bhnd(4) - Broadcom Home Networking Division interconnect bus driver

The bhnd driver provides a unified kernel bus interface to the on-chip interconnects used in Broadcom Home Networking Division (HND) devices.

The Broadcom HND device family consists of SoCs (System On a Chip) and host-connected chipsets based on a common library of Broadcom IP cores connected via an internal hardware bus architecture. Drivers for these common IP cores are implemented against the unified bhnd interface.

• SIBA (used in early BHND devices)
• BCMA

• ChipCommon
• PCI and PCIe-G1
• PCIe-G2

In Broadcom's AMBA-based devices, the ARM PL-368 “Device Management Plugin” system IP provides:

• Wrapper cores that vend per-core device management register blocks.
• An enumeration ROM providing the list of cores, their AXI master port identifiers, and any interconnect-mapped memory regions associated with their slave port(s).

Documentation for the PL-368 is not publicly available; it has been described by Broadcom engineers as being ARM's PL-368 “Device Management Plugin” system IP as included with the PL3xx/AMBA Designer tooling licensed from ARM.

The only public reference by ARM to its existence appears to be a reference to a proprietary/non-public “NIC-301 Interconnect Device Management (PL368)” errata document, included with ARM's “CoreLink Controllers and Peripherals” engineering errata.

The EROM table address can be found at offset 0xFC within the ChipCommon core register block. The table itself is comprised of 32-bit type-tagged entries, organized into an array of variable-length core descriptor records.

The final core descriptor is followed by an EOF marker of 0x0000000F.

Each core descriptor record provides:

• Hardware Identifiers:
  • Designer (as a JEP106 Manufacturer Code)
  • Part number
  • Hardware revision
• AXI master port IDs (unique across the bus) and port VID (unique per master). These are concatenated by the interconnect to form a unique master port ID.
• Slave port descriptors, which define:
  • The port type, which is one of:
    • Device (CSR register block)
    • Bridge (e.g. AXI2APB
    • Wrapper (per-core DMP wrapper register block).
      • The memory regions mapped to this slave port by the interconnect.

Example set of core descriptors from a BCM4331 chipset's EROM:

<Broadcom BCM4331 802.11a/b/g/n Wireless> mem 0xc0004000-0xc0007fff at device 4.0 on pci0
core0: designer=Broadcom "ChipCommon" (entry=25004211 cid=800, rev=25, nmp=1, nsp=1, nwmp=1, nwsp=0)
  Master Port ID: 0.0
  Memory Regions:
    device0.0 at 0x18000000-0x18000fff
    mwrap0.0 at 0x18100000-0x18100fff
core1: designer=Broadcom "802.11 MAC" (entry=1d004211 cid=812, rev=1d, nmp=1, nsp=1, nwmp=1, nwsp=0)
  Master Port ID: 1.0
  Memory Regions:
    device0.0 at 0x18001000-0x18001fff
    mwrap0.0 at 0x18101000-0x18101fff
core2: designer=Broadcom "PCIe Bridge" (entry=13084411 cid=820, rev=13, nmp=1, nsp=2, nwmp=1, nwsp=1)
  Master Port ID: 2.0
  Memory Regions:
    device0.0 at 0x18002000-0x18002fff
    device1.0 at 0x08000000-0x0fffffff
    device1.1 at 0x8000000000000000-0xffffffffffffffff
    mwrap0.0 at 0x18102000-0x18102fff
    swrap1.0 at 0x18103000-0x18103fff
core3: designer=ARM "AXI to APB Bridge" (entry=80201 cid=135, rev=0, nmp=0, nsp=1, nwmp=0, nwsp=1)
  Memory Regions:
    bridge0.0 at 0x18000000-0x18003fff
    swrap0.0 at 0x18104000-0x18104fff
core4: designer=ARM "AXI to APB Bridge" (entry=80201 cid=135, rev=0, nmp=0, nsp=1, nwmp=0, nwsp=1)
  Memory Regions:
    bridge0.0 at 0x18100000-0x18108fff
    swrap0.0 at 0x18105000-0x18105fff
core5: designer=ARM "OOB Interrupt Router" (entry=201 cid=367, rev=0, nmp=0, nsp=1, nwmp=0, nwsp=0)
  Memory Regions:
    device0.0 at 0x18106000-0x18106fff
core6: designer=ARM "Enumeration ROM" (entry=201 cid=366, rev=0, nmp=0, nsp=1, nwmp=0, nwsp=0)
  Memory Regions:
    device0.0 at 0x18107000-0x18107fff
core7: designer=ARM "AMBA AXI GPV" (entry=201 cid=301, rev=0, nmp=0, nsp=1, nwmp=0, nwsp=0)
  Memory Regions:
    device0.0 at 0x18003000-0x18003fff
core8: designer=ARM "Default Core (Unused Address Ranges)" (entry=80201 cid=fff, rev=0, nmp=0, nsp=1, nwmp=0, nwsp=1)
  Memory Regions:
    device0.0 at 0x00000000-0x07ffffff
    device0.1 at 0x10000000-0x17ffffff
    device0.2 at 0x18004000-0x180fffff
    device0.3 at 0x18109000-0x7fffffffffffffff
    swrap0.0 at 0x18108000-0x18108fff

The BCM440X appears to share common IP with Broadcom's Sonics-based BCM43xx hardware. The BCM440X Programmer's Reference Guide documents the per-core configuration registers used in Sonics-based devices (providing core identification, control clocks, reset, etc), as well as PCI, SPROM, and DMA IP compatible (in part or in full) with HND BCM43xx devices.

The Linux b43 project published reverse-engineered documentation covering Sonics-based BCM43xx hardware.

Broadcom has released drivers for various subsets of their BCM43xx hardware, often under different licenses, and with more or less documentation, register offsets/descriptions, etc. It can be helpful to review the different source drops for register constants and descriptive comments when investigating poor or undocumented components:

• android bcmhd
• linux brcm80211 driver release
• linux-staging brcm80211 driver release. This source release by Broadcom contains additional defines/constants, and more of the code is ISC-licensed.

Additionally, Linux also includes non-Broadcom GPL drivers covering a partially overlapping set of supported hardware:

• ssb (Sonics) bus driver.
• bcma (AMBA bus driver. This duplicates a fair bit of the ssb driver's code.
• b43 reverse-engineered bcm43xx wifi driver.

For more general background information on SoC interconnects (and specifically, AMBA, Sonics, and OCP), On-Chip Communication Architectures: System on Chip Interconnect is a decent (if light) reference.

• TODO :)