Linux_2_6_19 - Linux Kernel Newbies

Important things (AKA: ''the cool stuff'')

GFS2

GFS2 is a clustering filesystem developed mainly by Red Hat (after [http://www.theregister.co.uk/2003/12/18/red_hat_sweetens_q3/ purchasing Sistina] and opening the source code). It's not the first: OCFS2, another clustering filesystem developed by Oracle, was already merged in [http://kernelnewbies.org/Linux_2_6_16 Linux 2.6.16]. Clustering filesystems allow to share a filesystem between several machines with no compromises. GFS includes his own DLM (distributed locking manager) and a userspace API interface for that DLM.

Like OCFS2 and like any other filesystem that wants to be merged in the linux kernel, GFS2 developers asked for submission long time ago. They were asked to fix things (even considering that GFS2 had already been developed at Sistina and it was already a stable final product), they submitted it again, they were asked to fix more things, and so on, for a long period of time. Their developers have fixed every thing they were asked to fix. Because of their hard work, GFS2 is now ready to be merged, and everyone is happy. And nobody flames the kernel or GFS2 developers. Amazing, isn't?

[http://sources.redhat.com/cluster/ GFS2 project page]; Source code [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/gfs2 for GFS2] (840 KB) and [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/dlm for the DLM] (384 KB)

EXT 4

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/jbd2 JBD2], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/ext4 EXT 4]

ECRYPTFS

Coming from IBM, ecryptfs aims to bring "enterprise level" file encryption to the masses.

"Oh no, another filesystem!". No, Ecryptfs is not a traditional filesystem: it doesn't implements his own disk format. From [http://lwn.net/Articles/156921/ this LWN article]:

The eCryptfs developers took the stacking approach, meaning that, rather than implement its own platter-level format, eCryptfs sits on top of another filesystem. It is, essentially, a sort of translation layer which makes encrypted file capabilities available. The system administrator can thus create encrypted filesystems on top of whatever filesystem is in use locally, or even over a network-mounted filesystem. [...] Rather than encrypt the filesystem as a whole, eCryptfs deals with each file individually

(Reading the rest of the [http://lwn.net/Articles/156921 LWN article] is recommended. There's also a [http://www.linuxsymposium.org/2005/linuxsymposium_procv1.pdf Ecryptfs paper from the 2005 Ottawa Symposium] - page 209 and onwards)

Is it better to encrypt the whole disk using cryptoloop/dmcrypt, or use ecryptfs? You decide. Ecryptfs avoids the overhead of a fully encrypted filesystem by only encrypting the files you really want to encrypt, and it also allows to encrypt different files in different ways. Ecryptfs tries to make file encryption available in a easy way for the masses. It "aims to combine the flexibility of GnuPG encryption with the transparency of a kernel service" [...] "Think of eCryptfs as a sort of 'gnupgfs'". If you're interested, you will find the userspace tools and more information available in the [http://ecryptfs.sourceforge.net/ ecryptfs sourceforge site]. You can also read the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/ecryptfs.txt Ecryptfs documentation] and the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=237fead619984cc48818fe12ee0ceada3f55b012 Ecryptfs code] (232 KB).

Libata PATA (Parallel ATA) merge

By "Parallel ATA" we mean all the ATA/IDE controllers and drives that we have been using for years before SATA. Almost from the start, one of the objectives of some kernel hackers was to [http://marc.theaimsgroup.com/?l=linux-kernel&m=115514409104283&w=2 replace the IDE drivers available in drivers/ide] (everything under the "Device drivers -> ATA/ATAPI/MFM/RLL support" configuration menu) with a reimplementation on top of libata (i.e.: the "SATA layer"). Drivers/ide suffers from many ugly and obscure problems, and re-implementing it on top of libata has been much easier than fixing the unfixable drivers/ide mess - most of the porting work has been done by Alan Cox (a consequence of this PATA merge is that libata and all its SATA drivers have also been moved from drivers/scsi (available in the "Device drivers -> SCSI device support -> SCSI low-level drivers" submenu) to drivers/ata (now "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers"), and all the CONFIG_SCSI_FOOBAR options for the individual SATA drivers have been changed to CONFIG_FOOBAR, so this means you may need to reconfigure your SATA configuration options)

This means 2.6.19 may have two drivers for your PATA-base device: The old IDE driver under "Device drivers -> ATA/ATAPI/MFM/RLL support" and an alternative driver under "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers" (along with the rest of the SATA drivers)

What one must you choose? Well, the safe option is using the old driver: The old drivers will continue working just as they did before. There'll be no changes if you continue using the old drivers.

What do the new libata-base PATA drivers offer to you?

First of all, because they're libata-based and libata is a well engineered and sane infrastructure, the drivers have much better quality, they're cleaner, they've much better error handling (much better behaviour when one of your drives dies suddenly or finds broken sectors), and they don't have some of the known design issues that the old drivers have (this is why people did all the work to move away from drivers/ide, they didn't do it just for fun)
Because they're newer, there are more bugs. For this release, they're "experimental". If you want to be safe, use the old drivers.
Really. There is a risk that the new drivers won't work for you, or may harm your data (unlikely, but not impossible). If you want to be safe, use the old drivers.
They support some chipsets not supported by drivers/ide. The cleaner design of libata allows for easier driver development and maintenance. In some cases it supports features that the old driver doesn't, for the same reasons.
Some IDE controllers are not supported or they aren't fully supported. Some of them because not all the IDE drivers have been ported to libata, but others because they're old and undocumented or because the libata PATA layer still doesn't support some of their features. There's no support for certain old serialized devices, for prehistoric CMD640 controllers or for host-protected-area yet.
Drives appear as /dev/sda, /dev/sr0, the old devices names won't work. You will need to change your boot parameters and your /etc/fstab parameters in order to get a working system with the new drivers. Again, this only happens if you use the new drivers, the old drivers continue working as they did before.

Eventually, the new libata-based PATA drivers will get more stable, so the old drivers in drivers/ide may get deleted as the new drivers fulfill all needs of the IDE users and becomes feature-complete. But this certainly won't happen anytime soon. No old drivers will be deleted if there's not a working libata-based replacement. You can read the latest [http://zeniv.linux.org.uk/~alan/IDE/STATUS.txt status report] written by Alan Cox. It'd certainly be useful if you could give it a try and report back how well it works to linux-kernel@vger.kernel.org or bugzilla.kernel.org - even if it works fine, it'll be useful to know what systems do work (be sure to include the necessary information mentioned in the previous status report). [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=drivers/ata (libata PATA code)]

Removal of selected OSS drivers

Since 2.6 was released, ALSA has been the "official" sound subsystem. OSS drivers were kept for compatibility - ALSA also implements a OSS compatibility layer. However, there's a big number of ALSA drivers and OSS drivers targetting exactly the same hardware. Usually, the OSS ones are undermaintained (or no maintained at all). And ALSA already implements OSS compatibility. So....

