a network-mounted filesystem. [...] Rather than encrypt the filesystem as a whole, eCryptfs deals with each file individually

(Reading the rest of the [http://lwn.net/Articles/156921 LWN article] is recommended. There's also a [http://www.linuxsymposium.org/2005/linuxsymposium_procv1.pdf Ecryptfs paper from the 2005 Ottawa Symposium] - page 209 and onwards)

Is it better to encrypt the whole disk using cryptoloop/dmcrypt, or use ecryptfs? You decide. Ecryptfs avoids the overhead of a fully encrypted filesystem by only encrypting the files you really want to encrypt, and it also allows to encrypt different files in different ways. Ecryptfs tries to make file encryption available in a easy way for the masses. It "aims to combine the flexibility of GnuPG encryption with the transparency of a kernel service" [...] "Think of eCryptfs as a sort of 'gnupgfs'". If you're interested, you will find the userspace tools and more information available in the [http://ecryptfs.sourceforge.net/ ecryptfs sourceforge site]. You can also read the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/ecryptfs.txt Ecryptfs documentation] and the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=237fead619984cc48818fe12ee0ceada3f55b012 Ecryptfs code] (232 KB).

Libata PATA (Parallel ATA) merge

By "Parallel ATA" we mean all the ATA/IDE controllers and drives that we have been using for years before SATA. Almost from the start, one of the objectives of some kernel hackers was to [http://marc.theaimsgroup.com/?l=linux-kernel&m=115514409104283&w=2 replace the IDE drivers available in drivers/ide] (everything under the "Device drivers -> ATA/ATAPI/MFM/RLL support" configuration menu) with a reimplementation on top of libata (i.e.: the "SATA layer"). Drivers/ide suffers from many ugly and obscure problems, and re-implementing it on top of libata has been much easier than fixing the unfixable drivers/ide mess - most of the porting work has been done by Alan Cox (a consequence of this PATA merge is that libata and all its SATA drivers have also been moved from drivers/scsi (available in the "Device drivers -> SCSI device support -> SCSI low-level drivers" submenu) to drivers/ata (now "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers"), and all the CONFIG_SCSI_FOOBAR options for the individual SATA drivers have been changed to CONFIG_FOOBAR, so this means you may need to reconfigure your SATA configuration options)

This means 2.6.19 may have two drivers for your PATA-base device: The old IDE driver under "Device drivers -> ATA/ATAPI/MFM/RLL support" and an alternative driver under "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers" (along with the rest of the SATA drivers)

What one must you choose? Well, the safe option is using the old driver: The old drivers will continue working just as they did before. There'll be no changes if you continue using the old drivers.

What do the new libata-base PATA drivers offer to you?

First of all, because they're libata-based and libata is a well engineered and sane infrastructure, the drivers have much better quality, they're cleaner, they've much better error handling (much better behaviour when one of your drives dies suddenly or finds broken sectors), and they don't have some of the known design issues that the old drivers have (this is why people did all the work to move away from drivers/ide, they didn't do it just for fun)
Because they're newer, there are more bugs. For this release, they're "experimental". If you want to be safe, use the old drivers.
Really. There is a risk that the new drivers won't work for you, or may harm your data (unlikely, but not impossible). If you want to be safe, use the old drivers.
They support some chipsets not supported by drivers/ide. The cleaner design of libata allows for easier driver development and maintenance. In some cases it supports features that the old driver doesn't, for the same reasons.
Some IDE controllers are not supported or they aren't fully supported. Some of them because not all the IDE drivers have been ported to libata, but others because they're old and undocumented or because the libata PATA layer still doesn't support some of their features. There's no support for certain old serialized devices, for prehistoric CMD640 controllers or for host-protected-area yet.
Drives appear as /dev/sda, /dev/sr0, the old devices names won't work. You will need to change your boot parameters and your /etc/fstab parameters in order to get a working system with the new drivers. Again, this only happens if you use the new drivers, the old drivers continue working as they did before.

