Linux_2_6_19 - Linux Kernel Newbies

Important things (AKA: ''the cool stuff'')

GFS2

GFS2 is a clustering filesystem developed mainly by Red Hat (after [http://www.theregister.co.uk/2003/12/18/red_hat_sweetens_q3/ purchasing Sistina] and opening the source code). It's not the first: OCFS2, another clustering filesystem developed by Oracle, was already merged in [http://kernelnewbies.org/Linux_2_6_16 Linux 2.6.16]. Clustering filesystems allow to share a filesystem between several machines with no compromises. GFS includes his own DLM (distributed locking manager) and a userspace API interface for that DLM.

Like OCFS2 and like any other filesystem that wants to be merged in the linux kernel, GFS2 developers asked for submission long time ago. They were asked to fix things (even considering that GFS2 had already been developed at Sistina and it was already a stable final product), they submitted it again, they were asked to fix more things, and so on, for a long period of time. Their developers have fixed every thing they were asked to fix. Because of their hard work, GFS2 is now ready to be merged, and everyone is happy. And nobody flames the kernel or GFS2 developers. Amazing, isn't?

[http://sources.redhat.com/cluster/ GFS2 project page]; Source code [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/gfs2 for GFS2] (840 KB) and [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/dlm for the DLM] (384 KB)

EXT 4

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/jbd2 JBD2], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/ext4 EXT 4]

ECRYPTFS

Coming from IBM, ecryptfs aims to bring "enterprise level" file encryption to the masses.

"Oh no, another filesystem!". No, Ecryptfs is not a traditional filesystem: it doesn't implements his own disk format. From [http://lwn.net/Articles/156921/ this LWN article]:

The eCryptfs developers took the stacking approach, meaning that, rather than implement its own platter-level format, eCryptfs sits on top of another filesystem. It is, essentially, a sort of translation layer which makes encrypted file capabilities available. The system administrator can thus create encrypted filesystems on top of whatever filesystem is in use locally, or even over a network-mounted filesystem. [...] Rather than encrypt the filesystem as a whole, eCryptfs deals with each file individually

(Reading the rest of the [http://lwn.net/Articles/156921 LWN article] is recommended. There's also a [http://www.linuxsymposium.org/2005/linuxsymposium_procv1.pdf Ecryptfs paper from the 2005 Ottawa Symposium] - page 209 and onwards)

Is it better to encrypt the whole disk using cryptoloop/dmcrypt, or use ecryptfs? You decide. Ecryptfs avoids the overhead of a fully encrypted filesystem by only encrypting the files you really want to encrypt, and it also allows to encrypt different files in different ways. Ecryptfs tries to make file encryption available in a easy way for the masses. It "aims to combine the flexibility of GnuPG encryption with the transparency of a kernel service" [...] "Think of eCryptfs as a sort of 'gnupgfs'". If you're interested, you will find the userspace tools and more information available in the [http://ecryptfs.sourceforge.net/ ecryptfs sourceforge site]. You can also read the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/ecryptfs.txt Ecryptfs documentation] and the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=237fead619984cc48818fe12ee0ceada3f55b012 Ecryptfs code] (232 KB).

Libata PATA (Parallel ATA) merge

By "Parallel ATA" we mean all the ATA/IDE controllers and drives that we have been using for years before SATA. Almost from the start, one of the objectives of some kernel hackers was to [http://marc.theaimsgroup.com/?l=linux-kernel&m=115514409104283&w=2 replace the IDE drivers available in drivers/ide] (everything under the "Device drivers -> ATA/ATAPI/MFM/RLL support" configuration menu) with a reimplementation on top of libata (i.e.: the "SATA layer"). Drivers/ide suffers from many ugly and obscure problems, and re-implementing it on top of libata has been much easier than fixing the unfixable drivers/ide mess - most of the porting work has been done by Alan Cox (a consequence of this PATA merge is that libata and all its SATA drivers have also been moved from drivers/scsi (available in the "Device drivers -> SCSI device support -> SCSI low-level drivers" submenu) to drivers/ata (now "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers"), and all the CONFIG_SCSI_FOOBAR options for the individual SATA drivers have been changed to CONFIG_FOOBAR, so this means you may need to reconfigure your SATA configuration options)

This means 2.6.19 may have two drivers for your PATA-base device: The old IDE driver under "Device drivers -> ATA/ATAPI/MFM/RLL support" and an alternative driver under "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers" (along with the rest of the SATA drivers)

What one must you choose? Well, the safe option is using the old driver: The old drivers will continue working just as they did before. There'll be no changes if you continue using the old drivers.