...it's possible to remove old OSS drivers, as long as there's a equivalent ALSA driver, and as long as that driver has no regressions that don't allow users to migrate (drivers with no ALSA equivalent or with know regressions have NOT been deleted). In 2.6.19, those OSS drivers are being removed. If when migrating users find something wrong in the ALSA drivers, they should report it in the [https://bugtrack.alsa-project.org ALSA bug tracking system] and work with developers to fix them. Yes, we know there're users that feel just fine with the OSS drivers, but it doesn't helps to the kernel to keep those old drivers around. By forcing people to migrate to ALSA drivers, the ALSA drivers will be improved and fixed. Overall, the linux sound subsystem will only get better. Many thanks to all the hackers that coded them.

A total of 1.79 MB of OSS drivers will be removed. To see a list of source files being removed, see [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d56b9b9c464a10ab1ee51a4c6190a2b57b8ef7a6 the commit link]. Hardware that is forced to use ALSA drivers include:

AD1980 AC97 plugin; ALI 5455; Alchemy Au1000 (MIPS); AWE32/SB32/AWE64 WaveTable driver; C-Media; Cirrus Logic-Crystal CS4281; Ensoniq ES1370/Asahi Kasei AK4531; ESS Technology Solo1 (ES1946); ForteMedia FM801; Gravis Ultrasound; ASP's and Lasi's Harmony sound chip; ICS2101 mixer of GUS v3.7; OPTi MAD16 compatible audio chips; ESS Maestro/Maestro-2/Maestro-2E/Maestro3/Allegro; Turtle Beach Maui and Tropez; Yamaha YMF701B aka OPL3-SA; RME9652/36 "Hammerfall" Driver; Aztech Sound Galaxy cards; S3 Sonic Vibes; Turtle Beach WaveFront Series (Maui, Tropez, Tropez Plus); WaveFront ICS2115 MIDI; Yamaha YMF7xx

AVR32 Architecture

2.6.19 adds support for the Atmel AVR32 architecture, implemented and supported by Atmel Corporation.

AVR32 is a new high-performance 32-bit RISC microprocessor core, designed for cost-sensitive embedded applications, with particular emphasis on low power consumption and high code density. The AVR32 architecture description, including the instruction set, can be found in the [http://www.atmel.com/dyn/resources/prod_documents/doc32000.pdf AVR32 Architecture Manual]. The Atmel AT32AP7000 is the first CPU implementing the AVR32 architecture; it features a 7-stage pipeline, 16KB instruction and data caches and a full Memory Management Unit and a large set of integrated peripherals ([http://www.atmel.com/dyn/resources/prod_documents/doc32003.pdf full data sheet]); while the CPU core implementation including caches and MMU is documented by the [http://www.atmel.com/dyn/resources/prod_documents/doc32001.pdf AVR32 AP Technical Reference]. Information about the AT32STK1000 development board can be found [http://www.atmel.com/dyn/products/tools_card.asp?tool_id=3918 here], including a BSP CD image, development tools (binaries and source/patches) and a root filesystem image suitable for booting from SD card. Alternatively, there's a preliminary "getting started" guide available at http://avr32linux.org/twiki/bin/view/Main/GettingStarted which provides links to the sources and patches you will need in order to set up a cross-compiling environment for avr32-linux

Source code can be found [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=arch/avr32 here (arch/av32)]

Other stuff

Architecture-specific changes

x86 32/64

* Add SMP support on x86_64 to reservation framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f2802e7f571c05f9a901b1f5bd144aa730ccc88e (commit)]

* Add SMP support on i386 to reservation framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b7471c6da94d30d3deadc55986cc38d1ff57f9ca (commit)]

* x86: Add abilty to enable/disable nmi watchdog with sysctl (/proc/sys/kernel/nmi) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=407984f1af259b31957c7c05075a454a751bb801 (commit)]

* i386: Utilize performance counter reservation framework in oprofile [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb9c448c661d40ce2efbce8e9c19cc4d420d8ccc (commit)]

* x86: Add abilty to enable/disable nmi watchdog from procfs (/proc/sys/kernel/nmi_watchdog) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e33e89ab1a8d295de0500b697f4f31c3ceee9aa2 (commit)]

* [PATCH] x86: Add performance counter reservation framework for UP kernels [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=828f0afda123a96ff4e8078f057a302f4b4232ae (commit)]

* [PATCH] Add the vgetcpu vsyscall: This patch adds a vgetcpu vsyscall, which depending on the CPU RDTSCP capability uses either the RDTSCP or CPUID to obtain a CPU and node numbers and pass them to the program [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c08c820508233b424deab3302bc404bbecc6493a (commit)]

* [PATCH] x86: Allow users to force a panic on NMI [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8da5adda91df3d2fcc5300e68da491694c9af019 (commit)]

* [PATCH] x86: Add portable getcpu call [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3cfc348bf90ffaa777c188652aa297f04eb94de8 (commit)]

* [PATCH] i386: Support physical cpu hotplug for x86_64 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=73fea175303926055440c06bc8894f0c5c58afc8 (commit)]

* [PATCH] i386: Enable NMI watchdog by default for systems newer than 2004 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1de84979dfc527c422abf63f27beabe43892989b (commit)]

* [PATCH] hot-add-mem x86_64: memory_add_physaddr_to_nid enable: The api for hot-add memory already has a construct for finding nodes based on

an address, memory_add_physaddr_to_nid. This patch allows the fucntion to do something besides return 0. It uses the nodes_add infomation to lookup to node info for a hot add event.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4942e998b40b8f6080930ec16442444e9930aee5 (commit)]

* [PATCH] hot-add-mem x86_64: memory_add_physaddr_to_nid node fixup: In cases where the acpi memory-add event does not containe the pxm (node)

infomation allow the driver to look up node info based on the address. The acpi_get_node call returns -1 if it can't decode the pxm info, this causes add_memory to panic. acpi_get_node would have to decode the resource from the handle (a lenghty proposition). This seems to be the cleanist point to interject the hook.
[kamezawa.hiroyu@jp.fujitsu.com: build fixes] [y-goto@jp.fujitsu.com: build fixes]
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8c2676a5870ab15cbeea9f826266bc946fe3cc26 (commit)]

* [PATCH] hot-add-mem x86_64: Kconfig changes: Create Kconfig namespace for MEMORY_HOTPLUG_RESERVE and MEMORY_HOTPLUG_SPARSE.

