Linux_2_6_19 - Linux Kernel Newbies

Important things (AKA: ''the cool stuff'')

GFS2

GFS2 is a clustering filesystem developed mainly by Red Hat (after [http://www.theregister.co.uk/2003/12/18/red_hat_sweetens_q3/ purchasing Sistina] and opening the source code). It's not the first: OCFS2, another clustering filesystem developed by Oracle, was already merged in [http://kernelnewbies.org/Linux_2_6_16 Linux 2.6.16]. Clustering filesystems allow to share a filesystem between several machines with no compromises. GFS includes his own DLM (distributed locking manager) and a userspace API interface for that DLM.

Like OCFS2 and like any other filesystem that wants to be merged in the linux kernel, GFS2 developers asked for submission long time ago. They were asked to fix things (even considering that GFS2 had already been developed at Sistina and it was already a stable final product), they submitted it again, they were asked to fix more things, and so on, for a long period of time. Their developers have fixed every thing they were asked to fix. Because of their hard work, GFS2 is now ready to be merged, nobody oposes to it, and everyone is happy, there're no flames or accusations anywhere. Amazing, isn't? In fact, 3 new filesystems are being merged in 2.6.19.

[http://sources.redhat.com/cluster/ GFS2 project page]; Source code [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/gfs2 for GFS2] (840 KB) and [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/dlm for the DLM] (384 KB)

EXT 4

EXT 4 is a evolution (not a redesign) of EXT3

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/jbd2 JBD2], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/ext4 EXT 4]

ECRYPTFS

Coming from IBM, ecryptfs aims to bring "enterprise level" file encryption to the masses.

"Oh no, another filesystem!". No, Ecryptfs is not a traditional filesystem: it doesn't implements his own disk format. From [http://lwn.net/Articles/156921/ this LWN article]:

The eCryptfs developers took the stacking approach, meaning that, rather than implement its own platter-level format, eCryptfs sits on top of another filesystem. It is, essentially, a sort of translation layer which makes encrypted file capabilities available. The system administrator can thus create encrypted filesystems on top of whatever filesystem is in use locally, or even over a network-mounted filesystem. [...] Rather than encrypt the filesystem as a whole, eCryptfs deals with each file individually

(Reading the rest of the [http://lwn.net/Articles/156921 LWN article] is recommended. There's also a [http://www.linuxsymposium.org/2005/linuxsymposium_procv1.pdf Ecryptfs paper from the 2005 Ottawa Symposium] - page 209 and onwards)

Is it better to encrypt the whole disk using cryptoloop/dmcrypt, or use ecryptfs? You decide. Ecryptfs avoids the overhead of a fully encrypted filesystem by only encrypting the files you really want to encrypt, and it also allows to encrypt different files in different ways. Ecryptfs tries to make file encryption available in a easy way for the masses. It "aims to combine the flexibility of GnuPG encryption with the transparency of a kernel service" [...] "Think of eCryptfs as a sort of 'gnupgfs'". If you're interested, you will find the userspace tools and more information available in the [http://ecryptfs.sourceforge.net/ ecryptfs sourceforge site]. You can also read the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/ecryptfs.txt Ecryptfs documentation] and the [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=237fead619984cc48818fe12ee0ceada3f55b012 Ecryptfs code] (232 KB).

Libata PATA (Parallel ATA) merge

By "Parallel ATA" we mean all the ATA/IDE controllers and drives that we have been using for years before SATA. Almost from the start, one of the objectives of some kernel hackers was to [http://marc.theaimsgroup.com/?l=linux-kernel&m=115514409104283&w=2 replace the IDE drivers available in drivers/ide] (everything under the "Device drivers -> ATA/ATAPI/MFM/RLL support" configuration menu) with a reimplementation on top of libata (i.e.: the "SATA layer"). Drivers/ide suffers from many ugly and obscure problems, and re-implementing it on top of libata has been much easier than fixing the unfixable drivers/ide mess - most of the porting work has been done by Alan Cox (a consequence of this PATA merge is that libata and all its SATA drivers have also been moved from drivers/scsi (available in the "Device drivers -> SCSI device support -> SCSI low-level drivers" submenu) to drivers/ata (now "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers"), and all the CONFIG_SCSI_FOOBAR options for the individual SATA drivers have been changed to CONFIG_FOOBAR, so this means you may need to reconfigure your SATA configuration options)

This means 2.6.19 may have two drivers for your PATA-base device: The old IDE driver under "Device drivers -> ATA/ATAPI/MFM/RLL support" and an alternative driver under "Device drivers -> Serial ATA (prod) and Parallel ATA (experimental) drivers" (along with the rest of the SATA drivers)

What one must you choose? Well, the safe option is using the old driver: The old drivers will continue working just as they did before. There'll be no changes if you continue using the old drivers.

What do the new libata-base PATA drivers offer to you?

First of all, because they're libata-based and libata is a well engineered and sane infrastructure, the drivers have much better quality, they're cleaner, they've much better error handling (much better behaviour when one of your drives dies suddenly or finds broken sectors), and they don't have some of the known design issues that the old drivers have (this is why people did all the work to move away from drivers/ide, they didn't do it just for fun)
Because they're newer, there are more bugs. For this release, they're "experimental". If you want to be safe, use the old drivers.
Really. There is a risk that the new drivers won't work for you, or may harm your data (unlikely, but not impossible). If you want to be safe, use the old drivers.
They support some chipsets not supported by drivers/ide. The cleaner design of libata allows for easier driver development and maintenance. In some cases it supports features that the old driver doesn't, for the same reasons.
Some IDE controllers are not supported or they aren't fully supported. Some of them because not all the IDE drivers have been ported to libata, but others because they're old and undocumented or because the libata PATA layer still doesn't support some of their features. There's no support for certain old serialized devices, for prehistoric CMD640 controllers or for host-protected-area yet.
Drives appear as /dev/sda, /dev/sr0, the old devices names won't work. You will need to change your boot parameters and your /etc/fstab parameters in order to get a working system with the new drivers. Again, this only happens if you use the new drivers, the old drivers continue working as they did before.

Eventually, the new libata-based PATA drivers will get more stable, so the old drivers in drivers/ide may get deleted as the new drivers fulfill all needs of the IDE users and becomes feature-complete. But this certainly won't happen anytime soon. No old drivers will be deleted if there's not a working libata-based replacement. You can read the latest [http://zeniv.linux.org.uk/~alan/IDE/STATUS.txt status report] written by Alan Cox. It'd certainly be useful if you could give it a try and report back how well it works to linux-kernel@vger.kernel.org or bugzilla.kernel.org - even if it works fine, it'll be useful to know what systems do work (be sure to include the necessary information mentioned in the previous status report). [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=drivers/ata (libata PATA code)]

Removal of selected OSS drivers

Since 2.6 was released, ALSA has been the "official" sound subsystem. OSS drivers were kept for compatibility - ALSA also implements a OSS compatibility layer. However, there's a big number of ALSA drivers and OSS drivers targetting exactly the same hardware. Usually, the OSS ones are undermaintained (or no maintained at all). And ALSA already implements OSS compatibility. So....

...it's possible to remove old OSS drivers, as long as there's a equivalent ALSA driver, and as long as that driver has no regressions that don't allow users to migrate (drivers with no ALSA equivalent or with know regressions have NOT been deleted). In 2.6.19, those OSS drivers are being removed. If when migrating users find something wrong in the ALSA drivers, they should report it in the [https://bugtrack.alsa-project.org ALSA bug tracking system] and work with developers to fix them. Yes, we know there're users that feel just fine with the OSS drivers, but it doesn't helps to the kernel to keep those old drivers around. By forcing people to migrate to ALSA drivers, the ALSA drivers will be improved and fixed. Overall, the linux sound subsystem will only get better. Many thanks to all the hackers that coded them.

A total of 1.79 MB of OSS drivers will be removed. To see a list of source files being removed, see [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d56b9b9c464a10ab1ee51a4c6190a2b57b8ef7a6 the commit link]. Hardware that is forced to use ALSA drivers include:

AD1980 AC97 plugin; ALI 5455; Alchemy Au1000 (MIPS); AWE32/SB32/AWE64 Wavetable driver; C-Media; Cirrus Logic-Crystal CS4281; Ensoniq ES1370/Asahi Kasei AK4531; ESS Technology Solo1 (ES1946); Fortemedia FM801; Gravis Ultrasound; ASP's and Lasi's Harmony sound chip; ICS2101 mixer of GUS v3.7; OPTi MAD16 compatible audio chips; ESS Maestro/Maestro-2/Maestro-2E/Maestro3/Allegro; Turtle Beach Maui and Tropez; Yamaha YMF701B aka OPL3-SA; RME9652/36 "Hammerfall" Driver; Aztech Sound Galaxy cards; S3 Sonic Vibes; Turtle Beach Wavefront Series (Maui, Tropez, Tropez Plus); Wavefront ICS2115 MIDI; Yamaha YMF7xx

AVR32 Architecture

2.6.19 adds support for the Atmel AVR32 architecture, implemented and supported by Atmel Corporation.

AVR32 is a new high-performance 32-bit RISC microprocessor core, designed for cost-sensitive embedded applications, with particular emphasis on low power consumption and high code density. The AVR32 architecture description, including the instruction set, can be found in the [http://www.atmel.com/dyn/resources/prod_documents/doc32000.pdf AVR32 Architecture Manual]. The Atmel AT32AP7000 is the first CPU implementing the AVR32 architecture; it features a 7-stage pipeline, 16KB instruction and data caches and a full Memory Management Unit and a large set of integrated peripherals ([http://www.atmel.com/dyn/resources/prod_documents/doc32003.pdf full data sheet]); while the CPU core implementation including caches and MMU is documented by the [http://www.atmel.com/dyn/resources/prod_documents/doc32001.pdf AVR32 AP Technical Reference]. Information about the AT32STK1000 development board can be found [http://www.atmel.com/dyn/products/tools_card.asp?tool_id=3918 here], including a BSP CD image, development tools (binaries and source/patches) and a root filesystem image suitable for booting from SD card. Alternatively, there's a preliminary "getting started" guide available at http://avr32linux.org/twiki/bin/view/Main/GettingStarted which provides links to the sources and patches you will need in order to set up a cross-compiling environment for avr32-linux

Source code can be found [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=arch/avr32 here (arch/av32)]

