2.3-i386-nanobsd: nginx not working: PANIC: unprotected error in call to Lua API

NUT

Wasn't aware of that until it came up on the mailing list yesterday. Turns out we unknowingly deprecated CPUs lacking CMOV.
https://lists.pfsense.org/pipermail/list/2016-April/009649.html

I was looking for a cause that made 2.3 crash nginx… I guess I found it...

@cmb:

Feel a bit sorry for you that your Internet's slow enough that a 15 year old box, with comparable performance to many 20-25 year old boxes, suffices. :) Even my home connection is probably 10-15 times faster than what that'll handle (350 Mb).


CPU: VIA Samuel 2 (799.88-MHz 686-class CPU)
  Origin="CentaurHauls"  Id=0x673  Family=0x6  Model=0x7  Stepping=3
  Features=0x803035 <fpu,de,tsc,msr,mtrr,pge,mmx>AMD Features=0x80000000<3DNow!></fpu,de,tsc,msr,mtrr,pge,mmx>

I feel a bit sorry that you feel the need for speed by upping your hardware without any real good reason to scrap it >:(

I have 2 connections, one is a 'mere' symmetrical 25 Mbit, the other 100Mbit/20Mbit. They both perform with less then 10ms added latency on a full pull download on my slightly faster sister cpu. The VIA Samuel 2 series CPU is low power and offers a low cost, low noise and stable router platform.

Now I have to downgrade to 2.2.6 or scrap perfectly good hardware for the sake of 'having the latest and greatest' …

Sorry, but I found that remark very derogatory and offensive.

cmb

For now we disabled the LUA option in nginx in 2.3.1 so this won't happen. You can get the latest snapshot from snapshots.pfsense.org. Ancient CPUs have gotten a reprieve for a bit at least.

@[NUT:

link=topic=110030.msg616230#msg616230 date=1461508193]
Sorry, but I found that remark very derogatory and offensive.

C'mon.. it was a lighthearted joke.

Your 15 year old VIA isn't capable of maxing out my connection speed (without even considering VPN, where it has no hope), I didn't scrap anything for no reason. Of course I'm running new hardware anyway as we dogfood all the hardware we sell.

NUT

@cmb:

For now we disabled the LUA option in nginx in 2.3.1 so this won't happen. You can get the latest snapshot from snapshots.pfsense.org. Ancient CPUs have gotten a reprieve for a bit at least.

Great! (and I mean that in a positive way!) … but how to update to a snapshot on a running device without webgui? I've been searching the forums, but I can't find a definitive answer anywhere... ~~( Found it on the WiKi/FAQ: https://doc.pfsense.org/index.php/Upgrading_via_Shell_%28old%29 )~~ That doesn't work anymore :(

@cmb:

@[NUT:

link=topic=110030.msg616230#msg616230 date=1461508193]
Sorry, but I found that remark very derogatory and offensive.

C'mon.. it was a lighthearted joke.

Your 15 year old VIA isn't capable of maxing out my connection speed (without even considering VPN, where it has no hope), I didn't scrap anything for no reason. Of course I'm running new hardware anyway as we dogfood all the hardware we sell.

It might be 15 years old technology, but if it works fine for me, why would I replace it? I'm sure the LUA api and it's inner workings can do just fine with a software workaround instead of relying on a hardware feature.

I know time and tech is moving on, but if I where to have the software based solution and would have to conclude the board became too sluggish to run pfSense effectively, THAT would be the time I will be looking for replacement hardware to retire this one to the scrap pile…

NUT

@[NUT:

link=topic=110030.msg616788#msg616788 date=1461655781]
Great! (and I mean that in a positive way!) … but how to update to a snapshot on a running device without webgui? I've been searching the forums, but I can't find a definitive answer anywhere... ~~( Found it on the WiKi/FAQ: https://doc.pfsense.org/index.php/Upgrading_via_Shell_%28old%29 )~~ That doesn't work anymore :(

I've been poking around and I have to say the WIKI pages are quite outdated on the update/upgrade/backup/restore features… the rc scripts mentioned are nowhere to be found :o

If anyone has the answer, I'd like to know: how to update from the RELEASE/Stable branch to the SNAPSHOTS branch without a functioning WebGUI?

allenb

@cmb:

Wasn't aware of that until it came up on the mailing list yesterday. Turns out we unknowingly deprecated CPUs lacking CMOV.
https://lists.pfsense.org/pipermail/list/2016-April/009649.html

Lua API requires it, and we may take advantage of that in nginx in the future. So that won't be going away.