This is needed to create a disticiton between the 2 paths. Selecting the

high level opiton of MEMORY_HOTPLUG will get you MEMORY_HOTPLUG_SPARSE if you have sparsemem enabled or MEMORY_HOTPLUG_RESERVE if you are x86_64 with discontig and ACPI numa support.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec69acbb1191df671ff8e07c8e146619a5c53f70 (commit)]

* [PATCH] hot-add-mem x86_64: use CONFIG_MEMORY_HOTPLUG_SPARSE: Migate CONFIG_MEMORY_HOTPLUG to CONFIG_MEMORY_HOTPLUG_SPARSE where needed.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=53947027ad90542ddb2bb746e3175827c270610a (commit)]

* [PATCH] hot-add-mem x86_64: fixup externs: Fix up externs in memory_hotplug.c. Cleanup.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f28c5edc06ecd8068b38b7662ad19f4d20d741af (commit)]

* [PATCH] hot-add-mem x86_64: Enable SPARSEMEM in srat.c: Enable x86_64 srat.c to share code between both reserve and sparsemem based

add memory paths. Both paths need the hot-add area node locality infomration (nodes_add). This code refactors the code path to allow this.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=71efa8fdc55e70ec6687c897a30759f0a2c2ad7e (commit)]

* [PATCH] hot-add-mem x86_64: use CONFIG_MEMORY_HOTPLUG_RESERVE: The api for hot-add memory already has a construct for finding nodes based on

an address, memory_add_physaddr_to_nid. This patch allows the fucntion to do something besides return 0. It uses the nodes_add infomation to lookup to node info for a hot add event.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=45e0b78b0532f92c01e363dd4287617c5be4574f (commit)]

* [PATCH] convert i386 NUMA KVA space to bootmem [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=91023300057e96de7f46e95166a3e02394ae72f9 (commit)]

* [PATCH] x86: enable VMSPLIT for highmem kernels [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=753b9f86e7aef76c2beda32668ce528f90cb1733 (commit)] * [PATCH] x86: add a bootparameter to reserve high linear address space: Add a boot parameter to reserve high linear address space for hypervisors.

This is necessary to allow dynamically loaded hypervisor modules, which might not happen until userspace is already running, and also provides a useful tool to benchmark the performance impact of reduced lowmem address space.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=461a9afff5e731d6337c0f5b08a1e727ccd57e0a (commit)]

* [PATCH] Add the canary field to the PDA area and the task struct: This patch adds the per thread cookie field to the task struct and the PDA.

Also it makes sure that the PDA value gets the new cookie value at context switch, and that a new task gets a new cookie at task creation time.
- CC: Andi Kleen <ak@suse.de>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a4254058037eb172758961d0a5b94f4320a1425 (commit)]

* [PATCH] Add the Kconfig option for the stackprotector feature: This patch adds the config options for -fstack-protector.

CC: Andi Kleen <ak@suse.de>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b62a5c740df1e3d49a97349fce0c6a23f633d7fe (commit)]

* [PATCH] Add the stack_chk_fail() function: GCC emits a call to a stack_chk_fail() function when the stack canary is

not matching the expected value. Since this is a bad security issue; lets panic the kernel rather than limping along; the kernel really can't be trusted anymore when this happens.
- CC: Andi Kleen <ak@suse.de>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3162f751d04086a9d006342de63ac8f44fe0f72a (commit)]

* [PATCH] non lazy "sleazy" fpu implementation: Right now the kernel on x86-64 has a 100% lazy fpu behavior: after *every*

context switch a trap is taken for the first FPU use to restore the FPU context lazily. This is of course great for applications that have very sporadic or no FPU use (since then you avoid doing the expensive save/restore all the time). However for very frequent FPU users... you take an extra trap every context switch. The patch below adds a simple heuristic to this code: After 5 consecutive context switches of FPU use, the lazy behavior is disabled and the context gets restored every context switch. If the app indeed uses the FPU, the trap is avoided. (the chance of the 6th time slice using FPU after the previous 5 having done so are quite high obviously). After 256 switches, this is reset and lazy behavior is returned (until there are 5 consecutive ones again). The reason for this is to give apps that do longer bursts of FPU use still the lazy behavior back after some time.
[akpm@osdl.org: place new task_struct field next to jit_keyring to save space]
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e07e23e1fd3000289fc7ccc6c71879070d3b19e0 (commit)]

* [PATCH] Add the -fstack-protector option to the CFLAGS: Add a feature check that checks that the gcc compiler has stack-protector

support and has the bugfix for PR28281 to make this work in kernel mode. The easiest solution I could find was to have a shell script in scripts/ to do the detection; if needed we can make this fancier in the future without making the makefile too complex.
- CC: Andi Kleen <ak@suse.de>
CC: Sam Ravnborg <sam@ravnborg.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4f7fd4d7a79193ceda4ce77f75e22917d33fa154 (commit)] * [PATCH] x86: Allow disabling early pci scans with pci=noearly or disallowing conf1: Some buggy systems can machine check when config space accesses

happen for some non existent devices. i386/x86-64 do some early device scans that might trigger this. Allow pci=noearly to disable this. Also when type 1 is disabling also don't do any early accesses which are always type1. This moves the pci= configuration parsing to be a early parameter. I don't think this can break anything because it only changes a single global that is only used by PCI.
[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0637a70a5db98182d9ad3d6ae1ee30acf20afde9 (commit)]

* [PATCH] x86 microcode: add sysfs and hotplug support: Add sysfs support. Currently each CPU has three microcode related

attributes. One is 'version' which shows current ucode version of CPU. Tools can use the attribute do validation or show CPU ucode status. one is 'reload' which allows manually reloading ucode. Another is 'processor_flags', which exports processor flags, so we can write tools to check if CPU has latest ucode. Also add suspend/resume and CPU hotplug support.
[akpm@osdl.org: cleanups, build fix] [bunk@stusta.de: Kconfig fixes]
- Acked-by: Tigran Aivazian <tigran@veritas.com>
[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9a4b9efa1d39d7d31bed08fbe5a9b2a03b2759d4 (commit)]

* zone_reclaim: dynamic slab reclaim: Currently slab reclaim is enabled by setting an explicit option in /proc/sys/vm/zone_reclaim_mode and its used as a final option if the freeing of unmapped file backed pages is not enough to free enough pages to allow a local allocation. However, that means that the slab can grow excessively and that most memory of a node may be used by slabs. This implements slab reclaim during zone reclaim (zone reclaim occurs if there is a danger of an off node allocation).

