[OpenWrt-Devel] AA on brcm47xx: Unhandled kernel unaligned access

Nikolai Zhubr n-a-zhubr at yandex.ru
Tue Jul 15 16:44:18 EDT 2014 

15.07.2014 23:26, Nikolai Zhubr:
[...]
> And I've performed yet another experiment. If I insert an additional
> router (running also openwrt but atheros-based) between this WL-500W and
> uplink (with the idea to filter out any strange and bogus incoming
> packets) and redo the same test, I get no panic but instead a silent
> spontaneous reboot in a few minutes after reaching 30mbit traffic. I'll

Here is a slightly different panic, although also involving 
netif_receive_skb_core (And this is still with additional openwrt router 
inserted before uplink):

[  900.720000] CPU 0 Unable to handle kernel paging request at virtual 
address 00000004, epc == 80119aa0, ra == 8011b2e8
[  900.720000] Oops[#1]:
[  900.720000] CPU: 0 PID: 3 Comm: ksoftirqd/0 Not tainted 3.10.44 #2
[  900.720000] task: 81820028 ti: 8182a000 task.ti: 8182a000
[  900.720000] $ 0   : 00000000 10003800 80f29a48 00000000
[  900.720000] $ 4   : 802be1a0 802bdc1c 00000000 fffffffc
[  900.720000] $ 8   : 00000384 2b82ea80 00989680 00000000
[  900.720000] $12   : 00000384 00003c87 00000000 00000000
[  900.720000] $16   : 802be1a0 802bdc1c 802bdc40 7fffffff
[  900.720000] $20   : 00000384 ffffffff 2aea8de9 00000000
[  900.720000] $24   : 00000000 80016dc0
[  900.720000] $28   : 8182a000 8182bb50 00000384 8011b2e8
[  900.720000] Hi    : 00000000
[  900.720000] Lo    : 00003c87
[  900.720000] epc   : 80119aa0 rb_insert_color+0x2c/0x14c
[  900.720000]     Not tainted
[  900.720000] ra    : 8011b2e8 timerqueue_add+0xc0/0x118
[  900.720000] Status: 10003802	KERNEL EXL
[  900.720000] Cause : 00800008
[  900.720000] BadVA : 00000004
[  900.720000] PrId  : 00029006 (Broadcom BMIPS3300)
[  900.720000] Modules linked in: pppoe ppp_async iptable_nat b43legacy 
b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv4 mac80211 
ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport 
xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT 
xt_LOG xt_CT slhc nf_nat_irc nf_nat_ftp nf_nat nf_defrag_ipv4 
nf_conntrack_irc nf_conntrack_ftp iptable_raw iptable_mangle 
iptable_filter ipt_REJECT ip_tables crc_ccitt compat ip6t_REJECT 
ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables 
nf_conntrack_ipv6 nf_conntrack nf_defrag_ipv6 ipv6 arc4 crypto_blkcipher 
leds_gpio gpio_button_hotplug tg3 hwmon bgmac b44 ptp pps_core
[  900.720000] Process ksoftirqd/0 (pid: 3, threadinfo=8182a000, 
task=81820028, tls=00000000)
[  900.720000] Stack : 802bdc40 7fffffff 00000384 ffffffff 802be1a0 
802bdc10 802bdc40 8003a144
	  802be1a0 802c0000 00000000 802c0000 802c0000 802bdbe0 2aea8de9 8003a9c8
	  00000000 8182bc08 80c52220 80eb93a0 00000001 00000001 2aea8de9 00000384
	  00000003 2aea8de9 00000384 80f122e4 00000000 00000007 802c2870 00000000
	  00000000 80a169b5 802c0000 802765f4 80276608 80012d00 00000001 00014600
	  ...
[  900.720000] Call Trace:
[  900.720000] [<80119aa0>] rb_insert_color+0x2c/0x14c
[  900.720000] [<8011b2e8>] timerqueue_add+0xc0/0x118
[  900.720000] [<8003a144>] __run_hrtimer.isra.26+0x7c/0xf8
[  900.720000] [<8003a9c8>] hrtimer_interrupt+0x14c/0x3f4
[  900.720000] [<80012d00>] c0_compare_interrupt+0x74/0xa0
[  900.720000] [<8005335c>] handle_irq_event_percpu+0x64/0x1ec
[  900.720000] [<80055e60>] handle_percpu_irq+0x54/0x84
[  900.720000] [<80052ce0>] generic_handle_irq+0x28/0x44
[  900.720000] [<8000e24c>] do_IRQ+0x1c/0x2c
[  900.720000] [<8000a3ec>] plat_irq_dispatch+0x40/0xb8
[  900.720000] [<80001448>] ret_from_irq+0x0/0x4
[  900.720000] [<80005590>] __copy_user_common+0x248/0x2d8
[  900.720000] [<801a8830>] skb_copy_ubufs+0xec/0x204
[  900.720000] [<801b3db0>] __netif_receive_skb_core+0x47c/0x52c
[  900.720000] [<81ad41d4>] 0x81ad41d4
[  900.720000]
[  900.720000]
Code: 30660001  14c00047  00000000 <8c660004> 10460016  00000000 
10c00005  00000000  8cc80000
[  900.720000] ---[ end trace de6e4d131b0441ac ]---
[  900.720000] Kernel panic - not syncing: Fatal exception in interrupt



