Opened 12 years ago

Closed 12 years ago

#155 closed defect (fixed)

squashfs - failed access to the last block makes kernel panic

Reported by: anonymous Owned by: developers
Priority: normal Milestone:
Component: base system Version:
Keywords: Cc:


With some combination of kernel and squashfs sizes
kernel fails to boot:

Writing image at 0xa0001000 to flash at 0xbfc40000...done
Doing command call 80001000
CPU revision is: 00024000
Enabling BCM4710A0 cache workarounds.
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Linux version 2.4.30 (vanekt@big) (gcc version 3.4.4) #9 Wed Dec 21 10:04:25 CET
Setting the PFC value as 0x15
Determined physical RAM map:
 memory: 00800000 @ 00000000 (usable)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
CPU: BCM4710 rev 0 at 125 MHz
Using 62.400 MHz high precision timer.
Calibrating delay loop... 82.94 BogoMIPS
Memory: 6376k/8192k available (1292k kernel code, 1816k reserved, 96k data, 80k
init, 0k highmem)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (
devfs: boot_options: 0x1
JFFS version 1.0, (C) 1999, 2000  Axis Communications AB
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xbf800000 (irq = 2) is a 16550A
Software Watchdog Timer: 0.05, timer margin: 60 sec
 Amd/Fujitsu Extended Query Table v1.0 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Flash device: 0x200000 at 0x1fc00000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x001f0000 : "linux"
0x000b2094-0x00190000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x001f0000-0x00200000 : "nvram"
0x00190000-0x001f0000 : "OpenWrt"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 320 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
attempt to access beyond end of device
1f:02: rw=0, want=888, limit=887
attempt to access beyond end of device
1f:02: rw=0, want=888, limit=887
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 80k freed
SQUASHFS error: lzma returned unexpected result 0x1
SQUASHFS error: Unable to read cache block [0:0]
SQUASHFS error: Unable to read inode [dd0e3:4c2]
SQUASHFS error: lzma returned unexpected result 0x1
SQUASHFS error: Unable to read cache block [0:0]
SQUASHFS error: Unable to read inode [dd0e3:59e]
Kernel panic: No init found.  Try passing init= option to kernel.
 <0>Rebooting in 3 seconds...

rootfs partition begins at unaligned address in flash.
When it is filled near to 64k aligned boundary of OpenWrt partition
the last block of squashfs (not a whole kilobyte) cannot be accessed
as the block device driver treat that block as a kilobyte overflowing to OpenWrt

In this case:

0x00040000-0x000b2093 : "linux (real end)"
0x000b2094-0x00190000 : "rootfs"
    we have (0x190000 - 0xb2094)/1024 = 887 whole kilo blocks, this is 908288 bytes
    and 0x190000 - 0xb2094 - 877 * 1024 = 876 bytes remainder
0x00190000-0x001f0000 : "OpenWrt"

$ ll build_mipsel/linux-2.4-brcm/root.squashfs
-rwx------  1 van van 908319 Dec 21 22:05 build_mipsel/linux-2.4-brcm/root.squashfs
  • this squashfs takes last 31 byte from remainder - kernel panics as shown above

When squashfs is shortened below 908288 (I tested 908258), kernel boots OK.
The black hole of 876 bytes (generally 1024 - (kernel_size % 1024)) repeats each 64kilobytes.

I guess that


Tested on WAP54G v1.0 with connected UART and serial console, fresh svn white russian. The bug is probably device independent and it is also in svn head.
Look into forum how many times somebody complains to broken squashfs image...

Proposed solution:

  • align start of rootfs to 1 kilobyte block boundary in trx generator
    $ svn diff target/linux/image/brcm/Makefile
    Index: target/linux/image/brcm/Makefile
    --- target/linux/image/brcm/Makefile    (revision 2744)
    +++ target/linux/image/brcm/Makefile    (working copy)
    @@ -25,6 +25,9 @@
     ifeq ($(FS),jffs2-4MB)
     TRXALIGN:=-a 0x10000
    +ifeq ($(FS),squashfs)
    +TRXALIGN:=-a 1024
            cp $(BUILD_DIR)/loader.gz $@


  • change device size checked in drivers/block/ll_rw_block.c

Attachments (0)

Change History (1)

comment:1 Changed 12 years ago by wbx

  • Resolution set to fixed
  • Status changed from new to closed

fixed in r2758/r2759. thank you very much for the detailed bug report.

Add Comment

Modify Ticket

as closed .
The resolution will be deleted. Next status will be 'reopened'.

E-mail address and user name can be saved in the Preferences.

Note: See TracTickets for help on using tickets.