Mindstab.net

So I recall aoss being glitchy at times and generally not working with complex apps. At least that's what I recall.

So what is aoss? It's a program that acts as a wrapper around Unix apps that use the OSS sound system and silently converts their OSS calls to ALSA ones. Why is this useful?
a) I'm pretty sure each OSS app can lock the sound card, which is pretty lame on any modern system.
b) Because for some reason, some apps still use it, or are compile with OSS support instead of ALSA suport, still in this day and age.

Case point: Qemu on Ubuntu hardy still seems want to use OSS. I can't imagine why and I'm pretty sure it should support ALSA. I never had problems with it on Gentoo, but on Ubuntu it initializes it's OSS sound driver, and then fails to lock the sound card and so Qemu runs silently. Since I only use it to emulate Win98 for a few classic games, sound is pretty needed. So today on a lark I thought I'd try aoss.

 
aoss qemu -hda hd/win98.img -cdrom cd/dk.iso -soundhw sb16
 

And what do you know? It worked like a charm. Kudos. I'm impressed, pleased, and thankful.

Upgraded the kernel on the server today. That went fine but the reboot exposed some library update problems with moving from libexpat 1.9.* to 2. revdep-rebuild -X solved it. All is good.

So with a laptop again I'm really keen to find ways of not duplicating data entry and getting weirdness between my computers, so all kinds of synchronization catch my attention. Here's two I've jsut gotten working and love and make my life better:

Google Browser Sync: It lets you sync data from your browser (Firefox) to Google's server and the to other copies of Firefox you're using. I'm only using it to manage my bookmarks but it's wonderful to now have one set of bookmarks across my desktop and laptop.

Tomboy note syncing: Tomboy is awesome. It is my brain dump. I store tons of stuff in there but till now it has been a bit limited because the information in it doesn't follow me around so I can't count on it to be with me when I'm out or at home. Now I can. Since I have a nice reliable server, I just set it up to use sshfs (thanks to fuse) and both my copies of Tomboy (laptop and desktop) sync to a shared dump on my server. On Ubuntu it was super easy and everything was configured to work already, I just had to enable the sshfs sync plugin. On Gentoo, I had to add FUSE support to my kernel, install sshfs-fuse, and then add a fuse group and modify /etc/udev/rules.d/99-fuse.rules to look like

KERNEL=="fuse", NAME="%k", MODE="0666", OWNER="root", GROUP="fuse"

and then add myself to the fuse group. Once that was all done, Tomboy on Gentoo was syncing too and now my notes will follow me around where ever I am. This is truly amazing and takes Tomboy from a neat app, to an incredibly useful app.

I'm feeling the synchronizational love tonight!

Upgraded from Apache 2.0.59 to 2.2.6. Configuration file rearrangement again. Not bad though. They generally seem to be doing logical things. Took a little bit to make everything work, there were some Apache Directory Allow/Deny problems with my vhost setup but I got those sorted out pretty quickly and now everything seems to be working again. Let me know if you see anything broken but it seems like a pretty smooth migration :)

Preliminary googling seems to indicate that there aren't any main stream distos compiling all their binaries with even basic SSP enabled, let alone easy to use Grsecurity/PaX enabled kernels. The best I can find are instructions on how to enable some of these features in a system and then recompile the system or critical service binaries.

So really, Gentoo Hardened is ahead of the game. I was looking for a binary distro for a small system to be a firewall, but if I want to go the ultra secure route, it looks like no matter what I'll be (re)compiling binaries from source so I might as well use hardened Gentoo which makes it easiest by far to integrate with Grsecurity, PaX, and SSP.

If you're wondering at my other criteria, I've ruled out the obvious choice of OpenBSD because it only has a 6 month 1 year support cycle, and that's limited to patches that you apply and the use a old school build system to rebuild the binaries. Kludgy, still involves compiling, and short support cycle. So I looked for a Linux distro that had a longer and binary support cycle, but none seem to have SSP and Grsecurity.

On the other hand, Hardened Gentoo gives me native out of the box support for Grsecurity, PaX, SSP, and other fun things, and an infinite support cycle. The only cost is compiling everything, which only sucks a bit on small embedded-ish systems, but if compiling is the only way to go any ways, might as well do it right with Gentoo as no one else has nearly as good system tools for compiling software.

Also, although I wasn't looking for it, Gentoo Hardened has support for SELinux as well.

