In this week’s issue:

• openSUSE 11.2 Milestone 5 released
• People of openSUSE: Marcus Schaefer
• Linux.com/Rob Day: The Kernel Newbie Corner: Kernel and Module Debugging with gdb
• Guillaume DE BURE: More skrooge features
• LDN: Kernel Log – Coming in 2.6.31 – Part2: Graphics, Audio and Videor

For a list of available translations see this page:
http://en.opensuse.org/OpenSUSE_Weekly_News/84/Translations

Further investigation by Intel has found the root cause of the problem as Steven Rostedt wrote on the linux kernel mailing list : The dynamic ftrace code contained some fragile code that could write to ioremap-ed memory and thus corrupt the NVRAM.  The issue could happen “when the init functions of a module are freed and the nvram is vmapped there as well”.  The full story can be found on LKML.

Since 24th of September, we have disabled for our kernel of the day the dynamic ftrace code due for all flavors except the debug and vanilla kernels (on x86 and x86-64 – it was not enabled on other architectures).  We have also added the NVRAM protection patches to all kernel flavors.  Therefore Beta2 already contains – by pure luck – not only the NVRAM protection but also not anymore the broken code.

Beta3 will contain the same fixes – and the kernel of the day has just been updated with dynamic ftrace code disabled also for the debug and vanilla kernels (with the update to 2.6.27.1).

So, if you’re running a debug or vanilla kernel, I advice – to be on the safe side – to update to the 2.6.27.1 kernel of the day.  For everybody else: The Beta2 and Beta3 kernels should not corrupt your Intel e1000e NVRAM.

I’d like to thank all that were involved in debugging and fixing the issues around this, including our kernel developers Karsten Keil and Jiri Kosina who debugged and worked on a solution, testers that fried their machine and helped debugging like Stephan Binner and Vladimir Botka, and the team at Intel for developing protection code and finding and fixing the root cause.

Update 2008-10-21: Beta3 will contain 2.6.271.1

Fixing Erased e1000e NICs

Karsten Keil has developed a way to fix broken e1000e eproms.  Please contact him at kkeil@suse.de in case you need to recover from this bug.

We are still working on root-causing the issue, in close cooperation with developers from Intel and the general Linux community.

In the Beta 2 release, the e1000e driver has been augmented with several kernel patches that prevent all of the plausible scenarios where the NVM would be overwritten. This includes a patch that enables write-protection of the NVM. In order to corrupt the NVM with this patch in place, an application or kernel module would have to undo this write protection explicitly before being able to erase the NVM. Most of these protective measures have been implemented within the e1000e driver.

All tests performed so far have shown that with these protections in place, we are unable to reproduce the NVM corruption that could be seen with beta1. On some machines that were tested, a beta1 installation could lead to NVM corruption within 10-30 reboots, whereas a beta2 installation would perform 270 reboots without corrupting the NVM.

Therefore, we have made a conscious decision to leave the e1000e driver enabled by default. We think with the additional safeguards in place (most of which are part of the e1000e driver), the NVM is better protected than without loading the driver. This is based on the assumption that the e1000e driver shares the NVM with other parts of the system.

Nevertheless, users have the option to install beta2 with the e1000e driver disabled, by adding the following to the kernel command line when booting from the installation CD/DVD:

broken_modules=e1000e

This will prevent the driver from being loaded during installation, and will also add it to the file /etc/modprobe.d/blacklist, which will prevent it from being loaded automatically in the future.

The Intel e1000e driver on openSUSE 11.1 Beta 1 and SUSE Linux Enterprise 11 Beta 1 might have a serious issue with the potential to damage the network card in a way that it cannot be used any longer.

Intel and Novell are currently working to analyze and solve the issue.

For the time being:

Please do NOT USE:

openSUSE 11.1 Beta 1
or
SUSE Linux Enterprise 11 Beta 1

on systems with Intel e1000e hardware.

Any other hardware, including systems with Intel e1000 (without -e) network cards, is not affected by this issue.

We will keep you posted. Please watch news.opensuse.org and the opensuse-announce mailing list for more information.

Update: Check this page for a list of devices that use the e1000e driver. It may not be an exhaustive list. If you have an Intel PCI Express PRO/1000 gigabit Ethernet card, it uses the e1000e driver and you should avoid booting or using beta 1. Intel has instructions on how to identify your card.