What do the new libata-base PATA drivers offer to you?

First of all, because they're libata-based and libata is a well engineered and sane infrastructure, the drivers have much better quality, they're cleaner, they've much better error handling (much better behaviour when one of your drives dies suddenly or finds broken sectors), and they don't have some of the known design issues that the old drivers have (this is why people did all the work to move away from drivers/ide, they didn't do it just for fun)
Because they're newer, there are more bugs. For this release, they're "experimental". If you want to be safe, use the old drivers.
Really. There is a risk that the new drivers won't work for you, or may harm your data (unlikely, but not impossible). If you want to be safe, use the old drivers.
They support some chipsets not supported by drivers/ide. The cleaner design of libata allows for easier driver development and maintenance. In some cases it supports features that the old driver doesn't, for the same reasons.
Some IDE controllers are not supported or they aren't fully supported. Some of them because not all the IDE drivers have been ported to libata, but others because they're old and undocumented or because the libata PATA layer still doesn't support some of their features. There's no support for certain old serialized devices, for prehistoric CMD640 controllers or for host-protected-area yet.
Drives appear as /dev/sda, /dev/sr0, the old devices names won't work. You will need to change your boot parameters and your /etc/fstab parameters in order to get a working system with the new drivers. Again, this only happens if you use the new drivers, the old drivers continue working as they did before.

Eventually, the new libata-based PATA drivers will get more stable, so the old drivers in drivers/ide may get deleted as the new drivers fulfill all needs of the IDE users and becomes feature-complete. But this certainly won't happen anytime soon. No old drivers will be deleted if there's not a working libata-based replacement. You can read the latest [http://zeniv.linux.org.uk/~alan/IDE/STATUS.txt status report] written by Alan Cox. It'd certainly be useful if you could give it a try and report back how well it works to linux-kernel@vger.kernel.org or bugzilla.kernel.org - even if it works fine, it'll be useful to know what systems do work (be sure to include the necessary information mentioned in the previous status report). [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=drivers/ata (libata PATA code)]

Removal of selected OSS drivers

Since 2.6 was released, ALSA has been the "official" sound subsystem. OSS drivers were kept for compatibility - ALSA also implements a OSS compatibility layer. However, there's a big number of ALSA drivers and OSS drivers targetting exactly the same hardware. Usually, the OSS ones are undermaintained (or no maintained at all). And ALSA already implements OSS compatibility. So....

...it's possible to remove old OSS drivers, as long as there's a equivalent ALSA driver, and as long as that driver has no regressions that don't allow users to migrate (drivers with no ALSA equivalent or with know regressions have NOT been deleted). In 2.6.19, those OSS drivers are being removed. If when migrating users find something wrong in the ALSA drivers, they should report it in the [https://bugtrack.alsa-project.org ALSA bug tracking system] and work with developers to fix them. Yes, we know there're users that feel just fine with the OSS drivers, but it doesn't helps to the kernel to keep those old drivers around. By forcing people to migrate to ALSA drivers, the ALSA drivers will be improved and fixed. Overall, the linux sound subsystem will only get better. Many thanks to all the hackers that coded them.

A total of 1.79 MB of OSS drivers will be removed. To see a list of source files being removed, see [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d56b9b9c464a10ab1ee51a4c6190a2b57b8ef7a6 the commit link]. Hardware that is forced to use ALSA drivers include:

AD1980 AC97 plugin; ALI 5455; Alchemy Au1000 (MIPS); AWE32/SB32/AWE64 WaveTable driver; C-Media; Cirrus Logic-Crystal CS4281; Ensoniq ES1370/Asahi Kasei AK4531; ESS Technology Solo1 (ES1946); ForteMedia FM801; Gravis Ultrasound; ASP's and Lasi's Harmony sound chip; ICS2101 mixer of GUS v3.7; OPTi MAD16 compatible audio chips; ESS Maestro/Maestro-2/Maestro-2E/Maestro3/Allegro; Turtle Beach Maui and Tropez; Yamaha YMF701B aka OPL3-SA; RME9652/36 "Hammerfall" Driver; Aztech Sound Galaxy cards; S3 Sonic Vibes; Turtle Beach WaveFront Series (Maui, Tropez, Tropez Plus); WaveFront ICS2115 MIDI; Yamaha YMF7xx

AVR32 Architecture

2.6.19 adds support for the Atmel AVR32 architecture, implemented and supported by Atmel Corporation.