Eventually, the new libata-based PATA drivers will get more stable, so the old drivers in drivers/ide may get deleted as the new drivers fulfill all needs of the IDE users and becomes feature-complete. But this certainly won't happen anytime soon. No old drivers will be deleted if there's not a working libata-based replacement. You can read the latest [http://zeniv.linux.org.uk/~alan/IDE/STATUS.txt status report] written by Alan Cox. It'd certainly be useful if you could give it a try and report back how well it works to linux-kernel@vger.kernel.org or bugzilla.kernel.org - even if it works fine, it'll be useful to know what systems do work (be sure to include the necessary information mentioned in the previous status report). [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=drivers/ata (libata PATA code)]

Removal of selected OSS drivers

Since 2.6 was released, ALSA has been the "official" sound subsystem. OSS drivers were kept for compatibility - ALSA also implements a OSS compatibility layer. However, there's a big number of ALSA drivers and OSS drivers targetting exactly the same hardware. Usually, the OSS ones are undermaintained (or no maintained at all). And ALSA already implements OSS compatibility. So....

...it's possible to remove old OSS drivers, as long as there's a equivalent ALSA driver, and as long as that driver has no regressions that don't allow users to migrate (drivers with no ALSA equivalent or with know regressions have NOT been deleted). In 2.6.19, those OSS drivers are being removed. If when migrating users find something wrong in the ALSA drivers, they should report it in the [https://bugtrack.alsa-project.org ALSA bug tracking system] and work with developers to fix them. Yes, we know there're users that feel just fine with the OSS drivers, but it doesn't helps to the kernel to keep those old drivers around. By forcing people to migrate to ALSA drivers, the ALSA drivers will be improved and fixed. Overall, the linux sound subsystem will only get better. Many thanks to all the hackers that coded them.

A total of 1.79 MB of OSS drivers will be removed. To see a list of source files being removed, see [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d56b9b9c464a10ab1ee51a4c6190a2b57b8ef7a6 the commit link]. Hardware that is forced to use ALSA drivers include:

AD1980 AC97 plugin; ALI 5455; Alchemy Au1000 (MIPS); AWE32/SB32/AWE64 WaveTable driver; C-Media; Cirrus Logic-Crystal CS4281; Ensoniq ES1370/Asahi Kasei AK4531; ESS Technology Solo1 (ES1946); ForteMedia FM801; Gravis Ultrasound; ASP's and Lasi's Harmony sound chip; ICS2101 mixer of GUS v3.7; OPTi MAD16 compatible audio chips; ESS Maestro/Maestro-2/Maestro-2E/Maestro3/Allegro; Turtle Beach Maui and Tropez; Yamaha YMF701B aka OPL3-SA; RME9652/36 "Hammerfall" Driver; Aztech Sound Galaxy cards; S3 Sonic Vibes; Turtle Beach WaveFront Series (Maui, Tropez, Tropez Plus); WaveFront ICS2115 MIDI; Yamaha YMF7xx

AVR32 Architecture

2.6.19 adds support for the Atmel AVR32 architecture, implemented and supported by Atmel Corporation.

AVR32 is a new high-performance 32-bit RISC microprocessor core, designed for cost-sensitive embedded applications, with particular emphasis on low power consumption and high code density. The AVR32 architecture description, including the instruction set, can be found in the [http://www.atmel.com/dyn/resources/prod_documents/doc32000.pdf AVR32 Architecture Manual]. The Atmel AT32AP7000 is the first CPU implementing the AVR32 architecture; it features a 7-stage pipeline, 16KB instruction and data caches and a full Memory Management Unit and a large set of integrated peripherals ([http://www.atmel.com/dyn/resources/prod_documents/doc32003.pdf full data sheet]); while the CPU core implementation including caches and MMU is documented by the [http://www.atmel.com/dyn/resources/prod_documents/doc32001.pdf AVR32 AP Technical Reference]. Information about the AT32STK1000 development board can be found [http://www.atmel.com/dyn/products/tools_card.asp?tool_id=3918 here], including a BSP CD image, development tools (binaries and source/patches) and a root filesystem image suitable for booting from SD card. Alternatively, there's a preliminary "getting started" guide available at http://avr32linux.org/twiki/bin/view/Main/GettingStarted which provides links to the sources and patches you will need in order to set up a cross-compiling environment for avr32-linux

Source code can be found [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=arch/avr32 here (arch/av32)]

Other stuff

Architecture-specific changes

x86 32/64

ARM

* [ARM] Add ARM irqtrace support: This adds support for irqtrace for lockdep on ARM.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7ad1bcb25c5623f1f87c50fdf2272f58ff91db5a (commit)]

* [ARM] 3850/1: iop3xx: add thecus n2100 support: Add support for the Thecus n2100 (80219-based.)