So I get home Sunday after being out all weekend and notice that after the spam and the legitimate emails, I'm missing the regular email from my server telling me what it's been up to. Obviously something from the full system upgrade I was forced to do because of the glibc upgrade has broken cron's ability to send local email. I start messing around and find that mail doesn't work. It seems I need ssmtp installed but nothing installed it or seems to depend on it. I install that and now it gives me can't connect mail:25 errors. I edit /etc/ssmtp/ssmtp.conf and change 'mailhub=mail' to 'mailhub=mail.mindstab.net'. That seems to do the trick. Suddenly cron seems to be sending mail again. So that's good, but it's bad that it silently broke in the first place. And a pain as it took about 45 minutes to diagnose and fix.

So that was exciting. I like to keep my server fairly stable and so I'm accordingly pretty conservative on software upgrades on it. But sometimes with Gentoo you don't get to play that game. I had hard masked glibc > 2.3.* and gcc > 3.* because that upgrade would require a full system rebuild. Not exactly something I want to willingly do on my server. However earlier this week a GLSA came out saying there was a security vulnerability in glibc and I needed to upgrade to glibc 2.5. So I had no choice but to take the plunge and unmask them and recompile the whole system. It took about a day, and unlike my desktop, went pretty smoothly through the whole emerge process. Having only 450 packages instead of 1200 might have helped :). Anyways, recompiled a new kernel with the new GCC and rebooted.

Not bad results, only apache failed and iptables. Apache was just because of some config file changes I ahd merged. I took them out and it was fine. IPTables on the other hand was complaining it could find the 'nat' table. A little more annoying and concerning. Turns out between 2.6.17 and 2.6.20 they made some rather invasive changes to netfilter/fiptables and renamed a bunch of stuff and so my config file didn't activate about half the stuff I needed for iptables. Aside from the nat talbe not being there, connection tracking was missing, and several targets and match criteria were suddenly unchecked, some as crucial as 'state matching' were unselected. After a few recompiles I got everything in the kernel I needed to fully load my iptables config. And now I think everything is running and working and up to date. I wonder if the kernel devs provide a better kernel config migration tool because that was a bit on the silly side really. 3 minor versions and iptables fell apart.

Gentoo on the server can at times be involving and time consuming and needing attention and love. Definitely not for the week of heart, or possibly sane.

p.s. I've also been playing with wordpress avatar plugins. I know I'm published on at least one feed site (Planet Larry) and they could do avatars for me, but I do like to change it up every once in a while so this seemed like a better way for me to keep control of the avatar. On the flip side, it might not integrate as well with other feeds, so let me know if theres something I can do to make it fit in better.

If you're updating some Java packages, like Azureus and its dependancies, and something fails spectacularly to build, the following prefix to emerge may fix that:

JAVA_PKG_FORCE_VM="sun-jdk-1.5" JAVA_PKG_BSFIX="off"  \
JAVA_PKG_FORCE_COMPILER="ecj-3.2" JAVA_PKG_FORCE_CFLAGS="-source 1.5  -target 1.5" \
emerge  ... -va

From what I can tell the problem stems from Java build scripts not specifying what version of Java they need and so Portage defaults to blackdown-java 1.4. Sadly, these packages need Java 1.5 for generics etc. The above command forces Portage to use Sun Java 1.5.

Well, since, I got Debian installed on my GP2X, the first thing I did was run some benchmarks. As per usual, I fell back on my "raw and simple math computation" benchmark suite Primes, a collection of prime number finders written in many languages. For the rest of the article we will thus be evaluating languages purely on math computational speed and nothing else.

I had already gathered data from some of my computers from when I bought Bast, my G3, so I just ran the benchmarks on the GP2X and added them in for comparison.

Machines

Results

Time in seconds to find all prime numbers between 1 and one million

	Inferno	Nika    Kvasir  Bast    GP2X
C	1.19	0.79	0.45	2.83	35.1
ObjC	1.19	0.8		2.83	43.4
C++	1.93	1.06	1.1	4.76	50.1
Java	3.59	1.63	2.14	40.3
C#	3.69	1.87		10.5	140
Awk	32.1	27.1	30	199	2065
Perl	38.2	21	23.3	145	1280
PHP	15.1	8.89	13.4	64.9	758
Python	54	38	43.8	211	1526
Lisp	10.4	5.19		36.3	2674

As you can see, of course, the 200MHz ARM GP2X was destroyed by everyone else. This really doesn't tell us anything at all actually.

