Transfering files larger than some size (presumably 2MB) via SSH with FreeBSD XEN para-virt domU stall after transfering 2112kb of data, when domU is source of transfer. SSH transfers with the domU as target work properly. Fix: As reported by "Anne Marcel Roorda" on freebsd-xen disable TCP Segmentation offloading solves the problem. template-8_CURRENT# ifconfig xn0 -tso template-8_CURRENT# scp /boot/kernel/kernel dante@10.30.1.15:/tmp kernel 100% 4510KB 4.4MB/s 00:00 template-8_CURRENT# How-To-Repeat: 1) Enable TSO for xn0 2) transfer data (e.g. kernel file) template-8_CURRENT# ifconfig xn0 tso template-8_CURRENT# scp /boot/kernel/kernel dante@10.30.1.15:/tmp Password: kernel 46% 2112KB 1.4MB/s - stalled -^CKilled by signal 2. template-8_CURRENT#
Responsible Changed From-To: freebsd-bugs->freebsd-xen Over to maintainer(s).
This bug should have been fixed by SVN r208901 in June 2010 (merged to stable/8 as r209061). Are you still seeing this with a recent tree? -- Colin Percival Security Officer, FreeBSD | freebsd.org | The power to serve Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid
State Changed From-To: open->feedback Bug is probably fixed, place into state feedback in case the submitter can still reproduce.
This wasn't fixed, see Bug #192013 and Bug #154428. I'm having this exact issue on EC2 10.1-GENERIC. Even with an empty pf.conf just enabling pf kills performance outbound and causes massive hangs.
This bug is not about TSO + PF, just about TSO, which seems to work fine now (when not used in conjunction with PF).
(In reply to Roger Pau Monné from comment #5) > This bug is not about TSO + PF, just about TSO, which seems to work fine now > (when not used in conjunction with PF). Ah. Sounds suspicious though. If PF is using TSO wrong why is it only causing problems with the Xen interface and not all?
PF is inserting bogus TCP checksums into TSO segments. Some interfaces say "gee, some idiot didn't read the spec" and ignore the checksums, while other interfaces say "hey, this is not a TSO packet" and drop it. The Xen network (at least as implemented in EC2) falls into the second category.