At that point we:

Shrink the per node page cache if the number of pagecache
- pages is more than min_unmapped_ratio percent of pages in a zone.
Shrink the slab cache if the number of the nodes reclaimable slab pages
- (patch depends on earlier one that implements that counter) are more than min_slab_ratio (a new /proc/sys/vm tunable).

The default for the min_slab_ratio is 5%, and the slab option from /proc/sys/vm/zone_reclaim_mode is removed [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0ff38490c836dc379ff7ec45b10a15a662f4e5f6 (commit)]

* [PATCH] Have ia64 use add_active_range() and free_area_init_nodes: Size zones and holes in an architecture independent manner for ia64.

[bob.picco@hp.com: fix ia64 FLATMEM+VIRTUAL_MEM_MAP]
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05e0caad3b7bd0d0fbeff980bca22f186241a501 (commit)]

* [PATCH] Account for holes that are outside the range of physical memory: absent_pages_in_range() made the assumption that users of the API would not

care about holes beyound the end of physical memory. This was not the case. This patch will account for ranges outside of physical memory as holes correctly.
[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9c7cd6877cf8db15269163deda69392263124c1e (commit)]

* [PATCH] mspec driver: Implement the special memory driver (mspec) based on the do_no_pfn

approach. The driver is currently used only on SN2 hardware with special fetchop support but could be beneficial on other architectures using the uncached mode.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=17a3b05047119b7fc72ef03962e202becc659579 (commit)]

* Introduce a architecture-independent mechanism for registering active regions of memory [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c713216deebd95d2b0ab38fef8bb2361c0180c2d (commit)]

* [PATCH] Account for memmap and optionally the kernel image as holes: The x86_64 code accounted for memmap and some portions of the the DMA zone as

holes. This was because those areas would never be reclaimed and accounting for them as memory affects min watermarks. This patch will account for the memmap as a memory hole. Architectures may optionally use set_dma_reserve() if they wish to account for a portion of memory in ZONE_DMA as a hole.
- [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0e0b864e069c52a7b3e4a7da56e29b03a012fd75 (commit)]

* [PATCH] vm: add per-zone writeout counter [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e129b5c23c2b471d47f1c5d2b8b193fc2034af43 (commit)]

* [PATCH] Allow an arch to expand node boundaries: Arch-independent zone-sizing determines the size of a node

(pgdat->node_spanned_pages) based on the physical memory that was registered by the architecture. However, when CONFIG_MEMORY_HOTPLUG_RESERVE is set, the architecture expects that the spanned_pages will be much larger and that mem_map will be allocated that is used lated on memory hot-add. This patch allows an architecture that sets CONFIG_MEMORY_HOTPLUG_RESERVE to call push_node_boundaries() which will set the node beginning and end to at *least* the requested boundary.
[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fb01439c5b778d5974a488c5d4fe85e6d0e18a68 (commit)]

* [PATCH] vm: add per-zone writeout counter: The VM is supposed to minimise the number of pages which get written off the

LRU (for IO scheduling efficiency, and for high reclaim-success rates). But we don't actually have a clear way of showing how true this is. So add `nr_vmscan_write' to /proc/vmstat and /proc/zoneinfo - the number of pages which have been written by the vm scanner in this zone and globally.
[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e129b5c23c2b471d47f1c5d2b8b193fc2034af43 (commit)]

BLOCK

* [PATCH] Split struct request ->flags into two parts: Right now ->flags is a bit of a mess: some are request types, and

others are just modifiers. Clean this up by splitting it into
->cmd_type and ->cmd_flags. This allows introduction of generic Linux block message types, useful for sending generic Linux commands to block devices.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4aff5e2333c9a1609662f2091f55c3f6fffdad36 (commit)] * [PATCH] elevator: move the backmerging logic into the elevator core: Right now, every IO scheduler implements its own backmerging (except for

noop, which does no merging). That results in duplicated code for essentially the same operation, which is never a good thing. This patch moves the backmerging out of the io schedulers and into the elevator core. We save 1.6kb of text and as a bonus get backmerging for noop as well. Win-win!

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9817064b68fef7e4580c6df1ea597e106b9ff88b (commit)] * [PATCH] Allow file systems to differentiate between data and meta reads: We can use this information for making more intelligent priority

decisions, and it will also be useful for blktrace.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5404bc7a87b9949cf61e0174b21f80e73239ab25 (commit)]

* [PATCH] cfq-iosched: use metadata read flag: Give meta data reads preference over regular reads, as the process

often needs to get that out of the way to do the io it was actually interested in.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=374f84ac39ec7829a57a66efd5125d3561ff0e00 (commit)]

* [PATCH] ext3: make meta data reads use READ_META: [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=caa38fb0f481a3cb732b115cb59bfa6b59b6daaf (commit)]

* [PATCH] blktrace: support for logging metadata reads: [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7457e6e2d7406c7009e9ad03db1335fe93b5fb71 (commit)]

* [PATCH] BLOCK: Move functions out of buffer code [try #6]: Move some functions out of the buffering code that aren't strictly buffering

specific. This is a precursor to being able to disable the block layer.
- (*) Moved some stuff out of fs/buffer.c:
  - (*) The file sync and general sync stuff moved to fs/sync.c. (*) The superblock sync stuff moved to fs/super.c. (*) do_invalidatepage() moved to mm/truncate.c. (*) try_to_release_page() moved to mm/filemap.c.
  (*) Moved some related declarations between header files:
  - (*) declarations for do_invalidatepage() and try_to_release_page() moved
    - to linux/mm.h.
    (*) set_page_dirty_buffers() moved to linux/buffer_head.h.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cf9a2ae8d49948f861b56e5333530e491a9da190 (commit)]

* [PATCH] BLOCK: Remove duplicate declaration of exit_io_context() [try #6]: Remove the duplicate declaration of exit_io_context() from linux/sched.h.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d67a46df0125e20d14f12dbd3646f1f1bf23e8c (commit)]

* [PATCH] BLOCK: Stop fallback_migrate_page() from using page_has_buffers() [try #6]: Stop fallback_migrate_page() from using page_has_buffers() since that might not

be available. Use PagePrivate() instead since that's more general.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b398f6bff93a247d2a7099e92905374966e4558f (commit)]

* [PATCH] BLOCK: Dissociate generic_writepages() from mpage stuff [try #6]: Dissociate the generic_writepages() function from the mpage stuff, moving its

declaration to linux/mm.h and actually emitting a full implementation into mm/page-writeback.c. The implementation is a partial duplicate of mpage_writepages() with all BIO references removed. It is used by NFS to do writeback.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=811d736f9e8013966e1a5a930c0db09508bdbb15 (commit)]

* [PATCH] BLOCK: Move extern declarations out of fs/*.c into header files [try #6]: Create a new header file, fs/internal.h, for common definitions local to the

sources in the fs/ directory. Move extern definitions that should be in header files from fs/*.c to fs/internal.h or other main header files where they span directories.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=07f3f05c1e3052b8656129b2a5aca9f888241a34 (commit)]

* [PATCH] BLOCK: Separate the bounce buffering code from the highmem code [try #6]: Move the bounce buffer code from mm/highmem.c to mm/bounce.c so that it can be

more easily disabled when the block layer is disabled. !!!NOTE!!! There may be a bug in this code: Should init_emergency_pool() be
- contingent on CONFIG_HIGHMEM?

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=831058dec3735665fe91bd0d37b6a8cf56b91abd (commit)]

* [PATCH] BLOCK: Remove dependence on existence of blockdev_superblock [try #6]: Move blockdev_superblock extern declaration from fs/fs-writeback.c to a

headerfile and remove the dependence on it by wrapping it in a macro.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7b0de42d7c5a471741ede4e71727d88000e6ea59 (commit)]

* [PATCH] BLOCK: Don't call block_sync_page() from AFS [try #6]: The AFS filesystem no longer needs to override its sync_page() op.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=65e6f5bc8149165efb9d7bdbd142bb837d5edfeb (commit)]

* [PATCH] BLOCK: Move invalidate_device() to block_dev.c [try #6]: Move invalidate_device() from fs/inode.c to fs/block_dev.c so that it can

more easily be disabled when the block layer is disabled.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b71e8a4ce03b3098c7801ee5e6e08d1a39a226c2 (commit)]

* [PATCH] BLOCK: Move common FS-specific ioctls to linux/fs.h [try #6]: Move common FS-specific ioctls from linux/ext2_fs.h to linux/fs.h as FS_IOC_*

and FS_IOC32_* and have the users of them use those as a base. Also move the GETFLAGS/SETFLAGS flags to linux/fs.h as FS_*_FL macros, and then have the other users use them as a base.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=36695673b012096228ebdc1b39a6a5850daa474e (commit)]

* [PATCH] BLOCK: Move the ReiserFS device ioctl compat stuff to the ReiserFS driver [try #6]: Move the ReiserFS device ioctl compat stuff from fs/compat_ioctl.c to the

ReiserFS driver so that the ReiserFS header file doesn't need to be included.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=52b499c438ff60991eb3855ca090782569b3e8cf (commit)]

* [PATCH] BLOCK: Move the Ext2 device ioctl compat stuff to the Ext2 driver [try #6]: Move the Ext2 device ioctl compat stuff from fs/compat_ioctl.c to the Ext2

driver so that the Ext2 header file doesn't need to be included.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e322ff07fb2d0f05c02d85e7c6b30d23f308c20f (commit)]

* [PATCH] BLOCK: Move the msdos device ioctl compat stuff to the msdos driver [try #6]: Move the msdos device ioctl compat stuff from fs/compat_ioctl.c to the msdos

driver so that the msdos header file doesn't need to be included.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=188f83dfe0eeecd1427d0d255cc97dbf7ef6b4b7 (commit)]

* [PATCH] BLOCK: Move the Ext3 device ioctl compat stuff to the Ext3 driver [try #6]: Move the Ext3 device ioctl compat stuff from fs/compat_ioctl.c to the Ext3

driver so that the Ext3 header file doesn't need to be included.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=52a700c5675f399c07e6e57328291e57f13ef3bb (commit)]

* [PATCH] BLOCK: Move the loop device ioctl compat stuff to the loop driver [try #6]: Move the loop device ioctl compat stuff from fs/compat_ioctl.c to the loop

driver so that the loop header file doesn't need to be included.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=863d5b822c02d0e7215fb84ca79e9f8c3e35f04e (commit)]

* [PATCH] BLOCK: Remove no-longer necessary linux/buffer_head.h inclusions [try #6]: Remove inclusions of linux/buffer_head.h that are no longer necessary due to the

transfer of a number of things out of there.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d366e40a1cabd453be6e2609caa7e12f9ca17b1f (commit)]

* [PATCH] BLOCK: Remove no-longer necessary linux/mpage.h inclusions [try #6]: Remove inclusions of linux/mpage.h that are no longer necessary due to the

transfer of generic_writepages().

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cb50dc2eaeddb0bc20bc4cd108c4fec99f5045a (commit)]

* [PATCH] BLOCK: Make USB storage depend on SCSI rather than selecting it [try #6]: This makes CONFIG_USB_STORAGE depend on CONFIG_SCSI rather than selecting it,

as selecting it makes CONFIG_USB_STORAGE override the dependencies of SCSI, causing it to turn on even if they aren't all met.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=65934a9a028b88e83e2b0f8b36618fe503349f8e (commit)]

Filesystems

OCFS2

Add ext2 attributes - immutable, sync, append, noatime, dirsync - [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ca4d147e62df370c334898464023aa7f9126abe1 (commit)]; implement directory read-ahead [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=aa9588741db907785e4d92c8b768dd6c9077e6f0 (commit)]

CIFS

Legacy time handling for Win9x and OS/2 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1bd5bbcb6531776a8f73e2cc6287fc4dd542e1c7 (commit)]; support deep tree mounts (e.g. mounts to //server/share/path) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2fe87f02a04ad6e7075023a87fe38eb458a4bb9d (commit)]

NFS

Add server and volume lists to /proc [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6aaca566503296a73f956908ec98173946134fe2 (commit)]
Support of rsize/wsize of up to 1MB, over TCP (the limit over UDP remains at 32K) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7adae489fe794e3e203ff168595f635d0b845e59 (commit)]

SELinux

* [MLSXFRM]: Define new SELinux service routine: This defines a routine that combines the Type Enforcement portion of

one sid with the MLS portion from the other sid to arrive at a new sid. This would be used to define a sid for a security association that is to be negotiated by IKE as well as for determing the sid for open requests and connection-oriented child sockets.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=08554d6b33e60aa8ee40bbef94505941c0eefef2 (commit)]

* [MLSXFRM]: Add security context to acquire messages using PF_KEY: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using PF_KEY. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e2ba18eae7f370c7c3ed96eaca747cc9b39f917 (commit)]

