Showing posts with label freebsd. Show all posts
Showing posts with label freebsd. Show all posts

Sunday, January 25, 2015

FreeBSD LSI SAS9211-8i HBA firmware notes

I'll be using this post to store information about LSI HBA firmware, with a focus on FreeBSD (but also drawing upon Linux information). It may also be useful for users of FreeNAS, PC-BSD, unRAID, Nexenta, or ZFSguru.

Why - SATA port density on a budget

If you are using ZFS, you do not need RAID -- you just need lots of fast SATA ports. To maximize the features of ZFS, it needs to directly access attached drives in JBOD mode rather than as RAID. If you can afford them, you can buy the LSI 9211-8i HBA card. Alternatively, you can also buy a less expensive card, and then replace its stock "IR" (Initiator-RAID) firmware by "crossflashing" to an "IT" (Initiator-Target) version of LSI's general firmware for 9211-8i hardware. This option is useful for people building home NAS systems on a budget. Popular cards include the Dell PERC H200 and the IBM ServeRAID M1015. This ServeTheHome post introduces the topic well.

Here is the relevant dmesg for a Dell PERC H200 Internal (H200I) under FreeBSD 8.4-RELEASE. (Note that this particular card's LSI firmware (Phase 9) is out of sync with the FreeBSD driver (Phase 14), which may have unexpected side effects. The system was initially built as a FreeBSD 8.1-RELEASE system in 2010.)

$ uname -r
8.4-RELEASE-p19
$ egrep ^mps0 /var/run/dmesg.boot
mps0: <LSI SAS2008> port 0xc000-0xc0ff mem 0xfb3b0000-0xfb3bffff,0xfb3c0000-0xfb3fffff irq 16 at device 0.0 on pci3
mps0: Firmware: 09.00.00.00, Driver: 14.00.00.01-fbsd
mps0: IOCCapabilities: 1285c<ScsiTaskFull,DiagTrace,SnapBuf,EEDP,TransRetry,EventReplay,HostDisc>
mps0: [ITHREAD]

General flashing tips

Before flashing, and especially before erasing any flash, use the sas2flsh.exe -listall option to note the SAS ID of your device (usually beginning with "0x590"). If you accidentally erase the entire flash (sas2flsh.exe -o -e 6 will retain your SAS ID, but sas2flsh.exe -o -e 7 will wipe it), you will not be able to re-flash the device unless you have this ID. Write it down.

Some earlier versions of sas2flsh.exe allow cards to be flashed from IR firmware to IT firmware; others do not. I and others have had luck with the one that comes with LSI's Phase 7 (AKA P7 or P07) firmware. (Try this link, or search LSI.com for "9211_8i_Package_For_P7_Firmware_BIOS_Upgrade_on_MSDOS_and_Windows" to download the package that contains this version of sas2flsh.exe.

To flash the firmware on cards installed in non-UEFI motherboards, you can create a DOS-bootable USB key using a tool like Rufus. Rufus will make the device bootable with FreeDOS or MS-DOS (well, actually, Windows ME!). I and others have had better luck using the MS-DOS option. (According to that thread, LSI themselves recommend MS-DOS rather than FreeDOS).

Also note that when flashing using sas2flsh.exe there are two different components to be flashed: the firmware (contained in a filename sometimes ending with .fw, and usually named after the device in some way) and the BIOS (usually named something like MPTSAS2.ROM). The firmware component is what your OS driver communicates with. The BIOS component allows you to configure the firmware at boot time, and can enumerate the list of attached hard drives. For ZFS and JBOD purposes, the BIOS is not strictly necessary, and has even been reported to cause problems when present. Erasing the firmware areas sas2flsh.exe -o -e 6 and then just applying the firmware without the BIOS will also result in faster boot times.

A common error that people get when flashing is "Failed to Validate Mfg Page 2". This occurs when you try to flash to the LSI firmware without first erasing the firmware. The techmattr blog has some good information.

Phase 10 firmware or higher is needed for cards in this family (6GB/s HBSa) in order to support drives larger than 2GB. See this LSI KB article (old version cached at the Internet Archive)

FreeBSD flashing considerations

At this writing (2015-01), there have been reports of Phase 20 not playing well with FreeNAS and FreeBSD. Downgrading to Phase 16 (FreeBSD 9.3 and 10.0) or Phase 19 (FreeBSD 10.1) is reported to be more stable.

Under FreeBSD, PC-BSD, and FreeNAS, the desired end state is for the "Firmware" and "Driver" ports of the dmesg line to use identical firmware versions. For FreeBSD 10.1-RELEASE, this is the Phase 19 version. In the dmesg output, the Firmware item is what's on the card, and the Driver item is what the OS supplies.

mps0: Firmware: 19.00.00.00, Driver: 19.00.00.00-fbsd

In fact, FreeNAS will even complain if they are mismatched.

(I also list all of the firmware/OS pairings I know of towards the end of this post.)

Beware when upgrading a FreeBSD-based OS. Depending on the combination of firmware and driver, your drives may disappear from the OS' view until you reflash. This can be especially troublesome if your root filesystem is ZFS.

