NetBSD Problem Report #60592
From www@netbsd.org Fri Aug 14 21:48:27 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits)
client-signature RSA-PSS (2048 bits))
(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 7C0DA1A923B
for <gnats-bugs@gnats.NetBSD.org>; Fri, 14 Aug 2026 21:48:27 +0000 (UTC)
Message-Id: <20260814214826.662FD1A923C@mollari.NetBSD.org>
Date: Fri, 14 Aug 2026 21:48:26 +0000 (UTC)
From: joe@ns1.eloisystems.com
Reply-To: joe@ns1.eloisystems.com
To: gnats-bugs@NetBSD.org
Subject: random Mac address generation in genet Ethernet driver causes problems
X-Send-Pr-Version: www-1.0
X-From4GNATS: "joe@ns1.eloisystems.com via gnats" <gnats-admin@NetBSD.org>
>Number: 60592
>Category: kern
>Synopsis: random Mac address generation in genet Ethernet driver causes problems
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Aug 14 21:50:04 +0000 2026
>Last-Modified: Thu Aug 27 17:05:01 +0000 2026
>Originator: Emmanuel
>Release: NetBSD 11
>Organization:
NetBSD
>Environment:
arm aarch64
>Description:
https://mail-index.netbsd.org/port-arm/2026/07/26/msg009640.html
when generating random Mac addresses, our unicast bit is supposed to set to 0 and
locally administered bit to 1. but the extraction code shifts the unicast and administered bits away
so this causes problems sometimes on machines using the genet ethernet card.
>How-To-Repeat:
connect your genet network interface to any network.
>Fix:
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/bcmgenet.c,v
retrieving revision 1.23
diff -u -r1.23 bcmgenet.c
--- sys/dev/ic/bcmgenet.c 4 Oct 2025 04:44:20 -0000 1.23
+++ sys/dev/ic/bcmgenet.c 14 Aug 2026 21:44:19 -0000
@@ -974,11 +974,11 @@
if (maclo == 0 && machi == 0) {
/* Create one */
- maclo = 0x00f2 | (cprng_strong32() & 0xffff0000);
+ maclo = cprng_strong32() & 0x0000ffff;
machi = cprng_strong32() & 0xffff;
}
- eaddr[0] = (maclo >> 24) & 0xff;
+ eaddr[0] = (maclo >> 24) | 0xf2;
eaddr[1] = (maclo >> 16) & 0xff;
eaddr[2] = (maclo >> 8) & 0xff;
eaddr[3] = (maclo >> 0) & 0xff;
This preserves the intent to zero out second byte and have a 0xf2 in first byte and randomize third and fourth byte in the Mac address generated.
>Audit-Trail:
From: Robert Elz <kre@munnari.OZ.AU>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60592: random Mac address generation in genet Ethernet driver causes problems
Date: Sat, 15 Aug 2026 05:57:54 +0700
Date: Fri, 14 Aug 2026 21:50:04 +0000 (UTC)
From: "joe@ns1.eloisystems.com via gnats" <gnats-admin@NetBSD.org>
Message-ID: <20260814215004.EF6ED1A923F@mollari.NetBSD.org>
| if (maclo == 0 && machi == 0) {
| /* Create one */
| - maclo = 0x00f2 | (cprng_strong32() & 0xffff0000);
| + maclo = cprng_strong32() & 0x0000ffff;
| machi = cprng_strong32() & 0xffff;
| }
|
| - eaddr[0] = (maclo >> 24) & 0xff;
| + eaddr[0] = (maclo >> 24) | 0xf2;
| eaddr[1] = (maclo >> 16) & 0xff;
| eaddr[2] = (maclo >> 8) & 0xff;
| eaddr[3] = (maclo >> 0) & 0xff;
|
|
| This preserves the intent to zero out second byte and have a 0xf2
| in first byte and randomize third and fourth byte in the Mac address
| generated.
I suspect that the correct fix (which is not that) would be to change the
">>" values to be (in order) 0 8 16 24 for the 4 addr bytes, so "maclo" is
treated as a little endian value, which it was clearly intended to be.
Just that (not altering the init of maclo if it wasn't set) should be all
that is required. If it is desired to allow maclo to be a big endian
value when passed in rather than generated, an
else
maclo = htonl(maclo);
can be added to the "if" there. The code should respect what is given
to it, when it isn't all 0, however, not force "f2" anywhere, or 0 anywhere,
that would be up to wherever the passed in maclo/machi values come from
to assign as desired.
