2.3-i386-nanobsd: nginx not working: PANIC: unprotected error in call to Lua API

klou · Apr 26, 2016, 10:01 PM

I'm sure this'll won't much response because of the lack of supported hardware, but I'll post anyway in case somebody's feeling generous with their knowledge:

2.3 seems to be working well (after upgrade from 2.2.6), but nginx crashes. Also, it's a remote box so the only thing I have to work with is SSH at this point.

I pulled from dmesg.boot the following line:


php-cgi: rc.bootup: The command '/usr/local/sbin/nginx -c /var/etc/nginx-webConfigurator
.conf’ returned exit code '1’, the output was 'PANIC: unprotected error in call to Lua API (CPU not supported)'

I also get that when trying to call nginx manually–and this is with an ooooooooold VIA chip in an embedded Multitech device that has been faithfully running for quite some time.

CPU: VIA Samuel 2 (400.92-MHz 686-class CPU)
Origin="CentaurHauls" Id=0x673 Family=0x6 Model=0x7 Stepping=3
Features=0x803035 <fpu,de,tsc,msr,mtrr,pge,mmx>AMD Features=0x80000000<3DNow!></fpu,de,tsc,msr,mtrr,pge,mmx>

Any ideas before I start looking for new hardware?

cmb · Apr 15, 2016, 4:56 AM

Wasn't aware of that until it came up on the mailing list yesterday. Turns out we unknowingly deprecated CPUs lacking CMOV.
https://lists.pfsense.org/pipermail/list/2016-April/009649.html

Lua API requires it, and we may take advantage of that in nginx in the future. So that won't be going away.

Outside the circa 2001 VIA chips that are now 15 years old, that only impacts mid-'90s era CPUs.

For now you could compile nginx on stock FreeBSD 10.3 without Lua support and I think it'll work. But it's probably time to upgrade from a 15 year old box.

Feel a bit sorry for you that your Internet's slow enough that a 15 year old box, with comparable performance to many 20-25 year old boxes, suffices. :) Even my home connection is probably 10-15 times faster than what that'll handle (350 Mb).

klou · Apr 15, 2016, 4:56 PM

@cmb

Thanks for the info and the suggestion. I had wondered if there was a simple way to replace nginx (with something else), and I'll certainly compile and try that. For now, I'd like to restore functionality and limp along until we can get a replacement in place.

Also good to know that this is a "stock" limitation moving forward.

NUT · Apr 24, 2016, 2:29 PM

@cmb:

Wasn't aware of that until it came up on the mailing list yesterday. Turns out we unknowingly deprecated CPUs lacking CMOV.
https://lists.pfsense.org/pipermail/list/2016-April/009649.html

I was looking for a cause that made 2.3 crash nginx… I guess I found it...

@cmb:

Feel a bit sorry for you that your Internet's slow enough that a 15 year old box, with comparable performance to many 20-25 year old boxes, suffices. :) Even my home connection is probably 10-15 times faster than what that'll handle (350 Mb).


CPU: VIA Samuel 2 (799.88-MHz 686-class CPU)
  Origin="CentaurHauls"  Id=0x673  Family=0x6  Model=0x7  Stepping=3
  Features=0x803035 <fpu,de,tsc,msr,mtrr,pge,mmx>AMD Features=0x80000000<3DNow!></fpu,de,tsc,msr,mtrr,pge,mmx>

I feel a bit sorry that you feel the need for speed by upping your hardware without any real good reason to scrap it >:(

I have 2 connections, one is a 'mere' symmetrical 25 Mbit, the other 100Mbit/20Mbit. They both perform with less then 10ms added latency on a full pull download on my slightly faster sister cpu. The VIA Samuel 2 series CPU is low power and offers a low cost, low noise and stable router platform.

Now I have to downgrade to 2.2.6 or scrap perfectly good hardware for the sake of 'having the latest and greatest' …

Sorry, but I found that remark very derogatory and offensive.

cmb · Apr 26, 2016, 3:16 AM

For now we disabled the LUA option in nginx in 2.3.1 so this won't happen. You can get the latest snapshot from snapshots.pfsense.org. Ancient CPUs have gotten a reprieve for a bit at least.

@[NUT:

link=topic=110030.msg616230#msg616230 date=1461508193]
Sorry, but I found that remark very derogatory and offensive.

C'mon.. it was a lighthearted joke.

Your 15 year old VIA isn't capable of maxing out my connection speed (without even considering VPN, where it has no hope), I didn't scrap anything for no reason. Of course I'm running new hardware anyway as we dogfood all the hardware we sell.

NUT · Apr 26, 2016, 8:30 AM

@cmb:

For now we disabled the LUA option in nginx in 2.3.1 so this won't happen. You can get the latest snapshot from snapshots.pfsense.org. Ancient CPUs have gotten a reprieve for a bit at least.

Great! (and I mean that in a positive way!) … but how to update to a snapshot on a running device without webgui? I've been searching the forums, but I can't find a definitive answer anywhere... ~~( Found it on the WiKi/FAQ: https://doc.pfsense.org/index.php/Upgrading_via_Shell_%28old%29 )~~ That doesn't work anymore :(

@cmb:

@[NUT:

link=topic=110030.msg616230#msg616230 date=1461508193]
Sorry, but I found that remark very derogatory and offensive.

C'mon.. it was a lighthearted joke.

Your 15 year old VIA isn't capable of maxing out my connection speed (without even considering VPN, where it has no hope), I didn't scrap anything for no reason. Of course I'm running new hardware anyway as we dogfood all the hardware we sell.