How to reflash the Dell Internal Tape Adapter 15MCV card as a 9211-8i

There is a card from Dell that looks almost identical to the H200I card, but is actually a Dell Internal Tape Adapter board (Dell part number 15MCV). This is identified in various levels of firmware and utilities as "Int Tape Adapter" or "IntTapeAdptr", and identified under Linux as:

 Vendor(0x1000), Device(0x0072), SSVID(0x1028), SSDID(0x1F22)

Cards labeled as "H200" on eBay are sometimes actually these cards instead. Unfortunately, the usual methods for flashing to generic LSI drivers do not work for the Tape Adapter boards. But as discovered by Hardforum user lamune in this post, if you start from the original Dell Internal Tape Adapter firmware, and then, without erasing the current firmware, flash using Supermicro HBA drivers (Phase 16 at this writing) as an intermediate step, you can then flash to the LSI firmware.

Here is the Linux dmesg for my Internal Tape Adapter board, prior to being cross-flashed. Note that capabilities include RAID, and the BIOS has a standard version (07.11.10.00):

$ dmesg | egrep -i 'lsi|mpt|mps|sas'
[    0.000000]   HighMem  empty
[    5.722377] mpt2sas version 16.100.00.00 loaded
[    5.731608] scsi4 : Fusion MPT SAS Host
[    5.739575] mpt2sas0: 32 BIT PCI BUS DMA ADDRESSING SUPPORTED, total mem (497212 kB)
[    5.739643] mpt2sas 0000:01:00.0: irq 43 for MSI/MSI-X
[    5.739682] mpt2sas0-msix0: PCI-MSI-X enabled: IRQ 43
[    5.739686] mpt2sas0: iomem(0x00000000dfcb0000), mapped(0xe0280000), size(65536)
[    5.739689] mpt2sas0: ioport(0x000000000000dc00), size(256)
[    6.028016] mpt2sas0: sending diag reset !!
[    7.268013] mpt2sas0: diag reset: SUCCESS
[    7.418064] mpt2sas0: Allocated physical memory: size(4134 kB)
[    7.418070] mpt2sas0: Current Controller Queue Depth(2748), Max Controller Queue Depth(2879)
[    7.418073] mpt2sas0: Scatter Gather Elements per IO(128)
[    7.648484] mpt2sas0: LSISAS2008: FWVersion(07.15.08.00), ChipRevision(0x03), BiosVersion(07.11.10.00)
[    7.648490] mpt2sas0: Dell 6Gbps SAS: Vendor(0x1000), Device(0x0072), SSVID(0x1028), SSDID(0x1F22)
[    7.648492] mpt2sas0: Protocol=(Initiator,Target), Capabilities=(Raid,TLR,EEDP,Snapshot Buffer,Diag Trace Buffer,Task Set Full,NCQ)
[    7.648577] mpt2sas0: sending port enable !!
[   10.168254] mpt2sas0: host_add: handle(0x0001), sas_addr(0x590bxxxxxxxxxxxx), phys(8)
[   15.296010] mpt2sas0: port enable: SUCCESS

Here is a Linux dmesg after successful crossflash of firmware, but skipping installing a BIOS. Note that capabilities no longer include RAID, and BIOS is empty (00.00.00.00)

$ dmesg | egrep -i 'lsi|mpt|mps|sas'
[    0.000000]   HighMem  empty
[    5.784639] mpt2sas version 16.100.00.00 loaded
[    5.789191] scsi4 : Fusion MPT SAS Host
[    5.793970] mpt2sas0: 32 BIT PCI BUS DMA ADDRESSING SUPPORTED, total mem (497212 kB)
[    5.794039] mpt2sas 0000:01:00.0: irq 43 for MSI/MSI-X
[    5.794081] mpt2sas0-msix0: PCI-MSI-X enabled: IRQ 43
[    5.794086] mpt2sas0: iomem(0x00000000dfcb0000), mapped(0xe0140000), size(65536)
[    5.794088] mpt2sas0: ioport(0x000000000000dc00), size(256)
[    6.235645] mpt2sas0: Allocated physical memory: size(4964 kB)
[    6.235652] mpt2sas0: Current Controller Queue Depth(3307), Max Controller Queue Depth(3432)
[    6.235654] mpt2sas0: Scatter Gather Elements per IO(128)
[    6.468421] mpt2sas0: LSISAS2008: FWVersion(19.00.00.00), ChipRevision(0x03), BiosVersion(00.00.00.00)
[    6.468429] mpt2sas0: Dell 6Gbps SAS: Vendor(0x1000), Device(0x0072), SSVID(0x1028), SSDID(0x1F22)
[    6.468432] mpt2sas0: Protocol=(Initiator,Target), Capabilities=(TLR,EEDP,Snapshot Buffer,Diag Trace Buffer,Task Set Full,NCQ)
[    6.468517] mpt2sas0: sending port enable !!
[    8.978905] mpt2sas0: host_add: handle(0x0001), sas_addr(0x590b11c017d2a400), phys(8)
[   14.116010] mpt2sas0: port enable: SUCCESS