The code as proposed also doesn't clear the multicast bit, which it
claims it should (but only when it is passed in set, in which case
it shouldn't - though that would be strange indeed).
kre
From: "David H. Gutteridge" <david@gutteridge.ca>
To: Gnats Bugs <gnats-bugs@netbsd.org>
Cc:
Subject: Re: kern/60592: random Mac address generation in genet Ethernet
driver causes problems
Date: Fri, 14 Aug 2026 21:21:20 -0400
Just adding to/seconding what kre@ already noted, there was a recent
thread on port-arm about this as well, e.g.:
https://mail-index.netbsd.org/port-arm/2026/07/29/msg009642.html
I infer this is only exposed with certain firmware versions and the
offending bit randomly may or may not be then set, so that's probably
why it hasn't been addressed. (I don't have this hardware.)
Dave
From: joe@ns1.eloisystems
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60592: random Mac address generation in genet Ethernet
driver causes problems
Date: Sat, 15 Aug 2026 06:27:55 +0000
On Fri, Aug 14, 2026 at 11:00:02PM +0000, Robert Elz via gnats wrote:
> The following reply was made to PR kern/60592; it has been noted by GNATS.
>
> From: Robert Elz <kre@munnari.OZ.AU>
> To: gnats-bugs@netbsd.org
> Cc:
> Subject: Re: kern/60592: random Mac address generation in genet Ethernet driver causes problems
> Date: Sat, 15 Aug 2026 05:57:54 +0700
>
> Date: Fri, 14 Aug 2026 21:50:04 +0000 (UTC)
> From: "joe@ns1.eloisystems.com via gnats" <gnats-admin@NetBSD.org>
> Message-ID: <20260814215004.EF6ED1A923F@mollari.NetBSD.org>
>
>
> | if (maclo == 0 && machi == 0) {
> | /* Create one */
> | - maclo = 0x00f2 | (cprng_strong32() & 0xffff0000);
> | + maclo = cprng_strong32() & 0x0000ffff;
> | machi = cprng_strong32() & 0xffff;
> | }
> |
> | - eaddr[0] = (maclo >> 24) & 0xff;
> | + eaddr[0] = (maclo >> 24) | 0xf2;
> | eaddr[1] = (maclo >> 16) & 0xff;
> | eaddr[2] = (maclo >> 8) & 0xff;
> | eaddr[3] = (maclo >> 0) & 0xff;
> |
> |
> | This preserves the intent to zero out second byte and have a 0xf2
> | in first byte and randomize third and fourth byte in the Mac address
> | generated.
>
> I suspect that the correct fix (which is not that) would be to change the
> ">>" values to be (in order) 0 8 16 24 for the 4 addr bytes, so "maclo" is
> treated as a little endian value, which it was clearly intended to be.
>
> Just that (not altering the init of maclo if it wasn't set) should be all
> that is required. If it is desired to allow maclo to be a big endian
> value when passed in rather than generated, an
> else
> maclo = htonl(maclo);
>
> can be added to the "if" there. The code should respect what is given
> to it, when it isn't all 0, however, not force "f2" anywhere, or 0 anywhere,
> that would be up to wherever the passed in maclo/machi values come from
> to assign as desired.
>
> The code as proposed also doesn't clear the multicast bit, which it
> claims it should (but only when it is passed in set, in which case
> it shouldn't - though that would be strange indeed).
the proposed code clears it actually because that part is zeroed
even before the bit shift starts. in cprng_strong32() & 0x0000ffff.
yes you are right, consideration is needed for the the read tried by the driver
to set the MAC address. we need to only try inserting 0xf2 only when
it is in the random block else others gets affected.
this is what we have and being tested. will commit this if
everything looks good.
