I've made a new release of my sift IMAP utility, which now adds a few new types of rules:

• Match message bodies against regular expressions.
• Match recipients against regular expressions.

All the "searching" rules now allow negation too, so that "from:foo@bar.com" and "!from:foo@bar" work as you'd expect. Finally each of the searching rules, which require the download of the complete IMAP message, will use a local disk-cache to avoid undue overhead. All in all I'm pretty pleased with the way the tool is being used in the wild. Each of these changes were the result of a direct user request, or suggestion. ObMovie: Dogma

Regular readers may remember that I stood in the board election of Software in the Public Interest, the main democratic free software corporation, a few weeks ago. Well, the result is posted with David Graham and Jimmy Kaplowitz are re-elected. Well done and good luck to both. Thanks to the other board members for running the election and restarting the voting machine as necessary. The postponed July meeting might happen in irc.oftc.net #spi today (Wednesday) at 1900UTC, but I expect they’ll announce it in the usual place before it happens. Naturally, I’m disappointed that more news, members’ panels and the annual report weren’t attractive enough to get more votes, and that old untruths were being reposted to some forums, but I can’t get too upset about this year’s result because both elected candidates had fine manifestos. I’m glad that Jimmy Kaplowitz’s platform includes posting more news and look forward to seeing that. Slightly worrying are the low turnout (down for the third year) and that over 80% of those few voters were from debian (my estimate). I’ve my suspicions why, but I’d love any non-voters to leave me a comment telling me why you think it is. The apology: the summary of responses to my questions about SPI membership will appear next week because I made a mistake on one site, set the closing date a week late and I don’t see any way to edit surveys after they’ve opened. Oops. Sorry. (Now, if that site was running free software, I’d see if I could fix the user interface to allow previews.) (Aside: I was going to include a bar chart of the voting, like last year, but Wordpress’s stupid post editor strips style attributes from li tags. I’ll go looking for that with a hack-axe Real Soon Now, before it causes me serious trouble.)

For a long time I have opposed single letter variable names. Often I see code which has a variable for a fixed purpose with a single letter name, EG “FILE *f;“, the problem with this is that unless you choose a letter such as ‘z‘ which has a high scrabble score (and probably no relation to what your program is doing) then it will occur in other variable names and in reserved words for the language in question. As a significant part of the time spent coding will involve reading code so even for programmers working on a project a useful amount of time can be saved by using variable names that can easily by found by a search program. Often it’s necessary to read source code to understand what a system does - so that is code reading without writing. With most editors and file viewing tools searching for a variable with a single character name in a function (or source file for a global variable) is going to be difficult. Automated searching is mostly useless, probably the best option is to have your editor highlight every instance and visually scan for the ones with are not surrounded by brackets, braces, parenthesis, spaces, commas, or whatever else is not acceptable in a variable name in the language in question. Of course if you have a syntax highlighting editor then it might parse enough of the language to avoid this. But the heavier editors are not always available. Often I edit code on the system where the crash occurs (it makes it easier to run a debugger). Installing one of the heavier editors is often not an option for such a task (the vim-full Debian/Lenny package for AMD64 has dependencies that involve 27M of packages files to download and would take 100M of disk space to install quite a lot to ask if you just want to edit a single source file). Incidentally I am interested in suggestions for the best combination of features and space in a vi clone (color syntax highlighting is a feature I desire). But even if you have a fancy editor, there is still the issue of using tools such as less and grep to find uses of variables. Of course for some uses (such as a loop counter) there is little benefit in using grep. Another issue to consider is the language. If you write in Perl then a search for \$i should work reasonably well. One of the greatest uses of single letter variable names is the ‘i‘ and ‘j‘ names for loop counters. In the early days of computing FORTRAN was the only compiled language suitable for scientific tasks and it had no explicit way of declaring variables, if a variable name started with i, j, k, l, m, or n then it was known to be an integer. So i became the commonly used name for a loop counter (the first short integer variable name). That habit has been passed on through the years so now many people who have never heard of FORTRAN use i as the name for a loop counter and j as the name for the inner loop in nested loops. [I couldn't find a good reference for FORTRAN history - I'll update this post if someone can find one.] But it seems to me that using idx, index, or even names such as item_count which might refer to the meaning of the program might be more efficient overall. Searching for instances of i in a program is going to be difficult at the best of times, even without having multiple loops (either in separate functions or in the same function) with the same variable name. So if there is to be a policy for variable names for counters, I think that it makes most sense to have multiple letters in all variable names to allow for easy grepping, and to have counter names which apply to what is being counted. Some effort to give different index names to different for/while loops would make sense too. Having two different for loops with a counter named index is going to make things more difficult for someone who reads the code. Of course there are situations where two loops should have the same variable, for example if one loop searches through an array to find a particular item and then the next loop goes backward through the array to perform some operation on all preceding items then it makes sense to use the same variable.

