Re: kernel panic on shutdoen/reboot

On Mon, Jun 01, 2026 at 09:59:41PM +0200, Alexander Bluhm wrote:
> On Mon, Jun 01, 2026 at 06:24:38AM +0300, Vitaliy Makkoveev wrote:
> > On Mon, May 25, 2026 at 04:45:26PM +0200, [email protected] wrote:
> > > >Synopsis:	<Kernel panic at shutdoen/reboot when rad is enabled>
> > > >Category:	
> > > >Environment:
> > > 	System      : OpenBSD 7.9
> > > 	Details     : OpenBSD 7.9 (GENERIC.MP) #222: Wed May  6 18:07:56 MDT 2026
> > > 			 [email protected]:/usr/src/sys/arch/arm64/compile/GENERIC.MP
> > > 
> > > 	Architecture: OpenBSD.arm64
> > > 	Machine     : arm64
> > > >Description:
> > > 	When rad is enabled, the system panics at shutdoen/reboot, no orderly reboot possible
> > > >How-To-Repeat:
> > > 	rcctl enable rad
> > > 	rcctl start rad
> > > 	shutdowen -r now
> > > 	... panic
> > > 	... reboot
> > > 	rcctl disable rad
> > > 	rcctl stop rad
> > > 	... panic
> > > 	... reboot
> > > 	rcctl check rad
> > > 	rad (failed)
> > >         shutdown -r now
> > > 	... ok
> > > >Fix:
> > > 	disable rad
> > > 
> > 
> > Hello,
> > 
> > I have no cad(4) device and I have no ability to compile this diff, so
> > I'm sending it offlist. Does it help?
> 
> In November 2025 I sent this diff, but nobody tested it.
> 
> https://marc.info/?l=openbsd-bugs&m=176314127606140&w=2
> 

I'm not happy with sleeping malloc under exclusive netlock. Can we do
sc_{tx,rx}buf allocation at probe time? Or even declare them as arrays
like bse(4)?

> Index: dev/fdt/if_cad.c
> ===================================================================
> RCS file: /data/mirror/openbsd/cvs/src/sys/dev/fdt/if_cad.c,v
> diff -u -p -r1.16 if_cad.c
> --- dev/fdt/if_cad.c	17 Sep 2025 09:17:12 -0000	1.16
> +++ dev/fdt/if_cad.c	3 Jan 2026 21:58:47 -0000
> @@ -589,22 +589,10 @@ cad_ioctl(struct ifnet *ifp, u_long cmd,
>  {
>  	struct cad_softc *sc = ifp->if_softc;
>  	struct ifreq *ifr = (struct ifreq *)data;
> -	int error = 0, netlock_held = 1;
> +	int error = 0;
>  	int s;
>  
> -	switch (cmd) {
> -	case SIOCGIFMEDIA:
> -	case SIOCSIFMEDIA:
> -	case SIOCGIFSFFPAGE:
> -		netlock_held = 0;
> -		break;
> -	}
> -
> -	if (netlock_held)
> -		NET_UNLOCK();
>  	rw_enter_write(&sc->sc_cfg_lock);
> -	if (netlock_held)
> -		NET_LOCK();
>  	s = splnet();
>  
>  	switch (cmd) {
> @@ -722,9 +710,6 @@ cad_up(struct cad_softc *sc)
>  
>  	rw_assert_wrlock(&sc->sc_cfg_lock);
>  
> -	/* Release lock for memory allocation. */
> -	NET_UNLOCK();
> -
>  	if (sc->sc_dma64)
>  		flags |= BUS_DMA_64BIT;
>  
> @@ -880,8 +865,6 @@ cad_up(struct cad_softc *sc)
>  		}
>  	}
>  
> -	NET_LOCK();
> -
>  	/*
>  	 * Set MAC address filters.
>  	 */
> @@ -985,9 +968,6 @@ cad_down(struct cad_softc *sc)
>  	ifq_clr_oactive(&ifp->if_snd);
>  	ifp->if_timer = 0;
>  
> -	/* Avoid lock order issues with barriers. */
> -	NET_UNLOCK();
> -
>  	timeout_del_barrier(&sc->sc_tick);
>  
>  	/* Disable data transfer. */
> @@ -1011,7 +991,7 @@ cad_down(struct cad_softc *sc)
>  	/* Wait for activity to cease. */
>  	intr_barrier(sc->sc_ih);
>  	ifq_barrier(&ifp->if_snd);
> -	taskq_del_barrier(systq, &sc->sc_statchg_task);
> +	task_del(systq, &sc->sc_statchg_task);
>  
>  	/* Disable the packet clock as it is not needed any longer. */
>  	clock_disable(sc->sc_node, GEM_CLK_TX);
> @@ -1059,8 +1039,6 @@ cad_down(struct cad_softc *sc)
>  	cad_dmamem_free(sc, sc->sc_rxring);
>  	sc->sc_rxring = NULL;
>  	sc->sc_rxdesc = NULL;
> -
> -	NET_LOCK();
>  }
>  
>  uint8_t
> @@ -1683,8 +1661,14 @@ void
>  cad_statchg_task(void *arg)
>  {
>  	struct cad_softc *sc = arg;
> +	struct ifnet *ifp = &sc->sc_ac.ac_if;
>  
> -	clock_set_frequency(sc->sc_node, GEM_CLK_TX, sc->sc_tx_freq);
> +	rw_enter_write(&sc->sc_cfg_lock);
> +
> +	if ((ifp->if_flags & IFF_RUNNING))
> +		clock_set_frequency(sc->sc_node, GEM_CLK_TX, sc->sc_tx_freq);
> +
> +	rw_exit_write(&sc->sc_cfg_lock);
>  }
>  
>  struct cad_dmamem *
>