Other stuff

Arch-independent changes in the kernel core

Kbuild infrastructure: Add a new 'make headers_install_all' target [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6d71627581e96efb3717960b79fc2167a4617977 (commit)] and add a 'V=2 make' environment option, which prints why a target is rebuilt during the compile [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=45d506bd65e2e35881d8276c111b647807823d19 (commit)]
Sofware suspend: Add write-speed instrumentation [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3a4f7577c9ef393ca80c783f02ffbc125de771c7 (commit)] and read-speed instrumentation to see what bandwith we're achieving [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8c002494b55119a3fd1dddee83b4fb75cfda47e5 (commit)]; implement async read for faster swsusp resuming [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=546e0d271941dd1ff6961e2a1f7eac75f1fc277e (commit)] and switch the swsusp writeout code from 4k-at-a-time to 4MB-at-a-time for faster suspending [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ab954160350c91c77ae03740ef90458c3ad5412c (commit)]; introduce memory bitmaps for more efficient memory usage [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b788db79896ef2a5817b9395ad63573b254a6d93 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=940864ddabdb180e02041c4dcd46ba6f9eee732f (commit)], suspend infrastructure cleanup and extension [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c8265f51073bc8632a99de78d5fd19117ed78b7 (commit)]
Memory management:
- Allow the removal of ZONE_DMA32 for non x86_64 architectures and ZONE_HIGHMEM for arches not using highmem (like 64 bit architectures). While they're not used on those arches, they eat some memory and they've no sense on those platforms anyway [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=776ed98b842ee8551793f842fe028c8091f3633e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fb0e7942bdcbbd2f90e61cb4cfa4fa892a873f8a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e53ef38d05dd59ed281a35590e4a5b64d8ff4c52 (commit)]
- Tracking of dirty pages in shared writeable mmap()s [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d08b3851da41d0ee60851f2c75b118e1f7a5fc89 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=edc79b2a46ed854595e40edcf3f8b37f9f14aa3f (commit)]
- dynamic slab reclaim: currently slab reclaim is enabled by setting an explicit option in /proc/sys/vm/zone_reclaim_mode and its used as a final option if the freeing of unmapped file backed pages is not enough to free enough pages to allow a local allocation. However, that means that the slab can grow excessively and that most memory of a node may be used by slabs. This implements slab reclaim during zone reclaim (zone reclaim occurs if there is a danger of an off node allocation) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0ff38490c836dc379ff7ec45b10a15a662f4e5f6 (commit)]
- Add a new gfp flag GFP_THISNODE to avoid fallback to other nodes. This flag is essential if a kernel component requires memory to be located on a certain node [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9b819d204cf602eab1a53a9ec4b8d2ca51e02a1d (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=765c4507af71c39aba21006bbd3ec809fe9714ff (commit)], and use it in sys_move_pages() for not allowing fallbacks to another nodes [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3d99cfb5f46191fc68f1343feeb2cf835001f7d7 (commit)] and in the profiling code [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fbd98167e653535c5816be154f2149c0efa7757d (commit)]
- Zoned counters: Support NR_SLAB_RECLAIMABLE / NR_SLAB_UNRECLAIMABLE [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=972d1a7b140569084439a81265a0f15b74e924e0 (commit)]; add per-zone writeout counter [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e129b5c23c2b471d47f1c5d2b8b193fc2034af43 (commit)]
Introduce a architecture-independent mechanism for registering active regions of memory. The big benefit of this set of patches is a sizable reduction of architecture-specific code, some of which is very hairy. In this release x86, x86-64, ia64 and power platforms are ported to use this generic code [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c713216deebd95d2b0ab38fef8bb2361c0180c2d (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05e0caad3b7bd0d0fbeff980bca22f186241a501 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0e0b864e069c52a7b3e4a7da56e29b03a012fd75 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fb01439c5b778d5974a488c5d4fe85e6d0e18a68 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9c7cd6877cf8db15269163deda69392263124c1e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c67c3cb4c99fb2ee63c8733943c353d745f45b84 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cfee88ad30acc47f02b8b7ba3db8556262dce1e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05e0caad3b7bd0d0fbeff980bca22f186241a501 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5cb248abf5ab65ab543b2d5fc16c738b28031fc0 (commit)]
Block layer
- Allow file systems to differentiate between data and meta reads, so that the kernel can use this information for making more intelligent priority decisions and for blktrace [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5404bc7a87b9949cf61e0174b21f80e73239ab25 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=374f84ac39ec7829a57a66efd5125d3561ff0e00 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=caa38fb0f481a3cb732b115cb59bfa6b59b6daaf (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7457e6e2d7406c7009e9ad03db1335fe93b5fb71 (commit)]
- Make it possible to disable the block layer. Not all embedded devices require it, some can make do with just JFFS2, NFS, ramfs, etc - none of which require the block layer to be present [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9361401eb7619c033e2394e4f9f6d410d6719ac7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=51d7513a8a54e4210d358ff1dbd34daab99a6638 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cf9a2ae8d49948f861b56e5333530e491a9da190 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d67a46df0125e20d14f12dbd3646f1f1bf23e8c (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b398f6bff93a247d2a7099e92905374966e4558f (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=811d736f9e8013966e1a5a930c0db09508bdbb15 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=07f3f05c1e3052b8656129b2a5aca9f888241a34 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=831058dec3735665fe91bd0d37b6a8cf56b91abd (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7b0de42d7c5a471741ede4e71727d88000e6ea59 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=65e6f5bc8149165efb9d7bdbd142bb837d5edfeb (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b71e8a4ce03b3098c7801ee5e6e08d1a39a226c2 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=36695673b012096228ebdc1b39a6a5850daa474e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=52b499c438ff60991eb3855ca090782569b3e8cf (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e322ff07fb2d0f05c02d85e7c6b30d23f308c20f (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=188f83dfe0eeecd1427d0d255cc97dbf7ef6b4b7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=52a700c5675f399c07e6e57328291e57f13ef3bb (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=863d5b822c02d0e7215fb84ca79e9f8c3e35f04e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d366e40a1cabd453be6e2609caa7e12f9ca17b1f (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cb50dc2eaeddb0bc20bc4cd108c4fec99f5045a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=65934a9a028b88e83e2b0f8b36618fe503349f8e (commit)]
Various
- Add the pm_trace attribute in /sys/power which has to be explicitly set to one to really enable the "PM tracing" code compiled in when CONFIG_PM_TRACE is set (which modifies the machine's CMOS clock in unpredictable ways) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c5c6ba4e08ab9c9e390a0f3a7d9a5c332f5cc6ef (commit)]
- Make it possible to disable console suspending (CONFIG_DISABLE_CONSOLE_SUSPEND) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c8eb8b4025175f967af0ba8e933f23aa9954dc35 (commit)]
- Driver core: create devices/virtual/ tree [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c205ef4880273d2de4ee5388d4e52227ff688cc4 (commit)]

* Driver Core: add ability for drivers to do a threaded probe [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d779249ed4cb3b50690de6de8448829d65a1cd08 (commit)]

* enable driver multi-threaded probe [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0f397f865076e3471ec884ee73ad5e34165fac2a (commit)]