Index: sys/dev/ic/bcmgenet.c
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/bcmgenet.c,v
retrieving revision 1.23
diff -u -r1.23 bcmgenet.c
--- sys/dev/ic/bcmgenet.c 4 Oct 2025 04:44:20 -0000 1.23
+++ sys/dev/ic/bcmgenet.c 15 Aug 2026 06:13:21 -0000
@@ -977,11 +977,13 @@
maclo = 0x00f2 | (cprng_strong32() & 0xffff0000);
machi = cprng_strong32() & 0xffff;
}
+ else
+ maclo = htonl(maclo);
- eaddr[0] = (maclo >> 24) & 0xff;
- eaddr[1] = (maclo >> 16) & 0xff;
- eaddr[2] = (maclo >> 8) & 0xff;
- eaddr[3] = (maclo >> 0) & 0xff;
+ eaddr[0] = (maclo >> 0) | 0xff;
+ eaddr[1] = (maclo >> 8) & 0xff;
+ eaddr[2] = (maclo >> 16) & 0xff;
+ eaddr[3] = (maclo >> 24) & 0xff;
eaddr[4] = (machi >> 8) & 0xff;
eaddr[5] = (machi >> 0) & 0xff;
}
Emmanuel
From: joe@ns1.eloisystems
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60592: random Mac address generation in genet Ethernet
driver causes problems
Date: Sat, 15 Aug 2026 06:46:51 +0000
> Index: sys/dev/ic/bcmgenet.c
> ===================================================================
> RCS file: /cvsroot/src/sys/dev/ic/bcmgenet.c,v
> retrieving revision 1.23
> diff -u -r1.23 bcmgenet.c
> --- sys/dev/ic/bcmgenet.c 4 Oct 2025 04:44:20 -0000 1.23
> +++ sys/dev/ic/bcmgenet.c 15 Aug 2026 06:13:21 -0000
> @@ -977,11 +977,13 @@
> maclo = 0x00f2 | (cprng_strong32() & 0xffff0000);
> machi = cprng_strong32() & 0xffff;
> }
> + else
> + maclo = htonl(maclo);
>
> - eaddr[0] = (maclo >> 24) & 0xff;
> - eaddr[1] = (maclo >> 16) & 0xff;
> - eaddr[2] = (maclo >> 8) & 0xff;
> - eaddr[3] = (maclo >> 0) & 0xff;
> + eaddr[0] = (maclo >> 0) | 0xff;
> + eaddr[1] = (maclo >> 8) & 0xff;
> + eaddr[2] = (maclo >> 16) & 0xff;
> + eaddr[3] = (maclo >> 24) & 0xff;
> eaddr[4] = (machi >> 8) & 0xff;
> eaddr[5] = (machi >> 0) & 0xff;
> }
>
> Emmanuel
>
ndex: sys/dev/ic/bcmgenet.c
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/bcmgenet.c,v
retrieving revision 1.23
diff -u -r1.23 bcmgenet.c
--- sys/dev/ic/bcmgenet.c 4 Oct 2025 04:44:20 -0000 1.23
+++ sys/dev/ic/bcmgenet.c 15 Aug 2026 06:43:30 -0000
@@ -977,11 +977,13 @@
maclo = 0x00f2 | (cprng_strong32() & 0xffff0000);
machi = cprng_strong32() & 0xffff;
}
+ else
+ maclo = htonl(maclo);
- eaddr[0] = (maclo >> 24) & 0xff;
- eaddr[1] = (maclo >> 16) & 0xff;
- eaddr[2] = (maclo >> 8) & 0xff;
- eaddr[3] = (maclo >> 0) & 0xff;
+ eaddr[0] = (maclo >> 0) & 0xff;
+ eaddr[1] = (maclo >> 8) & 0xff;
+ eaddr[2] = (maclo >> 16) & 0xff;
+ eaddr[3] = (maclo >> 24) & 0xff;
eaddr[4] = (machi >> 8) & 0xff;
eaddr[5] = (machi >> 0) & 0xff;
sorry typo. & 0xff not | 0xff
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/60592: random Mac address generation in genet Ethernet driver causes problems
Date: Sat, 15 Aug 2026 19:14:49 -0000 (UTC)
gnats-admin@NetBSD.org ("David H. Gutteridge via gnats") writes:
> I infer this is only exposed with certain firmware versions and the
> offending bit randomly may or may not be then set, so that's probably
> why it hasn't been addressed. (I don't have this hardware.)
An RPI has a well defined MAC address even for genet. It's just that
the loaded UEFI firmware doesn't care.
N.B. the f2:00 "prefix" either needs to be set in the upper bytes
or both places dealing with the mac address need to be adjusted
to swap bytes.
From: "Emmanuel" <joe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60592 CVS commit: src/sys/dev/ic
Date: Mon, 17 Aug 2026 15:58:43 +0000
Module Name: src
Committed By: joe
Date: Mon Aug 17 15:58:43 UTC 2026
Modified Files:
src/sys/dev/ic: bcmgenet.c
Log Message:
PR kern/60592
properly move bits to ensure unicast bit and locally administered
bits were rightly set.
needs pullup to 11 and 10
To generate a diff of this commit:
cvs rdiff -u -r1.24 -r1.25 src/sys/dev/ic/bcmgenet.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60592 CVS commit: [netbsd-11] src/sys/dev/ic
Date: Thu, 27 Aug 2026 16:59:58 +0000
Module Name: src
Committed By: martin
Date: Thu Aug 27 16:59:58 UTC 2026
Modified Files:
src/sys/dev/ic [netbsd-11]: bcmgenet.c
Log Message:
Pull up following revision(s) (requested by joe in ticket #443):
sys/dev/ic/bcmgenet.c: revision 1.25
PR kern/60592
properly move bits to ensure unicast bit and locally administered
bits were rightly set.
To generate a diff of this commit:
cvs rdiff -u -r1.22 -r1.22.2.1 src/sys/dev/ic/bcmgenet.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home