On Wed, 25 Jan 2006 20:14:22 +0100
Manuel Bouyer <bouyer@antioche.eu.org> wrote:

> On Wed, Jan 25, 2006 at 05:44:44PM +0200, Mike M. Volokhov wrote:
[snip]
> > panic: kernel diagnostic assertion "((pa ^ (pa + m->m_pkthdr.len)) & PG_FRAME) == 0" failed: file "../../../../arch/xen/xen/if_xennet.c", line 1037
[snip]
> 
> Always ip_forward.

Not sure now. Todays morning I've got yet another on dom1 (one xennet,
but ip.forwarding is on):

login: panic: kernel diagnostic assertion "((pa ^ (pa + m->m_pkthdr.len)) & PG_FRAME) == 0" failed: file "../../../../arch/xen/xen/if_xennet.c", line 1037
Stopped in pid 539.1 (imapd) at netbsd:cpu_Debugger+0x4:        leave
cpu_Debugger(c08dc698,ffffffff,c09e4100,c08d4f38,c08d4f00) at netbsd:cpu_Debugger+0x4
panic(c033c780,c03097e7,c0338e80,c0338c60,40d) at netbsd:panic+0x121
__main(c03097e7,c0338c60,40d,c0338e80,cb4f7b74) at netbsd:__main
xennet_start(c0988038,cb4f7bb0,c0988038,2,400) at netbsd:xennet_start+0x55a
ether_output(c0988038,c08c0900,c08d746c,c08d839c,c08c0900) at netbsd:ether_output+0x38b
ip_output(c08c0900,0,c08d7468,400,0) at netbsd:ip_output+0x547
tcp_output(c08dfe10,c09e4b00,3,0,0) at netbsd:tcp_output+0xdbf
tcp_usrreq(c08d6948,9,c09e4b00,0,0) at netbsd:tcp_usrreq+0x2f4
sosend(c08d6948,0,cb4f7ec4,c09e4b00,0) at netbsd:sosend+0x37b
soo_write(ca3d3888,ca3d38b0,cb4f7ec4,ca3c0000,1) at netbsd:soo_write+0x22
dofilewrite(ca3c2b28,1,ca3d3888,806f800,86) at netbsd:dofilewrite+0x81
sys_write(ca3cb8c4,cb4f7f64,cb4f7f5c,0,0) at netbsd:sys_write+0x59
syscall_plain() at netbsd:syscall_plain+0x18f
--- syscall (number 4) ---
0xbd96de7b:
ds          0x11
es          0x11
fs          0x31
gs          0x11
edi         0x1
esi         0x100
ebp         0xcb4f7abc
ebx         0x1
edx         0xc041e000  emul_freebsd_object+0x9544c
ecx         0xffffffc0
eax         0x9ef
eip         0xc02ab1b0  cpu_Debugger+0x4
cs          0x9
eflags      0x202
esp         0xcb4f7abc
ss          0x11
netbsd:cpu_Debugger+0x4:        leave
Stopped in pid 539.1 (imapd) at netbsd:cpu_Debugger+0x4:        leave

> OK, can you use the attached patch instead ?
> I hope this will give us more details about why we get this strange packet.

Sure! (Because this patch is for if_xennet only, I've left xennetback
with previous patch applied, in case if it matters.) Results (on
multihomed dom2):

pa 0x616cf38 len 200 m_flags 0x2
panic: xennet_start1: buffer crosses page
Stopped at      netbsd:cpu_Debugger+0x4:        leave
cpu_Debugger(5,134e6,c03f8928,c06bdf38,c06bdf00) at netbsd:cpu_Debugger+0x4
panic(c0338f00,616cf38,c8,2,1) at netbsd:panic+0x121
xennet_start(c072f038,c03f89cc,c072f038,2,c03f8a18) at netbsd:xennet_start+0x5c4
ether_output(c072f038,c06bd100,c068c710,c06a8294,c06bd100) at netbsd:ether_output+0x38b
ip_output(c06bd100,0,c036e3f4,1,0) at netbsd:ip_output+0x547
ip_forward(c06bd100,0,c072d038,1,c072d038) at netbsd:ip_forward+0x176
ip_input(c06bd100,c02c2f26,c072d038,c06bd600,0) at netbsd:ip_input+0x29a
ipintr(fffffffe,20,4,1,c03f8e10) at netbsd:ipintr+0xad
DDB lost frame for netbsd:Xsoftnet+0x4f, trying 0xc03f8dd0
Xsoftnet() at netbsd:Xsoftnet+0x4f
--- interrupt ---
emul_freebsd_object(c03f8e4c,0,3b9a0000,ca00) at 0xc03fe000
Bad frame pointer: 0xc02ad0fc
ds          0x11
es          0x11
fs          0x31
gs          0x11
edi         0x1
esi         0x100
ebp         0xc03f8908  emul_freebsd_object+0x6fc54
ebx         0x1
edx         0xc03fe000  emul_freebsd_object+0x7534c
ecx         0xffffffc0
eax         0xa22
eip         0xc02ab1b0  cpu_Debugger+0x4
cs          0x9
eflags      0x202
esp         0xc03f8908  emul_freebsd_object+0x6fc54
ss          0x11
netbsd:cpu_Debugger+0x4:        leave
Stopped at      netbsd:cpu_Debugger+0x4:        leave

--
Mishka.