On Mon, Jun 01, 2026 at 09:59:41PM +0200, Alexander Bluhm wrote:
> On Mon, Jun 01, 2026 at 06:24:38AM +0300, Vitaliy Makkoveev wrote:
> > On Mon, May 25, 2026 at 04:45:26PM +0200, [email protected] wrote:
> > > >Synopsis: <Kernel panic at shutdoen/reboot when rad is enabled>
> > > >Category:
> > > >Environment:
> > > System : OpenBSD 7.9
> > > Details : OpenBSD 7.9 (GENERIC.MP) #222: Wed May 6 18:07:56 MDT
> > > 2026
> > >
> > > [email protected]:/usr/src/sys/arch/arm64/compile/GENERIC.MP
> > >
> > > Architecture: OpenBSD.arm64
> > > Machine : arm64
> > > >Description:
> > > When rad is enabled, the system panics at shutdoen/reboot, no orderly
> > > reboot possible
> > > >How-To-Repeat:
> > > rcctl enable rad
> > > rcctl start rad
> > > shutdowen -r now
> > > ... panic
> > > ... reboot
> > > rcctl disable rad
> > > rcctl stop rad
> > > ... panic
> > > ... reboot
> > > rcctl check rad
> > > rad (failed)
> > > shutdown -r now
> > > ... ok
> > > >Fix:
> > > disable rad
> > >
> >
> > Hello,
> >
> > I have no cad(4) device and I have no ability to compile this diff, so
> > I'm sending it offlist. Does it help?
>
> In November 2025 I sent this diff, but nobody tested it.
>
> https://marc.info/?l=openbsd-bugs&m=176314127606140&w=2
>
I'm not happy with sleeping malloc under exclusive netlock. Can we do
sc_{tx,rx}buf allocation at probe time? Or even declare them as arrays
like bse(4)?
> Index: dev/fdt/if_cad.c
> ===================================================================
> RCS file: /data/mirror/openbsd/cvs/src/sys/dev/fdt/if_cad.c,v
> diff -u -p -r1.16 if_cad.c
> --- dev/fdt/if_cad.c 17 Sep 2025 09:17:12 -0000 1.16
> +++ dev/fdt/if_cad.c 3 Jan 2026 21:58:47 -0000
> @@ -589,22 +589,10 @@ cad_ioctl(struct ifnet *ifp, u_long cmd,
> {
> struct cad_softc *sc = ifp->if_softc;
> struct ifreq *ifr = (struct ifreq *)data;
> - int error = 0, netlock_held = 1;
> + int error = 0;
> int s;
>
> - switch (cmd) {
> - case SIOCGIFMEDIA:
> - case SIOCSIFMEDIA:
> - case SIOCGIFSFFPAGE:
> - netlock_held = 0;
> - break;
> - }
> -
> - if (netlock_held)
> - NET_UNLOCK();
> rw_enter_write(&sc->sc_cfg_lock);
> - if (netlock_held)
> - NET_LOCK();
> s = splnet();
>
> switch (cmd) {
> @@ -722,9 +710,6 @@ cad_up(struct cad_softc *sc)
>
> rw_assert_wrlock(&sc->sc_cfg_lock);
>
> - /* Release lock for memory allocation. */
> - NET_UNLOCK();
> -
> if (sc->sc_dma64)
> flags |= BUS_DMA_64BIT;
>
> @@ -880,8 +865,6 @@ cad_up(struct cad_softc *sc)
> }
> }
>
> - NET_LOCK();
> -
> /*
> * Set MAC address filters.
> */
> @@ -985,9 +968,6 @@ cad_down(struct cad_softc *sc)
> ifq_clr_oactive(&ifp->if_snd);
> ifp->if_timer = 0;
>
> - /* Avoid lock order issues with barriers. */
> - NET_UNLOCK();
> -
> timeout_del_barrier(&sc->sc_tick);
>
> /* Disable data transfer. */
> @@ -1011,7 +991,7 @@ cad_down(struct cad_softc *sc)
> /* Wait for activity to cease. */
> intr_barrier(sc->sc_ih);
> ifq_barrier(&ifp->if_snd);
> - taskq_del_barrier(systq, &sc->sc_statchg_task);
> + task_del(systq, &sc->sc_statchg_task);
>
> /* Disable the packet clock as it is not needed any longer. */
> clock_disable(sc->sc_node, GEM_CLK_TX);
> @@ -1059,8 +1039,6 @@ cad_down(struct cad_softc *sc)
> cad_dmamem_free(sc, sc->sc_rxring);
> sc->sc_rxring = NULL;
> sc->sc_rxdesc = NULL;
> -
> - NET_LOCK();
> }
>
> uint8_t
> @@ -1683,8 +1661,14 @@ void
> cad_statchg_task(void *arg)
> {
> struct cad_softc *sc = arg;
> + struct ifnet *ifp = &sc->sc_ac.ac_if;
>
> - clock_set_frequency(sc->sc_node, GEM_CLK_TX, sc->sc_tx_freq);
> + rw_enter_write(&sc->sc_cfg_lock);
> +
> + if ((ifp->if_flags & IFF_RUNNING))
> + clock_set_frequency(sc->sc_node, GEM_CLK_TX, sc->sc_tx_freq);
> +
> + rw_exit_write(&sc->sc_cfg_lock);
> }
>
> struct cad_dmamem *
>