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e60d07b6cd38a7afb85f2cf51aebcb3359b63819 (commit)]

* [ARM] 3854/2: S3C2410 - add machine type for AML M5900 series (resubmitted): Add the AML M5900 series to the list of supported machines in the

arch/arm/mach-s3c2410 directory. This ensures the core peripherals are registered, and the timer source is configured. if selected in the kernel config the framebuffer registers and mtd partition information are set. This version of the patch has corrected formatting and removed the legacy procfs directory entry.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=da56c949261d462452a68cf05bfc645445bee830 (commit)]

* [ARM] 3851/1: iop3xx: add io-data glantank support: Add support for the IO-Data GLAN Tank, from Martin Michlmayr.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0c92e830bd39f3e6cf7b151dffecafbdc623496c (commit)]

* [ARM] nommu: add ARM9TDMI core support: This patch adds ARM9TDMI core support which has no cache and no CP15

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=43f5f0146ef5c3a3421ea53a0708fd37edcb8905 (commit)]

* ARM: OMAP: Apollon MMC support: Apollon board MMC supports on OMAP2

TODO:
- We have to check MMC on H4

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=abc45e1d69542281fb2b40968e5d112f51976623 (commit)]

* [ARM] 3863/1: Add Locomo SPI Device: The Locomo chip has a SPI interface which is used for SD/MMC cards (only collie).

This patch adds the definition for the SPI device inside the Locomo chip.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a2025e7f73ae5eab0a25dad88c60aba67e3ae690 (commit)]

* [ARM] nommu: add ARM740T core support: This patch adds ARM740T core support which has a MPU and 4KB or 8KB cache.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b731c3118d87f26c8bf3f358ffbbc24450af50a6 (commit)]

* [ARM] 3862/2: S3C2410 - add basic power management support for AML M5900 series: this patch registers the wakeup irq, sets a gpio pin to indicate the

status of system for suspend/resume operations, and adds the machine to the supported machines for use with the simtec-pm

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=26f908186f923291999833e9d563259834bdca06 (commit)]

* [ARM] nommu: add ARM940T core support: This patch adds ARM940T core support which has 4KB D-cache, 4KB I-cache

and a MPU.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d60674eb5d961b2421db16cc373dc163f38cc105 (commit)]

* ARM: OMAP: OMAP2 dmtimer power management support: GPT1 will be set into non-posted mode, and the wakeup register

is set for all timers.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=39020842b3d8a450e80724a71d5df676535d249e (commit)]

* [ARM] nommu: add ARM7TDMI core support: This patch adds ARM7TDMI core support which has no cache and no CP15

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=07e0da78abdc679714a12e7a60137d950c346681 (commit)]

* [ARM] nommu: add ARM946E-S core support: This patch adds ARM946E-S core support which has typically 8KB I&D cache.

It has a MPU and supports ARMv5TE instruction set. Because the ARM946E-S core can be synthesizable with various cache size, CONFIG_CPU_DCACHE_SIZE is defined for vendor specific configurations.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f37f46eb1c0bd0b11c34ef06c7365658be989d80 (commit)]

SH

* sh: Support for SH7770/SH7780 CPU subtypes.: Merge support for SH7770 and SH7780 SH-4A subtypes.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5b19c9081fbd0882c936ec087bf9055a20251dec (commit)]

* sh: prefetch()/prefetchw() support.: SH-2/3/4 are able to prefetch, add support for it..

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e86d6b66f5b38680746b2cb71186d90af17f150f (commit)]

* sh: Optimized cache handling for SH-4/SH-4A caches.: This reworks some of the SH-4 cache handling code to more easily

accomodate newer-style caches (particularly for the > direct-mapped case), as well as optimizing some of the old code.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b638d0b921dc95229af0dfd09cd24850336a2f75 (commit)]

* sh: Titan board support.: Add support for the titan board.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a09749dd86e9e93de10f12ab4ce4e90815b5650a (commit)]

* sh: earlyprintk= support and cleanups.: Allow multiple early printk consoles via earlyprintk=.

