ssb: Update to latest upstream version of ssb.

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@10490 3c298f89-4303-0410-b956-a3cf2f4a3e73

14 files changed, 577 insertions, 400 deletions

diff --git a/target/linux/brcm47xx/files/arch/mips/bcm947xx/setup.c b/target/linux/brcm47xx/files/arch/mips/bcm947xx/setup.c
index 008634a7e..2fcf68443 100644
--- a/target/linux/brcm47xx/files/arch/mips/bcm947xx/setup.c
+++ b/target/linux/brcm47xx/files/arch/mips/bcm947xx/setup.c
@@ -94,49 +94,53 @@ static void bcm47xx_fill_sprom(struct ssb_sprom *sprom)
 
 	sprom->revision = 1;
 	if ((s = nvram_get("il0macaddr")))
-		e_aton(s, sprom->r1.il0mac);
+		e_aton(s, sprom->il0mac);
 	if ((s = nvram_get("et0macaddr")))
-		e_aton(s, sprom->r1.et0mac);
+		e_aton(s, sprom->et0mac);
 	if ((s = nvram_get("et1macaddr")))
-		e_aton(s, sprom->r1.et1mac);
+		e_aton(s, sprom->et1mac);
 	if ((s = nvram_get("et0phyaddr")))
-		sprom->r1.et0phyaddr = simple_strtoul(s, NULL, 0);
+		sprom->et0phyaddr = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("et1phyaddr")))
-		sprom->r1.et1phyaddr = simple_strtoul(s, NULL, 0);
+		sprom->et1phyaddr = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("et0mdcport")))
-		sprom->r1.et0mdcport = !!simple_strtoul(s, NULL, 10);
+		sprom->et0mdcport = !!simple_strtoul(s, NULL, 10);
 	if ((s = nvram_get("et1mdcport")))
-		sprom->r1.et1mdcport = !!simple_strtoul(s, NULL, 10);
+		sprom->et1mdcport = !!simple_strtoul(s, NULL, 10);
 	if ((s = nvram_get("pa0b0")))
-		sprom->r1.pa0b0 = simple_strtoul(s, NULL, 0);
+		sprom->pa0b0 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa0b1")))
-		sprom->r1.pa0b1 = simple_strtoul(s, NULL, 0);
+		sprom->pa0b1 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa0b2")))
-		sprom->r1.pa0b2 = simple_strtoul(s, NULL, 0);
+		sprom->pa0b2 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa1b0")))
-		sprom->r1.pa1b0 = simple_strtoul(s, NULL, 0);
+		sprom->pa1b0 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa1b1")))
-		sprom->r1.pa1b1 = simple_strtoul(s, NULL, 0);
+		sprom->pa1b1 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa1b2")))
-		sprom->r1.pa1b2 = simple_strtoul(s, NULL, 0);
+		sprom->pa1b2 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("wl0gpio0")))
-		sprom->r1.gpio0 = simple_strtoul(s, NULL, 0);
+		sprom->gpio0 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("wl0gpio1")))
-		sprom->r1.gpio1 = simple_strtoul(s, NULL, 0);
+		sprom->gpio1 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("wl0gpio2")))
-		sprom->r1.gpio2 = simple_strtoul(s, NULL, 0);
+		sprom->gpio2 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("wl0gpio3")))
-		sprom->r1.gpio3 = simple_strtoul(s, NULL, 0);
+		sprom->gpio3 = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa0maxpwr")))
-		sprom->r1.maxpwr_bg = simple_strtoul(s, NULL, 0);
+		sprom->maxpwr_bg = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa1maxpwr")))
-		sprom->r1.maxpwr_a = simple_strtoul(s, NULL, 0);
+		sprom->maxpwr_a = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa0itssit")))
-		sprom->r1.itssi_bg = simple_strtoul(s, NULL, 0);
+		sprom->itssi_bg = simple_strtoul(s, NULL, 0);
 	if ((s = nvram_get("pa1itssit")))
-		sprom->r1.itssi_a = simple_strtoul(s, NULL, 0);
+		sprom->itssi_a = simple_strtoul(s, NULL, 0);
+	sprom->boardflags_lo = 0;
 	if ((s = nvram_get("boardflags")))
-		sprom->r1.boardflags_lo = simple_strtoul(s, NULL, 0);
+		sprom->boardflags_lo = simple_strtoul(s, NULL, 0);
+	sprom->boardflags_hi = 0;
+	if ((s = nvram_get("boardflags2")))
+		sprom->boardflags_hi = simple_strtoul(s, NULL, 0);
 }
 
 static int bcm47xx_get_invariants(struct ssb_bus *bus, struct ssb_init_invariants *iv)
diff --git a/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch b/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch
index 06865cff3..29125c675 100644
--- a/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch
+++ b/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch
@@ -1,7 +1,7 @@
-Index: linux-2.6.23/drivers/net/b44.c
+Index: linux-2.6.23.16/drivers/net/b44.c
 ===================================================================
---- linux-2.6.23.orig/drivers/net/b44.c	2007-10-13 10:58:27.872607266 +0200
-+++ linux-2.6.23/drivers/net/b44.c	2007-10-13 11:00:46.916530927 +0200
+--- linux-2.6.23.16.orig/drivers/net/b44.c	2008-02-19 01:35:58.000000000 +0100
++++ linux-2.6.23.16/drivers/net/b44.c	2008-02-19 01:37:04.000000000 +0100
 @@ -1,7 +1,9 @@
 -/* b44.c: Broadcom 4400 device driver.
 +/* b44.c: Broadcom 4400/47xx device driver.
@@ -39,7 +39,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  MODULE_LICENSE("GPL");
  MODULE_VERSION(DRV_MODULE_VERSION);
  
-@@ -96,18 +100,11 @@
+@@ -96,18 +100,11 @@ static int b44_debug = -1;	/* -1 == use 
  module_param(b44_debug, int, 0);
  MODULE_PARM_DESC(b44_debug, "B44 bitmapped debugging message enable value");
  
@@ -61,7 +61,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  static void b44_halt(struct b44 *);
  static void b44_init_rings(struct b44 *);
  
-@@ -119,6 +116,7 @@
+@@ -119,6 +116,7 @@ static void b44_init_hw(struct b44 *, in
  
  static int dma_desc_align_mask;
  static int dma_desc_sync_size;
@@ -69,7 +69,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  static const char b44_gstrings[][ETH_GSTRING_LEN] = {
  #define _B44(x...)	# x,
-@@ -126,35 +124,24 @@
+@@ -126,35 +124,24 @@ B44_STAT_REG_DECLARE
  #undef _B44
  };
  
@@ -123,7 +123,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  }
  
  static int b44_wait_bit(struct b44 *bp, unsigned long reg,
-@@ -182,117 +169,29 @@
+@@ -182,117 +169,29 @@ static int b44_wait_bit(struct b44 *bp, 
  	return 0;
  }
  
@@ -254,7 +254,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  {
  	u32 val;
  
-@@ -328,14 +227,14 @@
+@@ -328,14 +227,14 @@ static void b44_enable_ints(struct b44 *
  	bw32(bp, B44_IMASK, bp->imask);
  }
  
@@ -271,7 +271,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  			     (reg << MDIO_DATA_RA_SHIFT) |
  			     (MDIO_TA_VALID << MDIO_DATA_TA_SHIFT)));
  	err = b44_wait_bit(bp, B44_EMAC_ISTAT, EMAC_INT_MII, 100, 0);
-@@ -344,18 +243,34 @@
+@@ -344,18 +243,34 @@ static int b44_readphy(struct b44 *bp, i
  	return err;
  }
  
@@ -308,7 +308,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  /* miilib interface */
  /* FIXME FIXME: phy_id is ignored, bp->phy_addr use is unconditional
   * due to code existing before miilib use was added to this driver.
-@@ -384,6 +299,8 @@
+@@ -384,6 +299,8 @@ static int b44_phy_reset(struct b44 *bp)
  	u32 val;
  	int err;
  
@@ -317,7 +317,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	err = b44_writephy(bp, MII_BMCR, BMCR_RESET);
  	if (err)
  		return err;
-@@ -442,11 +359,27 @@
+@@ -442,11 +359,27 @@ static void b44_set_flow_ctrl(struct b44
  	__b44_set_flow_ctrl(bp, pause_enab);
  }
  
@@ -345,7 +345,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	if ((err = b44_readphy(bp, B44_MII_ALEDCTRL, &val)) != 0)
  		goto out;
  	if ((err = b44_writephy(bp, B44_MII_ALEDCTRL,
-@@ -542,6 +475,19 @@
+@@ -542,6 +475,19 @@ static void b44_check_phy(struct b44 *bp
  {
  	u32 bmsr, aux;
  
@@ -365,7 +365,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	if (!b44_readphy(bp, MII_BMSR, &bmsr) &&
  	    !b44_readphy(bp, B44_MII_AUXCTRL, &aux) &&
  	    (bmsr != 0xffff)) {
-@@ -617,10 +563,10 @@
+@@ -617,10 +563,10 @@ static void b44_tx(struct b44 *bp)
  
  		BUG_ON(skb == NULL);
  
@@ -378,7 +378,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		rp->skb = NULL;
  		dev_kfree_skb_irq(skb);
  	}
-@@ -657,9 +603,9 @@
+@@ -657,9 +603,9 @@ static int b44_alloc_rx_skb(struct b44 *
  	if (skb == NULL)
  		return -ENOMEM;
  
@@ -390,7 +390,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	/* Hardware bug work-around, the chip is unable to do PCI DMA
  	   to/from anything above 1GB :-( */
-@@ -667,18 +613,18 @@
+@@ -667,18 +613,18 @@ static int b44_alloc_rx_skb(struct b44 *
  		mapping + RX_PKT_BUF_SZ > DMA_30BIT_MASK) {
  		/* Sigh... */
  		if (!dma_mapping_error(mapping))
@@ -413,7 +413,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  			dev_kfree_skb_any(skb);
  			return -ENOMEM;
  		}
-@@ -705,9 +651,9 @@
+@@ -705,9 +651,9 @@ static int b44_alloc_rx_skb(struct b44 *
  	dp->addr = cpu_to_le32((u32) mapping + RX_PKT_OFFSET + bp->dma_offset);
  
  	if (bp->flags & B44_FLAG_RX_RING_HACK)
@@ -426,7 +426,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	return RX_PKT_BUF_SZ;
  }
-@@ -734,9 +680,9 @@
+@@ -734,9 +680,9 @@ static void b44_recycle_rx(struct b44 *b
  			   pci_unmap_addr(src_map, mapping));
  
  	if (bp->flags & B44_FLAG_RX_RING_HACK)
@@ -439,7 +439,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	ctrl = src_desc->ctrl;
  	if (dest_idx == (B44_RX_RING_SIZE - 1))
-@@ -750,13 +696,13 @@
+@@ -750,13 +696,13 @@ static void b44_recycle_rx(struct b44 *b
  	src_map->skb = NULL;
  
  	if (bp->flags & B44_FLAG_RX_RING_HACK)
@@ -458,7 +458,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  }
  
  static int b44_rx(struct b44 *bp, int budget)
-@@ -776,9 +722,9 @@
+@@ -776,9 +722,9 @@ static int b44_rx(struct b44 *bp, int bu
  		struct rx_header *rh;
  		u16 len;
  
@@ -470,7 +470,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		rh = (struct rx_header *) skb->data;
  		len = le16_to_cpu(rh->len);
  		if ((len > (RX_PKT_BUF_SZ - RX_PKT_OFFSET)) ||
-@@ -810,8 +756,8 @@
+@@ -810,8 +756,8 @@ static int b44_rx(struct b44 *bp, int bu
  			skb_size = b44_alloc_rx_skb(bp, cons, bp->rx_prod);
  			if (skb_size < 0)
  				goto drop_it;
@@ -481,7 +481,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  			/* Leave out rx_header */
                  	skb_put(skb, len + RX_PKT_OFFSET);
              	        skb_pull(skb, RX_PKT_OFFSET);
-@@ -982,24 +928,24 @@
+@@ -982,24 +928,24 @@ static int b44_start_xmit(struct sk_buff
  		goto err_out;
  	}
  
@@ -512,7 +512,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  			dev_kfree_skb_any(bounce_skb);
  			goto err_out;
  		}
-@@ -1022,9 +968,9 @@
+@@ -1022,9 +968,9 @@ static int b44_start_xmit(struct sk_buff
  	bp->tx_ring[entry].addr = cpu_to_le32((u32) mapping+bp->dma_offset);
  
  	if (bp->flags & B44_FLAG_TX_RING_HACK)
@@ -525,7 +525,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	entry = NEXT_TX(entry);
  