AVR32 is a new high-performance 32-bit RISC microprocessor core, designed for cost-sensitive embedded applications, with particular emphasis on low power consumption and high code density. The AVR32 architecture description, including the instruction set, can be found in the [http://www.atmel.com/dyn/resources/prod_documents/doc32000.pdf AVR32 Architecture Manual]. The Atmel AT32AP7000 is the first CPU implementing the AVR32 architecture; it features a 7-stage pipeline, 16KB instruction and data caches and a full Memory Management Unit and a large set of integrated peripherals ([http://www.atmel.com/dyn/resources/prod_documents/doc32003.pdf full data sheet]); while the CPU core implementation including caches and MMU is documented by the [http://www.atmel.com/dyn/resources/prod_documents/doc32001.pdf AVR32 AP Technical Reference]. Information about the AT32STK1000 development board can be found [http://www.atmel.com/dyn/products/tools_card.asp?tool_id=3918 here], including a BSP CD image, development tools (binaries and source/patches) and a root filesystem image suitable for booting from SD card. Alternatively, there's a preliminary "getting started" guide available at http://avr32linux.org/twiki/bin/view/Main/GettingStarted which provides links to the sources and patches you will need in order to set up a cross-compiling environment for avr32-linux

Source code can be found [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=arch/avr32 here (arch/av32)]

Other stuff

Architecture-specific changes

x86 32/64

* Add SMP support on x86_64 to reservation framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f2802e7f571c05f9a901b1f5bd144aa730ccc88e (commit)]

* Add SMP support on i386 to reservation framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b7471c6da94d30d3deadc55986cc38d1ff57f9ca (commit)]

* x86: Add abilty to enable/disable nmi watchdog with sysctl (/proc/sys/kernel/nmi) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=407984f1af259b31957c7c05075a454a751bb801 (commit)]

* i386: Utilize performance counter reservation framework in oprofile [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb9c448c661d40ce2efbce8e9c19cc4d420d8ccc (commit)]

* x86: Add abilty to enable/disable nmi watchdog from procfs (/proc/sys/kernel/nmi_watchdog) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e33e89ab1a8d295de0500b697f4f31c3ceee9aa2 (commit)]

* [PATCH] x86: Add performance counter reservation framework for UP kernels [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=828f0afda123a96ff4e8078f057a302f4b4232ae (commit)]

* [PATCH] Add the vgetcpu vsyscall: This patch adds a vgetcpu vsyscall, which depending on the CPU RDTSCP capability uses either the RDTSCP or CPUID to obtain a CPU and node numbers and pass them to the program [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c08c820508233b424deab3302bc404bbecc6493a (commit)]

* [PATCH] x86: Allow users to force a panic on NMI [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8da5adda91df3d2fcc5300e68da491694c9af019 (commit)]

* [PATCH] x86: Add portable getcpu call [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3cfc348bf90ffaa777c188652aa297f04eb94de8 (commit)]

* [PATCH] i386: Support physical cpu hotplug for x86_64 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=73fea175303926055440c06bc8894f0c5c58afc8 (commit)]

* [PATCH] i386: Enable NMI watchdog by default for systems newer than 2004 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1de84979dfc527c422abf63f27beabe43892989b (commit)]

* [PATCH] hot-add-mem x86_64: memory_add_physaddr_to_nid enable: The api for hot-add memory already has a construct for finding nodes based on

an address, memory_add_physaddr_to_nid. This patch allows the fucntion to do something besides return 0. It uses the nodes_add infomation to lookup to node info for a hot add event.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4942e998b40b8f6080930ec16442444e9930aee5 (commit)]

* [PATCH] hot-add-mem x86_64: memory_add_physaddr_to_nid node fixup: In cases where the acpi memory-add event does not containe the pxm (node)

infomation allow the driver to look up node info based on the address. The acpi_get_node call returns -1 if it can't decode the pxm info, this causes add_memory to panic. acpi_get_node would have to decode the resource from the handle (a lenghty proposition). This seems to be the cleanist point to interject the hook.
[kamezawa.hiroyu@jp.fujitsu.com: build fixes] [y-goto@jp.fujitsu.com: build fixes]
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8c2676a5870ab15cbeea9f826266bc946fe3cc26 (commit)]

* [PATCH] hot-add-mem x86_64: Kconfig changes: Create Kconfig namespace for MEMORY_HOTPLUG_RESERVE and MEMORY_HOTPLUG_SPARSE.

