Casper Dik's Weblog

Monday March 12, 2007

OGP election

About a week ago I accepted my nomination for the OGB after being nominated by Garrett D'Amore medio february.

Why do I nominate myself?

I've always felt a strong sense of community with all folks involved with Unix, SunOS and later Solaris. Having earned the dubious distinction of running one of the few Solaris 2.1 sites in production and sharing my experiences of that time with the world, I can truly say that I have been part of the Solaris community pretty much from the day it was born.

I joined Sun some years later, in 1995, and continued to be outward facing and involved with the community, regardless of whatever folly reigned at Sun at the time such as the time the edict came that all outside communication needed to be approved by a PR person. Surely they wouldn't have found the time to approve my 1000s of posts, even if they had found the will.

As the most prolific Sun employee/poster in OpenSolaris I believe I have firmly established my role as a community player; leading the laptop community and sharing some of the stuff I made through the OpenSolaris website.

I also think the OGB needs a person who is well-versed in Solaris "ON" development; someone who knows an ARC from a C-team and who has more than passing knowledge of our development process.


As an OGB member, I think I foremost want to focus on getting the open development process moving ahead more smoothly; and this does mean direct commit access. The current system is too much of a bottleneck for external development. As a Sun employee, I can look at both sides of the fence which can help resolve issues between Sun and the community.

But I also believe in quality all the time; it is what makes Solaris fairly stable to use, even using the more or less experimental releases.

I've written a bunch of code and have literally build 100s of kernels; some of which blew up spectacularly but others of which code found its way back into (Open)Solaris such as Solaris privileges, getpeerucred() et.al. I've distributed experimental code (acpidrv, powernow) and even experimented with the X server. As a security person, I have needed to touch larger parts of the system than many of my peers; security bugs know no boundaries.

I make a point of always running the latest release of Solaris Nevada on most of my systems, that is, unless there's fatal brakage. So my little home server, my laptop and my desktops all run Snv_59 today.

Once we have established all our procedures, I see the OGB pretty much as a hands-off body. We are there to quell conflicts but I don't think we should be pussyfooting around the mailing lists; a spade is a spade so let's not call it by another name. Arguments are healthy and should not be supressed unless they become destructive. I like to think that developers like it that way: just enjoy doing there thing with as little as possible outside interference.

Yes, I'm late in posting this; let me just say that life was pretty full the last few weeks. Both workwise (moving office and some urgent matters which required me to skip some vacation) and personal (buying a new house). Lame excuses, I know.

Let your vote be counted!

(2007-03-12 07:46:22.0) Permalink Comments [1]

Thursday October 19, 2006

NLOSUG: 26/10/2006 Dutch OpenSolaris User Group First Meeting The Dutch OpenSolaris User Group will have a meeting at the Sun offices in Amersfoort at Oktober 26, 2006. For program and registration see the website. (2006-10-19 04:20:42.0) Permalink Comments [1]

Monday January 16, 2006

Updated drivers: but only at www.opensolaris.org I've updated the powernow driver because of a serious incompatibility with the upcoming SOlaris build 32.
I've also updated acpidrv and also moved it to the opensolaris laptop community.

Start with downloading the frkit script and running it.
(2006-01-16 11:27:26.0) Permalink

Tuesday October 25, 2005

Small acpidrv update

I've created a small update to acpidrv which lets you specify automatic shutdown parameters when your battery runs low.

As usual, it can be found here.

(2005-10-25 06:29:16.0) Permalink Comments [2]

Monday October 10, 2005

OpenSolaris User Group Meeting, Amsterdam, October 18th

I've arranged for an OpenSolaris User Group BOF at Euro OSCon in Amsterdam. While the primary focus would be to get a Dutch/Benelux OpenSolaris User Group in the air.

7.30pm (19:30 for those of you who can tell time properly :-) in the Krasnapolsky Hotel in Amsterdam

I have a suitcase full of SWAG so come and get some.

Information over the BOFs and the conference can be found here

(2005-10-10 12:24:57.0) Permalink Comments [0]

Laptop community live!

As promised, the OpenSolaris laptop community went live somewhere in the last few days.