-@@ -1097,10 +1043,10 @@
+@@ -1097,10 +1043,10 @@ static void b44_free_rings(struct b44 *b
  
  		if (rp->skb == NULL)
  			continue;
@@ -538,7 +538,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		dev_kfree_skb_any(rp->skb);
  		rp->skb = NULL;
  	}
-@@ -1111,10 +1057,10 @@
+@@ -1111,10 +1057,10 @@ static void b44_free_rings(struct b44 *b
  
  		if (rp->skb == NULL)
  			continue;
@@ -551,7 +551,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		dev_kfree_skb_any(rp->skb);
  		rp->skb = NULL;
  	}
-@@ -1136,14 +1082,14 @@
+@@ -1136,14 +1082,14 @@ static void b44_init_rings(struct b44 *b
  	memset(bp->tx_ring, 0, B44_TX_RING_BYTES);
  
  	if (bp->flags & B44_FLAG_RX_RING_HACK)
@@ -572,7 +572,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	for (i = 0; i < bp->rx_pending; i++) {
  		if (b44_alloc_rx_skb(bp, -1, i) < 0)
-@@ -1163,24 +1109,24 @@
+@@ -1163,24 +1109,24 @@ static void b44_free_consistent(struct b
  	bp->tx_buffers = NULL;
  	if (bp->rx_ring) {
  		if (bp->flags & B44_FLAG_RX_RING_HACK) {
@@ -605,7 +605,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  					    bp->tx_ring, bp->tx_ring_dma);
  		bp->tx_ring = NULL;
  		bp->flags &= ~B44_FLAG_TX_RING_HACK;
-@@ -1206,7 +1152,7 @@
+@@ -1206,7 +1152,7 @@ static int b44_alloc_consistent(struct b
  		goto out_err;
  
  	size = DMA_TABLE_BYTES;
@@ -614,7 +614,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	if (!bp->rx_ring) {
  		/* Allocation may have failed due to pci_alloc_consistent
  		   insisting on use of GFP_DMA, which is more restrictive
-@@ -1218,9 +1164,9 @@
+@@ -1218,9 +1164,9 @@ static int b44_alloc_consistent(struct b
  		if (!rx_ring)
  			goto out_err;
  
@@ -627,7 +627,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  		if (dma_mapping_error(rx_ring_dma) ||
  			rx_ring_dma + size > DMA_30BIT_MASK) {
-@@ -1233,9 +1179,9 @@
+@@ -1233,9 +1179,9 @@ static int b44_alloc_consistent(struct b
  		bp->flags |= B44_FLAG_RX_RING_HACK;
  	}
  
@@ -639,7 +639,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		   insisting on use of GFP_DMA, which is more restrictive
  		   than necessary...  */
  		struct dma_desc *tx_ring;
-@@ -1245,9 +1191,9 @@
+@@ -1245,9 +1191,9 @@ static int b44_alloc_consistent(struct b
  		if (!tx_ring)
  			goto out_err;
  
@@ -652,7 +652,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  		if (dma_mapping_error(tx_ring_dma) ||
  			tx_ring_dma + size > DMA_30BIT_MASK) {
-@@ -1282,7 +1228,9 @@
+@@ -1282,7 +1228,9 @@ static void b44_clear_stats(struct b44 *
  /* bp->lock is held. */
  static void b44_chip_reset(struct b44 *bp)
  {
@@ -663,7 +663,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		bw32(bp, B44_RCV_LAZY, 0);
  		bw32(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE);
  		b44_wait_bit(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE, 200, 1);
-@@ -1294,19 +1242,23 @@
+@@ -1294,19 +1242,24 @@ static void b44_chip_reset(struct b44 *b
  		}
  		bw32(bp, B44_DMARX_CTRL, 0);
  		bp->rx_prod = bp->rx_cons = 0;
@@ -687,6 +687,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 +			     & MDIO_CTRL_MAXF_MASK)));
 +		break;
 +	case SSB_BUSTYPE_PCI:
++	case SSB_BUSTYPE_PCMCIA:
 +		bw32(bp, B44_MDIO_CTRL, (MDIO_CTRL_PREAMBLE |
  			     (0x0d & MDIO_CTRL_MAXF_MASK)));
 +		break;
@@ -695,7 +696,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	br32(bp, B44_MDIO_CTRL);
  
  	if (!(br32(bp, B44_DEVCTRL) & DEVCTRL_IPP)) {
-@@ -1349,6 +1301,7 @@
+@@ -1349,6 +1302,7 @@ static int b44_set_mac_addr(struct net_d
  {
  	struct b44 *bp = netdev_priv(dev);
  	struct sockaddr *addr = p;
@@ -703,7 +704,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	if (netif_running(dev))
  		return -EBUSY;
-@@ -1359,7 +1312,11 @@
+@@ -1359,7 +1313,11 @@ static int b44_set_mac_addr(struct net_d
  	memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
  
  	spin_lock_irq(&bp->lock);
@@ -716,7 +717,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	spin_unlock_irq(&bp->lock);
  
  	return 0;
-@@ -1445,18 +1402,6 @@
+@@ -1445,18 +1403,6 @@ out:
  	return err;
  }
  
@@ -735,7 +736,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  #ifdef CONFIG_NET_POLL_CONTROLLER
  /*
   * Polling receive - used by netconsole and other diagnostic tools
-@@ -1570,7 +1515,6 @@
+@@ -1570,7 +1516,6 @@ static void b44_setup_pseudo_magicp(stru
  static void b44_setup_wol(struct b44 *bp)
  {
  	u32 val;
@@ -743,7 +744,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	bw32(bp, B44_RXCONFIG, RXCONFIG_ALLMULTI);
  
-@@ -1594,13 +1538,6 @@
+@@ -1594,13 +1539,6 @@ static void b44_setup_wol(struct b44 *bp
   	} else {
   		b44_setup_pseudo_magicp(bp);
   	}
@@ -757,7 +758,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  }
  
  static int b44_close(struct net_device *dev)
-@@ -1700,7 +1637,7 @@
+@@ -1700,7 +1638,7 @@ static void __b44_set_rx_mode(struct net
  
  	val = br32(bp, B44_RXCONFIG);
  	val &= ~(RXCONFIG_PROMISC | RXCONFIG_ALLMULTI);
@@ -766,7 +767,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		val |= RXCONFIG_PROMISC;
  		bw32(bp, B44_RXCONFIG, val);
  	} else {
-@@ -1747,12 +1684,8 @@
+@@ -1747,12 +1685,8 @@ static void b44_set_msglevel(struct net_
  
  static void b44_get_drvinfo (struct net_device *dev, struct ethtool_drvinfo *info)
  {
@@ -779,7 +780,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  }
  
  static int b44_nway_reset(struct net_device *dev)
-@@ -2035,6 +1968,245 @@
+@@ -2035,6 +1969,245 @@ static const struct ethtool_ops b44_etht
  	.get_ethtool_stats	= b44_get_ethtool_stats,
  };
  
@@ -1025,7 +1026,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  static int b44_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  {
  	struct mii_ioctl_data *data = if_mii(ifr);
-@@ -2044,40 +2216,64 @@
+@@ -2044,40 +2217,64 @@ static int b44_ioctl(struct net_device *
  	if (!netif_running(dev))
  		goto out;
  
@@ -1102,12 +1103,12 @@ Index: linux-2.6.23/drivers/net/b44.c
 -	bp->dev->dev_addr[5] = eeprom[82];
 +	switch (instance) {
 +	case 1:
-+	       addr = sdev->bus->sprom.r1.et0mac;
-+	       bp->phy_addr = sdev->bus->sprom.r1.et0phyaddr;
++	       addr = sdev->bus->sprom.et0mac;
++	       bp->phy_addr = sdev->bus->sprom.et0phyaddr;
 +	       break;
 +	default:
-+	       addr = sdev->bus->sprom.r1.et1mac;
-+	       bp->phy_addr = sdev->bus->sprom.r1.et1phyaddr;
++	       addr = sdev->bus->sprom.et1mac;
++	       bp->phy_addr = sdev->bus->sprom.et1phyaddr;
 +	       break;
 +	}
 +
@@ -1115,7 +1116,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
  		printk(KERN_ERR PFX "Invalid MAC address found in EEPROM\n");
-@@ -2086,103 +2282,52 @@
+@@ -2086,103 +2283,52 @@ static int __devinit b44_get_invariants(
  
  	memcpy(bp->dev->perm_addr, bp->dev->dev_addr, bp->dev->addr_len);
  
@@ -1228,7 +1229,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	bp->rx_pending = B44_DEF_RX_RING_PENDING;
  	bp->tx_pending = B44_DEF_TX_RING_PENDING;
  
-@@ -2201,16 +2346,16 @@
+@@ -2201,16 +2347,16 @@ static int __devinit b44_init_one(struct
  	dev->poll_controller = b44_poll_controller;
  #endif
  	dev->change_mtu = b44_change_mtu;
@@ -1248,7 +1249,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	}
  
  	bp->mii_if.dev = dev;
-@@ -2229,61 +2374,52 @@
+@@ -2229,61 +2375,52 @@ static int __devinit b44_init_one(struct
  
  	err = register_netdev(dev);
  	if (err) {
@@ -1326,7 +1327,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	del_timer_sync(&bp->timer);
  
-@@ -2301,33 +2437,22 @@
+@@ -2301,33 +2438,22 @@ static int b44_suspend(struct pci_dev *p
  		b44_init_hw(bp, B44_PARTIAL_RESET);
  		b44_setup_wol(bp);
  	}
@@ -1363,7 +1364,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		return rc;
  	}
  
-@@ -2346,29 +2471,31 @@
+@@ -2346,29 +2472,31 @@ static int b44_resume(struct pci_dev *pd
  	return 0;
  }
  
@@ -1401,10 +1402,10 @@ Index: linux-2.6.23/drivers/net/b44.c
  }
  
  module_init(b44_init);
-Index: linux-2.6.23/drivers/net/b44.h
+Index: linux-2.6.23.16/drivers/net/b44.h
 ===================================================================
---- linux-2.6.23.orig/drivers/net/b44.h	2007-10-13 10:58:27.880607722 +0200
-+++ linux-2.6.23/drivers/net/b44.h	2007-10-13 11:00:46.904530245 +0200
+--- linux-2.6.23.16.orig/drivers/net/b44.h	2008-02-19 01:35:58.000000000 +0100
++++ linux-2.6.23.16/drivers/net/b44.h	2008-02-19 01:36:00.000000000 +0100
 @@ -129,6 +129,7 @@
  #define  RXCONFIG_FLOW		0x00000020 /* Flow Control Enable */
  #define  RXCONFIG_FLOW_ACCEPT	0x00000040 /* Accept Unicast Flow Control Frame */
@@ -1492,7 +1493,7 @@ Index: linux-2.6.23/drivers/net/b44.h
  
  /* 4400 PHY registers */
  #define B44_MII_AUXCTRL		24	/* Auxiliary Control */
-@@ -346,10 +281,12 @@
+@@ -346,10 +281,12 @@ struct rx_header {
  
  struct ring_info {
  	struct sk_buff		*skb;
@@ -1506,7 +1507,7 @@ Index: linux-2.6.23/drivers/net/b44.h
  
  #define	B44_STAT_REG_DECLARE		\
  	_B44(tx_good_octets)		\
-@@ -425,9 +362,10 @@
+@@ -425,9 +362,10 @@ struct b44 {
  
  	u32			dma_offset;
  	u32			flags;
@@ -1518,7 +1519,7 @@ Index: linux-2.6.23/drivers/net/b44.h
  #define B44_FLAG_PAUSE_AUTO	0x00008000
  #define B44_FLAG_FULL_DUPLEX	0x00010000
  #define B44_FLAG_100_BASE_T	0x00020000
-@@ -450,8 +388,7 @@
+@@ -450,8 +388,7 @@ struct b44 {
  	struct net_device_stats	stats;
  	struct b44_hw_stats	hw_stats;
  