Share This

SE Linux is almost ready to use in Lenny. Currently I am waiting on the packages libsepol1 version 2.0.30-2, policycoreutils 2.0.49-3, and selinux-policy-default version 0.0.20080702-4 to make their way to testing. The first two should get there soon, the policy will take a little longer as I just made a new upload today (to make it correctly depend on libsepol1 and also some policy fixes). Update: libsepol1 version 2.0.30-2 and policycoreutils 2.0.49-3 are now in Lenny (testing). Now I’m just waiting for the policy. Ideally we would be able to pin the apt repositories to take just the packages we want from Unstable (here is a document on how it’s supposed to work [1]). That doesn’t work, so I also tried setting “APT::Default-Release “stable”;” in /etc/apt/apt.conf (as suggested on IRC). This gave better results than pinning (which seems to not work at all) but it still wanted to take unreasonably large numbers of packages from unstable. Currently to get SE Linux in Lenny (Testing) working you must first upgrade everything to the testing versions, then install libsepol1 from Unstable (this is really important as until a few hours ago the Policy packages in Unstable didn’t depend on it). Then you install policycoreutils and finally the policy package which will be selinux-policy-default for almost everyone - I have not tested the MLS package (selinux-policy-mls) and it’s quite likely that it won’t work well. The policycoreutils package has a bug related to Python libraries [2] which I don’t know how to fix. Any advice would be appreciated. It’s obvious that the package name needs to not contain a hyphen, but what the name should be and where the files should be stored. The release team have been pretty cooperative with my requests so far to get broken things fixed, hopefully I’ll find a solution to this (and the other similar issues) soon enough to avoid any great inconvenience to them. I’m sure that they will agree that significantly broken packages (which have syntax errors in scripts) need to be fixed before release. There are also some last minute policy issues that need to be fixed. To properly test this I’m now running the server for my blog and mail server on Lenny with SE Linux. I think that I’m only one policy bug away from running in enforcing mode. While the situation is pretty difficult at the moment (I’ve had a report forwarded to me from an OLS delegate who tried Lenny SE Linux with the older policy packages and got a bad result), I believe that once Lenny is released we will have the best ever support for SE Linux. The Debian security team recently released an update to the SE Linux policy packages to match the recent updates to BIND [3]. I was grateful that they did this - and without any significant involvement from me. I was asked to advise on the patch that they had written, I confirmed that it looked good (which took hardly any effort), and they did the rest (which appears to be a moderate amount of work). Given the situation it would have been understandable if they had decided that it was something that could be worked around. I expect that SE Linux on Lenny will get more users than on Etch, so therefore more issues of this nature will be discovered so I expect to have more interaction with the Debian security group in future.

• [1] http://jaqque.sbih.org/kplug/apt-pinning.html


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486120


• [3] http://www.debian.org/security/2008/dsa-1617

Share This

As some of you know, I’ll stop working on Galician translations (of everything) after Lenny is released (or after the end of October, if Lenny is not released before). Before that, I’m going to start documenting several aspects of my work on it in several blog posts. I’m not going to follow any particular order; when everything’s written, I’ll collate the documents and make them available together in a single coherent document. Although it is written for the future Galician team, this work (even the final document) will be written in English. If it is a problem for anyone, I don’t want them as translators. And, also, this will make this document potentially useful for other teams.

---

The Debian installer system (d-i, for short) is made up of several components. Some of these components were written especially for the Debian installer; others, however, are standalone applications which are used during the installation of Debian. The translations of many of these components are managed separately; however, an effort is being made to keep track of them, providing a single dashboard where a translator can see the status of the d-i translations, get files to translate, instructions for submitting the translations, etc. This dashboard resides at http://d-i.alioth.debian.org/l10n-stats/. There is a translation guide for d-i, explaining what components are in each level, how to retrieve the files to translate or update, and how to submit the translated files. I’m giving here a short summary in this post. For translation purposes, d-i is divided in five levels. Level 1 contains the strings everyone sees when installing Debian — the following levels contain components whose translation is less user-visible. Therefore, when translating d-i you should prioritize level 1 translations, then level 2 translations and so on. However, this doesn’t mean that they are any less important; you should try to always keep them up to date! You can see the status of every language in each level by going to the l10n-stats page. If you click on a language you can see a text file with a more detailed report on the translations for that level and language. You can also opt in to receive emails every morning when the status in a level for your language changes — you’ll have to ask Christian Perrier to subscribe you to the websec-txt notifications for your language. Level 1 translations are maintained on Alioth, so you should get an Alioth account and request to be added to the d-i project as translator. Then, you’ll be able to download and upload the translations using Subversion. There are lots of programs and packages that comprise level 1; however, to make translation easier and more efficient, the translations are consolidated in only 5 files (called sublevels). In this way, if the same string appears several times in several programs, you only need to translate it once. It’s 5 files instead of a single one so that it’s easier to distribute work, assign priorities, etc. The other levels consist of translations of individual programs, which are maintained in many different ways. The particular methods you have to use for each package are detailed in the translation guide. For most of them, it involves downloading the .POT or .PO file from a read-only version control repository, and uploading the translation using the Debian BTS.