The first wireless driver is available (Supporting some Atheros MiniPCI and cardbus cards; but Cardbus support will have to wait until the Solaris cardbus driver is released)

Watch that space for further announcement of exciting drivers which will make your laptop much more usable.

Oh, I've finally refreshed the powernow driver to be a bit more lenient with broken BIOSes and initial CPU configs which are a bit off.

(2005-10-10 04:39:42.0) Permalink Comments [2]

Thursday September 22, 2005

Laptops After advancing the state of Solaris on the Ferrari 3400 with frkit, someone suggested that I should one of all new laptops we at Sun may decide to standardize on. That's how it came to be that I now have both a Ferrari 3400 and a Ferrari 4000.

But today in the mail, I got a message telling me of yet another laptop heading my way. This time a lightweight Fujitsu s2110, again a AMD64 based laptop, as those are the ones we like best.

Perhaps should I make a plot of laptops I got and when and then see if I can estimate the curve; I think I got one in '96, one in 2000, another one in dec 2004 and then again 6 months later and yet again 3 months later; with this accelerating pace it'd be one a day at christmas and one per hour early next year. Hm, perhaps not likely.

Solaris keeps on improving rapidly when it comes to device support; and while in the laptop space things appear to be moving forward very rapidly, there also appears to be some gravitating toward common chipsets. Graphics are often an issue but the fact that the Ferrari 4000 comes with a ATI X700 has the consequence that the updating of the Xorg ati driver is done much more quickly than before.

The Ferrari 3400 is relatively well supported in S10, though I think you really need my powernow driver and even then it still runs fairly hot to the touch.

The Ferrari 4000 requires some external drivers, but then, so does most bleeding hardware, regardless of OS. For the Ferrari 4000, you'll need to download the ethernet driver "bcme" from broadcom.com and we're working hard on getting OSS sound to work nicely on it. The 4000 runs much cooler than the 3400, but the downside is that it always has its fan blowing, albeit quitely. Probably because of a device enumeration bug, the firewire does not yet work. The SD card reader is a special device and we do not support it, unfortunately.

Of course, we're working on getting our broadcom ethernet driver "bge" and the one by broadcom "bcme" to be merged and shipped as a single driver.

Cardbus support is coming for all laptops, as the cardbus interface is properly standardized and they all work more or less the same.

I haven't gotten the Fujitsu yet, so I can't tell how well that will run and/or whether tweaking is necessary.

I don't like to recommend any particular brand or kind of laptop; one recommendation which I can make is this: run Solaris Express on it. It will get all the laptop features you may want much sooner. Such features include new drivers, Xorg support for new hardware, ACPI support, newboot, bug fixes (in some cases the difference between a device working and not working is just a small fix in an existing driver).

S10 was a huge leap forward and brought Solaris for x86/x64 to a point where it again runs on lots of (server) hardware. In Solaris Express, there is much more room for desktop/laptop innovation. We now ship several different x64 desktop platforms, so the x64 desktop/laptop space has much more visibility inside Sun.

If you want performant OpenGL, the only choice you have now is buying a laptop with an nVidia graphics chip and installing the nVidia "closed source" driver.

On the wireless front, things are moving but slowly, but more soon here. So watch this space.

Bluetooth is still a barren landscape when it comes to Solaris; I can't use the bluetooth rodent that came with the Ferrari 4000 (I'm saying rodent because it's quite a bit bigger than a mouse)

Note: I've just started the laptop-discuss list at opensolaris.org

(2005-09-22 13:50:54.0) Permalink Comments [9]

Tuesday June 28, 2005

First Installment (of frkit) I've teased people before about the nifty hacks I've been doing for my Ferrari 3400 laptop.

The hacks I did and the tool I wrote to make the distribution easier were so well liked that there was this "meme" propagating that whenever we got even cooler laptops, I should get the first one. And so it happened, I literally got the first Ferrari 4000 shipped to Sun.

Now, this is a whole different beast than the Ferrari 3400 and I haven't yet gotten quite to the same comfort level yet.

I've long promised to make all of the neat stuff available, but legalities are the difficult part of such a venture. But now with OpenSolaris and a supported license scheme (plus management buy-in), I now feel comfortable to release the stuff which I wrote or was derived from source now available under the CDDL)

The first installment includes my single CPU "PowerNow!(tm)" driver and my battery driver and utility.