Known FreeBSD versions and their equivalent target mps driver versions

  • 8.2-RELEASE: Phase 12? - not sure, but likely 12.00.00.00-fbsd - did not ship with, but it can be backported
  • 8.3-RELEASE: Phase 13 - mps0: Firmware: xx.xx.xx.xx, Driver: 13.00.00.00-fbsd
  • 8.4-RELEASE: Phase 14 - mps0: Firmware: xx.xx.xx.xx, Driver: 14.00.00.01-fbsd - LSI P14 firmware
  • 9.1-RELEASE: Phase 14 - mps0: Firmware: xx.xx.xx.xx, Driver: 14.00.00.01-fbsd
  • 9.2-RELEASE: Phase 14 - mps0: Firmware: xx.xx.xx.xx, Driver: 14.00.00.01-fbsd
  • FreeNAS v ?? Phase 15 - mps0: Firmware: xx.xx.xx.xx, Driver: 15.00.00.00-fbsd - LSI P15 firmware (ref)
  • 9.3-RELEASE: Phase 16 - mps0: Firmware: xx.xx.xx.xx, Driver: 16.00.00.00-fbsd - LSI P16 firmware
  • 10.0-RELEASE: Phase 16 - mps0: Firmware: xx.xx.xx.xx, Driver: 16.00.00.00-fbsd
  • Phase 18 was committed but not in a release that I can tell.
  • 10.1-RELEASE: Phase 19 - mps0: Firmware: xx.xx.xx.xx, Driver: 19.00.00.00-fbsd - LSI P19 firmware
  • 10.2-BETA2: Phase 20 - mps0: Firmware: xx.xx.xx.xx, Driver: 20.00.00.00-fbsd - LSI P20 firmware (reported by Dan Langille)
  • 10.3-RELEASE: Phase 20 - mps0: Firmware: xx.xx.xx.xx, Driver: 20.00.00.00-fbsd - LSI P20 firmware
  • 11.0-RELEASE: Phase 20? - mps0: Firmware: 20.00.07.00, Driver: 21.01.00.00-fbsd - (The FreeBSD driver is version 21, but the latest Avago firmware download (from 2016-04) still shows Phase 20 as the most recent).

Note:After Avago bought LSI, their new download system sometimes makes direct linking more difficult. This search may help.

FreeBSD firmware installers

I haven't had good luck with these, because they often can only perform a small subset of the actions necessary to upgrade firmware. But if you need them, here they are.

(For all firmware and installers, see LSI's archive)

Useful command-line snippets

sas2flsh -listall
sas2flsh -c 0 -o -testssid 1028:%SSID% > SSID.out
sas2flsh -c %num% -f fwname.fw > flash.out
sas2flsh -c %num% -b mptsas2.rom >> flash.out
sas2flsh -c %num% -b x64sas2.rom >> flash.out
sas2flsh -c %num% -o -reset > reset.out

References

Saturday, October 22, 2011

Using vi key bindings in Perl's debugger on FreeBSD

Even after verifying that Term::ReadKey and Term::ReadLine were part of my perl distribution:

royce@heffalump$ perl -e 'use Term::ReadKey;'
royce@heffalump$ perl -e 'use Term::ReadLine;'
royce@heffalump$

... and making sure that vi key bindings were listed in my .inputrc:

royce@heffalump$ grep editing-mode ~/.inputrc
set editing-mode vi

... I still couldn't use 'em, as demonstrated by what happened when I tried to use movement keys:

DB<1> testtesttest^[[A

In my research, I discovered that Ubuntu folks were installing a different ReadLine. I eventually found the devel/p5-ReadLine-Perl port, which has this pkg-descr:

Perl 5 ships with a module called Term::ReadLine which is an interface
to command line editing and recall. The version that ships with Perl
is only a stub, and offers little functionality.

This module supplants the Term::ReadLine stubs with real command line
editing and recall facilities, written entirely in Perl. Applications
that use Term::ReadLine do not need to be modified to gain the benefits
of this package; it will happen transparently upon installation.

After installing p5-ReadLine-Perl, I'm up and running.

Saturday, May 09, 2009

Colin Percival's scrypt: a new chapter in the history of encryption


Today at the 2009 BSDCan conference, Colin Percival (of FreeBSD and Tarsnap) announced a new key derivation function called scrypt. I am not a math person by any means - and the slides from the presentation explain it pretty well - but what Percival has done here is phenomenal. I feel lucky to have been there in person for the presentation.

The basic concept is that sequential memory-hard algorithms make dedicated encryption ASICs significantly more costly because they are sequential (difficult to run in parallel) and memory-hard (require a significant amount of RAM relative to the size of the input.)

In other words, making the math hard and difficult to run on ten thousand cores increases the time required, and making the math need a lot of room to be worked on increases the money required to crack the password. This is because it's relatively cheap to put 10,000 encryption-specific CPU mini-cores on a single die, but it's expensive to feed them piles of fast RAM in a small space.

This is nothing short of historic.

