KernelNewbies:

Linux kernel version 2.6.26 Released 13 July 2008 (full SCM git log)

Summary: 2.6.26 adds support for read-only bind mounts, x86 PAT (Page Attribute Tables), PCI Express ASPM (Active State Power Management), ports of KVM to IA64, S390 and PPC, other KVM improvements including basic paravirtualization support, preliminary support of the future 802.11s wireless mesh standard, much improved webcam support thanks to a driver for UVC devices, a built-in memory tester, a kernel debugger, BDI statistics and parameters exposure in /sys/class/bdi, a new /proc/PID/mountinfo file for more accurate information about mounts, per-process securebits, device white-list for containers users, support for the OLPC, some new drivers and many small improvements

Contents

  1. Important features (AKA: the cool stuff)
    1. Read-only bind mounts
    2. KVM ported to IA64, PPC and S390
    3. Improved webcam support
    4. Wireless mesh networking (802.11s) draft support
    5. x86 PAT support
    6. Per-process securebits
    7. KGDB
    8. Device whitelist on cgroups
    9. Memtest
    10. Export BDI attributes in sysfs
    11. /proc/pid/mountinfo
    12. Generic semaphores
  2. Subsystems
    1. Various
    2. Filesystems
    3. Networking
    4. Crypto
    5. Security
    6. KVM
  3. Architecture-specific changes
  4. Drivers
    1. IDE/SATA
    2. Networking
    3. Graphics
    4. Sound
    5. Input
    6. V4L/ DVB
    7. SCSI
    8. WATCHDOG
    9. HWMON
    10. USB
    11. FireWire
    12. Infiniband
    13. ACPI and Power Management
    14. MTD
    15. I2C
    16. Various

1. Important features (AKA: the cool stuff)

1.1. Read-only bind mounts

Recommended LWN article: "Read-only bind mounts"

Since 2.4.0 Linux has supported bind mounts. Bind mounts are a sort of directory symlinks that allow to share the contents of a directory in two different paths. For example, "mount --bind /foo /bar" will "bind" the contents of /foo not only to /foo, but also /bar. IOW, /foo and /bar would have the same content - and any modification in one directory is visible in the other. This has been useful for things like chroots or ftp/webservers, but until now, if /foo was writable, there was no way to stop /bar from being also writable.

In Linux 2.6.26, you can make those bind mounts read-only. If we made the bind mount in the previous example read-only, the contents of /foo would show up in /bar - but an application trying to modify a file in /bar will not be able to do it (/foo could continue being writable, of course). This has a number of uses. It allows chroots to have parts of filesystems writable. It's useful for containers because users may have root inside a container, but should not be allowed to write to some filesystems. It allows security enhancement by making sure that parts of your filesystem read-only (such as when you don't trust your FTP server), when you don't want to have entire new filesystems mounted, or when you want atime selectively updated.

(The current implementation does not allow to make a bind mount directly read-only: you need to make the bind mount first - mount --bind /foo /bar - and then remount the bind as ro - mount -o remount,ro /bar)

Code: commit 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22

1.2. KVM ported to IA64, PPC and S390

KVM, the virtualization solution included in Linux 2.6.20, has been rearchitected to give support to architectures other than x86: IA64 (Itanium), S390 and PPC

S390: (commit 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)

IA64: (commit 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)

PowerPC 440: (commit)

1.3. Improved webcam support

2.6.26 includes a driver that supports video input devices compliant with the USB Video Class specification. This means lots of currently manufactured webcams, and probably most of the future ones (commit)

1.4. Wireless mesh networking (802.11s) draft support

A year ago, in Linux 2.6.22, Linux included a new wireless stack. In 2.6.26 that stack is adding support for the draft of wireless mesh networking (802.11s), thanks to the open80211s project

Code: (commit 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17)

1.5. x86 PAT support

PAT (Page Attribute Table) is a feature found in x86 processors that allows for setting the memory attribute at the page level granularity. PAT is complementary to the MTRR settings which allows for setting of memory types over physical address ranges. However, PAT is more flexible than MTRR due to its capability to set attributes at page level and also due to the fact that there are no hardware limitations on number of such attribute settings allowed. It's not a very new feature: the Linux support for this has been in the works for a long time: the current patches are evolved from ones started in 2006, and there're traces of preliminary patches in 2001. Probably because it's not a critical feature and MTRRs did the job.