What the heck, let's throw in the mdb scripts which enable the additional keys on the Acer keyboards (mail, www, P1, P2, audio control). Some of these appear standard controls and may work for internet keyboards as well.

The tar.gz files all come with an install script which will take care of all the details of the installation; the battery driver requires ACPICA; that is only included in Solaris Nevada (11) build 14 and later.

I'll see what I can do about the GNOME battery utility we've done as well; oh, sorry for the somewhat lacking documentation.

Update: I've added acpipowertool, a small graphic battery meter by Matt Simmons, and fixed some installation issues for root user's without "nm" in $PATH.

Update2: (2005/7/31) Ive upgraded powernow so it works for more systems and to better integrate powernowadm with SMF; apcidrv is also updated to do a little bit more of thermal zone handling.

acpidrv only works for Solaris express build 14 and later; powernow should work with Solaris 10 GA also.

Update3: frkit is for some time now available as runnable script at www.opensolaris.org in the (2005-06-28 08:26:54.0) Permalink Comments [25]

Tuesday June 14, 2005

User Credentials and all that

Peter Harvey's story reminds me of the unforeseen consequences of creating the ucred in Solaris 10. The ucred was motivated by two factors: the introduction of privileges and a way to propagate information about process credentials through the system in userland.

Before Solaris 10, we had several mechanisms, some internal, some public, all propagating a subset of that information.

in sys/door.h:

/*
 * Structure used to return info from door_cred
 */
typedef struct door_cred {
        uid_t   dc_euid;        /* Effective uid of client */
        gid_t   dc_egid;        /* Effective gid of client */
        uid_t   dc_ruid;        /* Real uid of client */
        gid_t   dc_rgid;        /* Real gid of client */
        pid_t   dc_pid;         /* pid of client */
        int     dc_resv[4];     /* Future use */
} door_cred_t;

in sys/tl.h:

#define TL_OPT_PEER_CRED 10
typedef struct tl_credopt {
        uid_t   tc_uid;         /* Effective user id */
        gid_t   tc_gid;         /* Effective group id */
        uid_t   tc_ruid;        /* Real user id */
        gid_t   tc_rgid;        /* Real group id */
        uid_t   tc_suid;        /* Saved user id (from exec) */
        gid_t   tc_sgid;        /* Saved group id (from exec) */
        uint_t  tc_ngroups;     /* number of supplementary groups */
} tl_credopt_t;

in rpc/svc.h:

/*
 * Obtaining local credentials.
 */
typedef struct __svc_local_cred_t {
        uid_t   euid;   /* effective uid */
        gid_t   egid;   /* effective gid */
        uid_t   ruid;   /* real uid */
        gid_t   rgid;   /* real gid */
        pid_t   pid;    /* caller's pid, or -1 if not available */
} svc_local_cred_t;

and in the project I missed this one in sys/stropts.h:

struct k_strrecvfd {    /* SVR4 expanded syscall interface structure */
        struct file *fp;
        uid_t uid;
        gid_t gid;
        char fill[8];
};

There was also the need to be able to enquire about other processes and perhaps network connections and packets; a getpeereid interface was requested.

Now, what information should such an interface return? Network interfaces often only allow you to shape requests as a blob of bytes. And that blob needs to have a predictable maximum size too. As you can see from the above examples, even declaring a number of filler elements is not sufficient; none of the above structures which include a filler have space for the full complement of 16 groups, let alone Pete's proposed 65536 maximum number of groups.