With this change earlyprintk is no longer enabled by default, it must be specified on the kernel command line. Optionally with ,keep to prevent unreg by tty_io.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a80fd21e52cc09ff1e4d36de5781173a5b87b2dc (commit)]

* sh: math-emu support: This implements initial math-emu support, aimed primarily at SH-3.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4b565680d16300acab0ff167e24f0ea289a6bd5d (commit)]

* sh: Add support for R7780RP and R7780MP boards.: This adds support for the Renesas SH7780 development boards,

R7780RP and R7780MP.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5283ecb5ccbdb90d49fce6488d3944bba63a591c (commit)]

* sh: SH-4A Privileged Space Mapping Buffer (PMB) support.: Add support for 32-bit physical addressing through the SH-4A

Privileged Space Mapping Buffer (PMB).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0c7b1df69c62209db19d1279dd882b37c04c5c2f (commit)]

* sh: landisk board support.: This adds support for the I-O DATA Landisk.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=94c0fa520cc169ccf661e9c03b5b95f74d1520b8 (commit)]

* sh: Add support for SH7706/SH7710/SH7343 CPUs.: This adds support for the aforementioned CPU subtypes, and cleans

up some build issues encountered as a result.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e5723e0eeb2dc16629e86d66785024ead9169000 (commit)]

* sh: VoyagerGX cleanups and 8250 UART support.: This adds the VoyagerGX UART to the RTS7751R2D setup

code, and cleans up a few build issues.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ade2b3f6ed199dc4a7a0be53edf20f9399023640 (commit)]

* sh: SH7710VoIPGW board support.: This adds support for the SH7710 VoIP Gateway board.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=91b91d01416afba8d3f230a62b5d2784bd7af94a (commit)]

* sh: pselect6 and ppoll, along with signal trampoline rework.: This implements support for ppoll() and pselect6()..

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9f23e7e94f7083d9705b595cbd6b30972be6fbbb (commit)]

* sh: stack debugging support.: This adds a DEBUG_STACK_USAGE and DEBUG_STACKOVERFLOW for SH.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d153ea88dccf003173315b5d21acabebb897fb4a (commit)]

* sh: Solution Engine SH7343 board support.: This adds support for the SE7343 board.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bc8fb5d0471473f775378d09db712dcb8eeece75 (commit)]

* sh: SHMIN board support.: This adds support for the SHMIN SH7706 board.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=51e22e7a05c1c6f2e38ac7459d3404e32e543b75 (commit)]

* sh: APM/PM support.: This adds some simple PM stubs and the basic APM interfaces,

primarily for use by hp6xx, where the existing userland expects it.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3aa770e7972723f479122cf66b529017d2175289 (commit)]

* sh: Enable /proc/kcore support.: This was previously unimplemented..

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2cb7ce3bb384f30a377f66336c78546b834604df (commit)]

* sh: Add support for 4K stacks.: This enables support for 4K stacks on SH.

Currently this depends on DEBUG_KERNEL, but likely all boards will switch to this as the default in the future.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a6a31139897a5e539efe7ad3b7bd351fa9673ce8 (commit)]

* sh: Initial vsyscall page support.: This implements initial support for the vsyscall page on SH.

At the moment we leave it configurable due to having nommu to support from the same code base. We hook it up for the signal trampoline return at present, with more to be added later, once uClibc catches up.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=19f9a34f87c48bbd270d617d1c986d0c23866a1a (commit)]

Filesystems

OCFS2

Add ext2 attributes - immutable, sync, append, noatime, dirsync - [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ca4d147e62df370c334898464023aa7f9126abe1 (commit)]; implement directory read-ahead [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=aa9588741db907785e4d92c8b768dd6c9077e6f0 (commit)]

CIFS

Legacy time handling for Win9x and OS/2 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1bd5bbcb6531776a8f73e2cc6287fc4dd542e1c7 (commit)]; support deep tree mounts (e.g. mounts to //server/share/path) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2fe87f02a04ad6e7075023a87fe38eb458a4bb9d (commit)]

NFS

Add server and volume lists to /proc [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6aaca566503296a73f956908ec98173946134fe2 (commit)]

SELinux

* [MLSXFRM]: Define new SELinux service routine: This defines a routine that combines the Type Enforcement portion of

one sid with the MLS portion from the other sid to arrive at a new sid. This would be used to define a sid for a security association that is to be negotiated by IKE as well as for determing the sid for open requests and connection-oriented child sockets.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=08554d6b33e60aa8ee40bbef94505941c0eefef2 (commit)]

* [MLSXFRM]: Add security context to acquire messages using PF_KEY: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using PF_KEY. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e2ba18eae7f370c7c3ed96eaca747cc9b39f917 (commit)]