@@ -1528,11 +1529,11 @@ Index: linux-2.6.23/drivers/net/b44.h
  	struct net_device	*dev;
  
  	dma_addr_t		rx_ring_dma, tx_ring_dma;
-Index: linux-2.6.23/drivers/net/Kconfig
+Index: linux-2.6.23.16/drivers/net/Kconfig
 ===================================================================
---- linux-2.6.23.orig/drivers/net/Kconfig	2007-10-13 10:58:27.888608180 +0200
-+++ linux-2.6.23/drivers/net/Kconfig	2007-10-13 11:00:46.912530699 +0200
-@@ -1577,7 +1577,7 @@
+--- linux-2.6.23.16.orig/drivers/net/Kconfig	2008-02-19 01:35:58.000000000 +0100
++++ linux-2.6.23.16/drivers/net/Kconfig	2008-02-19 01:36:00.000000000 +0100
+@@ -1577,7 +1577,7 @@ config APRICOT
  
  config B44
  	tristate "Broadcom 4400 ethernet support"
diff --git a/target/linux/brcm47xx/patches-2.6.23/210-ssb_fixes.patch b/target/linux/brcm47xx/patches-2.6.23/210-ssb_fixes.patch
index 3b87a8c02..ce3a007b6 100644
--- a/target/linux/brcm47xx/patches-2.6.23/210-ssb_fixes.patch
+++ b/target/linux/brcm47xx/patches-2.6.23/210-ssb_fixes.patch
@@ -1,18 +1,18 @@
-Index: linux-2.6.23/drivers/ssb/driver_mipscore.c
+Index: linux-2.6.23.16/drivers/ssb/driver_mipscore.c
 ===================================================================
---- linux-2.6.23.orig/drivers/ssb/driver_mipscore.c	2007-10-14 04:32:45.793470742 +0200
-+++ linux-2.6.23/drivers/ssb/driver_mipscore.c	2007-10-14 04:33:25.155713862 +0200
-@@ -222,3 +222,5 @@
+--- linux-2.6.23.16.orig/drivers/ssb/driver_mipscore.c	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/driver_mipscore.c	2008-02-19 02:01:16.000000000 +0100
+@@ -222,3 +222,5 @@ void ssb_mipscore_init(struct ssb_mipsco
  	ssb_mips_serial_init(mcore);
  	ssb_mips_flash_detect(mcore);
  }
 +
 +EXPORT_SYMBOL(ssb_mips_irq);
-Index: linux-2.6.23/include/linux/ssb/ssb_driver_chipcommon.h
+Index: linux-2.6.23.16/include/linux/ssb/ssb_driver_chipcommon.h
 ===================================================================
---- linux-2.6.23.orig/include/linux/ssb/ssb_driver_chipcommon.h	2007-10-14 04:32:45.817472111 +0200
-+++ linux-2.6.23/include/linux/ssb/ssb_driver_chipcommon.h	2007-10-14 04:33:25.159714091 +0200
-@@ -382,11 +382,45 @@
+--- linux-2.6.23.16.orig/include/linux/ssb/ssb_driver_chipcommon.h	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/include/linux/ssb/ssb_driver_chipcommon.h	2008-02-19 02:01:10.000000000 +0100
+@@ -382,11 +382,45 @@ extern void ssb_chipco_set_clockmode(str
  extern void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc,
  					  u32 ticks);
  
@@ -61,10 +61,10 @@ Index: linux-2.6.23/include/linux/ssb/ssb_driver_chipcommon.h
  
  #ifdef CONFIG_SSB_SERIAL
  extern int ssb_chipco_serial_init(struct ssb_chipcommon *cc,
-Index: linux-2.6.23/include/linux/ssb/ssb_driver_extif.h
+Index: linux-2.6.23.16/include/linux/ssb/ssb_driver_extif.h
 ===================================================================
---- linux-2.6.23.orig/include/linux/ssb/ssb_driver_extif.h	2007-10-14 04:32:45.821472339 +0200
-+++ linux-2.6.23/include/linux/ssb/ssb_driver_extif.h	2007-10-14 04:33:25.167714544 +0200
+--- linux-2.6.23.16.orig/include/linux/ssb/ssb_driver_extif.h	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/include/linux/ssb/ssb_driver_extif.h	2008-02-19 01:39:40.000000000 +0100
 @@ -153,7 +153,6 @@
  #define SSB_EXTIF_WATCHDOG_CLK		48000000	/* Hz */
  
@@ -73,7 +73,7 @@ Index: linux-2.6.23/include/linux/ssb/ssb_driver_extif.h
  #ifdef CONFIG_SSB_DRIVER_EXTIF
  
  struct ssb_extif {
-@@ -171,17 +170,42 @@
+@@ -171,17 +170,42 @@ extern void ssb_extif_get_clockcontrol(s
  extern void ssb_extif_timing_init(struct ssb_extif *extif,
  				  unsigned long ns);
  
@@ -122,11 +122,11 @@ Index: linux-2.6.23/include/linux/ssb/ssb_driver_extif.h
  
  #else /* CONFIG_SSB_DRIVER_EXTIF */
  /* extif disabled */
-Index: linux-2.6.23/include/linux/ssb/ssb.h
+Index: linux-2.6.23.16/include/linux/ssb/ssb.h
 ===================================================================
---- linux-2.6.23.orig/include/linux/ssb/ssb.h	2007-10-14 04:32:45.833473010 +0200
-+++ linux-2.6.23/include/linux/ssb/ssb.h	2007-10-14 04:33:25.171714773 +0200
-@@ -255,6 +255,12 @@
+--- linux-2.6.23.16.orig/include/linux/ssb/ssb.h	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/include/linux/ssb/ssb.h	2008-02-19 01:39:40.000000000 +0100
+@@ -217,6 +217,12 @@ enum ssb_bustype {
  #define SSB_CHIPPACK_BCM4712M	2	/* Medium 225pin 4712 */
  #define SSB_CHIPPACK_BCM4712L	0	/* Large 340pin 4712 */
  
@@ -139,7 +139,7 @@ Index: linux-2.6.23/include/linux/ssb/ssb.h
  #include <linux/ssb/ssb_driver_chipcommon.h>
  #include <linux/ssb/ssb_driver_mips.h>
  #include <linux/ssb/ssb_driver_extif.h>
-@@ -385,6 +391,16 @@
+@@ -349,6 +355,16 @@ static inline void ssb_write32(struct ss
  	dev->ops->write32(dev, offset, value);
  }
  
@@ -156,11 +156,11 @@ Index: linux-2.6.23/include/linux/ssb/ssb.h
  
  /* Translation (routing) bits that need to be ORed to DMA
   * addresses before they are given to a device. */
-Index: linux-2.6.23/drivers/ssb/driver_chipcommon.c
+Index: linux-2.6.23.16/drivers/ssb/driver_chipcommon.c
 ===================================================================
---- linux-2.6.23.orig/drivers/ssb/driver_chipcommon.c	2007-10-14 04:32:45.797470966 +0200
-+++ linux-2.6.23/drivers/ssb/driver_chipcommon.c	2007-10-14 04:33:25.175715001 +0200
-@@ -351,21 +351,6 @@
+--- linux-2.6.23.16.orig/drivers/ssb/driver_chipcommon.c	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/driver_chipcommon.c	2008-02-19 02:01:16.000000000 +0100
+@@ -351,21 +351,6 @@ void ssb_chipco_watchdog_timer_set(struc
  	chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
  }
  
@@ -182,11 +182,11 @@ Index: linux-2.6.23/drivers/ssb/driver_chipcommon.c
  #ifdef CONFIG_SSB_SERIAL
  int ssb_chipco_serial_init(struct ssb_chipcommon *cc,
  			   struct ssb_serial_port *ports)
-Index: linux-2.6.23/drivers/ssb/driver_extif.c
+Index: linux-2.6.23.16/drivers/ssb/driver_extif.c
 ===================================================================
---- linux-2.6.23.orig/drivers/ssb/driver_extif.c	2007-10-14 04:32:45.809471640 +0200
-+++ linux-2.6.23/drivers/ssb/driver_extif.c	2007-10-14 04:33:25.179715231 +0200
-@@ -110,20 +110,4 @@
+--- linux-2.6.23.16.orig/drivers/ssb/driver_extif.c	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/driver_extif.c	2008-02-19 01:39:40.000000000 +0100
+@@ -110,20 +110,4 @@ void ssb_extif_get_clockcontrol(struct s
  	*m = extif_read32(extif, SSB_EXTIF_CLOCK_SB);
  }
  
@@ -207,11 +207,11 @@ Index: linux-2.6.23/drivers/ssb/driver_extif.c
 -				   mask, value);
 -}
  
-Index: linux-2.6.23/include/linux/mod_devicetable.h
+Index: linux-2.6.23.16/include/linux/mod_devicetable.h
 ===================================================================
---- linux-2.6.23.orig/include/linux/mod_devicetable.h	2007-10-14 04:35:22.102378272 +0200
-+++ linux-2.6.23/include/linux/mod_devicetable.h	2007-10-14 04:34:41.172045787 +0200
-@@ -340,4 +340,19 @@
+--- linux-2.6.23.16.orig/include/linux/mod_devicetable.h	2008-02-19 01:35:53.000000000 +0100
++++ linux-2.6.23.16/include/linux/mod_devicetable.h	2008-02-19 01:39:40.000000000 +0100
+@@ -340,4 +340,19 @@ struct parisc_device_id {
  #define PA_HVERSION_ANY_ID	0xffff
  #define PA_SVERSION_ANY_ID	0xffffffff
  
@@ -231,3 +231,62 @@ Index: linux-2.6.23/include/linux/mod_devicetable.h
 +#define SSB_ANY_REV		0xFF
 +
  #endif /* LINUX_MOD_DEVICETABLE_H */
+Index: linux-2.6.23.16/drivers/ssb/main.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/ssb/main.c	2008-02-19 01:45:24.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/main.c	2008-02-19 02:01:16.000000000 +0100
+@@ -321,14 +321,16 @@ static int ssb_bus_match(struct device *
+ 	return 0;
+ }
+ 
+-static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env)
++static int ssb_device_uevent(struct device *dev, char **envp,
++			     int num_envp, char *buffer, int buffer_size)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
++	int i = 0, len = 0;
+ 
+ 	if (!dev)
+ 		return -ENODEV;
+ 
+-	return add_uevent_var(env,
++	return add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
+ 			     "MODALIAS=ssb:v%04Xid%04Xrev%02X",
+ 			     ssb_dev->id.vendor, ssb_dev->id.coreid,
+ 			     ssb_dev->id.revision);
+Index: linux-2.6.23.16/drivers/ssb/scan.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/ssb/scan.c	2008-02-16 19:08:13.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/scan.c	2008-02-19 01:56:02.000000000 +0100
+@@ -391,12 +391,14 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			if (bus->bustype == SSB_BUSTYPE_PCI) {
+ 				/* Ignore PCI cores on PCI-E cards.
+ 				 * Ignore PCI-E cores on PCI cards. */
++				//FIXME kernel 2.6.23 doesn't have is_pcie. Add this check back when updating to 2.6.24 or later.
+ 				if (dev->id.coreid == SSB_DEV_PCI) {
+-					if (bus->host_pci->is_pcie)
+-						continue;
++//FIXME					if (bus->host_pci->is_pcie)
++//FIXME						continue;
+ 				} else {
+-					if (!bus->host_pci->is_pcie)
+-						continue;
++					continue; //FIXME
++//FIXME					if (!bus->host_pci->is_pcie)
++//FIXME						continue;
+ 				}
+ 			}
+ 			if (bus->pcicore.dev) {
+Index: linux-2.6.23.16/drivers/ssb/driver_pcicore.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/ssb/driver_pcicore.c	2008-02-19 02:01:11.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/driver_pcicore.c	2008-02-19 02:01:32.000000000 +0100
+@@ -362,7 +362,7 @@ static int pcicore_is_in_hostmode(struct
+ 	    chipid_top != 0x5300)
+ 		return 0;
+ 
+-	if (bus->sprom.r1.boardflags_lo & SSB_PCICORE_BFL_NOPCI)
++	if (bus->sprom.boardflags_lo & SSB_PCICORE_BFL_NOPCI)
+ 		return 0;
+ 
+ 	/* The 200-pin BCM4712 package does not bond out PCI. Even when
diff --git a/target/linux/brcm47xx/patches-2.6.23/220-bcm5354.patch b/target/linux/brcm47xx/patches-2.6.23/220-bcm5354.patch
index c524c8f3e..e3afcbc23 100644
--- a/target/linux/brcm47xx/patches-2.6.23/220-bcm5354.patch
+++ b/target/linux/brcm47xx/patches-2.6.23/220-bcm5354.patch
@@ -1,6 +1,8 @@
---- files/drivers/ssb/driver_chipcommon.c	2007-10-24 16:57:38.000000000 -0700
-+++ linux-2.6.23.1/drivers/ssb/driver_chipcommon.c	2007-10-27 13:27:06.000000000 -0700
-@@ -268,6 +268,8 @@
+Index: linux-2.6.23.16/drivers/ssb/driver_chipcommon.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/ssb/driver_chipcommon.c	2008-02-19 00:42:42.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/driver_chipcommon.c	2008-02-19 00:43:34.000000000 +0100
+@@ -268,6 +268,8 @@ void ssb_chipco_resume(struct ssb_chipco
  void ssb_chipco_get_clockcpu(struct ssb_chipcommon *cc,
                               u32 *plltype, u32 *n, u32 *m)
  {
@@ -9,7 +11,7 @@
  	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
  	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
  	switch (*plltype) {
-@@ -291,6 +293,8 @@
+@@ -291,6 +293,8 @@ void ssb_chipco_get_clockcpu(struct ssb_
  void ssb_chipco_get_clockcontrol(struct ssb_chipcommon *cc,
  				 u32 *plltype, u32 *n, u32 *m)
  {
@@ -18,9 +20,11 @@
  	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
  	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
  	switch (*plltype) {
---- files/drivers/ssb/driver_mipscore.c	2007-10-24 16:57:38.000000000 -0700
-+++ linux-2.6.23.1/drivers/ssb/driver_mipscore.c	2007-10-27 13:29:36.000000000 -0700
-@@ -160,6 +160,8 @@
+Index: linux-2.6.23.16/drivers/ssb/driver_mipscore.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/ssb/driver_mipscore.c	2008-02-19 00:42:42.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/driver_mipscore.c	2008-02-19 00:43:34.000000000 +0100
+@@ -160,6 +160,8 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
  
