Modify

Opened 11 years ago

Closed 11 years ago

#1465 closed defect (fixed)

brcm47xx-2.6 squashfs corruption (gcc 4.1.2) / broken lan

Reported by: mbm Owned by: developers
Priority: high Milestone: Kamikaze 7.06
Component: kernel Version:
Keywords: Cc:

Description

The /local/network/config.sh script has become corrupted breaking the lan configuration. Further investigation shows the script's bridge setup has become overwritten by what appears to be the nvram variable eth0phyaddr.

md5sum build_mipsel/root/lib/network/config.sh 
e7cc577c3712e3a70aad0083c6da94e2  build_mipsel/root/lib/network/config.sh

root@OpenWrt:~# md5sum /rom/lib/network/config.sh 
cec518d7206b15cf9a58c65460dd3cf1  /rom/lib/network/config.sh

--- valid       2007-03-15 00:34:59.000000000 -0700
+++ corrupt     2007-03-15 00:34:40.000000000 -0700
@@ -147,10 +147,10 @@
 00000920  64 69 66 20 22 62 72 2d  24 63 6f 6e 66 69 67 22  |dif "br-$config"|
 00000930  20 22 24 69 66 61 63 65  22 0a 09 09 09 09 09 23  | "$iface"......#|
 00000940  20 42 72 69 64 67 65 20  65 78 69 73 74 65 64 20  | Bridge existed |
-00000950  61 6c 72 65 61 64 79 2e  20 4e 6f 20 66 75 72 74  |already. No furt|
-00000960  68 65 72 20 70 72 6f 63  65 73 73 69 6e 67 20 6e  |her processing n|
-00000970  65 63 65 73 61 72 79 0a  09 09 09 09 7d 20 7c 7c  |ecesary.....} |||
-00000980  20 7b 0a 09 09 09 09 09  24 44 45 42 55 47 20 62  | {......$DEBUG b|
+00000950  61 6c 72 65 61 64 79 2e  20 4e 6f 20 00 65 74 30  |already. No .et0|
+00000960  70 68 79 61 64 64 72 00  32 35 34 30 66 2d 62 35  |phyaddr.2540f-b5|
+00000970  2d 33 64 2d 35 63 2d 63  39 35 32 30 30 20 72 6f  |-3d-5c-c95200 ro|
+00000980  6f 74 3d 20 72 77 20 6e  6f 69 6e 69 74 72 64 62  |ot= rw noinitrdb|
 00000990  72 63 74 6c 20 61 64 64  62 72 20 22 62 72 2d 24  |rctl addbr "br-$|
 000009a0  63 6f 6e 66 69 67 22 0a  09 09 09 09 09 24 44 45  |config"......$DE|
 000009b0  42 55 47 20 62 72 63 74  6c 20 73 65 74 66 64 20  |BUG brctl setfd |

What's odd is that there's no other indications of corruption:

md5sum build_mipsel/linux-2.6-brcm47xx/root.squashfs 
1e0f50954508b388cd7aedf158c47f0a  build_mipsel/linux-2.6-brcm47xx/root.squashfs
wc -c build_mipsel/linux-2.6-brcm47xx/root.squashfs
1114651 build_mipsel/linux-2.6-brcm47xx/root.squashfs

root@OpenWrt:~# dd if=/dev/mtdblock2 bs=1114651 count=1 | md5sum -
1+0 records in
1+0 records out
1e0f50954508b388cd7aedf158c47f0a  -

Attachments (1)

145-cfe_env_initdata.patch (472 bytes) - added by jhansen@… 11 years ago.
cfe_env.c _nvdata/_valuestr fix

Download all attachments as: .zip

Change History (5)

comment:1 Changed 11 years ago by mbm

see also #1451 for earlier discussion

comment:2 Changed 11 years ago by jhansen@…

This is very interesting because I saw the same type of corruption, except that the corruption happened *before* the LZMA decompression, not *after*, as in this case. I was receiving LZMA decompression errors in squashfs, and was finding something like:

ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0;boot -elf flash0.os, etc.

64 bytes of NVRAM crud right in the middle of the compressed data.

Perhaps there is an interrupt still being serviced by CFE which is clobbering data after Linux has booted, or something similar? I've done extensive memcpy tests, and it really does *not* appear that memcpy nor memcpy prefetching seem to be the issue here. It definitely seems to be a race condition of some sort, though, because changing the timing by even 10 clocks (in different places) will work-around the issue.

comment:3 Changed 11 years ago by jhansen@…

I finally fixed the problem. In cfe_env.c, the buffer used to copy nvram parameters was in the initdata section, and the actual function doing the copying was not. :(

The following patch fixes it. Hallelujah!

Changed 11 years ago by jhansen@…

cfe_env.c _nvdata/_valuestr fix

comment:4 Changed 11 years ago by nbd

  • Resolution set to fixed
  • Status changed from new to closed

Thanks a lot for debugging this. Fix applied in [6575]
... and there was much rejoicing.

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.