<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE report PUBLIC "-//FreeBSD//DTD FreeBSD XML Database for Status Report//EN"
                        "http://www.FreeBSD.org/XML/www/share/sgml/statusreport.dtd">

<!-- $FreeBSD$ -->

<report>
  <date>
    <month>October-December</month>
    <year>2003</year>
  </date>

  <section>
    <title>Introduction:</title>

    <p>The FreeBSD status reports are back again with the 2003 year-end
      edition.  Many new projects are starting up and gaining momentum,
      including XFS, MIPS, PowerPC, and networking locking and
      multithreading.  The end of 2003 also saw the release of FreeBSD 4.9,
      the first stable release to have greater than 4GB support for the
      ia32 platform.  Work on FreeBSD 5.2 also finished up and was released
      early in January of 2004.  Many thanks to all of the people who
      worked so hard on these releases and made them happen.</p>

    <p>This is the largest status report ever, so read and enjoy!</p>

    <p>Scott Long, Robert Watson</p>

  </section>
  
  <project>
    <title>libarchive, bsdtar</title>
    
    <contact>
      <person>
        <name>
          <given>Tim</given>
          <common>Kientzle</common>
        </name>
        <email>kientzle@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://people.FreeBSD.org/~kientzle/libarchive/" />
    </links>
    
    <body>
      <p>The libarchive library, which reads and writes tar and cpio
        archives, is about ready to commit to the tree.  The bsdtar
        program, built on libarchive, is also nearing completion and
        should soon be a worthwhile successor to our aging GNU tar.  I
        plan a gradual transition during which "bsdtar" and "gtar" will
        coexist in the tree.</p>
      
      <p>Oddly enough, libarchive and bsdtar are the first fruits of a
        project to completely rewrite the pkg tools.  I've started
        architecting a libpkg library for handling routine package
        management and have a prototype pkg_add that is three times faster
        than the current version.</p>
    </body>
  </project>
  
  <project>
    <title>Publications Page Update</title>
    
    <contact>
      <person>
        <name>
          <given>Josef</given>
          
          <common>El-Rayes</common>
        </name>
        
        <email>josef@daemon.li</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.daemon.li/freebsd/">Updated Publications Page</url>
    </links>
    
    <body>
      <p>I did a xml/xslt conversion of the html files to make maintaining
        of the page more comfortable.  I removed the cdsets, which might be
        kept in CVS or some kind of archive for historical reasons.  The books
        got an update, and were categorized in respect to the language they
        are written in. As soon as I get my access on the cvs repository I
        will commit the updates.  People are encouraged to add local FreeBSD
        books, I missed, especially in the asian area.  Feel free to send me
        links to books to add.</p>
    </body>
  </project>
  
  <project>
    <title>DVB-ASI Support</title>
    
    <contact>
      <person>
        <name>
          <given>Vincent</given>
          
          <common>Jardin</common>
        </name>
        
        <email>Vincent.Jardin@6wind.com</email>
      </person>
    </contact>
    
    <links>
      <url href="http://proxy.6wind.com/~jardin/dvb/">Home page and source code</url>
      <url href="http://www.computermodules.com/broadcast/broadcast-dvb.shtml">Computer Modules</url>
      <url href="http://www.dvb.org/"/>
    </links>
    
    <body>
      <p>DVB ASI stands for Digital Video Broadcast - Asynchronous Serial
        Interface.  It is the standard defined to send and receive DVB stream
        from Satellite (DVB-S), Terrestrial link (DVB-T), and TV Cable
        (DVB-C).  This standard was developed in Europe to transport 188-byte
        MPEG cells and 204-byte MPEG cells. However it can be used to carry IP
        over DVB too.</p>
      
      <p>The FreeBSD driver uses the newbus amd the bus-dma API. It means that it
        could be easily ported to all the BSD flavors (NetBSD, OpenBSD).</p>
      
      <p>It uses the same API than the Linux DVB ASI support from
        ComputerModules that is based on the following devices:
        <ul>
          <li>/dev/asitxN for the transmit stream (only open, write, select,
            close and ioctl are supported)</li>
          <li>/dev/asirxN for the receive stream (only open, read, select, close
            and ioctl are supported)</li>
        </ul>
        It means that software such as Videolan that support DVB-ASI
        broadcasting could be supported by this driver.</p>
      
      <p>Special thanks to Tom Thorsteinson from Computer Modules who helped
        6WIND to port their driver. It is used by 6WIND in order to provide
        IPv4, IPv6, Ethernet and our network services over DVB.</p>
      
      <p>Copyright 2003-2004, 6WIND</p>
    </body>
  </project>
  
  <project>
    <title>FreeBSD ports monitoring system</title>
    
    <contact>
      <person>
        <name>
          <given>Mark</given>
          
          <common>Linimon</common>
        </name>
        
        <email>linimon_at_lonesome_dot_com</email>
      </person>
    </contact>
    
    <links>
      <url href="http://lonesome.dyndns.org:4802/bento/errorlogs/index.html">FreeBSD
        ports monitoring system</url>
    </links>
    
    <body>
      <p>Enhancements continue to be made to the system.  Several,
        including improvements to the PR classification algorithm, the
        ability to more correctly guess when a PR has been updated, and
        better handling of errors in both port Makefiles and the bento
        builds, are invisible to end-users.  However, the addition of
        a "repocopy" classification is notable, as is the allowing the
        wildcard search in "overview of one port" (thanks to edwin@ for
        the shove in that direction.)  Additionally, logic has been
        added to identify the proposed category/portname of new ports,
        with the goal being to quickly identify possible duplications
        of effort.  (Some SQL performance was sacrificed to this goal,
        leading to some pages to load more slowly; this needs to be
        fixed.)</p>
      