Beginning with openSUSE 11.1, SUSE users will have an additional option regarding security frameworks. In addition to AppArmor, we will be adding SELinux capabilities in openSUSE 11.1, which will allow users to enable SELinux in openSUSE if they wish.

While our customer experience shows that AppArmor is the best solution for the vast majority of users, applications, and use cases, we want to give all of our users the ability to choose the security framework that’s appropriate for their respective environments and needs.

We continue to enable AppArmor as our default Host Intrusion Prevention System, and we are supporting it as the default in openSUSE 11.1 and in SUSE Linux Enterprise 11.

However we are adding functionality to allow openSUSE 11.1 systems to use SELinux instead. In the SUSE Linux Enterprise 11 platform, SELinux will also be shipped as a technology preview. This is particularly important for organizations that have already standardized on SELinux, but could not even test-drive SUSE Linux Enterprise before without major work and changes.

What does SELinux basic enablement mean?

• We will ship the kernel with SELinux support.
• We will apply SELinux patches to all “common” userland packages.
• The libraries required for SELinux (libselinux, libsepol, libsemanage, etc.) will be added to openSUSE and SUSE Linux Enterprise.
• However, we are not offering enterprise class support for SELinux at this time; thus we will run QA with SELinux disabled – to make sure that SELinux patches don’t break the default delivery and the majority of packages.
  Although we will not be running QA with SELinux enabled, we encourage our testers to run tests with SELinux enabled and report issues and enhancement requests back to us.
• We will not be shipping SELinux specific tools as part of the default distribution delivery. However, the packages (such as checkpolicy, policycoreutils, selinux-doc) will be available through the openSUSE and SUSE Linux Enterprise repositories.
• We will not be shipping any SELinux policies in the distribution. (Reference and maybe minimal policies will be available from the repositories.)

By enabling SELinux in our upcoming codebase, we add missing pieces of code that exist in the community already, and we allow those who wish to use SELinux to do so conveniently without having to replace a big chunk of the distribution.

Questions about SELinux enablement should be discussed on the opensuse-factory mailing list.

Andreas

• Reduce the number of kernel bugs in openSUSE’s bugzilla
• Get rid of old / invalid bugs in bugzilla and find duplicates
• Send patches and bugs upstream
• Test and review fixes for kernel bugs

If you’re interested in helping, join the kernel team on #opensuse-kernel on irc.freenode.net.They’ll be at it all day on Wednesday, July 30th starting at 00:00 UTC — so all time zones have equal opportunity to participate!

Virtualisation: What’s Available

Virtualisation refers to any sort of abstraction of physical hardware, or computer resources. openSUSE 10.3 will contain several emulators, a few more convenient kernel modules, and of course Xen; so let us take a look at these. For some guides and HOWTOs on Virtualisation, take a look at HOWTOs#Virtualisation on the openSUSE wiki.

VirtualBox

VirtualBox is a wonderful new open source virtualisation product, with a huge range of capabilities, and excellent documentation. As well as having nice enterprise features, for the regular openSUSE user it can be a great tool for trying out new installations or live CDs of openSUSE, and even other operating systems and distributions altogether.

Below you can take a look at VirtualBox running with openSUSE 10.3 RC1:

As you can see, the whole interface is very friendly and easy to work with. If you need help getting VirtualBox set up, take a look at openSUSE.org/VirtualBox.

Xen 3.1

The openSUSE distribution is also the base for other Linux distributions; most famously of course is SUSE Linux Enterprise Server (SLES) and Desktop (SLED). That means that openSUSE gets all the enterprise Xen virtualisation features, such as:

• Full support for Xen 3.1 virtualization on both 32- and 64-bit x86-based architectures with the capability to host 32-bit virtual machines on 64-bit virtualization host servers.
• Support for both paravirtualization and full virtualization on the same server, leveraging both Intel VT and AMD Virtualization (AMD-V) processor capabilities.
• A fully graphical and command-line virtual machine management tools for easy virtual machine (VM) administration and configuration, as well as tools for VM installation and lifecycle management.