* [MLSXFRM]: Granular IPSec associations for use in MLS environments: The current approach to labeling Security Associations for SELinux

purposes uses a one-to-one mapping between xfrm policy rules and security associations. This doesn't address the needs of real world MLS (Multi-level System,
traditional Bell-LaPadula) environments where a single xfrm policy rule (pertaining to a range, classified to secret for example) might need to map to multiple Security Associations (one each for classified, secret, top secret and all the compartments applicable to these security levels). This patch set addresses the above problem by allowing for the mapping of a single xfrm policy rule to multiple security associations, with each association used in the security context it is defined for. It also includes the security context to be used in IKE negotiation in the acquire messages sent to the IKE daemon so that a unique SA can be negotiated for each unique security context. A couple of bug fixes are also included; checks to make sure the SAs used by a packet match policy (security context-wise) on the inbound and also that the bundle used for the outbound matches the security context of the flow. This patch set also makes the use of the SELinux sid in flow cache lookups seemless by including the sid in the flow key itself. Also, open requests as well as connection-oriented child sockets are labeled automatically to be at the same level as the peer to allow for use of appropriately labeled IPSec associations.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=51bd39860ff829475aef611a3234309e37e090d9 (commit)]

* [MLSXFRM]: Add security sid to flowi: This adds security to flow key for labeling of flows as also to allow

for making flow cache lookups based on the security label seemless.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b6340fcd761acf9249b3acbc95c4dc555d9beb07 (commit)]

* [MLSXFRM]: Auto-labeling of child sockets: This automatically labels the TCP, Unix stream, and dccp child sockets

as well as openreqs to be at the same MLS level as the peer. This will result in the selection of appropriately labeled IPSec Security Associations. This also uses the sock's sid (as opposed to the isec sid) in SELinux enforcement of secmark in rcv_skb and postroute_last hooks.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf (commit)]

* [MLSXFRM]: Add flow labeling: This labels the flows that could utilize IPSec xfrms at the points the

flows are defined so that IPSec policy and SAs at the right label can be used. The following protos are currently not handled, but they should continue to be able to use single-labeled IPSec like they currently do. ipmr ip_gre ipip igmp sit sctp ip6_tunnel (IPv6 over IPv6 tunnel device) decnet

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=beb8d13bed80f8388f1a9a107d07ddd342e627e8 (commit)]

* [MLSXFRM]: Flow based matching of xfrm policy and state: This implements a seemless mechanism for xfrm policy selection and

state matching based on the flow sid. This also includes the necessary SELinux enforcement pieces.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e0d1caa7b0d5f02e4f34aa09c695d04251310c6c (commit)]

* [MLSXFRM]: Add security context to acquire messages using netlink: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using netlink/xfrm_user. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d681623d30c6565e8b62889f3aa3f4d4662c3e8 (commit)]

* [MLSXFRM]: Add security sid to sock: This adds security for IP sockets at the sock level. Security at the

sock level is needed to enforce the SELinux security policy for security associations even when a sock is orphaned (such as in the TCP LAST_ACK state). This will also be used to enforce SELinux controls over data arriving at or leaving a child socket while it's still waiting to be accepted.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=892c141e62982272b9c738b5520ad0e5e1ad7b42 (commit)]

* [MLSXFRM]: Default labeling of socket specific IPSec policies: This defaults the label of socket-specific IPSec policies to be the

same as the socket they are set on.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb969f072b6d67770b559617f14e767f47e77ece (commit)]

* [MLSXFRM]: Fix build with SECURITY_NETWORK_XFRM disabled.: The following patch will fix the build problem (encountered by Andrew

Morton) when SECURITY_NETWORK_XFRM is not enabled. As compared to git-net-selinux_xfrm_decode_session-build-fix.patch in -mm, this patch sets the return parameter sid to SECSID_NULL in selinux_xfrm_decode_session() and handles this value in the caller selinux_inet_conn_request() appropriately.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a51c64f1e5c2876eab2a32955acd9e8015c91c15 (commit)]

* [PATCH] selinux: add support for range transitions on object classes: Introduces support for policy version 21. This version of the binary

kernel policy allows for defining range transitions on security classes other than the process security class. As always, backwards compatibility for older formats is retained. The security class is read in as specified when using the new format, while the "process" security class is assumed when using an older policy format.
- Acked-by: James Morris <jmorris@namei.org>
Acked-by: Eric Paris <eparis@redhat.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3f8771420737004da55159c2f2dc0b6f483a4ef (commit)]

* [PATCH] selinux: enable configuration of max policy version: Enable configuration of SELinux maximum supported policy version to support

legacy userland (init) that does not gracefully handle kernels that support newer policy versions two or more beyond the installed policy, as in FC3 and FC4.
[bunk@stusta.de: improve Kconfig help text]
- Acked-by: James Morris <jmorris@namei.org>
Acked-by: Eric Paris <eparis@redhat.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=016b9bdb81d9c9c7800e4e224ade38d8b37669d3 (commit)]

* [PATCH] SELinux: support mls categories for context mounts: Allows commas to be embedded into context mount options (i.e. "-o

context=some_selinux_context_t"), to better support multiple categories, which are separated by commas and confuse mount. For example, with the current code:
- mount -t iso9660 /dev/cdrom /media/cdrom -o \ ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is context=system_u:object_r:iso9660_t:s0:c1 instead of context=system_u:object_r:iso9660_t:s0:c1,c3,c4 The options that will be passed on to the file system will be ro,c3,c4,exec. The proposed solution is to allow/require the SELinux context option specified to mount to use quotes when the context contains a comma. This patch modifies the option parsing in parse_opts(), contained in mount.c, to take options after finding a comma only if it hasn't seen a quote or if the quotes are matched. It also introduces a new function that will strip the quotes from the context option prior to translation. The quotes are replaced after the translation is completed to insure that in the event the raw context contains commas the kernel will be able to interpret the correct context.
- Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3528a95322b5c1ce882ab723f175a1845430cd89 (commit)]

Networking

* [IPV4]: Use Protocol Independant Policy Routing Rules Framework: [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e1ef4bf23b1ced0bf78a1c98289f746486e5c912 (commit)]

* [NetLabel]: core network changes: Changes to the core network stack to support the NetLabel subsystem. This

includes changes to the IPv4 option handling to support CIPSO labels.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=11a03f78fbf15a866ba3bf6359a75cdfd1ced703 (commit)] * [NetLabel]: core NetLabel subsystem: Add a new kernel subsystem, NetLabel, to provide explicit packet

labeling services (CIPSO, RIPSO, etc.) to LSM developers. NetLabel is designed to work in conjunction with a LSM to intercept and decode security labels on incoming network packets as well as ensure that outgoing network packets are labeled according to the security mechanism employed by the LSM. The NetLabel subsystem is configured through a Generic NETLINK interface described in the header files included in this patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d15c345fe3b8dfda0fa5a1d2143a35fffa746a43 (commit)]