      <p>The other work has been on an email back-end to allow the
        occasional sending of email to maintainers.  Two functions are
        currently available: "remind maintainers of their ports that
        are marked BROKEN", and "remind maintainers of PRs that they
        may not have seen."  A recent run of the former got generally
        good response, especially as changing some cases of BROKEN to
        IGNORE (PR ports/61090) had removed almost all the annoying
        false positives.  However, work remains to try to find out why
        a few allegedly broken ports only fail in certain environments
        (including the bento cluster).</p>
      
      <p>The next plan is to use the proposed DEPRECATED Makevar (see
        ports/59362) to create a new report to allow querying of "ports
        currently slated to be removed".  This report could also be
        posted to ports@ periodically with minimal work.  The author
        believes that doing this would allow the port deprecation process
        to be much more visible to the general FreeBSD user community.</p>
    </body>
  </project>
  
  <project>
    <title>Compile FreeBSD with Intels C compiler (icc)</title>
    
    <contact>
      <person>
        <name>
          <given>Alexander</given>
          
          <common>Leidinger</common>
        </name>
        
        <email>netchild@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.Leidinger.net/FreeBSD/">Some patches</url>
    </links>
    
    <body>
      <p>The FreeBSD kernel now builds and runs fine with icc v7 (only GENERIC
        and a custom kernel tested so far). A review on arch@ revealed no
        major concerns and some src committers are willing to commit the
        patches.  As icc v8 is out and defines __GNUC__ I want to rework the
        patches before they get committed so an icc v8 compiled kernel DTRT
        too.</p>
      <p>A complete build of the ports collection (as of start of December)
        finished and is under review to determine the reason of build
        failures.  Current <emph>icc</emph> stats:
        <ul>
          <li>1108 failed builds (excluding build failures because of failed
            dependencies)</li>
          <li>3535 successfully build packages (~ 1.7 GB)</li>
        </ul>
        A parallel build with <emph>gcc</emph> on the same snapshot of the
        ports collection has:
        <ul>
          <li>520 failed builds (excluding build failures because of failed
            dependencies)</li>
          <li>7261 successfully build packages (~ 4.8 GB)</li>
        </ul>
      </p>
      <p>The above mentioned build of the ports collection was run on a P4
        with a icc compiled kernel (optimized for a P4). No kernel panics or
        other strange behavior was noticed. The ports collection was build
        with a CPUTYPE of p4 and CFLAGS set to "-Os -pipe -mfpmath=sse -msse2"
        in the gcc and "-O2" in the icc case. No package is tested for correct
        run-time behavior so far.</p>
    </body>
    
  </project>
  
  <project>
    <title>Porting OpenBSD's pf</title>
    
    <contact>
      <person>
        <name>
          <given>Max</given>
          <common>Laier</common>
        </name>
        <email>max@love2party.net</email>
      </person>
      <person>
        <name>
          <given>Pyun</given>
          <common>YongHyeon</common>
        </name>
        <email>yongari@kt-is.co.kr</email>
      </person>
    </contact>
    
    <links>
      <url href="http://pf4freebsd.love2party.net" />
      <url href="http://www.benzedrine.cx/pf.html">PF homepage</url>
      <url href="http://openbsd.org/faq/pf/index.html">PF FAQ</url>
    </links>
    
    <body>
      <p>Much work has been invested into getting release 2.00 stable. It
        provides the complete OpenBSD 3.4 function set, as well as fine
        grained locking to work with a giant free network stack.</p>
      <p>pf provides: IPv6 filtering and normalization, &quot;syn-proxy&quot;
        to protect (web)server against SYN-floods, passive OS detection, fast
        and modular address tables, source/policy routing, stateful filter and
        normalization engine, structured rulesets via anchors and many many
        more. Especially in connection with ALTQ, pf can help to harden
        against various flood attacks and improve user experience.</p>
      <p>New features from OpenBSD-Current like: state synchronization over wire
        and enhanced support for cloned interfaces require patches to the
        kernel.  We are trying to resolve this issue and start
	OpenBSD-Current tracking again as soon as possible.</p>
    </body>
  </project>
  
  <project>
    <title>Binary security updates for FreeBSD</title>
    
    <contact>
      <person>
        <name>
          <given>Colin</given>
          
          <common>Percival</common>
        </name>
        
        <email>cperciva@daemonology.net</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.daemonology.net/freebsd-update/" />
    </links>
    
    <body>
      <p>Thanks to recent donations, I am now building binary security
        updates for FreeBSD {4.7, 4.8, 4.9, 5.0, 5.1, 5.2}-RELEASE.
        (Note that FreeBSD 4.7 and 5.0 are no longer officially
        supported; any advisories which are not reflected in the CVS
        tree will likewise not result in binary updates.)</p>
      
      <p>The current version (1.5) of FreeBSD Update will warn about
        locally modified files and will, by default, leave them
        untouched; if a "distribution branch", (i.e. crypto, nocrypto,
        krb4, or krb5) is specified, FreeBSD Update can be forced to
        "update" files which have been compiled locally.</p>
      
      <p>The only major issue remaining with FreeBSD Update is the
        single-point-of-failure of the update building process; I
        would like to resolve this in the future by having several
        machines cross-verify and cross-sign, but this will require
        a significant investment of time, and will probably have to
        wait until I've finished writing my DPhil thesis.</p>
    </body>
  </project>
  
  <project>
    <title>SGI XFS port for FreeBSD</title>
    
    <contact>
      <person>
        <name>
          <given>Alexander</given>
          
          <common>Kabaev</common>
        </name>
        
        <email>kan@FreeBSD.org</email>
      </person>
      <person>
        <name>
          <given>Russell</given>
          
          <common>Cattelan</common>
        </name>
        
        <email>cattelan@thebarn.com</email>
      </person>
    </contact>
    
    <body>
      <p>A project was started to revive a stalled effort to port SGI XFS
        journaling filesystem to FreeBSD.  The project is based on Linux 
        development sources from SGI and is currently being kept in a
        private Perforce repository. The work is progressing slowly due
        to lack of free time.  At the moment we have XFS kernel module 
        which is capable of mounting XFS filesystems read-only, with a
        panic or two happening infrequently, that need to be isolated and
        fixed. Semi-working metadata updates with full transaction support
        are there too, but will probably have to be rewritten to minimize
        the amount of custom kernel changes required.</p>
      
      <p>We seek volunteers to help with userland part of the port. Namely,
        existing xfsprogs port needs to be cleaned up, incompletely ported
        utilities brought into a working shape. xfs_dump/xfs_restore and
        as much from xfstests suite as possible need to be ported too. We do
        not need testers for now, so please to not ask for module sources
        just yet.</p>
      
    </body>
  </project>
  
  <project>
    <title>
      Bluetooth stack for FreeBSD (Netgraph implementation)
    </title>
    
    <contact>
      <person>
        <name>
          <given>
            Maksim
          </given>
          
          <common>
            Yevmenkin
          </common>
        </name>
        
        <email>m_evmenkin@yahoo.com</email>
      </person>
    </contact>
    
    <body>
      <p>Not much to report. Bluetooth code was integrated into the FreeBSD
        source tree. Bluetooth kernel modules appear to be stable. I have
        received few success stories from the users.</p>
      
      <p>During last few months the efforts were to make Bluetooth code
        more user friendly. Bluetooth Service Discovery Procotol daemon
        sdpd was reimplemented under BSD-style license and committed. The
        next step is to integrate existing Bluetooth utilities with SDP.</p>
      
      <p>Thanks to Matt Peterson &lt;matt at peterson dot org&gt; I now have
        Bluetooth keyboard and mouse for development. I'm currently
        working on Bluetooth HID profile implementation.</p>
      
      <p>Dave Sainty &lt;dave at dtsp dot co dot nz&gt; from NetBSD project
        offered his help in porting Bluetooth stack to NetBSD.</p>
    </body>
  </project>
  
  <project>
    <title>Network interface naming changes</title>
    
    <contact>
      <person>
        <name>
          <given>Brooks</given>
          
          <common>Davis</common>
        </name>
        
        <email>brooks@FreeBSD.org</email>
      </person>
    </contact>
    
    <body>
      <p>At the end of October, the if_name and if_unit members of struct
        ifnet were replaced with if_xname from NetBSD and if_dname and
        if_dunit.  These represent the name of the interface and the
        driver name and instance of the interface respectively.  Other then
        breaking IPFilter for a few weeks due to the userland being on the
        vendor branch, this change went quite well.  A few ports needed
        minor changes, but otherwise nothing changed from the user
        perspective.</p>
      
      <p>The purpose of this change was the lay the groundwork for support
        for network interface renaming and to allow the implementation of
        more interesting pseudo interface cloning support.  An example of
        interesting cloning support would be using "ifconfig fxp0.20
        create" to create and configure a vlan interface on fxp0 that
        handled frames marked with the tag 20.  Interface
        renaming is being worked on in Perforce at the moment with a
        working version expected for review soon.  Support for enhanced
        device cloning is still in the planing stage.</p>
    </body>
  </project>
  
  <project>
    <title>Kernel Tunables Documentation Project</title>
    <contact>
      <person>
        <name>
          <given>Tom</given>
          <common>Rhodes</common>
        </name>
        <email>trhodes@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.FreeBSD.org/cgi/query-pr.cgi?pr=docs/44034">The
        problem report which kicked this project in action</url>
    </links>
    
    <body>
      <p>FreeBSD has well over a few hundred tunables without
        documentation.  This project aims at designing an
        automated process to rip all available tunables and generate
        a manual page based on the selected kernel options.
        The ideal implementation, however; would gather tunables
        from the LINT kernels as well.  This would provide a
        default manual page for all supported architectures.
        A simple tool has been forged from the various off-list
        and on-list discussions and is waiting review from the
        -doc team.  Anyone interesting in reviewing my current
        work is requested to get in contact with me.</p>
    </body>
  </project>
  
  <project>
    <title>jpman project</title>
    
    <contact>
      <person>
        <name>
          <given>Kazuo</given>
          <common>Horikawa</common>
        </name>
        
        <email>horikawa@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.jp.FreeBSD.org/man-jp/">jpman project</url>
    </links>
    
    <body>
      <p>We have been updating existing Japanese translations
        of manual pages to meet the 5.2-RELEASE schedule.
        Also, 22 new translations were complete during this period.</p>
    </body>
  </project>
  