* PCI-Express AER (Advanced Error Reporting [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=47402400c6496dd114463deb3a2ba2d64055284e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6c2b374d74857e892080ee726184ec1d15e7d4e4 (commit)]

* Single bit flip detector. In cases where we detect a single bit has been flipped, we spew the usual slab corruption message, which users instantly think is a kernel bug. In a lot of cases, single bit errors are down to bad memory, or other hardware failure, so suggest users to run memtest86 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=aa83aa40ed2ae113d9ee5529cdd9e8c0e5fabe61 (commit)]

* lockdep: core, add enable/disable_irq_irqsave/irqrestore() APIs [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e8106b941ceab68cc5ff713df7b1276484554584 (commit)]

* Add infrastructure to track "maximum allowable latency" for power saving policies. The reason for adding this infrastructure is that power management in the idle loop needs to make a tradeoff between latency and power savings (deeper power save modes have a longer latency to running code again). The code that today makes this tradeoff just does a rather simple algorithm; however this is not good enough: There are devices and use cases where a lower latency is required than that the higher power saving states provide. An example would be audio playback, but another example is the ipw2100 wireless driver that right now has a very direct and ugly acpi hook to disable some higher power states randomly when it gets certain types of error. The proposed solution is to have an interface where drivers can 1) announce the maximum latency (in microseconds) that they can deal with 2) modify this latency 3) give up their constraint [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5c87579e65ee4f419b2369407f82326d38b5d2d8 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9442e691e4aec85eba43ac60a3e77c77fd2e73a4 (commit)]

* Generic boolean. The kernel hackers have finally surrended at it. $DEITY help us! [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6e21828743247270d09a86756a0c11702500dbfb (commit)]

* Directed yield: cpu_relax variants for spinlocks and rw-locks. On systems running with virtual cpus there is optimization potential in regard to spinlocks and rw-locks. If the virtual cpu that has taken a lock is known to a cpu that wants to acquire the same lock it is beneficial to yield the timeslice of the virtual cpu in favour of the cpu that has the lock (directed yield) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ef6edc9746dc2bfdacf44eefd5f881179971c478 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cdc39363d33506b0e067d41fc91f89d186bdf7f7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3c1fcfe229e99752c74efb945a4a3f560be04204 (commit)]

* EISA bus MODALIAS attributes support [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=07563c711fbc25389e58ab9c9f0b9de2fce56760 (commit)]

* Add vector AIO support [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eed4e51fb60c3863c134a5e9f6006b29805ead97 (commit)], vectorize aio_read/aio_write fileop methods [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=027445c37282bc1ed26add45e573ad2d3e4860a5 (commit)], remove readv/writev methods and use aio_read/aio_write instead [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee0b3e671baff681d69fbf0db33b47603c0a8280 (commit)], streamline generic_file_* interfaces and filemap cleanups [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=543ade1fc901db4c3dbe9fb27241fb977f1f3eea (commit)]

* Debug variants of linked list macros [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=199a9afc3dbe98c35326f1d3907ab94dae953a6e (commit)] * list_del debug check [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=df89a864631f5d840f4873c4c03733b4206e78ea (commit)] * add CONFIG_ENABLE_MUST_CHECK [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cebc04ba9aeb3a646cc746300421fc0e5aa4f253 (commit)]

* csa: This patch is to change those ifdef's from CONFIG_BSD_PROCESS_ACCT to CONFIG_TASK_XACCT [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8f0ab5147951267134612570604cf8341901a80c (commit)]

csa: basic accounting over taskstats [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3cef7a99469afc159fec3a61b42dc7ca5b6824f (commit)]
csa: Extended system accounting over taskstats [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9acc1853519a0473620d424105f9d49ea5b4e62e (commit)]
csa accounting taskstats update [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db5fed26b2e0beed939b773dd5896077a1794d65 (commit)]

* Support piping into commands in /proc/sys/kernel/core_pattern [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d025c9db7f31fc0554ce7fb2dfc78d35a77f3487 (commit)]

* Linux Kernel Dump Test Module, a simple module to test Linux Kernel Dump mechanism that allows users to crash their kernel in different ways. Linux is getting so good, we need a kernel module to remember the old days [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8bb31b9d5340ed3dfef45d322f59fcf18a0d598b (commit)]

* kconfig/menuconfig: lxdialog is now built-in: lxdialog was previously called as an external program causing screen to flicker when used. With this patch lxdialog is now built-in [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2982de6993e6d9944f2215d7cb9b558b465a0c99 (commit)], add support for color themes and add blackbg theme [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=458972132a705c4a869002354f7f10f395d08c18 (commit)], add a new theme bluetitle which is now default [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=350b5b76384e77bcc58217f00455fdbec5cac594 (commit)], support resize [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c8dc68ad0fbd934e78e913b8a8d7b45945db4930

* srcu-3: RCU variant permitting read-side blocking [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=621934ee7ed5b073c7fd638b347e632c53572761 (commit)] * [PATCH] Add SRCU-based notifier chains [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eabc069401bcf45bcc3f19e643017bf761780aa8 (commit)]

Architecture-specific changes

x86 32/64

* Add SMP support on x86_64 and i386 to reservation framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f2802e7f571c05f9a901b1f5bd144aa730ccc88e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b7471c6da94d30d3deadc55986cc38d1ff57f9ca (commit)] * i386: Utilize performance counter reservation framework in oprofile [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb9c448c661d40ce2efbce8e9c19cc4d420d8ccc (commit)] * x86: Add performance counter reservation framework for UP kernels [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=828f0afda123a96ff4e8078f057a302f4b4232ae (commit)]

* Add ability to enable/disable nmi watchdog with sysctl (/proc/sys/kernel/nmi) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=407984f1af259b31957c7c05075a454a751bb801 (commit)]

* x86: Add abilty to enable/disable nmi watchdog from procfs (/proc/sys/kernel/nmi_watchdog) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e33e89ab1a8d295de0500b697f4f31c3ceee9aa2 (commit)]

* Add the vgetcpu vsyscall: This patch adds a vgetcpu vsyscall, which depending on the CPU RDTSCP capability uses either the RDTSCP or CPUID to obtain a CPU and node numbers and pass them to the program [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c08c820508233b424deab3302bc404bbecc6493a (commit)]

* x86: Allow users to force a panic on NMI [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8da5adda91df3d2fcc5300e68da491694c9af019 (commit)]

* x86: Add portable getcpu call [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3cfc348bf90ffaa777c188652aa297f04eb94de8 (commit)]

* i386: Support physical cpu hotplug for x86_64 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=73fea175303926055440c06bc8894f0c5c58afc8 (commit)]

* i386: Enable NMI watchdog by default for systems newer than 2004 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1de84979dfc527c422abf63f27beabe43892989b (commit)]

* Enable memory hot-add in x86-64 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4942e998b40b8f6080930ec16442444e9930aee5 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8c2676a5870ab15cbeea9f826266bc946fe3cc26 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec69acbb1191df671ff8e07c8e146619a5c53f70 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=53947027ad90542ddb2bb746e3175827c270610a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f28c5edc06ecd8068b38b7662ad19f4d20d741af (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=71efa8fdc55e70ec6687c897a30759f0a2c2ad7e (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=45e0b78b0532f92c01e363dd4287617c5be4574f (commit)],

* [PATCH] convert i386 NUMA KVA space to bootmem [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=91023300057e96de7f46e95166a3e02394ae72f9 (commit)]

* enable VMSPLIT for highmem kernels [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=753b9f86e7aef76c2beda32668ce528f90cb1733 (commit)] * Add a bootparameter to reserve high linear address space [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=461a9afff5e731d6337c0f5b08a1e727ccd57e0a (commit)]

* Allow compiling the kernel with the -fstack-protector GCC option. You need a GCC 4.2 compiler [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a4254058037eb172758961d0a5b94f4320a1425 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b62a5c740df1e3d49a97349fce0c6a23f633d7fe (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3162f751d04086a9d006342de63ac8f44fe0f72a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4f7fd4d7a79193ceda4ce77f75e22917d33fa154 (commit)]

* Non lazy "sleazy" fpu implementation. Right now the kernel on x86-64 has a 100% lazy fpu behavior: after *every* context switch a trap is taken for the first FPU use to restore the FPU context lazily. This is great for applications that have very sporadic or no FPU use (since then you avoid doing the expensive save/restore all the time). However for very frequent FPU users... you take an extra trap every context switch. So 2.6.19 adds a simple heuristic to this code: After 5 consecutive context switches of FPU use, the lazy behavior is disabled and the context gets restored every context switch. If the app indeed uses the FPU, the trap is avoided. (the chance of the 6th time slice using FPU after the previous 5 having done so are quite high obviously). After 256 switches, this is reset and lazy behavior is returned (until there are 5 consecutive ones again) [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e07e23e1fd3000289fc7ccc6c71879070d3b19e0 (commit)] * x86: Allow disabling early pci scans with pci=noearly or disallowing conf1 [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0637a70a5db98182d9ad3d6ae1ee30acf20afde9 (commit)]

* x86 microcode: add sysfs and hotplug support [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9a4b9efa1d39d7d31bed08fbe5a9b2a03b2759d4 (commit)]

SELinux

* [MLSXFRM]: Define new SELinux service routine: This defines a routine that combines the Type Enforcement portion of

one sid with the MLS portion from the other sid to arrive at a new sid. This would be used to define a sid for a security association that is to be negotiated by IKE as well as for determing the sid for open requests and connection-oriented child sockets.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=08554d6b33e60aa8ee40bbef94505941c0eefef2 (commit)]

* [MLSXFRM]: Add security context to acquire messages using PF_KEY: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using PF_KEY. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e2ba18eae7f370c7c3ed96eaca747cc9b39f917 (commit)]

* [MLSXFRM]: Granular IPSec associations for use in MLS environments: The current approach to labeling Security Associations for SELinux

purposes uses a one-to-one mapping between xfrm policy rules and security associations. This doesn't address the needs of real world MLS (Multi-level System,
traditional Bell-LaPadula) environments where a single xfrm policy rule (pertaining to a range, classified to secret for example) might need to map to multiple Security Associations (one each for classified, secret, top secret and all the compartments applicable to these security levels). This patch set addresses the above problem by allowing for the mapping of a single xfrm policy rule to multiple security associations, with each association used in the security context it is defined for. It also includes the security context to be used in IKE negotiation in the acquire messages sent to the IKE daemon so that a unique SA can be negotiated for each unique security context. A couple of bug fixes are also included; checks to make sure the SAs used by a packet match policy (security context-wise) on the inbound and also that the bundle used for the outbound matches the security context of the flow. This patch set also makes the use of the SELinux sid in flow cache lookups seemless by including the sid in the flow key itself. Also, open requests as well as connection-oriented child sockets are labeled automatically to be at the same level as the peer to allow for use of appropriately labeled IPSec associations.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=51bd39860ff829475aef611a3234309e37e090d9 (commit)]

* [MLSXFRM]: Add security sid to flowi: This adds security to flow key for labeling of flows as also to allow

for making flow cache lookups based on the security label seemless.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b6340fcd761acf9249b3acbc95c4dc555d9beb07 (commit)]

* [MLSXFRM]: Auto-labeling of child sockets: This automatically labels the TCP, Unix stream, and dccp child sockets

as well as openreqs to be at the same MLS level as the peer. This will result in the selection of appropriately labeled IPSec Security Associations. This also uses the sock's sid (as opposed to the isec sid) in SELinux enforcement of secmark in rcv_skb and postroute_last hooks.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf (commit)]

