AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/10/27 03:30	flow	patch-triage	3m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The patch modifies Broadcom BCMA bus driver logic and Broadcom BCM47xx SPROM firmware parsing for Broadcom PCIe chips (such as BCM4360 and BCM4352). These drivers require physical Broadcom PCIe hardware or Broadcom SoCs, neither of which is emulated in standard QEMU or GCE virtualized environments. As the code is structurally unreachable in fuzzing environments, fuzzing is not warranted.", "WorthFuzzing": false }
1/1	2026/10/27 03:30	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 9aba30bb33a26a4a5890110b6787c43378dbac12\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Oct 27 03:30:21 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/bcma/core.c b/drivers/bcma/core.c\nindex 37a5ffe673d5da..f4246689ea0003 100644\n--- a/drivers/bcma/core.c\n+++ b/drivers/bcma/core.c\n@@ -100,7 +100,7 @@ void bcma_core_set_clockmode(struct bcma_device core,\n \t\t\tbcma_err(core-\u003ebus, \"HT force timeout\\n\");\n \t\tbreak;\n \tcase BCMA_CLKMODE_DYNAMIC:\n-\t\tbcma_set32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT);\n+\t\tbcma_mask32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT);\n \t\tbreak;\n \t}\n }\ndiff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c\nindex fd91a39f02c739..f5e1b541545f1b 100644\n--- a/drivers/bcma/driver_chipcommon.c\n+++ b/drivers/bcma/driver_chipcommon.c\n@@ -227,6 +227,9 @@ void bcma_core_chipcommon_init(struct bcma_drv_cc cc)\n \t\t\t((leddc_on \u003c\u003c BCMA_CC_GPIOTIMER_ONTIME_SHIFT) \|\n \t\t\t (leddc_off \u003c\u003c BCMA_CC_GPIOTIMER_OFFTIME_SHIFT)));\n \t}\n+\n+\tif (cc-\u003ecore-\u003eid.rev \u003e= 21)\n+\t\tbcma_cc_set32(cc, BCMA_CC_CORECTL, BCMA_CC_CORECTL_ASYNCGPIO);\n \tcc-\u003eticks_per_ms = bcma_chipco_watchdog_ticks_per_ms(cc);\n \n \tcc-\u003esetup_done = true;\ndiff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c\nindex 263ef6fa1d0f7d..ab2b2701d04895 100644\n--- a/drivers/bcma/driver_chipcommon_pmu.c\n+++ b/drivers/bcma/driver_chipcommon_pmu.c\n@@ -145,6 +145,39 @@ static void bcma_pmu2_pll_init0(struct bcma_drv_cc cc, u32 xtalfreq)\n \t/ TODO: Do we need to update OTP? /\n }\n \n+static void bcma_pmu_4360_pll_init(struct bcma_drv_cc cc)\n+{\n+\tstruct bcma_bus bus = cc-\u003ecore-\u003ebus;\n+\n+\tif (bus-\u003echipinfo.rev != 3)\n+\t\treturn;\n+\tif (bus-\u003echipinfo.id == BCMA_CHIP_ID_BCM4360 \u0026\u0026\n+\t cc-\u003estatus \u0026 BCMA_CC_CHIPST_4360_MODE_USB)\n+\t\treturn;\n+\n+\t/ Fractional VCO, 960.0098 MHz from a 40 MHz crystal. /\n+\tbcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL2, 0x0c31);\n+\tbcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL3, 0x100e);\n+\tbcma_pmu_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);\n+}\n+\n+/ Returns the max resource mask to program, 0 to leave it alone. /\n+static u32 bcma_pmu_4360_resources_init(struct bcma_drv_cc cc)\n+{\n+\tif (cc-\u003ecore-\u003ebus-\u003echipinfo.rev != 3)\n+\t\treturn 0;\n+\n+\tbcma_pmu_write32(cc, BCMA_CC_PMU_RES_TABSEL, 6);\n+\tbcma_pmu_write32(cc, BCMA_CC_PMU_RES_UPDNTM, 0x00200001);\n+\n+\tif (cc-\u003estatus \u0026 BCMA_CC_CHIPST_4360_RSRC_INIT_MODE0)\n+\t\treturn 0;\n+\tbcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL6, 0x09048562);\n+\tbcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL14, 0x09048562);\n+\tbcma_pmu_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);\n+\treturn 0x1ff;\n+}\n+\n static void bcma_pmu_pll_init(struct bcma_drv_cc cc)\n {\n \tstruct bcma_bus bus = cc-\u003ecore-\u003ebus;\n@@ -156,6 +189,10 @@ static void bcma_pmu_pll_init(struct bcma_drv_cc cc)\n \t\t\txtalfreq = 20000;\n \t\tbcma_pmu2_pll_init0(cc, xtalfreq);\n \t\tbreak;\n+\tcase BCMA_CHIP_ID_BCM4352:\n+\tcase BCMA_CHIP_ID_BCM4360:\n+\t\tbcma_pmu_4360_pll_init(cc);\n+\t\tbreak;\n \t}\n }\n \n@@ -188,6 +225,10 @@ static void bcma_pmu_resources_init(struct bcma_drv_cc cc)\n \t\t\t BCMA_RES_4314_WL_CORE_READY;\n \t\tmax_msk = 0x3FFFFFFF;\n \t\tbreak;\n+\tcase BCMA_CHIP_ID_BCM4352:\n+\tcase BCMA_CHIP_ID_BCM4360:\n+\t\tmax_msk = bcma_pmu_4360_resources_init(cc);\n+\t\tbreak;\n \tdefault:\n \t\tbcma_debug(bus, \"PMU resource config unknown or not needed for device 0x%04X\\n\",\n \t\t\t bus-\u003echipinfo.id);\ndiff --git a/drivers/bcma/driver_pcie2.c b/drivers/bcma/driver_pcie2.c\nindex cf889fc62ac7fd..fd8fab98218f63 100644\n--- a/drivers/bcma/driver_pcie2.c\n+++ b/drivers/bcma/driver_pcie2.c\n@@ -170,6 +170,9 @@ void bcma_core_pcie2_init(struct bcma_drv_pcie2 pcie2)\n \tcase BCMA_CHIP_ID_BCM4360:\n \tcase BCMA_CHIP_ID_BCM4352:\n \t\tpcie2-\u003ereqsize = 1024;\n+\t\tif (ci-\u003erev == 3)\n+\t\t\tpcie2_set32(pcie2, BCMA_CLKCTLST,\n+\t\t\t\t BCMA_CLKCTLST_HAVEHTREQ);\n \t\tbreak;\n \tdefault:\n \t\tpcie2-\u003ereqsize = 128;\ndiff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c\nindex 3dc2985063f1e5..f6cf722a37988e 100644\n--- a/drivers/bcma/host_pci.c\n+++ b/drivers/bcma/host_pci.c\n@@ -298,6 +298,7 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {\n \t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },\n \t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },\n \t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43b1) },\n+\t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43b3) },\n \t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },\n \t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },\t/ 0xa8db, BCM43217 (sic!) /\n \t{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43228) },\t/ 0xa8dc /\ndiff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c\nindex e668ad7963fc25..ac76225127c8c1 100644\n--- a/drivers/bcma/sprom.c\n+++ b/drivers/bcma/sprom.c\n@@ -11,6 +11,7 @@\n \n #include \u003clinux/bcma/bcma.h\u003e\n #include \u003clinux/bcma/bcma_regs.h\u003e\n+#include \u003clinux/bcm47xx_sprom.h\u003e\n #include \u003clinux/pci.h\u003e\n #include \u003clinux/io.h\u003e\n #include \u003clinux/dma-mapping.h\u003e\n@@ -474,6 +475,202 @@ static void bcma_sprom_extract_r8(struct bcma_bus bus, const u16 sprom)\n \t SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);\n }\n \n+static void bcma_sprom_unpack_rxgains(struct ssb_sprom_rxgains out,\n+\t\t\t\t int chain, u8 packed)\n+{\n+\tout-\u003etrelnabyp[chain] = (packed \u003e\u003e 7) \u0026 0x01;\n+\tout-\u003etriso[chain] = (packed \u003e\u003e 3) \u0026 0x0f;\n+\tout-\u003eelnagain[chain] = packed \u0026 0x07;\n+}\n+\n+static void bcma_sprom_extract_r11(struct bcma_bus bus, const u16 sprom)\n+{\n+\tstatic const u16 pwr_info_offset[] = {\n+\t\tSSB_SPROM11_PWR_INFO_CORE0,\n+\t\tSSB_SPROM11_PWR_INFO_CORE1,\n+\t\tSSB_SPROM11_PWR_INFO_CORE2,\n+\t};\n+\tu16 v;\n+\tint i, j;\n+\n+\tBUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) \u003e\n+\t\t ARRAY_SIZE(bus-\u003esprom.core_pwr_info));\n+\n+\t/* Header: rev-11 offsets, rev-8 masks/shifts. /\n+\tfor (i = 0; i \u003c 3; i++) {\n+\t\tv = sprom[SPOFF(SSB_SPROM11_IL0MAC) + i];\n+\t\t(((__be16 )bus-\u003esprom.il0mac) + i) = cpu_to_be16(v);\n+\t}\n+\n+\tSPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);\n+\tSPEX(board_type, SSB_SPROM1_SPID, ~0, 0);\n+\tSPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);\n+\tSPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);\n+\tSPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);\n+\tSPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);\n+\tSPEX32(boardflags3, SSB_SPROM11_BFL3, ~0, 0);\n+\n+\tSPEX(country_code, SSB_SPROM11_CCODE, ~0, 0);\n+\tSPEX(gpio0, SSB_SPROM11_GPIOA, SSB_SPROM8_GPIOA_P0, 0);\n+\tSPEX(gpio1, SSB_SPROM11_GPIOA, SSB_SPROM8_GPIOA_P1,\n+\t SSB_SPROM8_GPIOA_P1_SHIFT);\n+\tSPEX(gpio2, SSB_SPROM11_GPIOB, SSB_SPROM8_GPIOB_P2, 0);\n+\tSPEX(gpio3, SSB_SPROM11_GPIOB, SSB_SPROM8_GPIOB_P3,\n+\t SSB_SPROM8_GPIOB_P3_SHIFT);\n+\tSPEX(ant_available_a, SSB_SPROM11_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,\n+\t SSB_SPROM8_ANTAVAIL_A_SHIFT);\n+\tSPEX(ant_available_bg, SSB_SPROM11_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,\n+\t SSB_SPROM8_ANTAVAIL_BG_SHIFT);\n+\tSPEX(txchain, SSB_SPROM11_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,\n+\t SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);\n+\tSPEX(rxchain, SSB_SPROM11_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,\n+\t SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);\n+\tSPEX(antswitch, SSB_SPROM11_TXRXC, SSB_SPROM8_TXRXC_SWITCH,\n+\t SSB_SPROM8_TXRXC_SWITCH_SHIFT);\n+\tSPEX(subband5gver, SSB_SPROM11_SUBBAND5GVER, 0x00ff, 0);\n+\n+\tSPEX(tssiposslope2g, SSB_SPROM11_FEM_CFG1,\n+\t SSB_SPROM11_FEM_TSSIPOSSLOPE, 0);\n+\tSPEX(epagain2g, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_EPAGAIN,\n+\t SSB_SPROM11_FEM_EPAGAIN_SHIFT);\n+\tSPEX(pdgain2g, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_PDGAIN,\n+\t SSB_SPROM11_FEM_PDGAIN_SHIFT);\n+\tSPEX(tworangetssi2g, SSB_SPROM11_FEM_CFG1,\n+\t SSB_SPROM11_FEM_TWORANGETSSI, SSB_SPROM11_FEM_TWORANGETSSI_SHIFT);\n+\tSPEX(papdcap2g, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_PAPDCAP,\n+\t SSB_SPROM11_FEM_PAPDCAP_SHIFT);\n+\tSPEX(femctrl, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_CTRL,\n+\t SSB_SPROM11_FEM_CTRL_SHIFT);\n+\tSPEX(tssiposslope5g, SSB_SPROM11_FEM_CFG2,\n+\t SSB_SPROM11_FEM_TSSIPOSSLOPE, 0);\n+\tSPEX(epagain5g, SSB_SPROM11_FEM_CFG2, SSB_SPROM11_FEM_EPAGAIN,\n+\t SSB_SPROM11_FEM_EPAGAIN_SHIFT);\n+\tSPEX(pdgain5g, SSB_SPROM11_FEM_CFG2, SSB_SPROM11_FEM_PDGAIN,\n+\t SSB_SPROM11_FEM_PDGAIN_SHIFT);\n+\tSPEX(tworangetssi5g, SSB_SPROM11_FEM_CFG2,\n+\t SSB_SPROM11_FEM_TWORANGETSSI, SSB_SPROM11_FEM_TWORANGETSSI_SHIFT);\n+\tSPEX(papdcap5g, SSB_SPROM11_FEM_CFG2, SSB_SPROM11_FEM_PAPDCAP,\n+\t SSB_SPROM11_FEM_PAPDCAP_SHIFT);\n+\tSPEX(gainctrlsph, SSB_SPROM11_FEM_CFG2,\n+\t SSB_SPROM11_FEM_GAINCTRLSPH, SSB_SPROM11_FEM_GAINCTRLSPH_SHIFT);\n+\n+\tSPEX(tssifloor2g, SSB_SPROM11_TSSIFLOOR_2G,\n+\t SSB_SPROM11_TSSIFLOOR_MASK, 0);\n+\tfor (i = 0; i \u003c 4; i++)\n+\t\tSPEX(tssifloor5g[i], SSB_SPROM11_TSSIFLOOR_5GL + i 2,\n+\t\t SSB_SPROM11_TSSIFLOOR_MASK, 0);\n+\n+\tfor (i = 0; i \u003c ARRAY_SIZE(pwr_info_offset); i++) {\n+\t\tstruct ssb_sprom_core_pwr_info p = \u0026bus-\u003esprom.core_pwr_info[i];\n+\t\tu16 base = pwr_info_offset[i];\n+\n+\t\tp-\u003emaxp2ga = sprom[SPOFF(base + SSB_SPROM11_PWR_MAXP2GA)] \u0026 0xff;\n+\n+\t\tfor (j = 0; j \u003c 3; j++)\n+\t\t\tp-\u003epa2ga[j] = sprom[SPOFF(base + SSB_SPROM11_PWR_PA2GA) + j];\n+\n+\t\tv = sprom[SPOFF(base + SSB_SPROM11_PWR_MAXP5GA)];\n+\t\tp-\u003emaxp5ga[0] = v \u0026 0xff;\n+\t\tp-\u003emaxp5ga[1] = (v \u003e\u003e 8) \u0026 0xff;\n+\t\tv = sprom[SPOFF(base + SSB_SPROM11_PWR_MAXP5GA) + 1];\n+\t\tp-\u003emaxp5ga[2] = v \u0026 0xff;\n+\t\tp-\u003emaxp5ga[3] = (v \u003e\u003e 8) \u0026 0xff;\n+\n+\t\tfor (j = 0; j \u003c 12; j++)\n+\t\t\tp-\u003epa5ga[j] = sprom[SPOFF(base + SSB_SPROM11_PWR_PA5GA) + j];\n+\n+\t\tv = sprom[SPOFF(base + SSB_SPROM11_PWR_RXGAINS0)];\n+\t\tbcma_sprom_unpack_rxgains(\u0026bus-\u003esprom.rxgains_5gm, i, v \u0026 0xff);\n+\t\tbcma_sprom_unpack_rxgains(\u0026bus-\u003esprom.rxgains_5gh, i, (v \u003e\u003e 8) \u0026 0xff);\n+\t\tv = sprom[SPOFF(base + SSB_SPROM11_PWR_RXGAINS1)];\n+\t\tbcma_sprom_unpack_rxgains(\u0026bus-\u003esprom.rxgains_2g, i, v \u0026 0xff);\n+\t\tbcma_sprom_unpack_rxgains(\u0026bus-\u003esprom.rxgains_5gl, i, (v \u003e\u003e 8) \u0026 0xff);\n+\t}\n+\n+\tSPEX(rpcal2g, SSB_SPROM11_RPCAL_2G, ~0, 0);\n+\tSPEX(rpcal5gb[0], SSB_SPROM11_RPCAL_5GL, ~0, 0);\n+\tSPEX(rpcal5gb[1], SSB_SPROM11_RPCAL_5GM, ~0, 0);\n+\tSPEX(rpcal5gb[2], SSB_SPROM11_RPCAL_5GH, ~0, 0);\n+\tSPEX(rpcal5gb[3], SSB_SPROM11_RPCAL_5GU, ~0, 0);\n+\n+\tfor (i = 0; i \u003c 3; i++) {\n+\t\tbus-\u003esprom.pdoffset40ma[i] =\n+\t\t\tsprom[SPOFF(SSB_SPROM11_PDOFFSET40MA) + i];\n+\t\tbus-\u003esprom.pdoffset80ma[i] =\n+\t\t\tsprom[SPOFF(SSB_SPROM11_PDOFFSET80MA) + i];\n+\t}\n+\n+\tSPEX(cckbw202gpo, SSB_SPROM11_CCKBW202GPO, ~0, 0);\n+\tSPEX(cckbw20ul2gpo, SSB_SPROM11_CCKBW20UL2GPO, ~0, 0);\n+\tSPEX32(mcsbw202gpo, SSB_SPROM11_MCSBW202GPO, ~0, 0);\n+\tSPEX32(mcsbw402gpo, SSB_SPROM11_MCSBW402GPO, ~0, 0);\n+\tSPEX(dot11agofdmhrbw202gpo, SSB_SPROM11_DOT11AGOFDMHRBW202GPO, ~0, 0);\n+\tSPEX(ofdmlrbw202gpo, SSB_SPROM11_OFDMLRBW202GPO, ~0, 0);\n+\tSPEX32(mcsbw205glpo, SSB_SPROM11_MCSBW205GLPO, ~0, 0);\n+\tSPEX32(mcsbw405glpo, SSB_SPROM11_MCSBW405GLPO, ~0, 0);\n+\tSPEX32(mcsbw805glpo, SSB_SPROM11_MCSBW805GLPO, ~0, 0);\n+\tSPEX32(mcsbw205gmpo, SSB_SPROM11_MCSBW205GMPO, ~0, 0);\n+\tSPEX32(mcsbw405gmpo, SSB_SPROM11_MCSBW405GMPO, ~0, 0);\n+\tSPEX32(mcsbw805gmpo, SSB_SPROM11_MCSBW805GMPO, ~0, 0);\n+\tSPEX32(mcsbw205ghpo, SSB_SPROM11_MCSBW205GHPO, ~0, 0);\n+\tSPEX32(mcsbw405ghpo, SSB_SPROM11_MCSBW405GHPO, ~0, 0);\n+\tSPEX32(mcsbw805ghpo, SSB_SPROM11_MCSBW805GHPO, ~0, 0);\n+\n+\tSPEX(mcslr5gpo[0], SSB_SPROM11_MCSLR5GLPO, ~0, 0);\n+\tSPEX(mcslr5gpo[1], SSB_SPROM11_MCSLR5GMPO, ~0, 0);\n+\tSPEX(mcslr5gpo[2], SSB_SPROM11_MCSLR5GHPO, ~0, 0);\n+\tSPEX(sb20in40hrpo, SSB_SPROM11_SB20IN40HRPO, ~0, 0);\n+\tSPEX(sb20in40lrpo, SSB_SPROM11_SB20IN40LRPO, ~0, 0);\n+\tSPEX(sb20in80and160hr5gpo[0], SSB_SPROM11_SB20IN80AND160HR5GLPO, ~0, 0);\n+\tSPEX(sb20in80and160hr5gpo[1], SSB_SPROM11_SB20IN80AND160HR5GMPO, ~0, 0);\n+\tSPEX(sb20in80and160hr5gpo[2], SSB_SPROM11_SB20IN80AND160HR5GHPO, ~0, 0);\n+\tSPEX(sb20in80and160lr5gpo[0], SSB_SPROM11_SB20IN80AND160LR5GLPO, ~0, 0);\n+\tSPEX(sb20in80and160lr5gpo[1], SSB_SPROM11_SB20IN80AND160LR5GMPO, ~0, 0);\n+\tSPEX(sb20in80and160lr5gpo[2], SSB_SPROM11_SB20IN80AND160LR5GHPO, ~0, 0);\n+\tSPEX(sb40and80hr5gpo[0], SSB_SPROM11_SB40AND80HR5GLPO, ~0, 0);\n+\tSPEX(sb40and80hr5gpo[1], SSB_SPROM11_SB40AND80HR5GMPO, ~0, 0);\n+\tSPEX(sb40and80hr5gpo[2], SSB_SPROM11_SB40AND80HR5GHPO, ~0, 0);\n+\tSPEX(sb40and80lr5gpo[0], SSB_SPROM11_SB40AND80LR5GLPO, ~0, 0);\n+\tSPEX(sb40and80lr5gpo[1], SSB_SPROM11_SB40AND80LR5GMPO, ~0, 0);\n+\tSPEX(sb40and80lr5gpo[2], SSB_SPROM11_SB40AND80LR5GHPO, ~0, 0);\n+\tSPEX(dot11agduphrpo, SSB_SPROM11_DOT11AGDUPHRPO, ~0, 0);\n+\tSPEX(dot11agduplrpo, SSB_SPROM11_DOT11AGDUPLRPO, ~0, 0);\n+\n+\tSPEX(tempthresh, SSB_SPROM11_THERMAL, SSB_SPROM8_THERMAL_TRESH,\n+\t SSB_SPROM8_THERMAL_TRESH_SHIFT);\n+\tSPEX(tempoffset, SSB_SPROM11_THERMAL, SSB_SPROM8_THERMAL_OFFSET,\n+\t SSB_SPROM8_THERMAL_OFFSET_SHIFT);\n+\tSPEX(rawtempsense, SSB_SPROM11_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,\n+\t SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);\n+\tSPEX(measpower, SSB_SPROM11_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,\n+\t SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);\n+\tSPEX(tempsense_slope, SSB_SPROM11_OPT_CORRX,\n+\t SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,\n+\t SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);\n+\tSPEX(tempcorrx, SSB_SPROM11_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,\n+\t SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);\n+\tSPEX(tempsense_option, SSB_SPROM11_OPT_CORRX,\n+\t SSB_SPROM8_OPT_CORRX_TEMP_OPTION,\n+\t SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);\n+\tSPEX(phycal_tempdelta, SSB_SPROM11_TEMPDELTA,\n+\t SSB_SPROM8_TEMPDELTA_PHYCAL,\n+\t SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);\n+\tSPEX(temps_period, SSB_SPROM11_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,\n+\t SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);\n+\tSPEX(temps_hysteresis, SSB_SPROM11_TEMPDELTA,\n+\t SSB_SPROM8_TEMPDELTA_HYSTERESIS,\n+\t SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);\n+\n+\t/ Whole dB in bits [5:0], sign-extended, quarter dB in bits [7:6]. /\n+\tfor (i = 0; i \u003c 2; i++) {\n+\t\tu8 raw = i ? (sprom[SSB_SPROM11_AGBG2A0 / 2] \u003e\u003e 8) \u0026 0xff\n+\t\t\t : sprom[SSB_SPROM11_AGBG10 / 2] \u0026 0xff;\n+\t\ts8 gain = (s8)((raw \u0026 0x3f) \u003c\u003c 2) \u003e\u003e 2;\n+\n+\t\tbus-\u003esprom.antenna_gain_qdb[i] = (s8)(4 gain + (raw \u003e\u003e 6));\n+\t}\n+}\n+\n /\n Indicates the presence of external SPROM.\n /\n@@ -640,8 +837,13 @@ int bcma_sprom_get(struct bcma_bus bus)\n \t\tbcma_warn(bus, \"Invalid SPROM read from the PCIe card, trying to use fallback SPROM\\n\");\n \t\terr = bcma_fill_sprom_with_fallback(bus, \u0026bus-\u003esprom);\n \t} else {\n-\t\tbcma_sprom_extract_r8(bus, sprom);\n+\t\tif (bus-\u003esprom.revision == 11)\n+\t\t\tbcma_sprom_extract_r11(bus, sprom);\n+\t\telse\n+\t\t\tbcma_sprom_extract_r8(bus, sprom);\n \t\tkfree(sprom);\n+\t\t/* Most hosts have no NVRAM: ignore the result. /\n+\t\tbcm47xx_sprom_fill_bcma_nvram(bus, \u0026bus-\u003esprom);\n \t}\n \n \treturn err;\ndiff --git a/drivers/firmware/broadcom/bcm47xx_sprom.c b/drivers/firmware/broadcom/bcm47xx_sprom.c\nindex bca03fd8580865..581dd867d68324 100644\n--- a/drivers/firmware/broadcom/bcm47xx_sprom.c\n+++ b/drivers/firmware/broadcom/bcm47xx_sprom.c\n@@ -29,6 +29,7 @@\n #include \u003clinux/bcm47xx_nvram.h\u003e\n #include \u003clinux/bcm47xx_sprom.h\u003e\n #include \u003clinux/bcma/bcma.h\u003e\n+#include \u003clinux/err.h\u003e\n #include \u003clinux/etherdevice.h\u003e\n #include \u003clinux/hex.h\u003e\n #include \u003clinux/if_ether.h\u003e\n@@ -172,6 +173,52 @@ static void nvram_read_alpha2(const char prefix, const char name,\n \tmemcpy(val, buf, 2);\n }\n \n+/\n+ * AvVmid_c\u003ccore\u003e: Av,Vmid of the chain's power detector for 2g, 5gl, 5gml,\n+ * 5gmu and 5gh. The chain is marked valid only if all ten values parse.\n+ /\n+static void nvram_read_avvmid(const char prefix, int core,\n+\t\t\t struct ssb_sprom sprom, bool fallback)\n+{\n+\tchar name[sizeof(\"AvVmid_c0\")];\n+\tchar buf[64], p = buf, tok;\n+\tu8 v[10];\n+\tint n = 0;\n+\n+\tsnprintf(name, sizeof(name), \"AvVmid_c%d\", core);\n+\tif (get_nvram_var(prefix, NULL, name, buf, sizeof(buf), fallback) \u003c 0)\n+\t\treturn;\n+\twhile (n \u003c ARRAY_SIZE(v) \u0026\u0026 (tok = strsep(\u0026p, \",\")) != NULL) {\n+\t\tif (kstrtou8(strim(tok), 0, \u0026v[n]))\n+\t\t\treturn;\n+\t\tn++;\n+\t}\n+\tif (n != ARRAY_SIZE(v))\n+\t\treturn;\n+\tmemcpy(sprom-\u003eavvmid[core], v, sizeof(v));\n+\tsprom-\u003eavvmid_valid \|= BIT(core);\n+}\n+\n+/ Variables read from NVRAM whether or not the SPROM itself comes from it. /\n+static void bcm47xx_sprom_fill_nvram_only(struct ssb_sprom sprom,\n+\t\t\t\t\t const char prefix, bool fallback)\n+{\n+\tchar name[sizeof(\"ledbh15\")];\n+\tint i;\n+\n+\tfor (i = 0; i \u003c ARRAY_SIZE(sprom-\u003egpio_ext); i++) {\n+\t\tsnprintf(name, sizeof(name), \"ledbh%d\", i + 4);\n+\t\tnvram_read_u8(prefix, NULL, name, \u0026sprom-\u003egpio_ext[i], 0xff,\n+\t\t\t fallback);\n+\t}\n+\n+\tnvram_read_u32(prefix, NULL, \"boardflags3\", \u0026sprom-\u003eboardflags3, 0,\n+\t\t fallback);\n+\tsprom-\u003eavvmid_valid = 0;\n+\tfor (i = 0; i \u003c ARRAY_SIZE(sprom-\u003eavvmid); i++)\n+\t\tnvram_read_avvmid(prefix, i, sprom, fallback);\n+}\n+\n / This is one-function-only macro, it uses local \"sprom\" variable! /\n #define ENTRY(_revmask, _type, _prefix, _name, _val, _allset, _fallback) \\\n \tif (_revmask \u0026 BIT(sprom-\u003erevision)) \\\n@@ -209,6 +256,8 @@ static void bcm47xx_sprom_fill_auto(struct ssb_sprom sprom,\n \tENTRY(0xfffffffe, u8, pre, \"ledbh1\", gpio1, 0xff, fb);\n \tENTRY(0xfffffffe, u8, pre, \"ledbh2\", gpio2, 0xff, fb);\n \tENTRY(0xfffffffe, u8, pre, \"ledbh3\", gpio3, 0xff, fb);\n+\tif (sprom-\u003erevision)\n+\t\tbcm47xx_sprom_fill_nvram_only(sprom, pre, fb);\n \n \tENTRY(0x0000070e, u16, pre, \"pa0b0\", pa0b0, 0, fb);\n \tENTRY(0x0000070e, u16, pre, \"pa0b1\", pa0b1, 0, fb);\n@@ -647,45 +696,70 @@ static void bcm47xx_sprom_apply_prefix_alias(char prefix, size_t prefix_size)\n \t}\n }\n \n-static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom out)\n+/\n+ * The NVRAM prefix of a bcma bus's variables: pci/\u003cbus\u003e/\u003cslot\u003e/ or its\n+ * devpathN alias for a PCI device, sb/\u003ccore\u003e/ for the SoC's own core.\n+ * Returns the prefix, NULL for a SoC bus without an 802.11 core, or an\n+ * error pointer for a host type NVRAM knows nothing about. fallback is\n+ set when the caller may fall back to unprefixed variables.\n+ /\n+static char bcm47xx_sprom_bcma_prefix(struct bcma_bus bus, char buf,\n+\t\t\t\t size_t size, bool fallback)\n {\n-\tstruct bcma_boardinfo binfo = \u0026bus-\u003eboardinfo;\n \tstruct bcma_device core;\n-\tchar buf[10];\n-\tchar prefix;\n-\tbool fallback = false;\n \n+\tfallback = false;\n \tswitch (bus-\u003ehosttype) {\n \tcase BCMA_HOSTTYPE_PCI:\n-\t\tmemset(out, 0, sizeof(struct ssb_sprom));\n \t\t/ On BCM47XX all PCI buses share the same domain /\n \t\tif (IS_ENABLED(CONFIG_BCM47XX))\n-\t\t\tsnprintf(buf, sizeof(buf), \"pci/%u/%u/\",\n+\t\t\tsnprintf(buf, size, \"pci/%u/%u/\",\n \t\t\t\t bus-\u003ehost_pci-\u003ebus-\u003enumber + 1,\n \t\t\t\t PCI_SLOT(bus-\u003ehost_pci-\u003edevfn));\n \t\telse\n-\t\t\tsnprintf(buf, sizeof(buf), \"pci/%u/%u/\",\n+\t\t\tsnprintf(buf, size, \"pci/%u/%u/\",\n \t\t\t\t pci_domain_nr(bus-\u003ehost_pci-\u003ebus) + 1,\n \t\t\t\t bus-\u003ehost_pci-\u003ebus-\u003enumber);\n-\t\tbcm47xx_sprom_apply_prefix_alias(buf, sizeof(buf));\n-\t\tprefix = buf;\n-\t\tbreak;\n+\t\tbcm47xx_sprom_apply_prefix_alias(buf, size);\n+\t\treturn buf;\n \tcase BCMA_HOSTTYPE_SOC:\n-\t\tmemset(out, 0, sizeof(struct ssb_sprom));\n \t\tcore = bcma_find_core(bus, BCMA_CORE_80211);\n-\t\tif (core) {\n-\t\t\tsnprintf(buf, sizeof(buf), \"sb/%u/\",\n-\t\t\t\t core-\u003ecore_index);\n-\t\t\tprefix = buf;\n-\t\t\tfallback = true;\n-\t\t} else {\n-\t\t\tprefix = NULL;\n-\t\t}\n-\t\tbreak;\n+\t\tif (!core)\n+\t\t\treturn NULL;\n+\t\tsnprintf(buf, size, \"sb/%u/\", core-\u003ecore_index);\n+\t\tfallback = true;\n+\t\treturn buf;\n \tdefault:\n+\t\treturn ERR_PTR(-EINVAL);\n+\t}\n+}\n+\n+int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out)\n+{\n+\tchar buf[10];\n+\tchar prefix;\n+\tbool fallback;\n+\n+\tprefix = bcm47xx_sprom_bcma_prefix(bus, buf, sizeof(buf), \u0026fallback);\n+\tif (IS_ERR(prefix))\n+\t\treturn PTR_ERR(prefix);\n+\tbcm47xx_sprom_fill_nvram_only(out, prefix, fallback);\n+\treturn 0;\n+}\n+\n+static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom out)\n+{\n+\tstruct bcma_boardinfo binfo = \u0026bus-\u003eboardinfo;\n+\tchar buf[10];\n+\tchar prefix;\n+\tbool fallback;\n+\n+\tprefix = bcm47xx_sprom_bcma_prefix(bus, buf, sizeof(buf), \u0026fallback);\n+\tif (IS_ERR(prefix)) {\n \t\tpr_warn(\"Unable to fill SPROM for given bustype.