[PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[Rosen Penev]

Add it and set for gmac0, which is the only GMAC used on this board.

nvram size found from a random bootlog online.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v2: fix typo.
 .../boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
index c80ac16ad949..9ab618a097b1 100644
--- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
+++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
@@ -25,6 +25,15 @@ memory@0 {
 		      <0x88000000 0x08000000>;
 	};
 
+	nvram@1c080000 {
+		compatible = "brcm,nvram";
+		reg = <0x1c080000 0x180000>;
+
+		et0macaddr: et0macaddr {
+			#nvmem-cell-cells = <1>;
+		};
+	};
+
 	leds {
 		compatible = "gpio-leds";
 
@@ -92,3 +101,8 @@ button-wps {
 &usb3_phy {
 	status = "okay";
 };
+
+&gmac0 {
+	nvmem-cells = <&et0macaddr 0>;
+	nvmem-cell-names = "mac-address";
+};
-- 
2.55.0

Re: [PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Zero-size allocation leads to a kernel panic if NVRAM is completely empty or uninitialized.
--

commit 3e511df55083f5f3829311b665dd624ff8599e95
Author: Rosen Penev <rosenp@gmail.com>

ARM: dts: BCM5301X: AC56U: add nvram node

This commit adds the brcm,nvram node to the bcm4708-asus-rt-ac56u device tree.
It configures it for gmac0, which is the only GMAC used on this board, and sets
the size based on a bootlog.

> diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> index c80ac16ad9496..9ab618a097b1f 100644
> --- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> +++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> @@ -25,6 +25,15 @@ memory@0 {
>  		      <0x88000000 0x08000000>;
>  	};
>  
> +	nvram@1c080000 {
> +		compatible = "brcm,nvram";
> +		reg = <0x1c080000 0x180000>;
> +
> +		et0macaddr: et0macaddr {
> +			#nvmem-cell-cells = <1>;
> +		};
> +	};
> +

[Severity: High]
This isn't a bug introduced by this patch, but enabling the brcm,nvram node
exposes a potential kernel panic in the nvmem driver if the NVRAM is
completely empty or uninitialized.

In drivers/nvmem/brcm_nvram.c:brcm_nvram_copy_data(), if the flash partition
consists only of padding bytes (e.g., after an erase), the scanning loop
decrements priv->data_len to 0:

	for (priv->data_len = priv->nvmem_size;
	     priv->data_len;
	     priv->data_len--) {
		if (readb(base + priv->data_len - 1) != priv->padding_byte)
			break;
	}

This results in a zero-byte allocation:

	priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL);

If priv->data_len is 0, devm_kzalloc() returns ZERO_SIZE_PTR (0x10) rather
than NULL, so execution continues successfully to brcm_nvram_parse().

The driver then attempts to read the header:

	struct brcm_nvram_header *header = (struct brcm_nvram_header *)priv->data;
	...
	if (memcmp(header->magic, NVRAM_MAGIC, 4)) {

This dereferences ZERO_SIZE_PTR (0x10), which causes a page fault and kernel
panic on devices with erased NVRAM.

Could a check be added for priv->data_len == 0 in the nvmem driver to prevent
this unrecoverable boot failure before enabling the node in the device tree?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910001209.116465-1-rosenp@gmail.com?part=1

Re: [PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[Florian Fainelli]

On 9/9/26 17:12, Rosen Penev wrote:
> Add it and set for gmac0, which is the only GMAC used on this board.
> 
> nvram size found from a random bootlog online.
> 
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>   v2: fix typo.
>   .../boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts    | 14 ++++++++++++++
>   1 file changed, 14 insertions(+)
> 
> diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> index c80ac16ad949..9ab618a097b1 100644
> --- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> +++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> @@ -25,6 +25,15 @@ memory@0 {
>   		      <0x88000000 0x08000000>;
>   	};
>   
> +	nvram@1c080000 {
> +		compatible = "brcm,nvram";
> +		reg = <0x1c080000 0x180000>;

Why is not the nvram node moved to bcm5301x.dtsi given it is common to 
all of the chips?
--
Florian

Re: [PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[Rosen Penev]

On Thu, Sep 10, 2026 at 9:46 AM Florian Fainelli
<florian.fainelli@broadcom.com> wrote:
>
> On 9/9/26 17:12, Rosen Penev wrote:
> > Add it and set for gmac0, which is the only GMAC used on this board.
> >
> > nvram size found from a random bootlog online.
> >
> > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > ---
> >   v2: fix typo.
> >   .../boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts    | 14 ++++++++++++++
> >   1 file changed, 14 insertions(+)
> >
> > diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> > index c80ac16ad949..9ab618a097b1 100644
> > --- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> > +++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> > @@ -25,6 +25,15 @@ memory@0 {
> >                     <0x88000000 0x08000000>;
> >       };
> >
> > +     nvram@1c080000 {
> > +             compatible = "brcm,nvram";
> > +             reg = <0x1c080000 0x180000>;
>
> Why is not the nvram node moved to bcm5301x.dtsi given it is common to
> all of the chips?
To avoid probe errors on hardware where sizes are unknown.
> --
> Florian

Re: [PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[Rosen Penev]

On Thu, Sep 10, 2026 at 11:56 AM Rosen Penev <rosenp@gmail.com> wrote:
>
> On Thu, Sep 10, 2026 at 9:46 AM Florian Fainelli
> <florian.fainelli@broadcom.com> wrote:
> >
> > On 9/9/26 17:12, Rosen Penev wrote:
> > > Add it and set for gmac0, which is the only GMAC used on this board.
> > >
> > > nvram size found from a random bootlog online.
> > >
> > > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > > ---
> > >   v2: fix typo.
> > >   .../boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts    | 14 ++++++++++++++
> > >   1 file changed, 14 insertions(+)
> > >
> > > diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> > > index c80ac16ad949..9ab618a097b1 100644
> > > --- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> > > +++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> > > @@ -25,6 +25,15 @@ memory@0 {
> > >                     <0x88000000 0x08000000>;
> > >       };
> > >
> > > +     nvram@1c080000 {
> > > +             compatible = "brcm,nvram";
> > > +             reg = <0x1c080000 0x180000>;
> >
> > Why is not the nvram node moved to bcm5301x.dtsi given it is common to
> > all of the chips?
> To avoid probe errors on hardware where sizes are unknown.
I looked at this again. It makes no sense to centralize:

+       nvram@1c080000 {
+               compatible = "brcm,nvram";
+               reg = <0x1c080000 0x180000>;

The reg and @ values are correct here but not for all devices. There's
also nvram@1e3f0000 and nvram@1e1f0000 as examples.
> > --
> > Florian

[PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[Rosen Penev]

Add it and set MAC for gmac2, to avoid having to handle in userspaace.

nvram size found from a random bootlog online.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v2: set gmac2 MAC instead.
 .../boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
index c80ac16ad949..708599f8c4be 100644
--- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
+++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
@@ -25,6 +25,15 @@ memory@0 {
 		      <0x88000000 0x08000000>;
 	};
 
+	nvram@1c080000 {
+		compatible = "brcm,nvram";
+		reg = <0x1c080000 0x180000>;
+
+		et0macaddr: et0macaddr {
+			#nvmem-cell-cells = <1>;
+		};
+	};
+
 	leds {
 		compatible = "gpio-leds";
 
@@ -92,3 +101,8 @@ button-wps {
 &usb3_phy {
 	status = "okay";
 };
+
+&gmac2 {
+	nvmem-cells = <&et0macaddr 0>;
+	nvmem-cell-names = "mac-address";
+};
-- 
2.55.0