Documentation (commit) Code: (commit)

1.6. Per-process securebits

Recommended LWN article: "Per-process securebits"

Filesystem capability support makes it possible to do away with (set)uid-0 based privilege and use capabilities instead. That is, with filesystem support for capabilities but without this present feature, it is (conceptually) possible to manage a system with capabilities alone and never need to obtain privilege via (set)uid-0. Of course, conceptually isn't quite the same as currently possible since few user applications, certainly not enough to run a viable system, are currently prepared to leverage capabilities to exercise privilege. Further, many applications exist that may never get upgraded in this way, and the kernel will continue to want to support their setuid-0 base privilege needs. Where pure-capability applications evolve and replace setuid-0 binaries, it is desirable that there be a mechanisms by which they can contain their privilege. In addition to leveraging the per-process bounding and inheritable sets, this should include suppressing the privilege of the uid-0 superuser from the process' tree of children. The feature added in 2.6.26 can be leveraged to suppress the privilege associated with (set)uid-0. This suppression requires CAP_SETPCAP to initiate, and only immediately affects the 'current' process (it is inherited through fork()/exec()). This reimplementation differs significantly from the historical support for securebits which was system-wide, unwieldy and which has ultimately withered to a dead relic in the source of the modern kernel.

Code: (commit)

1.7. KGDB

For many years Linux has not included a kernel debugger. Linus Torvalds vetoed them for years, for reasons that he explained quite well in a known email: "When things crash and you fsck and you didn't even get a clue about what went wrong, you get frustrated. Tough. There are two kinds of reactions to that: you start being careful, or you start whining about a kernel debugger [...] I happen to believe that not having a kernel debugger forces people to think about their problem on a different level than with a debugger. I think that without a debugger, you don't get into that mindset where you know how it behaves, and then you fix it from there. Without a debugger, you tend to think about problems another way. You want to understand things on a different _level_."

Despite of those objections, many people wanted a debugger and KGDB is finally going in. It's a remote debugger, it needs two machines. x86 and sparc machines are supported

Code: (commit 1, 2, 3, 4, 5, 6, 7, 8)

1.8. Device whitelist on cgroups

Recommended LWN article: "Device whitelist on cgroups"

This feature implements a functionality wanted by some virtualization users: The ability to control the access to devices in a per-container basis. A cgroup is used to track and enforce open and mknod restrictions on device files. More details can be found in the commit link.

Code: (commit)

1.9. Memtest

Memtest is a commonly used tool for checking your memory. In 2.6.26 Linux is including his own in-kernel memory tester. The goal is not to replace memtest, in fact this tester is much simpler and less capable than memtest, but it's handy to have a built-in memory tester on every kernel. It's enabled easily with the "memtest" boot parameter.

Code: (commit 1, 2)

1.10. Export BDI attributes in sysfs

Linux 2.6.24 merged per-device dirty thresholds: The limits that the kernel put to the amount of memory that a process can "dirty" changed from being global to be per-device. 2.6.26 exposes a interface in /sys/class/bdi that allow to set several parameters. There's another set of read-only parameters that are exposet in debugfs (debug/bdi/<bdi>/stats)

Code: (commit 1, 2, 3, 4, 5, 6)

1.11. /proc/pid/mountinfo

The work being done these days in the VFS like per-process namespaces and such is obsoleting some things, like /proc/mounts (which is always a link to /proc/self/mounts). In its current form lacks important information and suffers some problems (see the code link). 2.6.26 introduces /proc/PID/mountinfo which addresses these deficiencies. Information about the information that can be found on these new files is explained in the commit links.

Code: (commit 1, 2, 3, 4, 5, 6, 7)

1.12. Generic semaphores

Since the introduction of mutexes, semaphores are no longer performance-critical, so the architecture-specific (and often asm-handcoded) implementation -that was needed when semaphores were really important for performance- has been reemplaced by a generic one written in C for maintainability, debuggability and extensibility. It removes 7365 LoC

Code: (commit)

2. Subsystems

2.1. Various

2.2. Filesystems

2.3. Networking

2.4. Crypto

2.5. Security

2.6. KVM

3. Architecture-specific changes

4. Drivers

4.1. IDE/SATA

4.2. Networking

4.3. Graphics

4.4. Sound

4.5. Input

4.6. V4L/ DVB

4.7. SCSI

4.8. WATCHDOG

4.9. HWMON

4.10. USB

4.11. FireWire

4.12. Infiniband

4.13. ACPI and Power Management

4.14. MTD

4.15. I2C

4.16. Various

KernelNewbies: Linux_2_6_26 (last edited 2017-12-30 01:30:16 by localhost)