\\n\");\n-\t\treturn -EINVAL;\n+\t\treturn PTR_ERR(prefix);\n \t}\n+\tmemset(out, 0, sizeof(struct ssb_sprom));\n \n \tnvram_read_u16(prefix, NULL, \"boardvendor\", \u0026binfo-\u003evendor, 0, true);\n \tif (!binfo-\u003evendor)\ndiff --git a/include/linux/bcm47xx_sprom.h b/include/linux/bcm47xx_sprom.h\nindex 40a7da3ef50e61..47e9922ec890c4 100644\n--- a/include/linux/bcm47xx_sprom.h\n+++ b/include/linux/bcm47xx_sprom.h\n@@ -9,6 +9,7 @@\n #include \u003clinux/types.h\u003e\n #include \u003clinux/vmalloc.h\u003e\n \n+struct bcma_bus;\n struct ssb_sprom;\n \n #ifdef CONFIG_BCM47XX_SPROM\n@@ -28,4 +29,18 @@ static inline int bcm47xx_sprom_register_fallbacks(void)\n };\n #endif\n \n+/\n+ * Fill the NVRAM-only variables of a bcma bus whose SPROM was read from the\n+ * device. Like the SPROM fallback, only with bcma built in.\n+ /\n+#if defined(CONFIG_BCM47XX_SPROM) \u0026\u0026 IS_BUILTIN(CONFIG_BCMA)\n+int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out);\n+#else\n+static inline int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus,\n+\t\t\t\t\t\tstruct ssb_sprom out)\n+{\n+\treturn -EOPNOTSUPP;\n+}\n+#endif\n+\n #endif / __BCM47XX_SPROM_H /\ndiff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h\nindex 0cb6638b55e54c..b761801d6356ab 100644\n--- a/include/linux/bcma/bcma_driver_chipcommon.h\n+++ b/include/linux/bcma/bcma_driver_chipcommon.h\n@@ -54,6 +54,7 @@\n #define BCMA_CC_CORECTL\t\t\t0x0008\n #define BCMA_CC_CORECTL_UARTCLK0\t0x00000001\t/ Drive UART with internal clock /\n #define\t BCMA_CC_CORECTL_SE\t\t0x00000002\t/ sync clk out enable (corerev \u003e= 3) /\n+#define BCMA_CC_CORECTL_ASYNCGPIO\t0x00000004\t/ GPIO IRQs without backplane clock /\n #define BCMA_CC_CORECTL_UARTCLKEN\t0x00000008\t/ UART clock enable (rev \u003e= 21) /\n #define BCMA_CC_BIST\t\t\t0x000C\n #define BCMA_CC_OTPS\t\t\t0x0010\t\t/ OTP status /\n@@ -107,6 +108,8 @@\n #define BCMA_CC_CHIPST_4706_PCIE1_DISABLE\tBIT(5) / PCIE1 enable strap pin /\n #define BCMA_CC_CHIPST_5357_NAND_BOOT\t\tBIT(4) / NAND boot, valid for CC rev 38 and/or BCM5357 /\n #define BCMA_CC_CHIPST_4360_XTAL_40MZ\t\t0x00000001\n+#define BCMA_CC_CHIPST_4360_RSRC_INIT_MODE0\t0x00000020\n+#define BCMA_CC_CHIPST_4360_MODE_USB\t\t0x00000100\n #define BCMA_CC_JCMD\t\t\t0x0030\t\t/ Rev \u003e= 10 only /\n #define BCMA_CC_JCMD_START\t\t0x80000000\n #define BCMA_CC_JCMD_BUSY\t\t0x80000000\n@@ -500,6 +503,8 @@\n #define BCMA_CC_PMU_PLL_CTL3\t\t3\n #define BCMA_CC_PMU_PLL_CTL4\t\t4\n #define BCMA_CC_PMU_PLL_CTL5\t\t5\n+#define BCMA_CC_PMU_PLL_CTL6\t\t6\n+#define BCMA_CC_PMU_PLL_CTL14\t\t14\n \n #define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK\t0x00f00000\n #define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT\t20\ndiff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h\nindex 67cb66f6f5ed6d..5a4daa76dfaaad 100644\n--- a/include/linux/ssb/ssb.h\n+++ b/include/linux/ssb/ssb.h\n@@ -23,6 +23,19 @@ struct ssb_sprom_core_pwr_info {\n \tu8 itssi_2g, itssi_5g;\n \tu8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;\n \tu16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];\n+\n+\t/ SROM rev 11 /\n+\tu8 maxp2ga;\n+\tu8 maxp5ga[4];\n+\tu16 pa2ga[3];\n+\tu16 pa5ga[12];\n+};\n+\n+/ Rx gain settings of a band, indexed by chain. SROM rev 11. /\n+struct ssb_sprom_rxgains {\n+\tu8 elnagain[3];\n+\tu8 triso[3];\n+\tu8 trelnabyp[3];\n };\n \n struct ssb_sprom {\n@@ -63,6 +76,10 @@ struct ssb_sprom {\n \tu8 gpio1;\t\t/ GPIO pin 1 /\n \tu8 gpio2;\t\t/ GPIO pin 2 /\n \tu8 gpio3;\t\t/ GPIO pin 3 /\n+\tu8 gpio_ext[12];\t/ GPIO pins 4-15, NVRAM ledbh4-15 only /\n+\t/ NVRAM AvVmid_c0..2: {Av, Vmid} for 2g, 5gl, 5gml, 5gmu, 5gh /\n+\tu8 avvmid[3][5][2];\n+\tu8 avvmid_valid;\t/ bit per chain whose AvVmid_cN parsed /\n \tu8 maxpwr_bg;\t\t/ 2.4GHz Amplifier Max Power (in dBm Q5.2) /\n \tu8 maxpwr_al;\t\t/ 5.2GHz Amplifier Max Power (in dBm Q5.2) /\n \tu8 maxpwr_a;\t\t/ 5.3GHz Amplifier Max Power (in dBm Q5.2) /\n@@ -192,6 +209,51 @@ struct ssb_sprom {\n \tu16 legofdm40duppo;\n \tu8 sar2g;\n \tu8 sar5g;\n+\n+\t/ SROM rev 11 only. /\n+\tstruct ssb_sprom_rxgains rxgains_2g;\n+\tstruct ssb_sprom_rxgains rxgains_5gl;\n+\tstruct ssb_sprom_rxgains rxgains_5gm;\n+\tstruct ssb_sprom_rxgains rxgains_5gh;\n+\tu8 subband5gver;\n+\t/ Antenna gain, quarter dB: [0] agbg0 (2.4 GHz), [1] aga0 (5 GHz). /\n+\ts8 antenna_gain_qdb[2];\n+\tu16 dot11agofdmhrbw202gpo;\n+\tu16 ofdmlrbw202gpo;\n+\tu32 mcsbw805glpo;\n+\tu32 mcsbw805gmpo;\n+\tu32 mcsbw805ghpo;\n+\t/ TX beamforming RX path calibration, 5 GHz in l, m, h, u order. /\n+\tu16 rpcal2g;\n+\tu16 rpcal5gb[4];\n+\tu16 pdoffset40ma[3];\n+\tu16 pdoffset80ma[3];\n+\t/ Per-rate-group power offsets, nibbles; [i] is 5 GHz l/m/h. /\n+\tu16 mcslr5gpo[3];\n+\tu16 sb20in40hrpo;\n+\tu16 sb20in40lrpo;\n+\tu16 sb20in80and160hr5gpo[3];\n+\tu16 sb20in80and160lr5gpo[3];\n+\tu16 sb40and80hr5gpo[3];\n+\tu16 sb40and80lr5gpo[3];\n+\tu16 dot11agduphrpo;\n+\tu16 dot11agduplrpo;\n+\t/ FEM configuration; femctrl selects the FEM control scheme. /\n+\tu8 tssiposslope2g;\n+\tu8 epagain2g;\n+\tu8 pdgain2g;\n+\tu8 tworangetssi2g;\n+\tu8 papdcap2g;\n+\tu8 femctrl;\n+\tu8 tssiposslope5g;\n+\tu8 epagain5g;\n+\tu8 pdgain5g;\n+\tu8 tworangetssi5g;\n+\tu8 papdcap5g;\n+\tu8 gainctrlsph;\n+\t/ TSSI floor, 0x3ff when not programmed. /\n+\tu16 tssifloor2g;\n+\tu16 tssifloor5g[4];\n };\n \n / Information about the PCB the circuitry is soldered on. /\ndiff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h\nindex 210f4649406502..12fa55e9188d95 100644\n--- a/include/linux/ssb/ssb_regs.h\n+++ b/include/linux/ssb/ssb_regs.h\n@@ -606,6 +606,100 @@\n #define SSB_SPROM8_BW40PO\t\t0x0196\n #define SSB_SPROM8_BWDUPPO\t\t0x0198\n \n+/ SROM revision 11. Header fields use the SSB_SPROM8 masks and shifts. /\n+#define SSB_SPROM11_BFL3\t\t0x008C\t/ boardflags3, 32 bits /\n+#define SSB_SPROM11_IL0MAC\t\t0x0090\t/ 6 byte MAC address /\n+#define SSB_SPROM11_CCODE\t\t0x0096\t/ 2 byte country code /\n+#define SSB_SPROM11_GPIOA\t\t0x009A\t/ ledbh0 low byte, ledbh1 high /\n+#define SSB_SPROM11_GPIOB\t\t0x009C\t/ ledbh2 low byte, ledbh3 high /\n+#define SSB_SPROM11_ANTAVAIL\t\t0x00A0\n+#define SSB_SPROM11_AGBG10\t\t0x00A2\t/ agbg0 low byte, agbg1 high /\n+#define SSB_SPROM11_AGBG2A0\t\t0x00A4\t/ agbg2 low byte, aga0 high /\n+#define SSB_SPROM11_AGA21\t\t0x00A6\t/ aga1 low byte, aga2 high /\n+#define SSB_SPROM11_TXRXC\t\t0x00A8\n+/ FEM configuration, CFG1 for 2.4 GHz and CFG2 for 5 GHz. /\n+#define SSB_SPROM11_FEM_CFG1\t\t0x00AA\n+#define SSB_SPROM11_FEM_CFG2\t\t0x00AC\n+#define SSB_SPROM11_FEM_TSSIPOSSLOPE\t0x0001\n+#define SSB_SPROM11_FEM_EPAGAIN\t\t0x000E\n+#define SSB_SPROM11_FEM_EPAGAIN_SHIFT\t1\n+#define SSB_SPROM11_FEM_PDGAIN\t\t0x01F0\n+#define SSB_SPROM11_FEM_PDGAIN_SHIFT\t4\n+#define SSB_SPROM11_FEM_TWORANGETSSI\t0x0200\n+#define SSB_SPROM11_FEM_TWORANGETSSI_SHIFT\t9\n+#define SSB_SPROM11_FEM_PAPDCAP\t\t0x0400\n+#define SSB_SPROM11_FEM_PAPDCAP_SHIFT\t10\n+#define SSB_SPROM11_FEM_CTRL\t\t0xF800\t/ CFG1: femctrl /\n+#define SSB_SPROM11_FEM_CTRL_SHIFT\t11\n+#define SSB_SPROM11_FEM_GAINCTRLSPH\t0xF800\t/ CFG2: gainctrlsph /\n+#define SSB_SPROM11_FEM_GAINCTRLSPH_SHIFT\t11\n+/ Temperature words, with the SSB_SPROM8 layout. /\n+#define SSB_SPROM11_THERMAL\t\t0x00AE\n+#define SSB_SPROM11_RAWTS\t\t0x00B0\n+#define SSB_SPROM11_OPT_CORRX\t\t0x00B2\n+#define SSB_SPROM11_TEMPDELTA\t\t0x00B8\n+/ TSSI floor: 2.4 GHz, then 5 GHz l, m, h, u. /\n+#define SSB_SPROM11_TSSIFLOOR_2G\t0x00BE\n+#define SSB_SPROM11_TSSIFLOOR_5GL\t0x00C0\n+#define SSB_SPROM11_TSSIFLOOR_MASK\t0x03FF\n+#define SSB_SPROM11_PDOFFSET40MA\t0x00CA\t/ 3 x u16, one per chain /\n+#define SSB_SPROM11_PDOFFSET80MA\t0x00D0\t/ 3 x u16, one per chain /\n+#define SSB_SPROM11_SUBBAND5GVER\t0x00D6\n+\n+/ Per-chain power info blocks, 0x28 bytes apart; SSB_SPROM11_PWR_* are\n+ * offsets within a block.\n+ /\n+#define SSB_SPROM11_PWR_INFO_CORE0\t0x00D8\n+#define SSB_SPROM11_PWR_INFO_CORE1\t0x0100\n+#define SSB_SPROM11_PWR_INFO_CORE2\t0x0128\n+\n+#define SSB_SPROM11_PWR_MAXP2GA\t\t0x0000\t/ u8 in low byte /\n+#define SSB_SPROM11_PWR_PA2GA\t\t0x0002\t/ 3 x u16 /\n+#define SSB_SPROM11_PWR_RXGAINS0\t0x0008\t/ 5gm (lo) / 5gh (hi) /\n+#define SSB_SPROM11_PWR_RXGAINS1\t0x000A\t/ 2g (lo) / 5gl (hi) /\n+#define SSB_SPROM11_PWR_MAXP5GA\t\t0x000C\t/ 2 x u16 -\u003e 4 x u8 /\n+#define SSB_SPROM11_PWR_PA5GA\t\t0x0010\t/ 12 x u16 /\n+\n+#define SSB_SPROM11_CCKBW202GPO\t\t0x0150\n+#define SSB_SPROM11_CCKBW20UL2GPO\t0x0152\n+#define SSB_SPROM11_MCSBW202GPO\t\t0x0154\n+#define SSB_SPROM11_MCSBW402GPO\t\t0x0158\n+#define SSB_SPROM11_DOT11AGOFDMHRBW202GPO 0x015C\n+#define SSB_SPROM11_OFDMLRBW202GPO\t0x015E\n+#define SSB_SPROM11_MCSBW205GLPO\t0x0160\n+#define SSB_SPROM11_MCSBW405GLPO\t0x0164\n+#define SSB_SPROM11_MCSBW805GLPO\t0x0168\n+#define SSB_SPROM11_RPCAL_2G\t\t0x016C\n+#define SSB_SPROM11_RPCAL_5GL\t\t0x016E\n+#define SSB_SPROM11_MCSBW205GMPO\t0x0170\n+#define SSB_SPROM11_MCSBW405GMPO\t0x0174\n+#define SSB_SPROM11_MCSBW805GMPO\t0x0178\n+#define SSB_SPROM11_RPCAL_5GM\t\t0x017C\n+#define SSB_SPROM11_RPCAL_5GH\t\t0x017E\n+#define SSB_SPROM11_MCSBW205GHPO\t0x0180\n+#define SSB_SPROM11_MCSBW405GHPO\t0x0184\n+#define SSB_SPROM11_MCSBW805GHPO\t0x0188\n+#define SSB_SPROM11_RPCAL_5GU\t\t0x018C\n+#define SSB_SPROM11_MCSLR5GLPO\t\t0x0190\n+#define SSB_SPROM11_MCSLR5GMPO\t\t0x0192\n+#define SSB_SPROM11_MCSLR5GHPO\t\t0x0194\n+#define SSB_SPROM11_SB20IN40HRPO\t0x0196\n+#define SSB_SPROM11_SB20IN80AND160HR5GLPO 0x0198\n+#define SSB_SPROM11_SB40AND80HR5GLPO\t0x019A\n+#define SSB_SPROM11_SB20IN80AND160HR5GMPO 0x019C\n+#define SSB_SPROM11_SB40AND80HR5GMPO\t0x019E\n+#define SSB_SPROM11_SB20IN80AND160HR5GHPO 0x01A0\n+#define SSB_SPROM11_SB40AND80HR5GHPO\t0x01A2\n+#define SSB_SPROM11_SB20IN40LRPO\t0x01A4\n+#define SSB_SPROM11_SB20IN80AND160LR5GLPO 0x01A6\n+#define SSB_SPROM11_SB40AND80LR5GLPO\t0x01A8\n+#define SSB_SPROM11_SB20IN80AND160LR5GMPO 0x01AA\n+#define SSB_SPROM11_SB40AND80LR5GMPO\t0x01AC\n+#define SSB_SPROM11_SB20IN80AND160LR5GHPO 0x01AE\n+#define SSB_SPROM11_SB40AND80LR5GHPO\t0x01B0\n+#define SSB_SPROM11_DOT11AGDUPHRPO\t0x01B2\n+#define SSB_SPROM11_DOT11AGDUPLRPO\t0x01B4\n+\n / Values for boardflags_lo read from SPROM /\n #define SSB_BFL_BTCOEXIST\t\t0x0001\t/ implements Bluetooth coexistance /\n #define SSB_BFL_PACTRL\t\t\t0x0002\t/ GPIO 9 controlling the PA */\n" }
2/1	2026/10/27 03:30	agent	patch-evaluator	3m Model: core Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies Broadcom BCMA bus driver logic and Broadcom BCM47xx SPROM firmware parsing for Broadcom PCIe chips (such as BCM4360 and BCM4352). These drivers require physical Broadcom PCIe hardware or Broadcom SoCs, neither of which is emulated in standard QEMU or GCE virtualized environments. As the code is structurally unreachable in fuzzing environments, fuzzing is not warranted.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 9aba30bb33a26a4a5890110b6787c43378dbac12 Author: syz-cluster <triage@syzkaller.com> Date: Tue Oct 27 03:30:21 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/bcma/core.c b/drivers/bcma/core.c index 37a5ffe673d5da..f4246689ea0003 100644 --- a/drivers/bcma/core.c +++ b/drivers/bcma/core.c @@ -100,7 +100,7 @@ void bcma_core_set_clockmode(struct bcma_device core, bcma_err(core->bus, "HT force timeout\n"); break; case BCMA_CLKMODE_DYNAMIC: - bcma_set32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT); + bcma_mask32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT); break; } } diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c index fd91a39f02c739..f5e1b541545f1b 100644 --- a/drivers/bcma/driver_chipcommon.c +++ b/drivers/bcma/driver_chipcommon.c @@ -227,6 +227,9 @@ void bcma_core_chipcommon_init(struct bcma_drv_cc cc) ((leddc_on << BCMA_CC_GPIOTIMER_ONTIME_SHIFT) \| (leddc_off << BCMA_CC_GPIOTIMER_OFFTIME_SHIFT))); } + + if (cc->core->id.rev >= 21) + bcma_cc_set32(cc, BCMA_CC_CORECTL, BCMA_CC_CORECTL_ASYNCGPIO); cc->ticks_per_ms = bcma_chipco_watchdog_ticks_per_ms(cc); cc->setup_done = true; diff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c index 263ef6fa1d0f7d..ab2b2701d04895 100644 --- a/drivers/bcma/driver_chipcommon_pmu.c +++ b/drivers/bcma/driver_chipcommon_pmu.c @@ -145,6 +145,39 @@ static void bcma_pmu2_pll_init0(struct bcma_drv_cc cc, u32 xtalfreq) / TODO: Do we need to update OTP? / } +static void bcma_pmu_4360_pll_init(struct bcma_drv_cc cc) +{ + struct bcma_bus bus = cc->core->bus; + + if (bus->chipinfo.rev != 3) + return; + if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4360 && + cc->status & BCMA_CC_CHIPST_4360_MODE_USB) + return; + + / Fractional VCO, 960.0098 MHz from a 40 MHz crystal. / + bcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL2, 0x0c31); + bcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL3, 0x100e); + bcma_pmu_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD); +} + +/ Returns the max resource mask to program, 0 to leave it alone. / +static u32 bcma_pmu_4360_resources_init(struct bcma_drv_cc cc) +{ + if (cc->core->bus->chipinfo.rev != 3) + return 0; + + bcma_pmu_write32(cc, BCMA_CC_PMU_RES_TABSEL, 6); + bcma_pmu_write32(cc, BCMA_CC_PMU_RES_UPDNTM, 0x00200001); + + if (cc->status & BCMA_CC_CHIPST_4360_RSRC_INIT_MODE0) + return 0; + bcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL6, 0x09048562); + bcma_chipco_pll_write(cc, BCMA_CC_PMU_PLL_CTL14, 0x09048562); + bcma_pmu_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD); + return 0x1ff; +} + static void bcma_pmu_pll_init(struct bcma_drv_cc cc) { struct bcma_bus bus = cc->core->bus; @@ -156,6 +189,10 @@ static void bcma_pmu_pll_init(struct bcma_drv_cc cc) xtalfreq = 20000; bcma_pmu2_pll_init0(cc, xtalfreq); break; + case BCMA_CHIP_ID_BCM4352: + case BCMA_CHIP_ID_BCM4360: + bcma_pmu_4360_pll_init(cc); + break; } } @@ -188,6 +225,10 @@ static void bcma_pmu_resources_init(struct bcma_drv_cc cc) BCMA_RES_4314_WL_CORE_READY; max_msk = 0x3FFFFFFF; break; + case BCMA_CHIP_ID_BCM4352: + case BCMA_CHIP_ID_BCM4360: + max_msk = bcma_pmu_4360_resources_init(cc); + break; default: bcma_debug(bus, "PMU resource config unknown or not needed for device 0x%04X\n", bus->chipinfo.id); diff --git a/drivers/bcma/driver_pcie2.c b/drivers/bcma/driver_pcie2.c index cf889fc62ac7fd..fd8fab98218f63 100644 --- a/drivers/bcma/driver_pcie2.c +++ b/drivers/bcma/driver_pcie2.c @@ -170,6 +170,9 @@ void bcma_core_pcie2_init(struct bcma_drv_pcie2 pcie2) case BCMA_CHIP_ID_BCM4360: case BCMA_CHIP_ID_BCM4352: pcie2->reqsize = 1024; + if (ci->rev == 3) + pcie2_set32(pcie2, BCMA_CLKCTLST, + BCMA_CLKCTLST_HAVEHTREQ); break; default: pcie2->reqsize = 128; diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c index 3dc2985063f1e5..f6cf722a37988e 100644 --- a/drivers/bcma/host_pci.c +++ b/drivers/bcma/host_pci.c @@ -298,6 +298,7 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = { { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) }, { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) }, { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43b1) }, + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43b3) }, { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) }, { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) }, / 0xa8db, BCM43217 (sic!) / { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43228) }, / 0xa8dc / diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c index e668ad7963fc25..ac76225127c8c1 100644 --- a/drivers/bcma/sprom.c +++ b/drivers/bcma/sprom.c @@ -11,6 +11,7 @@ #include <linux/bcma/bcma.h> #include <linux/bcma/bcma_regs.h> +#include <linux/bcm47xx_sprom.h> #include <linux/pci.h> #include <linux/io.h> #include <linux/dma-mapping.h> @@ -474,6 +475,202 @@ static void bcma_sprom_extract_r8(struct bcma_bus bus, const u16 sprom) SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT); } +static void bcma_sprom_unpack_rxgains(struct ssb_sprom_rxgains out, + int chain, u8 packed) +{ + out->trelnabyp[chain] = (packed >> 7) & 0x01; + out->triso[chain] = (packed >> 3) & 0x0f; + out->elnagain[chain] = packed & 0x07; +} + +static void bcma_sprom_extract_r11(struct bcma_bus bus, const u16 sprom) +{ + static const u16 pwr_info_offset[] = { + SSB_SPROM11_PWR_INFO_CORE0, + SSB_SPROM11_PWR_INFO_CORE1, + SSB_SPROM11_PWR_INFO_CORE2, + }; + u16 v; + int i, j; + + BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) > + ARRAY_SIZE(bus->sprom.core_pwr_info)); + + /* Header: rev-11 offsets, rev-8 masks/shifts. / + for (i = 0; i < 3; i++) { + v = sprom[SPOFF(SSB_SPROM11_IL0MAC) + i]; + (((__be16 )bus->sprom.il0mac) + i) = cpu_to_be16(v); + } + + SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0); + SPEX(board_type, SSB_SPROM1_SPID, ~0, 0); + SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0); + SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0); + SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0); + SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0); + SPEX32(boardflags3, SSB_SPROM11_BFL3, ~0, 0); + + SPEX(country_code, SSB_SPROM11_CCODE, ~0, 0); + SPEX(gpio0, SSB_SPROM11_GPIOA, SSB_SPROM8_GPIOA_P0, 0); + SPEX(gpio1, SSB_SPROM11_GPIOA, SSB_SPROM8_GPIOA_P1, + SSB_SPROM8_GPIOA_P1_SHIFT); + SPEX(gpio2, SSB_SPROM11_GPIOB, SSB_SPROM8_GPIOB_P2, 0); + SPEX(gpio3, SSB_SPROM11_GPIOB, SSB_SPROM8_GPIOB_P3, + SSB_SPROM8_GPIOB_P3_SHIFT); + SPEX(ant_available_a, SSB_SPROM11_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A, + SSB_SPROM8_ANTAVAIL_A_SHIFT); + SPEX(ant_available_bg, SSB_SPROM11_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG, + SSB_SPROM8_ANTAVAIL_BG_SHIFT); + SPEX(txchain, SSB_SPROM11_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN, + SSB_SPROM8_TXRXC_TXCHAIN_SHIFT); + SPEX(rxchain, SSB_SPROM11_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN, + SSB_SPROM8_TXRXC_RXCHAIN_SHIFT); + SPEX(antswitch, SSB_SPROM11_TXRXC, SSB_SPROM8_TXRXC_SWITCH, + SSB_SPROM8_TXRXC_SWITCH_SHIFT); + SPEX(subband5gver, SSB_SPROM11_SUBBAND5GVER, 0x00ff, 0); + + SPEX(tssiposslope2g, SSB_SPROM11_FEM_CFG1, + SSB_SPROM11_FEM_TSSIPOSSLOPE, 0); + SPEX(epagain2g, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_EPAGAIN, + SSB_SPROM11_FEM_EPAGAIN_SHIFT); + SPEX(pdgain2g, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_PDGAIN, + SSB_SPROM11_FEM_PDGAIN_SHIFT); + SPEX(tworangetssi2g, SSB_SPROM11_FEM_CFG1, + SSB_SPROM11_FEM_TWORANGETSSI, SSB_SPROM11_FEM_TWORANGETSSI_SHIFT); + SPEX(papdcap2g, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_PAPDCAP, + SSB_SPROM11_FEM_PAPDCAP_SHIFT); + SPEX(femctrl, SSB_SPROM11_FEM_CFG1, SSB_SPROM11_FEM_CTRL, + SSB_SPROM11_FEM_CTRL_SHIFT); + SPEX(tssiposslope5g, SSB_SPROM11_FEM_CFG2, + SSB_SPROM11_FEM_TSSIPOSSLOPE, 0); + SPEX(epagain5g, SSB_SPROM11_FEM_CFG2, SSB_SPROM11_FEM_EPAGAIN, + SSB_SPROM11_FEM_EPAGAIN_SHIFT); + SPEX(pdgain5g, SSB_SPROM11_FEM_CFG2, SSB_SPROM11_FEM_PDGAIN, + SSB_SPROM11_FEM_PDGAIN_SHIFT); + SPEX(tworangetssi5g, SSB_SPROM11_FEM_CFG2, + SSB_SPROM11_FEM_TWORANGETSSI, SSB_SPROM11_FEM_TWORANGETSSI_SHIFT); + SPEX(papdcap5g, SSB_SPROM11_FEM_CFG2, SSB_SPROM11_FEM_PAPDCAP, + SSB_SPROM11_FEM_PAPDCAP_SHIFT); + SPEX(gainctrlsph, SSB_SPROM11_FEM_CFG2, + SSB_SPROM11_FEM_GAINCTRLSPH, SSB_SPROM11_FEM_GAINCTRLSPH_SHIFT); + + SPEX(tssifloor2g, SSB_SPROM11_TSSIFLOOR_2G, + SSB_SPROM11_TSSIFLOOR_MASK, 0); + for (i = 0; i < 4; i++) + SPEX(tssifloor5g[i], SSB_SPROM11_TSSIFLOOR_5GL + i 2, + SSB_SPROM11_TSSIFLOOR_MASK, 0); + + for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) { + struct ssb_sprom_core_pwr_info p = &bus->sprom.core_pwr_info[i]; + u16 base = pwr_info_offset[i]; + + p->maxp2ga = sprom[SPOFF(base + SSB_SPROM11_PWR_MAXP2GA)] & 0xff; + + for (j = 0; j < 3; j++) + p->pa2ga[j] = sprom[SPOFF(base + SSB_SPROM11_PWR_PA2GA) + j]; + + v = sprom[SPOFF(base + SSB_SPROM11_PWR_MAXP5GA)]; + p->maxp5ga[0] = v & 0xff; + p->maxp5ga[1] = (v >> 8) & 0xff; + v = sprom[SPOFF(base + SSB_SPROM11_PWR_MAXP5GA) + 1]; + p->maxp5ga[2] = v & 0xff; + p->maxp5ga[3] = (v >> 8) & 0xff; + + for (j = 0; j < 12; j++) + p->pa5ga[j] = sprom[SPOFF(base + SSB_SPROM11_PWR_PA5GA) + j]; + + v = sprom[SPOFF(base + SSB_SPROM11_PWR_RXGAINS0)]; + bcma_sprom_unpack_rxgains(&bus->sprom.rxgains_5gm, i, v & 0xff); + bcma_sprom_unpack_rxgains(&bus->sprom.rxgains_5gh, i, (v >> 8) & 0xff); + v = sprom[SPOFF(base + SSB_SPROM11_PWR_RXGAINS1)]; + bcma_sprom_unpack_rxgains(&bus->sprom.rxgains_2g, i, v & 0xff); + bcma_sprom_unpack_rxgains(&bus->sprom.rxgains_5gl, i, (v >> 8) & 0xff); + } + + SPEX(rpcal2g, SSB_SPROM11_RPCAL_2G, ~0, 0); + SPEX(rpcal5gb[0], SSB_SPROM11_RPCAL_5GL, ~0, 0); + SPEX(rpcal5gb[1], SSB_SPROM11_RPCAL_5GM, ~0, 0); + SPEX(rpcal5gb[2], SSB_SPROM11_RPCAL_5GH, ~0, 0); + SPEX(rpcal5gb[3], SSB_SPROM11_RPCAL_5GU, ~0, 0); + + for (i = 0; i < 3; i++) { + bus->sprom.pdoffset40ma[i] = + sprom[SPOFF(SSB_SPROM11_PDOFFSET40MA) + i]; + bus->sprom.pdoffset80ma[i] = + sprom[SPOFF(SSB_SPROM11_PDOFFSET80MA) + i]; + } + + SPEX(cckbw202gpo, SSB_SPROM11_CCKBW202GPO, ~0, 0); + SPEX(cckbw20ul2gpo, SSB_SPROM11_CCKBW20UL2GPO, ~0, 0); + SPEX32(mcsbw202gpo, SSB_SPROM11_MCSBW202GPO, ~0, 0); + SPEX32(mcsbw402gpo, SSB_SPROM11_MCSBW402GPO, ~0, 0); + SPEX(dot11agofdmhrbw202gpo, SSB_SPROM11_DOT11AGOFDMHRBW202GPO, ~0, 0); + SPEX(ofdmlrbw202gpo, SSB_SPROM11_OFDMLRBW202GPO, ~0, 0); + SPEX32(mcsbw205glpo, SSB_SPROM11_MCSBW205GLPO, ~0, 0); + SPEX32(mcsbw405glpo, SSB_SPROM11_MCSBW405GLPO, ~0, 0); + SPEX32(mcsbw805glpo, SSB_SPROM11_MCSBW805GLPO, ~0, 0); + SPEX32(mcsbw205gmpo, SSB_SPROM11_MCSBW205GMPO, ~0, 0); + SPEX32(mcsbw405gmpo, SSB_SPROM11_MCSBW405GMPO, ~0, 0); + SPEX32(mcsbw805gmpo, SSB_SPROM11_MCSBW805GMPO, ~0, 0); + SPEX32(mcsbw205ghpo, SSB_SPROM11_MCSBW205GHPO, ~0, 0); + SPEX32(mcsbw405ghpo, SSB_SPROM11_MCSBW405GHPO, ~0, 0); + SPEX32(mcsbw805ghpo, SSB_SPROM11_MCSBW805GHPO, ~0, 0); + + SPEX(mcslr5gpo[0], SSB_SPROM11_MCSLR5GLPO, ~0, 0); + SPEX(mcslr5gpo[1], SSB_SPROM11_MCSLR5GMPO, ~0, 0); + SPEX(mcslr5gpo[2], SSB_SPROM11_MCSLR5GHPO, ~0, 0); + SPEX(sb20in40hrpo, SSB_SPROM11_SB20IN40HRPO, ~0, 0); + SPEX(sb20in40lrpo, SSB_SPROM11_SB20IN40LRPO, ~0, 0); + SPEX(sb20in80and160hr5gpo[0], SSB_SPROM11_SB20IN80AND160HR5GLPO, ~0, 0); + SPEX(sb20in80and160hr5gpo[1], SSB_SPROM11_SB20IN80AND160HR5GMPO, ~0, 0); + SPEX(sb20in80and160hr5gpo[2], SSB_SPROM11_SB20IN80AND160HR5GHPO, ~0, 0); + SPEX(sb20in80and160lr5gpo[0], SSB_SPROM11_SB20IN80AND160LR5GLPO, ~0, 0); + SPEX(sb20in80and160lr5gpo[1], SSB_SPROM11_SB20IN80AND160LR5GMPO, ~0, 0); + SPEX(sb20in80and160lr5gpo[2], SSB_SPROM11_SB20IN80AND160LR5GHPO, ~0, 0); + SPEX(sb40and80hr5gpo[0], SSB_SPROM11_SB40AND80HR5GLPO, ~0, 0); + SPEX(sb40and80hr5gpo[1], SSB_SPROM11_SB40AND80HR5GMPO, ~0, 0); + SPEX(sb40and80hr5gpo[2], SSB_SPROM11_SB40AND80HR5GHPO, ~0, 0); + SPEX(sb40and80lr5gpo[0], SSB_SPROM11_SB40AND80LR5GLPO, ~0, 0); + SPEX(sb40and80lr5gpo[1], SSB_SPROM11_SB40AND80LR5GMPO, ~0, 0); + SPEX(sb40and80lr5gpo[2], SSB_SPROM11_SB40AND80LR5GHPO, ~0, 0); + SPEX(dot11agduphrpo, SSB_SPROM11_DOT11AGDUPHRPO, ~0, 0); + SPEX(dot11agduplrpo, SSB_SPROM11_DOT11AGDUPLRPO, ~0, 0); + + SPEX(tempthresh, SSB_SPROM11_THERMAL, SSB_SPROM8_THERMAL_TRESH, + SSB_SPROM8_THERMAL_TRESH_SHIFT); + SPEX(tempoffset, SSB_SPROM11_THERMAL, SSB_SPROM8_THERMAL_OFFSET, + SSB_SPROM8_THERMAL_OFFSET_SHIFT); + SPEX(rawtempsense, SSB_SPROM11_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP, + SSB_SPROM8_RAWTS_RAWTEMP_SHIFT); + SPEX(measpower, SSB_SPROM11_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER, + SSB_SPROM8_RAWTS_MEASPOWER_SHIFT); + SPEX(tempsense_slope, SSB_SPROM11_OPT_CORRX, + SSB_SPROM8_OPT_CORRX_TEMP_SLOPE, + SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT); + SPEX(tempcorrx, SSB_SPROM11_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX, + SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT); + SPEX(tempsense_option, SSB_SPROM11_OPT_CORRX, + SSB_SPROM8_OPT_CORRX_TEMP_OPTION, + SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT); + SPEX(phycal_tempdelta, SSB_SPROM11_TEMPDELTA, + SSB_SPROM8_TEMPDELTA_PHYCAL, + SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT); + SPEX(temps_period, SSB_SPROM11_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD, + SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT); + SPEX(temps_hysteresis, SSB_SPROM11_TEMPDELTA, + SSB_SPROM8_TEMPDELTA_HYSTERESIS, + SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT); + + / Whole dB in bits [5:0], sign-extended, quarter dB in bits [7:6]. / + for (i = 0; i < 2; i++) { + u8 raw = i ? (sprom[SSB_SPROM11_AGBG2A0 / 2] >> 8) & 0xff + : sprom[SSB_SPROM11_AGBG10 / 2] & 0xff; + s8 gain = (s8)((raw & 0x3f) << 2) >> 2; + + bus->sprom.antenna_gain_qdb[i] = (s8)(4 gain + (raw >> 6)); + } +} + /* * Indicates the presence of external SPROM. / @@ -640,8 +837,13 @@ int bcma_sprom_get(struct bcma_bus bus) bcma_warn(bus, "Invalid SPROM read from the PCIe card, trying to use fallback SPROM\n"); err = bcma_fill_sprom_with_fallback(bus, &bus->sprom); } else { - bcma_sprom_extract_r8(bus, sprom); + if (bus->sprom.revision == 11) + bcma_sprom_extract_r11(bus, sprom); + else + bcma_sprom_extract_r8(bus, sprom); kfree(sprom); + /* Most hosts have no NVRAM: ignore the result. / + bcm47xx_sprom_fill_bcma_nvram(bus, &bus->sprom); } return err; diff --git a/drivers/firmware/broadcom/bcm47xx_sprom.c b/drivers/firmware/broadcom/bcm47xx_sprom.c index bca03fd8580865..581dd867d68324 100644 --- a/drivers/firmware/broadcom/bcm47xx_sprom.c +++ b/drivers/firmware/broadcom/bcm47xx_sprom.c @@ -29,6 +29,7 @@ #include <linux/bcm47xx_nvram.h> #include <linux/bcm47xx_sprom.h> #include <linux/bcma/bcma.h> +#include <linux/err.h> #include <linux/etherdevice.h> #include <linux/hex.h> #include <linux/if_ether.h> @@ -172,6 +173,52 @@ static void nvram_read_alpha2(const char prefix, const char name, memcpy(val, buf, 2); } +/ + * AvVmid_c<core>: Av,Vmid of the chain's power detector for 2g, 5gl, 5gml, + * 5gmu and 5gh. The chain is marked valid only if all ten values parse. + / +static void nvram_read_avvmid(const char prefix, int core, + struct ssb_sprom sprom, bool fallback) +{ + char name[sizeof("AvVmid_c0")]; + char buf[64], p = buf, tok; + u8 v[10]; + int n = 0; + + snprintf(name, sizeof(name), "AvVmid_c%d", core); + if (get_nvram_var(prefix, NULL, name, buf, sizeof(buf), fallback) < 0) + return; + while (n < ARRAY_SIZE(v) && (tok = strsep(&p, ",")) != NULL) { + if (kstrtou8(strim(tok), 0, &v[n])) + return; + n++; + } + if (n != ARRAY_SIZE(v)) + return; + memcpy(sprom->avvmid[core], v, sizeof(v)); + sprom->avvmid_valid \|= BIT(core); +} + +/ Variables read from NVRAM whether or not the SPROM itself comes from it. / +static void bcm47xx_sprom_fill_nvram_only(struct ssb_sprom sprom, + const char prefix, bool fallback) +{ + char name[sizeof("ledbh15")]; + int i; + + for (i = 0; i < ARRAY_SIZE(sprom->gpio_ext); i++) { + snprintf(name, sizeof(name), "ledbh%d", i + 4); + nvram_read_u8(prefix, NULL, name, &sprom->gpio_ext[i], 0xff, + fallback); + } + + nvram_read_u32(prefix, NULL, "boardflags3", &sprom->boardflags3, 0, + fallback); + sprom->avvmid_valid = 0; + for (i = 0; i < ARRAY_SIZE(sprom->avvmid); i++) + nvram_read_avvmid(prefix, i, sprom, fallback); +} + / This is one-function-only macro, it uses local "sprom" variable! / #define ENTRY(_revmask, _type, _prefix, _name, _val, _allset, _fallback) \ if (_revmask & BIT(sprom->revision)) \ @@ -209,6 +256,8 @@ static void bcm47xx_sprom_fill_auto(struct ssb_sprom sprom, ENTRY(0xfffffffe, u8, pre, "ledbh1", gpio1, 0xff, fb); ENTRY(0xfffffffe, u8, pre, "ledbh2", gpio2, 0xff, fb); ENTRY(0xfffffffe, u8, pre, "ledbh3", gpio3, 0xff, fb); + if (sprom->revision) + bcm47xx_sprom_fill_nvram_only(sprom, pre, fb); ENTRY(0x0000070e, u16, pre, "pa0b0", pa0b0, 0, fb); ENTRY(0x0000070e, u16, pre, "pa0b1", pa0b1, 0, fb); @@ -647,45 +696,70 @@ static void bcm47xx_sprom_apply_prefix_alias(char prefix, size_t prefix_size) } } -static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom out) +/ + * The NVRAM prefix of a bcma bus's variables: pci/<bus>/<slot>/ or its + * devpathN alias for a PCI device, sb/<core>/ for the SoC's own core. + * Returns the prefix, NULL for a SoC bus without an 802.11 core, or an + * error pointer for a host type NVRAM knows nothing about. fallback is + set when the caller may fall back to unprefixed variables. + / +static char bcm47xx_sprom_bcma_prefix(struct bcma_bus bus, char buf, + size_t size, bool fallback) { - struct bcma_boardinfo binfo = &bus->boardinfo; struct bcma_device core; - char buf[10]; - char prefix; - bool fallback = false; + fallback = false; switch (bus->hosttype) { case BCMA_HOSTTYPE_PCI: - memset(out, 0, sizeof(struct ssb_sprom)); / On BCM47XX all PCI buses share the same domain / if (IS_ENABLED(CONFIG_BCM47XX)) - snprintf(buf, sizeof(buf), "pci/%u/%u/", + snprintf(buf, size, "pci/%u/%u/", bus->host_pci->bus->number + 1, PCI_SLOT(bus->host_pci->devfn)); else - snprintf(buf, sizeof(buf), "pci/%u/%u/", + snprintf(buf, size, "pci/%u/%u/", pci_domain_nr(bus->host_pci->bus) + 1, bus->host_pci->bus->number); - bcm47xx_sprom_apply_prefix_alias(buf, sizeof(buf)); - prefix = buf; - break; + bcm47xx_sprom_apply_prefix_alias(buf, size); + return buf; case BCMA_HOSTTYPE_SOC: - memset(out, 0, sizeof(struct ssb_sprom)); core = bcma_find_core(bus, BCMA_CORE_80211); - if (core) { - snprintf(buf, sizeof(buf), "sb/%u/", - core->core_index); - prefix = buf; - fallback = true; - } else { - prefix = NULL; - } - break; + if (!core) + return NULL; + snprintf(buf, size, "sb/%u/", core->core_index); + fallback = true; + return buf; default: + return ERR_PTR(-EINVAL); + } +} + +int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out) +{ + char buf[10]; + char prefix; + bool fallback; + + prefix = bcm47xx_sprom_bcma_prefix(bus, buf, sizeof(buf), &fallback); + if (IS_ERR(prefix)) + return PTR_ERR(prefix); + bcm47xx_sprom_fill_nvram_only(out, prefix, fallback); + return 0; +} + +static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom out) +{ + struct bcma_boardinfo binfo = &bus->boardinfo; + char buf[10]; + char prefix; + bool fallback; + + prefix = bcm47xx_sprom_bcma_prefix(bus, buf, sizeof(buf), &fallback); + if (IS_ERR(prefix)) { pr_warn("Unable to fill SPROM for given bustype.\n"); - return -EINVAL; + return PTR_ERR(prefix); } + memset(out, 0, sizeof(struct ssb_sprom)); nvram_read_u16(prefix, NULL, "boardvendor", &binfo->vendor, 0, true); if (!binfo->vendor) diff --git a/include/linux/bcm47xx_sprom.h b/include/linux/bcm47xx_sprom.h index 40a7da3ef50e61..47e9922ec890c4 100644 --- a/include/linux/bcm47xx_sprom.h +++ b/include/linux/bcm47xx_sprom.h @@ -9,6 +9,7 @@ #include <linux/types.h> #include <linux/vmalloc.h> +struct bcma_bus; struct ssb_sprom; #ifdef CONFIG_BCM47XX_SPROM @@ -28,4 +29,18 @@ static inline int bcm47xx_sprom_register_fallbacks(void) }; #endif +/ + * Fill the NVRAM-only variables of a bcma bus whose SPROM was read from the + * device. Like the SPROM fallback, only with bcma built in. + / +#if defined(CONFIG_BCM47XX_SPROM) && IS_BUILTIN(CONFIG_BCMA) +int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out); +#else +static inline int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, + struct ssb_sprom out) +{ + return -EOPNOTSUPP; +} +#endif + #endif / __BCM47XX_SPROM_H / diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h index 0cb6638b55e54c..b761801d6356ab 100644 --- a/include/linux/bcma/bcma_driver_chipcommon.h +++ b/include/linux/bcma/bcma_driver_chipcommon.h @@ -54,6 +54,7 @@ #define BCMA_CC_CORECTL 0x0008 #define BCMA_CC_CORECTL_UARTCLK0 0x00000001 / Drive UART with internal clock / #define BCMA_CC_CORECTL_SE 0x00000002 / sync clk out enable (corerev >= 3) / +#define BCMA_CC_CORECTL_ASYNCGPIO 0x00000004 / GPIO IRQs without backplane clock / #define BCMA_CC_CORECTL_UARTCLKEN 0x00000008 / UART clock enable (rev >= 21) / #define BCMA_CC_BIST 0x000C #define BCMA_CC_OTPS 0x0010 / OTP status / @@ -107,6 +108,8 @@ #define BCMA_CC_CHIPST_4706_PCIE1_DISABLE BIT(5) / PCIE1 enable strap pin / #define BCMA_CC_CHIPST_5357_NAND_BOOT BIT(4) / NAND boot, valid for CC rev 38 and/or BCM5357 / #define BCMA_CC_CHIPST_4360_XTAL_40MZ 0x00000001 +#define BCMA_CC_CHIPST_4360_RSRC_INIT_MODE0 0x00000020 +#define BCMA_CC_CHIPST_4360_MODE_USB 0x00000100 #define BCMA_CC_JCMD 0x0030 / Rev >= 10 only / #define BCMA_CC_JCMD_START 0x80000000 #define BCMA_CC_JCMD_BUSY 0x80000000 @@ -500,6 +503,8 @@ #define BCMA_CC_PMU_PLL_CTL3 3 #define BCMA_CC_PMU_PLL_CTL4 4 #define BCMA_CC_PMU_PLL_CTL5 5 +#define BCMA_CC_PMU_PLL_CTL6 6 +#define BCMA_CC_PMU_PLL_CTL14 14 #define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK 0x00f00000 #define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT 20 diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h index 67cb66f6f5ed6d..5a4daa76dfaaad 100644 --- a/include/linux/ssb/ssb.h +++ b/include/linux/ssb/ssb.h @@ -23,6 +23,19 @@ struct ssb_sprom_core_pwr_info { u8 itssi_2g, itssi_5g; u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh; u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4]; + + / SROM rev 11 / + u8 maxp2ga; + u8 maxp5ga[4]; + u16 pa2ga[3]; + u16 pa5ga[12]; +}; + +/ Rx gain settings of a band, indexed by chain. SROM rev 11. / +struct ssb_sprom_rxgains { + u8 elnagain[3]; + u8 triso[3]; + u8 trelnabyp[3]; }; struct ssb_sprom { @@ -63,6 +76,10 @@ struct ssb_sprom { u8 gpio1; / GPIO pin 1 / u8 gpio2; / GPIO pin 2 / u8 gpio3; / GPIO pin 3 / + u8 gpio_ext[12]; / GPIO pins 4-15, NVRAM ledbh4-15 only / + / NVRAM AvVmid_c0..2: {Av, Vmid} for 2g, 5gl, 5gml, 5gmu, 5gh / + u8 avvmid[3][5][2]; + u8 avvmid_valid; / bit per chain whose AvVmid_cN parsed / u8 maxpwr_bg; / 2.4GHz Amplifier Max Power (in dBm Q5.2) / u8 maxpwr_al; / 5.2GHz Amplifier Max Power (in dBm Q5.2) / u8 maxpwr_a; / 5.3GHz Amplifier Max Power (in dBm Q5.2) / @@ -192,6 +209,51 @@ struct ssb_sprom { u16 legofdm40duppo; u8 sar2g; u8 sar5g; + + / SROM rev 11 only. / + struct ssb_sprom_rxgains rxgains_2g; + struct ssb_sprom_rxgains rxgains_5gl; + struct ssb_sprom_rxgains rxgains_5gm; + struct ssb_sprom_rxgains rxgains_5gh; + u8 subband5gver; + / Antenna gain, quarter dB: [0] agbg0 (2.4 GHz), [1] aga0 (5 GHz). / + s8 antenna_gain_qdb[2]; + u16 dot11agofdmhrbw202gpo; + u16 ofdmlrbw202gpo; + u32 mcsbw805glpo; + u32 mcsbw805gmpo; + u32 mcsbw805ghpo; + / TX beamforming RX path calibration, 5 GHz in l, m, h, u order. / + u16 rpcal2g; + u16 rpcal5gb[4]; + u16 pdoffset40ma[3]; + u16 pdoffset80ma[3]; + / Per-rate-group power offsets, nibbles; [i] is 5 GHz l/m/h. / + u16 mcslr5gpo[3]; + u16 sb20in40hrpo; + u16 sb20in40lrpo; + u16 sb20in80and160hr5gpo[3]; + u16 sb20in80and160lr5gpo[3]; + u16 sb40and80hr5gpo[3]; + u16 sb40and80lr5gpo[3]; + u16 dot11agduphrpo; + u16 dot11agduplrpo; + / FEM configuration; femctrl selects the FEM control scheme. / + u8 tssiposslope2g; + u8 epagain2g; + u8 pdgain2g; + u8 tworangetssi2g; + u8 papdcap2g; + u8 femctrl; + u8 tssiposslope5g; + u8 epagain5g; + u8 pdgain5g; + u8 tworangetssi5g; + u8 papdcap5g; + u8 gainctrlsph; + / TSSI floor, 0x3ff when not programmed. / + u16 tssifloor2g; + u16 tssifloor5g[4]; }; / Information about the PCB the circuitry is soldered on. / diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h index 210f4649406502..12fa55e9188d95 100644 --- a/include/linux/ssb/ssb_regs.h +++ b/include/linux/ssb/ssb_regs.h @@ -606,6 +606,100 @@ #define SSB_SPROM8_BW40PO 0x0196 #define SSB_SPROM8_BWDUPPO 0x0198 +/ SROM revision 11. Header fields use the SSB_SPROM8 masks and shifts. / +#define SSB_SPROM11_BFL3 0x008C / boardflags3, 32 bits / +#define SSB_SPROM11_IL0MAC 0x0090 / 6 byte MAC address / +#define SSB_SPROM11_CCODE 0x0096 / 2 byte country code / +#define SSB_SPROM11_GPIOA 0x009A / ledbh0 low byte, ledbh1 high / +#define SSB_SPROM11_GPIOB 0x009C / ledbh2 low byte, ledbh3 high / +#define SSB_SPROM11_ANTAVAIL 0x00A0 +#define SSB_SPROM11_AGBG10 0x00A2 / agbg0 low byte, agbg1 high / +#define SSB_SPROM11_AGBG2A0 0x00A4 / agbg2 low byte, aga0 high / +#define SSB_SPROM11_AGA21 0x00A6 / aga1 low byte, aga2 high / +#define SSB_SPROM11_TXRXC 0x00A8 +/ FEM configuration, CFG1 for 2.4 GHz and CFG2 for 5 GHz. / +#define SSB_SPROM11_FEM_CFG1 0x00AA +#define SSB_SPROM11_FEM_CFG2 0x00AC +#define SSB_SPROM11_FEM_TSSIPOSSLOPE 0x0001 +#define SSB_SPROM11_FEM_EPAGAIN 0x000E +#define SSB_SPROM11_FEM_EPAGAIN_SHIFT 1 +#define SSB_SPROM11_FEM_PDGAIN 0x01F0 +#define SSB_SPROM11_FEM_PDGAIN_SHIFT 4 +#define SSB_SPROM11_FEM_TWORANGETSSI 0x0200 +#define SSB_SPROM11_FEM_TWORANGETSSI_SHIFT 9 +#define SSB_SPROM11_FEM_PAPDCAP 0x0400 +#define SSB_SPROM11_FEM_PAPDCAP_SHIFT 10 +#define SSB_SPROM11_FEM_CTRL 0xF800 / CFG1: femctrl / +#define SSB_SPROM11_FEM_CTRL_SHIFT 11 +#define SSB_SPROM11_FEM_GAINCTRLSPH 0xF800 / CFG2: gainctrlsph / +#define SSB_SPROM11_FEM_GAINCTRLSPH_SHIFT 11 +/ Temperature words, with the SSB_SPROM8 layout. / +#define SSB_SPROM11_THERMAL 0x00AE +#define SSB_SPROM11_RAWTS 0x00B0 +#define SSB_SPROM11_OPT_CORRX 0x00B2 +#define SSB_SPROM11_TEMPDELTA 0x00B8 +/ TSSI floor: 2.4 GHz, then 5 GHz l, m, h, u. / +#define SSB_SPROM11_TSSIFLOOR_2G 0x00BE +#define SSB_SPROM11_TSSIFLOOR_5GL 0x00C0 +#define SSB_SPROM11_TSSIFLOOR_MASK 0x03FF +#define SSB_SPROM11_PDOFFSET40MA 0x00CA / 3 x u16, one per chain / +#define SSB_SPROM11_PDOFFSET80MA 0x00D0 / 3 x u16, one per chain / +#define SSB_SPROM11_SUBBAND5GVER 0x00D6 + +/ Per-chain power info blocks, 0x28 bytes apart; SSB_SPROM11_PWR_* are + * offsets within a block. + / +#define SSB_SPROM11_PWR_INFO_CORE0 0x00D8 +#define SSB_SPROM11_PWR_INFO_CORE1 0x0100 +#define SSB_SPROM11_PWR_INFO_CORE2 0x0128 + +#define SSB_SPROM11_PWR_MAXP2GA 0x0000 / u8 in low byte / +#define SSB_SPROM11_PWR_PA2GA 0x0002 / 3 x u16 / +#define SSB_SPROM11_PWR_RXGAINS0 0x0008 / 5gm (lo) / 5gh (hi) / +#define SSB_SPROM11_PWR_RXGAINS1 0x000A / 2g (lo) / 5gl (hi) / +#define SSB_SPROM11_PWR_MAXP5GA 0x000C / 2 x u16 -> 4 x u8 / +#define SSB_SPROM11_PWR_PA5GA 0x0010 / 12 x u16 / + +#define SSB_SPROM11_CCKBW202GPO 0x0150 +#define SSB_SPROM11_CCKBW20UL2GPO 0x0152 +#define SSB_SPROM11_MCSBW202GPO 0x0154 +#define SSB_SPROM11_MCSBW402GPO 0x0158 +#define SSB_SPROM11_DOT11AGOFDMHRBW202GPO 0x015C +#define SSB_SPROM11_OFDMLRBW202GPO 0x015E +#define SSB_SPROM11_MCSBW205GLPO 0x0160 +#define SSB_SPROM11_MCSBW405GLPO 0x0164 +#define SSB_SPROM11_MCSBW805GLPO 0x0168 +#define SSB_SPROM11_RPCAL_2G 0x016C +#define SSB_SPROM11_RPCAL_5GL 0x016E +#define SSB_SPROM11_MCSBW205GMPO 0x0170 +#define SSB_SPROM11_MCSBW405GMPO 0x0174 +#define SSB_SPROM11_MCSBW805GMPO 0x0178 +#define SSB_SPROM11_RPCAL_5GM 0x017C +#define SSB_SPROM11_RPCAL_5GH 0x017E +#define SSB_SPROM11_MCSBW205GHPO 0x0180 +#define SSB_SPROM11_MCSBW405GHPO 0x0184 +#define SSB_SPROM11_MCSBW805GHPO 0x0188 +#define SSB_SPROM11_RPCAL_5GU 0x018C +#define SSB_SPROM11_MCSLR5GLPO 0x0190 +#define SSB_SPROM11_MCSLR5GMPO 0x0192 +#define SSB_SPROM11_MCSLR5GHPO 0x0194 +#define SSB_SPROM11_SB20IN40HRPO 0x0196 +#define SSB_SPROM11_SB20IN80AND160HR5GLPO 0x0198 +#define SSB_SPROM11_SB40AND80HR5GLPO 0x019A +#define SSB_SPROM11_SB20IN80AND160HR5GMPO 0x019C +#define SSB_SPROM11_SB40AND80HR5GMPO 0x019E +#define SSB_SPROM11_SB20IN80AND160HR5GHPO 0x01A0 +#define SSB_SPROM11_SB40AND80HR5GHPO 0x01A2 +#define SSB_SPROM11_SB20IN40LRPO 0x01A4 +#define SSB_SPROM11_SB20IN80AND160LR5GLPO 0x01A6 +#define SSB_SPROM11_SB40AND80LR5GLPO 0x01A8 +#define SSB_SPROM11_SB20IN80AND160LR5GMPO 0x01AA +#define SSB_SPROM11_SB40AND80LR5GMPO 0x01AC +#define SSB_SPROM11_SB20IN80AND160LR5GHPO 0x01AE +#define SSB_SPROM11_SB40AND80LR5GHPO 0x01B0 +#define SSB_SPROM11_DOT11AGDUPHRPO 0x01B2 +#define SSB_SPROM11_DOT11AGDUPLRPO 0x01B4 + / Values for boardflags_lo read from SPROM / #define SSB_BFL_BTCOEXIST 0x0001 / implements Bluetooth coexistance / #define SSB_BFL_PACTRL 0x0002 / GPIO 9 controlling the PA */
3/2	2026/10/27 03:30	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 18042 output: 29 thoughts: 548 Thoughts: Analyzing the BCMA Patch for Syzkaller Fuzzing Potential Okay, so I've got this patch in front of me, and my initial thought is, "Does this warrant a syzkaller fuzzing campaign?" First, I need to understand what this `bcma` thing is. Right, Broadcom's bus architecture, used in their Wi-Fi and Bluetooth combo chips. Makes sense. It looks like the patch touches a bunch of driver files related to the BCMA bus, including core components, chip-specific drivers, and SPROM handling – it's all in the `drivers/bcma/` directory. The most important question right now is how accessible this code is. Is it hardware-specific, tied to a particular PCIe card or SoC? Or is there some emulation or virtual bus path that I can leverage? My mental checklist immediately goes to Section 2 of the syzkaller instructions. Specifically, I need to avoid structurally unreachable hardware. I need to figure out if BCMA falls into the category of "vendor-specific PCIe switches" that aren't emulated well in standard QEMU. That's a red flag. On the other hand, if it were something like a virtual bus, this could be a great target. My focus has to shift from "what is the code?" to "how is it reached?" Let's see... how is `bcma` and `bcm47xx_sprom` initialized? Can I trigger this from userspace? Or even from within a virtual environment? I need to look for sysfs attributes, debugfs entries, anything that hints at user accessibility. I'm going to run `grepper` (or whatever the tool is at hand) to search these files, starting with the drivers in `bcma` and `bcm47xx_sprom`, or I'm just going to read the code directly. That's the best way to determine if this is worth more of my time.