The Grade-II-listed Grand Pier Weston-super-Mare has burned down. It was right in the centre of the next bay south from me, facing down the main street between the town centre and seafront, visible all the way around Weston Bay. There’s been a half-mile exclusion zone in the middle of town, but I’ve not been travelling that way today. I go past the pier four or more times a week. It will be very strange for it to be missing. Pictures by a nearby resident really capture the scale of the shock. The pier is literally an icon, used for the WsM Forum that I help to run for the town. At least those landside towers are still standing. More reaction on WsM Forum.

Lenny has been frozen some four hours ago and still nobody blogged it yet, so I decided to break the news to those who care more about blogs and planets then old fashioned nice mailing-lists :-)

Unfortunatly no word was said about the kernel for lenny, so I asked on #debian-release whether that means, we will release with 2.6.25, which is what's in unstable and testing atm. The answer from a release team member was: no, it will probably be 2.6.26.

Happy polishing!

/me goes back to arriving in wonderful Madrid with wonderful company :-)

The above blog post was written yesterday but due to an user error due to being too tired I didn't manage to post it until now. But as still no one blogged about the freeze... :-)

Michael Janke has written an interesting article about data flows in networks [1], he describes how data from the Internet should be considered to have low integrity (he refers to it as “untrusted”) and that as you get closer to the more important parts of the system it needs to be of higher integrity. It seems to me that his ideas are very similar in concept to the Biba Integrity Model [2]. The Biba model is based around the idea that a process can only write data to a resource that is of equal or lower integrity and only read data from a resource that is of equal or higher integrity, this is often summarised as “no read-down and no write-up“. In a full implementation of Biba the OS would label all data (including network data) as to it’s integrity level and prevent any communication that violates the model (except of course for certain privileged programs - for example the file or database that stores user passwords must have high integrity but any user can run the program to change their password). A full Biba implementation would not work for a typical Internet service, but considering some of the concepts of Biba while designing an Internet service should lead to a much better design (as demonstrated in Michael’s post). While considering the application of Biba to network design it makes sense to also consider consider the Bell LaPadula model (BLP) [3]. In computer systems designed for military use a combination of Biba and BLP is not uncommon, while a strict combination of those technologies would be an almost insurmountable obstacle to development of Internet services I think it’s worth considering the concepts. BLP is a system that is primarily designed around the goal of protecting data confidentiality. Every process (subject) has a sensitivity label (often called a “clearance”) which is comprised of a sensitivity level and a set of categories and every resource that a process might access (object) also has a sensitivity label (often called a “classification”). If the clearance of the subject dominates the classification of the object (IE the level is equal or greater and the set of categories is a super-set) then read access is permitted, if the clearance of the subject is dominated by the classification of the object then write access is permitted, and the clearance and classification have to be equal for read/write access to be permitted. This is often summarised as “no write-down and no read-up“. SGI has published a lot of documentation for their Trusted Irix (TRIX) product on the net, the section about mandatory access control covers Biba and BBLP [4]. I recommend that most people who read my blog not read the description of how Biba and BLP works, it will just give you nightmares. The complexity of either Biba or BLP (including categories) is probably too great for consideration when designing network services which have much lower confidentiality requirements (even the loss of a few million credit card numbers is trivial compared to some of the potential results of leaks of confidential military data). But a simpler case of BLP with only levels is worth considering. You might have credit card numbers stored in a database classified as “Top Secret” and not allow less privileged processes to read from it. The data about customers addresses and phone numbers might be classified as “Secret” and all the other data might merely be “Classified”. One way of using the concepts of Biba and BLP in the design of a complex system would be to label every process and data store in the system according to it’s integrity and classification/clearance. Then for the situations where data flows to processes with lower clearance the code could be well designed and audited to ensure that it does not leak data. For situations where data of low integrity (EG data from a web browser) is received by a process of high integrity (EG the login screen) the code would have to be designed and audited to ensure that it correctly parsed the data and didn’t allow SQL injection or other potential attacks. I expect that many people who have experience with Biba and BLP will be rolling their eyes while reading this. The situation that we are dealing with in regard to PHP and SQL attacks over the Internet is quite different to the environments where proper implementations of Biba and BLP are deployed. We need to do what we can to try and improve things, and I think that the best way of improving things in terms of web application security would involve thinking about clearance and integrity as separate issues in the design phase.

• [1] http://lastinfirstout.blogspot.com/2008/07/presumed-hostile-your-application-is.html


• [2] http://en.wikipedia.org/wiki/Biba_Integrity_Model


• [3] http://en.wikipedia.org/wiki/Bell-LaPadula_model


• [4] http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi?coll=0650&db=bks&fname=/SGI_EndUser/books/TCMW_UG/sgi_html/ch02.html

Share This

over 96% successful
243 packages built successfully.
8 packages failed to cross build.

Failing packages

1. cups
   

   http-addr.c: In function 'httpGetHostByName':
   
   http-addr.c:464: error: invalid 'asm': invalid operand for code 'w'
   
   http-addr.c:464: error: invalid 'asm': invalid operand for code 'w'

   
   history
   


2. gtk+2.0 - cairo-directfb problems.
   history
   The cross-build keeps finding /usr/arm-linux-gnu/lib/libcairo.so first so it misses the extra symbols provided in /usr/arm-linux-gnu/lib/libcairo-directfb/lib/libcairo.so. Hopefully, this can be resolved by judicious hackery of LDFLAGS and LD_LIBRARY_PATH.