However, it not only has that, but even more. The new Xen 3.1 includes other additions, particularly tackling HVM guest issues: i.e. improving support for save/restore/migrate operations for non-paravirtualized virtual machines (i.e. Windows). Below you can take a look at openSUSE 10.3 running inside Xen:

VM YaST Module

To help with setting up and configuring Xen, openSUSE even has a nice Install Hypervisor and Tools (in the yast2-vm package) module which can do a lot of the work for you:

After the install has finished you’ll have two extra YaST modules to create and manage virtual machines:

Kernel-based Virtual Machine (KVM)

Also in this release is the latest Linux kernel virtualisation infrastructure, KVM. KVM itself is to be considered experimental, but it is progressing very quickly. The latest versions come with reports of even better performance and Windows Vista support.

The kernel module currently works with a modified version of QEMU, also available in openSUSE. To get it running, see openSUSE.org/KVM.

More kernel modules: PARAVIRT-OPS & VMI

The release also includes the important paravirt-ops and vmi kernel modules to assist you with and increase performance in vmware.

Talk with Frank Kohler

I caught up with SUSE’s project manager for Virtualisation to ask a few questions.

Could you tell us a little about Xen in SUSE? Why has it been so successful?

Francis, first thanks for offering me a chance to talk a bit about my area of work.

SUSE has broad experience with virtualisation, especially since supporting the IBM mainframe. Therefore interest in the Xen project has been established from the beginning. As an OS vendor SUSE has developers with essential knowledge and skills needed for the tight integration of hypervisor technology and OS. SUSE has therefore become one of the Top 5 contributors to the Xen project.

Today Xen has matured to a level where it is competitive to other hypervisor technologies in the market. Xen has established a large ecosystem, which is essential for adaption on various levels. SUSE contributes to virt-manager as well as to Novell’s datacenter management solution ZENworks Orchestrator offering solutions to a broad audience.

Virtualisation applications, such as VirtualBox recently, appear to benefit greatly by being licenced as free software. How great are the incentives for other virtualisation software vendors to follow suit, and do you think they will?

On one hand we see virtualisation being commodity today with industry leaders embracing virtualisation hand in hand with virtualisation specialists.

On the other hand the biggest share of the market is yet not virtualised offering huge opportunities to everyone. There’s still an enormous space for mainstream software and even more for niche products. So, yes, absolutely there are great incentives to publish virtualisation software and appliances be it fame, glory, money or all of that. If you have a great idea though, please talk to us (SUSE) and me first

KVM appears to be progressing very well in the upstream Linux kernel. What do you think the future holds for it?

Indeed SUSE recognises the growing momentum of KVM and its advantages in certain areas. It’s good to see developers trying to close gaps to Xen, e.g. in the areas of paravirtualisation, symmetric multiprocessing (SMP) or hardware virtualised environments (VT and AMD-V respectively).

For broader market adoption and success KVM needs to grow its ecosystem though. KVM project’s main sponsor confirms that direction by announcing a product for the desktop and laptop segment just yesterday.

Lguest is another upcoming hypervisor that looks promising. Do you think it will be used in the openSUSE distribution in the future?

Lguest is an impressive technology demonstration with just a few thousand lines of code. Of course Lguest’s scope is limited today therefore it’s hard to foresee it’s future. Yet we all remember Linus’ posting on August 25 in 1991

What kind of other plans does the virtualisation team at SUSE have for the future?

I’d love to talk more about the future of virtualisation since SUSE has lots of aces up its sleeve; unfortunately many things have not been announced yet. So I will at least talk a bit about a great demonstration SUSE did two weeks ago in San Francisco at one of the largest virtualisation conferences.

SUSE R&D managed on one hand to patch our SUSE Linux Enterprise kernel to VMI enablement and on the other hand to get hold of a VMI enabled enterprise hypervisor. In conjunction with partner middleware application we demonstrated great performance of SUSE Linux both on virtual and physical machines exploiting the very same kernel. Once again SUSE offers freedom of choice

Thanks!

With our openSUSE Build Service we build a daily kernel, where we take the current upstream development kernel without any patches (besides those we need for building a RPM).  We do call this the vanilla kernel. It can be downloaded from:
http://download.opensuse.org/repositories/Kernel:/Vanilla/SUSE_Factory/

Btw. if you test the vanilla kernel, report any problems to the Linux kernel mailing list (for details check the FAQ at http://www.tux.org/lkml/) and not to the openSUSE bugzilla.

This list is dedicated to the discussion of the openSUSE kernel development (Factory et al) and the kernels in the openSUSE Build Service. Packaging or openSUSE-specific patches (though hopefully rare and growing more so) are on-topic; general Linux kernel development is best served by the existing public lists (LKML et al).