4/2	2026/10/27 03:30	tool	grepper	0m Args: { "Expression": "bcma_", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "\nFull output is too long, showing 200 out of 3387 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (19 files in total):\ndrivers/bcma/bcma_private.h:72\ndrivers/bcma/core.c:43\ndrivers/bcma/driver_chipcommon.c:93\ndrivers/bcma/driver_chipcommon_b.c:10\ndrivers/bcma/driver_chipcommon_nflash.c:12\ndrivers/bcma/driver_chipcommon_pflash.c:14\ndrivers/bcma/driver_chipcommon_pmu.c:170\ndrivers/bcma/driver_chipcommon_sflash.c:36\ndrivers/bcma/driver_gmac_cmn.c:2\ndrivers/bcma/driver_gpio.c:69\ndrivers/bcma/driver_mips.c:97\ndrivers/bcma/driver_pci.c:46\ndrivers/bcma/driver_pci_host.c:70\ndrivers/bcma/driver_pcie2.c:22\ndrivers/bcma/host_pci.c:76\ndrivers/bcma/host_soc.c:48\ndrivers/bcma/main.c:161\ndrivers/bcma/scan.c:77\ndrivers/bcma/sprom.c:51\n\ndrivers/bcma/bcma_private.h-11-\ndrivers/bcma/bcma_private.h:12:#define bcma_err(bus, fmt, ...) \\\ndrivers/bcma/bcma_private.h-13-\tdev_err((bus)-\u003edev, \"bus%d: \" fmt, (bus)-\u003enum, ##__VA_ARGS__)\ndrivers/bcma/bcma_private.h:14:#define bcma_warn(bus, fmt, ...) \\\ndrivers/bcma/bcma_private.h-15-\tdev_warn((bus)-\u003edev, \"bus%d: \" fmt, (bus)-\u003enum, ##__VA_ARGS__)\ndrivers/bcma/bcma_private.h:16:#define bcma_info(bus, fmt, ...) \\\ndrivers/bcma/bcma_private.h-17-\tdev_info((bus)-\u003edev, \"bus%d: \" fmt, (bus)-\u003enum, ##__VA_ARGS__)\ndrivers/bcma/bcma_private.h:18:#define bcma_debug(bus, fmt, ...) \\\ndrivers/bcma/bcma_private.h-19-\tdev_dbg((bus)-\u003edev, \"bus%d: \" fmt, (bus)-\u003enum, ##__VA_ARGS__)\ndrivers/bcma/bcma_private.h-20-\ndrivers/bcma/bcma_private.h:21:struct bcma_bus;\ndrivers/bcma/bcma_private.h-22-\ndrivers/bcma/bcma_private.h-23-/* main.c /\ndrivers/bcma/bcma_private.h:24:bool bcma_wait_value(struct bcma_device core, u16 reg, u32 mask, u32 value,\ndrivers/bcma/bcma_private.h-25-\t\t int timeout);\ndrivers/bcma/bcma_private.h:26:void bcma_prepare_core(struct bcma_bus bus, struct bcma_device core);\ndrivers/bcma/bcma_private.h:27:void bcma_init_bus(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:28:void bcma_unregister_cores(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:29:int bcma_bus_register(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:30:void bcma_bus_unregister(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:31:int __init bcma_bus_early_register(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-32-#ifdef CONFIG_PM\ndrivers/bcma/bcma_private.h:33:int bcma_bus_suspend(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:34:int bcma_bus_resume(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-35-#endif\n--\ndrivers/bcma/bcma_private.h-37-/ scan.c /\ndrivers/bcma/bcma_private.h:38:void bcma_detect_chip(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:39:int bcma_bus_scan(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-40-\ndrivers/bcma/bcma_private.h-41-/ sprom.c /\ndrivers/bcma/bcma_private.h:42:int bcma_sprom_get(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-43-\ndrivers/bcma/bcma_private.h-44-/* driver_chipcommon.c /\ndrivers/bcma/bcma_private.h:45:void bcma_core_chipcommon_early_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:46:void bcma_core_chipcommon_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:47:void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc cc, bool enable);\ndrivers/bcma/bcma_private.h-48-#ifdef CONFIG_BCMA_DRIVER_MIPS\ndrivers/bcma/bcma_private.h:49:void bcma_chipco_serial_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h-50-#endif / CONFIG_BCMA_DRIVER_MIPS /\n--\ndrivers/bcma/bcma_private.h-52-/ driver_chipcommon_b.c /\ndrivers/bcma/bcma_private.h:53:int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b ccb);\ndrivers/bcma/bcma_private.h:54:void bcma_core_chipcommon_b_free(struct bcma_drv_cc_b ccb);\ndrivers/bcma/bcma_private.h-55-\ndrivers/bcma/bcma_private.h-56-/ driver_chipcommon_pmu.c /\ndrivers/bcma/bcma_private.h:57:void bcma_pmu_early_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:58:void bcma_pmu_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:59:u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:60:u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h-61-\n--\ndrivers/bcma/bcma_private.h-66-#ifdef CONFIG_BCMA_PFLASH\ndrivers/bcma/bcma_private.h:67:extern struct platform_device bcma_pflash_dev;\ndrivers/bcma/bcma_private.h:68:int bcma_pflash_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h-69-#else\ndrivers/bcma/bcma_private.h:70:static inline int bcma_pflash_init(struct bcma_drv_cc cc)\ndrivers/bcma/bcma_private.h-71-{\ndrivers/bcma/bcma_private.h:72:\tbcma_err(cc-\u003ecore-\u003ebus, \"Parallel flash not supported\\n\");\ndrivers/bcma/bcma_private.h-73-\treturn 0;\n--\ndrivers/bcma/bcma_private.h-78-/ driver_chipcommon_sflash.c /\ndrivers/bcma/bcma_private.h:79:int bcma_sflash_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:80:extern struct platform_device bcma_sflash_dev;\ndrivers/bcma/bcma_private.h-81-#else\ndrivers/bcma/bcma_private.h:82:static inline int bcma_sflash_init(struct bcma_drv_cc cc)\ndrivers/bcma/bcma_private.h-83-{\ndrivers/bcma/bcma_private.h:84:\tbcma_err(cc-\u003ecore-\u003ebus, \"Serial flash not supported\\n\");\ndrivers/bcma/bcma_private.h-85-\treturn 0;\n--\ndrivers/bcma/bcma_private.h-90-/ driver_chipcommon_nflash.c /\ndrivers/bcma/bcma_private.h:91:int bcma_nflash_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:92:extern struct platform_device bcma_nflash_dev;\ndrivers/bcma/bcma_private.h-93-#else\ndrivers/bcma/bcma_private.h:94:static inline int bcma_nflash_init(struct bcma_drv_cc cc)\ndrivers/bcma/bcma_private.h-95-{\ndrivers/bcma/bcma_private.h:96:\tbcma_err(cc-\u003ecore-\u003ebus, \"NAND flash not supported\\n\");\ndrivers/bcma/bcma_private.h-97-\treturn 0;\n--\ndrivers/bcma/bcma_private.h-102-/ host_pci.c /\ndrivers/bcma/bcma_private.h:103:extern int __init bcma_host_pci_init(void);\ndrivers/bcma/bcma_private.h:104:extern void __exit bcma_host_pci_exit(void);\ndrivers/bcma/bcma_private.h-105-#endif / CONFIG_BCMA_HOST_PCI /\n--\ndrivers/bcma/bcma_private.h-108-#if defined(CONFIG_BCMA_HOST_SOC) \u0026\u0026 defined(CONFIG_OF)\ndrivers/bcma/bcma_private.h:109:extern int __init bcma_host_soc_register_driver(void);\ndrivers/bcma/bcma_private.h:110:extern void __exit bcma_host_soc_unregister_driver(void);\ndrivers/bcma/bcma_private.h-111-#else\ndrivers/bcma/bcma_private.h:112:static inline int __init bcma_host_soc_register_driver(void)\ndrivers/bcma/bcma_private.h-113-{\n--\ndrivers/bcma/bcma_private.h-115-}\ndrivers/bcma/bcma_private.h:116:static inline void __exit bcma_host_soc_unregister_driver(void)\ndrivers/bcma/bcma_private.h-117-{\n--\ndrivers/bcma/bcma_private.h-122-#ifdef CONFIG_BCMA_DRIVER_PCI\ndrivers/bcma/bcma_private.h:123:u32 bcma_pcie_read(struct bcma_drv_pci pc, u32 address);\ndrivers/bcma/bcma_private.h:124:void bcma_core_pci_early_init(struct bcma_drv_pci pc);\ndrivers/bcma/bcma_private.h:125:void bcma_core_pci_init(struct bcma_drv_pci pc);\ndrivers/bcma/bcma_private.h:126:void bcma_core_pci_up(struct bcma_drv_pci pc);\ndrivers/bcma/bcma_private.h:127:void bcma_core_pci_down(struct bcma_drv_pci pc);\ndrivers/bcma/bcma_private.h-128-#else\ndrivers/bcma/bcma_private.h:129:static inline void bcma_core_pci_early_init(struct bcma_drv_pci pc)\ndrivers/bcma/bcma_private.h-130-{\n--\ndrivers/bcma/bcma_private.h-132-}\ndrivers/bcma/bcma_private.h:133:static inline void bcma_core_pci_init(struct bcma_drv_pci pc)\ndrivers/bcma/bcma_private.h-134-{\n--\ndrivers/bcma/bcma_private.h-141-#ifdef CONFIG_BCMA_DRIVER_PCI\ndrivers/bcma/bcma_private.h:142:void bcma_core_pcie2_init(struct bcma_drv_pcie2 pcie2);\ndrivers/bcma/bcma_private.h:143:void bcma_core_pcie2_up(struct bcma_drv_pcie2 pcie2);\ndrivers/bcma/bcma_private.h-144-#else\ndrivers/bcma/bcma_private.h:145:static inline void bcma_core_pcie2_init(struct bcma_drv_pcie2 pcie2)\ndrivers/bcma/bcma_private.h-146-{\n--\ndrivers/bcma/bcma_private.h-151-\ndrivers/bcma/bcma_private.h:152:extern int bcma_chipco_watchdog_register(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h-153-\ndrivers/bcma/bcma_private.h-154-#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE\ndrivers/bcma/bcma_private.h:155:bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci pc);\ndrivers/bcma/bcma_private.h:156:void bcma_core_pci_hostmode_init(struct bcma_drv_pci pc);\ndrivers/bcma/bcma_private.h-157-#else\ndrivers/bcma/bcma_private.h:158:static inline bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci pc)\ndrivers/bcma/bcma_private.h-159-{\n--\ndrivers/bcma/bcma_private.h-161-}\ndrivers/bcma/bcma_private.h:162:static inline void bcma_core_pci_hostmode_init(struct bcma_drv_pci pc)\ndrivers/bcma/bcma_private.h-163-{\n--\ndrivers/bcma/bcma_private.h-171-#ifdef CONFIG_BCMA_DRIVER_MIPS\ndrivers/bcma/bcma_private.h:172:unsigned int bcma_core_mips_irq(struct bcma_device dev);\ndrivers/bcma/bcma_private.h:173:void bcma_core_mips_early_init(struct bcma_drv_mips mcore);\ndrivers/bcma/bcma_private.h:174:void bcma_core_mips_init(struct bcma_drv_mips mcore);\ndrivers/bcma/bcma_private.h-175-#else\ndrivers/bcma/bcma_private.h:176:static inline unsigned int bcma_core_mips_irq(struct bcma_device dev)\ndrivers/bcma/bcma_private.h-177-{\n--\ndrivers/bcma/bcma_private.h-179-}\ndrivers/bcma/bcma_private.h:180:static inline void bcma_core_mips_early_init(struct bcma_drv_mips mcore)\ndrivers/bcma/bcma_private.h-181-{\ndrivers/bcma/bcma_private.h-182-}\ndrivers/bcma/bcma_private.h:183:static inline void bcma_core_mips_init(struct bcma_drv_mips mcore)\ndrivers/bcma/bcma_private.h-184-{\n--\ndrivers/bcma/bcma_private.h-192-#ifdef CONFIG_BCMA_DRIVER_GMAC_CMN\ndrivers/bcma/bcma_private.h:193:void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn gc);\ndrivers/bcma/bcma_private.h-194-#else\ndrivers/bcma/bcma_private.h:195:static inline void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn gc)\ndrivers/bcma/bcma_private.h-196-{\n--\ndrivers/bcma/bcma_private.h-201-/* driver_gpio.c /\ndrivers/bcma/bcma_private.h:202:int bcma_gpio_init(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h:203:int bcma_gpio_unregister(struct bcma_drv_cc cc);\ndrivers/bcma/bcma_private.h-204-#else\ndrivers/bcma/bcma_private.h:205:static inline int bcma_gpio_init(struct bcma_drv_cc cc)\ndrivers/bcma/bcma_private.h-206-{\n--\ndrivers/bcma/bcma_private.h-208-}\ndrivers/bcma/bcma_private.h:209:static inline int bcma_gpio_unregister(struct bcma_drv_cc cc)\ndrivers/bcma/bcma_private.h-210-{\n--\ndrivers/bcma/core.c-7-\ndrivers/bcma/core.c:8:#include \"bcma_private.h\"\ndrivers/bcma/core.c-9-#include \u003clinux/export.h\u003e\n--\ndrivers/bcma/core.c-11-\ndrivers/bcma/core.c:12:static bool bcma_core_wait_value(struct bcma_device core, u16 reg, u32 mask,\ndrivers/bcma/core.c-13-\t\t\t\t u32 value, int timeout)\n--\ndrivers/bcma/core.c-18-\tdo {\ndrivers/bcma/core.c:19:\t\tval = bcma_aread32(core, reg);\ndrivers/bcma/core.c-20-\t\tif ((val \u0026 mask) == value)\n--\ndrivers/bcma/core.c-25-\ndrivers/bcma/core.c:26:\tbcma_warn(core-\u003ebus, \"Timeout waiting for register 0x%04X!\\n\", reg);\ndrivers/bcma/core.c-27-\n--\ndrivers/bcma/core.c-30-\ndrivers/bcma/core.c:31:bool bcma_core_is_enabled(struct bcma_device core)\ndrivers/bcma/core.c-32-{\ndrivers/bcma/core.c:33:\tif ((bcma_aread32(core, BCMA_IOCTL) \u0026 (BCMA_IOCTL_CLK \| BCMA_IOCTL_FGC))\ndrivers/bcma/core.c-34-\t != BCMA_IOCTL_CLK)\ndrivers/bcma/core.c-35-\t\treturn false;\ndrivers/bcma/core.c:36:\tif (bcma_aread32(core, BCMA_RESET_CTL) \u0026 BCMA_RESET_CTL_RESET)\ndrivers/bcma/core.c-37-\t\treturn false;\n--\ndrivers/bcma/core.c-39-}\ndrivers/bcma/core.c:40:EXPORT_SYMBOL_GPL(bcma_core_is_enabled);\ndrivers/bcma/core.c-41-\ndrivers/bcma/core.c:42:void bcma_core_disable(struct bcma_device core, u32 flags)\ndrivers/bcma/core.c-43-{\ndrivers/bcma/core.c:44:\tif (bcma_aread32(core, BCMA_RESET_CTL) \u0026 BCMA_RESET_CTL_RESET)\ndrivers/bcma/core.c-45-\t\treturn;\ndrivers/bcma/core.c-46-\ndrivers/bcma/core.c:47:\tbcma_core_wait_value(core, BCMA_RESET_ST, ~0, 0, 300);\ndrivers/bcma/core.c-48-\ndrivers/bcma/core.c:49:\tbcma_awrite32(core, BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);\ndrivers/bcma/core.c:50:\tbcma_aread32(core, BCMA_RESET_CTL);\ndrivers/bcma/core.c-51-\tudelay(1);\n\n" }
5/2	2026/10/27 03:30	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 24426 output: 20 thoughts: 56 Thoughts: Here's my analysis of how `bcma` devices are instantiated, presented as a summary of my thought process: BCMA Device Instantiation Deep Dive Okay, so I need to understand how these `bcma` devices are brought to life. My initial instinct is to dig into the core registration process. I'm going to start by examining the callers of `bcma_bus_register`. That's where the magic probably happens. Specifically, I'll be focusing my attention on `drivers/bcma/host_pci.c` and `drivers/bcma/host_soc.c`. These seem like the most likely candidates, given their names; one deals with PCI host interfaces, the other with System-on-Chip (SoC) interfaces. I'll need to carefully dissect the code within those files, and any other places where `bcma_bus_register` is invoked, to trace the initialization flow. This should reveal the specific device detection, resource allocation, and ultimately, the driver attachment process for `bcma` devices. I'm expecting to find conditional logic and platform-specific code intertwined, but understanding this registration step is crucial for comprehending the entire `bcma` subsystem.
6/2	2026/10/27 03:30	tool	grepper	0m Args: { "Expression": "bcma_bus_register" } Results: { "Output": "arch/mips/bcm47xx/setup.c=259=static int __init bcm47xx_register_bus_complete(void)\n--\narch/mips/bcm47xx/setup.c-270-\t\t\tpr_err(\"Failed to register SoC device\\n\");\narch/mips/bcm47xx/setup.c:271:\t\tbcma_bus_register(\u0026bcm47xx_bus.bcma.bus);\narch/mips/bcm47xx/setup.c-272-\t\tbreak;\n--\ndrivers/bcma/bcma_private.h=28=void bcma_unregister_cores(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:29:int bcma_bus_register(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-30-void bcma_bus_unregister(struct bcma_bus bus);\n--\ndrivers/bcma/host_pci.c=160=static int bcma_host_pci_probe(struct pci_dev dev,\n--\ndrivers/bcma/host_pci.c-222-\t/* Register /\ndrivers/bcma/host_pci.c:223:\terr = bcma_bus_register(bus);\ndrivers/bcma/host_pci.c-224-\tif (err)\n--\ndrivers/bcma/host_soc.c=203=static int bcma_host_soc_probe(struct platform_device pdev)\n--\ndrivers/bcma/host_soc.c-229-\t/* Register /\ndrivers/bcma/host_soc.c:230:\terr = bcma_bus_register(bus);\ndrivers/bcma/host_soc.c-231-\tif (err)\n--\ndrivers/bcma/main.c=368=void bcma_unregister_cores(struct bcma_bus bus)\n--\ndrivers/bcma/main.c-387-\ndrivers/bcma/main.c:388:int bcma_bus_register(struct bcma_bus bus)\ndrivers/bcma/main.c-389-{\n--\ndrivers/bcma/main.c=637=static int bcma_device_uevent(const struct device dev, struct kobj_uevent_env env)\n--\ndrivers/bcma/main.c-646-\ndrivers/bcma/main.c:647:static unsigned int bcma_bus_registered;\ndrivers/bcma/main.c-648-\n--\ndrivers/bcma/main.c=654=static int __init bcma_init_bus_register(void)\n--\ndrivers/bcma/main.c-657-\ndrivers/bcma/main.c:658:\tif (bcma_bus_registered)\ndrivers/bcma/main.c-659-\t\treturn 0;\n--\ndrivers/bcma/main.c-662-\tif (!err)\ndrivers/bcma/main.c:663:\t\tbcma_bus_registered = 1;\ndrivers/bcma/main.c-664-\n--\ninclude/linux/bcma/bcma_soc.h=13=int __init bcma_host_soc_init(struct bcma_soc soc);\ninclude/linux/bcma/bcma_soc.h-14-\ninclude/linux/bcma/bcma_soc.h:15:int bcma_bus_register(struct bcma_bus *bus);\ninclude/linux/bcma/bcma_soc.h-16-\n" }
7/2	2026/10/27 03:30	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 25676 output: 33 thoughts: 123 Thoughts: Here's my analysis: Diving into the BCMA Architecture Okay, first things first, let's take a look at the landscape here. I see we're dealing with a Broadcom chipset, specifically the MIPS-based BCM47xx, given that `arch/mips/bcm47xx/setup.c` is on the scene. Interesting. Then there's the PCI implementation, as referenced in `drivers/bcma/host_pci.c`, which, from a quick glance at the code, appears to be using a table approach (`bcma_pci_bridge_tbl`) that's probably matching specific PCI device IDs. That's a classic approach for hardware detection. Finally, there's `drivers/bcma/host_soc.c`, which indicates a System-on-Chip (SoC) integration using an Open Firmware (OF) / Device Tree platform driver (`bcma_host_soc_probe`). Given that context, my initial hunch is that `drivers/bcma/host_soc.c` and `drivers/bcma/host_pci.c` are going to be where the core logic resides. I'm going to start by reviewing these two files; I'll expect to see how the BCMA bus is initialized in the PCI case, and how the OF/DT-based SoC setup happens. Likely, I'll see some differences in how resources are allocated and devices are enumerated depending on if it's a PCI-based system or a more integrated SoC configuration. Let's see how they handle bus initialization and device detection, and whether there's some common BCMA core code they both leverage.
8/2	2026/10/27 03:30	tool	grepper	0m Args: { "Expression": "bcma_host_soc_", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "drivers/bcma/bcma_private.h=104=extern void __exit bcma_host_pci_exit(void);\n--\ndrivers/bcma/bcma_private.h-108-#if defined(CONFIG_BCMA_HOST_SOC) \u0026\u0026 defined(CONFIG_OF)\ndrivers/bcma/bcma_private.h:109:extern int __init bcma_host_soc_register_driver(void);\ndrivers/bcma/bcma_private.h:110:extern void __exit bcma_host_soc_unregister_driver(void);\ndrivers/bcma/bcma_private.h-111-#else\ndrivers/bcma/bcma_private.h:112:static inline int __init bcma_host_soc_register_driver(void)\ndrivers/bcma/bcma_private.h-113-{\n--\ndrivers/bcma/bcma_private.h-115-}\ndrivers/bcma/bcma_private.h:116:static inline void __exit bcma_host_soc_unregister_driver(void)\ndrivers/bcma/bcma_private.h-117-{\n--\ndrivers/bcma/host_soc.c-15-\ndrivers/bcma/host_soc.c:16:static u8 bcma_host_soc_read8(struct bcma_device core, u16 offset)\ndrivers/bcma/host_soc.c-17-{\n--\ndrivers/bcma/host_soc.c-20-\ndrivers/bcma/host_soc.c:21:static u16 bcma_host_soc_read16(struct bcma_device core, u16 offset)\ndrivers/bcma/host_soc.c-22-{\n--\ndrivers/bcma/host_soc.c-25-\ndrivers/bcma/host_soc.c:26:static u32 bcma_host_soc_read32(struct bcma_device core, u16 offset)\ndrivers/bcma/host_soc.c-27-{\n--\ndrivers/bcma/host_soc.c-30-\ndrivers/bcma/host_soc.c:31:static void bcma_host_soc_write8(struct bcma_device core, u16 offset,\ndrivers/bcma/host_soc.c-32-\t\t\t\t u8 value)\n--\ndrivers/bcma/host_soc.c-36-\ndrivers/bcma/host_soc.c:37:static void bcma_host_soc_write16(struct bcma_device core, u16 offset,\ndrivers/bcma/host_soc.c-38-\t\t\t\t u16 value)\n--\ndrivers/bcma/host_soc.c-42-\ndrivers/bcma/host_soc.c:43:static void bcma_host_soc_write32(struct bcma_device core, u16 offset,\ndrivers/bcma/host_soc.c-44-\t\t\t\t u32 value)\n--\ndrivers/bcma/host_soc.c-49-#ifdef CONFIG_BCMA_BLOCKIO\ndrivers/bcma/host_soc.c:50:static void bcma_host_soc_block_read(struct bcma_device core, void buffer,\ndrivers/bcma/host_soc.c-51-\t\t\t\t size_t count, u16 offset, u8 reg_width)\n--\ndrivers/bcma/host_soc.c-92-\ndrivers/bcma/host_soc.c:93:static void bcma_host_soc_block_write(struct bcma_device core,\ndrivers/bcma/host_soc.c-94-\t\t\t\t const void buffer,\n--\ndrivers/bcma/host_soc.c-137-\ndrivers/bcma/host_soc.c:138:static u32 bcma_host_soc_aread32(struct bcma_device core, u16 offset)\ndrivers/bcma/host_soc.c-139-{\n--\ndrivers/bcma/host_soc.c-144-\ndrivers/bcma/host_soc.c:145:static void bcma_host_soc_awrite32(struct bcma_device core, u16 offset,\ndrivers/bcma/host_soc.c-146-\t\t\t\t u32 value)\n--\ndrivers/bcma/host_soc.c-152-\ndrivers/bcma/host_soc.c:153:static const struct bcma_host_ops bcma_host_soc_ops = {\ndrivers/bcma/host_soc.c:154:\t.read8\t\t= bcma_host_soc_read8,\ndrivers/bcma/host_soc.c:155:\t.read16\t\t= bcma_host_soc_read16,\ndrivers/bcma/host_soc.c:156:\t.read32\t\t= bcma_host_soc_read32,\ndrivers/bcma/host_soc.c:157:\t.write8\t\t= bcma_host_soc_write8,\ndrivers/bcma/host_soc.c:158:\t.write16\t= bcma_host_soc_write16,\ndrivers/bcma/host_soc.c:159:\t.write32\t= bcma_host_soc_write32,\ndrivers/bcma/host_soc.c-160-#ifdef CONFIG_BCMA_BLOCKIO\ndrivers/bcma/host_soc.c:161:\t.block_read\t= bcma_host_soc_block_read,\ndrivers/bcma/host_soc.c:162:\t.block_write\t= bcma_host_soc_block_write,\ndrivers/bcma/host_soc.c-163-#endif\ndrivers/bcma/host_soc.c:164:\t.aread32\t= bcma_host_soc_aread32,\ndrivers/bcma/host_soc.c:165:\t.awrite32\t= bcma_host_soc_awrite32,\ndrivers/bcma/host_soc.c-166-};\ndrivers/bcma/host_soc.c-167-\ndrivers/bcma/host_soc.c:168:int __init bcma_host_soc_register(struct bcma_soc soc)\ndrivers/bcma/host_soc.c-169-{\n--\ndrivers/bcma/host_soc.c-180-\tbus-\u003ehosttype = BCMA_HOSTTYPE_SOC;\ndrivers/bcma/host_soc.c:181:\tbus-\u003eops = \u0026bcma_host_soc_ops;\ndrivers/bcma/host_soc.c-182-\n--\ndrivers/bcma/host_soc.c-188-\ndrivers/bcma/host_soc.c:189:int __init bcma_host_soc_init(struct bcma_soc soc)\ndrivers/bcma/host_soc.c-190-{\n--\ndrivers/bcma/host_soc.c-202-#ifdef CONFIG_OF\ndrivers/bcma/host_soc.c:203:static int bcma_host_soc_probe(struct platform_device pdev)\ndrivers/bcma/host_soc.c-204-{\n--\ndrivers/bcma/host_soc.c-223-\tbus-\u003ehosttype = BCMA_HOSTTYPE_SOC;\ndrivers/bcma/host_soc.c:224:\tbus-\u003eops = \u0026bcma_host_soc_ops;\ndrivers/bcma/host_soc.c-225-\n--\ndrivers/bcma/host_soc.c-242-\ndrivers/bcma/host_soc.c:243:static void bcma_host_soc_remove(struct platform_device pdev)\ndrivers/bcma/host_soc.c-244-{\n--\ndrivers/bcma/host_soc.c-251-\ndrivers/bcma/host_soc.c:252:static const struct of_device_id bcma_host_soc_of_match[] = {\ndrivers/bcma/host_soc.c-253-\t{ .compatible = \"brcm,bus-axi\", },\n--\ndrivers/bcma/host_soc.c-255-};\ndrivers/bcma/host_soc.c:256:MODULE_DEVICE_TABLE(of, bcma_host_soc_of_match);\ndrivers/bcma/host_soc.c-257-\ndrivers/bcma/host_soc.c:258:static struct platform_driver bcma_host_soc_driver = {\ndrivers/bcma/host_soc.c-259-\t.driver = {\ndrivers/bcma/host_soc.c-260-\t\t.name = \"bcma-host-soc\",\ndrivers/bcma/host_soc.c:261:\t\t.of_match_table = bcma_host_soc_of_match,\ndrivers/bcma/host_soc.c-262-\t},\ndrivers/bcma/host_soc.c:263:\t.probe\t\t= bcma_host_soc_probe,\ndrivers/bcma/host_soc.c:264:\t.remove\t\t= bcma_host_soc_remove,\ndrivers/bcma/host_soc.c-265-};\ndrivers/bcma/host_soc.c-266-\ndrivers/bcma/host_soc.c:267:int __init bcma_host_soc_register_driver(void)\ndrivers/bcma/host_soc.c-268-{\ndrivers/bcma/host_soc.c:269:\treturn platform_driver_register(\u0026bcma_host_soc_driver);\ndrivers/bcma/host_soc.c-270-}\ndrivers/bcma/host_soc.c-271-\ndrivers/bcma/host_soc.c:272:void __exit bcma_host_soc_unregister_driver(void)\ndrivers/bcma/host_soc.c-273-{\ndrivers/bcma/host_soc.c:274:\tplatform_driver_unregister(\u0026bcma_host_soc_driver);\ndrivers/bcma/host_soc.c-275-}\n--\ndrivers/bcma/main.c=672=static int __init bcma_modinit(void)\n--\ndrivers/bcma/main.c-679-\ndrivers/bcma/main.c:680:\terr = bcma_host_soc_register_driver();\ndrivers/bcma/main.c-681-\tif (err) {\n--\ndrivers/bcma/main.c=697=static void __exit bcma_modexit(void)\n--\ndrivers/bcma/main.c-701-#endif\ndrivers/bcma/main.c:702:\tbcma_host_soc_unregister_driver();\ndrivers/bcma/main.c-703-\tbus_unregister(\u0026bcma_bus_type);\n" }
9/2	2026/10/27 03:30	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 28945 output: 34 thoughts: 17 Thoughts: Okay, let's dive in. Here's my thought process as I approach this: Analyzing `drivers/bcma/host_pci.c` Alright, I need to get a handle on what's going on with this Broadcom-specific code in relation to PCI host functionality. My initial thought is to go straight to the `drivers/bcma/host_pci.c` file. This is where I'd expect to find the core driver implementation for interacting with Broadcom chips over a PCI interface. Given the context, I'm expecting to find register access, interrupt handling, and maybe some initialization routines specific to the BCMA bus when it's operating in a PCI host environment. I'll need to look for PCI device probe and remove functions to get an idea of how devices are attached and detached. I'll be particularly interested in anything that diverges significantly from the standard PCI bus driver model, as that's where the BCMA-specific glue logic is likely to reside. Time to open the file and start digging.