This is needed to create a disticiton between the 2 paths. Selecting the

high level opiton of MEMORY_HOTPLUG will get you MEMORY_HOTPLUG_SPARSE if you have sparsemem enabled or MEMORY_HOTPLUG_RESERVE if you are x86_64 with discontig and ACPI numa support.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec69acbb1191df671ff8e07c8e146619a5c53f70 (commit)]

* [PATCH] hot-add-mem x86_64: use CONFIG_MEMORY_HOTPLUG_SPARSE: Migate CONFIG_MEMORY_HOTPLUG to CONFIG_MEMORY_HOTPLUG_SPARSE where needed.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=53947027ad90542ddb2bb746e3175827c270610a (commit)]

* [PATCH] hot-add-mem x86_64: fixup externs: Fix up externs in memory_hotplug.c. Cleanup.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f28c5edc06ecd8068b38b7662ad19f4d20d741af (commit)]

* [PATCH] hot-add-mem x86_64: Enable SPARSEMEM in srat.c: Enable x86_64 srat.c to share code between both reserve and sparsemem based

add memory paths. Both paths need the hot-add area node locality infomration (nodes_add). This code refactors the code path to allow this.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=71efa8fdc55e70ec6687c897a30759f0a2c2ad7e (commit)]

* [PATCH] hot-add-mem x86_64: use CONFIG_MEMORY_HOTPLUG_RESERVE: The api for hot-add memory already has a construct for finding nodes based on

an address, memory_add_physaddr_to_nid. This patch allows the fucntion to do something besides return 0. It uses the nodes_add infomation to lookup to node info for a hot add event.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=45e0b78b0532f92c01e363dd4287617c5be4574f (commit)]

* [PATCH] convert i386 NUMA KVA space to bootmem [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=91023300057e96de7f46e95166a3e02394ae72f9 (commit)]

* [PATCH] x86: enable VMSPLIT for highmem kernels [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=753b9f86e7aef76c2beda32668ce528f90cb1733 (commit)] * [PATCH] x86: add a bootparameter to reserve high linear address space: Add a boot parameter to reserve high linear address space for hypervisors.

This is necessary to allow dynamically loaded hypervisor modules, which might not happen until userspace is already running, and also provides a useful tool to benchmark the performance impact of reduced lowmem address space.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=461a9afff5e731d6337c0f5b08a1e727ccd57e0a (commit)]

Filesystems

OCFS2

Add ext2 attributes - immutable, sync, append, noatime, dirsync - [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ca4d147e62df370c334898464023aa7f9126abe1 (commit)]; implement directory read-ahead [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=aa9588741db907785e4d92c8b768dd6c9077e6f0 (commit)]

CIFS

Legacy time handling for Win9x and OS/2 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1bd5bbcb6531776a8f73e2cc6287fc4dd542e1c7 (commit)]; support deep tree mounts (e.g. mounts to //server/share/path) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2fe87f02a04ad6e7075023a87fe38eb458a4bb9d (commit)]

NFS

Add server and volume lists to /proc [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6aaca566503296a73f956908ec98173946134fe2 (commit)]

SELinux

* [MLSXFRM]: Define new SELinux service routine: This defines a routine that combines the Type Enforcement portion of

one sid with the MLS portion from the other sid to arrive at a new sid. This would be used to define a sid for a security association that is to be negotiated by IKE as well as for determing the sid for open requests and connection-oriented child sockets.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=08554d6b33e60aa8ee40bbef94505941c0eefef2 (commit)]

* [MLSXFRM]: Add security context to acquire messages using PF_KEY: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using PF_KEY. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e2ba18eae7f370c7c3ed96eaca747cc9b39f917 (commit)]

* [MLSXFRM]: Granular IPSec associations for use in MLS environments: The current approach to labeling Security Associations for SELinux