* [MLSXFRM]: Add flow labeling: This labels the flows that could utilize IPSec xfrms at the points the

flows are defined so that IPSec policy and SAs at the right label can be used. The following protos are currently not handled, but they should continue to be able to use single-labeled IPSec like they currently do. ipmr ip_gre ipip igmp sit sctp ip6_tunnel (IPv6 over IPv6 tunnel device) decnet

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=beb8d13bed80f8388f1a9a107d07ddd342e627e8 (commit)]

* [MLSXFRM]: Flow based matching of xfrm policy and state: This implements a seemless mechanism for xfrm policy selection and

state matching based on the flow sid. This also includes the necessary SELinux enforcement pieces.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e0d1caa7b0d5f02e4f34aa09c695d04251310c6c (commit)]

* [MLSXFRM]: Add security context to acquire messages using netlink: This includes the security context of a security association created

for use by IKE in the acquire messages sent to IKE daemons using netlink/xfrm_user. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d681623d30c6565e8b62889f3aa3f4d4662c3e8 (commit)]

* [MLSXFRM]: Add security sid to sock: This adds security for IP sockets at the sock level. Security at the

sock level is needed to enforce the SELinux security policy for security associations even when a sock is orphaned (such as in the TCP LAST_ACK state). This will also be used to enforce SELinux controls over data arriving at or leaving a child socket while it's still waiting to be accepted.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=892c141e62982272b9c738b5520ad0e5e1ad7b42 (commit)]

* [MLSXFRM]: Default labeling of socket specific IPSec policies: This defaults the label of socket-specific IPSec policies to be the

same as the socket they are set on.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cb969f072b6d67770b559617f14e767f47e77ece (commit)]

* [MLSXFRM]: Fix build with SECURITY_NETWORK_XFRM disabled [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a51c64f1e5c2876eab2a32955acd9e8015c91c15 (commit)]

* [PATCH] selinux: add support for range transitions on object classes: Introduces support for policy version 21. This version of the binary

kernel policy allows for defining range transitions on security classes other than the process security class. As always, backwards compatibility for older formats is retained. The security class is read in as specified when using the new format, while the "process" security class is assumed when using an older policy format.
- Acked-by: James Morris <jmorris@namei.org>
Acked-by: Eric Paris <eparis@redhat.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3f8771420737004da55159c2f2dc0b6f483a4ef (commit)]

* [PATCH] selinux: enable configuration of max policy version: Enable configuration of SELinux maximum supported policy version to support

legacy userland (init) that does not gracefully handle kernels that support newer policy versions two or more beyond the installed policy, as in FC3 and FC4.
[bunk@stusta.de: improve Kconfig help text]
- Acked-by: James Morris <jmorris@namei.org>
Acked-by: Eric Paris <eparis@redhat.com>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=016b9bdb81d9c9c7800e4e224ade38d8b37669d3 (commit)]

* [PATCH] SELinux: support mls categories for context mounts: Allows commas to be embedded into context mount options (i.e. "-o

context=some_selinux_context_t"), to better support multiple categories, which are separated by commas and confuse mount. For example, with the current code:
- mount -t iso9660 /dev/cdrom /media/cdrom -o \ ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is context=system_u:object_r:iso9660_t:s0:c1 instead of context=system_u:object_r:iso9660_t:s0:c1,c3,c4 The options that will be passed on to the file system will be ro,c3,c4,exec. The proposed solution is to allow/require the SELinux context option specified to mount to use quotes when the context contains a comma. This patch modifies the option parsing in parse_opts(), contained in mount.c, to take options after finding a comma only if it hasn't seen a quote or if the quotes are matched. It also introduces a new function that will strip the quotes from the context option prior to translation. The quotes are replaced after the translation is completed to insure that in the event the raw context contains commas the kernel will be able to interpret the correct context.
- Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3528a95322b5c1ce882ab723f175a1845430cd89 (commit)]

Networking

* [IPV4]: Use Protocol Independant Policy Routing Rules Framework: [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e1ef4bf23b1ced0bf78a1c98289f746486e5c912 (commit)]

* [NetLabel]: core network changes: Changes to the core network stack to support the NetLabel subsystem. This

includes changes to the IPv4 option handling to support CIPSO labels.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=11a03f78fbf15a866ba3bf6359a75cdfd1ced703 (commit)] * [NetLabel]: core NetLabel subsystem: Add a new kernel subsystem, NetLabel, to provide explicit packet

labeling services (CIPSO, RIPSO, etc.) to LSM developers. NetLabel is designed to work in conjunction with a LSM to intercept and decode security labels on incoming network packets as well as ensure that outgoing network packets are labeled according to the security mechanism employed by the LSM. The NetLabel subsystem is configured through a Generic NETLINK interface described in the header files included in this patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d15c345fe3b8dfda0fa5a1d2143a35fffa746a43 (commit)]

* [NetLabel]: documentation: Documentation for the NetLabel system, this includes a basic overview

of how NetLabel works, how LSM developers can integrate it into their favorite LSM, as well as documentation on the CIPSO related sysctl variables. Also, due to the difficulty of finding expired IETF drafts, I am including the IETF CIPSO draft that is the basis of the NetLabel CIPSO implementation.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8802f616f6de8576805f32e47602816f141118f2 (commit)]

* [NetLabel]: SELinux support: Add NetLabel support to the SELinux LSM and modify the

socket_post_create() LSM hook to return an error code. The most
significant part of this patch is the addition of NetLabel hooks into the following SELinux LSM hooks:
- selinux_file_permission()
- selinux_socket_sendmsg()
- selinux_socket_post_create()
- selinux_socket_sock_rcv_skb()
- selinux_socket_getpeersec_stream()
- selinux_socket_getpeersec_dgram()
- selinux_sock_graft()
- selinux_inet_conn_request()
The basic reasoning behind this patch is that outgoing packets are
"NetLabel'd" by labeling their socket and the NetLabel security attributes are checked via the additional hook in selinux_socket_sock_rcv_skb(). NetLabel itself is only a labeling mechanism, similar to filesystem extended attributes, it is up to the SELinux enforcement mechanism to perform the actual access checks. In addition to the changes outlined above this patch also includes some changes to the extended bitmap (ebitmap) and multi-level security (mls) code to import and export SELinux TE/MLS attributes into and out
of NetLabel.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7420ed23a4f77480b5b7b3245e5da30dd24b7575 (commit)]