It might be 15 years old technology, but if it works fine for me, why would I replace it? I'm sure the LUA api and it's inner workings can do just fine with a software workaround instead of relying on a hardware feature.

I know time and tech is moving on, but if I where to have the software based solution and would have to conclude the board became too sluggish to run pfSense effectively, THAT would be the time I will be looking for replacement hardware to retire this one to the scrap pile…

NUT · Apr 26, 2016, 9:38 AM

@[NUT:

link=topic=110030.msg616788#msg616788 date=1461655781]
Great! (and I mean that in a positive way!) … but how to update to a snapshot on a running device without webgui? I've been searching the forums, but I can't find a definitive answer anywhere... ~~( Found it on the WiKi/FAQ: https://doc.pfsense.org/index.php/Upgrading_via_Shell_%28old%29 )~~ That doesn't work anymore :(

I've been poking around and I have to say the WIKI pages are quite outdated on the update/upgrade/backup/restore features… the rc scripts mentioned are nowhere to be found :o

If anyone has the answer, I'd like to know: how to update from the RELEASE/Stable branch to the SNAPSHOTS branch without a functioning WebGUI?

allenb · Apr 26, 2016, 6:04 PM

@cmb:

Wasn't aware of that until it came up on the mailing list yesterday. Turns out we unknowingly deprecated CPUs lacking CMOV.
https://lists.pfsense.org/pipermail/list/2016-April/009649.html

Lua API requires it, and we may take advantage of that in nginx in the future. So that won't be going away.

Outside the circa 2001 VIA chips that are now 15 years old, that only impacts mid-'90s era CPUs.

Wanted to add my two cents since I've just encountered this as well. Got a similar unsupported CPU:

CPU: VIA Ezra (797.98-MHz 686-class CPU)
Origin="CentaurHauls" Id=0x67a Family=0x6 Model=0x7 Stepping=10
Features=0x803035 <fpu,de,tsc,msr,mtrr,pge,mmx>AMD Features=0x80000000<3DNow!>

It handles my ~90/12 connection just fine although interrupt processing CPU nears 100% at full download. I've actually upgraded my router recently but the old box still takes care of a few things.

I'll look forward to trying out the 2.3.1 build as soon as I figure out how, or someone posts the solution.

Thanks!
Allen</fpu,de,tsc,msr,mtrr,pge,mmx>

cmb · Apr 26, 2016, 10:21 PM

@allenb:

I'll look forward to trying out the 2.3.1 build as soon as I figure out how, or someone posts the solution.

Instructions here:
https://forum.pfsense.org/index.php?topic=110157.msg613376

NUT · Apr 27, 2016, 12:16 PM

@cmb:

@allenb:

I'll look forward to trying out the 2.3.1 build as soon as I figure out how, or someone posts the solution.

Instructions here:
https://forum.pfsense.org/index.php?topic=110157.msg613376

But that's just the thing, that assumes you still have a working webgui…

How to update without that?

klou · Apr 27, 2016, 11:15 PM

Rename /usr/local/sbin/nginx, copy a new one in it's place, make it executable.

Use at your own risk … but compiled from FreeBSD 10.3 i386.


nginx version: nginx/1.8.1
built with OpenSSL 1.0.1s-freebsd  1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --with-ld-opt='-L /usr/local/lib' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx-error.log --user=www --group=www --with-file-aio --with-ipv6 --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx-access.log --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_stub_status_module --with-http_sub_module --with-pcre --with-http_spdy_module --with-mail --without-mail_imap_module --without-mail_pop3_module --without-mail_smtp_module --with-mail_ssl_module --with-http_ssl_module

nginx.tar.gz

cmb · Apr 28, 2016, 5:54 AM

@[NUT:

link=topic=110030.msg617312#msg617312 date=1461759375]
But that's just the thing, that assumes you still have a working webgui…

How to update without that?

In that case, run this:

 ln -s /usr/local/share/pfSense/pkg/repos/pfSense-repo-devel.conf /usr/local/etc/pkg/repos/pfSense.conf

Then upgrade via option 13 at the console.

NUT · Apr 28, 2016, 10:43 AM

@cmb:

@[NUT:

link=topic=110030.msg617312#msg617312 date=1461759375]
But that's just the thing, that assumes you still have a working webgui…

How to update without that?

In that case, run this:
 ln -s /usr/local/share/pfSense/pkg/repos/pfSense-repo-devel.conf /usr/local/etc/pkg/repos/pfSense.conf 
Then upgrade via option 13 at the console.

Weird… I have it spitting out that it's on 2.4-DEVELOPMENT but nginx still crashes... I'm reinstalling all the packages (pkg upgrade -f) right now, maybe it skipped the update of nginx for some random reason ...

NUT · Apr 28, 2016, 11:32 AM

@klou:

Rename /usr/local/sbin/nginx, copy a new one in it's place, make it executable.

Use at your own risk … but compiled from FreeBSD 10.3 i386.


nginx version: nginx/1.8.1
built with OpenSSL 1.0.1s-freebsd  1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --with-ld-opt='-L /usr/local/lib' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx-error.log --user=www --group=www --with-file-aio --with-ipv6 --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx-access.log --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_stub_status_module --with-http_sub_module --with-pcre --with-http_spdy_module --with-mail --without-mail_imap_module --without-mail_pop3_module --without-mail_smtp_module --with-mail_ssl_module --with-http_ssl_module

By using your binary I was able to get the WebGUI to work again, I went to system->update and could select the development branch and installed 2.3.1, which actually works fine now…

THANK YOU!