3. ncurses
   
/trunk/n/ncurses/trunk/ncurses-5.6+20080713/ncurses/curses.priv.h:1417: warning: parameter names (without types) in function declaration
/trunk/n/ncurses/trunk/ncurses-5.6+20080713/ncurses/curses.priv.h:1418: error: expected '=', ',', ';', 'asm' or '__attribute__' before '_nc_to_widechar'

   history
   


4. ntp - same assembly error as cups
   

   authkeys.c: In function 'authencrypt':
   
   authkeys.c:445: error: invalid 'asm': invalid operand for code 'w'
   
   authkeys.c:445: error: invalid 'asm': invalid operand for code 'w'

   
   history
   


5. slang2 - confusing build behaviour - outside a chroot, files are put into a directory called elfobjs. Inside a chroot, files are put into a directory called elfamd64objs (and presumably that would change according to the BUILD architecture with is plain insane.
   history
   

The assembly errors look spooky and the cairo and slang2 errors could be made much simpler if the upstream builds were sane. (Honestly, why can't we just have /usr/lib/libcairo-directfb.so ?)

Some other packages fail to build, e.g. gcc-4.2, but we don't need those anymore so I'm ignoring those.

Well, tomorrow will be one week since my last of the prescription drugs, and the last Tylenol I had was on Tuesday. I think I'm finally free of these damned things.

It's worth noting that these bottles aren't all empty, but this doesn't include the ones given to me in the hospital, the various stomach things I had to take so that the steroids didn't hurt me, and the various bottles of Tylenol that I lost from being such a basket case (Everyone, especially Angie, has been so patient with me with the mood swings, the memory holes, etc. Thank-you so much!) Based on this, I'm assuming that the count probably evens out. I totalled the number of pills in these bottles: 1333.

I've heard that there's an org, "Doctors Without Borders" to which I can donate the ones that I will definitely not need again, like the steroids and such. I'll hunt them down soon.

Next update: Tuesday. I get to see the surgeon again and my movement restrictions are expected to be lifted. That means the only other visit is to the oncologist who *still* after 5 months can't manage to schedule an appointment with me. They're the ones who finally phoned a week ago to schedule one. I wanted to check with my surgeon on something, and when I went to phone them back, their call display number isn't valid. They were supposed to phone me back anyway, but I also asked my surgeon's practice coordinator to arrange it for me. Still nothing. *sigh* I'm going to take the opportunity at the hospital to go talk to them in person to see if I can get things moving. We're still at the stage where noone expects anything, but they want the tests to make sure that's actually the case.

Still, I'm excited to be this far. It's nice to finally feel like I'm thinking somewhat more clearly now.

On Thursday my new InterNode ADSL2+ service was connected [1]. I needed to get a connection with a larger download cap and a better upload speed because one of my clients wants me to transfer some significant amounts of data as well as hosting some Xen DomU’s for him. Strangely InterNode couldn’t offer a regular ADSL service but could offer Naked DSL (which means DSL without a phone service on the same pair of wires). So I now have Naked ADSL 2+[2] although unfortunately the line speed is reported as being 8263/814 Kbps - ADSL2 speed. For the moment this will do, but I’ll investigate the possibility of improving this eventually. Another strange thing about this is that Optus is the carrier for the ADSL line, Telstra is the monopoly telco with the vast majority of local-loop copper pairs so it’s surprising that I end up with Optus owning my copper - the wires in question were used by the previous owner of my house for a Telstra connection! On Friday I converted my network to using the new ADSL link and on Saturday I got my SE Linux Play Machine online again [3]. I could have managed the transition without ~20 hours of down-time for the Play Machine, but as I only get a few logins per day it didn’t seem to be worth the effort of rushing it. Also on Friday I got a new 3G modem from Three [4]. They advertise that the USB or PC-Card modem will cost $5 per month on a 24 month plan, but when I ordered it I discovered that as I have an existing mobile phone plan with them the $5 per month is waived. So all that I have to pay is $15 per month for a 1GB data allowance (which is about the best deal available). A client is paying for this so that I can provide remote support for his network. I had previously written about my search for an ideal mobile SSH client [5], I ended up getting an EeePC 701 which cost $300, an 8G SD card and 8G USB stick (for expanding the internal storage and for moving files around respectively) which cost $83, and now $15 per month over 24 months for net access. That gives a total of $743 for two years of mobile net access. This compares well to the $960 that an iPhone would cost over two years and provides a lot more utility (while admittedly not fitting into a pocket). Dave Hall [6] gave me a lot of great advice about selecting and using 3G modems. He recommended that I get the E220 modem as it’s easy to configure (mine was easy on Debian/Lenny but didn’t work with a Debian/Etch kernel as the necessary driver was not available). Three also sells another model the E169G which is apparently tricky to set up. There was one mistake made in the design of the E220, the cable is installed in such a way that the LED which indicates connection status is going to be face-down when connected to almost any laptop which has horizontally mounted USB ports (which includes all the thinner ones). Here is the PPP chatscript for use with an E220 modem (suggested file name /etc/chatscripts/three):