* [NetLabel]: tie NetLabel into the Kconfig system: Modify the net/Kconfig file to enable selecting the NetLabel Kconfig

options.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8161327311fe4da1684ed08015e141feb9a0a737 (commit)]

* [NetLabel]: CIPSOv4 engine: Add support for the Commercial IP Security Option (CIPSO) to the IPv4

network stack. CIPSO has become a de-facto standard for trusted/labeled networking amongst existing Trusted Operating Systems such as Trusted Solaris, HP-UX CMW, etc. This implementation is
designed to be used with the NetLabel subsystem to provide explicit packet labeling to LSM developers.
The CIPSO/IPv4 packet labeling works by the LSM calling a NetLabel API function which attaches a CIPSO label (IPv4 option) to a given socket; this in turn attaches the CIPSO label to every packet leaving the socket without any extra processing on the outbound side. On the inbound side the individual packet's sk_buff is examined through a call to a NetLabel API function to determine if a CIPSO/IPv4 label is present and if so the security attributes of the CIPSO label are returned to the caller of the NetLabel API function.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=446fda4f26822b2d42ab3396aafcedf38a9ff2b6 (commit)]

* [NET]: Replace CHECKSUM_HW by CHECKSUM_PARTIAL/CHECKSUM_COMPLETE: Replace CHECKSUM_HW by CHECKSUM_PARTIAL (for outgoing packets, whose

checksum still needs to be completed) and CHECKSUM_COMPLETE (for incoming packets, device supplied full checksum). Patch originally from Herbert Xu, updated by myself for 2.6.18-rc3.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=84fa7933a33f806bbbaae6775e87459b1ec584c0 (commit)]

* Add the framework to support multiple IPv6 routing tables [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c71099acce933455123ee505cc75964610a209ad (commit)]

* [NETFILTER]: Get rid of HW checksum invalidation: Update hardware checksums incrementally to avoid breaking GSO.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4cf411de49c65140b3c259748629b561c0d3340f (commit)]

* Extend netlink messaging interface [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fe4944e59c357f945f81bc67edb7ed1392e875ad (commit)]

* Protocol Independant Policy Routing Rules Framework [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=14c0b97ddfc2944982d078b8e33b088840068976 (commit)]

* [NetLabel]: CIPSOv4 and Unlabeled packet integration: Add CIPSO/IPv4 and unlabeled packet management to the NetLabel

subsystem. The CIPSO/IPv4 changes allow the configuration of
CIPSO/IPv4 within the overall NetLabel framework. The unlabeled packet changes allows NetLabel to pass unlabeled packets without error.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=96cb8e3313c7a12e026c1ed510522ae6f6023875 (commit)]

* [IPV6]: Policy Routing Rules: Adds support for policy routing rules including a new

local table for routes with a local destination.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=101367c2f8c464ea96643192673aa18d88e6336d (commit)]

* [NET]: Round out in-kernel sockets API: This patch implements wrapper functions that provide a convenient way

to access the sockets API for in-kernel users like sunrpc, cifs & ocfs2 etc and any future users.
- Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ac5a488ef252ed673cb067843e411f8cc43f7ab9 (commit)]

* [IPV6]: Increase number of possible routing tables to 2^{32: Increase number of possible routing tables to 2}32 by replacing iterations

over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1b43af5480c351dbcb2eef478bafe179cbeb6e83 (commit)]

* [XFRM] STATE: Introduce route optimization mode.: Route optimization is used with routing header and destination options

header for Mobile IPv6. At outbound it makes header space like IPsec transport. At inbound it does nothing because exhdrs.c functions have responsibility to update skbuff information for these headers.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d71627d699eca831c1fbfb66ea67bb1fba41415 (commit)]

* [IPV4]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1af5a8c4a11cfed0c9a7f30fcfb689981750599c (commit)]

* [DECNET]: Increase number of possible routing tables to 2^{32: Increase the number of possible routing tables to 2}32 by replacing the

fixed sized array of pointers by a hash table and replacing iterations over all possible table IDs by hash table walking.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=abcab268303c22d24fc89fedd35d82271d20f5da (commit)]

* replace IPv4 dscp match by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ba1627617d396135a4d679542a3623d5819e628 (commit)]

* replace IPv4 DSCP target by address family independent (x_tables) version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a468701db58a8b3e08e3f55fa6ac66db42014922 (commit)]

* [XFRM] POLICY: Add Kconfig to support sub policy.: Add Kconfig to support sub policy.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c11f1a15c522ddd3bbd2c32b5ce3e0b1831b22f2 (commit)]

* [DCCP]: Introduce tx buffering [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97e5848dd39e7e76bd6077735ebb5473763ab9c5 (commit)]

* [XFRM] POLICY: sub policy support.: Sub policy is introduced. Main and sub policy are applied the same flow.

(Policy that current kernel uses is named as main.) It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate. Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6. (Such usage as two IPsec policies on different database can be used, too.) Limitation or TODOs:
- - Sub policy is not supported for per socket one (it is always inserted as main). - Current kernel makes cached outbound with flowi to skip searching database.
  - However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e81bb8336a0ac50289d4d4c7a55e559b994ee8f (commit)]

* [IPV6] NDISC: Add proxy_ndp sysctl.: We do not always need proxy NDP functionality even we

enable forwarding.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fbea49e1e2404baa2d88ab47e2db89e49551b53b (commit)]

* [IPV6]: Add Kconfig to enable Mobile IPv6.: Add Kconfig to enable Mobile IPv6.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee53826801a8fa7a0e333895421ef6d0e5fbfbf0 (commit)]

* [IPV6] ADDRCONF: Mobile IPv6 Home Address support.: IFA_F_HOMEADDRESS is introduced for Mobile IPv6 Home Addresses on

Mobile Node. The IFA_F_HOMEADDRESS flag should be set for Mobile IPv6 Home Addresses for 2 purposes. 1) We need to check this on receipt of Type 2 Routing Header (RFC3775 Secion 6.4), 2) We prefer Home Address(es) in source address selection (RFC3484 Section 5 Rule 4).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3b9f9a1c3903b64c38505f9fed3bb11e48dbc931 (commit)]

* [IPV6] KCONFIG: Add subtrees support.: This is for developers only.

