BrandZ Impact on ON Development

Heads-up for ON developers

The integration of BrandZ into Solaris makes several fundamental changes to the way zones are implemented and inserts changes into some critical code paths in the kernel. All of these changes should be invisible to the end user, but they may trip up the unsuspecting kernel engineer.

We know that not everybody is going to be eager or able to install a GB+ of Linux software on their machines to verify the correctness of their changes. Also, the BrandZ changes affect all architectures, and Linux is only supported on x86. To enable everybody to validate their changes againt the BrandZ infrastructure, we have created an 'sn1' (for Solaris N-1) brand. This brand will allow you to create and test branded zones on SPARC and x86 machines with no Linux software.

The Solaris N-1 brand is identical to the native Solaris brand in all ways but one: the value returned by uname(2). On a Nevada system, uname(2) will return '10' in the release field instead of '11'. When BrandZ is backported to Solaris 10, uname(2) will return '9' in the release field instead of '10'.

To verify that any changes you have made to ON do not break BrandZ, it will almost always be sufficient to create an Solaris N-1 zone, boot it, and verify that "/usr/bin/uname -r" returns 5.10 on Nevada and 5.9 on Solaris 10.

For example:

bash-3.00# zonecfg -z sn1
sn1: No such zone configured
Use 'create' to begin configuring a new zone
zonecfg:sn1> create -t SUNWsn1
zonecfg:sn1> set zonepath=/export/sn1
zonecfg:sn1> commit
zonecfg:sn1> exit
bash-3.00# zoneadm -z sn1 install
Preparing to install zone .
Creating list of files to copy from the global zone.
[...]
The file  contains a log
of the zone installation.
bash-3.00# zoneadm list -icv
  ID NAME             STATUS         PATH                           BRAND
   0 global           running        /                              native
   - sn1              installed      /export/sn1                    sn1
bash-3.00# zoneadm -z sn1 boot
bash-3.00# zlogin sn1
[Connected to zone 'sn1' pts/2]
Sun Microsystems Inc.   SunOS 5.11      staging 2006-09-08      Sep. 08,
2006
SunOS Internal Development:  nn35248 2006-09-08 [staging]
bfu'ed from /net/steam/builds/nils/staging/archives/sparc/nightly on 2006-09-08
Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
# uname -a
SunOS sn1 5.10 staging_2006-09-08 sun4u sparc SUNW,UltraAX-i2
#

Obviously this is not an exhaustive test suite, but it exercises enough of the relevant code paths to give a fairly high confidence that all is well. If this is not a sufficient test for your changes, then you are probably working on something so intertwined with BrandZ that you already know that this testing is insufficient.

SPARC note:The Sn-1 brand will only work on DEBUG kernels on SPARC. Attempting to boot an Sn-1 zone on a non-DEBUG SPARC kernel will result in this failure:

bash-3.00# zoneadm -z palms-s1 boot
zoneadm: zone 'palms-s1': Could not set zone brand attribute.: Invalid argument
zoneadm: zone 'palms-s1': devfsadm call (/usr/sbin/devfsadm -Z palms-s1) unexpectedly returned 1
zoneadm: zone 'palms-s1': call to zoneadmd failed

 A more helpful error message will be displayed on the console or in /var/adm/messages:

/var/adm/messages:
	Aug 30 23:55:21 palms sn1_brand: [ID 793185 kern.warning] WARNING: The sn1 brand is only supported on DEBUG kernels.

Important: The Solaris N-1 brand is intended solely for testing purposes. This is emphaticly not a real "Solaris 10 on Nevada" solution. Under no circumstances should an Sn-1 zone be used in production. These zones are intended to be created and destroyed immediately after you are done testing. To avoid confusing end users, the packages needed to create Sn-1 zones are not available on the Solaris install media - they are only available in the (Open)Solaris source tree. Anybody who suggests that an Sn-1 zone is a reasonable solution to _any_ problem encountered by a customer is a dangerous charlatan who should not be allowed to touch any of your systems, and should probably be burned at the stake. I'm not kidding around here.