purposes uses a one-to-one mapping between xfrm policy rules and security associations. This doesn't address the needs of real world MLS (Multi-level System,
traditional Bell-LaPadula) environments where a single xfrm policy rule (pertaining to a range, classified to secret for example) might need to map to multiple Security Associations (one each for classified, secret, top secret and all the compartments applicable to these security levels). This patch set addresses the above problem by allowing for the mapping of a single xfrm policy rule to multiple security associations, with each association used in the security context it is defined for. It also includes the security context to be used in IKE negotiation in the acquire messages sent to the IKE daemon so that a unique SA can be negotiated for each unique security context. A couple of bug fixes are also included; checks to make sure the SAs used by a packet match policy (security context-wise) on the inbound and also that the bundle used for the outbound matches the security context of the flow. This patch set also makes the use of the SELinux sid in flow cache lookups seemless by including the sid in the flow key itself. Also, open requests as well as connection-oriented child sockets are labeled automatically to be at the same level as the peer to allow for use of appropriately labeled IPSec associations. Description of changes: A "sid" member has been added to the flow cache key resulting in the sid being available at all needed locations and the flow cache lookups automatically using the sid. The flow sid is derived from the socket on the outbound and the SAs (unlabeled where an SA was not used) on the inbound. Outbound case:
Find policy for the socket.
OLD: Find an SA that matches the policy.
- NEW: Find an SA that matches BOTH the policy and the flow/socket.
  - This is necessary since not every SA that matches the policy can be used for the flow/socket. Consider policy range Secret-TS, and SAs each for Secret and TS. We don't want a TS socket to use the Secret SA. Hence the additional check for the SA Vs. flow/socket.
NEW: When looking thru bundles for a policy, make sure the
- flow/socket can use the bundle. If a bundle is not found, create one, calling for IKE if necessary. If using IKE, include the security context in the acquire message to the IKE daemon.
Inbound case:
OLD: Find policy for the socket.
- NEW: Find policy for the incoming packet based on the sid of the
  - SA(s) it used or the unlabeled sid if no SAs were used. (Consider a case where a socket is "authorized" for two policies (unclassified-confidential, secret-top_secret). If the packet has come in using a secret SA, we really ought to be using the latter policy (secret-top_secret).)
OLD: BUG: No check to see if the SAs used by the packet agree with
- the policy sec_ctx-wise. (It was indicated in selinux_xfrm_sock_rcv_skb() that
  - this was being accomplished by
    (x->id.spi == tmpl->id.spi || !tmpl->id.spi) in xfrm_state_ok,
- but it turns out tmpl->id.spi
  - would normally be zero (unless xfrm policy rules specify one at the template level, which they usually don't).
- NEW: The socket is checked for access to the SAs used (based on the
  - sid of the SAs) in selinux_xfrm_sock_rcv_skb().
Forward case:
- This would be Step 1 from the Inbound case, followed by Steps 2 and 3
from the Outbound case. Outstanding items/issues: - Timewait acknowledgements and such are generated in the
- current/upstream implementation using a NULL socket resulting in the any_socket sid (SYSTEM_HIGH) to be used. This problem is not addressed by this patch set.
This patch: Add new flask definitions to SELinux Adds a new avperm "polmatch" to arbitrate flow/state access to a xfrm policy rule.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=51bd39860ff829475aef611a3234309e37e090d9 (commit)]

* [MLSXFRM]: Add security sid to flowi: This adds security to flow key for labeling of flows as also to allow

for making flow cache lookups based on the security label seemless.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b6340fcd761acf9249b3acbc95c4dc555d9beb07 (commit)]

* [MLSXFRM]: Auto-labeling of child sockets: This automatically labels the TCP, Unix stream, and dccp child sockets

as well as openreqs to be at the same MLS level as the peer. This will result in the selection of appropriately labeled IPSec Security Associations. This also uses the sock's sid (as opposed to the isec sid) in SELinux enforcement of secmark in rcv_skb and postroute_last hooks.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf (commit)]

* [MLSXFRM]: Add flow labeling: This labels the flows that could utilize IPSec xfrms at the points the

flows are defined so that IPSec policy and SAs at the right label can be used. The following protos are currently not handled, but they should continue to be able to use single-labeled IPSec like they currently do. ipmr ip_gre ipip igmp sit sctp ip6_tunnel (IPv6 over IPv6 tunnel device) decnet

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=beb8d13bed80f8388f1a9a107d07ddd342e627e8 (commit)]

* [MLSXFRM]: Flow based matching of xfrm policy and state: This implements a seemless mechanism for xfrm policy selection and

state matching based on the flow sid. This also includes the necessary SELinux enforcement pieces.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e0d1caa7b0d5f02e4f34aa09c695d04251310c6c (commit)]

* [MLSXFRM]: Add security context to acquire messages using netlink: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using netlink/xfrm_user. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d681623d30c6565e8b62889f3aa3f4d4662c3e8 (commit)]

* [MLSXFRM]: Add security sid to sock: This adds security for IP sockets at the sock level. Security at the

sock level is needed to enforce the SELinux security policy for security associations even when a sock is orphaned (such as in the TCP LAST_ACK state). This will also be used to enforce SELinux controls over data arriving at or leaving a child socket while it's still waiting to be accepted.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=892c141e62982272b9c738b5520ad0e5e1ad7b42 (commit)]

* [MLSXFRM]: Default labeling of socket specific IPSec policies: This defaults the label of socket-specific IPSec policies to be the

same as the socket they are set on.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb969f072b6d67770b559617f14e767f47e77ece (commit)]

* [MLSXFRM]: Fix build with SECURITY_NETWORK_XFRM disabled.: The following patch will fix the build problem (encountered by Andrew

