OpenSUSE Beta Can Brick Intel e1000e Network Cards

An anonymous reader writes "Some Intel cards don't just not work with the new OpenSUSE beta, they can get bricked as well. Check your hardware before you install!" The only card mentioned as affected is the Intel e1000e, and it's not just OpenSUSE for which this card is a problem, according to this short article: "Bug reports for Fedora 9 and 10 and Linux Kernel 2.6.27rc1 match the symptoms reported by SUSE users."

Comments

Badly written firmware.

[psergiu]

Any decent firmware for a device should not allow the user to accidentally destroy the device. Looks like Intel skipped on Q&A.

Re:Badly written firmware.

[reashlin]

Any decent device driver should also not be writing to the firmware, which i'm guessing is how the device can become bricked.

Re:Badly written firmware.

[arkhan_jg]

A few years back, Mandrake merged a kernel patch in their new release that would accidentally brick certain LG CDROM drives using old firmware versions when it checked if it had writing capabilities. This was largely LG's fault for re-using a valid command code to mean 'start flashing me now' instead, and of course, no firmware was then forthcoming, leaving the drive in an unusable state.

LG ended up replacing old affected drives, and the kernel patch was rewritten. Mandrake bore the brunt of the reputation hit though for quite a while, which I suspect will happen to SuSE.

The e1000e driver is the new one for pci-e based intel pro 1000 chipsets, with the old pci and pci-x cards unaffected with the original e1000 driver. Still, that's going to be quite a lot of cards affected.

Re:Badly written firmware.

[Anonymous Coward]

It appears that the bug is a combination of memory-mapped control registers which can enable flash writing and another (graphics related) problem which causes random data to be written to that area. The driver itself does not attempt to rewrite the firmware.

Re:Badly written firmware.

[jandrese]

Except for the multitude of cards that require you to basically reflash the firmware as part of the initialization? Cheap 802.11 cards are notorious for this, and it's a pain because it means you have to ship a binary blob with the driver and all of the licensing headaches that entails.

Re:Badly written firmware.

[ChrisJones]

err, what's the point of having firmware if your driver can't talk to it?

Also, this isn't about firmware, it's about Non-volatile memory. The chip uses it to store things like its MAC address.

You fail.

Re:Badly written firmware.

[ChrisJones]

the NVM is checksummed. If the checksum fails, the driver refuses to initialise the card.
It seems that something is able to write garbage data to the NVM, leaving all of its settings broken.

This isn't some database API where you get to do lots of nice high-level verification, this is twiddling bits in hardware. Of course it should be properly protected, and my discussions with Intel about this suggest that it is, and that something else is at work here, but until they release a fix, we won't know for sure.

Also, their own DOS tools to restore NIC EEPROMs actually break the laptop NICs to the point that they won't enumerate on the PCI bus, so there is literally no hope of recovery unless you happen to have a BIOS update which will rewrite all of the memory the NIC uses.

Re:Badly written firmware.

[PhilHibbs]

There's no way that a device can check all possible combinations of input for crash-inducing behaviour. If you think it can, go read "GÃdel, Escher, Bach". In fact, go read it anyway, it's awesome.

Also there's a difference between a NIC and a web site - the NIC's API input is coming from its owner, the web site's customer is not. If you're a piece of hardware, you do what your owner tells you.

Re:Badly written firmware.

[X0563511]

Can you get us an ISBN for that book? The non-ASCII character in there got mangled by slashdot (or my browser) and all search results based on my assumptions, are trash.

!Bricked

[Anonymous Coward]

Why won't people stop using the word brick to mean things that aren't bricked! All you have to do is use a quasi-negative reverse transponder linked to your flux capacitor to generate an inverse tachyon field, connect it to the JTAG while chanting Siaynoq and it will come right up. Sheesh!

Re:!Bricked

[clickety6]

I also hate it when people call these things bricked incorrectly.

Bricked XBOXen, bricked PSPs, bricked iPhones and now bricked network cards.

People, these things are not bricked! Believe me. I've tried building houses and garden walls out of them and they are absolutely fecking useless as bricks!

Please use the correct term in future. These items are not bricked, they are just FUBI (fecked up by incompetence)

Thank you...

That's not what Bricked means!!!!oneone1

[OverlordQ]

I hate it when people keep incorrectly using brick . . . . wait, what? They used it right? Oh . . . my bad, carry on.

Kernel fix, perhaps?

[Anonymous Coward]

Kernel 2.6.27-rc7 has a changelog entry that reads:

Christopher Li (1):
            e1000: prevent corruption of EEPROM/NVM

Re:Kernel fix, perhaps?

[neonprimetime]

From: Christopher Li

Andrey reports e1000 corruption, and that a patch in vmware's ESX fixed it.

The EEPROM corruption is triggered by concurrent access of the EEPROM read/write. Putting a lock around it solve the problem.

link

Agreed, in this instance

[davidwr]

Gun and air-conditioning aside, devices should not allow accidental bricking or physical damage unless it is inherent in the function of the hardware.