Brute-force attacks against encrypted passwords will change overnight - for passwords created after scrypt becomes available, that is. What was once a trivial password to crack becomes decidedly less trivial - literally by an order of magnitude. By Percival's back-of-the-slide-rule math, an 8-character password with good entropy (pretty random-looking) encrypted in .1 seconds (good enough for authentication speeds) will take on the rough order of CAD$4.8M to crack. By contrast, the previous best method (bcrypt) would cost $130K.

Longer strings (source text longer than passwords) become decidedly stronger by much greater factors because the function can spend more time on them, as the user has less of an interactive expectation for file encryption. If allowed to chew on the data for 5 seconds or less, a relatively short English text string encrypted using scrypt would take CAD$210B (vs $47M for bcrypt(!))

This table from the presentation shows the rough cost estimates to crack a string in 1 year (click to enlarge):


The last column may look odd because I've taken this slide out of context. Because the 40-character string is English text, it has decidedly less entropy, and is therefore easier to crack.

This isn't just theory; Percival has published version 1.0 of working FreeBSD demonstration code.

I decided to check it out in its early state. Out of the box, the demo code makes some quick checks of your system to see how much RAM you have, and tries to sanely limit how much it uses - because it can use a lot of RAM, very very quickly. There are also limits on how large a passphrase it will currently accept, as well as other parameters automatically sized based your system's memory size.

On a quick check of the code, the options are:

  • m - maximum memory fraction (default: .5, or 50% of RAM as reported by the hw.usermem sysctl for decryption; .128 for encryption)

  • M - maximum memory in bytes (default: 0)

  • t - maximum time in seconds (default: 5 for encryption; 300 for decryption)

In my testing on a 512M system, I couldn't immediately get it to eat more than 128M of RAM; not sure if this is fully by design, or if I'm passing the parameters incorrectly.
royce@heffalump$ time ./scrypt enc -m 1 -t 20 rand.in rand-scrypt.out
Please enter passphrase:
Please confirm passphrase:

real 0m25.090s
user 0m17.017s
sys 0m0.143s
The resulting file's header may not survive in future versions ... but for now, you can tell where it came from in the first six bytes:
royce@heffalump$ cut -b1-6 rand-scrypt.out | head -1
scrypt
At the presentation, FreeBSD Core Team member Brooks Davis asked a good question about the impact of large volumes of users trying to authenticate simultaneously on a system without huge amounts of RAM. Percival replied that the memory and other options could be tuned to fit the profile of a particular system. These parameters would be stored in the shadow password field, much as the salt and rounds are stored there today.

I look forward to seeing a full-fledged scrypt(3) show up in FreeBSD and OpenSSL ... and I'm sure that the Three Letter Agencies do not.

Thursday, April 30, 2009

update4.freebsd.org via ACS

Speaks for itself (if you speak geek):

$ host -t srv _http._tcp.update.freebsd.org | sort -k8
_http._tcp.update.freebsd.org has SRV record 1 10 80 update1.FreeBSD.org.
_http._tcp.update.freebsd.org has SRV record 1 25 80 update2.FreeBSD.org.
_http._tcp.update.freebsd.org has SRV record 1 5 80 update3.FreeBSD.org.
_http._tcp.update.freebsd.org has SRV record 1 30 80 update4.FreeBSD.org.
_http._tcp.update.freebsd.org has SRV record 1 50 80 update5.FreeBSD.org.
_http._tcp.update.freebsd.org has SRV record 1 5 80 update6.FreeBSD.org.

$ host update4.FreeBSD.org.
update4.FreeBSD.org has address 209.193.13.98

$ whois 209.193.13.98 | grep OrgName
OrgName: Alaska Communications Systems Group, Inc.

I am not authorized to speak on behalf of my employer (as some of you may remember from the May 17, 2002 edition of the ADN), but I'm personally pleased to be helping out with the upcoming release of FreeBSD 7.2!

Update: Note that our update server is only temporary, to help with the expected increased use of freebsd-update(8) for upgrading to the new release.

Also note that freebsd-update selects servers at random; if you're in Alaska, you can use -s update4.freebsd.org to select the ACS server.

Contributing more to FreeBSD

Next week, I am headed to BSDCan. I hope to meet people involved in the BSD family of projects, to learn about what people are working on, to talk about interesting problems ... and to stretch my CS brain that has been occupied by operational issues in the years since college.

But the truth is that I have a larger goal.

(deep breath)

To substantially improve my contributions to FreeBSD.

There. I said it.

I've read that public commitment to a goal increases the odds of success, and this seems pretty public. :-)

So the question is, how? I could use some advice or suggestions, especially from people who have traveled this road. (And if you're in the same boat with me and will be at BSDCan, let me know - I'd love to compare notes!)

So far, my plans for BSDCan are:

  • Spend some time with the FAQs for the topics covered, so that I'm not asking well-known questions.

  • Play with unfamiliar technologies in advance, to have questions ready.

  • At the Getting Started in FOSS session, find some buddies with similar goals - both for the conference and for contributing.

  • Strive to not be too much of a fanboy. :-)


My plans for ramping up in my contributions:

  • Tackling small outstanding problem reports, submitting patches, testing existing patches that are waiting for feedback, and contributing to bug busting.

  • Watching the FreeBSD mailing lists in more depth, looking for problems and practicing figuring out the solutions (and if I can't, find the solution posted and strive to understand it). It's also an opportunity to get a better feel for the culture.

  • Learning SGML so that I can contribute to the docs project.

  • Working through the Deitel & Deitel C book.

  • Use the source, Luke. :-)

  • Find a project that interests me and use it to fuel my C learning.

  • Study the FreeBSD Committer's Guide - I won't need to know most of it any time soon, but it should provide me with a framework to start understand the philosophy of the project in more detail.

  • Ponder the advice from Michael Lucas on becoming a committer (also long term planning).

  • Studying Design and Implementation and Modern Operating Systems.


What other tips or advice do you have?

Update: I'll keep a running list of other suggestions I've gotten below:

Thursday, July 17, 2008

New portupgrade features: portversion origin and fullname flags, pkgdu

portupgrade's portversion command is handy tool for tracking which third-party packages on your FreeBSD system have newer versions available.

portversion has some new flags and features in version 2.4.6 (committed just yesterday), and a new utility called pkgdu.

First, here's a quick summary of the changes to portversion. (This is just a simplified diff between the previous manpage and the current one):
<    portversion [-hrOqRv] [-l limit_chars] [-L inv_limit_chars]
> portversion [-hFOoQqRrv] [-l limit_chars] [-L inv_limit_chars]

> -F
> --fullname Display a package full name.
>
> -o
> --origin Display package origin instead of package name.
>
> -Q
> --quiet Do not display status chars.
>

Now, for some usage examples. In these examples, I'm using -L = to leave out all lines of output that indicate that the installed version and the version available in the ports tree are equal).

portversion now defaults to not showing the version on the left-hand side.
[royce@heffalump ~]$ portversion -v -L =
lsof < needs updating (port has 4.81A,2)
mytop < needs updating (port has 1.6_4)
net-snmp < needs updating (port has 5.4.1.2)
p5-Pod-Parser < needs updating (port has 1.35_2)
p5-Sub-Uplevel < needs updating (port has 0.1901_1)
p5-Test-ClassAPI < needs updating (port has 1.05)
p5-Test-Harness < needs updating (port has 3.12)
p5-version < needs updating (port has 0.75.01)
rsync < needs updating (port has 3.0.3)
sudo < needs updating (port has 1.6.9.17)
vim < needs updating (port has 7.1.330)

The new default behavior looks cleaner, but if you're used to the old output, it does make it hard to tell just how out of date you are. You can use -F to get the old behavior (with the version number of the currently installed software is displayed):
[royce@heffalump ~]$ portversion -vF -L =
lsof-4.80,2 < needs updating (port has 4.81A,2)
mytop-1.6_3 < needs updating (port has 1.6_4)
net-snmp-5.4.1_5 < needs updating (port has 5.4.1.2)
p5-Pod-Parser-1.35_1 < needs updating (port has 1.35_2)
p5-Sub-Uplevel-0.1901 < needs updating (port has 0.1901_1)
p5-Test-ClassAPI-1.04 < needs updating (port has 1.05)
p5-Test-Harness-3.11 < needs updating (port has 3.12)
p5-version-0.75 < needs updating (port has 0.75.01)
rsync-3.0.2_1 < needs updating (port has 3.0.3)
sudo-1.6.9.15_1 < needs updating (port has 1.6.9.17)
vim-7.1.315 < needs updating (port has 7.1.330)

You can display the ports' origins instead with -o. If you're not sure what a particular port is, you can get a good idea by knowing what subdirectory it's in:
[royce@heffalump ~]$ portversion -o -v -L =
sysutils/lsof < needs updating (port has 4.81A,2)
databases/mytop < needs updating (port has 1.6_4)
net-mgmt/net-snmp < needs updating (port has 5.4.1.2)
textproc/p5-Pod-Parser < needs updating (port has 1.35_2)
devel/p5-Sub-Uplevel < needs updating (port has 0.1901_1)
devel/p5-Test-ClassAPI < needs updating (port has 1.05)
devel/p5-Test-Harness < needs updating (port has 3.12)
devel/p5-version < needs updating (port has 0.75.01)
net/rsync < needs updating (port has 3.0.3)
security/sudo < needs updating (port has 1.6.9.17)
editors/vim < needs updating (port has 7.1.330)

What I'd love to see is an option that leaves the fullname data, but
puts whitespace between ... so that I can still see versions, but
have easy one-click highlighting of the package name:
lsof 4.80,2                 <  needs updating (port has 4.81A,2)
mytop 1.6_3 < needs updating (port has 1.6_4)
net-snmp 5.4.1_5 < needs updating (port has 5.4.1.2)
p5-Pod-Parser 1.35_1 < needs updating (port has 1.35_2)
p5-Sub-Uplevel 0.1901 < needs updating (port has 0.1901_1)
p5-Test-ClassAPI 1.04 < needs updating (port has 1.05)
p5-Test-Harness 3.11 < needs updating (port has 3.12)
p5-version 0.75 < needs updating (port has 0.75.01)
rsync 3.0.2_1 < needs updating (port has 3.0.3)
sudo 1.6.9.15_1 < needs updating (port has 1.6.9.17)
vim 7.1.315 < needs updating (port has 7.1.330)

... or even:
lsof                        <  needs update (inst: 4.80,2     port: 4.81A,2)
mytop < needs update (inst: 1.6_3 port: 1.6_4)
net-snmp < needs update (inst: 5.4.1_5 port: 5.4.1.2)
p5-Pod-Parser < needs update (inst: 1.35_1 port: 1.35_2)
p5-Sub-Uplevel < needs update (inst: 0.1901 port: 0.1901_1)
p5-Test-ClassAPI < needs update (inst: 1.04 port: 1.05)
p5-Test-Harness < needs update (inst: 3.11 port: 3.12)
p5-version < needs update (inst: 0.75 port: 0.75.01)
rsync < needs update (inst: 3.0.2_1 port: 3.0.3)
sudo < needs update (inst: 1.6.9.15_1 port: 1.6.9.17)
vim < needs update (inst: 7.1.315 port: 7.1.330)


Finally, here's the new pkgdu command, which shows disk space used by the
port and pretty much speaks for itself:
[royce@heffalump ~]$ pkgdu | sort -n | tail -20
970 ruby18-bdb-0.6.4
1151 perltidy-20071205
1332 gmake-3.81_3
1512 p5-Perl-Critic-1.08.5
1740 p5-DBI-1.60.4
1853 pcre-7.7
2235 bash-3.2.39_1
2255 autoconf-2.61_2
2385 joe-3.5_1,1
2492 libtool-1.5.26
3147 libiconv-1.11_1
3453 mysql-client-5.0.51a
7548 net-snmp-5.4.1_5
8946 ruby-1.8.6.111_4,1
9322 db41-4.1.25_4
9561 aspell-0.60.6_2
10182 gettext-0.17_1
12822 coreutils-6.9_3
28953 perl-5.8.8_1
30434 vim-7.1.315

Friday, March 07, 2008

Don't change your password while running freebsd-update

I found out the hard way today that freebsd-update doesn't like it when you change certain files while it's running. In retrospect, this makes sense; initially, I was a bit startled.

$ sudo sh freebsd-update.sh -f freebsd-update.conf -r 6.3-RELEASE upgrade
Looking up update.FreeBSD.org mirrors... 1 mirrors found.
Fetching metadata signature for 5.5-RELEASE from update1.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
src/base src/bin src/contrib src/crypto src/etc src/games src/gnu
src/include src/krb5 src/lib src/libexec src/release src/rescue src/sbin
src/secure src/share src/sys src/tools src/ubin src/usbin world/base
world/compat20 world/compat21 world/dict world/doc world/manpages

The following components of FreeBSD do not seem to be installed:
world/catpages world/compat1x world/compat22 world/compat3x
world/compat4x world/games world/info world/proflibs

Does this look reasonable (y/n)? y

Fetching metadata signature for 6.3-RELEASE from update1.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 1 metadata patches. done.
Applying metadata patches... done.
Fetching 1 metadata files... done.
Inspecting system... done.
Fetching files from 5.5-RELEASE for merging... done.
Preparing to download files...
File changed while FreeBSD Update running: /etc/master.passwd
$

Whoops. Had to start all over again.

Monday, January 15, 2007

Binary Upgrade to FreeBSD 6.2

After the release of FreeBSD 6.2 was announced today, I decided to try Colin Percival's experimental binary OS upgrade method to upgrade a 6.1-RC2 system to 6.2-RELEASE.

The underlying approach of this method -- the freebsd-update utility -- is included in the FreeBSD base system as of this release. Between OS releases, freebsd-update can be used to keep the OS patched for security vulnerabilities. This makes it much easier to maintain continuity of a system while keeping its operating system current and secure. I love to tinker as much as the next guy ... but when it comes to stability, I love freebsd-update.

The system that I upgraded (heffalump) was originally built as a 6.0 system. Using similar upgrade scripts, I subsequently upgraded to 6.1 and 6.2-RC2 without incident.

For my upgrade to 6.2-RELEASE, I followed the steps outlined here, changing 6.1-RC1 to 6.2-RELEASE where appropriate.