  	if ((pll_type == SSB_PLLTYPE_5) || (bus->chip_id == 0x5365)) {
  		rate = 200000000;
@@ -29,9 +33,11 @@
  	} else {
  		rate = ssb_calc_clock_rate(pll_type, n, m);
  	}
---- files/drivers/ssb/main.c	2007-10-24 16:57:38.000000000 -0700
-+++ linux-2.6.23.1/drivers/ssb/main.c	2007-10-27 13:30:59.000000000 -0700
-@@ -864,6 +864,8 @@
+Index: linux-2.6.23.16/drivers/ssb/main.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/ssb/main.c	2008-02-19 00:42:15.000000000 +0100
++++ linux-2.6.23.16/drivers/ssb/main.c	2008-02-19 00:43:34.000000000 +0100
+@@ -860,6 +860,8 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
  
  	if (bus->chip_id == 0x5365) {
  		rate = 100000000;
diff --git a/target/linux/brcm47xx/patches-2.6.23/225-bcm5354_ssbrev.patch b/target/linux/brcm47xx/patches-2.6.23/225-bcm5354_ssbrev.patch
deleted file mode 100644
index 55209b395..000000000
--- a/target/linux/brcm47xx/patches-2.6.23/225-bcm5354_ssbrev.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/drivers/ssb/main.c	2007-11-05 05:59:43.000000000 -0800
-+++ b/drivers/ssb/main.c	2007-11-05 08:59:13.000000000 -0800
-@@ -882,6 +884,7 @@
- 	case SSB_IDLOW_SSBREV_22:
- 		return SSB_TMSLOW_REJECT_22;
- 	case SSB_IDLOW_SSBREV_23:
-+	case SSB_IDLOW_SSBREV_5354:
- 		return SSB_TMSLOW_REJECT_23;
- 	default:
- 		WARN_ON(1);
---- a/include/linux/ssb/ssb_regs.h	2007-11-05 05:59:42.000000000 -0800
-+++ b/include/linux/ssb/ssb_regs.h	2007-11-05 09:00:45.000000000 -0800
-@@ -147,6 +147,7 @@
- #define  SSB_IDLOW_SSBREV	0xF0000000 /* Sonics Backplane Revision code */
- #define  SSB_IDLOW_SSBREV_22	0x00000000 /* <= 2.2 */
- #define  SSB_IDLOW_SSBREV_23	0x10000000 /* 2.3 */
-+#define  SSB_IDLOW_SSBREV_5354	0x60000000 /* 5354 */
- #define SSB_IDHIGH		0x0FFC     /* SB Identification High */
- #define  SSB_IDHIGH_RCLO	0x0000000F /* Revision Code (low part) */
- #define  SSB_IDHIGH_CC		0x00008FF0 /* Core Code */
diff --git a/target/linux/brcm47xx/patches-2.6.23/230-ohci-ssb.patch b/target/linux/brcm47xx/patches-2.6.23/230-ohci-ssb.patch
index 1db627f37..5be1a66c5 100644
--- a/target/linux/brcm47xx/patches-2.6.23/230-ohci-ssb.patch
+++ b/target/linux/brcm47xx/patches-2.6.23/230-ohci-ssb.patch
@@ -13,10 +13,10 @@ Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
 ---
 
-diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
-index 565d6ef..c978d62 100644
---- a/drivers/usb/host/Kconfig
-+++ b/drivers/usb/host/Kconfig
+Index: linux-2.6.23.16/drivers/usb/host/Kconfig
+===================================================================
+--- linux-2.6.23.16.orig/drivers/usb/host/Kconfig	2008-02-19 00:47:29.000000000 +0100
++++ linux-2.6.23.16/drivers/usb/host/Kconfig	2008-02-19 00:47:51.000000000 +0100
 @@ -154,6 +154,19 @@ config USB_OHCI_HCD_PCI
  	  Enables support for PCI-bus plug-in USB controller cards.
  	  If unsure, say Y.
@@ -37,11 +37,11 @@ index 565d6ef..c978d62 100644
  config USB_OHCI_BIG_ENDIAN_DESC
  	bool
  	depends on USB_OHCI_HCD
-diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
-index f7c6ced..240c7f5 100644
---- a/drivers/usb/host/ohci-hcd.c
-+++ b/drivers/usb/host/ohci-hcd.c
-@@ -1033,11 +1033,17 @@ MODULE_LICENSE ("GPL");
+Index: linux-2.6.23.16/drivers/usb/host/ohci-hcd.c
+===================================================================
+--- linux-2.6.23.16.orig/drivers/usb/host/ohci-hcd.c	2008-02-19 00:47:29.000000000 +0100
++++ linux-2.6.23.16/drivers/usb/host/ohci-hcd.c	2008-02-19 00:47:51.000000000 +0100
+@@ -926,11 +926,17 @@ MODULE_LICENSE ("GPL");
  #define PS3_SYSTEM_BUS_DRIVER	ps3_ohci_driver
  #endif
  
@@ -60,7 +60,7 @@ index f7c6ced..240c7f5 100644
  #error "missing bus glue for ohci-hcd"
  #endif
  
-@@ -1082,10 +1088,20 @@ static int __init ohci_hcd_mod_init(void)
+@@ -975,10 +981,20 @@ static int __init ohci_hcd_mod_init(void
  		goto error_pci;
  #endif
  
@@ -81,7 +81,7 @@ index f7c6ced..240c7f5 100644
   error_pci:
  #endif
  #ifdef SA1111_DRIVER
-@@ -1110,6 +1126,9 @@ module_init(ohci_hcd_mod_init);
+@@ -1003,6 +1019,9 @@ module_init(ohci_hcd_mod_init);
  
  static void __exit ohci_hcd_mod_exit(void)
  {
@@ -91,11 +91,10 @@ index f7c6ced..240c7f5 100644
  #ifdef PCI_DRIVER
  	pci_unregister_driver(&PCI_DRIVER);
  #endif
-diff --git a/drivers/usb/host/ohci-ssb.c b/drivers/usb/host/ohci-ssb.c
-new file mode 100644
-index 0000000..bc3e785
---- /dev/null
-+++ b/drivers/usb/host/ohci-ssb.c
+Index: linux-2.6.23.16/drivers/usb/host/ohci-ssb.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.23.16/drivers/usb/host/ohci-ssb.c	2008-02-19 00:47:51.000000000 +0100
 @@ -0,0 +1,247 @@
 +/*
 + * Sonics Silicon Backplane
@@ -344,4 +343,3 @@ index 0000000..bc3e785
 +	.suspend	= ssb_ohci_suspend,
 +	.resume		= ssb_ohci_resume,
 +};
-
diff --git a/target/linux/generic-2.6/files/drivers/ssb/Kconfig b/target/linux/generic-2.6/files/drivers/ssb/Kconfig
index b4a5e5e9d..d976660cb 100644
--- a/target/linux/generic-2.6/files/drivers/ssb/Kconfig
+++ b/target/linux/generic-2.6/files/drivers/ssb/Kconfig
@@ -22,7 +22,7 @@ config SSB
 
 config SSB_PCIHOST_POSSIBLE
 	bool
-	depends on SSB && PCI
+	depends on SSB && (PCI = y || PCI = SSB)
 	default y
 
 config SSB_PCIHOST
@@ -37,7 +37,7 @@ config SSB_PCIHOST
 
 config SSB_PCMCIAHOST_POSSIBLE
 	bool
-	depends on SSB && PCMCIA && EXPERIMENTAL
+	depends on SSB && (PCMCIA = y || PCMCIA = SSB) && EXPERIMENTAL
 	default y
 
 config SSB_PCMCIAHOST
diff --git a/target/linux/generic-2.6/files/drivers/ssb/b43_pci_bridge.c b/target/linux/generic-2.6/files/drivers/ssb/b43_pci_bridge.c
index 1a31f7a72..2d27d6d6d 100644
--- a/target/linux/generic-2.6/files/drivers/ssb/b43_pci_bridge.c
+++ b/target/linux/generic-2.6/files/drivers/ssb/b43_pci_bridge.c
@@ -1,7 +1,7 @@
 /*
  * Broadcom 43xx PCI-SSB bridge module
  *
- * This technically is a seperate PCI driver module, but
+ * This technically is a separate PCI driver module, but
  * because of its small size we include it in the SSB core
  * instead of creating a standalone module.
  *
diff --git a/target/linux/generic-2.6/files/drivers/ssb/main.c b/target/linux/generic-2.6/files/drivers/ssb/main.c
index 74d5182db..9028ed571 100644
--- a/target/linux/generic-2.6/files/drivers/ssb/main.c
+++ b/target/linux/generic-2.6/files/drivers/ssb/main.c
@@ -11,6 +11,7 @@
 #include "ssb_private.h"
 
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/dma-mapping.h>
@@ -320,23 +321,17 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv)
 	return 0;
 }
 
-static int ssb_device_uevent(struct device *dev, char **envp, int num_envp,
-			     char *buffer, int buffer_size)
+static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
-	int ret, i = 0, length = 0;
 
 	if (!dev)
 		return -ENODEV;
 
-	ret = add_uevent_var(envp, num_envp, &i,
-			     buffer, buffer_size, &length,
+	return add_uevent_var(env,
 			     "MODALIAS=ssb:v%04Xid%04Xrev%02X",
 			     ssb_dev->id.vendor, ssb_dev->id.coreid,
 			     ssb_dev->id.revision);
-	envp[i] = NULL;
-
-	return ret;
 }
 
 static struct bus_type ssb_bustype = {
@@ -445,6 +440,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 			break;
 		case SSB_BUSTYPE_PCMCIA:
 #ifdef CONFIG_SSB_PCMCIAHOST
+			sdev->irq = bus->host_pcmcia->irq.AssignedIRQ;
 			dev->parent = &bus->host_pcmcia->dev;
 #endif
 			break;
@@ -876,14 +872,22 @@ EXPORT_SYMBOL(ssb_clockspeed);
 
 static u32 ssb_tmslow_reject_bitmask(struct ssb_device *dev)
 {
+	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
+
 	/* The REJECT bit changed position in TMSLOW between
 	 * Backplane revisions. */
-	switch (ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV) {
+	switch (rev) {
 	case SSB_IDLOW_SSBREV_22:
 		return SSB_TMSLOW_REJECT_22;
 	case SSB_IDLOW_SSBREV_23:
 		return SSB_TMSLOW_REJECT_23;
+	case SSB_IDLOW_SSBREV_24:     /* TODO - find the proper REJECT bits */
+	case SSB_IDLOW_SSBREV_25:     /* same here */
+	case SSB_IDLOW_SSBREV_26:     /* same here */
+	case SSB_IDLOW_SSBREV_27:     /* same here */
+		return SSB_TMSLOW_REJECT_23;	/* this is a guess */
 	default:
+		printk(KERN_INFO "ssb: Backplane Revision 0x%.8X\n", rev);
 		WARN_ON(1);
 	}
 	return (SSB_TMSLOW_REJECT_22 | SSB_TMSLOW_REJECT_23);
@@ -1152,7 +1156,10 @@ static int __init ssb_modinit(void)
 
 	return err;
 }
-subsys_initcall(ssb_modinit);
+/* ssb must be initialized after PCI but before the ssb drivers.
+ * That means we must use some initcall between subsys_initcall
+ * and device_initcall. */
+fs_initcall(ssb_modinit);
 
 static void __exit ssb_modexit(void)
 {
diff --git a/target/linux/generic-2.6/files/drivers/ssb/pci.c b/target/linux/generic-2.6/files/drivers/ssb/pci.c
index 0ab095c65..b434df750 100644
--- a/target/linux/generic-2.6/files/drivers/ssb/pci.c
+++ b/target/linux/generic-2.6/files/drivers/ssb/pci.c
@@ -212,29 +212,29 @@ static inline u8 ssb_crc8(u8 crc, u8 data)
 	return t[crc ^ data];
 }
 