Morton) when SECURITY_NETWORK_XFRM is not enabled. As compared to git-net-selinux_xfrm_decode_session-build-fix.patch in -mm, this patch sets the return parameter sid to SECSID_NULL in selinux_xfrm_decode_session() and handles this value in the caller selinux_inet_conn_request() appropriately.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a51c64f1e5c2876eab2a32955acd9e8015c91c15 (commit)]

* [PATCH] selinux: add support for range transitions on object classes: Introduces support for policy version 21. This version of the binary

kernel policy allows for defining range transitions on security classes other than the process security class. As always, backwards compatibility for older formats is retained. The security class is read in as specified when using the new format, while the "process" security class is assumed when using an older policy format.
- Acked-by: James Morris <jmorris@namei.org>
Acked-by: Eric Paris <eparis@redhat.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3f8771420737004da55159c2f2dc0b6f483a4ef (commit)]

* [PATCH] selinux: enable configuration of max policy version: Enable configuration of SELinux maximum supported policy version to support

legacy userland (init) that does not gracefully handle kernels that support newer policy versions two or more beyond the installed policy, as in FC3 and FC4.
[bunk@stusta.de: improve Kconfig help text]
- Acked-by: James Morris <jmorris@namei.org>
Acked-by: Eric Paris <eparis@redhat.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=016b9bdb81d9c9c7800e4e224ade38d8b37669d3 (commit)]

* [PATCH] SELinux: support mls categories for context mounts: Allows commas to be embedded into context mount options (i.e. "-o

context=some_selinux_context_t"), to better support multiple categories, which are separated by commas and confuse mount. For example, with the current code:
- mount -t iso9660 /dev/cdrom /media/cdrom -o \ ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is context=system_u:object_r:iso9660_t:s0:c1 instead of context=system_u:object_r:iso9660_t:s0:c1,c3,c4 The options that will be passed on to the file system will be ro,c3,c4,exec. The proposed solution is to allow/require the SELinux context option specified to mount to use quotes when the context contains a comma. This patch modifies the option parsing in parse_opts(), contained in mount.c, to take options after finding a comma only if it hasn't seen a quote or if the quotes are matched. It also introduces a new function that will strip the quotes from the context option prior to translation. The quotes are replaced after the translation is completed to insure that in the event the raw context contains commas the kernel will be able to interpret the correct context.
- Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3528a95322b5c1ce882ab723f175a1845430cd89 (commit)]

Networking

* [IPV4]: Use Protocol Independant Policy Routing Rules Framework: [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e1ef4bf23b1ced0bf78a1c98289f746486e5c912 (commit)]

* [NetLabel]: core network changes: Changes to the core network stack to support the NetLabel subsystem. This

includes changes to the IPv4 option handling to support CIPSO labels.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=11a03f78fbf15a866ba3bf6359a75cdfd1ced703 (commit)] * [NetLabel]: core NetLabel subsystem: Add a new kernel subsystem, NetLabel, to provide explicit packet

labeling services (CIPSO, RIPSO, etc.) to LSM developers. NetLabel is designed to work in conjunction with a LSM to intercept and decode security labels on incoming network packets as well as ensure that outgoing network packets are labeled according to the security mechanism employed by the LSM. The NetLabel subsystem is configured through a Generic NETLINK interface described in the header files included in this patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d15c345fe3b8dfda0fa5a1d2143a35fffa746a43 (commit)]

* [NetLabel]: documentation: Documentation for the NetLabel system, this includes a basic overview

of how NetLabel works, how LSM developers can integrate it into their favorite LSM, as well as documentation on the CIPSO related sysctl variables. Also, due to the difficulty of finding expired IETF drafts, I am including the IETF CIPSO draft that is the basis of the NetLabel CIPSO implementation.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8802f616f6de8576805f32e47602816f141118f2 (commit)]

* [NetLabel]: SELinux support: Add NetLabel support to the SELinux LSM and modify the

socket_post_create() LSM hook to return an error code. The most
significant part of this patch is the addition of NetLabel hooks into the following SELinux LSM hooks:
- selinux_file_permission()
- selinux_socket_sendmsg()
- selinux_socket_post_create()
- selinux_socket_sock_rcv_skb()
- selinux_socket_getpeersec_stream()
- selinux_socket_getpeersec_dgram()
- selinux_sock_graft()
- selinux_inet_conn_request()
The basic reasoning behind this patch is that outgoing packets are
"NetLabel'd" by labeling their socket and the NetLabel security attributes are checked via the additional hook in selinux_socket_sock_rcv_skb(). NetLabel itself is only a labeling mechanism, similar to filesystem extended attributes, it is up to the SELinux enforcement mechanism to perform the actual access checks. In addition to the changes outlined above this patch also includes some changes to the extended bitmap (ebitmap) and multi-level security (mls) code to import and export SELinux TE/MLS attributes into and out
of NetLabel.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7420ed23a4f77480b5b7b3245e5da30dd24b7575 (commit)]