The most natural way of implementing a blob which such restrictions is using an opaque data structure with accessor functions (in <ucred.h>):

extern ucred_t *ucred_get(pid_t pid);

extern void ucred_free(ucred_t *);

extern uid_t ucred_geteuid(const ucred_t *);
extern uid_t ucred_getruid(const ucred_t *);
extern uid_t ucred_getsuid(const ucred_t *);
extern gid_t ucred_getegid(const ucred_t *);
extern gid_t ucred_getrgid(const ucred_t *);
extern gid_t ucred_getsgid(const ucred_t *);
extern int   ucred_getgroups(const ucred_t *, const gid_t **);

extern const priv_set_t *ucred_getprivset(const ucred_t *, priv_ptype_t);
extern uint_t ucred_getpflags(const ucred_t *, uint_t);

extern pid_t ucred_getpid(const ucred_t *); /* for door_cred compatibility */

extern size_t ucred_size(void);

extern int getpeerucred(int, ucred_t **);

extern zoneid_t ucred_getzoneid(const ucred_t *);

extern projid_t ucred_getprojid(const ucred_t *);

The ucred_t itself is defined in sys/ucred.h, a header which isn't installed on the system because programs are not supposed to use it; it is a private interface between the kernel and the library.
One function of note is perhaps ucred_size() which returns the maximum size of a credential on the system; it can be used to size credentials allocated on the stack or embedded in structures.
In many cases, the system will just allocate one for you and return the allocated one, but the interfaces have been structured so you can reuse ones returned earlier or ones you allocated yourself.

By now you may be asking yourself where you get creds; well, here are some examples in the OpenSolaris source code: nscd getting a door cred, rpcbind getting an rpc caller credential and the use of the TL option by RPC.

And your typical use of the function in an inetd started daemon:

#include <ucred.h>

int
main(int argc, char **argv)
{
	ucred_t *uc = NULL;

	if (getpeerucred(0, &uc) == 0) {
		/* we know something about the caller */
	}

        return (0);
}

And a slightly bigger example where we use XPG4 recvmsg to receive a UCRED control messages:

/*
 * Send a 1 byte UDP packet; print the response packet if one is
 * received.
 */

#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/signal.h>
#include <netinet/in.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <netdb.h>
#include <stdlib.h>
#include <arpa/inet.h>

int
main(int argc, char **argv)
{
        struct sockaddr_storage stor;
        struct sockaddr_in *sin = (struct sockaddr_in *)&stor;
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&stor;
        ssize_t bytes;
        union {
                struct cmsghdr hdr;
                unsigned char buf[2048];
                double align;
        } cbuf;
        unsigned char buf[2048];
        struct msghdr msg;
        struct cmsghdr *cmsg;
        struct iovec iov;
        int one = 1;

        msg.msg_name = &stor;
        msg.msg_iov = &iov;
        msg.msg_iovlen = 1;

        iov.iov_base = buf;

        setsockopt(0, IPPROTO_IP, IP_RECVDSTADDR, &one, sizeof (one));
        setsockopt(0, IPPROTO_IPV6, IPV6_RECVPKTINFO, &one, sizeof (one));
        setsockopt(0, SOL_SOCKET, SO_RECVUCRED, &one, sizeof (one));
        alarm(30);

        while (1) {
                char abuf[256];
                msg.msg_control = &cbuf;
                msg.msg_controllen = sizeof (cbuf);
                msg.msg_namelen = sizeof (stor);
                iov.iov_len = sizeof (buf);

                bytes = recvmsg(0, &msg, 0);

                if (bytes >= 0) {

                        if (msg.msg_namelen != 0 &&
                            connect(0, (struct sockaddr *)&stor,
                            msg.msg_namelen) != 0)
                                exit(1);
                        printf("you connected from %s with the credential\n",
                                inet_ntop(stor.ss_family,
                                    stor.ss_family == AF_INET ?
                                        (void *)&sin->sin_addr :
                                        (void *)&sin6->sin6_addr,
                                        abuf, sizeof(abuf)));
                        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg;
                            cmsg = CMSG_NXTHDR(&msg, cmsg)) {
                                if (cmsg->cmsg_level == SOL_SOCKET &&
                                    cmsg->cmsg_type == SCM_UCRED) {
                                        ucred_t *uc = (ucred_t *)
                                            CMSG_DATA(cmsg);

                                        /* We have a ucred here !! */
                                }

                        }
                        if (msg.msg_namelen != 0)
                                (void) connect(0, NULL, 0);
                } else {
                        exit(1);
                }
        }
}

But thinking back of Pete's problem, we see a problem when increasing max groups, even worse, this libnsl private datastructure is abused and multiple copies exist which need to be kept in sync (so parts of the system broke when I changed it in this one place). The bug is an illustration why cut & paste programming doesn't work and why even when you share a private defintion, you must use a proper header file. I filed the bug as soon as I did the quick fix for the Solaris Express respin, the bug is 4994017.