-static u8 ssb_sprom_crc(const u16 *sprom)
+static u8 ssb_sprom_crc(const u16 *sprom, u16 size)
 {
 	int word;
 	u8 crc = 0xFF;
 
-	for (word = 0; word < SSB_SPROMSIZE_WORDS - 1; word++) {
+	for (word = 0; word < size - 1; word++) {
 		crc = ssb_crc8(crc, sprom[word] & 0x00FF);
 		crc = ssb_crc8(crc, (sprom[word] & 0xFF00) >> 8);
 	}
-	crc = ssb_crc8(crc, sprom[SPOFF(SSB_SPROM_REVISION)] & 0x00FF);
+	crc = ssb_crc8(crc, sprom[size - 1] & 0x00FF);
 	crc ^= 0xFF;
 
 	return crc;
 }
 
-static int sprom_check_crc(const u16 *sprom)
+static int sprom_check_crc(const u16 *sprom, u16 size)
 {
 	u8 crc;
 	u8 expected_crc;
 	u16 tmp;
 
-	crc = ssb_sprom_crc(sprom);
-	tmp = sprom[SPOFF(SSB_SPROM_REVISION)] & SSB_SPROM_REVISION_CRC;
+	crc = ssb_sprom_crc(sprom, size);
+	tmp = sprom[size - 1] & SSB_SPROM_REVISION_CRC;
 	expected_crc = tmp >> SSB_SPROM_REVISION_CRC_SHIFT;
 	if (crc != expected_crc)
 		return -EPROTO;
@@ -246,8 +246,8 @@ static void sprom_do_read(struct ssb_bus *bus, u16 *sprom)
 {
 	int i;
 
-	for (i = 0; i < SSB_SPROMSIZE_WORDS; i++)
-		sprom[i] = readw(bus->mmio + SSB_SPROM_BASE + (i * 2));
+	for (i = 0; i < bus->sprom_size; i++)
+		sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
 }
 
 static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
@@ -255,6 +255,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
 	struct pci_dev *pdev = bus->host_pci;
 	int i, err;
 	u32 spromctl;
+	u16 size = bus->sprom_size;
 
 	ssb_printk(KERN_NOTICE PFX "Writing SPROM. Do NOT turn off the power! Please stand by...\n");
 	err = pci_read_config_dword(pdev, SSB_SPROMCTL, &spromctl);
@@ -266,12 +267,12 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
 		goto err_ctlreg;
 	ssb_printk(KERN_NOTICE PFX "[ 0%%");
 	msleep(500);
-	for (i = 0; i < SSB_SPROMSIZE_WORDS; i++) {
-		if (i == SSB_SPROMSIZE_WORDS / 4)
+	for (i = 0; i < size; i++) {
+		if (i == size / 4)
 			ssb_printk("25%%");
-		else if (i == SSB_SPROMSIZE_WORDS / 2)
+		else if (i == size / 2)
 			ssb_printk("50%%");
-		else if (i == (SSB_SPROMSIZE_WORDS / 4) * 3)
+		else if (i == (size * 3) / 4)
 			ssb_printk("75%%");
 		else if (i % 2)
 			ssb_printk(".");
@@ -296,24 +297,53 @@ err_ctlreg:
 	return err;
 }
 
-static void sprom_extract_r1(struct ssb_sprom_r1 *out, const u16 *in)
+static s8 r123_extract_antgain(u8 sprom_revision, const u16 *in,
+			       u16 mask, u16 shift)
+{
+	u16 v;
+	u8 gain;
+
+	v = in[SPOFF(SSB_SPROM1_AGAIN)];
+	gain = (v & mask) >> shift;
+	if (gain == 0xFF)
+		gain = 2; /* If unset use 2dBm */
+	if (sprom_revision == 1) {
+		/* Convert to Q5.2 */
+		gain <<= 2;
+	} else {
+		/* Q5.2 Fractional part is stored in 0xC0 */
+		gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
+	}
+
+	return (s8)gain;
+}
+
+static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
 {
 	int i;
 	u16 v;
+	s8 gain;
+	u16 loc[3];
 
-	SPEX(pci_spid, SSB_SPROM1_SPID, 0xFFFF, 0);
-	SPEX(pci_svid, SSB_SPROM1_SVID, 0xFFFF, 0);
-	SPEX(pci_pid, SSB_SPROM1_PID, 0xFFFF, 0);
+	if (out->revision == 3) {			/* rev 3 moved MAC */
+		loc[0] = SSB_SPROM3_IL0MAC;
+		loc[1] = SSB_SPROM3_ET0MAC;
+		loc[2] = SSB_SPROM3_ET1MAC;
+	} else {
+		loc[0] = SSB_SPROM1_IL0MAC;
+		loc[1] = SSB_SPROM1_ET0MAC;
+		loc[2] = SSB_SPROM1_ET1MAC;
+	}
 	for (i = 0; i < 3; i++) {
-		v = in[SPOFF(SSB_SPROM1_IL0MAC) + i];
+		v = in[SPOFF(loc[0]) + i];
 		*(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
 	}
 	for (i = 0; i < 3; i++) {
-		v = in[SPOFF(SSB_SPROM1_ET0MAC) + i];
+		v = in[SPOFF(loc[1]) + i];
 		*(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
 	}
 	for (i = 0; i < 3; i++) {
-		v = in[SPOFF(SSB_SPROM1_ET1MAC) + i];
+		v = in[SPOFF(loc[2]) + i];
 		*(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
 	}
 	SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
@@ -324,9 +354,9 @@ static void sprom_extract_r1(struct ssb_sprom_r1 *out, const u16 *in)
 	SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
 	SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
 	     SSB_SPROM1_BINF_CCODE_SHIFT);
-	SPEX(antenna_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
+	SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
 	     SSB_SPROM1_BINF_ANTA_SHIFT);
-	SPEX(antenna_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
+	SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
 	     SSB_SPROM1_BINF_ANTBG_SHIFT);
 	SPEX(pa0b0, SSB_SPROM1_PA0B0, 0xFFFF, 0);
 	SPEX(pa0b1, SSB_SPROM1_PA0B1, 0xFFFF, 0);
@@ -347,100 +377,108 @@ static void sprom_extract_r1(struct ssb_sprom_r1 *out, const u16 *in)
 	     SSB_SPROM1_ITSSI_A_SHIFT);
 	SPEX(itssi_bg, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_BG, 0);
 	SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
-	SPEX(antenna_gain_a, SSB_SPROM1_AGAIN, SSB_SPROM1_AGAIN_A, 0);
-	SPEX(antenna_gain_bg, SSB_SPROM1_AGAIN, SSB_SPROM1_AGAIN_BG,
-	     SSB_SPROM1_AGAIN_BG_SHIFT);
-	for (i = 0; i < 4; i++) {
-		v = in[SPOFF(SSB_SPROM1_OEM) + i];
-		*(((__le16 *)out->oem) + i) = cpu_to_le16(v);
-	}
+	if (out->revision >= 2)
+		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+
+	/* Extract the antenna gain values. */
+	gain = r123_extract_antgain(out->revision, in,
+				    SSB_SPROM1_AGAIN_BG,
+				    SSB_SPROM1_AGAIN_BG_SHIFT);
+	out->antenna_gain.ghz24.a0 = gain;
+	out->antenna_gain.ghz24.a1 = gain;
+	out->antenna_gain.ghz24.a2 = gain;
+	out->antenna_gain.ghz24.a3 = gain;
+	gain = r123_extract_antgain(out->revision, in,
+				    SSB_SPROM1_AGAIN_A,
+				    SSB_SPROM1_AGAIN_A_SHIFT);
+	out->antenna_gain.ghz5.a0 = gain;
+	out->antenna_gain.ghz5.a1 = gain;
+	out->antenna_gain.ghz5.a2 = gain;
+	out->antenna_gain.ghz5.a3 = gain;
 }
 
-static void sprom_extract_r2(struct ssb_sprom_r2 *out, const u16 *in)
+static void sprom_extract_r4(struct ssb_sprom *out, const u16 *in)
 {
 	int i;
 	u16 v;
 
-	SPEX(boardflags_hi, SSB_SPROM2_BFLHI,  0xFFFF, 0);
-	SPEX(maxpwr_a_hi, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_HI, 0);
-	SPEX(maxpwr_a_lo, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_LO,
-	     SSB_SPROM2_MAXP_A_LO_SHIFT);
-	SPEX(pa1lob0, SSB_SPROM2_PA1LOB0, 0xFFFF, 0);
-	SPEX(pa1lob1, SSB_SPROM2_PA1LOB1, 0xFFFF, 0);
-	SPEX(pa1lob2, SSB_SPROM2_PA1LOB2, 0xFFFF, 0);
-	SPEX(pa1hib0, SSB_SPROM2_PA1HIB0, 0xFFFF, 0);
-	SPEX(pa1hib1, SSB_SPROM2_PA1HIB1, 0xFFFF, 0);
-	SPEX(pa1hib2, SSB_SPROM2_PA1HIB2, 0xFFFF, 0);
-	SPEX(ofdm_pwr_off, SSB_SPROM2_OPO, SSB_SPROM2_OPO_VALUE, 0);
-	for (i = 0; i < 4; i++) {
-		v = in[SPOFF(SSB_SPROM2_CCODE) + i];
-		*(((__le16 *)out->country_str) + i) = cpu_to_le16(v);
+	/* extract the equivalent of the r1 variables */
+	for (i = 0; i < 3; i++) {
+		v = in[SPOFF(SSB_SPROM4_IL0MAC) + i];
+		*(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
 	}
+	for (i = 0; i < 3; i++) {
+		v = in[SPOFF(SSB_SPROM4_ET0MAC) + i];
+		*(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
+	}
+	for (i = 0; i < 3; i++) {
+		v = in[SPOFF(SSB_SPROM4_ET1MAC) + i];
+		*(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
+	}
+	SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
+	SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
+	     SSB_SPROM4_ETHPHY_ET1A_SHIFT);
+	SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
+	SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+	SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
+	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
+	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_BG,
+	     SSB_SPROM4_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_ITSSI_BG,
+	     SSB_SPROM4_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_ITSSI_A,
+	     SSB_SPROM4_ITSSI_A_SHIFT);
+	SPEX(gpio0, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P1,
+	     SSB_SPROM4_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P3,
+	     SSB_SPROM4_GPIOB_P3_SHIFT);
+
+	/* Extract the antenna gain values. */
+	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
+	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
+	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
+	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
+	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+	       sizeof(out->antenna_gain.ghz5));
+
+	/* TODO - get remaining rev 4 stuff needed */
 }
 