  <project>
    <title>FreeBSD MIDI</title>
    
    <contact>
      <person>
        <name>
          <given>Mathew</given>
          
          <common>Kanner</common>
        </name>
        
        <email>matk@FreeBSD.org</email>
      </person>
    </contact>
    
    <body>
      <p>This project aims to update the current MIDI implementation.  We
        are currently looking at removing the current code sometime in
        February and importing the new version soon after.  I'm currently
        working on a kernel/timidity bridge for those without external
        hardware.</p>
      
    </body>
  </project>
  
  <project>
    <title>The FreeBSD Russian Documentation Project</title>
    
    <contact>
      <person>
        <name>
          <given>Andrey</given>
          
          <common>Zakhvatov</common>
        </name>
        
        <email>andy@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.FreeBSD.org/ru/index.html">The FreeBSD Project [Russian]</url>
    </links>
    
    <body>
      <p>The FreeBSD Russian Documentation Project aims to provide FreeBSD
        Documentation translated to Russian.  Already done: FAQ, Porters
        Handbook, WWW (partially synched with English version), some
        articles.</p>
      
      <p>We working at Handbook (and more docs) translation and synchronization
        with English versions and need more translators (or financial aid  to
        continue our work.  If you can help, please, contact us at
        ru-cvs-committers@FreeBSD.org.ua (or andy@FreeBSD.org).</p>
    </body>
  </project>
  
  <project>
    <title>KSE</title>
    
    <contact>
      <person>
        <name>
          <given>Daniel</given>
          
          <common>Eischen</common>
        </name>
        
        <email>deischen@FreeBSD.org</email>
      </person>
    </contact>
    
    <body>
      <p>The libkse library will shortly be renamed to libpthread and
        be made the default thread library.  This includes making the
        GCC -pthread option link to -lpthread instead of libc_r and
        changing PTHREAD_LIBS to -lpthread.  David Xu has been working
        on GDB support and has it working with the GDB currently in our
        tree.  The next step is to make a libpthread_db and get it working
        with GDB 6.0 which marcel has imported into the perforce tree.</p>
    </body>
  </project>
  
  <project>
    <title>Donations Team</title>
    
    <contact>
      <person>
        <name>
          <given>Michael</given>
          
          <common>Lucas</common>
        </name>
        
        <email>donations@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.FreeBSD.org/donations/">FreeBSD Donations Project</url>
    </links>
    
    <body>
      <p>2003 was quite successful for the Donations team.  We
        shepherded over 200 items from donors into the hands of
        developers.  Some high points include: a small cluster for the
        security team, assorted laptop hardware for our cardbus work,
        and documentation for our standards group.  In the main FreeBSD.org
        cluster we were able to replace 8 DEC Miata machines with 6
        Alpha DS10s (21264).  Every committer doing SMP work now has
        multi-processor testing hardware.</p>
      
      <p>We have smoothed out the tax deduction process with the FreeBSD
        Foundation, and can ship donated items directly to the
        recipients instead of tying up Foundation time handling
        shipping.</p>
      
      <p>Current team membership is: Michael Lucas, David O'Brien, and
        Tom Rhodes.  Wilko Bulte has replaced Robert Watson as the Core
        Team representative.</p>
    </body>
  </project>
  
  <project>
    <title>ACPI</title>
    
    <contact>
      <person>
        <name>
          <given>Nate</given>
          
          <common>Lawson</common>
        </name>
        
        <email>njl@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.root.org/~nate/freebsd/">ACPI TODO</url>
      <url href="http://home.jp.FreeBSD.org/mail-list/acpi-jp/">ACPI-JP
        Mailing List</url>
      
    </links>
    
    <body>
      <p>The updated acpi_cpu driver was committed in November.  Work is
        ongoing to finish support for _CST re-evaluation, which makes it
        possible for laptops based on processors like the Centrino to use
        varying CPU idle states when on or off AC power.  5.2-RELEASE also
        went out with support for _CID packages, which fixed mouse probing
        for Compaq users.  Control of CPU idle states and throttling can
        now be done through rc.conf(5) settings for the /etc/power_profile
        script, which switches between performance/economy levels when
        the AC status changes.</p>
      
      <p>One huge task underway is the cpufreq project, a framework for
        detecting and controlling various frequency/voltage technologies
        (SpeedStep, LongRun, ACPI Performance states, etc.)  The ACPI
        performance states driver is working and the framework is being
        implemented.  It requires newbus attachments for CPUs so some
        ground work needs to go in before the driver can be committed.</p>
      
      <p>ACPI-CA was updated to 20031203 in early December and with a few
        patches is reasonably stable.  An ACPI debugging how-to has been
        written and is being DocBooked by trhodes@.  Ongoing work on fixing
        interrupt storms due to various ways of setting up the SCI
        is being done by jhb@.</p>
      
      <p>I'd like to welcome Philip Paeps (philip@) to the FreeBSD team.
        Philip has written an ACPI ASUS driver that will be committed soon
        and has been very helpful on the mailing lists.  We've also had
        a lot of help from jhb@, marcel@, imp@, and peter@.  We're hoping
        to see the return of takawata@ and iwasaki@, who have been very
        helpful in the past.
        If any developers are interested in assisting with ACPI, please
        see the ACPI TODO and send us an email.</p>
    </body>
  </project>
  
  <project>
    <title>kgi4BSD Status Report</title>
    
    <contact>
      <person>
        <name>
          <given>Nicholas</given>
          
          <common>Souchu</common>
        </name>
        
        <email>nsouch@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.FreeBSD.org/~nsouch/kgi4BSD" />
      <url href="http://www.kgi-project.org" />
    </links>
    