* [NetLabel]: documentation: Documentation for the NetLabel system, this includes a basic overview

of how NetLabel works, how LSM developers can integrate it into their favorite LSM, as well as documentation on the CIPSO related sysctl variables. Also, due to the difficulty of finding expired IETF drafts, I am including the IETF CIPSO draft that is the basis of the NetLabel CIPSO implementation.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8802f616f6de8576805f32e47602816f141118f2 (commit)]

* [NetLabel]: SELinux support: Add NetLabel support to the SELinux LSM and modify the

socket_post_create() LSM hook to return an error code. The most
significant part of this patch is the addition of NetLabel hooks into the following SELinux LSM hooks:
- selinux_file_permission()
- selinux_socket_sendmsg()
- selinux_socket_post_create()
- selinux_socket_sock_rcv_skb()
- selinux_socket_getpeersec_stream()
- selinux_socket_getpeersec_dgram()
- selinux_sock_graft()
- selinux_inet_conn_request()
The basic reasoning behind this patch is that outgoing packets are
"NetLabel'd" by labeling their socket and the NetLabel security attributes are checked via the additional hook in selinux_socket_sock_rcv_skb(). NetLabel itself is only a labeling mechanism, similar to filesystem extended attributes, it is up to the SELinux enforcement mechanism to perform the actual access checks. In addition to the changes outlined above this patch also includes some changes to the extended bitmap (ebitmap) and multi-level security (mls) code to import and export SELinux TE/MLS attributes into and out
of NetLabel.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7420ed23a4f77480b5b7b3245e5da30dd24b7575 (commit)]

* [NetLabel]: tie NetLabel into the Kconfig system: Modify the net/Kconfig file to enable selecting the NetLabel Kconfig

options.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8161327311fe4da1684ed08015e141feb9a0a737 (commit)]

* [NetLabel]: CIPSOv4 engine: Add support for the Commercial IP Security Option (CIPSO) to the IPv4

network stack. CIPSO has become a de-facto standard for trusted/labeled networking amongst existing Trusted Operating Systems such as Trusted Solaris, HP-UX CMW, etc. This implementation is
designed to be used with the NetLabel subsystem to provide explicit packet labeling to LSM developers.
The CIPSO/IPv4 packet labeling works by the LSM calling a NetLabel API function which attaches a CIPSO label (IPv4 option) to a given socket; this in turn attaches the CIPSO label to every packet leaving the socket without any extra processing on the outbound side. On the inbound side the individual packet's sk_buff is examined through a call to a NetLabel API function to determine if a CIPSO/IPv4 label is present and if so the security attributes of the CIPSO label are returned to the caller of the NetLabel API function.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=446fda4f26822b2d42ab3396aafcedf38a9ff2b6 (commit)]

* [NET]: Replace CHECKSUM_HW by CHECKSUM_PARTIAL/CHECKSUM_COMPLETE: Replace CHECKSUM_HW by CHECKSUM_PARTIAL (for outgoing packets, whose

checksum still needs to be completed) and CHECKSUM_COMPLETE (for incoming packets, device supplied full checksum). Patch originally from Herbert Xu, updated by myself for 2.6.18-rc3.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=84fa7933a33f806bbbaae6775e87459b1ec584c0 (commit)]

* Add the framework to support multiple IPv6 routing tables [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c71099acce933455123ee505cc75964610a209ad (commit)]

* [NETFILTER]: Get rid of HW checksum invalidation: Update hardware checksums incrementally to avoid breaking GSO.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cf411de49c65140b3c259748629b561c0d3340f (commit)]

* Extend netlink messaging interface [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fe4944e59c357f945f81bc67edb7ed1392e875ad (commit)]

* Protocol Independant Policy Routing Rules Framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=14c0b97ddfc2944982d078b8e33b088840068976 (commit)]

* [NetLabel]: CIPSOv4 and Unlabeled packet integration: Add CIPSO/IPv4 and unlabeled packet management to the NetLabel

subsystem. The CIPSO/IPv4 changes allow the configuration of
CIPSO/IPv4 within the overall NetLabel framework. The unlabeled packet changes allows NetLabel to pass unlabeled packets without error.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96cb8e3313c7a12e026c1ed510522ae6f6023875 (commit)]

* [IPV6]: Policy Routing Rules: Adds support for policy routing rules including a new

local table for routes with a local destination.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=101367c2f8c464ea96643192673aa18d88e6336d (commit)]

* [NET]: Round out in-kernel sockets API: This patch implements wrapper functions that provide a convenient way

to access the sockets API for in-kernel users like sunrpc, cifs & ocfs2 etc and any future users.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ac5a488ef252ed673cb067843e411f8cc43f7ab9 (commit)]

* [IPV6]: Increase number of possible routing tables to 2^{32: Increase number of possible routing tables to 2}32 by replacing iterations

over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1b43af5480c351dbcb2eef478bafe179cbeb6e83 (commit)]

* [XFRM] STATE: Introduce route optimization mode.: Route optimization is used with routing header and destination options

header for Mobile IPv6. At outbound it makes header space like IPsec transport. At inbound it does nothing because exhdrs.c functions have responsibility to update skbuff information for these headers.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d71627d699eca831c1fbfb66ea67bb1fba41415 (commit)]

* [IPV4]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1af5a8c4a11cfed0c9a7f30fcfb689981750599c (commit)]

* [DECNET]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=abcab268303c22d24fc89fedd35d82271d20f5da (commit)]

* replace IPv4 dscp match by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ba1627617d396135a4d679542a3623d5819e628 (commit)]

* replace IPv4 DSCP target by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a468701db58a8b3e08e3f55fa6ac66db42014922 (commit)]

* [XFRM] POLICY: Add Kconfig to support sub policy.: Add Kconfig to support sub policy.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c11f1a15c522ddd3bbd2c32b5ce3e0b1831b22f2 (commit)]

* [DCCP]: Introduce tx buffering [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97e5848dd39e7e76bd6077735ebb5473763ab9c5 (commit)]

* [XFRM] POLICY: sub policy support.: Sub policy is introduced. Main and sub policy are applied the same flow.