* [MLSXFRM]: Granular IPSec associations for use in MLS environments: The current approach to labeling Security Associations for SELinux

purposes uses a one-to-one mapping between xfrm policy rules and security associations. This doesn't address the needs of real world MLS (Multi-level System,
traditional Bell-LaPadula) environments where a single xfrm policy rule (pertaining to a range, classified to secret for example) might need to map to multiple Security Associations (one each for classified, secret, top secret and all the compartments applicable to these security levels). This patch set addresses the above problem by allowing for the mapping of a single xfrm policy rule to multiple security associations, with each association used in the security context it is defined for. It also includes the security context to be used in IKE negotiation in the acquire messages sent to the IKE daemon so that a unique SA can be negotiated for each unique security context. A couple of bug fixes are also included; checks to make sure the SAs used by a packet match policy (security context-wise) on the inbound and also that the bundle used for the outbound matches the security context of the flow. This patch set also makes the use of the SELinux sid in flow cache lookups seemless by including the sid in the flow key itself. Also, open requests as well as connection-oriented child sockets are labeled automatically to be at the same level as the peer to allow for use of appropriately labeled IPSec associations. Description of changes: A "sid" member has been added to the flow cache key resulting in the sid being available at all needed locations and the flow cache lookups automatically using the sid. The flow sid is derived from the socket on the outbound and the SAs (unlabeled where an SA was not used) on the inbound. Outbound case:
Find policy for the socket.
OLD: Find an SA that matches the policy.
- NEW: Find an SA that matches BOTH the policy and the flow/socket.
  - This is necessary since not every SA that matches the policy can be used for the flow/socket. Consider policy range Secret-TS, and SAs each for Secret and TS. We don't want a TS socket to use the Secret SA. Hence the additional check for the SA Vs. flow/socket.
NEW: When looking thru bundles for a policy, make sure the
- flow/socket can use the bundle. If a bundle is not found, create one, calling for IKE if necessary. If using IKE, include the security context in the acquire message to the IKE daemon.
Inbound case:
OLD: Find policy for the socket.
- NEW: Find policy for the incoming packet based on the sid of the
  - SA(s) it used or the unlabeled sid if no SAs were used. (Consider a case where a socket is "authorized" for two policies (unclassified-confidential, secret-top_secret). If the packet has come in using a secret SA, we really ought to be using the latter policy (secret-top_secret).)
OLD: BUG: No check to see if the SAs used by the packet agree with
- the policy sec_ctx-wise. (It was indicated in selinux_xfrm_sock_rcv_skb() that
  - this was being accomplished by
    (x->id.spi == tmpl->id.spi || !tmpl->id.spi) in xfrm_state_ok,
- but it turns out tmpl->id.spi
  - would normally be zero (unless xfrm policy rules specify one at the template level, which they usually don't).
- NEW: The socket is checked for access to the SAs used (based on the
  - sid of the SAs) in selinux_xfrm_sock_rcv_skb().
Forward case:
- This would be Step 1 from the Inbound case, followed by Steps 2 and 3
from the Outbound case. Outstanding items/issues: - Timewait acknowledgements and such are generated in the
- current/upstream implementation using a NULL socket resulting in the any_socket sid (SYSTEM_HIGH) to be used. This problem is not addressed by this patch set.
This patch: Add new flask definitions to SELinux Adds a new avperm "polmatch" to arbitrate flow/state access to a xfrm policy rule.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=51bd39860ff829475aef611a3234309e37e090d9 (commit)]

* [MLSXFRM]: Add security sid to flowi: This adds security to flow key for labeling of flows as also to allow

for making flow cache lookups based on the security label seemless.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b6340fcd761acf9249b3acbc95c4dc555d9beb07 (commit)]

* [MLSXFRM]: Auto-labeling of child sockets: This automatically labels the TCP, Unix stream, and dccp child sockets

as well as openreqs to be at the same MLS level as the peer. This will result in the selection of appropriately labeled IPSec Security Associations. This also uses the sock's sid (as opposed to the isec sid) in SELinux enforcement of secmark in rcv_skb and postroute_last hooks.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf (commit)]

* [MLSXFRM]: Add flow labeling: This labels the flows that could utilize IPSec xfrms at the points the

flows are defined so that IPSec policy and SAs at the right label can be used. The following protos are currently not handled, but they should continue to be able to use single-labeled IPSec like they currently do. ipmr ip_gre ipip igmp sit sctp ip6_tunnel (IPv6 over IPv6 tunnel device) decnet