-static void sprom_extract_r3(struct ssb_sprom_r3 *out, const u16 *in)
-{
-	out->ofdmapo  = (in[SPOFF(SSB_SPROM3_OFDMAPO) + 0] & 0xFF00) >> 8;
-	out->ofdmapo |= (in[SPOFF(SSB_SPROM3_OFDMAPO) + 0] & 0x00FF) << 8;
-	out->ofdmapo <<= 16;
-	out->ofdmapo |= (in[SPOFF(SSB_SPROM3_OFDMAPO) + 1] & 0xFF00) >> 8;
-	out->ofdmapo |= (in[SPOFF(SSB_SPROM3_OFDMAPO) + 1] & 0x00FF) << 8;
-
-	out->ofdmalpo  = (in[SPOFF(SSB_SPROM3_OFDMALPO) + 0] & 0xFF00) >> 8;
-	out->ofdmalpo |= (in[SPOFF(SSB_SPROM3_OFDMALPO) + 0] & 0x00FF) << 8;
-	out->ofdmalpo <<= 16;
-	out->ofdmalpo |= (in[SPOFF(SSB_SPROM3_OFDMALPO) + 1] & 0xFF00) >> 8;
-	out->ofdmalpo |= (in[SPOFF(SSB_SPROM3_OFDMALPO) + 1] & 0x00FF) << 8;
-
-	out->ofdmahpo  = (in[SPOFF(SSB_SPROM3_OFDMAHPO) + 0] & 0xFF00) >> 8;
-	out->ofdmahpo |= (in[SPOFF(SSB_SPROM3_OFDMAHPO) + 0] & 0x00FF) << 8;
-	out->ofdmahpo <<= 16;
-	out->ofdmahpo |= (in[SPOFF(SSB_SPROM3_OFDMAHPO) + 1] & 0xFF00) >> 8;
-	out->ofdmahpo |= (in[SPOFF(SSB_SPROM3_OFDMAHPO) + 1] & 0x00FF) << 8;
-
-	SPEX(gpioldc_on_cnt, SSB_SPROM3_GPIOLDC, SSB_SPROM3_GPIOLDC_ON,
-	     SSB_SPROM3_GPIOLDC_ON_SHIFT);
-	SPEX(gpioldc_off_cnt, SSB_SPROM3_GPIOLDC, SSB_SPROM3_GPIOLDC_OFF,
-	     SSB_SPROM3_GPIOLDC_OFF_SHIFT);
-	SPEX(cckpo_1M, SSB_SPROM3_CCKPO, SSB_SPROM3_CCKPO_1M, 0);
-	SPEX(cckpo_2M, SSB_SPROM3_CCKPO, SSB_SPROM3_CCKPO_2M,
-	     SSB_SPROM3_CCKPO_2M_SHIFT);
-	SPEX(cckpo_55M, SSB_SPROM3_CCKPO, SSB_SPROM3_CCKPO_55M,
-	     SSB_SPROM3_CCKPO_55M_SHIFT);
-	SPEX(cckpo_11M, SSB_SPROM3_CCKPO, SSB_SPROM3_CCKPO_11M,
-	     SSB_SPROM3_CCKPO_11M_SHIFT);
-
-	out->ofdmgpo  = (in[SPOFF(SSB_SPROM3_OFDMGPO) + 0] & 0xFF00) >> 8;
-	out->ofdmgpo |= (in[SPOFF(SSB_SPROM3_OFDMGPO) + 0] & 0x00FF) << 8;
-	out->ofdmgpo <<= 16;
-	out->ofdmgpo |= (in[SPOFF(SSB_SPROM3_OFDMGPO) + 1] & 0xFF00) >> 8;
-	out->ofdmgpo |= (in[SPOFF(SSB_SPROM3_OFDMGPO) + 1] & 0x00FF) << 8;
-}
-
-static int sprom_extract(struct ssb_bus *bus,
-			 struct ssb_sprom *out, const u16 *in)
+static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
+			 const u16 *in, u16 size)
 {
 	memset(out, 0, sizeof(*out));
 
-	SPEX(revision, SSB_SPROM_REVISION, SSB_SPROM_REVISION_REV, 0);
-	SPEX(crc, SSB_SPROM_REVISION, SSB_SPROM_REVISION_CRC,
-	     SSB_SPROM_REVISION_CRC_SHIFT);
-
+	out->revision = in[size - 1] & 0x00FF;
+	ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
 	if ((bus->chip_id & 0xFF00) == 0x4400) {
 		/* Workaround: The BCM44XX chip has a stupid revision
 		 * number stored in the SPROM.
 		 * Always extract r1. */
-		sprom_extract_r1(&out->r1, in);
+		out->revision = 1;
+		sprom_extract_r123(out, in);
+	} else if (bus->chip_id == 0x4321) {
+		/* the BCM4328 has a chipid == 0x4321 and a rev 4 SPROM */
+		out->revision = 4;
+		sprom_extract_r4(out, in);
 	} else {
 		if (out->revision == 0)
 			goto unsupported;
-		if (out->revision >= 1 && out->revision <= 3)
-			sprom_extract_r1(&out->r1, in);
-		if (out->revision >= 2 && out->revision <= 3)
-			sprom_extract_r2(&out->r2, in);
-		if (out->revision == 3)
-			sprom_extract_r3(&out->r3, in);
-		if (out->revision >= 4)
+		if (out->revision >= 1 && out->revision <= 3) {
+			sprom_extract_r123(out, in);
+		}
+		if (out->revision == 4)
+			sprom_extract_r4(out, in);
+		if (out->revision >= 5)
 			goto unsupported;
 	}
 
@@ -448,7 +486,7 @@ static int sprom_extract(struct ssb_bus *bus,
 unsupported:
 	ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d "
 		   "detected. Will extract v1\n", out->revision);
-	sprom_extract_r1(&out->r1, in);
+	sprom_extract_r123(out, in);
 	return 0;
 }
 
@@ -458,16 +496,29 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
 	int err = -ENOMEM;
 	u16 *buf;
 
-	buf = kcalloc(SSB_SPROMSIZE_WORDS, sizeof(u16), GFP_KERNEL);
+	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
 	if (!buf)
 		goto out;
+	bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
 	sprom_do_read(bus, buf);
-	err = sprom_check_crc(buf);
+	err = sprom_check_crc(buf, bus->sprom_size);
 	if (err) {
-		ssb_printk(KERN_WARNING PFX
-			   "WARNING: Invalid SPROM CRC (corrupt SPROM)\n");
+		/* check for rev 4 sprom - has special signature */
+		if (buf[32] == 0x5372) {
+			kfree(buf);
+			buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+				      GFP_KERNEL);
+			if (!buf)
+				goto out;
+			bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
+			sprom_do_read(bus, buf);
+			err = sprom_check_crc(buf, bus->sprom_size);
+		}
+		if (err)
+			ssb_printk(KERN_WARNING PFX "WARNING: Invalid"
+				   " SPROM CRC (corrupt SPROM)\n");
 	}
-	err = sprom_extract(bus, sprom, buf);
+	err = sprom_extract(bus, sprom, buf, bus->sprom_size);
 
 	kfree(buf);
 out:
@@ -581,29 +632,28 @@ const struct ssb_bus_ops ssb_pci_ops = {
 	.write32	= ssb_pci_write32,
 };
 
-static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len)
+static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len, u16 size)
 {
 	int i, pos = 0;
 
-	for (i = 0; i < SSB_SPROMSIZE_WORDS; i++) {
+	for (i = 0; i < size; i++)
 		pos += snprintf(buf + pos, buf_len - pos - 1,
 				"%04X", swab16(sprom[i]) & 0xFFFF);
-	}
 	pos += snprintf(buf + pos, buf_len - pos - 1, "\n");
 
 	return pos + 1;
 }
 
-static int hex2sprom(u16 *sprom, const char *dump, size_t len)
+static int hex2sprom(u16 *sprom, const char *dump, size_t len, u16 size)
 {
 	char tmp[5] = { 0 };
 	int cnt = 0;
 	unsigned long parsed;
 
-	if (len < SSB_SPROMSIZE_BYTES * 2)
+	if (len < size * 2)
 		return -EINVAL;
 
-	while (cnt < SSB_SPROMSIZE_WORDS) {
+	while (cnt < size) {
 		memcpy(tmp, dump, 4);
 		dump += 4;
 		parsed = simple_strtoul(tmp, NULL, 16);
@@ -627,7 +677,7 @@ static ssize_t ssb_pci_attr_sprom_show(struct device *pcidev,
 	if (!bus)
 		goto out;
 	err = -ENOMEM;
-	sprom = kcalloc(SSB_SPROMSIZE_WORDS, sizeof(u16), GFP_KERNEL);
+	sprom = kcalloc(bus->sprom_size, sizeof(u16), GFP_KERNEL);
 	if (!sprom)
 		goto out;
 
@@ -640,7 +690,7 @@ static ssize_t ssb_pci_attr_sprom_show(struct device *pcidev,
 	sprom_do_read(bus, sprom);
 	mutex_unlock(&bus->pci_sprom_mutex);
 
-	count = sprom2hex(sprom, buf, PAGE_SIZE);
+	count = sprom2hex(sprom, buf, PAGE_SIZE, bus->sprom_size);
 	err = 0;
 
 out_kfree:
@@ -662,15 +712,15 @@ static ssize_t ssb_pci_attr_sprom_store(struct device *pcidev,
 	if (!bus)
 		goto out;
 	err = -ENOMEM;
-	sprom = kcalloc(SSB_SPROMSIZE_WORDS, sizeof(u16), GFP_KERNEL);
+	sprom = kcalloc(bus->sprom_size, sizeof(u16), GFP_KERNEL);
 	if (!sprom)
 		goto out;
-	err = hex2sprom(sprom, buf, count);
+	err = hex2sprom(sprom, buf, count, bus->sprom_size);
 	if (err) {
 		err = -EINVAL;
 		goto out_kfree;
 	}
-	err = sprom_check_crc(sprom);
+	err = sprom_check_crc(sprom, bus->sprom_size);
 	if (err) {
 		err = -EINVAL;
 		goto out_kfree;
diff --git a/target/linux/generic-2.6/files/drivers/ssb/pcmcia.c b/target/linux/generic-2.6/files/drivers/ssb/pcmcia.c
index 7c773603b..46816cda8 100644
--- a/target/linux/generic-2.6/files/drivers/ssb/pcmcia.c
+++ b/target/linux/generic-2.6/files/drivers/ssb/pcmcia.c
@@ -10,6 +10,7 @@
 
 #include <linux/ssb/ssb.h>
 #include <linux/delay.h>
+#include <linux/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
@@ -62,17 +63,17 @@ int ssb_pcmcia_switch_coreidx(struct ssb_bus *bus,
 		err = pcmcia_access_configuration_register(pdev, &reg);
 		if (err != CS_SUCCESS)
 			goto error;
-		read_addr |= (reg.Value & 0xF) << 12;
+		read_addr |= ((u32)(reg.Value & 0x0F)) << 12;
 		reg.Offset = 0x30;
 		err = pcmcia_access_configuration_register(pdev, &reg);
 		if (err != CS_SUCCESS)
 			goto error;
-		read_addr |= reg.Value << 16;
+		read_addr |= ((u32)reg.Value) << 16;
 		reg.Offset = 0x32;
 		err = pcmcia_access_configuration_register(pdev, &reg);
 		if (err != CS_SUCCESS)
 			goto error;
-		read_addr |= reg.Value << 24;
+		read_addr |= ((u32)reg.Value) << 24;
 
 		cur_core = (read_addr - SSB_ENUM_BASE) / SSB_CORE_SIZE;
 		if (cur_core == coreidx)
@@ -93,7 +94,6 @@ int ssb_pcmcia_switch_core(struct ssb_bus *bus,
 			   struct ssb_device *dev)
 {
 	int err;
-	unsigned long flags;
 
 #if SSB_VERBOSE_PCMCIACORESWITCH_DEBUG
 	ssb_printk(KERN_INFO PFX
@@ -102,11 +102,9 @@ int ssb_pcmcia_switch_core(struct ssb_bus *bus,
 		   dev->core_index);
 #endif
 
-	spin_lock_irqsave(&bus->bar_lock, flags);
 	err = ssb_pcmcia_switch_coreidx(bus, dev->core_index);
 	if (!err)
 		bus->mapped_device = dev;
-	spin_unlock_irqrestore(&bus->bar_lock, flags);
 
 	return err;
 }
@@ -114,14 +112,12 @@ int ssb_pcmcia_switch_core(struct ssb_bus *bus,
 int ssb_pcmcia_switch_segment(struct ssb_bus *bus, u8 seg)
 {
 	int attempts = 0;
-	unsigned long flags;
 	conf_reg_t reg;
-	int res, err = 0;
+	int res;
 
 	SSB_WARN_ON((seg != 0) && (seg != 1));
 	reg.Offset = 0x34;
 	reg.Function = 0;
-	spin_lock_irqsave(&bus->bar_lock, flags);
 	while (1) {
 		reg.Action = CS_WRITE;
 		reg.Value = seg;
@@ -142,37 +138,36 @@ int ssb_pcmcia_switch_segment(struct ssb_bus *bus, u8 seg)
 		udelay(10);
 	}
 	bus->mapped_pcmcia_seg = seg;
-out_unlock:
-	spin_unlock_irqrestore(&bus->bar_lock, flags);
-	return err;
+
+	return 0;
 error:
 	ssb_printk(KERN_ERR PFX "Failed to switch pcmcia segment\n");
-	err = -ENODEV;
-	goto out_unlock;
+	return -ENODEV;
 }
 