[root@heffalump ~]# date
Mon Jan 15 08:38:32 AKST 2007

[root@heffalump ~]# mkdir /usr/upgrade

[root@heffalump ~]# cd /usr/upgrade
[root@heffalump /usr/upgrade]# fetch http://www.daemonology.net/freebsd-update/upgrade-to-6.2.tgz
upgrade-to-6.2.tgz 100% of 18 kB 20 kBps

[root@heffalump /usr/upgrade]# fetch http://www.daemonology.net/freebsd-update/upgrade-to-6.2.tgz.asc
upgrade-to-6.2.tgz.asc 100% of 187 B 878 kBps

[root@heffalump /usr/upgrade]# gpg --verify upgrade-to-6.2.tgz.asc upgrade-to-6.2.tgz
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: Signature made Sun Jan 14 11:21:59 2007 AKST using DSA key ID CA6CDFB2
gpg: Can't check signature: No public key

[root@heffalump /usr/upgrade]# tar -xzf upgrade-to-6.2.tgz

[root@heffalump /usr/upgrade]# cd upgrade-to-6.2

[root@heffalump /usr/upgrade/upgrade-to-6.2]# sh freebsd-update.sh -f freebsd-update.conf -d /usr/upgrade -r 6.2-RELEASE upgrade
Looking up update.FreeBSD.org mirrors... 1 mirrors found.
Fetching public key from update1.FreeBSD.org... done.
Fetching metadata signature for 6.1-RELEASE from update1.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata files... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/sys world/base world/dict world/doc world/info
world/manpages world/proflibs

The following components of FreeBSD do not seem to be installed:
kernel/smp src/base src/bin src/contrib src/crypto src/etc src/games
src/gnu src/include src/krb5 src/lib src/libexec src/release src/rescue
src/sbin src/secure src/share src/tools src/ubin src/usbin
world/catpages world/games

Does this look reasonable (y/n)? y

Fetching metadata signature for 6.2-RELEASE from update1.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 1 metadata patches. done.
Applying metadata patches... done.
Fetching 1 metadata files... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 3734 patches.....10....20....30....40....50....60....70....80....90....100....110....120....130....140....150....160....170....180....190....200....210....220....230....240....250....260....270....280....290....300....310....320....330....340....350....360....370....380....390....400....410....420....430....440....450....460....470....480....490....500....510....520....530....540....550....560....570....580....590....600....610....620....630....640....650....660....670....680....690....700....710....720....730....740....750....760....770....780....790....800....810....820....830....840....850....860....870....880....890....900....910....920....930....940....950....960....970....980....990....1000....1010....1020....1030....1040....1050....1060....1070....1080....1090....1100....1110....1120....1130....1140....1150....1160....1170....1180....1190....1200....1210....1220....1230....1240....1250....1260....1270....1280....1290....1300....1310....1320....1330....1340....1350....1360....1370....1380....1390....1400....1410....1420....1430....1440....1450....1460....1470....1480....1490....1500....1510....1520....1530....1540....1550....1560....1570....1580....1590....1600....1610....1620....1630....1640....1650....1660....1670....1680....1690....1700....1710....1720....1730....1740....1750....1760....1770....1780....1790....1800....1810....1820....1830....1840....1850....1860....1870....1880....1890....1900....1910....1920....1930....1940....1950....1960....1970....1980....1990....2000....2010....2020....2030....2040....2050....2060....2070....2080....2090....2100....2110....2120....2130....2140....2150....2160....2170....2180....2190....2200....2210....2220....2230....2240....2250....2260....2270....2280....2290....2300....2310....2320....2330....2340....2350....2360....2370....2380....2390....2400....2410....2420....2430....2440....2450....2460....2470....2480....2490....2500....2510....2520....2530....2540....2550....2560....2570....2580....2590....2600....2610....2620....2630....2640....2650....2660....2670....2680....2690....2700....2710....2720....2730....2740....2750....2760....2770....2780....2790....2800....2810....2820....2830....2840....2850....2860....2870....2880....2890....2900....2910....2920....2930....2940....2950....2960....2970....2980....2990....3000....3010....3020....3030....3040....3050....3060....3070....3080....3090....3100....3110....3120....3130....3140....3150....3160....3170....3180....3190....3200....3210....3220....3230....3240....3250....3260....3270....3280....3290....3300....3310....3320....3330....3340....3350....3360....3370....3380....3390....3400....3410....3420....3430....3440....3450....3460....3470....3480....3490....3500....3510....3520....3530....3540....3550....3560....3570....3580....3590....3600....3610....3620....3630....3640....3650....3660....3670....3680....3690....3700....3710....3720....3730.. done.
Applying patches... done.
Fetching 5495 files... done.

The script said "Fetching 5495 files," but since it wasn't providing a progress indicator, I rigged one up in another window:

royce@heffalump$ while true; do ls -1 /usr/upgrade| wc -l; ls -lARt /usr/upgrade | head -2; sleep 1; done
3783
total 50548
-rw-r--r-- 1 root stephb 262982 Jan 15 09:14 ac156aa7853fca9e0c739ce6e0e8691ac9a2a651653e74e69f845a9a91832ca7.gz

When it is finished, the script reports files that it cannot update, files that will be removed, files that will be added, and files that will be replaced. Make specific note of the files that cannot be updated; you will want to manually compare them with the distributed files when you're finished.