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=beb8d13bed80f8388f1a9a107d07ddd342e627e8 (commit)]

* [MLSXFRM]: Flow based matching of xfrm policy and state: This implements a seemless mechanism for xfrm policy selection and

state matching based on the flow sid. This also includes the necessary SELinux enforcement pieces.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e0d1caa7b0d5f02e4f34aa09c695d04251310c6c (commit)]

* [MLSXFRM]: Add security context to acquire messages using netlink: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using netlink/xfrm_user. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d681623d30c6565e8b62889f3aa3f4d4662c3e8 (commit)]

* [MLSXFRM]: Add security sid to sock: This adds security for IP sockets at the sock level. Security at the

sock level is needed to enforce the SELinux security policy for security associations even when a sock is orphaned (such as in the TCP LAST_ACK state). This will also be used to enforce SELinux controls over data arriving at or leaving a child socket while it's still waiting to be accepted.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=892c141e62982272b9c738b5520ad0e5e1ad7b42 (commit)]

* [MLSXFRM]: Default labeling of socket specific IPSec policies: This defaults the label of socket-specific IPSec policies to be the

same as the socket they are set on.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb969f072b6d67770b559617f14e767f47e77ece (commit)]

* [MLSXFRM]: Fix build with SECURITY_NETWORK_XFRM disabled.: The following patch will fix the build problem (encountered by Andrew

Morton) when SECURITY_NETWORK_XFRM is not enabled. As compared to git-net-selinux_xfrm_decode_session-build-fix.patch in -mm, this patch sets the return parameter sid to SECSID_NULL in selinux_xfrm_decode_session() and handles this value in the caller selinux_inet_conn_request() appropriately.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a51c64f1e5c2876eab2a32955acd9e8015c91c15 (commit)]

Networking

* [IPV4]: Use Protocol Independant Policy Routing Rules Framework: [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e1ef4bf23b1ced0bf78a1c98289f746486e5c912 (commit)]

* [NetLabel]: core network changes: Changes to the core network stack to support the NetLabel subsystem. This

includes changes to the IPv4 option handling to support CIPSO labels.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=11a03f78fbf15a866ba3bf6359a75cdfd1ced703 (commit)] * [NetLabel]: core NetLabel subsystem: Add a new kernel subsystem, NetLabel, to provide explicit packet

labeling services (CIPSO, RIPSO, etc.) to LSM developers. NetLabel is designed to work in conjunction with a LSM to intercept and decode security labels on incoming network packets as well as ensure that outgoing network packets are labeled according to the security mechanism employed by the LSM. The NetLabel subsystem is configured through a Generic NETLINK interface described in the header files included in this patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d15c345fe3b8dfda0fa5a1d2143a35fffa746a43 (commit)]

* [NetLabel]: documentation: Documentation for the NetLabel system, this includes a basic overview

of how NetLabel works, how LSM developers can integrate it into their favorite LSM, as well as documentation on the CIPSO related sysctl variables. Also, due to the difficulty of finding expired IETF drafts, I am including the IETF CIPSO draft that is the basis of the NetLabel CIPSO implementation.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8802f616f6de8576805f32e47602816f141118f2 (commit)]

* [NetLabel]: SELinux support: Add NetLabel support to the SELinux LSM and modify the

socket_post_create() LSM hook to return an error code. The most
significant part of this patch is the addition of NetLabel hooks into the following SELinux LSM hooks:
- selinux_file_permission()
- selinux_socket_sendmsg()
- selinux_socket_post_create()
- selinux_socket_sock_rcv_skb()
- selinux_socket_getpeersec_stream()
- selinux_socket_getpeersec_dgram()
- selinux_sock_graft()
- selinux_inet_conn_request()
The basic reasoning behind this patch is that outgoing packets are
"NetLabel'd" by labeling their socket and the NetLabel security attributes are checked via the additional hook in selinux_socket_sock_rcv_skb(). NetLabel itself is only a labeling mechanism, similar to filesystem extended attributes, it is up to the SELinux enforcement mechanism to perform the actual access checks. In addition to the changes outlined above this patch also includes some changes to the extended bitmap (ebitmap) and multi-level security (mls) code to import and export SELinux TE/MLS attributes into and out
of NetLabel.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7420ed23a4f77480b5b7b3245e5da30dd24b7575 (commit)]