ABORT 'BUSY'
ABORT 'NO CARRIER'
ABORT 'ERROR'
'' AT
OK ATQ0V1E1S0=0&C1&D2+FCLASS=0
OK 'AT+COPS=0,0,"3TELSTRA",2'
OK AT+CGATT=1
OK AT+CGDCONT=1,"IP","3netaccess"
OK ATDT*99**3# Here is the ppp configuration file which references the above chatscript:
/dev/ttyUSB0
230400
noauth
defaultroute
usepeerdns connect "/usr/sbin/chat -v -f /etc/chatscripts/three"

• [1] http://www.internode.on.net/


• [2] http://en.wikipedia.org/wiki/Adsl2+


• [3] http://www.coker.com.au/selinux/play.html


• [4] http://www.three.com.au/


• [5] http://etbe.coker.com.au/2008/07/16/mobile-ssh-client/


• [6] http://davehall.com.au/

Share This

Steven Levitt gave an interesting talk for TED about the economics of a crack-dealing gang [1]. He makes some interesting comparisons with the way that corporations work. Top 10 strangest terrorism patents [2]. Items 1 and 4 have been implemented many years ago, item 5 was probably implemented by the CIA decades ago (they did many similar things), item 7 will probably kill a significant portion of the passengers (bummer if it goes off accidentally), item 8 has the same problem but will only target nervous people (calm terrorists can do what they want), and the creator of item 9 doesn’t seem to have much idea about how much energy is contained by high explosive. Supporters of Barack Obama are adopting Hussein as their middle-name to support him and oppose some of the unreasonable claims from extremists [3]. I’m not planning to call myself Russell Hussein Coker. Chris Samuel summarises the latest CSIRO report about droughts caused by climate change [4]. He notes that most simulations are based on lower levels of CO2 than we are expecting… Interesting article in the Guardian about car use in the US [5]. It suggests that soon suburbs will be slums occupied by the poor an unemployed and inner city areas will experience a revival. Recently I’ve been putting the papers I’ve presented at conferences online on my documents blog (see this link for the “papers” category) [6]. The papers are almost unchanged from when I published them, I fixed up some broken URLs and made some notes on relevant things that have happened since publication but made no essential changes to the text. Linux.com article about Bonnie++ [7]. It’s well written and covers most of the features quite well. An unfortunate omission is the fact that if you want to run Bonnie++ from the root account you can specify “-u user” on the command-line to run the test as a different user, or you can use “-u root” if you REALLY want to run it as root. A Linux.com article with the source code for a Perl script to create charts from Bonnie++ results [8]. I had always planned that other people would write programs like this, I’m glad to see someone finally publish the source to one!

• [1] http://www.ted.com/index.php/talks/view/id/29


• [2] http://www.neatorama.com/2008/06/27/top-10-strangest-anti-terrorism-patents/


• [3] http://www.nytimes.com/2008/06/29/us/politics/29hussein.html


• [4] http://www.csamuel.org/2008/07/06/csiro-bom-report-drought-exceptional-circumstances-not


• [5] http://www.guardian.co.uk/environment/2008/jul/06/travelandtransport.usa?gusrc=rss&feed=networkfront


• [6] http://doc.coker.com.au/category/papers/


• [7] http://www.linux.com/feature/139742


• [8] http://www.linux.com/feature/139743

Share This

Ryan kindly sent me a copy of the ACPI tables for his motherboard, so I've had the opportunity to look at them in a little more detail. There's nothing especially surprising. The first method of interest is OSFL, which I've annotated below:

   Method (OSFL, 0, NotSerialized)
     
        If (LNotEqual (OSVR, Ones))
         
            Return (OSVR)
         

This block simply skips the checks if they've already been evaluated and returns the cached value

        If (LEqual (PICM, Zero))
         
            Store (0xAC, DBG8)
         

If the programmable interrupt controller has been set up in PIC mode rather than APIC mode, 0xAC is written to i/o port 0x80. This would then show up on a plug-in card if one were attached. Simply debug code

        Store (One, OSVR)

Set OSVR to 1, which in this case clearly means "Unknown OS"

        If (CondRefOf (_OSI, Local1))

This checks whether the OS supports the _OSI method. If it does, the following block is executed. If not, the older _OS method is used to detect the OS

         
            If (_OSI ("Windows 2000"))
             
                Store (0x04, OSVR)
             

Newer versions of Windows will also claim to support the interfaces defined in older versions, so this set of checks is done in release order

            If (_OSI ("Windows 2001"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP2"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2006"))
             
                Store (Zero, OSVR)
             

If we've got this far, OSVR is now set to 0. Linux will claim to support all of these interfaces, and so OSVR should be 0 on Linux systems. Note that there is no _OSI check for Linux - the 2.6.24 change to remove Linux from the set of claimed interfaces is therefore irrelevant

         
        Else
         

Linux supports _OSI, so we should never be here. But if we somehow are...