    <body>
      <p>Most of the console blocks are in place with nice results
        (see screenshots on the site). Boot console and virtual
        terminals are working with 8bit rendering and perfect integration
        of true graphic drivers in the kernel.</p>
      
      <p>Now it is time to bring it to end user and a precompiled R5.2 GENERIC
        kernel is available for this (see the site news). In parallel,
        after providing a last tarball/patch for R5.2, everything will
        move to Perforce.</p>
      
      <p>As always, volunteers are welcome. The task is huge but very
        exciting.</p>
    </body>
  </project>
  
  <project>
    <title>FreeBSD/powerpc on PPCBug-based embedded boards</title>
    
    <contact>
      <person>
        <name>
          <given>Rafal</given>
          
          <common>Jaworowski</common>
        </name>
        
        <email>rafal.jaworowski@motorola.com</email>
      </person>
    </contact>
    
    <body>
      <p>The direct objective is to make FreeBSD/powerpc work on Motorola
        MCP750 and similar (single board computer that is compliant with
        Compact PCI standard) Based on this work it would be easy to bring it
        to other embedded systems.</p>

      <p>1. loader(8): it is based on the existing loader for FreeBSD/powerpc
        port but binding to OpenFirmware was removed and replaced with PPCBug
        firmware binding.  It only supports netbooting for the moment, so disk
        (compact flash) support needs to be done one day. The loader is the
        only piece that relies onPPCBug system calls - once the kernel starts
        it doesn't need firmware support any longer.</p>
 
      <p>2. kernel: it is now divorced from OpenFirmware dependencies; most of
        the groundwork finished includes: nexus stuff is sorted out (resources
        management is ok except interrupts assignment); host to PCI bridge low
        level routines are finished so configuration of and access to PCI
        devices works; the only important thing missing is the IRQ management
        (Raven MPIC part is done, but the board has the second PIC,
        8259-compatible that needs to be set up, but here the existing code
        from x86 arch will be adopted).</p>
      
      <p>Once the IRQ management is cleared out, most of the devices on board
        would work straight away since they are pretty standard chips with
        drivers already implemented in the tree (e.g. if_de).</p>
      
      <p>At the moment work is on hold (don't have physical access to the
        device) but will resume when I'm back home (late Feb).</p>
      
    </body>
  </project>
  
  <project>
    <title>TrustedBSD Mandatory Access Control (MAC)</title>
    
    <contact>
      <person>
        <name>
          <given>Robert</given>
          
          <common>Watson</common>
        </name>
        
        <email>rwatson@FreeBSD.org</email>
      </person>
      
      <person>
        <name>
          <given>TrustedBSD Discussion Mailing List</given>
        </name>
        
        <email>trustedbsd-discuss@TrustedBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.trustedbsd.org/mac.html">TrustedBSD MAC
        page</url>
    </links>
    
    <body>
      <p>The TrustedBSD Mandatory Access Control (MAC) Framework
        permits the FreeBSD kernel and userspace access control
        policies to be adapted at compile-time, boot-time, or
        run-time.  The MAC Framework provides common infrastructure
        components, such as policy-agnostic labeling, making it
        possible to easily development and distribute new access
        control policy modules.  Sample modules include Biba, MLS,
        and Type Enforcement, as well as a variety of system
        hardening policies.</p>
      
      <p>TrustedBSD MAC development branch in Perforce integrated
        to 5.2-RELEASE.</p>
      
      <p>The TrustedBSD MAC Framework now enforces protections on System
        V IPC objects and methods.  Shared memory, semaphores, and
        message queues are labeled, and most operations are controlled.
        The Biba, MLS, Test, and Stub policies have been updated for
        System V IPC.  (Not yet merged)</p>
      
      <p>The TrustedBSD MAC Framework now enforces protections on POSIX
        semaphore objects and methods.  The Biba, MLS, Test, and Stub
        policies have been updated.  (Not yet merged)</p>
      
      <p>The TrustedBSD MAC Framework's central kernel implementation
        previously existed in one large file, src/sys/kern/kern_mac.c.
        It is now broken out into a series of by-service files in
        src/sys/security/mac.  src/sys/security/mac/mac_internal.h
        specifies APIs, structures, and variables used internally
        across the different parts of the framework.  System calls
        and registration still occur in kern_mac.c.  This permits
        more easy maintenance of locally added object types.  (Merged)</p>
      
      <p>Break out mac_policy_list into two different lists, one to
        hold "static" policy modules -- ones loaded prior to kernel
        initialization, and that may not be loaded, and one for
        "dynamic" policy modules -- that are either loaded later in
        boot, or may be unloaded.  Perform less synchronization when
        using static modules only, reducing overhead for entering
        the framework when not using dynamic modules.  (Merged)</p>
      
      <p>Introduced a kernel option, MAC_STATIC, which permits only
        statically registered policy modules to be loaded at boot
        or compiled into the kernel.  When running with MAC_STATIC,
        no internal synchronization is required in the MAC Framework,
        lowering the cost of MAC Framework entry points.  (Not yet
        merged)</p>
      
      <p>Make mac.h userland API definition C++-happy.  (Merged)</p>
      
      <p>Created mac_support.4, a declaration of what kernel and
        userspace features are (and aren't) supported with MAC.
        (Not yet merged)</p>
      
      <p>Stale SEBSD module deleted from MAC branch; SEBSD module will
        solely be developed in the SEBSD branch from now on.  See
        the TrustedBSD SEBSD report for more detail.</p>
      