* [NetLabel]: tie NetLabel into the Kconfig system: Modify the net/Kconfig file to enable selecting the NetLabel Kconfig

options.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8161327311fe4da1684ed08015e141feb9a0a737 (commit)]

* [NetLabel]: CIPSOv4 engine: Add support for the Commercial IP Security Option (CIPSO) to the IPv4

network stack. CIPSO has become a de-facto standard for trusted/labeled networking amongst existing Trusted Operating Systems such as Trusted Solaris, HP-UX CMW, etc. This implementation is
designed to be used with the NetLabel subsystem to provide explicit packet labeling to LSM developers.
The CIPSO/IPv4 packet labeling works by the LSM calling a NetLabel API function which attaches a CIPSO label (IPv4 option) to a given socket; this in turn attaches the CIPSO label to every packet leaving the socket without any extra processing on the outbound side. On the inbound side the individual packet's sk_buff is examined through a call to a NetLabel API function to determine if a CIPSO/IPv4 label is present and if so the security attributes of the CIPSO label are returned to the caller of the NetLabel API function.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=446fda4f26822b2d42ab3396aafcedf38a9ff2b6 (commit)]

* [NET]: Replace CHECKSUM_HW by CHECKSUM_PARTIAL/CHECKSUM_COMPLETE: Replace CHECKSUM_HW by CHECKSUM_PARTIAL (for outgoing packets, whose

checksum still needs to be completed) and CHECKSUM_COMPLETE (for incoming packets, device supplied full checksum). Patch originally from Herbert Xu, updated by myself for 2.6.18-rc3.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=84fa7933a33f806bbbaae6775e87459b1ec584c0 (commit)]

* Add the framework to support multiple IPv6 routing tables [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c71099acce933455123ee505cc75964610a209ad (commit)]

* [NETFILTER]: Get rid of HW checksum invalidation: Update hardware checksums incrementally to avoid breaking GSO.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cf411de49c65140b3c259748629b561c0d3340f (commit)]

* Extend netlink messaging interface [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fe4944e59c357f945f81bc67edb7ed1392e875ad (commit)]

* Protocol Independant Policy Routing Rules Framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=14c0b97ddfc2944982d078b8e33b088840068976 (commit)]

* [NetLabel]: CIPSOv4 and Unlabeled packet integration: Add CIPSO/IPv4 and unlabeled packet management to the NetLabel

subsystem. The CIPSO/IPv4 changes allow the configuration of
CIPSO/IPv4 within the overall NetLabel framework. The unlabeled packet changes allows NetLabel to pass unlabeled packets without error.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96cb8e3313c7a12e026c1ed510522ae6f6023875 (commit)]

* [IPV6]: Policy Routing Rules: Adds support for policy routing rules including a new

local table for routes with a local destination.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=101367c2f8c464ea96643192673aa18d88e6336d (commit)]

* [NET]: Round out in-kernel sockets API: This patch implements wrapper functions that provide a convenient way

to access the sockets API for in-kernel users like sunrpc, cifs & ocfs2 etc and any future users.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ac5a488ef252ed673cb067843e411f8cc43f7ab9 (commit)]

* [IPV6]: Increase number of possible routing tables to 2^{32: Increase number of possible routing tables to 2}32 by replacing iterations

over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1b43af5480c351dbcb2eef478bafe179cbeb6e83 (commit)]

* [XFRM] STATE: Introduce route optimization mode.: Route optimization is used with routing header and destination options

header for Mobile IPv6. At outbound it makes header space like IPsec transport. At inbound it does nothing because exhdrs.c functions have responsibility to update skbuff information for these headers.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d71627d699eca831c1fbfb66ea67bb1fba41415 (commit)]

* [IPV4]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1af5a8c4a11cfed0c9a7f30fcfb689981750599c (commit)]

* [DECNET]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=abcab268303c22d24fc89fedd35d82271d20f5da (commit)]

* replace IPv4 dscp match by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ba1627617d396135a4d679542a3623d5819e628 (commit)]

* replace IPv4 DSCP target by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a468701db58a8b3e08e3f55fa6ac66db42014922 (commit)]

* [XFRM] POLICY: Add Kconfig to support sub policy.: Add Kconfig to support sub policy.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c11f1a15c522ddd3bbd2c32b5ce3e0b1831b22f2 (commit)]

* [DCCP]: Introduce tx buffering [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97e5848dd39e7e76bd6077735ebb5473763ab9c5 (commit)]

* [XFRM] POLICY: sub policy support.: Sub policy is introduced. Main and sub policy are applied the same flow.