10/2	2026/10/27 03:30	tool	grepper	0m Args: { "Expression": "bcma_host_pci_", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "drivers/bcma/bcma_private.h=94=static inline int bcma_nflash_init(struct bcma_drv_cc cc)\n--\ndrivers/bcma/bcma_private.h-102-/ host_pci.c /\ndrivers/bcma/bcma_private.h:103:extern int __init bcma_host_pci_init(void);\ndrivers/bcma/bcma_private.h:104:extern void __exit bcma_host_pci_exit(void);\ndrivers/bcma/bcma_private.h-105-#endif / CONFIG_BCMA_HOST_PCI /\n--\ndrivers/bcma/host_pci.c-13-\ndrivers/bcma/host_pci.c:14:static void bcma_host_pci_switch_core(struct bcma_device core)\ndrivers/bcma/host_pci.c-15-{\n--\ndrivers/bcma/host_pci.c-27- * used. It makes use of fixed windows when possible. /\ndrivers/bcma/host_pci.c:28:static u16 bcma_host_pci_provide_access_to_core(struct bcma_device core)\ndrivers/bcma/host_pci.c-29-{\n--\ndrivers/bcma/host_pci.c-37-\tif (core-\u003ebus-\u003emapped_core != core)\ndrivers/bcma/host_pci.c:38:\t\tbcma_host_pci_switch_core(core);\ndrivers/bcma/host_pci.c-39-\treturn 0;\n--\ndrivers/bcma/host_pci.c-41-\ndrivers/bcma/host_pci.c:42:static u8 bcma_host_pci_read8(struct bcma_device core, u16 offset)\ndrivers/bcma/host_pci.c-43-{\ndrivers/bcma/host_pci.c:44:\toffset += bcma_host_pci_provide_access_to_core(core);\ndrivers/bcma/host_pci.c-45-\treturn ioread8(core-\u003ebus-\u003emmio + offset);\n--\ndrivers/bcma/host_pci.c-47-\ndrivers/bcma/host_pci.c:48:static u16 bcma_host_pci_read16(struct bcma_device core, u16 offset)\ndrivers/bcma/host_pci.c-49-{\ndrivers/bcma/host_pci.c:50:\toffset += bcma_host_pci_provide_access_to_core(core);\ndrivers/bcma/host_pci.c-51-\treturn ioread16(core-\u003ebus-\u003emmio + offset);\n--\ndrivers/bcma/host_pci.c-53-\ndrivers/bcma/host_pci.c:54:static u32 bcma_host_pci_read32(struct bcma_device core, u16 offset)\ndrivers/bcma/host_pci.c-55-{\ndrivers/bcma/host_pci.c:56:\toffset += bcma_host_pci_provide_access_to_core(core);\ndrivers/bcma/host_pci.c-57-\treturn ioread32(core-\u003ebus-\u003emmio + offset);\n--\ndrivers/bcma/host_pci.c-59-\ndrivers/bcma/host_pci.c:60:static void bcma_host_pci_write8(struct bcma_device core, u16 offset,\ndrivers/bcma/host_pci.c-61-\t\t\t\t u8 value)\ndrivers/bcma/host_pci.c-62-{\ndrivers/bcma/host_pci.c:63:\toffset += bcma_host_pci_provide_access_to_core(core);\ndrivers/bcma/host_pci.c-64-\tiowrite8(value, core-\u003ebus-\u003emmio + offset);\n--\ndrivers/bcma/host_pci.c-66-\ndrivers/bcma/host_pci.c:67:static void bcma_host_pci_write16(struct bcma_device core, u16 offset,\ndrivers/bcma/host_pci.c-68-\t\t\t\t u16 value)\ndrivers/bcma/host_pci.c-69-{\ndrivers/bcma/host_pci.c:70:\toffset += bcma_host_pci_provide_access_to_core(core);\ndrivers/bcma/host_pci.c-71-\tiowrite16(value, core-\u003ebus-\u003emmio + offset);\n--\ndrivers/bcma/host_pci.c-73-\ndrivers/bcma/host_pci.c:74:static void bcma_host_pci_write32(struct bcma_device core, u16 offset,\ndrivers/bcma/host_pci.c-75-\t\t\t\t u32 value)\ndrivers/bcma/host_pci.c-76-{\ndrivers/bcma/host_pci.c:77:\toffset += bcma_host_pci_provide_access_to_core(core);\ndrivers/bcma/host_pci.c-78-\tiowrite32(value, core-\u003ebus-\u003emmio + offset);\n--\ndrivers/bcma/host_pci.c-81-#ifdef CONFIG_BCMA_BLOCKIO\ndrivers/bcma/host_pci.c:82:static void bcma_host_pci_block_read(struct bcma_device core, void buffer,\ndrivers/bcma/host_pci.c-83-\t\t\t\t size_t count, u16 offset, u8 reg_width)\n--\ndrivers/bcma/host_pci.c-86-\tif (core-\u003ebus-\u003emapped_core != core)\ndrivers/bcma/host_pci.c:87:\t\tbcma_host_pci_switch_core(core);\ndrivers/bcma/host_pci.c-88-\tswitch (reg_width) {\n--\ndrivers/bcma/host_pci.c-104-\ndrivers/bcma/host_pci.c:105:static void bcma_host_pci_block_write(struct bcma_device core,\ndrivers/bcma/host_pci.c-106-\t\t\t\t const void buffer, size_t count,\n--\ndrivers/bcma/host_pci.c-110-\tif (core-\u003ebus-\u003emapped_core != core)\ndrivers/bcma/host_pci.c:111:\t\tbcma_host_pci_switch_core(core);\ndrivers/bcma/host_pci.c-112-\tswitch (reg_width) {\n--\ndrivers/bcma/host_pci.c-129-\ndrivers/bcma/host_pci.c:130:static u32 bcma_host_pci_aread32(struct bcma_device core, u16 offset)\ndrivers/bcma/host_pci.c-131-{\ndrivers/bcma/host_pci.c-132-\tif (core-\u003ebus-\u003emapped_core != core)\ndrivers/bcma/host_pci.c:133:\t\tbcma_host_pci_switch_core(core);\ndrivers/bcma/host_pci.c-134-\treturn ioread32(core-\u003ebus-\u003emmio + (1 BCMA_CORE_SIZE) + offset);\n--\ndrivers/bcma/host_pci.c-136-\ndrivers/bcma/host_pci.c:137:static void bcma_host_pci_awrite32(struct bcma_device core, u16 offset,\ndrivers/bcma/host_pci.c-138-\t\t\t\t u32 value)\n--\ndrivers/bcma/host_pci.c-140-\tif (core-\u003ebus-\u003emapped_core != core)\ndrivers/bcma/host_pci.c:141:\t\tbcma_host_pci_switch_core(core);\ndrivers/bcma/host_pci.c-142-\tiowrite32(value, core-\u003ebus-\u003emmio + (1 BCMA_CORE_SIZE) + offset);\n--\ndrivers/bcma/host_pci.c-144-\ndrivers/bcma/host_pci.c:145:static const struct bcma_host_ops bcma_host_pci_ops = {\ndrivers/bcma/host_pci.c:146:\t.read8\t\t= bcma_host_pci_read8,\ndrivers/bcma/host_pci.c:147:\t.read16\t\t= bcma_host_pci_read16,\ndrivers/bcma/host_pci.c:148:\t.read32\t\t= bcma_host_pci_read32,\ndrivers/bcma/host_pci.c:149:\t.write8\t\t= bcma_host_pci_write8,\ndrivers/bcma/host_pci.c:150:\t.write16\t= bcma_host_pci_write16,\ndrivers/bcma/host_pci.c:151:\t.write32\t= bcma_host_pci_write32,\ndrivers/bcma/host_pci.c-152-#ifdef CONFIG_BCMA_BLOCKIO\ndrivers/bcma/host_pci.c:153:\t.block_read\t= bcma_host_pci_block_read,\ndrivers/bcma/host_pci.c:154:\t.block_write\t= bcma_host_pci_block_write,\ndrivers/bcma/host_pci.c-155-#endif\ndrivers/bcma/host_pci.c:156:\t.aread32\t= bcma_host_pci_aread32,\ndrivers/bcma/host_pci.c:157:\t.awrite32\t= bcma_host_pci_awrite32,\ndrivers/bcma/host_pci.c-158-};\ndrivers/bcma/host_pci.c-159-\ndrivers/bcma/host_pci.c:160:static int bcma_host_pci_probe(struct pci_dev dev,\ndrivers/bcma/host_pci.c-161-\t\t\t const struct pci_device_id id)\n--\ndrivers/bcma/host_pci.c-205-\tbus-\u003ehosttype = BCMA_HOSTTYPE_PCI;\ndrivers/bcma/host_pci.c:206:\tbus-\u003eops = \u0026bcma_host_pci_ops;\ndrivers/bcma/host_pci.c-207-\n--\ndrivers/bcma/host_pci.c-244-\ndrivers/bcma/host_pci.c:245:static void bcma_host_pci_remove(struct pci_dev dev)\ndrivers/bcma/host_pci.c-246-{\n--\ndrivers/bcma/host_pci.c-256-#ifdef CONFIG_PM_SLEEP\ndrivers/bcma/host_pci.c:257:static int bcma_host_pci_suspend(struct device dev)\ndrivers/bcma/host_pci.c-258-{\n--\ndrivers/bcma/host_pci.c-265-\ndrivers/bcma/host_pci.c:266:static int bcma_host_pci_resume(struct device dev)\ndrivers/bcma/host_pci.c-267-{\n--\ndrivers/bcma/host_pci.c-272-\ndrivers/bcma/host_pci.c:273:static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,\ndrivers/bcma/host_pci.c:274:\t\t\t bcma_host_pci_resume);\ndrivers/bcma/host_pci.c-275-#define BCMA_PM_OPS\t(\u0026bcma_pm_ops)\n--\ndrivers/bcma/host_pci.c=309=static struct pci_driver bcma_pci_bridge_driver = {\n--\ndrivers/bcma/host_pci.c-311-\t.id_table = bcma_pci_bridge_tbl,\ndrivers/bcma/host_pci.c:312:\t.probe = bcma_host_pci_probe,\ndrivers/bcma/host_pci.c:313:\t.remove = bcma_host_pci_remove,\ndrivers/bcma/host_pci.c-314-\t.driver.pm = BCMA_PM_OPS,\n--\ndrivers/bcma/host_pci.c-316-\ndrivers/bcma/host_pci.c:317:int __init bcma_host_pci_init(void)\ndrivers/bcma/host_pci.c-318-{\n--\ndrivers/bcma/host_pci.c-321-\ndrivers/bcma/host_pci.c:322:void __exit bcma_host_pci_exit(void)\ndrivers/bcma/host_pci.c-323-{\n--\ndrivers/bcma/host_pci.c-331-/ See also pcicore_up /\ndrivers/bcma/host_pci.c:332:void bcma_host_pci_up(struct bcma_bus bus)\ndrivers/bcma/host_pci.c-333-{\n--\ndrivers/bcma/host_pci.c-341-}\ndrivers/bcma/host_pci.c:342:EXPORT_SYMBOL_GPL(bcma_host_pci_up);\ndrivers/bcma/host_pci.c-343-\ndrivers/bcma/host_pci.c-344-/* See also pcicore_down /\ndrivers/bcma/host_pci.c:345:void bcma_host_pci_down(struct bcma_bus bus)\ndrivers/bcma/host_pci.c-346-{\n--\ndrivers/bcma/host_pci.c-352-}\ndrivers/bcma/host_pci.c:353:EXPORT_SYMBOL_GPL(bcma_host_pci_down);\ndrivers/bcma/host_pci.c-354-\ndrivers/bcma/host_pci.c-355-/* See also si_pci_setup /\ndrivers/bcma/host_pci.c:356:int bcma_host_pci_irq_ctl(struct bcma_bus bus, struct bcma_device *core,\ndrivers/bcma/host_pci.c-357-\t\t\t bool enable)\n--\ndrivers/bcma/host_pci.c-386-}\ndrivers/bcma/host_pci.c:387:EXPORT_SYMBOL_GPL(bcma_host_pci_irq_ctl);\n--\ndrivers/bcma/main.c=672=static int __init bcma_modinit(void)\n--\ndrivers/bcma/main.c-685-#ifdef CONFIG_BCMA_HOST_PCI\ndrivers/bcma/main.c:686:\terr = bcma_host_pci_init();\ndrivers/bcma/main.c-687-\tif (err) {\n--\ndrivers/bcma/main.c=697=static void __exit bcma_modexit(void)\n--\ndrivers/bcma/main.c-699-#ifdef CONFIG_BCMA_HOST_PCI\ndrivers/bcma/main.c:700:\tbcma_host_pci_exit();\ndrivers/bcma/main.c-701-#endif\n" }
11/2	2026/10/27 03:30	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 33268 output: 44 thoughts: 73 Thoughts: Here's my thought process, as it stands: Digging into the `bcm47xx_sprom` Driver Okay, first things first, I need to understand what this `bcm47xx_sprom` driver is all about. My initial thought is to dive straight into the source code, specifically `drivers/firmware/broadcom/bcm47xx_sprom.c`. This will give me the raw, unfiltered view of the implementation. I need to understand the role this module plays within the broader system. Is it involved in hardware initialization, configuration, or perhaps data retrieval? What's the context here? Next, I need to trace its usage. I'll search for where `bcm47xx_sprom` is called or referenced throughout the kernel. This is critical. I'm looking for the call stack, the execution path, how it fits into the overall scheme. Is it a core component, or something more peripheral? I want to know if it's reachable at all, and, specifically, how the system is exposing the functionality. What interfaces are available? Is this a driver that's exposed to user space, or is it purely internal to the kernel? The answers to these questions will significantly shape my understanding of its potential impact.
12/2	2026/10/27 03:30	tool	grepper	0m Args: { "Expression": "bcm47xx_sprom", "PathPrefixes": [ "drivers/firmware/", "include/", "arch/" ] } Results: { "Output": "arch/mips/bcm47xx/setup.c-30-\narch/mips/bcm47xx/setup.c:31:#include \u003clinux/bcm47xx_sprom.h\u003e\narch/mips/bcm47xx/setup.c-32-#include \u003clinux/export.h\u003e\n--\narch/mips/bcm47xx/setup.c=155=void __init plat_mem_setup(void)\n--\narch/mips/bcm47xx/setup.c-172-\t\tbcm47xx_bus_type = BCM47XX_BUS_TYPE_SSB;\narch/mips/bcm47xx/setup.c:173:\t\tbcm47xx_sprom_register_fallbacks();\narch/mips/bcm47xx/setup.c-174-\t\tbcm47xx_register_ssb();\n--\narch/mips/include/asm/mach-bcm47xx/bcm47xx.h-12-#include \u003clinux/bcm47xx_nvram.h\u003e\narch/mips/include/asm/mach-bcm47xx/bcm47xx.h:13:#include \u003clinux/bcm47xx_sprom.h\u003e\narch/mips/include/asm/mach-bcm47xx/bcm47xx.h-14-\n--\ndrivers/firmware/broadcom/Makefile=2=obj-$(CONFIG_BCM47XX_NVRAM)\t\t+= bcm47xx_nvram.o\ndrivers/firmware/broadcom/Makefile:3:obj-$(CONFIG_BCM47XX_SPROM)\t\t+= bcm47xx_sprom.o\ndrivers/firmware/broadcom/Makefile-4-obj-$(CONFIG_TEE_BNXT_FW)\t\t+= tee_bnxt_fw.o\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-29-#include \u003clinux/bcm47xx_nvram.h\u003e\ndrivers/firmware/broadcom/bcm47xx_sprom.c:30:#include \u003clinux/bcm47xx_sprom.h\u003e\ndrivers/firmware/broadcom/bcm47xx_sprom.c-31-#include \u003clinux/bcma/bcma.h\u003e\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=180=static void nvram_read_avvmid(const char prefix, int core,\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-202-/ Variables read from NVRAM whether or not the SPROM itself comes from it. /\ndrivers/firmware/broadcom/bcm47xx_sprom.c:203:static void bcm47xx_sprom_fill_nvram_only(struct ssb_sprom sprom,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-204-\t\t\t\t\t const char prefix, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-235- /\ndrivers/firmware/broadcom/bcm47xx_sprom.c:236:static void bcm47xx_sprom_fill_auto(struct ssb_sprom sprom,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-237-\t\t\t\t const char prefix, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-259-\tif (sprom-\u003erevision)\ndrivers/firmware/broadcom/bcm47xx_sprom.c:260:\t\tbcm47xx_sprom_fill_nvram_only(sprom, pre, fb);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-261-\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=614=void bcm47xx_fill_sprom(struct ssb_sprom sprom, const char prefix,\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-639-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:640:\tbcm47xx_sprom_fill_auto(sprom, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-641-}\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=644=static int bcm47xx_get_sprom_ssb(struct ssb_bus bus, struct ssb_sprom out)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-673- /\ndrivers/firmware/broadcom/bcm47xx_sprom.c:674:static void bcm47xx_sprom_apply_prefix_alias(char prefix, size_t prefix_size)\ndrivers/firmware/broadcom/bcm47xx_sprom.c-675-{\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-705- /\ndrivers/firmware/broadcom/bcm47xx_sprom.c:706:static char bcm47xx_sprom_bcma_prefix(struct bcma_bus bus, char buf,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-707-\t\t\t\t size_t size, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-722-\t\t\t\t bus-\u003ehost_pci-\u003ebus-\u003enumber);\ndrivers/firmware/broadcom/bcm47xx_sprom.c:723:\t\tbcm47xx_sprom_apply_prefix_alias(buf, size);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-724-\t\treturn buf;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-736-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:737:int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out)\ndrivers/firmware/broadcom/bcm47xx_sprom.c-738-{\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-742-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:743:\tprefix = bcm47xx_sprom_bcma_prefix(bus, buf, sizeof(buf), \u0026fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-744-\tif (IS_ERR(prefix))\ndrivers/firmware/broadcom/bcm47xx_sprom.c-745-\t\treturn PTR_ERR(prefix);\ndrivers/firmware/broadcom/bcm47xx_sprom.c:746:\tbcm47xx_sprom_fill_nvram_only(out, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-747-\treturn 0;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=750=static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom out)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-756-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:757:\tprefix = bcm47xx_sprom_bcma_prefix(bus, buf, sizeof(buf), \u0026fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-758-\tif (IS_ERR(prefix)) {\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-774-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:775:static unsigned int bcm47xx_sprom_registered;\ndrivers/firmware/broadcom/bcm47xx_sprom.c-776-\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-780- /\ndrivers/firmware/broadcom/bcm47xx_sprom.c:781:int bcm47xx_sprom_register_fallbacks(void)\ndrivers/firmware/broadcom/bcm47xx_sprom.c-782-{\ndrivers/firmware/broadcom/bcm47xx_sprom.c:783:\tif (bcm47xx_sprom_registered)\ndrivers/firmware/broadcom/bcm47xx_sprom.c-784-\t\treturn 0;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-795-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:796:\tbcm47xx_sprom_registered = 1;\ndrivers/firmware/broadcom/bcm47xx_sprom.c-797-\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-800-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:801:fs_initcall(bcm47xx_sprom_register_fallbacks);\n--\ninclude/linux/bcm47xx_sprom.h=16=void bcm47xx_fill_sprom(struct ssb_sprom sprom, const char prefix,\ninclude/linux/bcm47xx_sprom.h-17-\t\t\tbool fallback);\ninclude/linux/bcm47xx_sprom.h:18:int bcm47xx_sprom_register_fallbacks(void);\ninclude/linux/bcm47xx_sprom.h-19-#else\ninclude/linux/bcm47xx_sprom.h=20=static inline void bcm47xx_fill_sprom(struct ssb_sprom sprom,\n--\ninclude/linux/bcm47xx_sprom.h-25-\ninclude/linux/bcm47xx_sprom.h:26:static inline int bcm47xx_sprom_register_fallbacks(void)\ninclude/linux/bcm47xx_sprom.h-27-{\n--\ninclude/linux/bcm47xx_sprom.h-36-#if defined(CONFIG_BCM47XX_SPROM) \u0026\u0026 IS_BUILTIN(CONFIG_BCMA)\ninclude/linux/bcm47xx_sprom.h:37:int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out);\ninclude/linux/bcm47xx_sprom.h-38-#else\ninclude/linux/bcm47xx_sprom.h:39:static inline int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus,\ninclude/linux/bcm47xx_sprom.h-40-\t\t\t\t\t\tstruct ssb_sprom *out)\n" }
13/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 36519 output: 35 thoughts: 27 Thoughts: Okay, let's dive into this. Here's my thought process on tackling this: Examining bcm47xx_sprom.c Dependencies Alright, before I go any further, I need to get a clear picture of what's going on with `bcm47xx_sprom.c`. To understand its role and how it fits into the broader picture, the best starting point is to investigate its configuration and dependencies. My instinct says to check the Kconfig file associated with this module. That will give me a clear view of the build-time dependencies, any hardware or other software components it requires, and any potential configuration options. That's the most efficient way to get a solid grasp of its purpose.
14/2	2026/10/27 03:31	tool	grepper	0m Args: { "Expression": "config BCM47XX_SPROM", "PathPrefixes": [ "drivers/firmware/" ] } Results: { "Output": "drivers/firmware/broadcom/Kconfig=2=config BCM47XX_NVRAM\n--\ndrivers/firmware/broadcom/Kconfig-13-\ndrivers/firmware/broadcom/Kconfig:14:config BCM47XX_SPROM\ndrivers/firmware/broadcom/Kconfig-15-\tbool \"Broadcom SPROM driver\"\n" }
15/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 36836 output: 36 thoughts: 16 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue: Diving into the Broadcom Firmware Kconfig Alright, time to dig in. Let's see... drivers/firmware/broadcom/Kconfig. Right, that means we're looking at the configuration file for Broadcom firmware options within the kernel. My immediate thought is, what's the context? Are we troubleshooting a specific module, exploring new feature possibilities, or just trying to get a better handle on the build system's dependencies? Given the location, my guess is it's probably related to supporting Broadcom WiFi, Bluetooth, or potentially some embedded platform-specific firmware needs. I need to quickly assess the structure. What's the overall organization of this file? Is it broken down by Broadcom chipsets, by driver functionality, or a mix of both? Are there any obvious `depends on` statements that might highlight interactions with other kernel components like the regulatory domain code, the wireless subsystem, or specific platform-specific features like power management or secure boot? I'll be looking for potential conflicts too, either with existing Broadcom drivers or even upstream, so I'll want to get the lay of the land quickly. The important thing is to understand what variables are exposed, how they control which drivers get built, and what the dependencies look like. It's likely that it will be structured using standard Kconfig syntax so my experience with these is going to be incredibly useful.
16/2	2026/10/27 03:31	tool	read-file	0m Args: { "File": "drivers/firmware/broadcom/Kconfig", "FirstLine": 1, "LineCount": 40 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\tconfig BCM47XX_NVRAM\n 3:\t\tbool \"Broadcom NVRAM driver\"\n 4:\t\tdepends on BCM47XX \|\| ARCH_BCM_5301X \|\| COMPILE_TEST\n 5:\t\thelp\n 6:\t\t Broadcom home routers contain flash partition called \"nvram\" with all\n 7:\t\t important hardware configuration as well as some minor user setup.\n 8:\t\t NVRAM partition contains a text-like data representing name=value\n 9:\t\t pairs.\n 10:\t\t This driver provides an easy way to get value of requested parameter.\n 11:\t\t It simply reads content of NVRAM and parses it. It doesn't control any\n 12:\t\t hardware part itself.\n 13:\t\n 14:\tconfig BCM47XX_SPROM\n 15:\t\tbool \"Broadcom SPROM driver\"\n 16:\t\tdepends on BCM47XX_NVRAM\n 17:\t\tselect GENERIC_NET_UTILS\n 18:\t\thelp\n 19:\t\t Broadcom devices store configuration data in SPROM. Accessing it is\n 20:\t\t specific to the bus host type, e.g. PCI(e) devices have it mapped in\n 21:\t\t a PCI BAR.\n 22:\t\t In case of SoC devices SPROM content is stored on a flash used by\n 23:\t\t bootloader firmware CFE. This driver provides method to ssb and bcma\n 24:\t\t drivers to read SPROM on SoC.\n 25:\t\n 26:\tconfig TEE_BNXT_FW\n 27:\t\ttristate \"Broadcom BNXT firmware manager\"\n 28:\t\tdepends on (ARCH_BCM_IPROC \u0026\u0026 OPTEE) \|\| (COMPILE_TEST \u0026\u0026 TEE)\n 29:\t\tdefault ARCH_BCM_IPROC\n 30:\t\thelp\n 31:\t\t This module help to manage firmware on Broadcom BNXT device. The module\n 32:\t\t registers on tee bus and invoke calls to manage firmware on BNXT device.\n" }
17/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 37744 output: 33 thoughts: 73 Thoughts: Here's my analysis of these dependencies, as I understand them: Navigating the Broadcom Chipset Kconfig Logic Okay, so I'm looking at these kernel configuration options and their dependencies. It looks like `BCM47XX_NVRAM`, which is interesting in itself, relies on a broader definition: either a generic `BCM47XX` architecture, or specifically targeting the `ARCH_BCM_5301X` variant, or even just included for a `COMPILE_TEST`. Makes sense – NVRAM functionality is core to these broadcom chipsets. Next, we have `BCM47XX_SPROM`. This seems to be building on the previous one. `BCM47XX_SPROM` directly depends on `BCM47XX_NVRAM`. The SPROM likely utilizes data stored in the NVRAM, which indicates that it cannot function independently. The dependencies are clear and logical. Now, I need to dig into `drivers/bcma/Kconfig` to see how these modules are defined and used within that specific subsystem. This should paint a clearer picture of their exact roles within the broader Broadcom chipset driver framework.