The following files are affected by updates, but no changes have
been downloaded because the files have been modified locally:
/etc/devd.conf
/etc/mail/sendmail.cf
/etc/mail/submit.cf

The following files will be removed as part of updating to 6.2-RELEASE-p0:
/etc/periodic/weekly/120.clean-kvmdb
/usr/include/c++/3.4/ext/demangle.h
/usr/lib/libpcap.so.4
/usr/lib/libpthread.so.2
/usr/share/doc/en_US.ISO8859-1/articles/building-products/b378.html
/usr/share/doc/en_US.ISO8859-1/articles/wp-toolbox/x32.html
/usr/share/doc/en_US.ISO8859-1/books/handbook/kernelconfig-nodes.html
/usr/share/doc/en_US.ISO8859-1/books/handbook/mac-examplehttpd.html
/usr/share/doc/en_US.ISO8859-1/books/handbook/mac-labelingpolicies.html
/usr/share/doc/en_US.ISO8859-1/books/handbook/network-bind9.html
/usr/share/doc/en_US.ISO8859-1/books/porters-handbook/LEGALNOTICE.html
/usr/share/doc/en_US.ISO8859-1/books/porters-handbook/c1038.html
/usr/share/doc/en_US.ISO8859-1/books/porters-handbook/c1189.html
/usr/share/doc/en_US.ISO8859-1/books/porters-handbook/c1234.html
/usr/share/doc/en_US.ISO8859-1/books/porters-handbook/c19.html
/usr/share/doc/en_US.ISO8859-1/books/porters-handbook/c190.html

[snip]

The following files will be added as part of updating to 6.2-RELEASE-p0:
/bin/pgrep
/bin/pkill
/boot/kernel/amdsmb.ko
/boot/kernel/geom_md.ko
/boot/kernel/if_ixgb.ko
/boot/kernel/if_stge.ko
/boot/kernel/ipmi.ko
/boot/kernel/linsysfs.ko
/boot/kernel/mfi_linux.ko
/boot/kernel/nfsmb.ko
/boot/kernel/ng_tag.ko
/boot/kernel/ppc.ko
/boot/kernel/rr232x.ko
/etc/freebsd-update.conf
/etc/rc.d/auditd
/etc/rc.d/auto_linklocal
/etc/rc.d/bridge
/etc/rc.d/bthidd
/etc/rc.d/mdconfig
/etc/rc.d/mdconfig2
/etc/rc.d/mountlate
/etc/security/audit_class

[snip]

The following files will be updated as part of updating to 6.2-RELEASE-p0:
/COPYRIGHT
/bin/[
/bin/cat
/bin/chflags
/bin/chio
/bin/chmod
/bin/cp
/bin/csh
/bin/date
/bin/dd
/bin/df
/bin/domainname
/bin/echo
/bin/ed
/bin/expr
/bin/getfacl
/bin/hostname
/bin/kenv
/bin/kill
/bin/link
/bin/ln
/bin/ls
/bin/mkdir
/bin/mv
/bin/pax
/bin/ps
/bin/pwd
/bin/rcp
/bin/realpath
/bin/red
/bin/rm
/bin/rmail

I then performed the first part of the install, which installs the new kernel and supporting files:

[root@heffalump /usr/upgrade/upgrade-to-6.2]# date
Mon Jan 15 09:32:24 AKST 2007
[root@heffalump /usr/upgrade/upgrade-to-6.2]#
[root@heffalump /usr/upgrade/upgrade-to-6.2]# sh freebsd-update.sh -f freebsd-update.conf -d /usr/upgrade install
Installing updates...
Kernel updates have been installed. Please
reboot and run "freebsd-update.sh install" again to
finish installing updates.

I rebooted as instructed:

[root@heffalump /usr/upgrade/upgrade-to-6.2]# shutdown -r now
Shutdown NOW!
shutdown: [pid 96143]
[root@heffalump /usr/upgrade/upgrade-to-6.2]#
*** FINAL System shutdown message from royce@heffalump.prv.tycho.org ***
System going down IMMEDIATELY



System shutdown time has arrived

After reboot, note that we are running a 6.2-RELEASE kernel, but userland has
not yet been updated:

[root@heffalump ~]# uname -a
FreeBSD heffalump.prv.tycho.org 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 10:40:27 UTC 2007 root@dessler.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386

[root@heffalump ~]# ls -la /bin/ps
-r-xr-xr-x 1 root wheel 28728 Jul 2 2006 /bin/ps

We now install the rest of the files that have been changed between 6.1-RC2 and 6.2:

[root@heffalump ~]# cd /usr/upgrade/upgrade-to-6.2

[root@heffalump /usr/upgrade/upgrade-to-6.2]# sh freebsd-update.sh -f freebsd-update.conf -d /usr/upgrade install
Installing updates... done.

[root@heffalump /usr/upgrade/upgrade-to-6.2]# date
Mon Jan 15 09:45:17 AKST 2007

Another reboot, and now our kernel and userland match:

royce@heffalump$ uname -a

FreeBSD heffalump.prv.tycho.org 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 10:40:27 UTC 2007 root@dessler.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386

royce@heffalump$ ls -la /bin/ls
-r-xr-xr-x 1 root wheel 23444 Jan 15 09:37 /bin/ls

Once my download of ISO for disc1 is complete, I'll look at the three straggling files (/etc/devd.conf,/etc/mail/sendmail.cf, and /etc/mail/submit.cf) and merge any changes as appropriate.