-/* These are the main device register access functions.
- * do_select_core is inline to have the likely hotpath inline.
- * All unlikely codepaths are out-of-line. */
-static inline int do_select_core(struct ssb_bus *bus,
-				 struct ssb_device *dev,
-				 u16 *offset)
+static int select_core_and_segment(struct ssb_device *dev,
+				   u16 *offset)
 {
+	struct ssb_bus *bus = dev->bus;
 	int err;
-	u8 need_seg = (*offset >= 0x800) ? 1 : 0;
+	u8 need_segment;
+
+	if (*offset >= 0x800) {
+		*offset -= 0x800;
+		need_segment = 1;
+	} else
+		need_segment = 0;
 
 	if (unlikely(dev != bus->mapped_device)) {
 		err = ssb_pcmcia_switch_core(bus, dev);
 		if (unlikely(err))
 			return err;
 	}
-	if (unlikely(need_seg != bus->mapped_pcmcia_seg)) {
-		err = ssb_pcmcia_switch_segment(bus, need_seg);
+	if (unlikely(need_segment != bus->mapped_pcmcia_seg)) {
+		err = ssb_pcmcia_switch_segment(bus, need_segment);
 		if (unlikely(err))
 			return err;
 	}
-	if (need_seg == 1)
-		*offset -= 0x800;
 
 	return 0;
 }
@@ -180,46 +175,65 @@ static inline int do_select_core(struct ssb_bus *bus,
 static u16 ssb_pcmcia_read16(struct ssb_device *dev, u16 offset)
 {
 	struct ssb_bus *bus = dev->bus;
-	u16 x;
+	unsigned long flags;
+	int err;
+	u16 value = 0xFFFF;
 
-	if (unlikely(do_select_core(bus, dev, &offset)))
-		return 0xFFFF;
-	x = readw(bus->mmio + offset);
+	spin_lock_irqsave(&bus->bar_lock, flags);
+	err = select_core_and_segment(dev, &offset);
+	if (likely(!err))
+		value = readw(bus->mmio + offset);
+	spin_unlock_irqrestore(&bus->bar_lock, flags);
 
-	return x;
+	return value;
 }
 
 static u32 ssb_pcmcia_read32(struct ssb_device *dev, u16 offset)
 {
 	struct ssb_bus *bus = dev->bus;
-	u32 x;
+	unsigned long flags;
+	int err;
+	u32 lo = 0xFFFFFFFF, hi = 0xFFFFFFFF;
 
-	if (unlikely(do_select_core(bus, dev, &offset)))
-		return 0xFFFFFFFF;
-	x = readl(bus->mmio + offset);
+	spin_lock_irqsave(&bus->bar_lock, flags);
+	err = select_core_and_segment(dev, &offset);
+	if (likely(!err)) {
+		lo = readw(bus->mmio + offset);
+		hi = readw(bus->mmio + offset + 2);
+	}
+	spin_unlock_irqrestore(&bus->bar_lock, flags);
 
-	return x;
+	return (lo | (hi << 16));
 }
 
 static void ssb_pcmcia_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
 	struct ssb_bus *bus = dev->bus;
+	unsigned long flags;
+	int err;
 
-	if (unlikely(do_select_core(bus, dev, &offset)))
-		return;
-	writew(value, bus->mmio + offset);
+	spin_lock_irqsave(&bus->bar_lock, flags);
+	err = select_core_and_segment(dev, &offset);
+	if (likely(!err))
+		writew(value, bus->mmio + offset);
+	mmiowb();
+	spin_unlock_irqrestore(&bus->bar_lock, flags);
 }
 
 static void ssb_pcmcia_write32(struct ssb_device *dev, u16 offset, u32 value)
 {
 	struct ssb_bus *bus = dev->bus;
+	unsigned long flags;
+	int err;
 
-	if (unlikely(do_select_core(bus, dev, &offset)))
-		return;
-	readw(bus->mmio + offset);
-	writew(value >> 16, bus->mmio + offset + 2);
-	readw(bus->mmio + offset);
-	writew(value, bus->mmio + offset);
+	spin_lock_irqsave(&bus->bar_lock, flags);
+	err = select_core_and_segment(dev, &offset);
+	if (likely(!err)) {
+		writew((value & 0x0000FFFF), bus->mmio + offset);
+		writew(((value & 0xFFFF0000) >> 16), bus->mmio + offset + 2);
+	}
+	mmiowb();
+	spin_unlock_irqrestore(&bus->bar_lock, flags);
 }
 
 /* Not "static", as it's used in main.c */
@@ -230,10 +244,12 @@ const struct ssb_bus_ops ssb_pcmcia_ops = {
 	.write32	= ssb_pcmcia_write32,
 };
 
+#include <linux/etherdevice.h>
 int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
 			      struct ssb_init_invariants *iv)
 {
 	//TODO
+	random_ether_addr(iv->sprom.il0mac);
 	return 0;
 }
 
diff --git a/target/linux/generic-2.6/files/drivers/ssb/scan.c b/target/linux/generic-2.6/files/drivers/ssb/scan.c
index 96258c609..63ee5cfbe 100644
--- a/target/linux/generic-2.6/files/drivers/ssb/scan.c
+++ b/target/linux/generic-2.6/files/drivers/ssb/scan.c
@@ -388,6 +388,17 @@ int ssb_bus_scan(struct ssb_bus *bus,
 		case SSB_DEV_PCI:
 		case SSB_DEV_PCIE:
 #ifdef CONFIG_SSB_DRIVER_PCICORE
+			if (bus->bustype == SSB_BUSTYPE_PCI) {
+				/* Ignore PCI cores on PCI-E cards.
+				 * Ignore PCI-E cores on PCI cards. */
+				if (dev->id.coreid == SSB_DEV_PCI) {
+					if (bus->host_pci->is_pcie)
+						continue;
+				} else {
+					if (!bus->host_pci->is_pcie)
+						continue;
+				}
+			}
 			if (bus->pcicore.dev) {
 				ssb_printk(KERN_WARNING PFX
 					   "WARNING: Multiple PCI(E) cores found\n");
diff --git a/target/linux/generic-2.6/files/include/linux/ssb/ssb.h b/target/linux/generic-2.6/files/include/linux/ssb/ssb.h
index 2b5c312c4..9d5da8b2c 100644
--- a/target/linux/generic-2.6/files/include/linux/ssb/ssb.h
+++ b/target/linux/generic-2.6/files/include/linux/ssb/ssb.h
@@ -15,22 +15,19 @@ struct pcmcia_device;
 struct ssb_bus;
 struct ssb_driver;
 
-
-struct ssb_sprom_r1 {
-	u16 pci_spid;		/* Subsystem Product ID for PCI */
-	u16 pci_svid;		/* Subsystem Vendor ID for PCI */
-	u16 pci_pid;		/* Product ID for PCI */
+struct ssb_sprom {
+	u8 revision;
 	u8 il0mac[6];		/* MAC address for 802.11b/g */
 	u8 et0mac[6];		/* MAC address for Ethernet */
 	u8 et1mac[6];		/* MAC address for 802.11a */
-	u8 et0phyaddr:5;	/* MII address for enet0 */
-	u8 et1phyaddr:5;	/* MII address for enet1 */
-	u8 et0mdcport:1;	/* MDIO for enet0 */
-	u8 et1mdcport:1;	/* MDIO for enet1 */
-	u8 board_rev;		/* Board revision */
-	u8 country_code:4;	/* Country Code */
-	u8 antenna_a:2;		/* Antenna 0/1 available for A-PHY */
-	u8 antenna_bg:2;	/* Antenna 0/1 available for B-PHY and G-PHY */
+	u8 et0phyaddr;		/* MII address for enet0 */
+	u8 et1phyaddr;		/* MII address for enet1 */
+	u8 et0mdcport;		/* MDIO for enet0 */
+	u8 et1mdcport;		/* MDIO for enet1 */
+	u8 board_rev;		/* Board revision number from SPROM. */
+	u8 country_code;	/* Country Code */
+	u8 ant_available_a;	/* A-PHY antenna available bits (up to 4) */
+	u8 ant_available_bg;	/* B/G-PHY antenna available bits (up to 4) */
 	u16 pa0b0;
 	u16 pa0b1;
 	u16 pa0b2;
@@ -41,61 +38,26 @@ struct ssb_sprom_r1 {
 	u8 gpio1;		/* GPIO pin 1 */
 	u8 gpio2;		/* GPIO pin 2 */
 	u8 gpio3;		/* GPIO pin 3 */
-	u16 maxpwr_a;		/* A-PHY Power Amplifier Max Power (in dBm Q5.2) */
-	u16 maxpwr_bg;		/* B/G-PHY Power Amplifier Max Power (in dBm Q5.2) */
+	u16 maxpwr_a;		/* A-PHY Amplifier Max Power (in dBm Q5.2) */
+	u16 maxpwr_bg;		/* B/G-PHY Amplifier Max Power (in dBm Q5.2) */
 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
 	u16 boardflags_lo;	/* Boardflags (low 16 bits) */
-	u8 antenna_gain_a;	/* A-PHY Antenna gain (in dBm Q5.2) */
-	u8 antenna_gain_bg;	/* B/G-PHY Antenna gain (in dBm Q5.2) */
-	u8 oem[8];		/* OEM string (rev 1 only) */
-};
-
-struct ssb_sprom_r2 {
 	u16 boardflags_hi;	/* Boardflags (high 16 bits) */
-	u8 maxpwr_a_lo;		/* A-PHY Max Power Low */
-	u8 maxpwr_a_hi;		/* A-PHY Max Power High */
-	u16 pa1lob0;		/* A-PHY PA Low Settings */
-	u16 pa1lob1;		/* A-PHY PA Low Settings */
-	u16 pa1lob2;		/* A-PHY PA Low Settings */
-	u16 pa1hib0;		/* A-PHY PA High Settings */
-	u16 pa1hib1;		/* A-PHY PA High Settings */
-	u16 pa1hib2;		/* A-PHY PA High Settings */
-	u8 ofdm_pwr_off;	/* OFDM Power Offset from CCK Level */
-	u8 country_str[2];	/* Two char Country Code */
-};
 
-struct ssb_sprom_r3 {
-	u32 ofdmapo;		/* A-PHY OFDM Mid Power Offset */
-	u32 ofdmalpo;		/* A-PHY OFDM Low Power Offset */
-	u32 ofdmahpo;		/* A-PHY OFDM High Power Offset */
-	u8 gpioldc_on_cnt;	/* GPIO LED Powersave Duty Cycle ON count */
-	u8 gpioldc_off_cnt;	/* GPIO LED Powersave Duty Cycle OFF count */
-	u8 cckpo_1M:4;		/* CCK Power Offset for Rate 1M */
-	u8 cckpo_2M:4;		/* CCK Power Offset for Rate 2M */
-	u8 cckpo_55M:4;		/* CCK Power Offset for Rate 5.5M */
-	u8 cckpo_11M:4;		/* CCK Power Offset for Rate 11M */
-	u32 ofdmgpo;		/* G-PHY OFDM Power Offset */
-};
-
-struct ssb_sprom_r4 {
-	/* TODO */
-};
-
-struct ssb_sprom {
-	u8 revision;
-	u8 crc;
-	/* The valid r# fields are selected by the "revision".
-	 * Revision 3 and lower inherit from lower revisions.
-	 */
-	union {
+	/* Antenna gain values for up to 4 antennas
+	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
+	 * loss in the connectors is bigger than the gain. */
+	struct {
+		struct {
+			s8 a0, a1, a2, a3;
+		} ghz24;	/* 2.4GHz band */
 		struct {
-			struct ssb_sprom_r1 r1;
-			struct ssb_sprom_r2 r2;
-			struct ssb_sprom_r3 r3;
-		};
-		struct ssb_sprom_r4 r4;
-	};
+			s8 a0, a1, a2, a3;
+		} ghz5;		/* 5GHz band */
+	} antenna_gain;
+
+	/* TODO - add any parameters needed from rev 2, 3, or 4 SPROMs */
 };
 
 /* Information about the PCB the circuitry is soldered on. */
@@ -270,7 +232,8 @@ struct ssb_bus {
 	struct ssb_device *mapped_device;
 	/* Currently mapped PCMCIA segment. (bustype == SSB_BUSTYPE_PCMCIA only) */
 	u8 mapped_pcmcia_seg;
-	/* Lock for core and segment switching. */
+	/* Lock for core and segment switching.
+	 * On PCMCIA-host busses this is used to protect the whole MMIO access. */
 	spinlock_t bar_lock;
 