18/2	2026/10/27 03:31	tool	read-file	0m Args: { "File": "drivers/bcma/Kconfig", "FirstLine": 1, "LineCount": 80 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0\n 2:\tconfig BCMA_POSSIBLE\n 3:\t\tbool\n 4:\t\tdepends on HAS_IOMEM \u0026\u0026 HAS_DMA\n 5:\t\tdefault y\n 6:\t\n 7:\tmenuconfig BCMA\n 8:\t\ttristate \"Broadcom specific AMBA\"\n 9:\t\tdepends on BCMA_POSSIBLE\n 10:\t\thelp\n 11:\t\t Bus driver for Broadcom specific Advanced Microcontroller Bus\n 12:\t\t Architecture.\n 13:\t\n 14:\tif BCMA\n 15:\t\n 16:\t# Support for Block-I/O. SELECT this from the driver that needs it.\n 17:\tconfig BCMA_BLOCKIO\n 18:\t\tbool\n 19:\t\n 20:\tconfig BCMA_HOST_PCI_POSSIBLE\n 21:\t\tbool\n 22:\t\tdepends on PCI = y\n 23:\t\tdefault y\n 24:\t\n 25:\tconfig BCMA_HOST_PCI\n 26:\t\tbool \"Support for BCMA on PCI-host bus\"\n 27:\t\tdepends on BCMA_HOST_PCI_POSSIBLE\n 28:\t\tselect BCMA_DRIVER_PCI\n 29:\t\tdefault y\n 30:\t\n 31:\tconfig BCMA_HOST_SOC\n 32:\t\tbool \"Support for BCMA in a SoC\"\n 33:\t\tdepends on HAS_IOMEM\n 34:\t\thelp\n 35:\t\t Host interface for a Broadcom AIX bus directly mapped into\n 36:\t\t the memory. This only works with the Broadcom SoCs from the\n 37:\t\t BCM47XX line.\n 38:\t\n 39:\t\t If unsure, say N\n 40:\t\n 41:\tconfig BCMA_DRIVER_PCI\n 42:\t\tbool \"BCMA Broadcom PCI core driver\"\n 43:\t\tdepends on PCI\n 44:\t\tdefault y\n 45:\t\thelp\n 46:\t\t BCMA bus may have many versions of PCIe core. This driver\n 47:\t\t supports:\n 48:\t\t 1) PCIe core working in clientmode\n 49:\t\t 2) PCIe Gen 2 clientmode core\n 50:\t\n 51:\t\t In general PCIe (Gen 2) clientmode core is required on PCIe\n 52:\t\t hosted buses. It's responsible for initialization and basic\n 53:\t\t hardware management.\n 54:\t\t This driver is also prerequisite for a hostmode PCIe core\n 55:\t\t support.\n 56:\t\n 57:\tconfig BCMA_DRIVER_PCI_HOSTMODE\n 58:\t\tbool \"Driver for PCI core working in hostmode\"\n 59:\t\tdepends on MIPS \u0026\u0026 BCMA_DRIVER_PCI \u0026\u0026 PCI_DRIVERS_LEGACY \u0026\u0026 BCMA = y\n 60:\t\thelp\n 61:\t\t PCI core hostmode operation (external PCI bus).\n 62:\t\n 63:\tconfig BCMA_DRIVER_MIPS\n 64:\t\tbool \"BCMA Broadcom MIPS core driver\"\n 65:\t\tdepends on MIPS \|\| COMPILE_TEST\n 66:\t\thelp\n 67:\t\t Driver for the Broadcom MIPS core attached to Broadcom specific\n 68:\t\t Advanced Microcontroller Bus.\n 69:\t\n 70:\t\t If unsure, say N\n 71:\t\n 72:\tconfig BCMA_PFLASH\n 73:\t\tbool\n 74:\t\tdepends on BCMA_DRIVER_MIPS\n 75:\t\tdefault y\n 76:\t\n 77:\tconfig BCMA_SFLASH\n 78:\t\tbool \"ChipCommon-attached serial flash support\"\n 79:\t\tdepends on BCMA_HOST_SOC\n 80:\t\tdefault y\n" }
19/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 39067 output: 30 thoughts: 75 Thoughts: Okay, let's dive into this. Here's how I'm thinking about it: Investigating `bcma` Device Instantiation and Potential Interactions Right, my first instinct is to understand the landscape of `bcma` devices and how they're brought into existence within the system. I need to get a clear picture of what hardware relies on `bcma`, and exactly how those instances are created and initialized. But hold on, before I get too deep into specific hardware implementations, I need to consider the bigger picture. I have to look for any virtual or software-based buses, or perhaps even virtual drivers, that might be creating or probing for a `bcma` bus. Think along the lines of something like USB, the `mac80211_hwsim` framework, or other software-defined components. These could be interesting. I should verify there are none. Essentially, I need to make sure I don't miss any indirect routes. It's important to rule out any software-driven bus creation, instead of solely focusing on the hardware aspect. Now I'll check to see if any USB device or virtual driver is utilizing the `bcma` interface at all.
20/2	2026/10/27 03:31	tool	grepper	0m Args: { "Expression": "bcma_", "PathPrefixes": [ "drivers/net/wireless/" ] } Results: { "Output": "\nFull output is too long, showing 200 out of 2061 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (26 files in total):\ndrivers/net/wireless/broadcom/b43/bus.c:36\ndrivers/net/wireless/broadcom/b43/bus.h:2\ndrivers/net/wireless/broadcom/b43/dma.c:2\ndrivers/net/wireless/broadcom/b43/main.c:49\ndrivers/net/wireless/broadcom/b43/phy_common.c:10\ndrivers/net/wireless/broadcom/b43/phy_ht.c:4\ndrivers/net/wireless/broadcom/b43/phy_lcn.c:12\ndrivers/net/wireless/broadcom/b43/phy_n.c:3\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/aiutils.c:27\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/aiutils.h:4\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/ampdu.c:4\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/debug.c:2\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c:47\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/led.c:4\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c:25\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c:205\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h:1\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c:60\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_hal.h:1\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_int.h:2\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c:33\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c:28\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/pmu.c:5\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/pub.h:2\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/types.h:3\n\ndrivers/net/wireless/broadcom/b43/bus.c-20-#ifdef CONFIG_B43_BCMA\ndrivers/net/wireless/broadcom/b43/bus.c:21:static int b43_bus_bcma_bus_may_powerdown(struct b43_bus_dev dev)\ndrivers/net/wireless/broadcom/b43/bus.c-22-{\ndrivers/net/wireless/broadcom/b43/bus.c:23:\treturn 0; / bcma_bus_may_powerdown(dev-\u003ebdev-\u003ebus); /\ndrivers/net/wireless/broadcom/b43/bus.c-24-}\ndrivers/net/wireless/broadcom/b43/bus.c:25:static int b43_bus_bcma_bus_powerup(struct b43_bus_dev dev,\ndrivers/net/wireless/broadcom/b43/bus.c-26-\t\t\t\t\t bool dynamic_pctl)\ndrivers/net/wireless/broadcom/b43/bus.c-27-{\ndrivers/net/wireless/broadcom/b43/bus.c:28:\treturn 0; /* bcma_bus_powerup(dev-\u003esdev-\u003ebus, dynamic_pctl); /\ndrivers/net/wireless/broadcom/b43/bus.c-29-}\ndrivers/net/wireless/broadcom/b43/bus.c:30:static int b43_bus_bcma_device_is_enabled(struct b43_bus_dev dev)\ndrivers/net/wireless/broadcom/b43/bus.c-31-{\ndrivers/net/wireless/broadcom/b43/bus.c:32:\treturn bcma_core_is_enabled(dev-\u003ebdev);\ndrivers/net/wireless/broadcom/b43/bus.c-33-}\ndrivers/net/wireless/broadcom/b43/bus.c:34:static void b43_bus_bcma_device_enable(struct b43_bus_dev dev,\ndrivers/net/wireless/broadcom/b43/bus.c-35-\t\t\t\t\t u32 core_specific_flags)\ndrivers/net/wireless/broadcom/b43/bus.c-36-{\ndrivers/net/wireless/broadcom/b43/bus.c:37:\tbcma_core_enable(dev-\u003ebdev, core_specific_flags);\ndrivers/net/wireless/broadcom/b43/bus.c-38-}\ndrivers/net/wireless/broadcom/b43/bus.c:39:static void b43_bus_bcma_device_disable(struct b43_bus_dev dev,\ndrivers/net/wireless/broadcom/b43/bus.c-40-\t\t\t\t\t u32 core_specific_flags)\ndrivers/net/wireless/broadcom/b43/bus.c-41-{\ndrivers/net/wireless/broadcom/b43/bus.c:42:\tbcma_core_disable(dev-\u003ebdev, core_specific_flags);\ndrivers/net/wireless/broadcom/b43/bus.c-43-}\ndrivers/net/wireless/broadcom/b43/bus.c:44:static u16 b43_bus_bcma_read16(struct b43_bus_dev dev, u16 offset)\ndrivers/net/wireless/broadcom/b43/bus.c-45-{\ndrivers/net/wireless/broadcom/b43/bus.c:46:\treturn bcma_read16(dev-\u003ebdev, offset);\ndrivers/net/wireless/broadcom/b43/bus.c-47-}\ndrivers/net/wireless/broadcom/b43/bus.c:48:static u32 b43_bus_bcma_read32(struct b43_bus_dev dev, u16 offset)\ndrivers/net/wireless/broadcom/b43/bus.c-49-{\ndrivers/net/wireless/broadcom/b43/bus.c:50:\treturn bcma_read32(dev-\u003ebdev, offset);\ndrivers/net/wireless/broadcom/b43/bus.c-51-}\ndrivers/net/wireless/broadcom/b43/bus.c=52=static\ndrivers/net/wireless/broadcom/b43/bus.c:53:void b43_bus_bcma_write16(struct b43_bus_dev dev, u16 offset, u16 value)\ndrivers/net/wireless/broadcom/b43/bus.c-54-{\ndrivers/net/wireless/broadcom/b43/bus.c:55:\tbcma_write16(dev-\u003ebdev, offset, value);\ndrivers/net/wireless/broadcom/b43/bus.c-56-}\ndrivers/net/wireless/broadcom/b43/bus.c=57=static\ndrivers/net/wireless/broadcom/b43/bus.c:58:void b43_bus_bcma_write32(struct b43_bus_dev dev, u16 offset, u32 value)\ndrivers/net/wireless/broadcom/b43/bus.c-59-{\ndrivers/net/wireless/broadcom/b43/bus.c:60:\tbcma_write32(dev-\u003ebdev, offset, value);\ndrivers/net/wireless/broadcom/b43/bus.c-61-}\ndrivers/net/wireless/broadcom/b43/bus.c=62=static\ndrivers/net/wireless/broadcom/b43/bus.c:63:void b43_bus_bcma_block_read(struct b43_bus_dev dev, void buffer,\ndrivers/net/wireless/broadcom/b43/bus.c-64-\t\t\t size_t count, u16 offset, u8 reg_width)\ndrivers/net/wireless/broadcom/b43/bus.c-65-{\ndrivers/net/wireless/broadcom/b43/bus.c:66:\tbcma_block_read(dev-\u003ebdev, buffer, count, offset, reg_width);\ndrivers/net/wireless/broadcom/b43/bus.c-67-}\ndrivers/net/wireless/broadcom/b43/bus.c=68=static\ndrivers/net/wireless/broadcom/b43/bus.c:69:void b43_bus_bcma_block_write(struct b43_bus_dev dev, const void buffer,\ndrivers/net/wireless/broadcom/b43/bus.c-70-\t\t\t size_t count, u16 offset, u8 reg_width)\ndrivers/net/wireless/broadcom/b43/bus.c-71-{\ndrivers/net/wireless/broadcom/b43/bus.c:72:\tbcma_block_write(dev-\u003ebdev, buffer, count, offset, reg_width);\ndrivers/net/wireless/broadcom/b43/bus.c-73-}\ndrivers/net/wireless/broadcom/b43/bus.c-74-\ndrivers/net/wireless/broadcom/b43/bus.c:75:struct b43_bus_dev b43_bus_dev_bcma_init(struct bcma_device core)\ndrivers/net/wireless/broadcom/b43/bus.c-76-{\n--\ndrivers/net/wireless/broadcom/b43/bus.c-83-\ndrivers/net/wireless/broadcom/b43/bus.c:84:\tdev-\u003ebus_may_powerdown = b43_bus_bcma_bus_may_powerdown;\ndrivers/net/wireless/broadcom/b43/bus.c:85:\tdev-\u003ebus_powerup = b43_bus_bcma_bus_powerup;\ndrivers/net/wireless/broadcom/b43/bus.c:86:\tdev-\u003edevice_is_enabled = b43_bus_bcma_device_is_enabled;\ndrivers/net/wireless/broadcom/b43/bus.c:87:\tdev-\u003edevice_enable = b43_bus_bcma_device_enable;\ndrivers/net/wireless/broadcom/b43/bus.c:88:\tdev-\u003edevice_disable = b43_bus_bcma_device_disable;\ndrivers/net/wireless/broadcom/b43/bus.c-89-\ndrivers/net/wireless/broadcom/b43/bus.c:90:\tdev-\u003eread16 = b43_bus_bcma_read16;\ndrivers/net/wireless/broadcom/b43/bus.c:91:\tdev-\u003eread32 = b43_bus_bcma_read32;\ndrivers/net/wireless/broadcom/b43/bus.c:92:\tdev-\u003ewrite16 = b43_bus_bcma_write16;\ndrivers/net/wireless/broadcom/b43/bus.c:93:\tdev-\u003ewrite32 = b43_bus_bcma_write32;\ndrivers/net/wireless/broadcom/b43/bus.c:94:\tdev-\u003eblock_read = b43_bus_bcma_block_read;\ndrivers/net/wireless/broadcom/b43/bus.c:95:\tdev-\u003eblock_write = b43_bus_bcma_block_write;\ndrivers/net/wireless/broadcom/b43/bus.c-96-#ifdef CONFIG_BCM47XX_BCMA\n--\ndrivers/net/wireless/broadcom/b43/bus.c=223=void b43_bus_get_wldev(struct b43_bus_dev dev)\n--\ndrivers/net/wireless/broadcom/b43/bus.c-227-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/bus.c:228:\t\treturn bcma_get_drvdata(dev-\u003ebdev);\ndrivers/net/wireless/broadcom/b43/bus.c-229-#endif\n--\ndrivers/net/wireless/broadcom/b43/bus.c=238=void b43_bus_set_wldev(struct b43_bus_dev dev, void wldev)\n--\ndrivers/net/wireless/broadcom/b43/bus.c-242-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/bus.c:243:\t\tbcma_set_drvdata(dev-\u003ebdev, wldev);\ndrivers/net/wireless/broadcom/b43/bus.c-244-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/bus.h=14=struct b43_bus_dev {\n--\ndrivers/net/wireless/broadcom/b43/bus.h-16-\tunion {\ndrivers/net/wireless/broadcom/b43/bus.h:17:\t\tstruct bcma_device bdev;\ndrivers/net/wireless/broadcom/b43/bus.h-18-\t\tstruct ssb_device sdev;\n--\ndrivers/net/wireless/broadcom/b43/bus.h=80=static inline bool b43_bus_host_is_sdio(struct b43_bus_dev dev)\n--\ndrivers/net/wireless/broadcom/b43/bus.h-89-\ndrivers/net/wireless/broadcom/b43/bus.h:90:struct b43_bus_dev b43_bus_dev_bcma_init(struct bcma_device core);\ndrivers/net/wireless/broadcom/b43/bus.h-91-struct b43_bus_dev b43_bus_dev_ssb_init(struct ssb_device sdev);\n--\ndrivers/net/wireless/broadcom/b43/dma.c=800=static enum b43_dmatype b43_engine_type(struct b43_wldev dev)\n--\ndrivers/net/wireless/broadcom/b43/dma.c-807-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/dma.c:808:\t\ttmp = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOST);\ndrivers/net/wireless/broadcom/b43/dma.c-809-\t\tif (tmp \u0026 BCMA_IOST_DMA64)\n--\ndrivers/net/wireless/broadcom/b43/dma.c=1049=int b43_dma_init(struct b43_wldev dev)\n--\ndrivers/net/wireless/broadcom/b43/dma.c-1064-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/dma.c:1065:\t\tdma-\u003etranslation = bcma_core_dma_translation(dev-\u003edev-\u003ebdev);\ndrivers/net/wireless/broadcom/b43/dma.c-1066-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/main.c=114=MODULE_PARM_DESC(allhwsupport, \"Enable support for all hardware (even it if overlaps with the brcmsmac driver)\");\n--\ndrivers/net/wireless/broadcom/b43/main.c-116-#ifdef CONFIG_B43_BCMA\ndrivers/net/wireless/broadcom/b43/main.c:117:static const struct bcma_device_id b43_bcma_tbl[] = {\ndrivers/net/wireless/broadcom/b43/main.c-118-\tBCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),\n--\ndrivers/net/wireless/broadcom/b43/main.c-129-};\ndrivers/net/wireless/broadcom/b43/main.c:130:MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);\ndrivers/net/wireless/broadcom/b43/main.c-131-#endif\n--\ndrivers/net/wireless/broadcom/b43/main.c=1204=void b43_wireless_core_phy_pll_reset(struct b43_wldev dev)\ndrivers/net/wireless/broadcom/b43/main.c-1205-{\ndrivers/net/wireless/broadcom/b43/main.c:1206:\tstruct bcma_drv_cc bcma_cc __maybe_unused;\ndrivers/net/wireless/broadcom/b43/main.c-1207-\tstruct ssb_chipcommon ssb_cc __maybe_unused;\n--\ndrivers/net/wireless/broadcom/b43/main.c-1211-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/main.c:1212:\t\tbcma_cc = \u0026dev-\u003edev-\u003ebdev-\u003ebus-\u003edrv_cc;\ndrivers/net/wireless/broadcom/b43/main.c-1213-\ndrivers/net/wireless/broadcom/b43/main.c:1214:\t\tbcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);\ndrivers/net/wireless/broadcom/b43/main.c:1215:\t\tbcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);\ndrivers/net/wireless/broadcom/b43/main.c:1216:\t\tbcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);\ndrivers/net/wireless/broadcom/b43/main.c:1217:\t\tbcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);\ndrivers/net/wireless/broadcom/b43/main.c-1218-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/main.c-1233-#ifdef CONFIG_B43_BCMA\ndrivers/net/wireless/broadcom/b43/main.c:1234:static void b43_bcma_phy_reset(struct b43_wldev dev)\ndrivers/net/wireless/broadcom/b43/main.c-1235-{\n--\ndrivers/net/wireless/broadcom/b43/main.c-1238-\t/ Put PHY into reset /\ndrivers/net/wireless/broadcom/b43/main.c:1239:\tflags = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOCTL);\ndrivers/net/wireless/broadcom/b43/main.c-1240-\tflags \|= B43_BCMA_IOCTL_PHY_RESET;\ndrivers/net/wireless/broadcom/b43/main.c-1241-\tflags \|= B43_BCMA_IOCTL_PHY_BW_20MHZ; / Make 20 MHz def /\ndrivers/net/wireless/broadcom/b43/main.c:1242:\tbcma_awrite32(dev-\u003edev-\u003ebdev, BCMA_IOCTL, flags);\ndrivers/net/wireless/broadcom/b43/main.c-1243-\tudelay(2);\n--\ndrivers/net/wireless/broadcom/b43/main.c-1247-\ndrivers/net/wireless/broadcom/b43/main.c:1248:static void b43_bcma_wireless_core_reset(struct b43_wldev dev, bool gmode)\ndrivers/net/wireless/broadcom/b43/main.c-1249-{\n--\ndrivers/net/wireless/broadcom/b43/main.c-1263-\ndrivers/net/wireless/broadcom/b43/main.c:1264:\t\ttmp = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOCTL);\ndrivers/net/wireless/broadcom/b43/main.c-1265-\t\ttmp \u0026= ~B43_BCMA_IOCTL_DAC;\ndrivers/net/wireless/broadcom/b43/main.c-1266-\t\ttmp \|= 0x100;\ndrivers/net/wireless/broadcom/b43/main.c:1267:\t\tbcma_awrite32(dev-\u003edev-\u003ebdev, BCMA_IOCTL, tmp);\ndrivers/net/wireless/broadcom/b43/main.c-1268-\ndrivers/net/wireless/broadcom/b43/main.c:1269:\t\ttmp = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOCTL);\ndrivers/net/wireless/broadcom/b43/main.c-1270-\t\ttmp \u0026= ~B43_BCMA_IOCTL_PHY_CLKEN;\ndrivers/net/wireless/broadcom/b43/main.c:1271:\t\tbcma_awrite32(dev-\u003edev-\u003ebdev, BCMA_IOCTL, tmp);\ndrivers/net/wireless/broadcom/b43/main.c-1272-\ndrivers/net/wireless/broadcom/b43/main.c:1273:\t\ttmp = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOCTL);\ndrivers/net/wireless/broadcom/b43/main.c-1274-\t\ttmp \|= B43_BCMA_IOCTL_PHY_CLKEN;\ndrivers/net/wireless/broadcom/b43/main.c:1275:\t\tbcma_awrite32(dev-\u003edev-\u003ebdev, BCMA_IOCTL, tmp);\ndrivers/net/wireless/broadcom/b43/main.c-1276-\t}\ndrivers/net/wireless/broadcom/b43/main.c-1277-\ndrivers/net/wireless/broadcom/b43/main.c:1278:\tbcma_core_set_clockmode(dev-\u003edev-\u003ebdev, BCMA_CLKMODE_FAST);\ndrivers/net/wireless/broadcom/b43/main.c:1279:\tb43_bcma_phy_reset(dev);\ndrivers/net/wireless/broadcom/b43/main.c:1280:\tbcma_core_pll_ctl(dev-\u003edev-\u003ebdev, req, status, true);\ndrivers/net/wireless/broadcom/b43/main.c-1281-}\n--\ndrivers/net/wireless/broadcom/b43/main.c=1302=void b43_wireless_core_reset(struct b43_wldev dev, bool gmode)\n--\ndrivers/net/wireless/broadcom/b43/main.c-1308-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/main.c:1309:\t\tb43_bcma_wireless_core_reset(dev, gmode);\ndrivers/net/wireless/broadcom/b43/main.c-1310-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/main.c=2874=static int b43_gpio_init(struct b43_wldev dev)\n--\ndrivers/net/wireless/broadcom/b43/main.c-2916-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/main.c:2917:\t\tbcma_chipco_gpio_control(\u0026dev-\u003edev-\u003ebdev-\u003ebus-\u003edrv_cc, mask, set);\ndrivers/net/wireless/broadcom/b43/main.c-2918-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/main.c=2935=static void b43_gpio_cleanup(struct b43_wldev dev)\n--\ndrivers/net/wireless/broadcom/b43/main.c-2943-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/main.c:2944:\t\tbcma_chipco_gpio_control(\u0026dev-\u003edev-\u003ebdev-\u003ebus-\u003edrv_cc, ~0, 0);\ndrivers/net/wireless/broadcom/b43/main.c-2945-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/main.c=3020=void b43_mac_phy_clock_set(struct b43_wldev dev, bool on)\n--\ndrivers/net/wireless/broadcom/b43/main.c-3026-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/main.c:3027:\t\ttmp = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOCTL);\ndrivers/net/wireless/broadcom/b43/main.c-3028-\t\tif (on)\n--\ndrivers/net/wireless/broadcom/b43/main.c-3031-\t\t\ttmp \u0026= ~B43_BCMA_IOCTL_MACPHYCLKEN;\ndrivers/net/wireless/broadcom/b43/main.c:3032:\t\tbcma_awrite32(dev-\u003edev-\u003ebdev, BCMA_IOCTL, tmp);\ndrivers/net/wireless/broadcom/b43/main.c-3033-\t\tbreak;\n--\ndrivers/net/wireless/broadcom/b43/main.c=3894=static int b43_switch_band(struct b43_wldev *dev,\n--\ndrivers/net/wireless/broadcom/b43/main.c-3936-\tcase B43_BUS_BCMA:\ndrivers/net/wireless/broadcom/b43/main.c:3937:\t\ttmp = bcma_aread32(dev-\u003edev-\u003ebdev, BCMA_IOCTL);\n\n" }
21/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 46338 output: 43 thoughts: 933 Thoughts: Investigating the b43 Driver and bcma Devices Okay, so the `b43` driver is attaching to `bcma` devices, which means it's leveraging the `bcma` bus infrastructure. And specifically, `b43_bcma_tbl` is registered with `MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl)`. Interesting. I need to understand how these `bcma_device` instances are getting created in the first place. Let's trace it back. I should start by looking at `bcma_bus_register`. Right, let's see what's actually creating a `struct bcma_bus`. I'll grep for callers of `bcma_bus_register`. Okay, I've got a couple of hits. First, `arch/mips/bcm47xx/setup.c`, but that's MIPS-specific, so not immediately relevant for generic fuzzing. Then there's `drivers/bcma/host_pci.c`, which calls `bcma_host_pci_probe` – that's called from a PCI probe function, and uses `bcma_pci_bridge_tbl[]`. This table is populated with Broadcom PCI device IDs. It looks like a recent patch added support for `0x43b3` here. Also, there's `drivers/bcma/host_soc.c`, which uses an OF (device tree) match table for SoCs, `bcma_host_soc_of_match[]`, specifically for devices compatible with "brcm,bus-axi". This means Broadcom ARM and MIPS SoCs, like the BCM5301X and BCM47XX. Now, the important question: Can any of this be exercised in a typical amd64 QEMU/GCE syzkaller fuzzing environment? My initial thought is no, not directly. That's assuming I don't need to enable PCI emulation. But what about PCI emulation in QEMU? I should check whether standard QEMU emulates those specific Broadcom BCM43xx PCI devices. No, it doesn't. Now, what about syzkaller? Does it offer virtual buses for PCI? I know it supports USB (Raw Gadget/Dummy HCD), Bluetooth (vhci), WiFi (mac80211_hwsim), Netlink, sockets, and pseudo-filesystems (proc, sysfs, debugfs), syscalls, etc. But, does it have PCI emulation? No, it does not. Can a user-space program attach or instantiate a PCI device, or fake a PCI device? I'm not aware of any straightforward way to do that. So, since I can't emulate PCI hardware directly, is there another way into the `bcma` infrastructure that I can reach? What about `CONFIG_BCMA` itself? Does it expose anything through debugfs, sysfs, or other user-triggerable mechanisms? I need to check every file within `drivers/bcma/` for sysfs, ioctl, debugfs, or any other user-triggered way to get in. Let's see what I can find.
22/2	2026/10/27 03:31	tool	grepper	0m Args: { "Expression": "file_operations\|debugfs\|sysfs\|module_param\|DEVICE_ATTR", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "drivers/bcma/main.c=34=static ssize_t manuf_show(struct device dev, struct device_attribute attr, char buf)\n--\ndrivers/bcma/main.c-38-}\ndrivers/bcma/main.c:39:static DEVICE_ATTR_RO(manuf);\ndrivers/bcma/main.c-40-\ndrivers/bcma/main.c=41=static ssize_t id_show(struct device dev, struct device_attribute attr, char buf)\n--\ndrivers/bcma/main.c-45-}\ndrivers/bcma/main.c:46:static DEVICE_ATTR_RO(id);\ndrivers/bcma/main.c-47-\ndrivers/bcma/main.c=48=static ssize_t rev_show(struct device dev, struct device_attribute attr, char buf)\n--\ndrivers/bcma/main.c-52-}\ndrivers/bcma/main.c:53:static DEVICE_ATTR_RO(rev);\ndrivers/bcma/main.c-54-\ndrivers/bcma/main.c=55=static ssize_t class_show(struct device dev, struct device_attribute attr, char buf)\n--\ndrivers/bcma/main.c-59-}\ndrivers/bcma/main.c:60:static DEVICE_ATTR_RO(class);\ndrivers/bcma/main.c-61-\n" }
23/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 48369 output: 32 thoughts: 97 Thoughts: Here's my thought process, as it stands: Navigating the BCMA Driver Structure Okay, so `manuf_show`, `id_show`, `rev_show`, and `class_show` - those are all attributes on the `bcma_device` struct. That makes sense. And I recall that a `bcma_device` gets registered only after a `bcma_bus` has been registered and scanned. That's the sequence. Now, where is the action? I need to understand how these devices are actually found. The registration itself is a starting point, but how do we get there? Let me jump over to `drivers/bcma/scan.c`. That feels like the likely location for the device discovery logic. How are the cores on this bus, in effect the devices, located? I'm guessing it involves reading some sort of physical MMIO addresses. I've got to confirm, so back to `scan.c` I go!