Based on MIPL2 kernel patch.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e96c2b4180aff4f080b77314712073c6ca430e7 (commit)]

* [TCP]: make cubic the default http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=597811ec167fa01c926a0957a91d9e39baa30e64 (commit)]

* [TCP]: default congestion control menu: Change how default TCP congestion control is chosen. Don't just use

last installed module, instead allow selection during configuration, and make sure and use the default regardless of load order.

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3d2573f7ebe507e372a23cdd3c8b03305d6e90aa (commit)]

* [NETFILTER]: ebt_mark: add or/and/xor action support to mark target [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b18dfa90c008850e0f3bfd63638dd8fbe8e08701 (commit)]

* [XFRM]: BEET mode: This patch introduces the BEET mode (Bound End-to-End Tunnel) with as

specified by the ietf draft at the following link:
http://www.ietf.org/internet-drafts/draft-nikander-esp-beet-mode-06.txt The patch provides only single family support (i.e. inner family = outer family).

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a69452cb45add0841c2bc1e75c25f6bd4f1d8d9 (commit)]

* [NetLabel]: add audit support for configuration changes: This patch adds audit support to NetLabel, including six new audit message

types shown below.
- #define AUDIT_MAC_UNLBL_ACCEPT 1406 #define AUDIT_MAC_UNLBL_DENY 1407 #define AUDIT_MAC_CIPSOV4_ADD 1408 #define AUDIT_MAC_CIPSOV4_DEL 1409 #define AUDIT_MAC_MAP_ADD 1410 #define AUDIT_MAC_MAP_DEL 1411
  - Acked-by: James Morris <jmorris@namei.org>

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=32f50cdee666333168b5203c7864bede159f789e (commit)]

* [PKTGEN]: DSCP support [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1ca7768c87ac1393228857d576654f7e84c8cee6 (commit)], allow pktgen to produce 802.1Q and Q-in-Q tagged frames [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=34954ddc4f3e790fb6d5ed331513f54b38713234 (commit)]

* [SCTP]: Enable Nagle algorithm by default [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=208edef6a5b6c50363c77efcf34c4b4020681029 (commit)]

* [TIPC]: Added subscription cancellation capability [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eb409460b1abec0e2a1f9c9d07019f4157a6d6bc (commit)], add support for Ethernet VLANs [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3a8d12142eab420ffcbbf3d1d2e637158e85aab8 (commit)], added duplicate node address detection capability [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e91ed0bcdfc4812c0342d64281ee985213df07c3 (commit)]

Crypto

Add cryptomgr, a "cryptographic algorithm manager" [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2b8c19dbdc692e81243a328725a02efb77b144a5 (commit)]
Add block cipher type. Unlike current cipher algorithms which operate on a single block at a time, block ciphers operate on an arbitrarily long linear area of data. As it is block-based, it will skip any data remaining at the end which cannot form a block [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5cde0af2a9825dd1edaca233bd9590566579ef21 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5c64097aa0f6dc4f27718ef47ca9a12538d62860 (commit)]. Also switch some cipher users to use block type [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db131ef9084110d9e82549c0a627e157e8bb99d7 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cba83564d112e4aec52227f68670f8dbd4d4ac89 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=69affe7fc52c14e4b81408a2076e9e58ba4af60a (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d1806f6a97a536b043fe50e6d8a25b061755cf50 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f12cc2090d721647c23dfce20834f4306db3b77d (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=28ce728a90cce3a0c6c0ed00354299de52db94b1 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=378c6697a282c383d89428380a3405bf95189347 (commit)], [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6b7326c8497f954c2cfcb4c49fe42be5b80887bc (commit)]
Support for SHA1 / SHA256 algorithms in VIA C7 processors [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6c833275152b454d311f0e70b5e6bf028b4a2aaf (commit)], add twofish x86-64 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eaf44088ff467410dd15a033fef118888002ffe6 (commit)] and a i586 assembly version [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9f535ffe38f7eb61ac2219d32d97c377b69f70d (commit)]

CPUFREQ

* add powersave_bias tunable. ondemand selects the minimum frequency that can retire a workload with negligible idle time -- ideally resulting in the highest performance/power efficiency with negligible performance impact. But on some systems and some workloads, this algorithm is more performance biased than necessary, and de-tuning it a bit to allow some performance impact can save measurable power. This patch adds a "powersave_bias" tunable to ondemand to allow it to reduce its target frequency by a specified percent. By default, the powersave_bias is 0 and has no effect. powersave_bias is in units of 0.1%, so it has an effective range of 1 through 1000, resulting in 0.1% to 100% impact. In practice, users will not be able to detect a difference between 0.1% increments, but 1.0% increments turned out to be too large. Also, the max value of 1000 (100%) would simply peg the system in its deepest power saving P-state, unless the processor really has a hardware P-state at 0Hz:-)

[http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05ca0350e8caa91a5ec9961c585c98005b6934ea (commit)]

* Longhaul - Disable arbiter [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=179da8e6e8903a8cdb19bb12672d50dc33f0fde6 (commit)], add voltage scaling to driver [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db44aaf3a2f599163c53ce96658aca688b3466f0 (commit)] * Longhaul - Add ignore_latency option [http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6595413fc9453a211f4b5d5cc42f0bbf3daa615b (commit)]