* [NetLabel]: tie NetLabel into the Kconfig system: Modify the net/Kconfig file to enable selecting the NetLabel Kconfig

options.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8161327311fe4da1684ed08015e141feb9a0a737 (commit)]

* [NetLabel]: CIPSOv4 engine: Add support for the Commercial IP Security Option (CIPSO) to the IPv4

network stack. CIPSO has become a de-facto standard for trusted/labeled networking amongst existing Trusted Operating Systems such as Trusted Solaris, HP-UX CMW, etc. This implementation is
designed to be used with the NetLabel subsystem to provide explicit packet labeling to LSM developers.
The CIPSO/IPv4 packet labeling works by the LSM calling a NetLabel API function which attaches a CIPSO label (IPv4 option) to a given socket; this in turn attaches the CIPSO label to every packet leaving the socket without any extra processing on the outbound side. On the inbound side the individual packet's sk_buff is examined through a call to a NetLabel API function to determine if a CIPSO/IPv4 label is present and if so the security attributes of the CIPSO label are returned to the caller of the NetLabel API function.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=446fda4f26822b2d42ab3396aafcedf38a9ff2b6 (commit)]

* [NET]: Replace CHECKSUM_HW by CHECKSUM_PARTIAL/CHECKSUM_COMPLETE: Replace CHECKSUM_HW by CHECKSUM_PARTIAL (for outgoing packets, whose

checksum still needs to be completed) and CHECKSUM_COMPLETE (for incoming packets, device supplied full checksum). Patch originally from Herbert Xu, updated by myself for 2.6.18-rc3.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=84fa7933a33f806bbbaae6775e87459b1ec584c0 (commit)]

* Add the framework to support multiple IPv6 routing tables [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c71099acce933455123ee505cc75964610a209ad (commit)]

* [NETFILTER]: Get rid of HW checksum invalidation: Update hardware checksums incrementally to avoid breaking GSO.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cf411de49c65140b3c259748629b561c0d3340f (commit)]

* Extend netlink messaging interface [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fe4944e59c357f945f81bc67edb7ed1392e875ad (commit)]

* Protocol Independant Policy Routing Rules Framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=14c0b97ddfc2944982d078b8e33b088840068976 (commit)]

* [NetLabel]: CIPSOv4 and Unlabeled packet integration: Add CIPSO/IPv4 and unlabeled packet management to the NetLabel

subsystem. The CIPSO/IPv4 changes allow the configuration of
CIPSO/IPv4 within the overall NetLabel framework. The unlabeled packet changes allows NetLabel to pass unlabeled packets without error.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96cb8e3313c7a12e026c1ed510522ae6f6023875 (commit)]

* [IPV6]: Policy Routing Rules: Adds support for policy routing rules including a new

local table for routes with a local destination.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=101367c2f8c464ea96643192673aa18d88e6336d (commit)]

* [NET]: Round out in-kernel sockets API: This patch implements wrapper functions that provide a convenient way

to access the sockets API for in-kernel users like sunrpc, cifs & ocfs2 etc and any future users.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ac5a488ef252ed673cb067843e411f8cc43f7ab9 (commit)]

* [IPV6]: Increase number of possible routing tables to 2^{32: Increase number of possible routing tables to 2}32 by replacing iterations

over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1b43af5480c351dbcb2eef478bafe179cbeb6e83 (commit)]

* [XFRM] STATE: Introduce route optimization mode.: Route optimization is used with routing header and destination options

header for Mobile IPv6. At outbound it makes header space like IPsec transport. At inbound it does nothing because exhdrs.c functions have responsibility to update skbuff information for these headers.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d71627d699eca831c1fbfb66ea67bb1fba41415 (commit)]

* [IPV4]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1af5a8c4a11cfed0c9a7f30fcfb689981750599c (commit)]

* [DECNET]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=abcab268303c22d24fc89fedd35d82271d20f5da (commit)]

* replace IPv4 dscp match by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ba1627617d396135a4d679542a3623d5819e628 (commit)]

* replace IPv4 DSCP target by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a468701db58a8b3e08e3f55fa6ac66db42014922 (commit)]

* [XFRM] POLICY: Add Kconfig to support sub policy.: Add Kconfig to support sub policy.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c11f1a15c522ddd3bbd2c32b5ce3e0b1831b22f2 (commit)]

* [DCCP]: Introduce tx buffering [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97e5848dd39e7e76bd6077735ebb5473763ab9c5 (commit)]

* [XFRM] POLICY: sub policy support.: Sub policy is introduced. Main and sub policy are applied the same flow.