 	/* The bus this backplane is running on. */
@@ -288,6 +251,7 @@ struct ssb_bus {
 	/* ID information about the Chip. */
 	u16 chip_id;
 	u16 chip_rev;
+	u16 sprom_size;		/* number of words in sprom */
 	u8 chip_package;
 
 	/* List of devices (cores) on the backplane. */
@@ -402,6 +366,22 @@ static inline void ssb_pcihost_unregister(struct pci_driver *driver)
 {
 	pci_unregister_driver(driver);
 }
+
+static inline
+void ssb_pcihost_set_power_state(struct ssb_device *sdev, pci_power_t state)
+{
+	if (sdev->bus->bustype == SSB_BUSTYPE_PCI)
+		pci_set_power_state(sdev->bus->host_pci, state);
+}
+#else
+static inline void ssb_pcihost_unregister(struct pci_driver *driver)
+{
+}
+
+static inline
+void ssb_pcihost_set_power_state(struct ssb_device *sdev, pci_power_t state)
+{
+}
 #endif /* CONFIG_SSB_PCIHOST */
 
 
diff --git a/target/linux/generic-2.6/files/include/linux/ssb/ssb_regs.h b/target/linux/generic-2.6/files/include/linux/ssb/ssb_regs.h
index 47c7c71a5..ebad0bac9 100644
--- a/target/linux/generic-2.6/files/include/linux/ssb/ssb_regs.h
+++ b/target/linux/generic-2.6/files/include/linux/ssb/ssb_regs.h
@@ -147,6 +147,10 @@
 #define  SSB_IDLOW_SSBREV	0xF0000000 /* Sonics Backplane Revision code */
 #define  SSB_IDLOW_SSBREV_22	0x00000000 /* <= 2.2 */
 #define  SSB_IDLOW_SSBREV_23	0x10000000 /* 2.3 */
+#define  SSB_IDLOW_SSBREV_24	0x40000000 /* ?? Found in BCM4328 */
+#define  SSB_IDLOW_SSBREV_25	0x50000000 /* ?? Not Found yet */
+#define  SSB_IDLOW_SSBREV_26	0x60000000 /* ?? Found in some BCM4311/2 */
+#define  SSB_IDLOW_SSBREV_27	0x70000000 /* ?? Found in some BCM4311/2 */
 #define SSB_IDHIGH		0x0FFC     /* SB Identification High */
 #define  SSB_IDHIGH_RCLO	0x0000000F /* Revision Code (low part) */
 #define  SSB_IDHIGH_CC		0x00008FF0 /* Core Code */
@@ -162,11 +166,16 @@
  */
 #define SSB_SPROMSIZE_WORDS		64
 #define SSB_SPROMSIZE_BYTES		(SSB_SPROMSIZE_WORDS * sizeof(u16))
+#define SSB_SPROMSIZE_WORDS_R123	64
+#define SSB_SPROMSIZE_WORDS_R4		220
+#define SSB_SPROMSIZE_BYTES_R123	(SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
+#define SSB_SPROMSIZE_BYTES_R4		(SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
 #define SSB_SPROM_BASE			0x1000
 #define SSB_SPROM_REVISION		0x107E
 #define  SSB_SPROM_REVISION_REV		0x00FF	/* SPROM Revision number */
 #define  SSB_SPROM_REVISION_CRC		0xFF00	/* SPROM CRC8 value */
 #define  SSB_SPROM_REVISION_CRC_SHIFT	8
+
 /* SPROM Revision 1 */
 #define SSB_SPROM1_SPID			0x1004	/* Subsystem Product ID for PCI */
 #define SSB_SPROM1_SVID			0x1006	/* Subsystem Vendor ID for PCI */
@@ -184,10 +193,10 @@
 #define  SSB_SPROM1_BINF_BREV		0x00FF	/* Board Revision */
 #define  SSB_SPROM1_BINF_CCODE		0x0F00	/* Country Code */
 #define  SSB_SPROM1_BINF_CCODE_SHIFT	8
-#define  SSB_SPROM1_BINF_ANTA		0x3000	/* Available A-PHY antennas */
-#define  SSB_SPROM1_BINF_ANTA_SHIFT	12
-#define  SSB_SPROM1_BINF_ANTBG		0xC000	/* Available B-PHY antennas */
-#define  SSB_SPROM1_BINF_ANTBG_SHIFT	14
+#define  SSB_SPROM1_BINF_ANTBG		0x3000	/* Available B-PHY and G-PHY antennas */
+#define  SSB_SPROM1_BINF_ANTBG_SHIFT	12
+#define  SSB_SPROM1_BINF_ANTA		0xC000	/* Available A-PHY antennas */
+#define  SSB_SPROM1_BINF_ANTA_SHIFT	14
 #define SSB_SPROM1_PA0B0		0x105E
 #define SSB_SPROM1_PA0B1		0x1060
 #define SSB_SPROM1_PA0B2		0x1062
@@ -212,10 +221,11 @@
 #define  SSB_SPROM1_ITSSI_A_SHIFT	8
 #define SSB_SPROM1_BFLLO		0x1072	/* Boardflags (low 16 bits) */
 #define SSB_SPROM1_AGAIN		0x1074	/* Antenna Gain (in dBm Q5.2) */
-#define  SSB_SPROM1_AGAIN_A		0x00FF	/* A-PHY */
-#define  SSB_SPROM1_AGAIN_BG		0xFF00	/* B-PHY and G-PHY */
-#define  SSB_SPROM1_AGAIN_BG_SHIFT	8
-#define SSB_SPROM1_OEM			0x1076	/* 8 bytes OEM string (rev 1 only) */
+#define  SSB_SPROM1_AGAIN_BG		0x00FF	/* B-PHY and G-PHY */
+#define  SSB_SPROM1_AGAIN_BG_SHIFT	0
+#define  SSB_SPROM1_AGAIN_A		0xFF00	/* A-PHY */
+#define  SSB_SPROM1_AGAIN_A_SHIFT	8
+
 /* SPROM Revision 2 (inherits from rev 1) */
 #define SSB_SPROM2_BFLHI		0x1038	/* Boardflags (high 16 bits) */
 #define SSB_SPROM2_MAXP_A		0x103A	/* A-PHY Max Power */
@@ -232,7 +242,11 @@
 #define  SSB_SPROM2_OPO_VALUE		0x00FF
 #define  SSB_SPROM2_OPO_UNUSED		0xFF00
 #define SSB_SPROM2_CCODE		0x107C	/* Two char Country Code */
-/* SPROM Revision 3 (inherits from rev 2) */
+
+/* SPROM Revision 3 (inherits most data from rev 2) */
+#define SSB_SPROM3_IL0MAC		0x104A	/* 6 bytes MAC address for 802.11b/g */
+#define SSB_SPROM3_ET0MAC		0x1050	/* 6 bytes MAC address for Ethernet ?? */
+#define SSB_SPROM3_ET1MAC		0x1050	/* 6 bytes MAC address for 802.11a ?? */
 #define SSB_SPROM3_OFDMAPO		0x102C	/* A-PHY OFDM Mid Power Offset (4 bytes, BigEndian) */
 #define SSB_SPROM3_OFDMALPO		0x1030	/* A-PHY OFDM Low Power Offset (4 bytes, BigEndian) */
 #define SSB_SPROM3_OFDMAHPO		0x1034	/* A-PHY OFDM High Power Offset (4 bytes, BigEndian) */
@@ -251,6 +265,57 @@
 #define  SSB_SPROM3_CCKPO_11M_SHIFT	12
 #define  SSB_SPROM3_OFDMGPO		0x107A	/* G-PHY OFDM Power Offset (4 bytes, BigEndian) */
 
+/* SPROM Revision 4 */
+#define SSB_SPROM4_IL0MAC		0x104C	/* 6 byte MAC address for a/b/g/n */
+#define SSB_SPROM4_ET0MAC		0x1018	/* 6 bytes MAC address for Ethernet ?? */
+#define SSB_SPROM4_ET1MAC		0x1018	/* 6 bytes MAC address for 802.11a ?? */
+#define SSB_SPROM4_ETHPHY		0x105A	/* Ethernet PHY settings ?? */
+#define  SSB_SPROM4_ETHPHY_ET0A		0x001F	/* MII Address for enet0 */
+#define  SSB_SPROM4_ETHPHY_ET1A		0x03E0	/* MII Address for enet1 */
+#define  SSB_SPROM4_ETHPHY_ET1A_SHIFT	5
+#define  SSB_SPROM4_ETHPHY_ET0M		(1<<14)	/* MDIO for enet0 */
+#define  SSB_SPROM4_ETHPHY_ET1M		(1<<15)	/* MDIO for enet1 */
+#define SSB_SPROM4_CCODE		0x1052	/* Country Code (2 bytes) */
+#define SSB_SPROM4_ANTAVAIL		0x105D  /* Antenna available bitfields */
+#define SSB_SPROM4_ANTAVAIL_A		0x00FF	/* A-PHY bitfield */
+#define SSB_SPROM4_ANTAVAIL_A_SHIFT	0
+#define SSB_SPROM4_ANTAVAIL_BG		0xFF00	/* B-PHY and G-PHY bitfield */
+#define SSB_SPROM4_ANTAVAIL_BG_SHIFT	8
+#define SSB_SPROM4_BFLLO		0x1044	/* Boardflags (low 16 bits) */
+#define SSB_SPROM4_AGAIN01		0x105E	/* Antenna Gain (in dBm Q5.2) */
+#define  SSB_SPROM4_AGAIN0		0x00FF	/* Antenna 0 */
+#define  SSB_SPROM4_AGAIN0_SHIFT	0
+#define  SSB_SPROM4_AGAIN1		0xFF00	/* Antenna 1 */
+#define  SSB_SPROM4_AGAIN1_SHIFT	8
+#define SSB_SPROM4_AGAIN23		0x1060
+#define  SSB_SPROM4_AGAIN2		0x00FF	/* Antenna 2 */
+#define  SSB_SPROM4_AGAIN2_SHIFT	0
+#define  SSB_SPROM4_AGAIN3		0xFF00	/* Antenna 3 */
+#define  SSB_SPROM4_AGAIN3_SHIFT	8
+#define SSB_SPROM4_BFLHI		0x1046  /* Board Flags Hi */
+#define SSB_SPROM4_MAXP_BG		0x1080  /* Max Power BG in path 1 */
+#define  SSB_SPROM4_MAXP_BG_MASK	0x00FF  /* Mask for Max Power BG */
+#define  SSB_SPROM4_ITSSI_BG		0xFF00	/* Mask for path 1 itssi_bg */
+#define  SSB_SPROM4_ITSSI_BG_SHIFT	8
+#define SSB_SPROM4_MAXP_A		0x108A  /* Max Power A in path 1 */
+#define  SSB_SPROM4_MAXP_A_MASK		0x00FF  /* Mask for Max Power A */
+#define  SSB_SPROM4_ITSSI_A		0xFF00	/* Mask for path 1 itssi_a */
+#define  SSB_SPROM4_ITSSI_A_SHIFT	8
+#define SSB_SPROM4_GPIOA		0x1056	/* Gen. Purpose IO # 0 and 1 */
+#define  SSB_SPROM4_GPIOA_P0		0x00FF	/* Pin 0 */
+#define  SSB_SPROM4_GPIOA_P1		0xFF00	/* Pin 1 */
+#define  SSB_SPROM4_GPIOA_P1_SHIFT	8
+#define SSB_SPROM4_GPIOB		0x1058	/* Gen. Purpose IO # 2 and 3 */
+#define  SSB_SPROM4_GPIOB_P2		0x00FF	/* Pin 2 */
+#define  SSB_SPROM4_GPIOB_P3		0xFF00	/* Pin 3 */
+#define  SSB_SPROM4_GPIOB_P3_SHIFT	8
+#define SSB_SPROM4_PA0B0		0x1082	/* The paXbY locations are */
+#define SSB_SPROM4_PA0B1		0x1084	/*   only guesses */
+#define SSB_SPROM4_PA0B2		0x1086
+#define SSB_SPROM4_PA1B0		0x108E
+#define SSB_SPROM4_PA1B1		0x1090
+#define SSB_SPROM4_PA1B2		0x1092
+
 /* Values for SSB_SPROM1_BINF_CCODE */
 enum {
 	SSB_SPROM1CCODE_WORLD = 0,