Xen networking problems in -current with xn driver?

[Roger Pau Monné]

On Wed, Aug 03, 2016 at 10:20:19AM +0200, Roger Pau Monné wrote:
> On Wed, Aug 03, 2016 at 02:12:33AM +0800, Julian Elischer wrote:
> > I upgraded my VPS machine to today's current, and on reboot I couldn't get
> > into it by network.
> > 
> > A quick switch to the VNC console showed that it was up but that it couldn't
> > get out.
> > 
> > 
> > The xn interfaces said they were UP but attempts to get out were met with
> > "network is down".
> > 
> > if I did 'tcpdump -n -i xn0' (and xn1) hten all was fine again.
> > 
> > tcpdump saw packets, and in fact ipfw saw some packets coming in even before
> > that but it was not possible to send.
> > 
> > 
> > Has anyone seen similar?
> 
> Hello,
> 
> I've tested current less than one week ago and didn't find any issues, I'm 
> currently updating to see if it's something that has been introduced in the 
> last few days. There have also been reports of it working fine on the
> freebsd-xen mailing list, but I guess there's something different with your 
> setup:
> 
> https://lists.freebsd.org/pipermail/freebsd-xen/2016-July/002779.html
> 
> > some relevant parts of the dmesg output.:
> > 
> > 
> > T(vga): text 80x25
> > XEN: Hypervisor version 3.4 detected.
> > CPU: Intel(R) Xeon(R) CPU           E5620  @ 2.40GHz (2400.05-MHz 686-class
> > CPU)
> >   Origin="GenuineIntel"  Id=0x206c2  Family=0x6  Model=0x2c Stepping=2
> > Features=0x1781fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,MMX,FXSR,SSE,SSE2,HTT>
> > Features2=0x80982201<SSE3,SSSE3,CX16,SSE4.1,SSE4.2,POPCNT,HV>
> >   AMD Features=0x20100000<NX,LM>
> >   AMD Features2=0x1<LAHF>
> > Hypervisor: Origin = "XenVMMXenVMM"
> > real memory  = 536870912 (512 MB)
> > avail memory = 503783424 (480 MB)
> > Event timer "LAPIC" quality 400
> > ACPI APIC Table: <Xen HVM>
> > WARNING: L1 data cache covers less APIC IDs than a core
> > 0 < 1
> > WARNING: L2 data cache covers less APIC IDs than a core
> > 0 < 1
> > WARNING: L3 data cache covers less APIC IDs than a core
> > 0 < 1
> > 
> > ipfw2 (+ipv6) initialized, divert loadable, nat enabled, default to deny,
> 
> You seem to be using ipfw, I guess you have firewall_enable="YES" on you 
> rc.conf, are you also using IPv6? Anything else net related on your rc.conf?

FWIW, I've added:

firewall_enable="YES"
firewall_type="open"

To my rc.conf and I'm still not able to reproduce, this is all with IPv4.

Roger.