      <p>Use only pointers to 'struct label' in various kernel objects
        outside the MAC Framework, and use a zone allocator to allocate
        label storage.  This permits label structures to have their
        size changed more easily without changing the normal kernel
        ABI.  This also lowers the non-MAC memory overhead for base
        kernel structures.  This also simplifies handling and storage
        of labels in some of the edge cases where labels are exposed
        outside of the Framework, such as in execve().  Include files
        outside of the Framework are substantially simplified and now
        frequently no longer require _label.h.  (Merged)</p>
      
      <p>Giant pushed down into the MAC Framework in a number of MAC
        related system calls, as it is not required for almost all
        of the MAC Framework.  The exceptions are areas where the
        Framework interacts with pieces of the kernel still covered
        by MAC and relies on Giant to protect label storage in those
        structures.  However, even in those cases, we can push Giant
        in quite a bit past label internalization/externalization/
        storage allocation/deallocation.  This substantially simplifies
        file descriptor-based MAC label system calls.  (Merged)</p>
      
      <p>Remove unneeded mpo_destroy methods for Biba, LOMAC, and MLS
        since they cannot be unloaded.  (Merged)</p>
      
      <p>Biba and MLS now use UMA zones for label allocation, which
        improves storage efficiency and enhances performance.  (Merged)</p>
      
      <p>Bug fix for mac_prepare_type() to better support arbitrary
        object label definitions in /etc/mac.conf.  (Merged)</p>
      
      <p>Labels added to 'struct inpcb', which represents TCP and UDP
        connections at the network layer.  These labels cache socket
        labels at the application layer so that the labels may be
        accessed without application layer socket locks.  When a label
        is changed on the socket, it is pushed down to the network
        layer through additional entry points.  Biba, MLS policies
        updated to reflect this change.  (Merged)</p>
      
      <p>SO_PEERLABEL socket option fixed so that peer socket labels
        may be retrieved.  (Merged)</p>
      
      <p>mac_get_fd() learns to retrieve local socket labels, providing
        a simpler API than SO_LABEL with getsockopt().  mac_set_fd()
        learns about local socket labels, providing a simpler API than
        SO_LABEL with setsockopt().  This also improves the ABI by not
        embedding a struct label in the socket option arguments, instead
        using the copyin/copyout routine for labels used for other object
        types.  (Merged)</p>
      
      <p>Some function names simplified relating to socket options.
        (Merged)</p>
      
      <p>Library call mac_get_peer() implemented in terms of getsockopt()
        with SO_PEERLABEL to improve API/ABI for networked applications
        that speak MAC.  (Merged)</p>
      
      <p>mac_create_cred() renamed to mac_cred_copy(), similar to other
        label copying methods, allowing policies to implement all the
        label copying method with a single function, if desired.  This
        also provides a better semantic match for the crdup() behavior.
        (Merged)</p>
      
      <p>Support "id -M", similar to Trusted IRIX.  (Not yet merged)</p>
      
      <p>TCP now uses the inpcb label when responding in timed wait,
        avoiding reaching up to the socket layer for label information
        in otherwise network-centric code.</p>
      
      <p>Numerous bug fixes, including assertion fixes in the MAC
        test policy relating to execution and relabeling.  (Merged)</p>
    </body>
  </project>
  
  <project>
    <title>TrustedBSD Access Control Lists (ACLs)</title>
    
    <contact>
      <person>
        <name>
          <given>Robert</given>
          
          <common>Watson</common>
        </name>
        
        <email>rwatson@FreeBSD.org</email>
      </person>
      
      <person>
        <name>
          <given>TrustedBSD Discussion Mailing List</given>
          
        </name>
        
        <email>trustedbsd-discuss@TrustedBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.trustedbsd.org/components.html#acls">TrustedBSD
        ACLs page</url>
    </links>
    
    <body>
      <p>TrustedBSD Access Control Lists (ACLs) provide extended
        discretionary access control support for the UFS and UFS2
        file systems on FreeBSD.  They implement POSIX.1e ACLs with
        some extensions, and meet the Common Criteria CAPP
        requirements.  Most ACL-related work is complete, with
        remaining tasks associated with userspace integration, third
        party applications, and compatibility</p>
      
      <p>Prototyped Solaris/Linux semantics for combining ACLs and
        the umask: if an default ACL mask is defined, substitute that
        mask for the umask, permitting ACLs to override umasks.  (Not
        merged)</p>
    </body>
  </project>
  
  <project>
    <title>TrustedBSD "Security-Enhanced BSD" -- FLASK/TE Port</title>
    
    <contact>
      <person>
        <name>
          <given>Robert</given>
          
          <common>Watson</common>
        </name>
        
        <email>rwatson@FreeBSD.org</email>
      </person>
      
      <person>
        <name>
          <given>TrustedBSD Discussion Mailing List</given>
        </name>
        
        <email>trustedbsd-discuss@TrustedBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.TrustedBSD.org/sebsd.html">TrustedBSD
        SEBSD page</url>
    </links>
    
    <body>
      <p>TrustedBSD "Security-Enhanced BSD" (SEBSD) is a port of NSA's
        SELinux FLASK security architecture, Type Enforcement (TE)
        policy engine and language, and sample policy to FreeBSD using
        the TrustedBSD MAC Framework.  SEBSD is available as a loadable
        policy module for the MAC Framework, along with a set of
        userspace extensions support security-extended labeling calls.
        In most cases, existing MAC Framework functions provide the
        necessary abstractions for SEBSD to plug in without SEBSD-specific
        changes, but some extensions to the MAC Framework have been
        required; these changes are developed in the SEBSD development
        branch, then merged to the MAC branch as they mature, and then
        to the FreeBSD development tree.</p>
      
      <p>Unlike other MAC Framework policy modules, the SEBSD module
        falls under the GPL, as it is derived from NSA's
        implementation.  However, the eventual goal is to support
        plugging SEBSD into a base FreeBSD install without any
        modifications to FreeBSD itself.</p>
      
      <p>TrustedBSD SEBSD development branch in Perforce integrated
        to 5.2-RELEASE.  Other changes in the MAC branch, including
        restructuring of MAC Framework files also integrated, and a
        move to zone allocation for labels.  See the TrustedBSD MAC
        Framework report for more detail on these and other MAC
        changes that also affect the SEBSD work.</p>

      <p>FreeBSD PTY code modified so that the MAC Framework and SEBSD
        module can create pty's with the label of the process trying
        to access them.  Improves compatibility with the SELinux
        sample policy.  (Not yet merged)</p>
      
      <p>SEBSD now loads its initial policy in the boot loader rather
        than using a dummy policy until the root file system is
        mounted, and then loading it using VFS operations.  This
        avoids initial labeling and access control conditions during
        the boot.</p>
      
      <p>security_load_policy() now passes a memory buffer and length
        to the kernel, permitting the policy reload mechanisms to
        be shared between the early boot load and late reloads.  The
        kernel SEBSD code now no longer needs to perform direct file
        I/O relating to reading the policy.  checkpolicy now mmap's
        the policy before making the system call.</p>
      
      <p>SEBSD now enforces protections on System V IPC objects and
        methods.  Shared memory, semaphores, and message queues are
        labeled, and most operations are controlled.  The sample
        policy has been updated.</p>
      
      <p>The TrustedBSD MAC Framework now controls mount, umount, and
        remount operations.  A new MAC system call, mac_get_fs() can
        be used to query the mountpoint label.  lmount() system call
        allows a mount label to be explicitly specified at mount
        time.  The SEBSD policy module has been updated to reflect
        this functionality, and sample TE policy has been updated.
        (Not yet merged)</p>
      
      <p>SEBSD now enforces protections on POSIX semaphores; the sample
        policy has been updated to demonstrate how to label and control
        sempahores.  This includes sample rules for PostgreSQL.</p>
      
      <p>The SEBSD sample policy, policy syntax, and policy tools have
        been updated to the SELinux code drop from August.  Bmake these
        pieces so we don't need gmake.</p>
      
      <p>Provide file ioctl() MAC Framework entry point and SEBSD
        implementation.</p>
      
      <p>A large number of sample policy tweaks and fixes.  The policy
        has been updated to permit cron to operate properly.  It has
        been updated for FreeBSD 5.2 changes, including dynamically
        linked root.  Teach the sample policy about FreeBSD's sendmail
        wrapper.</p>
      
      <p>Adapt sysinstall and install process for SEBSD pieces.  Teach
        sysinstall, newfs, et al, about multilabel file systems, install
        SEBSD sample policy pieces, build policy.  Automatically load
        the SEBSD module on first boot after install.</p>
      
      <p>Allow "ls -Z" to print out labels without long format.</p>
    </body>
  </project>
  
  <project>
    <title>TrustedBSD Audit</title>
    
    <contact>
      <person>
        <name>
          <given>Robert</given>
          
          <common>Watson</common>
        </name>
        
        <email>rwatson@FreeBSD.org</email>
      </person>
      
      <person>
        <name>
          <given>TrustedBSD Audit Discussion List</given>
        </name>
        
        <email>trustedbsd-audit@TrustedBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.trustedbsd.org/components.html#audit">TrustedBSD
        Audit Page</url>
      
    </links>
    
    <body>
      
      <p>The TrustedBSD Project is producing an implementation of CAPP
        compliant Audit support for use with FreeBSD.  Little progress
        was made on this implementation between October and December
        other than an update to the existing development tree.  However,
        in January, work began on porting the Darwin Audit
        implementation to FreeBSD.  Details on this work will appear in
        the next report; more information is available on the TrustedBSD
        audit discussion list.  Perforce messages may be seen on the
        trustedbsd-cvs mailing list.</p>
      
    </body>
  </project>
  
  <project>
    <title>TrustedBSD Documentation</title>
    
    <contact>
      <person>
        <name>
          <given>Robert</given>
          
          <common>Watson</common>
        </name>
        
        <email>rwatson@FreeBSD.org</email>
      </person>
      
      <person>
        <name>
          <given>TrustedBSD Discussion Mailing List</given>
          
        </name>
        
        <email>trustedbsd-discuss@TrustedBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.TrustedBSD.org/docs.html">TrustedBSD
        Documentation Page</url>
    </links>
    
    <body>
      <p>The TrustedBSD Project is implementing many new features
        for the FreeBSD Project.  It also provides documentation for
        users, administrators, and developers.</p>
      
      <p>mac_support.4 added -- documents TrustedBSD MAC Framework
        feature compatibility.  See also the MAC Framework report.</p>
      
      <p>FreeBSD security architecture updated and corrections/additions
        made.</p>
      
      <p>A variety of documentation updates relating to API changes,
        including the socket-related API changes in libc/mac(3).</p>
    </body>
  </project>
  
  <project>
    <title>FreeBSD/MIPS Status Report</title>
    
    <contact>
      <person>
        <name>
          <given>Juli</given>
          
          <common>Mallett</common>
        </name>
        
        <email>jmallett@FreeBSD.org</email>
      </person>
    </contact>
    
    <links>
      <url href="http://www.FreeBSD.org/projects/mips/" />
    </links>
    
    <body>
      <p>TLB support code and PMAP have come along nicely.  GCC and related
        have been kept up to date with the main tree.  An evaluation board
        from Broadcom was donated and initial work on that platform has been
        occurring.  Much old and obsolete code brought from NetBSD for
        bootstrapping the effort has been cleaned up.  The system has been
        seen to get to the point of trying to initialize filesystems, but
        there are still bugs even before that milestone.</p>
    </body>
  </project>
  
  <project>
    <title>AGP 3.0 Support</title>
    
    <contact>
      <person>
        <name>
          <given>John</given>
          
          <common>Baldwin</common>
        </name>
        
        <email>jhb@FreeBSD.org</email>
      </person>
    </contact>
    
    <body>
      <p>Simple support AGP 3.0 including support for AGP 8x mode was
        added.  The support is simple in that it still assumes only one
        master and one target.  The main gain is the ability to use AGP
        8x with drm modules that support it.</p>
    </body>
  </project>
  
  <project>
    <title>Network Subsystem Locking and Performance</title>
    
    <contact>
      <person>
        <name>
          <given>Sam</given>
          
          <common>Leffler</common>
        </name>
        
        <email>sam@FreeBSD.org</email>
      </person>
    </contact>
    
    <body>
      <p>The purpose of this project is to improve performance of the network 
        subsystem.  A major part of this work is to complete the locking of
        the networking subsystem so that it no longer depends on the "Giant
        lock" for proper operation.  Removing the use of Giant will improve
        performance and permit multiple instances of the network stack to
        operate concurrently on multiprocessor systems.</p>
      
      <p>Locking of the network subsystem is largely complete.  Network
        drivers, middleware layers (e.g. ipfw, dummynet, bridge, etc.), the
        routing tables, IPv4, NFS, and sockets are locked and operating
        without the use of Giant.  Much of this work was included in the 5.2
        release, but not enabled by default.  The remaining work (mostly
        locking of the socket layer) will be committed to CVS as soon as we
        can resolve how to handle "legacy protocols" (i.e. those protocols
        that are not locked).  The code can be obtained now from the Perforce
        database.  A variety of test and production systems have been running
        this code for several months without any obvious issues.</p>
      
      <p>Performance analysis and tuning is ongoing. Initial results indicate
        SMP performance is already better than 4.x systems but UP performance
        is still lagging (though improved over -current). The removal of Giant
        from the network subsystem has reduced contention on Giant and
        highlighted performance bottlenecks in other parts of the system.</p>
      
      <p>This work was supported by the FreeBSD Foundation.</p>
    </body>
  </project>
  
  <project>
    <title>Wireless Networking Support</title>
    
    <contact>
      <person>
        <name>
          <given>Sam</given>
          
          <common>Leffler</common>
        </name>
        
        <email>sam@FreeBSD.org</email>
      </person>
    </contact>
    
    <body>
      <p>Work to merge the NetBSD and MADWIFI code bases is almost complete.  
        This brings in new features and improves sharing which will enable
        future development.  Support was added for 802.1x client
        authentication (using the open1x xsupplicant program) and for shared
        key authentication (both client and AP) which improves interopability
        with systems like OS X. The awi driver was updated to use the common
        802.11 layer and the Atheros driver received extensive work to support
        hardware multi-rate retry.  Kismet now works with the
        device-independent radiotap capture format.  All of this work is still
        in Perforce but should be committed to CVS soon.  </p>
      
      <p>Work has begun on full 802.1x and WPA support.</p>
      
    </body>
  </project>

  <project>
    <title>SMPng Status Report</title>

    <contact>
      <person>
        <name>
          <given>John</given>

          <common>Baldwin</common>
        </name>

        <email>jhb@FreeBSD.org</email>
      </person>

      <person>
        <email>smp@FreeBSD.org</email>
      </person>
    </contact>

    <links>
      <url href="http://www.FreeBSD.org/smp/" />
    </links>

    <body>
      <p>Work is progressing on SMPng on several different fronts.  Sam
        Leffler and several other folks have been working on locking the
        network stack as mentioned elsewhere in this update.  Several
        infrastructure improvements have been made in the past few months
        as well.</p>

      <p>The low-level interrupt code for the i386 architecture has been
        redesigned to allow for a runtime selection between different types
        of interrupt controllers.  This work allows the Advanced Programmable
        Interrupt Controllers (APICs) to be used instead of the AT 8259A PIC
        without having to compile a separate kernel to do so.  It also allows
        the APIC to be used in a UP kernel as well as on a UP box.  Together,
        all these changes allow an SMP kernel to work on a UP box and thus
        allowed SMP to be enabled in GENERIC as it already is on all of the
        other supported architectures.  This work also reworked the APIC
        support to correctly route PCI interrupts when using an APIC to
        service device interrupts.  This work was also used to add SMP support
        to the amd64 port.</p>

      <p>A turnstile implementation was committed that implemented a queue
        of threads blocked on a resource along with priority inheritance of
        blocked threads to the owner of the resource.  Turnstiles were then
        used to replace the thread queue built into each mutex object which
        shrunk the size of each mutex as well as reduced the use of the
        sched_lock spin mutex.</p>
    </body>
  </project>
</report>