Clearly scaling needed to be introduced so that we could see how the languages faired on the different architectures. All being equal I assumed that GCC would give the best optimization per platform and that the C results would be the least skewed, so I choose to represent all the results as multiples of the C time results, or divide all the times by the time that the C prime number finder took on that computer. It yielded the following results:

Time in multiples of C time to find all prime numbers between 1 and one million

	Inferno	Nika    Kvasir  Bast    GP2X
C	1.00	1.00	1.00	1.00	1.00
ObjC	1.00	1.01		1.00	1.24
C++	1.62	1.34	2.44	1.68	1.43
Java	3.02	2.06	4.76	14.24
C#	3.10	2.37		3.71	3.99
Awk	26.97	34.30	66.67	70.32	58.83
Perl	32.10	26.58	51.78	51.24	36.47
PHP	12.69	11.25	29.78	22.93	21.60
Python	45.38	48.10	97.33	74.56	43.48
Lisp	8.74	6.57		12.83	76.18

Analysis

x86 machines

You would think we could use these 3 machines to establish a baseline but we find a fairly large variance in results here. First of all, inexplicably, Inferno is the only machine to have a worse result for Perl than Awk. Also, we can see that when it comes to the interpreted languages, Kvasir is near the worst in all cases. I would attribute this to Hardened Gentoo adding very viable overhead to the interpreters. It seems to show there is a definite cost for added security in terms of efficiency.

PPC

The most notable result here is the Java result which is clearly markedly bad. Java for the PPC could use some optimization. C# care of mono on the other hand is competitive. The rest of the interpreted languages also lag behind on the PPC, although Lisp (SBCL) comes pretty close the the x86 scaled results.

ARM

And now what you've been waiting for, the ARM results for the GP2X. Well, Sadly, I just couldn't really get Java for the GP2X. Sun Java appeared to be unavailable. I could have used something like Kaffe or Jikes, but it probably wouldn't have been to fair, and also, on Debian, they insisted in pulling in some parts of Xorg as dependencies, and I didn't have a lot of space to play around with on the GP2X. Kind of lame, oh well. Again, as with the PPC, C# care of mono is very respectable. Other than that, the Lisp result was way off by a staggering amount, but that can be explained by SBCL not being available for ARM. I had to resort to the clearly slower CLisp compiler/'interpreter.'

Languages

As much hype as there is around Python these days, it appears to be fairly slow across the board compared to other interpreted languages. PHP on fact is the fastest of PERL, PHP, and Python on all tested architectures, so if you need speed and yet still the flexibility of an interpreted language, you might seriously want to use the CLI version of PHP. It seems the interpreter is very optimized across the board.

If you happened to be on an architectures supported by a good Lisp compiler like SBCL it is also a very attractive and viable option, but unfortunately for ARM, it looks like CLisp isn't, speed wise anyway.

As for Java, hopefully the GPLing of it will allow it to a) be further optimized for alternate architectures like PPC, and b) for it to be fully ported to 'new' architectures like ARM. If you're looking for speed but the middle ground flexibility of a VM language than in the mean time C# in the form of Mono is a fantastic looking choice.

Note: Ruby has again been omitted because until 2.0 is released, which includes a real VM, it is sadly not even remotely competitive in this area (math computation). It is about an order of magnitude slower than any of the other interpreted languages. Ruby 1.9 CVS last I checked (half a year ago) was competitive with Python :)

And that's it from me on the Primes front (at east until I acquire a Sparc box :P ...)

Well, I took some time and experimented with crossdev for the GP2X and added those notes to my Gentoo GP2X Guide in a new section here (GP2X Crossdev). As I mentioned in the new section, it didn't end up quite working, and as I went along, I saw some potential further complications. So I'm going to pause on this track for the moment and explore another track that may be more promising, Debian on the GP2X.

Why? I haven't really spent much time with Gentoo's crossd evelopment tools yet, or their embedded stuff, but neitehr quite seem a match for this situation. The situation being I have a system, and simply want another computer to compile all new programs so as not to kill my SD card. crossdev feels more like it's meant for building a new system, not incrementally updating an existing one. However, a binary distro like Debian wouldn't give me the problems new software installation on Gentoo presents (compilation killing SD card).

So I'm going to take a look at Debian for the GP2X coming up soon.