Outside the circa 2001 VIA chips that are now 15 years old, that only impacts mid-'90s era CPUs.

Wanted to add my two cents since I've just encountered this as well. Got a similar unsupported CPU:

CPU: VIA Ezra (797.98-MHz 686-class CPU)
Origin="CentaurHauls" Id=0x67a Family=0x6 Model=0x7 Stepping=10
Features=0x803035 <fpu,de,tsc,msr,mtrr,pge,mmx>AMD Features=0x80000000<3DNow!>

It handles my ~90/12 connection just fine although interrupt processing CPU nears 100% at full download. I've actually upgraded my router recently but the old box still takes care of a few things.

I'll look forward to trying out the 2.3.1 build as soon as I figure out how, or someone posts the solution.

Thanks!
Allen</fpu,de,tsc,msr,mtrr,pge,mmx>

cmb

@allenb:

I'll look forward to trying out the 2.3.1 build as soon as I figure out how, or someone posts the solution.

Instructions here:
https://forum.pfsense.org/index.php?topic=110157.msg613376

NUT

@cmb:

@allenb:

I'll look forward to trying out the 2.3.1 build as soon as I figure out how, or someone posts the solution.

Instructions here:
https://forum.pfsense.org/index.php?topic=110157.msg613376

But that's just the thing, that assumes you still have a working webgui…

How to update without that?

klou

Rename /usr/local/sbin/nginx, copy a new one in it's place, make it executable.

Use at your own risk … but compiled from FreeBSD 10.3 i386.


nginx version: nginx/1.8.1
built with OpenSSL 1.0.1s-freebsd  1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --with-ld-opt='-L /usr/local/lib' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx-error.log --user=www --group=www --with-file-aio --with-ipv6 --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx-access.log --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_stub_status_module --with-http_sub_module --with-pcre --with-http_spdy_module --with-mail --without-mail_imap_module --without-mail_pop3_module --without-mail_smtp_module --with-mail_ssl_module --with-http_ssl_module

nginx.tar.gz

cmb

@[NUT:

link=topic=110030.msg617312#msg617312 date=1461759375]
But that's just the thing, that assumes you still have a working webgui…

How to update without that?

In that case, run this:

 ln -s /usr/local/share/pfSense/pkg/repos/pfSense-repo-devel.conf /usr/local/etc/pkg/repos/pfSense.conf

Then upgrade via option 13 at the console.

NUT

@cmb:

@[NUT:

link=topic=110030.msg617312#msg617312 date=1461759375]
But that's just the thing, that assumes you still have a working webgui…

How to update without that?

In that case, run this:
 ln -s /usr/local/share/pfSense/pkg/repos/pfSense-repo-devel.conf /usr/local/etc/pkg/repos/pfSense.conf 
Then upgrade via option 13 at the console.

Weird… I have it spitting out that it's on 2.4-DEVELOPMENT but nginx still crashes... I'm reinstalling all the packages (pkg upgrade -f) right now, maybe it skipped the update of nginx for some random reason ...

NUT

@klou:

Rename /usr/local/sbin/nginx, copy a new one in it's place, make it executable.

Use at your own risk … but compiled from FreeBSD 10.3 i386.


nginx version: nginx/1.8.1
built with OpenSSL 1.0.1s-freebsd  1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --with-ld-opt='-L /usr/local/lib' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx-error.log --user=www --group=www --with-file-aio --with-ipv6 --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx-access.log --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_stub_status_module --with-http_sub_module --with-pcre --with-http_spdy_module --with-mail --without-mail_imap_module --without-mail_pop3_module --without-mail_smtp_module --with-mail_ssl_module --with-http_ssl_module

By using your binary I was able to get the WebGUI to work again, I went to system->update and could select the development branch and installed 2.3.1, which actually works fine now…

THANK YOU!