(Policy that current kernel uses is named as main.) It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate. Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6. (Such usage as two IPsec policies on different database can be used, too.) Limitation or TODOs:
- - Sub policy is not supported for per socket one (it is always inserted as main). - Current kernel makes cached outbound with flowi to skip searching database.
  - However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e81bb8336a0ac50289d4d4c7a55e559b994ee8f (commit)]

* [IPV6] NDISC: Add proxy_ndp sysctl.: We do not always need proxy NDP functionality even we

enable forwarding.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fbea49e1e2404baa2d88ab47e2db89e49551b53b (commit)]

* [IPV6]: Add Kconfig to enable Mobile IPv6.: Add Kconfig to enable Mobile IPv6.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee53826801a8fa7a0e333895421ef6d0e5fbfbf0 (commit)]

* [IPV6] ADDRCONF: Mobile IPv6 Home Address support.: IFA_F_HOMEADDRESS is introduced for Mobile IPv6 Home Addresses on

Mobile Node. The IFA_F_HOMEADDRESS flag should be set for Mobile IPv6 Home Addresses for 2 purposes. 1) We need to check this on receipt of Type 2 Routing Header (RFC3775 Secion 6.4), 2) We prefer Home Address(es) in source address selection (RFC3484 Section 5 Rule 4).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3b9f9a1c3903b64c38505f9fed3bb11e48dbc931 (commit)]

* [IPV6] KCONFIG: Add subtrees support.: This is for developers only.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e96c2b4180aff4f080b77314712073c6ca430e7 (commit)]

Crypto

Add cryptomgr, a "cryptographic algorithm manager" [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b8c19dbdc692e81243a328725a02efb77b144a5 (commit)]
Add block cipher type. Unlike current cipher algorithms which operate on a single block at a time, block ciphers operate on an arbitrarily long linear area of data. As it is block-based, it will skip any data remaining at the end which cannot form a block [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5cde0af2a9825dd1edaca233bd9590566579ef21 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5c64097aa0f6dc4f27718ef47ca9a12538d62860 (commit)]. Also switch some cipher users to use block type [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db131ef9084110d9e82549c0a627e157e8bb99d7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cba83564d112e4aec52227f68670f8dbd4d4ac89 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=69affe7fc52c14e4b81408a2076e9e58ba4af60a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d1806f6a97a536b043fe50e6d8a25b061755cf50 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f12cc2090d721647c23dfce20834f4306db3b77d (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=28ce728a90cce3a0c6c0ed00354299de52db94b1 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=378c6697a282c383d89428380a3405bf95189347 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6b7326c8497f954c2cfcb4c49fe42be5b80887bc (commit)]
Support for SHA1 / SHA256 algorithms in VIA C7 processors [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6c833275152b454d311f0e70b5e6bf028b4a2aaf (commit)], add twofish x86-64 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eaf44088ff467410dd15a033fef118888002ffe6 (commit)] and a i586 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9f535ffe38f7eb61ac2219d32d97c377b69f70d (commit)]

CPUFREQ

* add powersave_bias tunable. ondemand selects the minimum frequency that can retire a workload with negligible idle time -- ideally resulting in the highest performance/power efficiency with negligible performance impact. But on some systems and some workloads, this algorithm is more performance biased than necessary, and de-tuning it a bit to allow some performance impact can save measurable power. This patch adds a "powersave_bias" tunable to ondemand to allow it to reduce its target frequency by a specified percent. By default, the powersave_bias is 0 and has no effect. powersave_bias is in units of 0.1%, so it has an effective range of 1 through 1000, resulting in 0.1% to 100% impact. In practice, users will not be able to detect a difference between 0.1% increments, but 1.0% increments turned out to be too large. Also, the max value of 1000 (100%) would simply peg the system in its deepest power saving P-state, unless the processor really has a hardware P-state at 0Hz:-)

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05ca0350e8caa91a5ec9961c585c98005b6934ea (commit)]

* Longhaul - Disable arbiter [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=179da8e6e8903a8cdb19bb12672d50dc33f0fde6 (commit)], add voltage scaling to driver [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db44aaf3a2f599163c53ce96658aca688b3466f0 (commit)] * Longhaul - Add ignore_latency option [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6595413fc9453a211f4b5d5cc42f0bbf3daa615b (commit)]