> retest this more carefully later, and meanwhile I think:
>
> 1. Apparently some (bogus?) packets ocasionally coming from uplink still
> confuse b44 driver and cause panics regardless of my B44_RXMAXLEN
> correction.
>
> 2. Silent reboot might probably indicate hardware problem like
> overheating. Although I have its case open and I touched its chips,
> well, they were acceptably warm I think. Another point is that CPU
> performance limits routing capability of this device (when using openwrt
> at least) somewhere around 33mbit, so getting close to continuous 100%
> CPU usage might probably lead to watchdog trigger? (Just a random
> speculation)
>
>
> Thank you.
> Nikolai
>
>>
>>
>> [ 271.210000] ------------[ cut here ]------------
>> [ 271.220000] WARNING: at net/core/dev.c:2194
>> skb_warn_bad_offload+0xc0/0xe8()
>> [ 271.220000] b44: caps=(0x0000000000004000, 0x0000000000000000) len=377
>> data_len=0 gso_size=57048 gso_type=32506 ip_summed=0
>> [ 271.240000] Modules linked in: pppoe ppp_async iptable_nat b43legacy
>> b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv4 mac80211
>> ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport
>> xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT
>> xt_LOG xt_CT slhc nf_nat_irc nf_nat_ftp nf_nat nf_defrag_ipv4
>> nf_conntrack_irc nf_conntrack_ftp iptable_raw iptable_mangle
>> iptable_filter ipt_REJECT ip_tables crc_ccitt compat ip6t_REJECT
>> ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables
>> nf_conntrack_ipv6 nf_conntrack nf_defrag_ipv6 ipv6 arc4 crypto_blkcipher
>> leds_gpio gpio_button_hotplug tg3 hwmon bgmac b44 ptp pps_core
>> [ 271.300000] CPU: 0 PID: 3 Comm: ksoftirqd/0 Not tainted 3.10.44 #2
>> [ 271.300000] Stack : 00000000 00000000 00000000 00000000 8030d552
>> 00000036 818201d0 00000008
>> 80272688 802bf23b 00000003 8030cd00 818201d0 00000008 802bb6e4 00000000
>> 802bb6dc 8001c204 00000003 80019bc4 80299520 00000008 80273f28 8182bc5c
>> 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
>> 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8182bbe8
>> ...
>> [ 271.340000] Call Trace:
>> [ 271.340000] [<80010ca0>] show_stack+0x48/0x70
>> [ 271.350000] [<80019cc0>] warn_slowpath_common+0x78/0xa8
>> [ 271.350000] [<80019d1c>] warn_slowpath_fmt+0x2c/0x38
>> [ 271.360000] [<801b2d10>] skb_warn_bad_offload+0xc0/0xe8
>> [ 271.360000] [<801b68c4>] __skb_gso_segment+0x50/0xec
>> [ 271.370000] [<801de5bc>] ip_forward_finish+0x108/0x1bc
>> [ 271.370000] [<801b3da0>] __netif_receive_skb_core+0x46c/0x52c
>> [ 271.380000] [<81ad41d4>] 0x81ad41d4
>> [ 271.380000]
>> [ 271.380000] ---[ end trace b4f0aa7175b12bf7 ]---
>> [ 271.390000] Unhandled kernel unaligned access[#1]:
>> [ 271.390000] CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G W 3.10.44 #2
>> [ 271.390000] task: 81820028 ti: 8182a000 task.ti: 8182a000
>> [ 271.390000] $ 0 : 00000000 00000001 81696a48 00000028
>> [ 271.390000] $ 4 : 2d37d9ee 00000000 00007088 00000000
>> [ 271.390000] $ 8 : 0000002d 35373137 62323162 5d203766
>> [ 271.390000] $12 : 00000000 03bf0000 00000000 bc000000