(Policy that current kernel uses is named as main.) It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate. Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6. (Such usage as two IPsec policies on different database can be used, too.) Limitation or TODOs:
- - Sub policy is not supported for per socket one (it is always inserted as main). - Current kernel makes cached outbound with flowi to skip searching database.
  - However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e81bb8336a0ac50289d4d4c7a55e559b994ee8f (commit)]

* [IPV6] NDISC: Add proxy_ndp sysctl.: We do not always need proxy NDP functionality even we

enable forwarding.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fbea49e1e2404baa2d88ab47e2db89e49551b53b (commit)]

* [IPV6]: Add Kconfig to enable Mobile IPv6.: Add Kconfig to enable Mobile IPv6.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee53826801a8fa7a0e333895421ef6d0e5fbfbf0 (commit)]

* [IPV6] ADDRCONF: Mobile IPv6 Home Address support.: IFA_F_HOMEADDRESS is introduced for Mobile IPv6 Home Addresses on

Mobile Node. The IFA_F_HOMEADDRESS flag should be set for Mobile IPv6 Home Addresses for 2 purposes. 1) We need to check this on receipt of Type 2 Routing Header (RFC3775 Secion 6.4), 2) We prefer Home Address(es) in source address selection (RFC3484 Section 5 Rule 4).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3b9f9a1c3903b64c38505f9fed3bb11e48dbc931 (commit)]

* [IPV6] KCONFIG: Add subtrees support.: This is for developers only.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e96c2b4180aff4f080b77314712073c6ca430e7 (commit)]

Crypto

Add cryptomgr, a "cryptographic algorithm manager" [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b8c19dbdc692e81243a328725a02efb77b144a5 (commit)]
Add block cipher type. Unlike current cipher algorithms which operate on a single block at a time, block ciphers operate on an arbitrarily long linear area of data. As it is block-based, it will skip any data remaining at the end which cannot form a block [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5cde0af2a9825dd1edaca233bd9590566579ef21 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5c64097aa0f6dc4f27718ef47ca9a12538d62860 (commit)]. Also switch some cipher users to use block type [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db131ef9084110d9e82549c0a627e157e8bb99d7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cba83564d112e4aec52227f68670f8dbd4d4ac89 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=69affe7fc52c14e4b81408a2076e9e58ba4af60a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d1806f6a97a536b043fe50e6d8a25b061755cf50 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f12cc2090d721647c23dfce20834f4306db3b77d (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=28ce728a90cce3a0c6c0ed00354299de52db94b1 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=378c6697a282c383d89428380a3405bf95189347 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6b7326c8497f954c2cfcb4c49fe42be5b80887bc (commit)]
Support for SHA1 / SHA256 algorithms in VIA C7 processors [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6c833275152b454d311f0e70b5e6bf028b4a2aaf (commit)], add twofish x86-64 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eaf44088ff467410dd15a033fef118888002ffe6 (commit)] and a i586 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9f535ffe38f7eb61ac2219d32d97c377b69f70d (commit)]

CPUFREQ

* add powersave_bias tunable. ondemand selects the minimum frequency that can retire a workload with negligible idle time -- ideally resulting in the highest performance/power efficiency with negligible performance impact. But on some systems and some workloads, this algorithm is more performance biased than necessary, and de-tuning it a bit to allow some performance impact can save measurable power. This patch adds a "powersave_bias" tunable to ondemand to allow it to reduce its target frequency by a specified percent. By default, the powersave_bias is 0 and has no effect. powersave_bias is in units of 0.1%, so it has an effective range of 1 through 1000, resulting in 0.1% to 100% impact. In practice, users will not be able to detect a difference between 0.1% increments, but 1.0% increments turned out to be too large. Also, the max value of 1000 (100%) would simply peg the system in its deepest power saving P-state, unless the processor really has a hardware P-state at 0Hz:-)

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05ca0350e8caa91a5ec9961c585c98005b6934ea (commit)]

* Longhaul - Disable arbiter [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=179da8e6e8903a8cdb19bb12672d50dc33f0fde6 (commit)], add voltage scaling to driver [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db44aaf3a2f599163c53ce96658aca688b3466f0 (commit)] * Longhaul - Add ignore_latency option [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6595413fc9453a211f4b5d5cc42f0bbf3daa615b (commit)]