            If (MCTH (_OS, "Microsoft Windows NT"))
             
                Store (0x04, OSVR)
             

Linux has responded to _OS with "Microsoft Windows NT" since 2.6.9. MCTH is simply a string matching routine defined elsewhere in the DSDT. So, worst case here is that OSVR is 4

            Else
             
                If (MCTH (_OS, "Microsoft WindowsME: Millennium Edition"))
                 
                    Store (0x02, OSVR)
                 
                If (MCTH (_OS, "Linux"))
                 
                    Store (0x03, OSVR)
                 

..because this could never be true unless you're running 2.6.8.1 or earlier. But even so, getting here would still indicate failure - we've supported _OSI since before then, and so should never come anywhere near this code block.

             
         
        Return (OSVR)
     

In summary, we end up with the following values:

Value	OS
0	Windows XP, 2003 or Vista. Linux (assuming absence of bugs)
1	Unknown OS
2	Windows ME
3	A version of Linux that doesn't implement _OSI and is from before 2.6.9
4	Windows NT 4 and 2000. A version of Linux that doesn't implement _OSI and is 2.6.9 or later (I don't believe any such version exists

Now, where is this used? The majority of the OSFL checks only check whether the return value is 1 or 2, which will only be true for an OS that (a) doesn't claim to be Windows or (b) is Windows ME. Linux doesn't fall into either of these categories, so we can ignore them. The first interesting hit we have is in the HPET code, where _STA will return 0xf (device present and working) if OSFL is 0 and 0xb (device present and working, but should not be shown in the UI) otherwise. This is just to keep the HPET from showing up in versions of Windows that don't know what it is. The only other interesting hit is the following code from the PCI bus initialisation pathway:

 
                               If (LEqual (OSFL (), Zero))
                                 
                                    Store (0x59, SMIC)
                                 
                                Else
                                 
                                    If (LEqual (OSFL (), 0x04))
                                     
                                        Store (0x5A, SMIC)
                                     
                                    Else
                                     
                                        Store (0x58, SMIC)
                                     
                                 

This writes different values to SMIC (which turns out to be i/o port 0xb2) depending on the OS. 0xb2 is the standard(ish) way to trigger a system management interrupt, which causes the CPU to execute some code from a memory region that can't be accessed by the OS. This isn't that unusual, but it's a little weird. In any case, note that there's no check for whether OSFL is 3 here (which would be true if the _OS call returned Linux), and so Linux is being treated identically to Windows ME and any unknown OS. In reality, Linux will be treated identically to either Vista or 2000. This block provides no evidence of conspiracy. Finally, the OS version flag is written to a region of memory before suspend and read back afterwards. Nothing appears to be done with this information - it's conceivable that the low-level resume code in the BIOS has conditionals based on this, but I suspect that it's just boilerplate code that's ignored.

To summarise:

• There is no code in this DSDT that could determine that the system is running any Linux kernel of 2.6.9 or later. This may even be true of earlier versions - I'm not sure when _OSI support was added
• Even if the code did manage to determine that the system was running Linux, there are no codepaths that are Linux specific. Every piece of code is run on at least one version of Windows

What's the problem, then? I've no idea. The only "significant" issue is that the OEMB table provided by the BIOS has an incorrect checksum. Given that the OEMB table is never used by Linux (it's a vendor extension of some kind, with the best hint I've been able to find being that it can be used to pass information from the BIOS to the OS - kind of like the rest of ACPI, then...), this is pretty unimportant. And given that the OEMB table isn't part of the ACPI spec, it's certainly entirely irrelevant when it comes to determining whether the system is ACPI compliant or not.

Are there ACPI issues with Ryan's system? It sounds like it. The "Error attaching device data" complaints indicate some kind of failure on the part of the kernel to work out how the devices correspond to the ACPI namespace, but I strongly suspect that this is a Linux bug. Failure to reboot after suspend? Could be anything (I'd need direct access to the hardware to figure it out properly), but again it's almost certainly a Linux bug. The standard way Linux reboots systems is to bang the keyboard controller, and it's conceivable that something we're doing on resume is leaving the keyboard controller in a slightly confused state. We're clearly doing something wrong there, given that my Dell comes up without a keyboard about one resume in twenty - I just haven't had time to look into it yet.

The only remaining thing is the mutex handwaving. I've got no clue what's going on there. Ryan's suggested change (from Acquire (MUTE, 0x03E8) to Acquire (MUTE, 0xFFFF)) simply means that the OS will wait forever until it acquires the mutex - in the past it would only wait a second. The reason the compiler generates a warning here is that the firmware never checks whether it acquired the mutex or not! Bumping the timeout to infinity obviously fixes this warning (there's no need to check the return code if you're happy to wait forever rather than failing), but the original code is merely stupid as opposed to a spec violation.