>> [ 271.390000] $16 : 80e7fec0 00000001 00000001 00000014
>> [ 271.390000] $20 : 00000000 00000008 802bb6e4 00000000
>> [ 271.390000] $24 : 00000003 80150bcc
>> [ 271.390000] $28 : 8182a000 8182bd28 802bb6dc 801ab22c
>> [ 271.390000] Hi : 00000000
>> [ 271.390000] Lo : 00000083
>> [ 271.390000] epc : 80064440 put_page+0x0/0x4c
>> [ 271.390000] Tainted: G W
>> [ 271.390000] ra : 801ab22c skb_release_data+0xc4/0x118
>> [ 271.390000] Status: 1000b803 KERNEL EXL IE
>> [ 271.390000] Cause : 00800010
>> [ 271.390000] BadVA : 2d37d9ee
>> [ 271.390000] PrId : 00029006 (Broadcom BMIPS3300)
>> [ 271.390000] Modules linked in: pppoe ppp_async iptable_nat b43legacy
>> b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv4 mac80211
>> ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport
>> xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT
>> xt_LOG xt_CT slhc nf_nat_irc nf_nat_ftp nf_nat nf_defrag_ipv4
>> nf_conntrack_irc nf_conntrack_ftp iptable_raw iptable_mangle
>> iptable_filter ipt_REJECT ip_tables crc_ccitt compat ip6t_REJECT
>> ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables
>> nf_conntrack_ipv6 nf_conntrack nf_defrag_ipv6 ipv6 arc4 crypto_blkcipher
>> leds_gpio gpio_button_hotplug tg3 hwmon bgmac b44 ptp pps_core
>> [ 271.390000] Process ksoftirqd/0 (pid: 3, threadinfo=8182a000,
>> task=81820028, tls=00000000)
>> [ 271.390000] Stack : 80e7fec0 801ab294 80e7fec0 00007088 00000000
>> 80e7fec0 ffffffea 801ab2d0
>> 802bb6e4 80e7fec0 80e5da40 00000001 80e7fec0 801de5d4 00000850 80f72ac0
>> 81b68000 801de4b4 00000001 801aa3e4 802bca98 802bca98 802bb6d0 81abc000
>> 80e7fec0 801b3da0 00000042 81ad0964 81b7df20 801aa3e4 802bb6e4 8018e658
>> 0000010a 000001f1 81abc3e8 81abc3c0 00000042 80e7fec0 00000017 00000187
>> ...
>> [ 271.390000] Call Trace:
>> [ 271.390000] [<80064440>] put_page+0x0/0x4c
>> [ 271.390000] [<801ab22c>] skb_release_data+0xc4/0x118
>> [ 271.390000] [<801ab2d0>] __kfree_skb+0x14/0xd4
>> [ 271.390000] [<801de5d4>] ip_forward_finish+0x120/0x1bc
>> [ 271.390000] [<801b3da0>] __netif_receive_skb_core+0x46c/0x52c
>> [ 271.390000] [<81ad41d4>] 0x81ad41d4
>> [ 271.390000]
>> [ 271.390000]
>> Code: 3c058006 080190c9 24a538e4 <8c820000> 3042c000 10400003 00801821
>> 08018fa0 00000000
>> [ 271.630000] ---[ end trace b4f0aa7175b12bf8 ]---
>> [ 271.640000] Kernel panic - not syncing: Fatal exception in interrupt
>> [ 271.640000] Rebooting in 3 seconds..
>>
>>
>>
>>>
>>>> or maybe even
>>>> bw32(bp, B44_RXMAXLEN, bp->dev->mtu) ?
>>>>
>>>> Apology for my ignorance, just can't stand testing it immediately to
>>>> hopefully get it right for BB.
>>>>
>>>>
>>>> Thank you.
>>>> Nikolai
>>>
>>> Thanks for testing!
>>>
>>>
>>> Jonas
>>>
>>> .
>>>
>> _______________________________________________
>> openwrt-devel mailing list
>> openwrt-devel at lists.openwrt.org
>> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>>
>>
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel at lists.openwrt.org
> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>
>
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel

More information about the openwrt-devel mailing list