24/2	2026/10/27 03:31	tool	grepper	0m Args: { "Expression": "bcma_bus_scan", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "drivers/bcma/bcma_private.h=38=void bcma_detect_chip(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:39:int bcma_bus_scan(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-40-\n--\ndrivers/bcma/host_pci.c=160=static int bcma_host_pci_probe(struct pci_dev dev,\n--\ndrivers/bcma/host_pci.c-214-\t/ Scan bus to find out generation of PCIe core /\ndrivers/bcma/host_pci.c:215:\terr = bcma_bus_scan(bus);\ndrivers/bcma/host_pci.c-216-\tif (err)\n--\ndrivers/bcma/main.c=388=int bcma_bus_register(struct bcma_bus bus)\n--\ndrivers/bcma/main.c-393-\t/* Scan for devices (cores) /\ndrivers/bcma/main.c:394:\terr = bcma_bus_scan(bus);\ndrivers/bcma/main.c-395-\tif (err) {\n--\ndrivers/bcma/main.c=507=int __init bcma_bus_early_register(struct bcma_bus bus)\n--\ndrivers/bcma/main.c-512-\t/* Scan for devices (cores) /\ndrivers/bcma/main.c:513:\terr = bcma_bus_scan(bus);\ndrivers/bcma/main.c-514-\tif (err) {\n--\ndrivers/bcma/scan.c=437=void bcma_detect_chip(struct bcma_bus bus)\n--\ndrivers/bcma/scan.c-455-\ndrivers/bcma/scan.c:456:int bcma_bus_scan(struct bcma_bus *bus)\ndrivers/bcma/scan.c-457-{\n" }
25/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 49230 output: 27 thoughts: 48 Thoughts: Investigating USB and Broadcom Chipsets Okay, hold on a second. I'm having a hunch here. Could any USB device potentially utilize the `bcma` (Broadcom Common MAC Architecture) framework, even if it's not immediately obvious from the initial connection? I need to dig deeper. My gut feeling tells me there might be a subtle link. Let me verify this by thoroughly examining the USB subsystem. My first course of action is to check if the USB gadget driver or, more broadly, any USB-related driver in the kernel uses `bcma`. I'm thinking a broad search is the way to go. Time to unleash `grep`. I'll run a recursive search, looking specifically for the string `bcma` across all the `drivers/usb` directories, and, just to be thorough, I should broaden the search to the entire `drivers/` directory structure. This should hopefully uncover any unexpected dependencies or integrations, helping clarify the possible overlap between USB and Broadcom hardware.
26/2	2026/10/27 03:31	tool	grepper	0m Args: { "Expression": "bcma", "PathPrefixes": [ "drivers/usb/" ] } Results: { "Output": "\nFull output is too long, showing 200 out of 324 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (3 files in total):\ndrivers/usb/host/Kconfig:4\ndrivers/usb/host/Makefile:1\ndrivers/usb/host/bcma-hcd.c:112\n\ndrivers/usb/host/Kconfig=685=config USB_HCD_BCMA\n--\ndrivers/usb/host/Kconfig-690-\thelp\ndrivers/usb/host/Kconfig:691:\t Enable support for the EHCI and OCHI host controller on an bcma bus.\ndrivers/usb/host/Kconfig:692:\t It converts the bcma driver into two platform device drivers\ndrivers/usb/host/Kconfig-693-\t for ehci and ohci.\n--\ndrivers/usb/host/Kconfig=697=config USB_HCD_SSB\n--\ndrivers/usb/host/Kconfig-702-\thelp\ndrivers/usb/host/Kconfig:703:\t Enable support for the EHCI and OCHI host controller on an bcma bus.\ndrivers/usb/host/Kconfig:704:\t It converts the bcma driver into two platform device drivers\ndrivers/usb/host/Kconfig-705-\t for ehci and ohci.\n--\ndrivers/usb/host/Makefile=87=obj-$(CONFIG_USB_EHCI_MV)\t+= ehci-mv.o\ndrivers/usb/host/Makefile:88:obj-$(CONFIG_USB_HCD_BCMA)\t+= bcma-hcd.o\ndrivers/usb/host/Makefile-89-obj-$(CONFIG_USB_HCD_SSB)\t+= ssb-hcd.o\n--\ndrivers/usb/host/bcma-hcd.c-20- /\ndrivers/usb/host/bcma-hcd.c:21:#include \u003clinux/bcma/bcma.h\u003e\ndrivers/usb/host/bcma-hcd.c-22-#include \u003clinux/delay.h\u003e\n--\ndrivers/usb/host/bcma-hcd.c=34=MODULE_LICENSE(\"GPL\");\n--\ndrivers/usb/host/bcma-hcd.c-38-\ndrivers/usb/host/bcma-hcd.c:39:struct bcma_hcd_device {\ndrivers/usb/host/bcma-hcd.c:40:\tstruct bcma_device core;\ndrivers/usb/host/bcma-hcd.c-41-\tstruct platform_device ehci_dev;\n--\ndrivers/usb/host/bcma-hcd.c-48- /\ndrivers/usb/host/bcma-hcd.c:49:static int bcma_wait_bits(struct bcma_device dev, u16 reg, u32 bitmask,\ndrivers/usb/host/bcma-hcd.c-50-\t\t\t int timeout)\n--\ndrivers/usb/host/bcma-hcd.c-55-\tfor (i = 0; i \u003c timeout; i++) {\ndrivers/usb/host/bcma-hcd.c:56:\t\tval = bcma_read32(dev, reg);\ndrivers/usb/host/bcma-hcd.c-57-\t\tif ((val \u0026 bitmask) == bitmask)\n--\ndrivers/usb/host/bcma-hcd.c-64-\ndrivers/usb/host/bcma-hcd.c:65:static void bcma_hcd_4716wa(struct bcma_device dev)\ndrivers/usb/host/bcma-hcd.c-66-{\n--\ndrivers/usb/host/bcma-hcd.c-71-\ndrivers/usb/host/bcma-hcd.c:72:\t\ttmp = bcma_cpu_clock(\u0026dev-\u003ebus-\u003edrv_mips);\ndrivers/usb/host/bcma-hcd.c-73-\t\tif (tmp \u003e= 480000000)\n--\ndrivers/usb/host/bcma-hcd.c-83-\t\tif (tmp) {\ndrivers/usb/host/bcma-hcd.c:84:\t\t\tbcma_write32(dev, 0x524, 0x1); /* write sel to enable /\ndrivers/usb/host/bcma-hcd.c-85-\t\t\tudelay(500);\ndrivers/usb/host/bcma-hcd.c-86-\ndrivers/usb/host/bcma-hcd.c:87:\t\t\tbcma_write32(dev, 0x524, tmp);\ndrivers/usb/host/bcma-hcd.c-88-\t\t\tudelay(500);\ndrivers/usb/host/bcma-hcd.c:89:\t\t\tbcma_write32(dev, 0x524, 0x4ab);\ndrivers/usb/host/bcma-hcd.c-90-\t\t\tudelay(500);\ndrivers/usb/host/bcma-hcd.c:91:\t\t\tbcma_read32(dev, 0x528);\ndrivers/usb/host/bcma-hcd.c:92:\t\t\tbcma_write32(dev, 0x528, 0x80000000);\ndrivers/usb/host/bcma-hcd.c-93-\t\t}\n--\ndrivers/usb/host/bcma-hcd.c-98-/ based on arch/mips/brcm-boards/bcm947xx/pcibios.c /\ndrivers/usb/host/bcma-hcd.c:99:static void bcma_hcd_init_chip_mips(struct bcma_device dev)\ndrivers/usb/host/bcma-hcd.c-100-{\n--\ndrivers/usb/host/bcma-hcd.c-112-\t /\ndrivers/usb/host/bcma-hcd.c:113:\tif (!bcma_core_is_enabled(dev)) {\ndrivers/usb/host/bcma-hcd.c:114:\t\tbcma_core_enable(dev, 0);\ndrivers/usb/host/bcma-hcd.c-115-\t\tmdelay(10);\n--\ndrivers/usb/host/bcma-hcd.c-117-\t\t\t/ Enable Misc PLL /\ndrivers/usb/host/bcma-hcd.c:118:\t\t\ttmp = bcma_read32(dev, 0x1e0);\ndrivers/usb/host/bcma-hcd.c-119-\t\t\ttmp \|= 0x100;\ndrivers/usb/host/bcma-hcd.c:120:\t\t\tbcma_write32(dev, 0x1e0, tmp);\ndrivers/usb/host/bcma-hcd.c:121:\t\t\tif (bcma_wait_bits(dev, 0x1e0, 1 \u003c\u003c 24, 100))\ndrivers/usb/host/bcma-hcd.c-122-\t\t\t\tprintk(KERN_EMERG \"Failed to enable misc PPL!\\n\");\n--\ndrivers/usb/host/bcma-hcd.c-124-\t\t\t/ Take out of resets /\ndrivers/usb/host/bcma-hcd.c:125:\t\t\tbcma_write32(dev, 0x200, 0x4ff);\ndrivers/usb/host/bcma-hcd.c-126-\t\t\tudelay(25);\ndrivers/usb/host/bcma-hcd.c:127:\t\t\tbcma_write32(dev, 0x200, 0x6ff);\ndrivers/usb/host/bcma-hcd.c-128-\t\t\tudelay(25);\n--\ndrivers/usb/host/bcma-hcd.c-130-\t\t\t/ Make sure digital and AFE are locked in USB PHY /\ndrivers/usb/host/bcma-hcd.c:131:\t\t\tbcma_write32(dev, 0x524, 0x6b);\ndrivers/usb/host/bcma-hcd.c-132-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:133:\t\t\ttmp = bcma_read32(dev, 0x524);\ndrivers/usb/host/bcma-hcd.c-134-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:135:\t\t\tbcma_write32(dev, 0x524, 0xab);\ndrivers/usb/host/bcma-hcd.c-136-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:137:\t\t\ttmp = bcma_read32(dev, 0x524);\ndrivers/usb/host/bcma-hcd.c-138-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:139:\t\t\tbcma_write32(dev, 0x524, 0x2b);\ndrivers/usb/host/bcma-hcd.c-140-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:141:\t\t\ttmp = bcma_read32(dev, 0x524);\ndrivers/usb/host/bcma-hcd.c-142-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:143:\t\t\tbcma_write32(dev, 0x524, 0x10ab);\ndrivers/usb/host/bcma-hcd.c-144-\t\t\tudelay(50);\ndrivers/usb/host/bcma-hcd.c:145:\t\t\ttmp = bcma_read32(dev, 0x524);\ndrivers/usb/host/bcma-hcd.c-146-\ndrivers/usb/host/bcma-hcd.c:147:\t\t\tif (bcma_wait_bits(dev, 0x528, 0xc000, 10000)) {\ndrivers/usb/host/bcma-hcd.c:148:\t\t\t\ttmp = bcma_read32(dev, 0x528);\ndrivers/usb/host/bcma-hcd.c-149-\t\t\t\tprintk(KERN_EMERG\n--\ndrivers/usb/host/bcma-hcd.c-151-\t\t\t}\ndrivers/usb/host/bcma-hcd.c:152:\t\t\tbcma_write32(dev, 0x528, 0x80000000);\ndrivers/usb/host/bcma-hcd.c:153:\t\t\ttmp = bcma_read32(dev, 0x314);\ndrivers/usb/host/bcma-hcd.c-154-\t\t\tudelay(265);\ndrivers/usb/host/bcma-hcd.c:155:\t\t\tbcma_write32(dev, 0x200, 0x7ff);\ndrivers/usb/host/bcma-hcd.c-156-\t\t\tudelay(10);\n--\ndrivers/usb/host/bcma-hcd.c-158-\t\t\t/ Take USB and HSIC out of non-driving modes /\ndrivers/usb/host/bcma-hcd.c:159:\t\t\tbcma_write32(dev, 0x510, 0);\ndrivers/usb/host/bcma-hcd.c-160-\t\t} else {\ndrivers/usb/host/bcma-hcd.c:161:\t\t\tbcma_write32(dev, 0x200, 0x7ff);\ndrivers/usb/host/bcma-hcd.c-162-\n--\ndrivers/usb/host/bcma-hcd.c-165-\ndrivers/usb/host/bcma-hcd.c:166:\t\tbcma_hcd_4716wa(dev);\ndrivers/usb/host/bcma-hcd.c-167-\t}\n--\ndrivers/usb/host/bcma-hcd.c-170-/\ndrivers/usb/host/bcma-hcd.c:171: * bcma_hcd_usb20_old_arm_init - Initialize old USB 2.0 controller on ARM\ndrivers/usb/host/bcma-hcd.c-172- \n--\ndrivers/usb/host/bcma-hcd.c-177- /\ndrivers/usb/host/bcma-hcd.c:178:static int bcma_hcd_usb20_old_arm_init(struct bcma_hcd_device usb_dev)\ndrivers/usb/host/bcma-hcd.c-179-{\ndrivers/usb/host/bcma-hcd.c:180:\tstruct bcma_device core = usb_dev-\u003ecore;\ndrivers/usb/host/bcma-hcd.c-181-\tstruct device dev = \u0026core-\u003edev;\ndrivers/usb/host/bcma-hcd.c:182:\tstruct bcma_device pmu_core;\ndrivers/usb/host/bcma-hcd.c-183-\n--\ndrivers/usb/host/bcma-hcd.c-187-\ndrivers/usb/host/bcma-hcd.c:188:\tpmu_core = bcma_find_core(core-\u003ebus, BCMA_CORE_PMU);\ndrivers/usb/host/bcma-hcd.c-189-\tif (!pmu_core) {\n--\ndrivers/usb/host/bcma-hcd.c-194-\t/* Take USB core out of reset /\ndrivers/usb/host/bcma-hcd.c:195:\tbcma_awrite32(core, BCMA_IOCTL, BCMA_IOCTL_CLK \| BCMA_IOCTL_FGC);\ndrivers/usb/host/bcma-hcd.c-196-\tusleep_range(100, 200);\ndrivers/usb/host/bcma-hcd.c:197:\tbcma_awrite32(core, BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);\ndrivers/usb/host/bcma-hcd.c-198-\tusleep_range(100, 200);\ndrivers/usb/host/bcma-hcd.c:199:\tbcma_awrite32(core, BCMA_RESET_CTL, 0);\ndrivers/usb/host/bcma-hcd.c-200-\tusleep_range(100, 200);\ndrivers/usb/host/bcma-hcd.c:201:\tbcma_awrite32(core, BCMA_IOCTL, BCMA_IOCTL_CLK);\ndrivers/usb/host/bcma-hcd.c-202-\tusleep_range(100, 200);\n--\ndrivers/usb/host/bcma-hcd.c-204-\t/ Enable Misc PLL /\ndrivers/usb/host/bcma-hcd.c:205:\tbcma_write32(core, BCMA_CLKCTLST, BCMA_CLKCTLST_FORCEHT \|\ndrivers/usb/host/bcma-hcd.c-206-\t\t\t\t\t BCMA_CLKCTLST_HQCLKREQ \|\n--\ndrivers/usb/host/bcma-hcd.c-209-\ndrivers/usb/host/bcma-hcd.c:210:\tbcma_write32(core, 0x510, 0xc7f85000);\ndrivers/usb/host/bcma-hcd.c:211:\tbcma_write32(core, 0x510, 0xc7f85003);\ndrivers/usb/host/bcma-hcd.c-212-\tusleep_range(300, 600);\n--\ndrivers/usb/host/bcma-hcd.c-214-\t/ Program USB PHY PLL parameters /\ndrivers/usb/host/bcma-hcd.c:215:\tbcma_write32(pmu_core, BCMA_CC_PMU_PLLCTL_ADDR, 0x6);\ndrivers/usb/host/bcma-hcd.c:216:\tbcma_write32(pmu_core, BCMA_CC_PMU_PLLCTL_DATA, 0x005360c1);\ndrivers/usb/host/bcma-hcd.c-217-\tusleep_range(100, 200);\ndrivers/usb/host/bcma-hcd.c:218:\tbcma_write32(pmu_core, BCMA_CC_PMU_PLLCTL_ADDR, 0x7);\ndrivers/usb/host/bcma-hcd.c:219:\tbcma_write32(pmu_core, BCMA_CC_PMU_PLLCTL_DATA, 0x0);\ndrivers/usb/host/bcma-hcd.c-220-\tusleep_range(100, 200);\ndrivers/usb/host/bcma-hcd.c:221:\tbcma_set32(pmu_core, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);\ndrivers/usb/host/bcma-hcd.c-222-\tusleep_range(100, 200);\ndrivers/usb/host/bcma-hcd.c-223-\ndrivers/usb/host/bcma-hcd.c:224:\tbcma_write32(core, 0x510, 0x7f8d007);\ndrivers/usb/host/bcma-hcd.c-225-\tudelay(1000);\n--\ndrivers/usb/host/bcma-hcd.c-227-\t/ Take controller out of reset /\ndrivers/usb/host/bcma-hcd.c:228:\tbcma_write32(core, 0x200, 0x4ff);\ndrivers/usb/host/bcma-hcd.c-229-\tusleep_range(25, 50);\ndrivers/usb/host/bcma-hcd.c:230:\tbcma_write32(core, 0x200, 0x6ff);\ndrivers/usb/host/bcma-hcd.c-231-\tusleep_range(25, 50);\ndrivers/usb/host/bcma-hcd.c:232:\tbcma_write32(core, 0x200, 0x7ff);\ndrivers/usb/host/bcma-hcd.c-233-\tusleep_range(25, 50);\n--\ndrivers/usb/host/bcma-hcd.c-239-\ndrivers/usb/host/bcma-hcd.c:240:static void bcma_hcd_usb20_ns_init_hc(struct bcma_device dev)\ndrivers/usb/host/bcma-hcd.c-241-{\n--\ndrivers/usb/host/bcma-hcd.c-244-\t/* Set packet buffer OUT threshold /\ndrivers/usb/host/bcma-hcd.c:245:\tval = bcma_read32(dev, 0x94);\ndrivers/usb/host/bcma-hcd.c-246-\tval \u0026= 0xffff;\ndrivers/usb/host/bcma-hcd.c-247-\tval \|= 0x80 \u003c\u003c 16;\ndrivers/usb/host/bcma-hcd.c:248:\tbcma_write32(dev, 0x94, val);\ndrivers/usb/host/bcma-hcd.c-249-\ndrivers/usb/host/bcma-hcd.c-250-\t/ Enable break memory transfer /\ndrivers/usb/host/bcma-hcd.c:251:\tval = bcma_read32(dev, 0x9c);\ndrivers/usb/host/bcma-hcd.c-252-\tval \|= 1;\ndrivers/usb/host/bcma-hcd.c:253:\tbcma_write32(dev, 0x9c, val);\ndrivers/usb/host/bcma-hcd.c-254-\n--\ndrivers/usb/host/bcma-hcd.c-263-/\ndrivers/usb/host/bcma-hcd.c:264: * bcma_hcd_usb20_ns_init - Initialize Northstar USB 2.0 controller\ndrivers/usb/host/bcma-hcd.c-265- /\ndrivers/usb/host/bcma-hcd.c:266:static int bcma_hcd_usb20_ns_init(struct bcma_hcd_device bcma_hcd)\ndrivers/usb/host/bcma-hcd.c-267-{\ndrivers/usb/host/bcma-hcd.c:268:\tstruct bcma_device core = bcma_hcd-\u003ecore;\ndrivers/usb/host/bcma-hcd.c:269:\tstruct bcma_chipinfo ci = \u0026core-\u003ebus-\u003echipinfo;\ndrivers/usb/host/bcma-hcd.c-270-\tstruct device *dev = \u0026core-\u003edev;\ndrivers/usb/host/bcma-hcd.c-271-\ndrivers/usb/host/bcma-hcd.c:272:\tbcma_core_enable(core, 0);\ndrivers/usb/host/bcma-hcd.c-273-\n\n" }
27/2	2026/10/27 03:31	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 55058 output: 41 thoughts: 1813 Thoughts: Analyzing the Broadcom BCMA Bus Driver for Fuzzing Potential Okay, so I'm looking at `bcma-hcd.c`, a USB Host Controller driver that clearly attaches to the `bcma` bus, specifically targeting BCMA cores like `BCMA_CORE_USB20_HOST`. My immediate question is whether this bus can even be registered without physical Broadcom hardware or an OF device tree. This is a crucial first step in determining if this code is reachable in a fuzzing environment. I started by scouring the kernel for all instances of `bcma_bus_register` and `struct bcma_bus` to understand how the bus is instantiated. Initially, grep pointed me towards `arch/mips/bcm47xx/setup.c`, but that's MIPS-specific, and my target is AMD64, so that's a dead end. Then, I found `drivers/bcma/host_pci.c` which utilizes `bcma_pci_bridge_driver` via `pci_register_driver`. There's also `drivers/bcma/host_soc.c` with the platform driver `bcma_host_soc_driver`, matching `brcm,bus-axi` from Device Tree. The concern here is whether `bcma_host_soc_probe` can be triggered on AMD64, which typically uses ACPI, not the Device Tree. Unless there's some sort of fake DTB being used, and `brcm,bus-axi` requires specific MMIO ranges of a Broadcom SoC bus, which isn't standard on AMD64 QEMU. Back to the PCI driver. `bcma_pci_bridge_driver` is interesting, but it relies on specific Broadcom PCI vendor and device IDs. I pulled up the `pci_device_id` table. These are all Broadcom WiFi or SoC PCI devices, like BCM4313, BCM43224, etc. Here's where it hit me: does QEMU, the standard emulator, actually emulate any of these Broadcom PCI devices? No! Standard QEMU emulates other devices but not Broadcom WiFi chips. My next line of thought: could syzkaller somehow emulate PCI devices? Does the kernel have any generic userspace PCI device emulation, similar to the USB Raw Gadget setup for USB? Nope. `virtio` is virtio. `pci-stub` and `vfio-pci` are for passing through physical devices, not emulating them. Let's re-read the negative criteria. Specifically, the wording here: "Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU." Now, my mind shifts to `bcm47xx_sprom.c` located under `drivers/firmware/broadcom`. How does this code get triggered? I have to look at how the functions are called. The functions modified are: `nvram_read_avvmid`, `bcm47xx_sprom_fill_nvram_only`, `bcm47xx_sprom_fill_auto` (which calls `bcm47xx_sprom_fill_nvram_only`), `bcm47xx_sprom_bcma_prefix`, `bcm47xx_sprom_fill_bcma_nvram` (newly added and exported to `bcma_sprom_get`), and `bcm47xx_get_sprom_bcma` (calls `bcm47xx_sprom_bcma_prefix`). Aha! `bcm47xx_sprom_fill_bcma_nvram` is called by `bcma_sprom_get` in `drivers/bcma/sprom.c` via the `bcma_bus` struct. And `bcm47xx_get_sprom_bcma` is also being called... I need to chase that down further. I need to see where that bus is registered, and how I can reach that code path!
28/2	2026/10/27 03:32	tool	grepper	0m Args: { "Expression": "bcm47xx_get_sprom_bcma", "PathPrefixes": [ "drivers/", "arch/" ] } Results: { "Output": "drivers/firmware/broadcom/bcm47xx_sprom.c=737=int bcm47xx_sprom_fill_bcma_nvram(struct bcma_bus bus, struct ssb_sprom out)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-749-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:750:static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom out)\ndrivers/firmware/broadcom/bcm47xx_sprom.c-751-{\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=781=int bcm47xx_sprom_register_fallbacks(void)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-791-#if IS_BUILTIN(CONFIG_BCMA)\ndrivers/firmware/broadcom/bcm47xx_sprom.c:792:\tif (bcma_arch_register_fallback_sprom(\u0026bcm47xx_get_sprom_bcma))\ndrivers/firmware/broadcom/bcm47xx_sprom.c-793-\t\tpr_warn(\"Failed to register bcma SPROM handler\\n\");\n" }
29/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 58187 output: 40 thoughts: 66 Thoughts: Here's my analysis of the provided information, as if these were my internal thoughts: Analyzing the bcma Fallback SPROM Handler Okay, so `bcm47xx_get_sprom_bcma` is being set up as the go-to fallback sprom handler for the Broadcom Component Architecture (bcma) system, interesting. This implies that the standard method is failing for some reason, and this handler is there to fill in the gaps. Now, I need to understand when and how this fallback mechanism is actually triggered. Let's trace this back to understand the control flow. The logical next step is to locate where `bcm47xx_sprom_fill_auto` gets called – that's the key to understanding how this all ties together. I'm assuming that it is called either directly by `bcm47xx_get_sprom_bcma`, or as part of its function calls. I should start investigating that function now.
30/2	2026/10/27 03:32	tool	grepper	0m Args: { "Expression": "bcm47xx_sprom_fill_auto", "PathPrefixes": [ "drivers/", "arch/" ] } Results: { "Output": "drivers/firmware/broadcom/bcm47xx_sprom.c=203=static void bcm47xx_sprom_fill_nvram_only(struct ssb_sprom sprom,\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-235- /\ndrivers/firmware/broadcom/bcm47xx_sprom.c:236:static void bcm47xx_sprom_fill_auto(struct ssb_sprom sprom,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-237-\t\t\t\t const char prefix, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=614=void bcm47xx_fill_sprom(struct ssb_sprom sprom, const char prefix,\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-639-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:640:\tbcm47xx_sprom_fill_auto(sprom, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-641-}\n" }
31/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 58827 output: 38 thoughts: 17 Thoughts: Okay, here's my summary, tailored as requested: Tracing the bcm47xx_fill_sprom Function Call Alright, let's get down to brass tacks. I'm deep into this firmware again, and the `bcm47xx_fill_sprom` function has popped up. My immediate question, the one that really needs answering before I go any further, is: where exactly is this function being invoked? I need to understand its call stack, its context. Knowing the caller tells me what information is likely being passed to it, what its intended purpose is in the broader system, and the events that trigger its execution. Is it called during the boot sequence, network initialization, or perhaps in response to a specific driver event? Knowing this will help me quickly understand the purpose of `bcm47xx_fill_sprom`. So, where is it? I need to find the callsites. Let's start digging.
32/2	2026/10/27 03:32	tool	grepper	0m Args: { "Expression": "bcm47xx_fill_sprom", "PathPrefixes": [ "drivers/", "arch/" ] } Results: { "Output": "drivers/firmware/broadcom/bcm47xx_sprom.c=236=static void bcm47xx_sprom_fill_auto(struct ssb_sprom sprom,\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-458-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:459:static void bcm47xx_fill_sprom_path_r4589(struct ssb_sprom sprom,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-460-\t\t\t\t\t const char prefix, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-509-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:510:static void bcm47xx_fill_sprom_path_r45(struct ssb_sprom sprom,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-511-\t\t\t\t\tconst char prefix, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=558=static int mac_addr_used = 2;\ndrivers/firmware/broadcom/bcm47xx_sprom.c-559-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:560:static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom sprom,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-561-\t\t\t\t\tconst char prefix, bool fallback)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=605=static void bcm47xx_fill_board_data(struct ssb_sprom sprom, const char prefix,\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-613-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:614:void bcm47xx_fill_sprom(struct ssb_sprom sprom, const char prefix,\ndrivers/firmware/broadcom/bcm47xx_sprom.c-615-\t\t\tbool fallback)\ndrivers/firmware/broadcom/bcm47xx_sprom.c-616-{\ndrivers/firmware/broadcom/bcm47xx_sprom.c:617:\tbcm47xx_fill_sprom_ethernet(sprom, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-618-\tbcm47xx_fill_board_data(sprom, prefix, fallback);\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-630-\tcase 5:\ndrivers/firmware/broadcom/bcm47xx_sprom.c:631:\t\tbcm47xx_fill_sprom_path_r4589(sprom, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c:632:\t\tbcm47xx_fill_sprom_path_r45(sprom, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-633-\t\tbreak;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-635-\tcase 9:\ndrivers/firmware/broadcom/bcm47xx_sprom.c:636:\t\tbcm47xx_fill_sprom_path_r4589(sprom, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-637-\t\tbreak;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=644=static int bcm47xx_get_sprom_ssb(struct ssb_bus bus, struct ssb_sprom out)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-649-\tcase SSB_BUSTYPE_SSB:\ndrivers/firmware/broadcom/bcm47xx_sprom.c:650:\t\tbcm47xx_fill_sprom(out, NULL, false);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-651-\t\treturn 0;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-656-\t\t\t PCI_SLOT(bus-\u003ehost_pci-\u003edevfn));\ndrivers/firmware/broadcom/bcm47xx_sprom.c:657:\t\tbcm47xx_fill_sprom(out, prefix, false);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-658-\t\treturn 0;\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c=750=static int bcm47xx_get_sprom_bcma(struct bcma_bus bus, struct ssb_sprom *out)\n--\ndrivers/firmware/broadcom/bcm47xx_sprom.c-768-\ndrivers/firmware/broadcom/bcm47xx_sprom.c:769:\tbcm47xx_fill_sprom(out, prefix, fallback);\ndrivers/firmware/broadcom/bcm47xx_sprom.c-770-\n" }
33/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 60490 output: 32 thoughts: 511 Thoughts: My Analysis of `bcm47xx_sprom` Usage and Testability Okay, so `bcm47xx_sprom` seems pretty central, but it's only called from `bcm47xx_get_sprom_ssb`, `bcm47xx_get_sprom_bcma`, and `bcm47xx_sprom_fill_bcma_nvram`. And all of those functions are expecting either a `struct bcma_bus` or a `struct ssb_bus` structure. Right, that makes sense. Now, where do those bus structures come from? Let's trace it back. Looks like the `bcma_bus` can be initialized through `bcma_host_pci_probe` (for Broadcom PCI devices), `bcma_host_soc_probe` (for Broadcom SoCs via DT), or even something in MIPS architecture-specific code (`arch/mips/bcm47xx/setup.c`). Aha! Let's zoom in on `drivers/bcma/host_pci.c`. The million-dollar question: Can we trigger `bcma_host_pci`'s probe in a testing environment like QEMU? Can QEMU create a virtual Broadcom PCI device? No, hold on... In QEMU or even Google Compute Engine VMs running syzkaller, the PCI devices are static. They're determined at QEMU launch (like `-device virtio-net-pci` or the standard motherboard chipset devices). Syzkaller fuzzes inside the VM. It doesn't control the QEMU command line to inject arbitrary PCI hardware, and even if it could, QEMU doesn't have a model for a Broadcom BCMA PCI device anyway. This is a dead end. Okay, let's pivot. Can a user-space process itself create a virtual PCI device in Linux? Is there a "pci-gadget" like we have for USB with `dummy_hcd` or `raw_gadget`? No, as far as I know, there isn't. No upstream mechanism for userspace PCI emulation. That's unfortunate. Wait a minute, what about the PCI endpoint test framework? Is there something in the kernel that lets us poke at things, or create virtual PCI devices there? The `pci-endpoint-test` driver? No, that's just testing endpoints, which isn't the same as creating a BCMA bus. Alright, what about the kernel config, `CONFIG_BCMA`? Is it just a compile-time flag? Can we instantiate a BCMA bus in software, maybe through sysfs? Let's check the code: does BCMA have any bus registration functions from sysfs, something like `new_device` or similar? Time to search for `bus_type` or `bcma_bus_type` and see if we can find any hints. That seems like the most likely avenue to explore next.
