port-xen/42370: NetBSD 4.0/xen panic: bnx0: Double mbuf allocation failure!

[pettai%nordu.net@localhost]

>Number:         42370
>Category:       port-xen
>Synopsis:       NetBSD 4.0/xen panic: bnx0: Double mbuf allocation failure!
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    port-xen-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 24 10:10:00 +0000 2009
>Originator:     Fredrik Pettai
>Release:        NetBSD 4.0_RELEASE
>Organization:
NORDUnet A/S
>Environment:
NetBSD thule 4.0 NetBSD 4.0 (XEN312_DOM0) #0: Fri Jun 27 16:19:21 CEST 2008  
root@thule:/usr/src/sys/arch/i386/compile/XEN312_DOM0 i386
>Description:
We got a panic on one of our NetBSD/xen servers.
I find a case reported for NetBSD 5.0_BETA (non-xen), but that case is still 
open.
And the patch included by Dave seems to stop the panic, but makes the network 
interface "disconnected" instead.
http://mail-index.netbsd.org/netbsd-bugs/2009/01/23/msg008547.html

Console output:

panic: bnx0: Double mbuf allocation failure!
^MBegin traceback...
^Mfatal page fault in supervisor mode
^Mtrap type 6 code 0 eip c04e2f30 cs 9 eflags 10246 cr2 0 ilevel 5
^Mpanic: trap
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump 245 244 243 242 241 240 (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17
c00) from L1 entry cf883001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) mm.c:649:d0 Error getting mfn cf883 (pfn 17c00) from L1 entry cf883
001 for dom0
panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump panic: HYPERVISOR_mmu_update failed
^M
^MFaulted in mid-traceback; aborting...
^Mdumping to dev 4,1 offset 16274551
^Mdump (XEN) domain_crash_sync called from entry.S (ff16699e)
(XEN) Domain 0 (vcpu#0) crashed on cpu#2:
(XEN) ----[ Xen-3.1.2  x86_32  debug=n  Not tainted ]----
(XEN) CPU:    2
(XEN) EIP:    0009:[<c0706ad1>]
(XEN) EFLAGS: 00010206   CONTEXT: guest
(XEN) eax: c0a86060   ebx: c0a8604a   ecx: 0000000c   edx: 00000003
(XEN) esi: c0a8605a   edi: 0000021d   ebp: c0a86078   esp: c0a86000
(XEN) cr0: 8005003b   cr4: 000006d0   cr3: c0ca0000   cr2: c0a85ffc
(XEN) ds: 0011   es: 0011   fs: 0031   gs: 0011   ss: 0011   cs: 0009
(XEN) Guest stack trace from esp=c0a86000:
(XEN)    00000000 00000000 0000000f 00000000 000f4240 00000000 00008880 c0a86060
(XEN)    c0a86058 c0a86050 00000000 00000200 00000001 00000002 0000000c c051ec2f
(XEN)    c0988aa0 c0a861fc 00006088 00000000 00000000 00006c28 000f0000 00004240
(XEN)    021d0000 8880eb3c 00000000 000f4240 9e528c89 005f62d0 c0a86098 c0705a8c
(XEN)    eb3c8880 0000021d 000f4240 00000000 00000000 00000200 c0a860d8 c04f55d5
(XEN)    eb3c8880 0000021d 000f4240 00000000 00000000 00000000 00000000 00000000
(XEN)    00000000 000002c0 3ee5e000 c092a5e0 3ee5e000 000002c0 c0a86118 c0259cf4
(XEN)    000003e8 00000001 d4b90280 c0967520 c15e6600 c1246000 c0a86118 c025a353
(XEN)    c1246000 d4b90280 00000000 00000001 0000000c c1251270 c0a86168 c025bff6
(XEN)    c1251270 c0967520 010054b6 00000001 00000200 00000000 c0a86168 c0705b78
(XEN)    c1246000 c1251270 000000b6 00000000 00000000 00000004 00000000 c0967520
(XEN)    00000000 00000000 c0a861d8 c05099cd c124603c 00000000 c0967520 00000000
(XEN)    01000000 00000000 c0a861a8 01000000 eb3c8880 00000001 f0a8ee00 00000001
(XEN)    00000000 0008003f c15e7400 00000200 c15e6600 c124603c 000f4240 002a0000
(XEN)    b6540001 00010000 9e50aca2 00000001 00000001 c0a861fc c0a86408 c04e6da9
(XEN)    00000401 00f85477 00000000 c0a861fc 00000200 c12e6c00 c0509790 ca8f8604
(XEN)    000001f8 c0a85000 00000001 00a8f000 00000000 0f571000 00000000 00000000
(XEN)    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
(XEN)    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
(XEN)    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
(XEN) Domain 0 crashed: rebooting machine in 5 seconds.
>How-To-Repeat:
Enable bnx0 interface and do excessive networking I/O over NFS (and Xen).
>Fix: