kern/40615: [5.0_BETA] lock-ups with pf in a DomU

[andreas%wrede.ca@localhost]

>Number:         40615
>Category:       kern
>Synopsis:       DomU lock-ups with pf
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 11 16:25:00 +0000 2009
>Originator:     Andreas Wrede
>Release:        NetBSD 5.0_BETA
>Organization:
        Wapanafa
>Environment:
        
        
System: NetBSD colo2.wapanafa.org 5.0_BETA NetBSD 5.0_BETA (XEN3_DOMU_WR) #26: 
Thu Jan 15 04:29:01 EST 2009 
root%wotan.wrede.pvt@localhost:/u2/netbsd-5.0/obj.amd64/sys/arch/amd64/compile/XEN3_DOMU_WR
 amd64
Architecture: x86_64
Machine: amd64
>Description:
        I am experiencing lockups of a DomU, roughly every one or two days.
The Dom0 host is a Linux box running  2.6.18-6-xen-amd64 with Xen version 3.0.3.

The DomU kernel is amd64 XEN3_DOMU, plus pf, altq, IPSEC and minus DIAGNOSTIC
and DEBUG. pf is configured and active. The root filesystem is mounted with -o
log, in case it matters. Most of the time, a destroy of the DomU and new boot
is needed, on some occasions, typing the hw.cnmagic sequence produces a trap

Fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8038d355 cs e030 rflags 202 cr2  7f7ffd2aca70 
cpl 6 rsp ffffa00046ab7
f38
Stopped in pid 0.5 (system) at  netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
xencons_tty_input() at netbsd:xencons_tty_input+0xc5
xencons_handler() at netbsd:xencons_handler+0x96
evtchn_do_event() at netbsd:evtchn_do_event+0xaa
call_evtchn_do_event() at netbsd:call_evtchn_do_event+0xd
hypervisor_callback() at netbsd:hypervisor_callback+0xa3
rtalloc1() at netbsd:rtalloc1+0xac
_rtcache_init() at netbsd:_rtcache_init+0x22
ip_output() at netbsd:ip_output+0xf5e
pf_send_tcp() at netbsd:pf_send_tcp+0x36f
pf_test_rule() at netbsd:pf_test_rule+0x1c20
pf_test() at netbsd:pf_test+0xc16
pfil4_wrapper() at netbsd:pfil4_wrapper+0x57
pfil_run_hooks() at netbsd:pfil_run_hooks+0xa0
ip_output() at netbsd:ip_output+0xc9b
tcp_output() at netbsd:tcp_output+0x157a
tcp_delack() at netbsd:tcp_delack+0x5f
callout_softclock() at netbsd:callout_softclock+0x192
softint_thread() at netbsd:softint_thread+0x66

this trap from another freeze instance:

Fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8038d355 cs e030 rflags 202 cr2  7f7ffd2aca70 
cpl 6 rsp ffffa0004938
e0e8
Stopped in pid 12873.1 (sshd) at        netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
xencons_tty_input() at netbsd:xencons_tty_input+0xc5
xencons_handler() at netbsd:xencons_handler+0x96
evtchn_do_event() at netbsd:evtchn_do_event+0xaa
call_evtchn_do_event() at netbsd:call_evtchn_do_event+0xd
hypervisor_callback() at netbsd:hypervisor_callback+0xa3
pool_cache_get_paddr() at netbsd:pool_cache_get_paddr+0x74
m_get() at netbsd:m_get+0x25
m_gethdr() at netbsd:m_gethdr+0x9
pf_send_tcp() at netbsd:pf_send_tcp+0x9c
pf_test_rule() at netbsd:pf_test_rule+0x1c20
pf_test() at netbsd:pf_test+0xc16
pfil4_wrapper() at netbsd:pfil4_wrapper+0x57
pfil_run_hooks() at netbsd:pfil_run_hooks+0xa0
ip_output() at netbsd:ip_output+0xc9b
tcp_output() at netbsd:tcp_output+0x157a
tcp_delack() at netbsd:tcp_delack+0x5f
callout_softclock() at netbsd:callout_softclock+0x192
softint_overlay() at netbsd:softint_overlay+0x286
lwp_userret() at netbsd:lwp_userret+0x1ac
syscall() at netbsd:syscall+0x119


Dmesg:

NetBSD 5.0_BETA (XEN3_DOMU_WR) #26: Thu Jan 15 04:29:01 EST 2009
        
root%wotan.wrede.pvt@localhost:/u2/netbsd-5.0/obj.amd64/sys/arch/amd64/compile/XEN3_DOMU_WR
total memory = 1536 MB
avail memory = 1476 MB
timecounter: Timecounters tick every 10.000 msec
mainbus0 (root)
hypervisor0 at mainbus0: Xen version 3.0
vcpu0 at hypervisor0: Intel 686-class, 2666MHz, id 0x10676
debug virtual interrupt using event channel 3
xenbus0 at hypervisor0: Xen Virtual Bus Interface
xencons0 at hypervisor0: Xen Virtual Console Driver
xencons0: console major 143, unit 0
xencons0: using event channel 2
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
Xen clock: using event channel 4
timecounter: Timecounter "xen_system_time" frequency 1000000000 Hz quality 10000
xenbus0: using event channel 1
IPsec: Initialized Security Association Processing.
xbd0 at xenbus0 id 1: Xen Virtual Block Device Interface
xbd0: using event channel 5
xennet0 at xenbus0 id 0: Xen Virtual Network Interface
xennet0: MAC address aa:00:94:6f:f9:df
xennet0: using event channel 6
xbd0: 81920 MB, 512 bytes/sect x 167772160 sectors
Kernelized RAIDframe activated
boot device: xbd0
root on xbd0a dumps on xbd0b
root file system type: ffs
tap0: Ethernet address f2:0b:a4:cf:cd:03

>How-To-Repeat:
        Add pf to a XEN3_DOMU kernel, configure and enable pf. Wait.
>Fix:
        Unknown

>Unformatted: