[PATCH] MIPS: Alchemy: Save the Ethernet address before reusing PROM memory

[PATCH] MIPS: Alchemy: Save the Ethernet address before reusing PROM memory

[Florian Fainelli]

Alchemy keeps pointers into the firmware environment and looks up ethaddr
when initializing the Ethernet devices. By that point, memory allocation
can have overwritten the environment, causing prom_getenv() to pass an
invalid pointer to strchr() and panic during boot.

On the MTX-1, the struct page layout change in 9ddb3c14afba reduces struct
page from 40 to 32 bytes and exposes this unreserved firmware memory.
Bisection and boot tests confirmed that the parent boots while the change
reproduces the panic.

Parse the Ethernet address during prom_init(), before registering RAM
with memblock, and keep the six bytes in kernel-owned init data. Return
the saved address during device initialization, preserving the existing
YAMON formats and command-line fallback without reserving a fixed
low-memory region.

Fixes: 9ddb3c14afba ("mm: fix struct page layout on 32-bit systems")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
 arch/mips/alchemy/common/prom.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/arch/mips/alchemy/common/prom.c b/arch/mips/alchemy/common/prom.c
index 20d30f6265cd..c4aefeb78871 100644
--- a/arch/mips/alchemy/common/prom.c
+++ b/arch/mips/alchemy/common/prom.c
@@ -46,6 +46,11 @@ int prom_argc;
 char **prom_argv;
 char **prom_envp;
 
+static char prom_ethaddr[6] __initdata;
+static bool prom_ethaddr_valid __initdata;
+
+static void __init prom_init_ethernet_addr(void);
+
 void __init prom_init_cmdline(void)
 {
 	int i;
@@ -95,6 +100,9 @@ void __init prom_init(void)
 	if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
 		memsize = SZ_64M; /* minimum memsize is 64MB RAM */
 
+	/* Save the MAC before the allocator can reuse the PROM environment. */
+	prom_init_ethernet_addr();
+
 	memblock_add(0, memsize);
 }
 
@@ -125,7 +133,7 @@ static inline void str2eaddr(unsigned char *ea, unsigned char *str)
 	}
 }
 
-int __init prom_get_ethernet_addr(char *ethernet_addr)
+static void __init prom_init_ethernet_addr(void)
 {
 	char *ethaddr_str;
 
@@ -135,12 +143,21 @@ int __init prom_get_ethernet_addr(char *ethernet_addr)
 		/* Check command line */
 		ethaddr_str = strstr(arcs_cmdline, "ethaddr=");
 		if (!ethaddr_str)
-			return -1;
+			return;
 
 		ethaddr_str += strlen("ethaddr=");
 	}
 
-	str2eaddr(ethernet_addr, ethaddr_str);
+	str2eaddr(prom_ethaddr, ethaddr_str);
+	prom_ethaddr_valid = true;
+}
+
+int __init prom_get_ethernet_addr(char *ethernet_addr)
+{
+	if (!prom_ethaddr_valid)
+		return -1;
+
+	memcpy(ethernet_addr, prom_ethaddr, sizeof(prom_ethaddr));
 
 	return 0;
 }
-- 
2.53.0

Re: [PATCH] MIPS: Alchemy: Save the Ethernet address before reusing PROM memory

[Matthew Wilcox]

On Fri, Oct 16, 2026 at 10:31:55AM -0700, Florian Fainelli wrote:
> Alchemy keeps pointers into the firmware environment and looks up ethaddr
> when initializing the Ethernet devices. By that point, memory allocation
> can have overwritten the environment, causing prom_getenv() to pass an
> invalid pointer to strchr() and panic during boot.
> 
> On the MTX-1, the struct page layout change in 9ddb3c14afba reduces struct
> page from 40 to 32 bytes and exposes this unreserved firmware memory.
> Bisection and boot tests confirmed that the parent boots while the change
> reproduces the panic.
> 
> Parse the Ethernet address during prom_init(), before registering RAM
> with memblock, and keep the six bytes in kernel-owned init data. Return
> the saved address during device initialization, preserving the existing
> YAMON formats and command-line fallback without reserving a fixed
> low-memory region.
> 
> Fixes: 9ddb3c14afba ("mm: fix struct page layout on 32-bit systems")

This is an inappropriate Fixes line.  That may have exposed the problem
(... 5 years ago; how often is this being tested?) but it's merely
restoring the layout to that which existed two years before that.
The correct Fixes line wuld be something related to this driver.

Re: [PATCH] MIPS: Alchemy: Save the Ethernet address before reusing PROM memory

[Florian Fainelli]

On 10/16/26 12:45, Matthew Wilcox wrote:
> On Fri, Oct 16, 2026 at 10:31:55AM -0700, Florian Fainelli wrote:
>> Alchemy keeps pointers into the firmware environment and looks up ethaddr
>> when initializing the Ethernet devices. By that point, memory allocation
>> can have overwritten the environment, causing prom_getenv() to pass an
>> invalid pointer to strchr() and panic during boot.
>>
>> On the MTX-1, the struct page layout change in 9ddb3c14afba reduces struct
>> page from 40 to 32 bytes and exposes this unreserved firmware memory.
>> Bisection and boot tests confirmed that the parent boots while the change
>> reproduces the panic.
>>
>> Parse the Ethernet address during prom_init(), before registering RAM
>> with memblock, and keep the six bytes in kernel-owned init data. Return
>> the saved address during device initialization, preserving the existing
>> YAMON formats and command-line fallback without reserving a fixed
>> low-memory region.
>>
>> Fixes: 9ddb3c14afba ("mm: fix struct page layout on 32-bit systems")
> 
> This is an inappropriate Fixes line.  That may have exposed the problem
> (... 5 years ago; how often is this being tested?) but it's merely
> restoring the layout to that which existed two years before that.
> The correct Fixes line wuld be something related to this driver.

Fair enough, because this landed as a the first bad commit, I used it as 
is, but you have a good point about this being a pre-existing issue that 
just became apparent with 9ddb3c14afba.

As for how often the platform was tested, not very often clearly, but 
that's about to change since I have it restored in my test rack.

Thanks
-- 
Florian