[PATCH 2/4] bcma: allow SHIM-style mini-EROM wrapper-less cores in scan
From: Alessio Ferri
Date: Thu May 28 2026 - 20:11:12 EST
bcma_get_next_core() rejects with -ENXIO any component whose
component_B descriptor reports NMW=NSW=0 unless its core id is in
a short allowlist (4706 MAC GBIT, NS_CHIPCOMMON_B, PMU, GCI).
On SoCs that publish a SHIM-style mini-EROM (i.e. BCM6362) the
WLAN backplane lists three components:
ChipCommon, IEEE 802.11 and BCMA_CORE_SHIM. None of the three is
in the existing allowlist, so all three are skipped silently,
bus->cores stays empty, bcma_find_core(BCMA_CORE_CHIPCOMMON)
returns NULL, and a later bcma_chipco_watchdog_register()
dereferences cc->core->bus on its first line and oopses mid-probe.
Assisted-by: Claude:claude-4.8-opus
Signed-off-by: Alessio Ferri <alessio.ferri@xxxxxxxxxxx>
---
drivers/bcma/scan.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 983a62ddeebb..782fc53eb6b3 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -318,6 +318,21 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
case BCMA_CORE_GCI:
/* Not used yet: case BCMA_CORE_OOB_ROUTER: */
break;
+ case BCMA_CORE_CHIPCOMMON:
+ case BCMA_CORE_80211:
+ case BCMA_CORE_SHIM:
+ /* SHIM-style mini-EROM SoCs publish CHIPCOMMON, the
+ * IEEE 802.11 core and the SHIM core itself with
+ * NMW=NSW=0 because clock and reset gating happens
+ * at the SoC level via the SHIM Control register,
+ * not via per-core DMP wrappers. host_soc.c sets
+ * bus->shim_attached on those SoCs from pdata; the
+ * strict NMW=NSW=0 rejection still applies to PCI-
+ * attached cards and to SoCs without that quirk.
+ */
+ if (bus->shim_attached)
+ break;
+ fallthrough;
default:
bcma_erom_skip_component(bus, eromptr);
return -ENXIO;
--
2.54.0