34/2	2026/10/27 03:32	tool	grepper	0m Args: { "Expression": "bcma_bus_type", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "drivers/bcma/main.c=69=ATTRIBUTE_GROUPS(bcma_device);\ndrivers/bcma/main.c-70-\ndrivers/bcma/main.c:71:static const struct bus_type bcma_bus_type = {\ndrivers/bcma/main.c-72-\t.name\t\t= \"bcma\",\n--\ndrivers/bcma/main.c=238=void bcma_prepare_core(struct bcma_bus bus, struct bcma_device core)\n--\ndrivers/bcma/main.c-241-\tcore-\u003edev.release = bcma_release_core_dev;\ndrivers/bcma/main.c:242:\tcore-\u003edev.bus = \u0026bcma_bus_type;\ndrivers/bcma/main.c-243-\tdev_set_name(\u0026core-\u003edev, \"bcma%d:%d\", bus-\u003enum, core-\u003ecore_index);\n--\ndrivers/bcma/main.c=577=int __bcma_driver_register(struct bcma_driver drv, struct module owner)\n--\ndrivers/bcma/main.c-579-\tdrv-\u003edrv.name = drv-\u003ename;\ndrivers/bcma/main.c:580:\tdrv-\u003edrv.bus = \u0026bcma_bus_type;\ndrivers/bcma/main.c-581-\tdrv-\u003edrv.owner = owner;\n--\ndrivers/bcma/main.c=654=static int __init bcma_init_bus_register(void)\n--\ndrivers/bcma/main.c-660-\ndrivers/bcma/main.c:661:\terr = bus_register(\u0026bcma_bus_type);\ndrivers/bcma/main.c-662-\tif (!err)\n--\ndrivers/bcma/main.c=697=static void __exit bcma_modexit(void)\n--\ndrivers/bcma/main.c-702-\tbcma_host_soc_unregister_driver();\ndrivers/bcma/main.c:703:\tbus_unregister(\u0026bcma_bus_type);\ndrivers/bcma/main.c-704-}\n" }
35/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 62248 output: 35 thoughts: 24 Thoughts: Here's a summary of my thought process: Diving into the bcma_bus_type Definition Okay, so I need to understand how `bcma_bus_type` is defined. My first instinct is to locate the source code, specifically the `drivers/bcma/main.c` file. I'll open that up and jump straight to the definition. That's the most efficient way to get a handle on the data structure itself and how it's being used within the BCMA driver context. Let's see what we've got.
36/2	2026/10/27 03:32	tool	read-file	0m Args: { "File": "drivers/bcma/main.c", "FirstLine": 65, "LineCount": 50 } Results: { "Contents": " 65:\t\t\u0026dev_attr_rev.attr,\n 66:\t\t\u0026dev_attr_class.attr,\n 67:\t\tNULL,\n 68:\t};\n 69:\tATTRIBUTE_GROUPS(bcma_device);\n 70:\t\n 71:\tstatic const struct bus_type bcma_bus_type = {\n 72:\t\t.name\t\t= \"bcma\",\n 73:\t\t.match\t\t= bcma_bus_match,\n 74:\t\t.probe\t\t= bcma_device_probe,\n 75:\t\t.remove\t\t= bcma_device_remove,\n 76:\t\t.uevent\t\t= bcma_device_uevent,\n 77:\t\t.dev_groups\t= bcma_device_groups,\n 78:\t};\n 79:\t\n 80:\tstatic u16 bcma_cc_core_id(struct bcma_bus bus)\n 81:\t{\n 82:\t\tif (bus-\u003echipinfo.id == BCMA_CHIP_ID_BCM4706)\n 83:\t\t\treturn BCMA_CORE_4706_CHIPCOMMON;\n 84:\t\treturn BCMA_CORE_CHIPCOMMON;\n 85:\t}\n 86:\t\n 87:\tstruct bcma_device bcma_find_core_unit(struct bcma_bus bus, u16 coreid,\n 88:\t\t\t\t\t\tu8 unit)\n 89:\t{\n 90:\t\tstruct bcma_device core;\n 91:\t\n 92:\t\tlist_for_each_entry(core, \u0026bus-\u003ecores, list) {\n 93:\t\t\tif (core-\u003eid.id == coreid \u0026\u0026 core-\u003ecore_unit == unit)\n 94:\t\t\t\treturn core;\n 95:\t\t}\n 96:\t\treturn NULL;\n 97:\t}\n 98:\tEXPORT_SYMBOL_GPL(bcma_find_core_unit);\n 99:\t\n 100:\tbool bcma_wait_value(struct bcma_device *core, u16 reg, u32 mask, u32 value,\n 101:\t\t\t int timeout)\n 102:\t{\n 103:\t\tunsigned long deadline = jiffies + timeout;\n 104:\t\tu32 val;\n 105:\t\n 106:\t\tdo {\n 107:\t\t\tval = bcma_read32(core, reg);\n 108:\t\t\tif ((val \u0026 mask) == value)\n 109:\t\t\t\treturn true;\n 110:\t\t\tcpu_relax();\n 111:\t\t\tudelay(10);\n 112:\t\t} while (!time_after_eq(jiffies, deadline));\n 113:\t\n 114:\t\tbcma_warn(core-\u003ebus, \"Timeout waiting for register 0x%04X!\\n\", reg);\n" }
37/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 63174 output: 39 thoughts: 135 Thoughts: Investigating the BCMA Bus and PCI Device Binding Okay, so I'm digging into this `bcma_bus_type` and trying to figure out how a new device can be introduced from userspace. I'm not seeing any obvious entry points like a `new_device` or `bind` attribute in `bcma_bus_type` itself. That feels pretty restrictive. Wait a second... Could we potentially leverage the PCI bus directly? Can any PCI device, even indirectly related to BCMA, be bound to the `bcma_pci_bridge_driver` using the sysfs interface under `/sys/bus/pci/drivers/bcma-pci-bridge`? Specifically, by playing with `new_id` or `bind`? That's definitely worth exploring. But... that raises a red flag. What actually happens if a user attempts to write a PCI ID or device to the `bind` file? What kind of checks are in place? Are we opening a security hole or introducing some kind of instability? I need to understand this. Alright, time to get my hands dirty. I'm going to trace the execution path of `bcma_host_pci_probe`. Understanding that function and how it interacts with the PCI bus is going to be crucial to understanding the potential implications of these `bind` operations. Let's see what happens there.
38/2	2026/10/27 03:32	tool	read-file	0m Args: { "File": "drivers/bcma/host_pci.c", "FirstLine": 160, "LineCount": 80 } Results: { "Contents": " 160:\tstatic int bcma_host_pci_probe(struct pci_dev dev,\n 161:\t\t\t\t const struct pci_device_id id)\n 162:\t{\n 163:\t\tstruct bcma_bus bus;\n 164:\t\tint err = -ENOMEM;\n 165:\t\tu32 val;\n 166:\t\n 167:\t\t/ Alloc /\n 168:\t\tbus = kzalloc_obj(bus);\n 169:\t\tif (!bus)\n 170:\t\t\tgoto out;\n 171:\t\n 172:\t\t/* Basic PCI configuration /\n 173:\t\terr = pci_enable_device(dev);\n 174:\t\tif (err)\n 175:\t\t\tgoto err_kfree_bus;\n 176:\t\n 177:\t\terr = pci_request_regions(dev, \"bcma-pci-bridge\");\n 178:\t\tif (err)\n 179:\t\t\tgoto err_pci_disable;\n 180:\t\tpci_set_master(dev);\n 181:\t\n 182:\t\t/ Disable the RETRY_TIMEOUT register (0x41) to keep\n 183:\t\t * PCI Tx retries from interfering with C3 CPU state /\n 184:\t\tpci_read_config_dword(dev, 0x40, \u0026val);\n 185:\t\tif ((val \u0026 0x0000ff00) != 0)\n 186:\t\t\tpci_write_config_dword(dev, 0x40, val \u0026 0xffff00ff);\n 187:\t\n 188:\t\t/ SSB needed additional powering up, do we have any AMBA PCI cards? /\n 189:\t\tif (!pci_is_pcie(dev)) {\n 190:\t\t\tbcma_err(bus, \"PCI card detected, they are not supported.\\n\");\n 191:\t\t\terr = -ENXIO;\n 192:\t\t\tgoto err_pci_release_regions;\n 193:\t\t}\n 194:\t\n 195:\t\tbus-\u003edev = \u0026dev-\u003edev;\n 196:\t\n 197:\t\t/ Map MMIO /\n 198:\t\terr = -ENOMEM;\n 199:\t\tbus-\u003emmio = pci_iomap(dev, 0, ~0UL);\n 200:\t\tif (!bus-\u003emmio)\n 201:\t\t\tgoto err_pci_release_regions;\n 202:\t\n 203:\t\t/ Host specific /\n 204:\t\tbus-\u003ehost_pci = dev;\n 205:\t\tbus-\u003ehosttype = BCMA_HOSTTYPE_PCI;\n 206:\t\tbus-\u003eops = \u0026bcma_host_pci_ops;\n 207:\t\n 208:\t\tbus-\u003eboardinfo.vendor = bus-\u003ehost_pci-\u003esubsystem_vendor;\n 209:\t\tbus-\u003eboardinfo.type = bus-\u003ehost_pci-\u003esubsystem_device;\n 210:\t\n 211:\t\t/ Initialize struct, detect chip /\n 212:\t\tbcma_init_bus(bus);\n 213:\t\n 214:\t\t/ Scan bus to find out generation of PCIe core /\n 215:\t\terr = bcma_bus_scan(bus);\n 216:\t\tif (err)\n 217:\t\t\tgoto err_pci_unmap_mmio;\n 218:\t\n 219:\t\tif (bcma_find_core(bus, BCMA_CORE_PCIE2))\n 220:\t\t\tbus-\u003ehost_is_pcie2 = true;\n 221:\t\n 222:\t\t/ Register */\n 223:\t\terr = bcma_bus_register(bus);\n 224:\t\tif (err)\n 225:\t\t\tgoto err_unregister_cores;\n 226:\t\n 227:\t\tpci_set_drvdata(dev, bus);\n 228:\t\n 229:\tout:\n 230:\t\treturn err;\n 231:\t\n 232:\terr_unregister_cores:\n 233:\t\tbcma_unregister_cores(bus);\n 234:\terr_pci_unmap_mmio:\n 235:\t\tpci_iounmap(dev, bus-\u003emmio);\n 236:\terr_pci_release_regions:\n 237:\t\tpci_release_regions(dev);\n 238:\terr_pci_disable:\n 239:\t\tpci_disable_device(dev);\n" }
39/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 64865 output: 33 thoughts: 141 Thoughts: Here's my analysis of the situation: Investigating a Potentially Mis-Bound PCI Device Okay, hold on a second! Even if some clever individual has managed to force a completely unrelated PCI device to use `bcma_pci_bridge_driver` through the sysfs interface, I need to figure out what happens when the driver actually attempts to initialize. Let's delve into the `bcma_host_pci_probe` function. First, it calls `pci_is_pcie(dev)` to determine if the device is a PCIe device. Then, it attempts to map the memory region using `bus->mmio = pci_iomap(dev, 0, ~0UL);`. After that, the `bcma_init_bus(bus)` function is called, followed by `bcma_bus_scan(bus)`. I think the most important thing to examine is what `bcma_bus_scan(bus)` actually does. That will reveal the true nature of this potential misconfiguration. I need to understand its behavior thoroughly to assess any implications.
40/2	2026/10/27 03:32	tool	grepper	0m Args: { "Expression": "int bcma_bus_scan", "PathPrefixes": [ "drivers/bcma/" ] } Results: { "Output": "drivers/bcma/bcma_private.h=38=void bcma_detect_chip(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h:39:int bcma_bus_scan(struct bcma_bus bus);\ndrivers/bcma/bcma_private.h-40-\n--\ndrivers/bcma/scan.c=437=void bcma_detect_chip(struct bcma_bus bus)\n--\ndrivers/bcma/scan.c-455-\ndrivers/bcma/scan.c:456:int bcma_bus_scan(struct bcma_bus bus)\ndrivers/bcma/scan.c-457-{\n" }
41/2	2026/10/27 03:32	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 65459 output: 36 thoughts: 26 Thoughts: Okay, let's dive into this. Here's my take on those lines of code, presented as a personal reflection, keeping in mind my expertise: Diving into `drivers/bcma/scan.c` Alright, I'm thinking we need to go back and revisit `drivers/bcma/scan.c`. Specifically, I want to refresh my memory around lines 437 and 456. From what I recall, these sections likely deal with the enumeration or detection routines within the Broadcom Core Architecture (BCMA) bus scan. My initial hypothesis is that they probably handle some crucial aspect of identifying attached devices, perhaps related to probe timing, device type filtering, or error handling during the scan process. Given my understanding of BCMA and the challenges inherent in this type of hardware discovery, I anticipate a careful dance between hardware interaction, interrupt handling (potentially), and the interpretation of returned device information. I will be looking closely for any subtle nuances that might explain a previous issue, or provide hints for optimizations.
42/2	2026/10/27 03:33	tool	read-file	0m Args: { "File": "drivers/bcma/scan.c", "FirstLine": 435, "LineCount": 60 } Results: { "Contents": " 435:\t}\n 436:\t\n 437:\tvoid bcma_detect_chip(struct bcma_bus bus)\n 438:\t{\n 439:\t\ts32 tmp;\n 440:\t\tstruct bcma_chipinfo chipinfo = \u0026(bus-\u003echipinfo);\n 441:\t\tchar chip_id[8];\n 442:\t\n 443:\t\tbcma_scan_switch_core(bus, BCMA_ADDR_BASE);\n 444:\t\n 445:\t\ttmp = bcma_scan_read32(bus, BCMA_CC_ID);\n 446:\t\tchipinfo-\u003eid = (tmp \u0026 BCMA_CC_ID_ID) \u003e\u003e BCMA_CC_ID_ID_SHIFT;\n 447:\t\tchipinfo-\u003erev = (tmp \u0026 BCMA_CC_ID_REV) \u003e\u003e BCMA_CC_ID_REV_SHIFT;\n 448:\t\tchipinfo-\u003epkg = (tmp \u0026 BCMA_CC_ID_PKG) \u003e\u003e BCMA_CC_ID_PKG_SHIFT;\n 449:\t\n 450:\t\tsnprintf(chip_id, ARRAY_SIZE(chip_id),\n 451:\t\t\t (chipinfo-\u003eid \u003e 0x9999) ? \"%d\" : \"0x%04X\", chipinfo-\u003eid);\n 452:\t\tbcma_info(bus, \"Found chip with id %s, rev 0x%02X and package 0x%02X\\n\",\n 453:\t\t\t chip_id, chipinfo-\u003erev, chipinfo-\u003epkg);\n 454:\t}\n 455:\t\n 456:\tint bcma_bus_scan(struct bcma_bus bus)\n 457:\t{\n 458:\t\tu32 erombase;\n 459:\t\tu32 __iomem eromptr, eromend;\n 460:\t\n 461:\t\tint err, core_num = 0;\n 462:\t\n 463:\t\t/ Skip if bus was already scanned (e.g. during early register) /\n 464:\t\tif (bus-\u003enr_cores)\n 465:\t\t\treturn 0;\n 466:\t\n 467:\t\terombase = bcma_scan_read32(bus, BCMA_CC_EROM);\n 468:\t\tif (bus-\u003ehosttype == BCMA_HOSTTYPE_SOC) {\n 469:\t\t\teromptr = ioremap(erombase, BCMA_CORE_SIZE);\n 470:\t\t\tif (!eromptr)\n 471:\t\t\t\treturn -ENOMEM;\n 472:\t\t} else {\n 473:\t\t\teromptr = bus-\u003emmio;\n 474:\t\t}\n 475:\t\n 476:\t\teromend = eromptr + BCMA_CORE_SIZE / sizeof(u32);\n 477:\t\n 478:\t\tbcma_scan_switch_core(bus, erombase);\n 479:\t\n 480:\t\twhile (eromptr \u003c eromend) {\n 481:\t\t\tstruct bcma_device other_core;\n 482:\t\t\tstruct bcma_device core = kzalloc_obj(core);\n 483:\t\t\tif (!core) {\n 484:\t\t\t\terr = -ENOMEM;\n 485:\t\t\t\tgoto out;\n 486:\t\t\t}\n 487:\t\t\tINIT_LIST_HEAD(\u0026core-\u003elist);\n 488:\t\t\tcore-\u003ebus = bus;\n 489:\t\n 490:\t\t\terr = bcma_get_next_core(bus, \u0026eromptr, NULL, core_num, core);\n 491:\t\t\tif (err \u003c 0) {\n 492:\t\t\t\tkfree(core);\n 493:\t\t\t\tif (err == -ENODEV) {\n 494:\t\t\t\t\tcore_num++;\n" }
43/2	2026/10/27 03:33	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 66759 output: 45 thoughts: 1622 Thoughts: Analyzing the Impact of This Commit Okay, let's break this down. First, I see the code is trying to read registers from the hardware EROM, which is on-chip ROM on Broadcom chips. This is for identifying the cores on the AXI bus. The problem is, if a random PCIe device were bound, reads would either return garbage or fail entirely. It's not the target. Then, there are the specific guidelines in Section 2, about structurally unreachable hardware. It specifically mentions vendor-specific PCIe switches, SmartNICs, or GPU drivers that require physical cards not emulated in QEMU. This seems to be the core concern: the hardware this code interacts with might not be available in a standard QEMU environment, or even be possible to emulate. Now, let's go line-by-line, since that's where the rubber meets the road. 1. `drivers/bcma/core.c`: A simple change, `bcma_mask32` is now used instead of `bcma_set32`. Fine. 2. `drivers/bcma/driver_chipcommon.c`: Some GPIO control and now an asynchronous GPIO control setting. OK. 3. `drivers/bcma/driver_chipcommon_pmu.c`: Introduction of PLL and PMU initialization specifically for BCM4352 and BCM4360, which are Broadcom 802.11ac chips. This seems very targeted and specific. 4. `drivers/bcma/driver_pcie2.c`: PCIE2 initialization for BCM4360 and BCM4352, setting the `HAVEHTREQ` flag. Very specific to these chips. 5. `drivers/bcma/host_pci.c`: Adds PCI ID 14e4:43b3. New device support. 6. `drivers/bcma/sprom.c`: Code for unpacking SPROM Rx gain data and extracting Revision 11 SPROM data. 7. `drivers/firmware/broadcom/bcm47xx_sprom.c`: Extracts NVRAM variables for the BCM47xx family and Broadcom SPROM. 8. `include/...`: Generic headers. Essentially, all of these changes are strictly related to Broadcom's BCMA bus and the Broadcom SPROM firmware parser, for specific Broadcom hardware (BCM4360, BCM4352, and other Broadcom WiFi/SoC chips). Now, the critical question: Can any of this Broadcom WiFi or BCMA hardware be emulated in QEMU? No! QEMU does not have emulated BCM4360 or BCM43xx devices. Standard QEMU doesn't emulate any Broadcom wireless NIC or BCMA bus device. I'm pretty certain there's an issue. It appears this code is only relevant to physical Broadcom hardware. It will not work in a standard QEMU environment. The code may very well rely on physical PCI hot-unplug, or manual sysfs driver unbinding to unload it, and there's no way to reproduce that in QEMU. I need to check how relevant `brcmfmac` is to this, and if it might be affected. The answer is no; `brcmfmac` has its own drivers and code in the `brcmfmac/chip.c` that does not utilize `drivers/bcma`.
44/2	2026/10/27 03:33	tool	grepper	0m Args: { "Expression": "bcma", "PathPrefixes": [ "drivers/net/wireless/broadcom/brcm80211/brcmfmac/" ] } Results: { "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c-8-#include \u003clinux/ssb/ssb_regs.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:9:#include \u003clinux/bcma/bcma.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:10:#include \u003clinux/bcma/bcma_regs.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c-11-\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c-12-#include \u003clinux/interrupt.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c:13:#include \u003clinux/bcma/bcma.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c-14-#include \u003clinux/sched.h\u003e\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c-22-#include \u003clinux/module.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:23:#include \u003clinux/bcma/bcma.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c-24-#include \u003clinux/debugfs.h\u003e\n" }
45/2	2026/10/27 03:33	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 69619 output: 46 thoughts: 65 Thoughts: Okay, let's dive into this. Here's my thought process on dissecting the relationship between `brcmfmac` and `bcma.h` and the broader `drivers/bcma/` directory: Examining the Interplay Between `brcmfmac` and `bcma` My immediate concern is understanding the dependency – specifically, how `brcmfmac` leverages the functionality defined within `bcma.h`. I need to identify which structures, macros, or enums from that header file are actually utilized in the `brcmfmac` module. A more direct question: does `brcmfmac` make any function calls to code residing within the `drivers/bcma/` directory? This is the core of what I'm after: direct API usage. To do this efficiently, I'll start with a targeted code inspection. `brcmfmac/chip.c` and `brcmfmac/usb.c` are good starting points. These are likely to contain hardware-specific initialization and control logic, so they're prime candidates for interactions with the Broadcom-specific features found in `bcma`. I'll analyze these files to determine if any external `bcma` functions are present.
46/2	2026/10/27 03:33	tool	grepper	0m Args: { "Expression": "bcma_", "PathPrefixes": [ "drivers/net/wireless/broadcom/brcm80211/brcmfmac/" ] } Results: { "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c-9-#include \u003clinux/bcma/bcma.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:10:#include \u003clinux/bcma/bcma_regs.h\u003e\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c-11-\n" }
47/2	2026/10/27 03:33	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 70124 output: 33 thoughts: 80 Thoughts: Okay, here's my understanding, thinking through this as an expert in the field: Internal Review of Broadcom Wireless Driver Architecture Right, so I'm looking at these Broadcom drivers and need to clarify a key point. It seems like `brcmfmac` only pulls in `bcma_regs.h`. That's solely for those register definitions – the offsets, constants, and so on. It's not using any of the underlying `drivers/bcma/` code or infrastructure. That's a vital distinction to lock in. Now, that immediately raises a question in my mind: What about `brcmsmac`? It's the SoftMAC PCIe driver from Broadcom, so how does that fit into the picture? I need to check how `brcmsmac` interacts with the bcma subsystem, if at all. That's the next logical step in this investigation. I need to see if there's any code sharing or interaction at the lower levels with the bus configuration management.
48/2	2026/10/27 03:33	tool	grepper	0m Args: { "Expression": "bcma_driver_register", "PathPrefixes": [ "drivers/net/wireless/" ] } Results: { "Output": "drivers/net/wireless/broadcom/b43/main.c=5827=static int __init b43_init(void)\n--\ndrivers/net/wireless/broadcom/b43/main.c-5835-#ifdef CONFIG_B43_BCMA\ndrivers/net/wireless/broadcom/b43/main.c:5836:\terr = bcma_driver_register(\u0026b43_bcma_driver);\ndrivers/net/wireless/broadcom/b43/main.c-5837-\tif (err)\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c=1309=static void brcms_driver_init(struct work_struct *work)\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c-1312-\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c:1313:\terror = bcma_driver_register(\u0026brcms_bcma_driver);\ndrivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c-1314-\tif (error)\n" }
49/2	2026/10/27 03:33	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 70802 output: 44 thoughts: 306 Thoughts: My Analysis of Broadcom BCMA Driver Initialization Okay, so here's the situation as I see it. The `b43` and `brcmsmac` drivers are hooking into the `bcma` subsystem through `bcma_driver_register()`. This function registers the driver on the `bcma_bus_type`. This is the key. The devices on the `bcma_bus_type` are only created when `bcma_bus_scan()` is called, and that happens on a `bcma_bus`. The critical bit, as always, is how a `bcma_bus` actually gets instantiated. From what I can tell, `bcma_bus` instances are only created in a few specific scenarios: `bcma_host_pci_probe()` is called when a matching physical PCI device (according to `bcma_pci_bridge_tbl`) is detected. The other route is `bcma_host_soc_probe()`, which looks for the presence of the `brcm,bus-axi` device tree node on Broadcom SoCs. Lastly, there's some platform-specific code in `arch/mips/bcm47xx/setup.c` for the MIPS bcm47xx platform. Given my experience, I can't see either of these code paths ever triggering in a standard amd64 QEMU or Google Compute Engine virtualized environment. It all boils down to the presence of physical Broadcom hardware. This makes the whole investigation a bit of a dead end in my current environment. Alright, let's take a step back and check all the callers and users of `bcma` and `bcm47xx_sprom`, just to be sure there's not something I missed. A more comprehensive search is needed to confirm the scope of this driver. Going back to `bcm47xx_sprom` specifically, I need to know if there's any userspace interface to it. Is there some way that userspace could interact with this functionality, even indirectly? Okay, let's dive into `drivers/firmware/broadcom/bcm47xx_sprom.c` again. I need to be absolutely certain I understand its role in this whole process.
50/2	2026/10/27 03:33	tool	grepper	0m Error: no matches Args: { "Expression": "sysfs\|debugfs\|proc_\|module_param\|DEVICE_ATTR", "PathPrefixes": [ "drivers/firmware/broadcom/" ] } Results: { "error": "no matches" }
51/2	2026/10/27 03:33	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 71655 output: 54 thoughts: 47 Thoughts: Okay, let's see. My initial scan of the `drivers/firmware/broadcom/` directory reveals a conspicuous absence: no sysfs, debugfs, or proc entries, and no use of `module_param`. This is interesting. It immediately raises questions about how these firmware drivers are intended to be configured or interacted with. Are they truly "black boxes," or am I missing something? The next thought that leaps to mind is, what about `bcm47xx_nvram`? Does that component, perhaps, expose some kind of user interface? It's a key area that I need to investigate further. If it does interact with user space, that's where I'll likely find the entry point for understanding how the Broadcom firmware is being handled. This could be crucial for debugging or customization.
52/2	2026/10/27 03:33	tool	grepper	0m Error: no matches Args: { "Expression": "sysfs\|debugfs\|proc_\|module_param\|DEVICE_ATTR", "PathPrefixes": [ "drivers/firmware/broadcom/bcm47xx_nvram.c" ] } Results: { "error": "no matches" }
53/2	2026/10/27 03:33	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 71945 output: 124 thoughts: 1081 Thoughts: Analysis of Broadcom BCMA Code Reachability in Standard Virtualized Environments Okay, let's break this down. First, I see that `bcm47xx_sprom_register_fallbacks()` is an `fs_initcall` that registers a fallback callback with `bcma_arch_register_fallback_sprom()`. However, `bcma_arch_register_fallback_sprom` is only called if the SPROM read from a PCIe card is invalid or during SPROM extraction for a BCMA bus. And a BCMA bus requires… a `bcma_bus` to exist! Now, let's reference Section 2 of the instructions. This is key: "Structurally unreachable hardware: Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU." My understanding is that the Broadcom BCMA bus (`drivers/bcma/`) is a bus driver specifically for Broadcom PCIe WiFi/network cards and Broadcom MIPS/ARM SoCs. This is the critical point. It requires physical Broadcom hardware. On amd64 (the target architecture), the only host bus supported for BCMA is PCIe (`bcma_pci_bridge_driver`), and that again needs physical Broadcom PCIe hardware like a BCM4360 or BCM4352. And, as we know, standard QEMU doesn't emulate Broadcom PCIe devices. Let's quickly review the touched files: `drivers/bcma/core.c`, `drivers/bcma/driver_chipcommon.c`, `drivers/bcma/driver_chipcommon_pmu.c`, `drivers/bcma/driver_pcie2.c`, `drivers/bcma/host_pci.c`, `drivers/bcma/sprom.c`, `drivers/firmware/broadcom/bcm47xx_sprom.c`, plus the associated headers. All of these files are directly related to BCMA and `bcm47xx_sprom`. I've looked at the modified functions, including things like `bcma_core_set_clockmode`, `bcma_pmu_4360_pll_init`, `bcma_sprom_extract_r11`, `bcm47xx_sprom_fill_nvram_only`, and `bcm47xx_get_sprom_bcma`. None of these are reachable without the underlying Broadcom ASIC (PCIe card) or SoC. Therefore, according to Section 2 of the instructions, this clearly falls under "Structurally unreachable hardware." This code cannot be reached in standard virtualized environments like QEMU or GCE. Thus: `WorthFuzzing` must be false. `EnableConfigs` and `FocusSymbols` should be empty (or null). The `Reasoning` should concisely state that the code is structurally unreachable because it requires Broadcom-specific hardware (PCIe cards or SoCs) not emulated by standard virtualization environments. Everything is clear and verified. Time to call `set-results`.
54/2	2026/10/27 03:34	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch modifies Broadcom BCMA bus driver logic and Broadcom BCM47xx SPROM firmware parsing for Broadcom PCIe chips (such as BCM4360 and BCM4352). These drivers require physical Broadcom PCIe hardware or Broadcom SoCs, neither of which is emulated in standard QEMU or GCE virtualized environments. As the code is structurally unreachable in fuzzing environments, fuzzing is not warranted.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies Broadcom BCMA bus driver logic and Broadcom BCM47xx SPROM firmware parsing for Broadcom PCIe chips (such as BCM4360 and BCM4352). These drivers require physical Broadcom PCIe hardware or Broadcom SoCs, neither of which is emulated in standard QEMU or GCE virtualized environments. As the code is structurally unreachable in fuzzing environments, fuzzing is not warranted.", "WorthFuzzing": false }
55/1	2026/10/27 03:34	action	If	0m Args: { "WorthFuzzing": false } Results: null

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)