(Policy that current kernel uses is named as main.) It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate. Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6. (Such usage as two IPsec policies on different database can be used, too.) Limitation or TODOs:
- - Sub policy is not supported for per socket one (it is always inserted as main). - Current kernel makes cached outbound with flowi to skip searching database.
  - However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e81bb8336a0ac50289d4d4c7a55e559b994ee8f (commit)]

* [IPV6] NDISC: Add proxy_ndp sysctl.: We do not always need proxy NDP functionality even we

enable forwarding.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fbea49e1e2404baa2d88ab47e2db89e49551b53b (commit)]

* [IPV6]: Add Kconfig to enable Mobile IPv6.: Add Kconfig to enable Mobile IPv6.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee53826801a8fa7a0e333895421ef6d0e5fbfbf0 (commit)]

* [IPV6] ADDRCONF: Mobile IPv6 Home Address support.: IFA_F_HOMEADDRESS is introduced for Mobile IPv6 Home Addresses on

Mobile Node. The IFA_F_HOMEADDRESS flag should be set for Mobile IPv6 Home Addresses for 2 purposes. 1) We need to check this on receipt of Type 2 Routing Header (RFC3775 Secion 6.4), 2) We prefer Home Address(es) in source address selection (RFC3484 Section 5 Rule 4).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3b9f9a1c3903b64c38505f9fed3bb11e48dbc931 (commit)]

* [IPV6] KCONFIG: Add subtrees support.: This is for developers only.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e96c2b4180aff4f080b77314712073c6ca430e7 (commit)]

* [TCP]: make cubic the default: Change default congestion control used from BIC to the newer CUBIC

which it the successor to BIC but has better properties over long delay links.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=597811ec167fa01c926a0957a91d9e39baa30e64 (commit)]

* [TCP]: default congestion control menu: Change how default TCP congestion control is chosen. Don't just use

last installed module, instead allow selection during configuration, and make sure and use the default regardless of load order.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3d2573f7ebe507e372a23cdd3c8b03305d6e90aa (commit)]

* [NETFILTER]: ebt_mark: add or/and/xor action support to mark target [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b18dfa90c008850e0f3bfd63638dd8fbe8e08701 (commit)]

* [XFRM]: BEET mode: This patch introduces the BEET mode (Bound End-to-End Tunnel) with as

specified by the ietf draft at the following link:
http://www.ietf.org/internet-drafts/draft-nikander-esp-beet-mode-06.txt The patch provides only single family support (i.e. inner family = outer family).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a69452cb45add0841c2bc1e75c25f6bd4f1d8d9 (commit)]

* [NetLabel]: add audit support for configuration changes: This patch adds audit support to NetLabel, including six new audit message

types shown below.
- #define AUDIT_MAC_UNLBL_ACCEPT 1406 #define AUDIT_MAC_UNLBL_DENY 1407 #define AUDIT_MAC_CIPSOV4_ADD 1408 #define AUDIT_MAC_CIPSOV4_DEL 1409 #define AUDIT_MAC_MAP_ADD 1410 #define AUDIT_MAC_MAP_DEL 1411
  - Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=32f50cdee666333168b5203c7864bede159f789e (commit)]

* [PKTGEN]: DSCP support: Anyway, I've been asked to add support for managing DSCP codepoints,

so one can test DiffServ capable routers. It's very simple code and is working for me.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1ca7768c87ac1393228857d576654f7e84c8cee6 (commit)]

* [PKTGEN]: vlan support: The attached patch allows pktgen to produce 802.1Q and Q-in-Q tagged frames.

I have used it for stress test a bridge and seems ok to me. Unfortunately I have no access to net-2.6.x git tree so the diff is against 2.6.17.13.
- Acked-by: Steven Whitehouse <steve@chygwyn.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=34954ddc4f3e790fb6d5ed331513f54b38713234 (commit)]

* [SCTP]: Enable Nagle algorithm by default.: This allows more aggressive bundling of chunks when sending small

messages.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=208edef6a5b6c50363c77efcf34c4b4020681029 (commit)]

Crypto

Add cryptomgr, a "cryptographic algorithm manager" [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b8c19dbdc692e81243a328725a02efb77b144a5 (commit)]
Add block cipher type. Unlike current cipher algorithms which operate on a single block at a time, block ciphers operate on an arbitrarily long linear area of data. As it is block-based, it will skip any data remaining at the end which cannot form a block [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5cde0af2a9825dd1edaca233bd9590566579ef21 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5c64097aa0f6dc4f27718ef47ca9a12538d62860 (commit)]. Also switch some cipher users to use block type [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db131ef9084110d9e82549c0a627e157e8bb99d7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cba83564d112e4aec52227f68670f8dbd4d4ac89 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=69affe7fc52c14e4b81408a2076e9e58ba4af60a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d1806f6a97a536b043fe50e6d8a25b061755cf50 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f12cc2090d721647c23dfce20834f4306db3b77d (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=28ce728a90cce3a0c6c0ed00354299de52db94b1 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=378c6697a282c383d89428380a3405bf95189347 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6b7326c8497f954c2cfcb4c49fe42be5b80887bc (commit)]
Support for SHA1 / SHA256 algorithms in VIA C7 processors [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6c833275152b454d311f0e70b5e6bf028b4a2aaf (commit)], add twofish x86-64 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eaf44088ff467410dd15a033fef118888002ffe6 (commit)] and a i586 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9f535ffe38f7eb61ac2219d32d97c377b69f70d (commit)]

CPUFREQ

* add powersave_bias tunable. ondemand selects the minimum frequency that can retire a workload with negligible idle time -- ideally resulting in the highest performance/power efficiency with negligible performance impact. But on some systems and some workloads, this algorithm is more performance biased than necessary, and de-tuning it a bit to allow some performance impact can save measurable power. This patch adds a "powersave_bias" tunable to ondemand to allow it to reduce its target frequency by a specified percent. By default, the powersave_bias is 0 and has no effect. powersave_bias is in units of 0.1%, so it has an effective range of 1 through 1000, resulting in 0.1% to 100% impact. In practice, users will not be able to detect a difference between 0.1% increments, but 1.0% increments turned out to be too large. Also, the max value of 1000 (100%) would simply peg the system in its deepest power saving P-state, unless the processor really has a hardware P-state at 0Hz:-)

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05ca0350e8caa91a5ec9961c585c98005b6934ea (commit)]

* Longhaul - Disable arbiter [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=179da8e6e8903a8cdb19bb12672d50dc33f0fde6 (commit)], add voltage scaling to driver [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db44aaf3a2f599163c53ce96658aca688b3466f0 (commit)] * Longhaul - Add ignore_latency option [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6595413fc9453a211f4b5d5cc42f0bbf3daa615b (commit)]