Tuesday May 31, 2005

Southpark Stdio I guess we all have to do this now, so here's my self-portrait. After pointing my kids to this, they and their friends spend a whole afternoon creating images of themselves, their mothers and fathers. Well, I preempted them and did myself before they had a chance.
(2005-05-31 06:29:50.0) Permalink Comments [1]

Saturday May 07, 2005

Open Solaris Release Date Set Well, the Open Solaris "vaporware" release date is now set; and as the end of Q2 draws near this should be no surprise. It's only a few days after my dad's 73rd birthday, so I have two things to celebrate that week. (2005-05-07 06:03:59.0) Permalink Comments [6]

Wednesday April 27, 2005

The End of Realmode Boot I've already mentioned two great new features in our current development release; ACPICA and USB hotplug.

But there's one change that's much more far reaching than that: Newboot.

Most Solaris x86 users will be familiar with the blue screen/device configuration assistant/boot sequence and how ancient some of that feels. Perhaps few are aware that the DCA is actually a realmode DOS like environment where each boot device requires its own realmode driver. These drivers needed to be compiled with a 16 bit compiler and 16 bit MASM, not available for ready money anywhere. While the official build environment required NT, I managed to build it on environments ranging from MS Windows 98 and 2000 on actual PCs to Caldera DOS 7 on a SunPCi card (which allowed for automatic building which was great fun). Now that this piece of shameful history lies in the past, I am not afraid to confess.

But as of last Sunday, April 17th, 2005, we have "legacy free" newboot. Newboot uses grub with ufs support so we now have native grub support and a menu we can edit from inside Solaris. Device enumeration completely done using ACPI

Because it skip the device configuration assistant and boot a single large file with all kernel device drivers which makes startup quite a bit quicker and allows us to boot from any bootable device as long as we also support it in the kernel so we can mount root.

And we've reverted back to white on black consoles; this again takes some getting used, surprisingly enough.

One thing to note is that before you may had to disable ACPI in the kernel and the BIOS; with Newboot + ACPICA, you actually stand a much better chance of the system working with all the default settings: ACPI on, ACPI 2.0 enabled. Even legacy USB enabled now has a much better chance of working than before.

But this is a radical change an PC BIOSes and hardware being like it is, interesting times ahead. SO please test drive when this hits Solaris Express in a few months time.

As of this writing, it's a bit in the balance whether you'll get to see the source first as part of OpenSolaris or the binaries as part of a Solaris Express. (2005-04-27 00:00:00.0) Permalink Comments [14]

Tuesday April 26, 2005

Netherlands/Benelux OpenSolaris/Solaris Usergroup A few of our customers approached me to start a Solaris user group in the Netherlands (or perhaps a somewhat larger area)

Any takers? Perhaps offers of venues, talks wanted?

For those who don't know, I am based in the Netherlands. (2005-04-26 13:38:40.0) Permalink Comments [5]

Yet Another Desktop/Laptop Usability Step "Solaris Nevada" build 14 is proving to be another quantum leap for Solaris desktop usability.

I discussed the new USB hotplug support in vold before, but in the last few days we've also gotten the virtual keyboard/mouse driver in the next Solaris release. People often complained about the fact that their laptop keyboard died until the next reboot when they plugged in a USB or other keyboard. Well, not anymore! We now have virtualized keyboard and mouse drivers which collect events from all available keyboards and present them through a single virtual keyboard and mouse. It is also still possible to use the devices as seprate devices in case you have a multi-head/multi-user environment, but for the common case of a single system with multiple keyboard (laptop + keyboard) this is another big step.

You can plug in the other keyboard at any time, running under X or the commandline, it just works. (2005-04-26 04:49:55.0) Permalink Comments [2]

Solaris FAQ Updated For the first time in many years (2.5 years) I've updated the Solaris FAQ

Much more work is needed on it but at least this is a start. I'm hoping to update it more regularly now. It's also still here but it seems to be doing fine there. (2005-04-26 04:45:12.0) Permalink Comments [3]