For cases of loading bad firmware, the "load new firmware" instruction should have a few failsafes like magic words or what-not so it isn't accidentally invoked.

Even better, hardware devices should have a failsafe firmware burned on silicon that can be reactivated by flipping a switch, setting a jumper, or some other hardware-action-required setting. This "failsafe firmware" may be nothing more than a stub that prepares the device to accept a new "real" firmware, but at least it will allow de-bricking.

You don't really want this debrick/failsafe-mode to be triggerable through software alone, it's too much of an opportunity for malicious use.

Oh great.

[gandhi_2]

Remember when Dell told customers that installing Linux on their computers voided the warranty?

Remember how everyone on /. called bullshit?

This doesn't look good for our cause.

Re:Oh great.

[jimicus]

This doesn't look good for our cause.

It doesn't, but it does get me thinking: Given that it's possible for a badly behaved driver running in the kernel to stamp over NVRAM rendering hardware useless, how many pieces of bricked hardware have I thrown out over the years that were bricked because of a freak coincidence involving a rogue driver?

Bear in mind that many drivers in Windows run quite close to ring 0 of the kernel and they would be just as capable of causing such a problem.

What is really happening regarding this problem

[ronch]

I work on the e1000 team (including the e1000e driver) and here is what we know. A panic in another driver (believed to be the gfx driver but uncertain) which scribbles over the NIC/LOM non-volatile memory (NVM). This is only happening with the 2.6.27-rc kernels on ICHx systems. Since the NIC/LOM VNM is part of the whole BIOS image other things in the system could be effected by this driver panic as well. An update of the system BIOS will restore the NIC/LOM to be operational. We have some patches under test right now that we will be releasing later today to protect the NIC/LOM NVM. That should help narrow down who is scribbling over NVM.

Re:What is really happening regarding this problem

[Anonymous Coward]

This post was what to helpful and informative.

It doesn't belong in the comments of a Slashdot article!

Re:What is really happening regarding this problem

[k.a.f.]

I work on the e1000 team (including the e1000e driver) and here is what we know. A panic in another driver (believed to be the gfx driver but uncertain) which scribbles over the NIC/LOM non-volatile memory (NVM). This is only happening with the 2.6.27-rc kernels on ICHx systems. Since the NIC/LOM VNM is part of the whole BIOS image other things in the system could be effected by this driver panic as well. An update of the system BIOS will restore the NIC/LOM to be operational.

In other words, as usual, the device is NOT bricked.

Re:What is really happening regarding this problem

[pipatron]

This post was what to helpful and informative.

Good thing you set it straight again with a sentence that's both incomprehensible and contains a typo.

Re:What is really happening regarding this problem

[ChrisJones]

As I just pointed out elsewhere, that particular comment is not correct.
A BIOS update *may* restore the NIC, but it depends purely on the BIOS update including that information.
All of the available updates for my laptop do not include that, so the device was not recoverable. ie bricked.

Re:What is really happening regarding this problem

[T.E.D.]

I've written an E1000 driver (for a realtime program on a different OS). The issue is that once you have the base address registers for the card mapped into system memory, they are there. There's no super-special secret mechanisim devoted to writing only to the flash RAM.

Oversimplifying things a great deal (so experts out there, please don't roast me over the nitty details), every PCI device in your system presents software drivers with up to 6 "Base Address Registers" (BARs). Most PCI devices really only use one or two of those. This is (mostly) the device-driver's only window into the PCI device.

At bootup the system places the physical address of the device's control registers and memory into its BARs. When the device driver starts up later, it grabs those physical addresses and maps them into virtual memory so that software can get at them.

Once this is done, *all* the device's control registers are avialble to software. If one of these registers can command the card to write data to flash (as one of the control registers on the E1000 does), then the proper (or improper) value written to that memory location by *anyone* will cause a flash write. Its that simple.

Lesson finished

[Anonymous Coward]

What do we learn from this incident?

1. Beta is not for the common people.
2. Programmers are humans are erroneous.
3. "This program is distributed in the hope that it will be useful,
        but WITHOUT ANY WARRANTY; [...]"

I tried that, it doesn't work for long

[davidwr]

Unfortunately, due to inferior materials used in the chip's casing, exposing the device to a sufficiently strong inverse tachyon field will cause protonium breakdown which will in turn cause an endothermic reaction, which in turn will fracture the silicon along the sharp drop-offs in the resulting thermal gradient. As a side-effect of the presence of the inverse tachyons, the failure will happen in the near future rather than immediately. In other words, your device will work on the testbench but by the time you put it into production then *crack* there it goes.

Mandriva notification

[AdamWill]

This can also affect Mandriva Linux 2009 pre-releases. To be clear, the bug is in the upstream kernel itself, not in any code specific to any distribution.
It affects any 2.6.27rc kernel, whether it's in a distribution or a clean upstream build.
We have posted a full, detailed notification of the issue for Mandriva users.