Take home messages? There's no evidence whatsoever that the BIOS is deliberately targeting Linux. There's also no obvious spec violations, but some further investigation would be required to determine for sure whether the runtime errors are due to a Linux bug or a firmware bug. Ryan's modifications should result in precisely no reasonable functional change to the firmware (if it's ever hitting the mutex timeout, something has already gone horribly wrong), and if they do then it's because Linux isn't working as it's intended to. I can't find any way in which the code Foxconn are shipping is worse than any other typical vendor. This entire controversy is entirely unjustified.

As an update to this, it turns out that I can't read and talking about _OSI isn't very helpful when the DSDT in question is calling _OS, but it does leave me somewhat more confused - Linux has claimed to be Windows NT since approximately forever. Without the original DSDT I've got absolutely no clue what's going on, but comments like:

Find and replace all seven occurences of Acquire (MUTE, 0x03E8) and replace with Acquire (MUTE, 0xFFFF), it appears they're trying to crash the kernel by locking a region of memory that shouldn't be locked, but without access to their source code comments, I can only speculate, this tells it to lock a memory address that is always reserved instead. ;)

don't give me a lot of confidence in any of this being a correct diagnosis given that the second argument to Acquire is a timeout and not an address (0x03e8 gives a timeout of a second, while 0xffff is "Block on acquiring this mutex forever").

In any case, it's highly unlikely that this is any attempt by Foxconn to prevent Linux from working. The majority of checks for Linux in ACPI tables are copy and pasted from reference tables that Intel (and other manufacturers) have provided at various points - even the Intel Macs attempt to check for Linux! Most vendors will never attempt to boot Linux on their boards or validate them appropriately, so it's entirely conceivable that they'll end up screwing things up in such a way that the only tested paths are the ones that are run by Windows. This is why we now attempt to ensure that Linux reports itself as Windows. If we're running Linux-specific code in the DSDT, then that's a bug in Linux.

Anyway. Accusing companies of conspiring against us when the most likely explanation is simply that they don't care is a fucking ridiculous thing to do and does nothing to get rid of the impression that Linux users are a bunch of whining childish hatemongers. Next time, try talking to someone who actually understands this stuff first?

For a week now, I couldn t get rid of this smile on my face (again).

It has been a hard year so far (back to therapy, again, back to medication, again, nasty insomnia, again, depression, again, getting phat as hell, again, my usual stuff, again). This has affected my job, which is the hardest of it all. Not being able to perform well has been troubling me to no avail, destroying my self-esteem.

But I have been feeling slightly better recently, I guess thanks to sunny days and chemistry reactions in (what used to be) my brain. And believe me: slightly better is a huge improvement. But what really put me on a great mood was reading the Wikipedia page on Mar del Plata, the Hotels web sites, the Debconf8 site... and realizing what a HUGE effort the localteam has made. I know they are exhausted, I know they are stressed, I know this week is probably the worst in their life. But the smile they ve put on my face! They have done a huge+great work.

Also, it looks like it will be a smaller event this year, I managed to count the assistants and I came up with 180, approx, and not all of them simultaneously. I must confess EDI was a bit too big for me to handle, so was MEX. I believe I will be able to spend more quality time with fellow debconfers, which I value a lot in this sort of events.This is precisely why I only attend the Debian room during FOSDEM, I cannot seem to enjoy getting out there in the (huge) crowd of attendees.

Anyway, I am smiling while typing this, and believe me: I look silly :)

I can t wait to meet the wonderful Debconf crowd again, specially my Argentinian friends.

See you in MDQ!

Another point release for Etch has been done; now it's the time for the CD team to roll out new images after the next mirror pulse. The official announcements (prepared by Alexander Reichle-Schmehl, thanks!) will follow shortly afterwards. FTP master of the day was Joerg Jaspert, who did his first point release since Woody, as he told us on IRC. We appreciate your work and you spending your time that shortly before going to Argentina. This point release includes the etchnhalf update introducing a new kernel image (based on 2.6.24) and some driver updates. Additionally the infamous openssl hole will be fixed for good, even for new installs. Again I want to present you a list of people who contributed to this release. It cannot be complete as I got the information out of the Changed-by fields of the uploads.

• akira yamada
• Alexander Sack
• Alexander Schmehl
• A Mennucc1
• Andrea De Iacovo
• Andres Salomon
• Aurelien Jarno
• Charles Plessy
• Christian Perrier
• Christian Welzel
• Colin Watson
• dann frazier (indefatigable kernel worker, most sourceful uploads)
• Darren Salt
• Devin Carraway (3rd place of sourceful uploads, due to security work)
• Emmanuel Lacour
• Eric Dorland
• Fabio Tranchitella
• Faidon Liambotis
• Fathi Boudra
• Florian Weimer
• Francesco Paolo Lovergine
• Francois Marier
• Frank Lichtenheld
• Frans Pop (thanks for your d-i work!)
• Frederic Peters
• Gregory Colpart
• Holger Levsen
• Jan Wagner
• Jay Berkenbilt
• J r my Bobbio
• Joey Hess
• Joey Schulze
• Josselin Mouette
• Julien Cristau
• Kai Hendry
• Kurt Roeckx
• LaMont Jones
• Laszlo Boszormenyi
• Martin Pitt
• maximilian attems
• Michael Biebl
• Michael Koch
• Mike Hommey
• Moritz Muehlenhoff
• Noah Meyerhans
• Ola Lundqvist
• Otavio Salvador
• Patrick Matth i
• Petter Reinholdtsen
• Philipp Kern
• Pierre Habouzit
• Raphael Hertzog
• Rene Engelhard
• Robert Millan
• Roberto Lumbreras
• Roland Mas
• Romain Beauxis
• Russ Allbery
• Sean Finney
• Stefan Fritsch
• Steffen Joeris
• Stephen Gran
• Steve Kemp
• Sune Vuorela
• Thijs Kinkhorst (2nd place of sourceful uploads, due to security work)
• Thomas Viehmann
• Toni Mueller
• Tzafrir Cohen

From the Release Team we had dann frazier (who drove the important kernel part of etchnhalf), Luk Claes, Neil McGovern, Andreas Barth, Martin Zobel-Helas and me working on it. ;-)

This weekend, I will be mostly watching the Tour de France. It’s been a very good tour for software and cooperatives. Look at the current leaderboards:-

Teams

1. Carlos Sastre Candil (also 2nd in King of Mountains) Team Computer Sciences Corporation - Saxo Bank
2. Frank Schleck (3rd KoM) Team CSC - Saxo Bank
3. Bernhard Kohl (1st KoM) Gerolsteiner bottled water - OK, not related
4. Cadel Evans, Silence anti-snoring product - Lotto Belgium - also unrelated
5. Denis Menchov, Rabobank cooperative

Points

1. Oscar Freire Gomez, Rabobank
2. Erik Zabel, Team Milram, a brand of Nordmilch cooperative
3. Thor Hushovd, Cr dit Agricole cooperative banks

Teams

1. Team CSC Saxo Bank
2. AG2R-La Mondiale insurance mutuals
3. Rabobank
4. Euskaltel - Euskadi - privately-owned telco and a government
5. Caisse d’Epargne cooperative bank

So however it finishes, I think it probably will have been a much better race for software and cooperatives than last year’s tour, likely to take 4 of the top 5 team positions and 1-2-3 in the green jersey contest… even the doping scandals have been for other teams this year, I think. One day, one of my companies will sponsor pro-cycling. I hope. Anyway, if you’d like to cheer on other Software and Cooperative firm teams until then, European TV coverage details are on another site of mine and Saturday’s time trial start times are posted on a sister site.

Sometimes things like these happen. Noone really did expect it, but it did: blosxom Version 2.1 got released by the new Upstream Team. It does incorporate all previous Debian patches which I'm quite happy about, and contains other long standing and needed fixes and changes. Though, there is also a tiny drawback in that, especially for the Debian package: some of the changes might not be totally approved by all the users of the Debian package. This is unfortunate, but it had to be done to get the package finally yet in a cleaner state (maybe you remember the cleanup run when I originally took over the package). Please be sure to read the NEWS.Debian entry (apt-listchanges might help here) about the most important changes, one of them might even mean that upgrades to this package will flood planets. This is extremely unfortunate but for getting things clean unavoidable:

blosxom (2.1.0-1) unstable; urgency=low
  * This update is a major switch, all local patches have been incorporated
    into upstream version again. Furthermore, html and rss flavours are now
    included in the blosxom script directly and the old 1993 and index
    flavours are not included anymore, to get rid of some further historical
    annoyances with the packaging.
  * MOST IMPORTANTLY: This update adds a new tag into rss feeds:
    <guid isPermanentLink="true"> which helps to notice duplicates and not let
    them appear again on planets. Though, for the time of switching it might
    mean that your last entries might appear as new when planet doesn't check
    <link> (which already should be cached) when finding <guid>. This is
    unfortunate but not really avoidable. To limit impact a new plugin was
    added: 00RssLimit which turns the syndicated feed in only pick up the last
    5 entries.
  * The plugin timezone got disabled and gets only installed into a new
    /etc/blosxom/plugins-available directory which is the first step to the
    planned blosxom-plugins package. If you found it useful and made use of it
    just symlink it from the plugins directory.
 -- Gerfried Fuchs <rhonda@debian.at>  Fri, 25 Jul 2008 16:19:49 +0200

Technically it means you might want to tweak the included 00RssLimit plugin to even just 1 until you blogged some more and raise it with time if your blog runs through some planet. If you do the upgrade, did set 00RssLimit to 1 and do not reappear with your last entry on your planet sites feel free to switch it back. Again, this is an unfortunate situation, and it's not really related to the Debian package only–the addition of the <guid> tag happened upstream and will affect all users of blosxom. It's just that I added the selfwritten 00RssLimit plugin to reduce the impact for the Debian users. Hope you don't mind. ;) Ah yes, and if you might ask where the package is: I did put it into my website for now so people have some time to stumble upon this blog entry before they install the package from unstable without prior notice and maybe not even using apt-listchanges. I will upload the package within the next day.